www.itwbooking.bjquwhcm.com Open in urlscan Pro
50.31.134.90 Public Scan

Go To Rescan
Add Verdict Report

URL:
https://www.itwbooking.bjquwhcm.com/
Submission: On October 17 via automatic, source certstream-suspicious (October 17th 2019, 11:17:47 am UTC)

Summary HTTP 286 Redirects Links 12 Behaviour Indicators

Summary

This website contacted 57 IPs in 9 countries across 48 domains to perform 286 HTTP transactions. The main IP is 50.31.134.90, located in Chicago, United States and belongs to SERVERCENTRAL - Server Central Network, US. The main domain is www.itwbooking.bjquwhcm.com.
TLS certificate: Issued by Let's Encrypt Authority X3 on October 17th 2019. Valid for: 3 months.

This is the only time www.itwbooking.bjquwhcm.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
79	50.31.134.90 50.31.134.90	23352 (SERVERCEN...) (SERVERCENTRAL - Server Central Network)
3	2a00:1450:400... 2a00:1450:4001:821::200a	15169 (GOOGLE) (GOOGLE - Google LLC)
6	13.225.78.50 13.225.78.50	16509 (AMAZON-02) (AMAZON-02 - Amazon.com)
1	2606:4700:30:... 2606:4700:30::681c:c3d	13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare)
13	172.217.16.162 172.217.16.162	15169 (GOOGLE) (GOOGLE - Google LLC)
1	2a00:1450:400... 2a00:1450:4001:815::2002	15169 (GOOGLE) (GOOGLE - Google LLC)
1	2a00:1450:400... 2a00:1450:4001:800::2002	15169 (GOOGLE) (GOOGLE - Google LLC)
3	151.101.13.182 151.101.13.182	54113 (FASTLY) (FASTLY - Fastly)
7	94.31.29.64 94.31.29.64	33438 (HIGHWINDS2) (HIGHWINDS2 - Highwinds Network Group)
5	2a00:1450:400... 2a00:1450:4001:825::2003	15169 (GOOGLE) (GOOGLE - Google LLC)
2	2606:4700:10:... 2606:4700:10::6814:33ae	13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare)
2 7	2.19.43.224 2.19.43.224	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1 2	35.190.59.101 35.190.59.101	15169 (GOOGLE) (GOOGLE - Google LLC)
5	151.139.128.10 151.139.128.10	20446 (HIGHWINDS3) (HIGHWINDS3 - Highwinds Network Group)
1	35.190.40.172 35.190.40.172	15169 (GOOGLE) (GOOGLE - Google LLC)
5 5	63.33.115.128 63.33.115.128	16509 (AMAZON-02) (AMAZON-02 - Amazon.com)
3 3	147.75.102.200 147.75.102.200	54825 (PACKET) (PACKET - Packet Host)
1	143.204.101.34 143.204.101.34	16509 (AMAZON-02) (AMAZON-02 - Amazon.com)
2	151.101.113.194 151.101.113.194	54113 (FASTLY) (FASTLY - Fastly)
8	37.252.161.184 37.252.161.184	29990 (ASN-APPNEXUS) (ASN-APPNEXUS - AppNexus)
7	2.18.234.21 2.18.234.21	16625 (AKAMAI-AS) (AKAMAI-AS - Akamai Technologies)
8	2.18.232.7 2.18.232.7	16625 (AKAMAI-AS) (AKAMAI-AS - Akamai Technologies)
7	185.64.189.112 185.64.189.112	62713 (AS-PUBMATIC) (AS-PUBMATIC - PubMatic)
6	34.95.120.147 34.95.120.147	15169 (GOOGLE) (GOOGLE - Google LLC)
7	178.162.133.150 178.162.133.150	60781 (LEASEWEB-...) (LEASEWEB-NL-AMS-01 Netherlands)
7	178.250.2.152 178.250.2.152	44788 (ASN-CRITE...) (ASN-CRITEO-EUROPE)
7	69.173.144.141 69.173.144.141	26667 (RUBICONPR...) (RUBICONPROJECT - The Rubicon Project)
7	104.16.190.66 104.16.190.66	13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare)
3	54.67.106.161 54.67.106.161	16509 (AMAZON-02) (AMAZON-02 - Amazon.com)
7	52.58.198.43 52.58.198.43	16509 (AMAZON-02) (AMAZON-02 - Amazon.com)
7	72.251.249.14 72.251.249.14	29791 (VOXEL-DOT...) (VOXEL-DOT-NET - Internap Corporation)
14	185.33.223.216 185.33.223.216	29990 (ASN-APPNEXUS) (ASN-APPNEXUS - AppNexus)
2	54.76.37.45 54.76.37.45	16509 (AMAZON-02) (AMAZON-02 - Amazon.com)
2	35.201.67.47 35.201.67.47	15169 (GOOGLE) (GOOGLE - Google LLC)
2 2	54.76.79.46 54.76.79.46	16509 (AMAZON-02) (AMAZON-02 - Amazon.com)
1	2a00:1450:400... 2a00:1450:4001:80b::200e	15169 (GOOGLE) (GOOGLE - Google LLC)
1	2a00:1450:400... 2a00:1450:400c:c04::9d	15169 (GOOGLE) (GOOGLE - Google LLC)
2	52.51.196.221 52.51.196.221	16509 (AMAZON-02) (AMAZON-02 - Amazon.com)
7	2a00:1450:400... 2a00:1450:4001:81f::2001	15169 (GOOGLE) (GOOGLE - Google LLC)
9	2a00:1450:400... 2a00:1450:4001:821::2001	15169 (GOOGLE) (GOOGLE - Google LLC)
1	2a00:1450:400... 2a00:1450:4001:800::2004	15169 (GOOGLE) (GOOGLE - Google LLC)
2	2a00:1450:400... 2a00:1450:4001:81c::2002	15169 (GOOGLE) (GOOGLE - Google LLC)
1	185.80.38.195 185.80.38.195	27381 (CASALE-MEDIA) (CASALE-MEDIA - Index Exchange Inc.)
3	185.29.133.52 185.29.133.52	30419 (MEDIAMATH...) (MEDIAMATH-INC - MediaMath Inc)
1	18.195.61.72 18.195.61.72	16509 (AMAZON-02) (AMAZON-02 - Amazon.com)
1	136.243.51.232 136.243.51.232	24940 (HETZNER-AS) (HETZNER-AS)
1	2.18.233.201 2.18.233.201	16625 (AKAMAI-AS) (AKAMAI-AS - Akamai Technologies)
1 3	136.243.54.219 136.243.54.219	24940 (HETZNER-AS) (HETZNER-AS)
1 1	104.109.83.210 104.109.83.210	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1	2606:4700:30:... 2606:4700:30::681b:b368	13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare)
1	2606:4700::68... 2606:4700::6810:a727	13335 (CLOUDFLAR...) (CLOUDFLARENET - Cloudflare)
2 4	195.216.249.67 195.216.249.67	47268 (ZANOX) (ZANOX)
1 1	85.10.231.199 85.10.231.199	24940 (HETZNER-AS) (HETZNER-AS)
2	46.236.13.147 46.236.13.147	24931 (DEDIPOWER) (DEDIPOWER)
1	2600:9000:20e... 2600:9000:20eb:5600:9:352d:a240:93a1	16509 (AMAZON-02) (AMAZON-02 - Amazon.com)
1	46.236.12.250 46.236.12.250	24931 (DEDIPOWER) (DEDIPOWER)
1 2	216.58.205.230 216.58.205.230	15169 (GOOGLE) (GOOGLE - Google LLC)
1	185.29.135.48 185.29.135.48	30419 (MEDIAMATH...) (MEDIAMATH-INC - MediaMath Inc)
3	2a00:1450:400... 2a00:1450:4001:81a::2013	15169 (GOOGLE) (GOOGLE - Google LLC)
2	2a00:1450:400... 2a00:1450:4001:814::2002	15169 (GOOGLE) (GOOGLE - Google LLC)
1	178.250.0.130 178.250.0.130	44788 (ASN-CRITE...) (ASN-CRITEO-EUROPE)
286	57

79 50.31.134.90 (Chicago, United States)

ASN23352 (SERVERCENTRAL - Server Central Network, US)
PTR: mocha3026-web1.mochahost.com

www.itwbooking.bjquwhcm.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:821::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE - Google LLC, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 13.225.78.50 (Seattle, United States)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: server-13-225-78-50.fra2.r.cloudfront.net

ads.adthrive.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:30::681c:c3d (United States)

ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)

hitherandthither.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

13 172.217.16.162 (United States)

ASN15169 (GOOGLE - Google LLC, US)
PTR: fra15s11-in-f2.1e100.net

securepubads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:815::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE - Google LLC, US)

adservice.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:800::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE - Google LLC, US)

adservice.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 151.101.13.182 (Frankfurt am Main, Germany)

ASN54113 (FASTLY - Fastly, US)

static.fmpub.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 94.31.29.64 (United Kingdom)

ASN33438 (HIGHWINDS2 - Highwinds Network Group, Inc., US)
PTR: 94.31.29.64.IPYX-077437-ZYO.above.net

etdlwwyzs7ibptm965zo1lyq-wpengine.netdna-ssl.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2a00:1450:4001:825::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE - Google LLC, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:4700:10::6814:33ae (United States)

ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)

lightwidget.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 2.19.43.224 (Ascension Island) 2 redirects

ASN20940 (AKAMAI-ASN1, US)
PTR: a2-19-43-224.deploy.static.akamaitechnologies.com

sb.scorecardresearch.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 35.190.59.101 (Mountain View, United States) 1 redirects

ASN15169 (GOOGLE - Google LLC, US)
PTR: 101.59.190.35.bc.googleusercontent.com

r.skimresources.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 151.139.128.10 (Dallas, United States)

ASN20446 (HIGHWINDS3 - Highwinds Network Group, Inc., US)

p.skimresources.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 35.190.40.172 (Mountain View, United States)

ASN15169 (GOOGLE - Google LLC, US)
PTR: 172.40.190.35.bc.googleusercontent.com

api.skimlinks.mgr.consensu.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 63.33.115.128 (Dublin, Ireland) 5 redirects

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: ec2-63-33-115-128.eu-west-1.compute.amazonaws.com

x.skimresources.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 147.75.102.200 (Central, Hong Kong) 3 redirects

ASN54825 (PACKET - Packet Host, Inc., US)

loadeu.exelator.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 143.204.101.34 (Seattle, United States)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: server-143-204-101-34.fra50.r.cloudfront.net

logger.adthrive.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 151.101.113.194 (Frankfurt am Main, Germany)

ASN54113 (FASTLY - Fastly, US)

clarium.global.ssl.fastly.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 37.252.161.184 (Ascension Island)

ASN29990 (ASN-APPNEXUS - AppNexus, Inc, US)
PTR: prebid.ams1.adnexus.net

prebid.adnxs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 2.18.234.21 (Ascension Island)

ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US)
PTR: a2-18-234-21.deploy.static.akamaitechnologies.com

as-sec.casalemedia.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 2.18.232.7 (Ascension Island)

ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US)
PTR: a2-18-232-7.deploy.static.akamaitechnologies.com

a.teads.tv	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 185.64.189.112 (United Kingdom)

ASN62713 (AS-PUBMATIC - PubMatic, Inc., US)

hbopenbid.pubmatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 34.95.120.147 (United States)

ASN15169 (GOOGLE - Google LLC, US)
PTR: 147.120.95.34.bc.googleusercontent.com

cafemedia-d.openx.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 178.162.133.150 (Netherlands)

ASN60781 (LEASEWEB-NL-AMS-01 Netherlands, NL)
PTR: ams-1-apex.go.sonobi.com

apex.go.sonobi.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 178.250.2.152 (France)

ASN44788 (ASN-CRITEO-EUROPE, FR)

bidder.criteo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 69.173.144.141 (Frankfurt am Main, Germany)

ASN26667 (RUBICONPROJECT - The Rubicon Project, Inc., US)

fastlane.rubiconproject.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 104.16.190.66 (United States)

ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)

dmx.districtm.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 54.67.106.161 (San Jose, United States)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: ec2-54-67-106-161.us-west-1.compute.amazonaws.com

hb.undertone.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 52.58.198.43 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: ec2-52-58-198-43.eu-central-1.compute.amazonaws.com

tlx.3lift.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 72.251.249.14 (Amsterdam, Netherlands)

ASN29791 (VOXEL-DOT-NET - Internap Corporation, US)

ap.lijit.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

14 185.33.223.216 (Netherlands)

ASN29990 (ASN-APPNEXUS - AppNexus, Inc, US)
PTR: 312.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net

ib.adnxs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 54.76.37.45 (Dublin, Ireland)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: ec2-54-76-37-45.eu-west-1.compute.amazonaws.com

i.skimresources.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 35.201.67.47 (Ascension Island)

ASN15169 (GOOGLE - Google LLC, US)
PTR: 47.67.201.35.bc.googleusercontent.com

t.skimresources.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 54.76.79.46 (Dublin, Ireland) 2 redirects

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: ec2-54-76-79-46.eu-west-1.compute.amazonaws.com

sync.crwdcntrl.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:80b::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE - Google LLC, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:400c:c04::9d (Brussels, Belgium)

ASN15169 (GOOGLE - Google LLC, US)

stats.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 52.51.196.221 (Dublin, Ireland)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: ec2-52-51-196-221.eu-west-1.compute.amazonaws.com

g2.gumgum.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 2a00:1450:4001:81f::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE - Google LLC, US)

tpc.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

9 2a00:1450:4001:821::2001 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE - Google LLC, US)

cdn.ampproject.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:800::2004 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE - Google LLC, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:81c::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE - Google LLC, US)

www.googletagservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 185.80.38.195 (Netherlands)

ASN27381 (CASALE-MEDIA - Index Exchange Inc., CA)

a3226.casalemedia.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 185.29.133.52 (United Kingdom)

ASN30419 (MEDIAMATH-INC - MediaMath Inc, US)

tags.mathtag.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 18.195.61.72 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: ec2-18-195-61-72.eu-central-1.compute.amazonaws.com

protected-by.clarium.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 136.243.51.232 (Germany)

ASN24940 (HETZNER-AS, DE)
PTR: static.232.51.243.136.clients.your-server.de

hal9000.redintelligence.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2.18.233.201 (Ascension Island)

ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US)
PTR: a2-18-233-201.deploy.static.akamaitechnologies.com

pixel.mathtag.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 136.243.54.219 (Germany) 1 redirects

ASN24940 (HETZNER-AS, DE)
PTR: static.219.54.243.136.clients.your-server.de

hal900037.redintelligence.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.109.83.210 (Netherlands) 1 redirects

ASN20940 (AKAMAI-ASN1, US)
PTR: a104-109-83-210.deploy.static.akamaitechnologies.com

www.awin1.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:30::681b:b368 (United States)

ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)

www.vehiculum.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6810:a727 (United States)

ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)

www.11teamsports.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 195.216.249.67 (France) 2 redirects

ASN47268 (ZANOX, FR)

ad.zanox.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 85.10.231.199 (Germany) 1 redirects

ASN24940 (HETZNER-AS, DE)
PTR: 85-10-231-199.clients.your-server.de

pb.media01.eu	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 46.236.13.147 (United Kingdom)

ASN24931 (DEDIPOWER, GB)
PTR: 46-236-13-147.servers.dedipower.net

track.webgains.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:20eb:5600:9:352d:a240:93a1 (United States)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)

analytics.webgains.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 46.236.12.250 (United Kingdom)

ASN24931 (DEDIPOWER, GB)
PTR: 46-236-12-250.servers.dedipower.net

diapi.webgains.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 216.58.205.230 (Mountain View, United States) 1 redirects

ASN15169 (GOOGLE - Google LLC, US)
PTR: fra15s24-in-f230.1e100.net

5994599.fls.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 185.29.135.48 (United Kingdom)

ASN30419 (MEDIAMATH-INC - MediaMath Inc, US)

mathid.mathtag.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:81a::2013 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE - Google LLC, US)

w-it.m-t.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:814::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE - Google LLC, US)

pagead2.googlesyndication.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 178.250.0.130 (France)

ASN44788 (ASN-CRITEO-EUROPE, FR)

static.criteo.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
79	bjquwhcm.com www.itwbooking.bjquwhcm.com	824 KB
22	adnxs.com prebid.adnxs.com ib.adnxs.com	20 KB
16	skimresources.com 6 redirects r.skimresources.com p.skimresources.com x.skimresources.com i.skimresources.com t.skimresources.com	12 KB
16	doubleclick.net 1 redirects securepubads.g.doubleclick.net stats.g.doubleclick.net 5994599.fls.doubleclick.net	119 KB
9	ampproject.org cdn.ampproject.org	441 KB
9	googlesyndication.com tpc.googlesyndication.com pagead2.googlesyndication.com	951 B
8	teads.tv a.teads.tv	3 KB
8	casalemedia.com as-sec.casalemedia.com a3226.casalemedia.com	7 KB
7	lijit.com ap.lijit.com	3 KB
7	3lift.com tlx.3lift.com	4 KB
7	districtm.io dmx.districtm.io	776 B
7	rubiconproject.com fastlane.rubiconproject.com	13 KB
7	criteo.com bidder.criteo.com	1 KB
7	sonobi.com apex.go.sonobi.com	8 KB
7	pubmatic.com hbopenbid.pubmatic.com	539 B
7	scorecardresearch.com 2 redirects sb.scorecardresearch.com	4 KB
7	netdna-ssl.com etdlwwyzs7ibptm965zo1lyq-wpengine.netdna-ssl.com	784 KB
7	adthrive.com ads.adthrive.com logger.adthrive.com	209 KB
6	openx.net cafemedia-d.openx.net	2 KB
5	mathtag.com tags.mathtag.com pixel.mathtag.com mathid.mathtag.com	22 KB
5	gstatic.com fonts.gstatic.com	75 KB
4	zanox.com 2 redirects ad.zanox.com	2 KB
4	redintelligence.net 1 redirects hal9000.redintelligence.net hal900037.redintelligence.net	6 KB
3	m-t.io w-it.m-t.io	524 B
3	webgains.com track.webgains.com diapi.webgains.com	16 KB
3	undertone.com hb.undertone.com	1 KB
3	exelator.com 3 redirects loadeu.exelator.com	3 KB
3	fmpub.net static.fmpub.net	2 KB
3	googleapis.com fonts.googleapis.com	2 KB
2	googletagservices.com www.googletagservices.com	58 KB
2	gumgum.com g2.gumgum.com	2 KB
2	crwdcntrl.net 2 redirects sync.crwdcntrl.net	1 KB
2	fastly.net clarium.global.ssl.fastly.net	65 KB
2	lightwidget.com lightwidget.com
2	google.com adservice.google.com www.google.com	171 B
1	criteo.net static.criteo.net	14 KB
1	webgains.io analytics.webgains.io	13 KB
1	media01.eu 1 redirects pb.media01.eu	1 KB
1	11teamsports.com www.11teamsports.com
1	vehiculum.de www.vehiculum.de
1	awin1.com 1 redirects www.awin1.com	532 B
1	clarium.io protected-by.clarium.io	345 B
1	google-analytics.com www.google-analytics.com	97 B
1	consensu.org api.skimlinks.mgr.consensu.org	646 B
1	google.de adservice.google.de	656 B
1	hitherandthither.net hitherandthither.net	4 KB
0	amazonaws.com Failed gdprexclusion.dmpxs.com.s3-website.eu-west-3.amazonaws.com Failed
0	myfonts.net Failed hello.myfonts.net Failed
286	48

	Domain	Requested by
79	www.itwbooking.bjquwhcm.com	www.itwbooking.bjquwhcm.com
14	ib.adnxs.com	ads.adthrive.com
13	securepubads.g.doubleclick.net	ads.adthrive.com securepubads.g.doubleclick.net www.itwbooking.bjquwhcm.com
9	cdn.ampproject.org	securepubads.g.doubleclick.net clarium.global.ssl.fastly.net
8	a.teads.tv	ads.adthrive.com
8	prebid.adnxs.com	ads.adthrive.com
7	tpc.googlesyndication.com	securepubads.g.doubleclick.net www.itwbooking.bjquwhcm.com clarium.global.ssl.fastly.net cdn.ampproject.org
7	ap.lijit.com	ads.adthrive.com
7	tlx.3lift.com	ads.adthrive.com
7	dmx.districtm.io	ads.adthrive.com
7	fastlane.rubiconproject.com	ads.adthrive.com
7	bidder.criteo.com	ads.adthrive.com
7	apex.go.sonobi.com	ads.adthrive.com
7	hbopenbid.pubmatic.com	ads.adthrive.com
7	as-sec.casalemedia.com	ads.adthrive.com
7	sb.scorecardresearch.com	2 redirects static.fmpub.net www.itwbooking.bjquwhcm.com ads.adthrive.com
7	etdlwwyzs7ibptm965zo1lyq-wpengine.netdna-ssl.com	www.itwbooking.bjquwhcm.com
6	cafemedia-d.openx.net	ads.adthrive.com
6	ads.adthrive.com	www.itwbooking.bjquwhcm.com ads.adthrive.com
5	x.skimresources.com	5 redirects
5	p.skimresources.com	www.itwbooking.bjquwhcm.com
5	fonts.gstatic.com	www.itwbooking.bjquwhcm.com
4	ad.zanox.com	2 redirects clarium.global.ssl.fastly.net www.itwbooking.bjquwhcm.com
3	w-it.m-t.io	analytics.webgains.io
3	hal900037.redintelligence.net	1 redirects www.itwbooking.bjquwhcm.com
3	tags.mathtag.com	clarium.global.ssl.fastly.net www.itwbooking.bjquwhcm.com
3	hb.undertone.com	ads.adthrive.com
3	loadeu.exelator.com	3 redirects
3	static.fmpub.net	www.itwbooking.bjquwhcm.com
3	fonts.googleapis.com	www.itwbooking.bjquwhcm.com
2	pagead2.googlesyndication.com	www.itwbooking.bjquwhcm.com
2	5994599.fls.doubleclick.net	1 redirects clarium.global.ssl.fastly.net
2	track.webgains.com	clarium.global.ssl.fastly.net www.itwbooking.bjquwhcm.com
2	www.googletagservices.com	securepubads.g.doubleclick.net clarium.global.ssl.fastly.net
2	g2.gumgum.com	ads.adthrive.com
2	sync.crwdcntrl.net	2 redirects
2	t.skimresources.com	www.itwbooking.bjquwhcm.com
2	i.skimresources.com	www.itwbooking.bjquwhcm.com
2	clarium.global.ssl.fastly.net	ads.adthrive.com www.itwbooking.bjquwhcm.com
2	r.skimresources.com	1 redirects www.itwbooking.bjquwhcm.com
2	lightwidget.com	www.itwbooking.bjquwhcm.com
1	static.criteo.net	ads.adthrive.com
1	mathid.mathtag.com	www.itwbooking.bjquwhcm.com
1	diapi.webgains.com	track.webgains.com
1	analytics.webgains.io	track.webgains.com
1	pb.media01.eu	1 redirects
1	www.11teamsports.com	clarium.global.ssl.fastly.net
1	www.vehiculum.de	clarium.global.ssl.fastly.net
1	www.awin1.com	1 redirects
1	pixel.mathtag.com	clarium.global.ssl.fastly.net
1	hal9000.redintelligence.net	clarium.global.ssl.fastly.net
1	protected-by.clarium.io	www.itwbooking.bjquwhcm.com
1	a3226.casalemedia.com	clarium.global.ssl.fastly.net
1	www.google.com	www.itwbooking.bjquwhcm.com
1	stats.g.doubleclick.net	www.itwbooking.bjquwhcm.com
1	www.google-analytics.com	www.itwbooking.bjquwhcm.com
1	logger.adthrive.com	ads.adthrive.com
1	api.skimlinks.mgr.consensu.org	www.itwbooking.bjquwhcm.com
1	adservice.google.com	securepubads.g.doubleclick.net
1	adservice.google.de	securepubads.g.doubleclick.net
1	hitherandthither.net	www.itwbooking.bjquwhcm.com
0	gdprexclusion.dmpxs.com.s3-website.eu-west-3.amazonaws.com Failed	www.itwbooking.bjquwhcm.com
0	hello.myfonts.net Failed	www.itwbooking.bjquwhcm.com
286	63

This site contains links to these domains. Also see Links.

Domain
www.ikea.com
www.semitix.com
hislide.io
www.sekurigi.com
www.instagram.com
amzn.to
academy.swingleft.org
thelastweekend.org
instagram.com
feeds.feedburner.com
www.bloglovin.com
www.pinterest.com

Subject Issuer	Validity	Valid
jimmy-choo.cc Let's Encrypt Authority X3	`2019-10-17` - `2020-01-15`	3 months	crt.sh
*.googleapis.com GTS CA 1O1	`2019-09-17` - `2019-12-10`	3 months	crt.sh
*.adthrive.com Amazon	`2019-08-31` - `2020-09-30`	a year	crt.sh
sni29257.cloudflaressl.com COMODO ECC Domain Validation Secure Server CA 2	`2019-08-27` - `2020-03-04`	6 months	crt.sh
*.g.doubleclick.net GTS CA 1O1	`2019-09-17` - `2019-12-10`	3 months	crt.sh
*.google.com GTS CA 1O1	`2019-09-17` - `2019-12-10`	3 months	crt.sh
q.ssl.fastly.net GlobalSign CloudSSL CA - SHA256 - G3	`2019-04-23` - `2020-04-11`	a year	crt.sh
*.netdna-ssl.com Sectigo RSA Domain Validation Secure Server CA	`2019-02-18` - `2020-02-27`	a year	crt.sh
*.lightwidget.com Let's Encrypt Authority X3	`2019-08-19` - `2019-11-17`	3 months	crt.sh
*.scorecardresearch.com COMODO RSA Organization Validation Secure Server CA	`2018-11-28` - `2019-12-26`	a year	crt.sh
*.skimresources.com DigiCert SHA2 Secure Server CA	`2018-09-13` - `2020-10-07`	2 years	crt.sh
p.skimresources.com Sectigo RSA Domain Validation Secure Server CA	`2019-08-24` - `2019-11-22`	3 months	crt.sh
api.skimlinks.mgr.consensu.org DigiCert SHA2 Secure Server CA	`2019-10-04` - `2021-10-07`	2 years	crt.sh
*.freetls.global.fastly.net GlobalSign CloudSSL CA - SHA256 - G3	`2019-01-02` - `2020-01-03`	a year	crt.sh
prebid.adnxs.com GeoTrust RSA CA 2018	`2019-03-25` - `2021-05-20`	2 years	crt.sh
san.casalemedia.com GeoTrust RSA CA 2018	`2019-07-17` - `2020-03-09`	8 months	crt.sh
teads.tv Let's Encrypt Authority X3	`2019-08-22` - `2019-11-20`	3 months	crt.sh
*.pubmatic.com Sectigo RSA Organization Validation Secure Server CA	`2019-02-22` - `2021-02-21`	2 years	crt.sh
*.openx.net GeoTrust RSA CA 2018	`2018-01-04` - `2020-07-09`	3 years	crt.sh
*.go.sonobi.com Go Daddy Secure Certificate Authority - G2	`2019-02-01` - `2021-02-04`	2 years	crt.sh
*.criteo.com DigiCert ECC Secure Server CA	`2019-03-28` - `2020-04-01`	a year	crt.sh
*.rubiconproject.com DigiCert SHA2 Secure Server CA	`2019-01-10` - `2021-01-14`	2 years	crt.sh
districtm.io CloudFlare Inc ECC CA-2	`2019-03-26` - `2020-03-26`	a year	crt.sh
*.undertone.com Amazon	`2019-03-28` - `2020-04-28`	a year	crt.sh
*.3lift.com Amazon	`2019-07-17` - `2020-08-17`	a year	crt.sh
*.lijit.com Go Daddy Secure Certificate Authority - G2	`2019-03-11` - `2020-05-10`	a year	crt.sh
*.adnxs.com DigiCert ECC Secure Server CA	`2019-01-23` - `2021-03-08`	2 years	crt.sh
*.google-analytics.com GTS CA 1O1	`2019-09-17` - `2019-12-10`	3 months	crt.sh
*.gumgum.com Amazon	`2019-07-31` - `2020-08-31`	a year	crt.sh
tpc.googlesyndication.com GTS CA 1O1	`2019-09-17` - `2019-12-10`	3 months	crt.sh
misc-sni.google.com GTS CA 1O1	`2019-09-17` - `2019-12-10`	3 months	crt.sh
www.google.com GTS CA 1O1	`2019-10-03` - `2019-12-26`	3 months	crt.sh
*.casalemedia.com Go Daddy Secure Certificate Authority - G2	`2016-12-13` - `2019-12-13`	3 years	crt.sh
*.mathtag.com DigiCert SHA2 Secure Server CA	`2018-01-26` - `2020-04-16`	2 years	crt.sh
protected-by.clarium.io Gandi Standard SSL CA 2	`2018-04-26` - `2020-04-26`	2 years	crt.sh
*.redintelligence.net Go Daddy Secure Certificate Authority - G2	`2019-03-22` - `2020-03-22`	a year	crt.sh
pixel.mathtag.com DigiCert SHA2 Secure Server CA	`2019-01-25` - `2020-04-25`	a year	crt.sh
sni240393.cloudflaressl.com COMODO ECC Domain Validation Secure Server CA 2	`2019-09-21` - `2020-03-29`	6 months	crt.sh
11teamsports.com CloudFlare Inc ECC CA-2	`2019-02-11` - `2020-02-11`	a year	crt.sh
ad.zanox.com Thawte RSA CA 2018	`2019-06-17` - `2021-07-16`	2 years	crt.sh
*.webgains.com Sectigo RSA Domain Validation Secure Server CA	`2019-05-20` - `2021-06-08`	2 years	crt.sh
*.webgains.io Amazon	`2019-05-08` - `2020-06-08`	a year	crt.sh
*.doubleclick.net GTS CA 1O1	`2019-09-17` - `2019-12-10`	3 months	crt.sh
w-it.m-t.io Let's Encrypt Authority X3	`2019-10-15` - `2020-01-13`	3 months	crt.sh
*.criteo.net DigiCert ECC Secure Server CA	`2019-03-26` - `2020-03-30`	a year	crt.sh

This page contains 15 frames:

Primary Page: https://www.itwbooking.bjquwhcm.com/
Frame ID: 0E8338CCD224381A7E0FCC2321A5C8D5
Requests: 235 HTTP requests in this frame

Frame: https://lightwidget.com/widgets/d7ab66202d49542782175051e3f11ee3.html
Frame ID: DB592E224C98ABEC5A14906050FD47FB
Requests: 1 HTTP requests in this frame

Frame: https://lightwidget.com/widgets/1d404a9b65565ac99d38266e9dc66726.html
Frame ID: 56FC109FA594079E8BD8781E45C1CEFE
Requests: 1 HTTP requests in this frame

Frame: https://p.skimresources.com/?provider_id=bb4d2d0cb739fd2597b72ebf60af4cea&skim_mapping=true
Frame ID: 6BBDC2699EA5667110DD0D1D00A437C6
Requests: 3 HTTP requests in this frame

Frame: https://cdn.ampproject.org/rtv/011909241711100/amp4ads-v0.js
Frame ID: 096A3FE20D0EF852204BF4F529AB8F33
Requests: 6 HTTP requests in this frame

Frame: https://cdn.ampproject.org/rtv/031910071804120/amp4ads-v0.js
Frame ID: C2EA2DF8B815D20929A338D564DFA67E
Requests: 6 HTTP requests in this frame

Frame: https://cdn.ampproject.org/rtv/011909241711100/amp4ads-v0.js
Frame ID: B00964E3A0AABD150C8EB008370A643D
Requests: 6 HTTP requests in this frame

Frame: https://cdn.ampproject.org/rtv/221910071804120/amp4ads-v0.js
Frame ID: 241DCE8FDAE5D1EE44694035C1B12D10
Requests: 6 HTTP requests in this frame

Frame: https://clarium.global.ssl.fastly.net/?wrapper=mOinGM9MTu5v-Lto835XLhlrSPY&tpid=bU9pbkdNOU1UdTV2LUx0bzgzNVhMaGxyU1BZLzI0NzY3MDI0OTE6MXgx&v=v2lgcycid&d=eyJ3aCI6ImJVOXBia2ROT1UxVWRUVjJMVXgwYnpnek5WaE1hR3h5VTFCWkx6STBOelkzTURJME9URTZNWGd4Iiwid2QiOnsibyI6MjQ3NjcwMjQ5MSwidyI6IjEiLCJoIjoiMSJ9LCJ3ciI6Mn0=
Frame ID: 29C7CB783E615086F5FCD4C9FA735C15
Requests: 21 HTTP requests in this frame

Frame: https://a3226.casalemedia.com/ifnotify?gdprconsent=1&c=1323407&r=BC99D054&t=5DA84DB9&u=WGFoTnVibFFKc01BQUZ3amhLSUFBQUFj&m=6bfe32698564dc112214a72541353b9e&wp=11&aid=78AC9E464D5DAEEA&tid=FDD0&s=2D5AA&cp=0.17&n=www.itwbooking.bjquwhcm.com&pr=xx&sid=317f-3180-36f6-37bc-38c8-38cb-38d0-38d3-38d8-38db-3996-3996-3996-3996-3999-3999-3999-3999-39c3-3bcf-40ea-438f-4427-4769-50a7-50aa-55d5-55e4-55e9-55e9-55e9-55e9-57b4-5a20-5f68-93ce-b149&epr=1714d48110e49865
Frame ID: BBBDF89C233381146D5E37A4C7E078DE
Requests: 1 HTTP requests in this frame

Frame: https://www.vehiculum.de/leasing/htlp/awin.html
Frame ID: D9D0C99FD09788DFF220CD6ABF76B25A
Requests: 1 HTTP requests in this frame

Frame: https://www.11teamsports.com/de-de/htlp-webgains
Frame ID: C399315E330518265FDC4EC4AAB0D959
Requests: 1 HTTP requests in this frame

Frame: https://ad.zanox.com/ppv/images/onepixel.gif?foo=45475836C666538628SV1yq32186858000568747841422036599273yb5yb7T2619872353978952707&dyn_id=
Frame ID: 5523B0A1B44466DC4E42D5C171A0F66C
Requests: 1 HTTP requests in this frame

Frame: https://5994599.fls.doubleclick.net/activityi;dc_pre=CPfumuCVo-UCFVH2dwodJQoP8Q;src=5994599;type=invmedia;cat=g2slskko;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=4217308203254.1196
Frame ID: E18DACE3EF1DF3CEF91D75CF2EE79718
Requests: 1 HTTP requests in this frame

Frame: https://hal900037.redintelligence.net/request_content.php?s=95383400085078601049054011019037&a=45feb6ef
Frame ID: 9133CAA100DF279F396B5BD920DE5836
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

WordPress (CMS) Expand

Overall confidence: 100%
Detected patterns

script /\/wp-(?:content|includes)\//i
meta generator /^WordPress ?([\d.]+)?/i
html /<!-- This site is optimized with the Yoast (?:WordPress )?SEO plugin v([\d.]+) -/i

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

script /\/wp-(?:content|includes)\//i
meta generator /^WordPress ?([\d.]+)?/i
html /<!-- This site is optimized with the Yoast (?:WordPress )?SEO plugin v([\d.]+) -/i

MySQL (Databases) Expand

Overall confidence: 100%
Detected patterns

script /\/wp-(?:content|includes)\//i
meta generator /^WordPress ?([\d.]+)?/i
html /<!-- This site is optimized with the Yoast (?:WordPress )?SEO plugin v([\d.]+) -/i

Nginx (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /nginx(?:\/([\d.]+))?/i

Yoast SEO (SEO) Expand

Overall confidence: 100%
Detected patterns

html /<!-- This site is optimized with the Yoast (?:WordPress )?SEO plugin v([\d.]+) -/i

Font Awesome (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

html /<link[^>]* href=[^>]+(?:([\d.]+)\/)?(?:css\/)?font-awesome(?:\.min)?\.css/i

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

script /google-analytics\.com\/(?:ga|urchin|analytics)\.js/i

comScore (Analytics) Expand

Overall confidence: 100%
Detected patterns

html /<iframe[^>]* (?:id="comscore"|scr=[^>]+comscore)|\.scorecardresearch\.com\/beacon\.js|COMSCORE\.beacon/i
script /\.scorecardresearch\.com\/beacon\.js|COMSCORE\.beacon/i

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

script /jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?/i

Page Statistics

286
Requests

99 %
HTTPS

28 %
IPv6

48
Domains

63
Subdomains

57
IPs

9
Countries

2734 kB
Transfer

5333 kB
Size

0
Cookies

12 Outgoing links

These are links going to different origins than the main page.

URL: https://www.ikea.com/us/en/catalog/products/50248541/
Title: Sniglar crib

Search URL Search Domain Scan URL

URL: https://www.semitix.com/maison-close-allemagne
Title: Fkk Allemagne

Search URL Search Domain Scan URL

URL: https://hislide.io/product-category/keynote-template/
Title: keynote thems

Search URL Search Domain Scan URL

URL: https://www.sekurigi.com/
Title: sekurigi

Search URL Search Domain Scan URL

URL: https://www.instagram.com/abbyclawsonlow/?hl=en
Title: on Instagram

Search URL Search Domain Scan URL

URL: https://amzn.to/2SHJXr3
Title: This is Mexico City

Search URL Search Domain Scan URL

URL: https://academy.swingleft.org/training
Title: Swing Left

Search URL Search Domain Scan URL

URL: https://thelastweekend.org/
Title: The Last Weekend

Search URL Search Domain Scan URL

URL: https://instagram.com/ashleymuirbruhn/
Title: Follow Along

Search URL Search Domain Scan URL

URL: http://feeds.feedburner.com/HitherAndThither
Title: Via Email

Search URL Search Domain Scan URL

URL: https://www.bloglovin.com/blogs/hither-thither-1654946
Title: Bloglovin'

Search URL Search Domain Scan URL

URL: https://www.pinterest.com/ashleymuirbruhn/
Title: I’M ON PINTEREST

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 98

https://bob.dmpxs.com/static/bob_010.js?phnxsid=6134&bob_cb=1571311032715240 HTTP 301
https://gdprexclusion.dmpxs.com.s3-website.eu-west-3.amazonaws.com/blank.js

Request Chain 105

https://r.skimresources.com/api/?callback=skimlinksBeaconCallback&data=%7B%22pubcode%22%3A%2275155X1525201%22%2C%22page%22%3A%22https%3A%2F%2Fwww.itwbooking.bjquwhcm.com%2F%22%2C%22domains%22%3A%5B%22ikea.com%22%2C%22semitix.com%22%2C%22hislide.io%22%2C%22sekurigi.com%22%2C%22instagram.com%22%2C%22amzn.to%22%2C%22academy.swingleft.org%22%2C%22thelastweekend.org%22%2C%22feeds.feedburner.com%22%2C%22bloglovin.com%22%2C%22pinterest.com%22%5D%7D HTTP 302
https://r.skimresources.com/api/?callback=skimlinksBeaconCallback&persistence=1&xguid=01DQCPZ6EHKYVF5QHCFM9J4CH7&data=%7B%22pubcode%22%3A%2275155X1525201%22%2C%22page%22%3A%22https%3A%2F%2Fwww.itwbooking.bjquwhcm.com%2F%22%2C%22domains%22%3A%5B%22ikea.com%22%2C%22semitix.com%22%2C%22hislide.io%22%2C%22sekurigi.com%22%2C%22instagram.com%22%2C%22amzn.to%22%2C%22academy.swingleft.org%22%2C%22thelastweekend.org%22%2C%22feeds.feedburner.com%22%2C%22bloglovin.com%22%2C%22pinterest.com%22%5D%7D&checksum=c3fc0c9890f63300775b27ecad7ea575c88c4a1535f6f13ef542bbfb7282d875

Request Chain 111

https://sb.scorecardresearch.com/b?c1=8&c2=6035610&c3=36782&c4=http%253A%252F%252Fwww.hitherandthither.net%252F&ns__t=1571311032798&ns_c=UTF-8&cv=3.1e&c8=Hither%20%26%20Thither&c7=https%3A%2F%2Fwww.itwbooking.bjquwhcm.com%2F&c9= HTTP 302
https://sb.scorecardresearch.com/b2?c1=8&c2=6035610&c3=36782&c4=http%253A%252F%252Fwww.hitherandthither.net%252F&ns__t=1571311032798&ns_c=UTF-8&cv=3.1e&c8=Hither%20%26%20Thither&c7=https%3A%2F%2Fwww.itwbooking.bjquwhcm.com%2F&c9=

Request Chain 112

https://sb.scorecardresearch.com/b?c1=2&c2=6035610&c3=36782&c4=http%253A%252F%252Fwww.hitherandthither.net%252F&ns__t=1571311032798&ns_c=UTF-8&cv=3.1e&c8=Hither%20%26%20Thither&c7=https%3A%2F%2Fwww.itwbooking.bjquwhcm.com%2F&c9= HTTP 302
https://sb.scorecardresearch.com/b2?c1=2&c2=6035610&c3=36782&c4=http%253A%252F%252Fwww.hitherandthither.net%252F&ns__t=1571311032798&ns_c=UTF-8&cv=3.1e&c8=Hither%20%26%20Thither&c7=https%3A%2F%2Fwww.itwbooking.bjquwhcm.com%2F&c9=

Request Chain 114

https://x.skimresources.com/?provider=exelate HTTP 302
https://loadeu.exelator.com/load/?p=787&g=001&j=0& HTTP 302
https://loadeu.exelator.com/load/?p=787&g=001&j=0&&xl8blockcheck=1 HTTP 302
https://x.skimresources.com/?provider=exelate&skim_mapping=true&provider_id=bb4d2d0cb739fd2597b72ebf60af4cea HTTP 302
https://p.skimresources.com/?provider_id=bb4d2d0cb739fd2597b72ebf60af4cea&skim_mapping=true

Request Chain 152

https://sync.crwdcntrl.net/map/c=7505/tp=SKIM/?https%3A%2F%2Fx.skimresources.com%2F%3Fprovider%3Dlotame%26skim_mapping%3Dtrue%26provider_id%3D%24%7Bprofile_id%7D HTTP 302
https://sync.crwdcntrl.net/map/ct=y/c=7505/tp=SKIM/?https%3A%2F%2Fx.skimresources.com%2F%3Fprovider%3Dlotame%26skim_mapping%3Dtrue%26provider_id%3D%24%7Bprofile_id%7D HTTP 302
https://x.skimresources.com/?provider=lotame&skim_mapping=true&provider_id=a664d2f56e90ac2155d971ac19d463a3 HTTP 302
https://p.skimresources.com/?provider_id=a664d2f56e90ac2155d971ac19d463a3&skim_mapping=true

Request Chain 199

https://x.skimresources.com/?provider=exelate HTTP 302
https://loadeu.exelator.com/load/?p=787&g=001&j=0& HTTP 302
https://x.skimresources.com/?provider=exelate&skim_mapping=true&provider_id=bb4d2d0cb739fd2597b72ebf60af4cea HTTP 302
https://p.skimresources.com/?provider_id=bb4d2d0cb739fd2597b72ebf60af4cea&skim_mapping=true

Request Chain 243

https://hal900037.redintelligence.net/request.php?zone=df2muyo5c9nk&nw=20&renderingType=javascript&namespace=d8d567ed8b&subid=&uid=b30fde7be28a1416&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=728x90&scrollPos=0x0&extData[]=&extVar[]=DOUBLEBORDER%3A1&envData=&redirectClick=http%3A%2F%2Fpixel.mathtag.com%2Fclick%2Fimg%3Fmt_aid%3D712362346163147449%26mt_id%3D6864055%26mt_adid%3D216536%26mt_sid%3D4802372%26mt_exid%3D15%26mt_inapp%3D0%26mt_uuid%3D27655da8-4db9-4601-bf0d-b028a2e3f837%26redirect%3D&documentReferer=https%3A%2F%2Fwww.itwbooking.bjquwhcm.com%2F&ancestorOrigins=https%3A%2F%2Fwww.itwbooking.bjquwhcm.com&random=9122350899755&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0 HTTP 302
https://hal900037.redintelligence.net/request.php?zone=df2muyo5c9nk&nw=20&renderingType=javascript&namespace=d8d567ed8b&subid=&uid=b30fde7be28a1416&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=728x90&scrollPos=0x0&extData[]=&extVar[]=DOUBLEBORDER%3A1&envData=&redirectClick=http%3A%2F%2Fpixel.mathtag.com%2Fclick%2Fimg%3Fmt_aid%3D712362346163147449%26mt_id%3D6864055%26mt_adid%3D216536%26mt_sid%3D4802372%26mt_exid%3D15%26mt_inapp%3D0%26mt_uuid%3D27655da8-4db9-4601-bf0d-b028a2e3f837%26redirect%3D&documentReferer=https%3A%2F%2Fwww.itwbooking.bjquwhcm.com%2F&ancestorOrigins=https%3A%2F%2Fwww.itwbooking.bjquwhcm.com&random=9122350899755&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0&uidRedirect=1

Request Chain 244

https://www.awin1.com/cshow.php?s=2335133&v=16039&q=356706&r=296283&pref1=95383400085078601049054011019037&pv=1 HTTP 302
https://www.vehiculum.de/leasing/htlp/awin.html

Request Chain 246

https://ad.zanox.com/tpv/?45475836C666538628T&zpar0=95383400085078601049054011019037 HTTP 302
https://pb.media01.eu/view.aspx?trackid=91C09AA007C123F60FDC6F5FD61F1F1B&dt_subid1=45475836C666538628SV1yq32186858000568747841422036599273yb5yb7T2619872353978952707&dt_subid2=&actionid=879111&produktid=postbankratenkredit&dt_url=https%3A%2F%2Fad.zanox.com%2Fppv%2Fimages%2Fonepixel.gif%3Ffoo%3D45475836C666538628SV1yq32186858000568747841422036599273yb5yb7T2619872353978952707 HTTP 301
https://ad.zanox.com/ppv/images/onepixel.gif?foo=45475836C666538628SV1yq32186858000568747841422036599273yb5yb7T2619872353978952707&dyn_id=

Request Chain 248

https://ad.zanox.com/ppv/?45475836C666538628&zpar0=95383400085078601049054011019037 HTTP 302
https://ad.zanox.com/ppv/images/onepixel.gif

Request Chain 252

https://5994599.fls.doubleclick.net/activityi;src=5994599;type=invmedia;cat=g2slskko;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=4217308203254.1196 HTTP 302
https://5994599.fls.doubleclick.net/activityi;dc_pre=CPfumuCVo-UCFVH2dwodJQoP8Q;src=5994599;type=invmedia;cat=g2slskko;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=4217308203254.1196

286 HTTP transactions
5 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request / Show response
www.itwbooking.bjquwhcm.com/ 81 KB
15 KB 1002ms
600ms Document
text/html 50.31.134.90
Server Central Ne...

General

Check archive.org

Show headers Download Go to

Full URL: https://www.itwbooking.bjquwhcm.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 50.31.134.90 Chicago, United States, ASN23352 (SERVERCENTRAL - Server Central Network, US),
Reverse DNS: mocha3026-web1.mochahost.com
Software: nginx /
Resource Hash: 6714e4568db4ecbeafc76e9cbc77c1fbd6de19c1b5b7603bc5bd68db08f601d9

Request headers

:method: GET
:authority: www.itwbooking.bjquwhcm.com
:scheme: https
:path: /
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-mode: navigate
sec-fetch-user: ?1
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
sec-fetch-site: none
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode: navigate
Sec-Fetch-User: ?1

Response headers

status: 200
server: nginx
date: Thu, 17 Oct 2019 11:17:11 GMT
content-type: text/html
vary: Accept-Encoding
last-modified: Wed, 17 Jul 2019 23:57:45 GMT
x-cache: HIT from Backend
content-encoding: gzip

GET
H2 200 style.css
www.itwbooking.bjquwhcm.com/etdlwwyzs7ibptm965zo1lyq-wpengine.netdna-ssl.com/wp-content/themes/hitherandthither/ 43 KB
9 KB 110ms
109ms Stylesheet
text/css 50.31.134.90
Server Central Ne...

General

Check archive.org

Show headers Download Go to

Full URL: https://www.itwbooking.bjquwhcm.com/etdlwwyzs7ibptm965zo1lyq-wpengine.netdna-ssl.com/wp-content/themes/hitherandthither/style.css
Requested by: Host: www.itwbooking.bjquwhcm.com
URL: https://www.itwbooking.bjquwhcm.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 50.31.134.90 Chicago, United States, ASN23352 (SERVERCENTRAL - Server Central Network, US),
Reverse DNS: mocha3026-web1.mochahost.com
Software: nginx /
Resource Hash: 460167894ad901de30a5cf5e658a49a62375593f310b3efb56b4dceb21b99950

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.itwbooking.bjquwhcm.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 17 Oct 2019 11:17:11 GMT
content-encoding: gzip
last-modified: Thu, 08 Nov 2018 17:23:07 GMT
server: nginx
etag: W/"5be470fb-acb1"
vary: Accept-Encoding
content-type: text/css
status: 200
cache-control: max-age=2592000
expires: Sat, 16 Nov 2019 11:17:11 GMT

GET
H2 404 font-awesome.min.css
www.itwbooking.bjquwhcm.com/maxcdn.bootstrapcdn.com/font-awesome/4.4.0/css/ 0
0 120ms
120ms Stylesheet
text/html 50.31.134.90
Server Central Ne...

General

Check archive.org

Show headers Download Go to

Full URL: https://www.itwbooking.bjquwhcm.com/maxcdn.bootstrapcdn.com/font-awesome/4.4.0/css/font-awesome.min.css
Requested by: Host: www.itwbooking.bjquwhcm.com
URL: https://www.itwbooking.bjquwhcm.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 50.31.134.90 Chicago, United States, ASN23352 (SERVERCENTRAL - Server Central Network, US),
Reverse DNS: mocha3026-web1.mochahost.com
Software: nginx /
Resource Hash

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.itwbooking.bjquwhcm.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

status: 404
date: Thu, 17 Oct 2019 11:17:11 GMT
content-encoding: gzip
server: nginx
vary: Accept-Encoding
content-type: text/html

GET 2f2e86
hello.myfonts.net/count/ 0
0

GET
H2 200 css
fonts.googleapis.com/ 1 KB
491 B 19ms
18ms Stylesheet
text/css 2a00:1450:4001:821::200a
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Lato:400,700

Requested by

Host: www.itwbooking.bjquwhcm.com
URL: https://www.itwbooking.bjquwhcm.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:821::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

ESF /

Resource Hash

8235befaa90794559978bcf134955b78f0d560f7448cb0119a7079e74de9b322

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.itwbooking.bjquwhcm.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: br
last-modified: Thu, 17 Oct 2019 11:17:11 GMT
server: ESF
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
status: 200
date: Thu, 17 Oct 2019 11:17:11 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
x-xss-protection: 0
expires: Thu, 17 Oct 2019 11:17:11 GMT

GET
H2 200 css
fonts.googleapis.com/ 5 KB
647 B 22ms
21ms Stylesheet
text/css 2a00:1450:4001:821::200a
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Noto+Serif:400,700

Requested by

Host: www.itwbooking.bjquwhcm.com
URL: https://www.itwbooking.bjquwhcm.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:821::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

ESF /

Resource Hash

5bfb6d4691e1ec8296fad43d296a2c9d8185460e6ae2294766006233a5f55dc5

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.itwbooking.bjquwhcm.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: br
last-modified: Thu, 17 Oct 2019 11:17:11 GMT
server: ESF
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
status: 200
date: Thu, 17 Oct 2019 11:17:11 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
x-xss-protection: 0
expires: Thu, 17 Oct 2019 11:17:11 GMT

GET
H2 200 css
fonts.googleapis.com/ 7 KB
712 B 20ms
19ms Stylesheet
text/css 2a00:1450:4001:821::200a
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Lora:400,400italic,700,700italic

Requested by

Host: www.itwbooking.bjquwhcm.com
URL: https://www.itwbooking.bjquwhcm.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:821::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

ESF /

Resource Hash

63c297f6cb8e2e58bb21c0c509ba1f63e375715095293f4b67ff522774b5ee80

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.itwbooking.bjquwhcm.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: br
last-modified: Thu, 17 Oct 2019 11:17:11 GMT
server: ESF
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
status: 200
date: Thu, 17 Oct 2019 11:17:11 GMT
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
x-xss-protection: 0
expires: Thu, 17 Oct 2019 11:17:11 GMT

GET
H2 200 ads.min.js Show response
ads.adthrive.com/sites/58262713bbb11e24413c230b/ 6 KB
2 KB 429ms
408ms Script
application/javascript 13.225.78.50
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.adthrive.com/sites/58262713bbb11e24413c230b/ads.min.js?threshold=34
Requested by: Host: www.itwbooking.bjquwhcm.com
URL: https://www.itwbooking.bjquwhcm.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 13.225.78.50 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: server-13-225-78-50.fra2.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: bdc6c5bde5c04d6d26c81a650422b68960244543c6901d4d2cb09b19517c0fd2

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.itwbooking.bjquwhcm.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 17 Oct 2019 11:17:13 GMT
content-encoding: gzip
last-modified: Fri, 12 Apr 2019 12:33:08 GMT
server: AmazonS3
x-amz-cf-pop: FRA2-C2
vary: Accept-Encoding
x-cache: Miss from cloudfront
x-amz-version-id: i5usbPZyi9HR8pTpWiIeViJuKx3bJnrT
status: 200
cache-control: max-age=3600
content-type: application/javascript
x-amz-cf-id: R1Jn6trR6i383wydxk0C--6h-3xF-s9DHrOxakl-ILE6mWtgp-5VQA==
via: 1.1 2f194b62c8c43859cbf5af8e53a8d2a7.cloudfront.net (CloudFront)

GET
H2 200 wp-emoji-release.min.js Show response
hitherandthither.net/wp-includes/js/ 12 KB
4 KB 595ms
509ms Script
application/javascript 2606:4700:30::681c:c3d
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL: https://hitherandthither.net/wp-includes/js/wp-emoji-release.min.js?ver=4.9.8
Requested by: Host: www.itwbooking.bjquwhcm.com
URL: https://www.itwbooking.bjquwhcm.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:30::681c:c3d , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash: d2458b9fd9089fdcb9de317093e004ef3a65597dc68b9adfdeb15a7c9968d0d5

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.itwbooking.bjquwhcm.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 17 Oct 2019 11:17:12 GMT
content-encoding: br
cf-cache-status: MISS
last-modified: Wed, 10 Oct 2018 04:11:25 GMT
server: cloudflare
status: 200
etag: W/"5bbd7bed-2efa"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
cf-ray: 5271dd5cef2e8c86-VIE
expires: Fri, 16 Oct 2020 11:17:12 GMT

GET
H2 200 sb-instagram.minf24c.css
www.itwbooking.bjquwhcm.com/etdlwwyzs7ibptm965zo1lyq-wpengine.netdna-ssl.com/wp-content/plugins/instagram-feed/css/ 8 KB
2 KB 107ms
106ms Stylesheet
text/css 50.31.134.90
Server Central Ne...

General

Check archive.org

Show headers Download Go to

Full URL: https://www.itwbooking.bjquwhcm.com/etdlwwyzs7ibptm965zo1lyq-wpengine.netdna-ssl.com/wp-content/plugins/instagram-feed/css/sb-instagram.minf24c.css?ver=1.6
Requested by: Host: www.itwbooking.bjquwhcm.com
URL: https://www.itwbooking.bjquwhcm.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 50.31.134.90 Chicago, United States, ASN23352 (SERVERCENTRAL - Server Central Network, US),
Reverse DNS: mocha3026-web1.mochahost.com
Software: nginx /
Resource Hash: 4f199aabd06ef777d574559d88fe197591dda8bf97877036f9639cfca693f58e

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.itwbooking.bjquwhcm.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 17 Oct 2019 11:17:11 GMT
content-encoding: gzip
last-modified: Thu, 08 Nov 2018 17:23:09 GMT
server: nginx
etag: W/"5be470fd-1ffe"
vary: Accept-Encoding
content-type: text/css
status: 200
cache-control: max-age=2592000
expires: Sat, 16 Nov 2019 11:17:11 GMT

GET
H2 404 font-awesome.min.css
www.itwbooking.bjquwhcm.com/maxcdn.bootstrapcdn.com/font-awesome/4.7.0/css/ 0
0 113ms
113ms Stylesheet
text/html 50.31.134.90
Server Central Ne...

General

Check archive.org

Show headers Download Go to

Full URL: https://www.itwbooking.bjquwhcm.com/maxcdn.bootstrapcdn.com/font-awesome/4.7.0/css/font-awesome.min.css
Requested by: Host: www.itwbooking.bjquwhcm.com
URL: https://www.itwbooking.bjquwhcm.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 50.31.134.90 Chicago, United States, ASN23352 (SERVERCENTRAL - Server Central Network, US),
Reverse DNS: mocha3026-web1.mochahost.com
Software: nginx /
Resource Hash

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.itwbooking.bjquwhcm.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

status: 404
date: Thu, 17 Oct 2019 11:17:11 GMT
content-encoding: gzip
server: nginx
vary: Accept-Encoding
content-type: text/html

GET
H2 200 light_stylef24c.css
www.itwbooking.bjquwhcm.com/etdlwwyzs7ibptm965zo1lyq-wpengine.netdna-ssl.com/wp-content/plugins/jquery-collapse-o-matic/ 1 KB
610 B 265ms
264ms Stylesheet
text/css 50.31.134.90
Server Central Ne...

General

Check archive.org

Show headers Download Go to

Full URL: https://www.itwbooking.bjquwhcm.com/etdlwwyzs7ibptm965zo1lyq-wpengine.netdna-ssl.com/wp-content/plugins/jquery-collapse-o-matic/light_stylef24c.css?ver=1.6
Requested by: Host: www.itwbooking.bjquwhcm.com
URL: https://www.itwbooking.bjquwhcm.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 50.31.134.90 Chicago, United States, ASN23352 (SERVERCENTRAL - Server Central Network, US),
Reverse DNS: mocha3026-web1.mochahost.com
Software: nginx /
Resource Hash: 20b65e8f8de30a77aec4888993b537ab0aa6243c3ff5a5da2a816edf48b87643

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.itwbooking.bjquwhcm.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 17 Oct 2019 11:17:11 GMT
content-encoding: gzip
last-modified: Thu, 08 Nov 2018 17:23:08 GMT
server: nginx
etag: W/"5be470fc-413"
vary: Accept-Encoding
content-type: text/css
status: 200
cache-control: max-age=2592000
expires: Sat, 16 Nov 2019 11:17:11 GMT

GET
H2 200 client531b.css
www.itwbooking.bjquwhcm.com/etdlwwyzs7ibptm965zo1lyq-wpengine.netdna-ssl.com/wp-content/plugins/jquery-pin-it-button-for-images/css/ 6 KB
1 KB 266ms
265ms Stylesheet
text/css 50.31.134.90
Server Central Ne...

General

Check archive.org

Show headers Download Go to

Full URL: https://www.itwbooking.bjquwhcm.com/etdlwwyzs7ibptm965zo1lyq-wpengine.netdna-ssl.com/wp-content/plugins/jquery-pin-it-button-for-images/css/client531b.css?ver=2.3.4
Requested by: Host: www.itwbooking.bjquwhcm.com
URL: https://www.itwbooking.bjquwhcm.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 50.31.134.90 Chicago, United States, ASN23352 (SERVERCENTRAL - Server Central Network, US),
Reverse DNS: mocha3026-web1.mochahost.com
Software: nginx /
Resource Hash: 0f0858d77245751f1e5908486cd3fb8919798139fdaa5f78bf40e1f4107ec6b2

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.itwbooking.bjquwhcm.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 17 Oct 2019 11:17:11 GMT
content-encoding: gzip
last-modified: Thu, 08 Nov 2018 17:23:11 GMT
server: nginx
etag: W/"5be470ff-1847"
vary: Accept-Encoding
content-type: text/css
status: 200
cache-control: max-age=2592000
expires: Sat, 16 Nov 2019 11:17:11 GMT

GET
H2 200 style7be9.css
www.itwbooking.bjquwhcm.com/etdlwwyzs7ibptm965zo1lyq-wpengine.netdna-ssl.com/wp-content/plugins/pinterest-pinboard-widget/ 981 B
1 KB 266ms
266ms Stylesheet
text/css 50.31.134.90
Server Central Ne...

General

Check archive.org

Show headers Download Go to

Full URL: https://www.itwbooking.bjquwhcm.com/etdlwwyzs7ibptm965zo1lyq-wpengine.netdna-ssl.com/wp-content/plugins/pinterest-pinboard-widget/style7be9.css?v=1&ver=4.9.8
Requested by: Host: www.itwbooking.bjquwhcm.com
URL: https://www.itwbooking.bjquwhcm.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 50.31.134.90 Chicago, United States, ASN23352 (SERVERCENTRAL - Server Central Network, US),
Reverse DNS: mocha3026-web1.mochahost.com
Software: nginx /
Resource Hash: 377c8a27860862294f56f8ba7ec15484b681ffa1a530114a56f957baacbb7acd

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.itwbooking.bjquwhcm.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 17 Oct 2019 11:17:11 GMT
last-modified: Thu, 08 Nov 2018 17:23:07 GMT
server: nginx
etag: "5be470fb-3d5"
content-type: text/css
status: 200
cache-control: max-age=2592000
accept-ranges: bytes
content-length: 981
expires: Sat, 16 Nov 2019 11:17:11 GMT

GET
H2 404 easy-social-share-buttonsf9b8.css
www.itwbooking.bjquwhcm.com/etdlwwyzs7ibptm965zo1lyq-wpengine.netdna-ssl.com/wp-content/plugins/easy-social-share-buttons/assets/css/ 0
0 296ms
295ms Stylesheet
text/html 50.31.134.90
Server Central Ne...

General

Check archive.org

Show headers Download Go to

Full URL: https://www.itwbooking.bjquwhcm.com/etdlwwyzs7ibptm965zo1lyq-wpengine.netdna-ssl.com/wp-content/plugins/easy-social-share-buttons/assets/css/easy-social-share-buttonsf9b8.css?ver=4.0
Requested by: Host: www.itwbooking.bjquwhcm.com
URL: https://www.itwbooking.bjquwhcm.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 50.31.134.90 Chicago, United States, ASN23352 (SERVERCENTRAL - Server Central Network, US),
Reverse DNS: mocha3026-web1.mochahost.com
Software: nginx /
Resource Hash

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.itwbooking.bjquwhcm.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

status: 404
date: Thu, 17 Oct 2019 11:17:11 GMT
content-encoding: gzip
server: nginx
vary: Accept-Encoding
content-type: text/html

GET
H2 404 stylesf9b8.css
www.itwbooking.bjquwhcm.com/etdlwwyzs7ibptm965zo1lyq-wpengine.netdna-ssl.com/wp-content/plugins/easy-social-share-buttons/lib/modules/click-to-tweet/assets/css/ 0
0 295ms
295ms Stylesheet
text/html 50.31.134.90
Server Central Ne...

General

Check archive.org

Show headers Download Go to

Full URL: https://www.itwbooking.bjquwhcm.com/etdlwwyzs7ibptm965zo1lyq-wpengine.netdna-ssl.com/wp-content/plugins/easy-social-share-buttons/lib/modules/click-to-tweet/assets/css/stylesf9b8.css?ver=4.0
Requested by: Host: www.itwbooking.bjquwhcm.com
URL: https://www.itwbooking.bjquwhcm.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 50.31.134.90 Chicago, United States, ASN23352 (SERVERCENTRAL - Server Central Network, US),
Reverse DNS: mocha3026-web1.mochahost.com
Software: nginx /
Resource Hash

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.itwbooking.bjquwhcm.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

status: 404
date: Thu, 17 Oct 2019 11:17:11 GMT
content-encoding: gzip
server: nginx
vary: Accept-Encoding
content-type: text/html

GET
H2 200 jqueryb8ff.js Show response
www.itwbooking.bjquwhcm.com/etdlwwyzs7ibptm965zo1lyq-wpengine.netdna-ssl.com/wp-includes/js/jquery/ 95 KB
33 KB 363ms
363ms Script
application/javascript 50.31.134.90
Server Central Ne...

General

Check archive.org

Show headers Download Go to

Full URL: https://www.itwbooking.bjquwhcm.com/etdlwwyzs7ibptm965zo1lyq-wpengine.netdna-ssl.com/wp-includes/js/jquery/jqueryb8ff.js?ver=1.12.4
Requested by: Host: www.itwbooking.bjquwhcm.com
URL: https://www.itwbooking.bjquwhcm.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 50.31.134.90 Chicago, United States, ASN23352 (SERVERCENTRAL - Server Central Network, US),
Reverse DNS: mocha3026-web1.mochahost.com
Software: nginx /
Resource Hash: fc48d1d80ece71a79a7b39877f4104d49d3da6c3665cf6dc203000fb7df4447e

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.itwbooking.bjquwhcm.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 17 Oct 2019 11:17:12 GMT
content-encoding: gzip
last-modified: Thu, 08 Nov 2018 17:23:07 GMT
server: nginx
etag: W/"5be470fb-17ba0"
vary: Accept-Encoding
content-type: application/javascript
status: 200
cache-control: max-age=2592000
expires: Sat, 16 Nov 2019 11:17:12 GMT

GET
H2 200 jquery-migrate.min330a.js Show response
www.itwbooking.bjquwhcm.com/etdlwwyzs7ibptm965zo1lyq-wpengine.netdna-ssl.com/wp-includes/js/jquery/ 10 KB
4 KB 106ms
106ms Script
application/javascript 50.31.134.90
Server Central Ne...

General

Check archive.org

Show headers Download Go to

Full URL: https://www.itwbooking.bjquwhcm.com/etdlwwyzs7ibptm965zo1lyq-wpengine.netdna-ssl.com/wp-includes/js/jquery/jquery-migrate.min330a.js?ver=1.4.1
Requested by: Host: www.itwbooking.bjquwhcm.com
URL: https://www.itwbooking.bjquwhcm.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 50.31.134.90 Chicago, United States, ASN23352 (SERVERCENTRAL - Server Central Network, US),
Reverse DNS: mocha3026-web1.mochahost.com
Software: nginx /
Resource Hash: 48eb8b500ae6a38617b5738d2b3faec481922a7782246e31d2755c034a45cd5d

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.itwbooking.bjquwhcm.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 17 Oct 2019 11:17:12 GMT
content-encoding: gzip
last-modified: Thu, 08 Nov 2018 17:23:07 GMT
server: nginx
etag: W/"5be470fb-2748"
vary: Accept-Encoding
content-type: application/javascript
status: 200
cache-control: max-age=2592000
expires: Sat, 16 Nov 2019 11:17:12 GMT

GET
H2 200 adthrive.min.js Show response
ads.adthrive.com/core/v1/js/ 217 KB
57 KB 10ms
10ms Script
application/javascript 13.225.78.50
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.adthrive.com/core/v1/js/adthrive.min.js?threshold=34
Requested by: Host: ads.adthrive.com
URL: https://ads.adthrive.com/sites/58262713bbb11e24413c230b/ads.min.js?threshold=34
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 13.225.78.50 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: server-13-225-78-50.fra2.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: fc9105b8fff111487346d24228117b01b120a025e7226ca3e618c5d80533b780

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.itwbooking.bjquwhcm.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-amz-version-id: zg16uOEVPNyZssy1aCWfosQMUkk1Adh9
content-encoding: gzip
last-modified: Tue, 15 Oct 2019 16:44:41 GMT
server: AmazonS3
age: 2431
date: Thu, 17 Oct 2019 10:36:41 GMT
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
status: 200
cache-control: max-age=3600
x-amz-cf-pop: FRA2-C2
x-amz-cf-id: I9vNywE8IwBfe-Zr5tnTTpC_mjTwN8qaEGZu_q93vUf7xoPafDowRw==
via: 1.1 2f194b62c8c43859cbf5af8e53a8d2a7.cloudfront.net (CloudFront)

GET
H2 200 cmp.bundle.js Show response
ads.adthrive.com/gdpr/cmp/ 138 KB
37 KB 7ms
7ms Script
application/javascript 13.225.78.50
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.adthrive.com/gdpr/cmp/cmp.bundle.js
Requested by: Host: ads.adthrive.com
URL: https://ads.adthrive.com/core/v1/js/adthrive.min.js?threshold=34
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 13.225.78.50 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: server-13-225-78-50.fra2.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: cb6f68118b51eb89379519cbbc3526e741af47d7cec5b33622fb77c9be246494

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.itwbooking.bjquwhcm.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-amz-version-id: zjxD5hL7oUyyObH35q3OtNc0wGywJi6A
content-encoding: gzip
last-modified: Thu, 03 Oct 2019 16:40:44 GMT
server: AmazonS3
age: 1647
date: Sat, 05 Oct 2019 06:24:44 GMT
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
status: 200
cache-control: max-age=3600
x-amz-cf-pop: FRA2-C2
x-amz-cf-id: Tsb_gi06oR_u5fV1qqY1qBhz7SqxlASi1X38wzHmf7vGTMzpHi_ZsQ==
via: 1.1 2f194b62c8c43859cbf5af8e53a8d2a7.cloudfront.net (CloudFront)

GET
H2 200 gpt.js Show response
securepubads.g.doubleclick.net/tag/js/ 45 KB
15 KB 53ms
41ms Script
text/javascript 172.217.16.162
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/tag/js/gpt.js

Requested by

Host: ads.adthrive.com
URL: https://ads.adthrive.com/core/v1/js/adthrive.min.js?threshold=34

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.16.162 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

fra15s11-in-f2.1e100.net

Software

sffe /

Resource Hash

c18fe22eb7d7d041ee06e0017cff51877b1d51601c99b8f2a00550043568e1db

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.itwbooking.bjquwhcm.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 17 Oct 2019 11:17:12 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "309 / 262 of 1000 / last-modified: 1571261205"
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, max-age=900, stale-while-revalidate=3600
timing-allow-origin: *
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 14547
x-xss-protection: 0
expires: Thu, 17 Oct 2019 11:17:12 GMT

GET
H2 200 prebid.min.js Show response
ads.adthrive.com/core/gdpr/vendor/prebid/ 304 KB
97 KB 6ms
6ms Script
application/javascript 13.225.78.50
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.adthrive.com/core/gdpr/vendor/prebid/prebid.min.js
Requested by: Host: ads.adthrive.com
URL: https://ads.adthrive.com/core/v1/js/adthrive.min.js?threshold=34
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 13.225.78.50 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: server-13-225-78-50.fra2.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 50b6a58af23a06c1dc2b5c68a5b0383cd87f8749caf956c35d8e79dde677f4bf

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.itwbooking.bjquwhcm.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Wed, 16 Oct 2019 17:25:36 GMT
content-encoding: gzip
last-modified: Tue, 15 Oct 2019 16:44:42 GMT
server: AmazonS3
age: 943
vary: Accept-Encoding
x-cache: Hit from cloudfront
x-amz-version-id: DQInL6GQww2Fs8V26ZSr2fNui5dkc8QS
status: 200
cache-control: max-age=3600
x-amz-cf-pop: FRA2-C2
content-type: application/javascript
x-amz-cf-id: BXdr5wURLW7YEPKxgy_r3c6Y0axq7ppXBU2m-dNG68FdvN1JN3u6QQ==
via: 1.1 2f194b62c8c43859cbf5af8e53a8d2a7.cloudfront.net (CloudFront)

GET
H2 200 vendorlist.json Show response
ads.adthrive.com/gdpr/ 85 KB
16 KB 393ms
376ms Fetch
application/json 13.225.78.50
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.adthrive.com/gdpr/vendorlist.json
Requested by: Host: ads.adthrive.com
URL: https://ads.adthrive.com/gdpr/cmp/cmp.bundle.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 13.225.78.50 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: server-13-225-78-50.fra2.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: fbcadc50fa4ac76ebceea52b5afee2223a3cbd73c25cdd581492074df794dfc3

Request headers

Sec-Fetch-Mode: cors
Referer: https://www.itwbooking.bjquwhcm.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 17 Oct 2019 11:17:13 GMT
content-encoding: gzip
last-modified: Mon, 19 Aug 2019 20:15:17 GMT
server: AmazonS3
x-amz-cf-pop: FRA2-C2
status: 200
vary: Accept-Encoding,Origin,Access-Control-Request-Headers,Access-Control-Request-Method
access-control-allow-methods: GET
x-amz-version-id: 03uRNcexOFtsnYFqvyXNcxooi7Vs.uf0
access-control-allow-origin: *
access-control-max-age: 3000
x-cache: Miss from cloudfront
content-type: application/json
x-amz-cf-id: WN2JLHvpZtYE3UIsadHEFmXHL4-WW_yBY8UeF8kq6l6dWj9lukuvRw==
via: 1.1 6fa33d47af6f4da7007689083cfe9b9c.cloudfront.net (CloudFront)

GET
H2 200 google-acl68b3.js Show response
www.itwbooking.bjquwhcm.com/etdlwwyzs7ibptm965zo1lyq-wpengine.netdna-ssl.com/wp-content/plugins/ajax-comment-loading-fixed/js/ 2 KB
940 B 105ms
105ms Script
application/javascript 50.31.134.90
Server Central Ne...

General

Check archive.org

Show headers Download Go to

Full URL: https://www.itwbooking.bjquwhcm.com/etdlwwyzs7ibptm965zo1lyq-wpengine.netdna-ssl.com/wp-content/plugins/ajax-comment-loading-fixed/js/google-acl68b3.js?ver=1
Requested by: Host: www.itwbooking.bjquwhcm.com
URL: https://www.itwbooking.bjquwhcm.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 50.31.134.90 Chicago, United States, ASN23352 (SERVERCENTRAL - Server Central Network, US),
Reverse DNS: mocha3026-web1.mochahost.com
Software: nginx /
Resource Hash: a3f36a24a6d011969e763ac244a23822ae3301204a75e1c5366e9ff00edf6505

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.itwbooking.bjquwhcm.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 17 Oct 2019 11:17:12 GMT
content-encoding: gzip
last-modified: Thu, 08 Nov 2018 17:23:09 GMT
server: nginx
etag: W/"5be470fd-635"
vary: Accept-Encoding
content-type: application/javascript
status: 200
cache-control: max-age=2592000
expires: Sat, 16 Nov 2019 11:17:12 GMT

GET
H2 200 integrator.js Show response
adservice.google.de/adsid/ 109 B
656 B 31ms
18ms Script
application/javascript 2a00:1450:4001:815::2002
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/adsid/integrator.js?domain=www.itwbooking.bjquwhcm.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:815::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

cafe /

Resource Hash

0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.itwbooking.bjquwhcm.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

timing-allow-origin: *
date: Thu, 17 Oct 2019 11:17:12 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
status: 200
cache-control: private, no-cache, no-store
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 104
x-xss-protection: 0

GET
H2 200 integrator.js Show response
adservice.google.com/adsid/ 109 B
171 B 16ms
15ms Script
application/javascript 2a00:1450:4001:800::2002
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/adsid/integrator.js?domain=www.itwbooking.bjquwhcm.com

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

cafe /

Resource Hash

0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.itwbooking.bjquwhcm.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

timing-allow-origin: *
date: Thu, 17 Oct 2019 11:17:12 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
status: 200
cache-control: private, no-cache, no-store
content-disposition: attachment; filename="f.txt"
content-type: application/javascript; charset=UTF-8
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 104
x-xss-protection: 0

GET
H2 200 pubads_impl_2019100301.js Show response
securepubads.g.doubleclick.net/gpt/ 157 KB
58 KB 39ms
39ms Script
text/javascript 172.217.16.162
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gpt/pubads_impl_2019100301.js?21064780

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.16.162 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

fra15s11-in-f2.1e100.net

Software

sffe /

Resource Hash

d98e77e558ef5c298f4c28cdd1604914a16a3fcc9249904ba70c57d989fb6aab

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.itwbooking.bjquwhcm.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 17 Oct 2019 11:17:12 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Thu, 03 Oct 2019 13:06:21 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, immutable, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 58949
x-xss-protection: 0
expires: Thu, 17 Oct 2019 11:17:12 GMT

GET
H2 404 font-awesome.min.css
www.itwbooking.bjquwhcm.com/maxcdn.bootstrapcdn.com/font-awesome/4.4.0/css/ 0
0 123ms
123ms Stylesheet
text/html 50.31.134.90
Server Central Ne...

General

Check archive.org

Show headers Download Go to

Full URL: https://www.itwbooking.bjquwhcm.com/maxcdn.bootstrapcdn.com/font-awesome/4.4.0/css/font-awesome.min.css
Requested by: Host: www.itwbooking.bjquwhcm.com
URL: https://www.itwbooking.bjquwhcm.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 50.31.134.90 Chicago, United States, ASN23352 (SERVERCENTRAL - Server Central Network, US),
Reverse DNS: mocha3026-web1.mochahost.com
Software: nginx /
Resource Hash

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.itwbooking.bjquwhcm.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

status: 404
date: Thu, 17 Oct 2019 11:17:12 GMT
content-encoding: gzip
server: nginx
vary: Accept-Encoding
content-type: text/html

GET
H2 404 font-awesome.min.css
www.itwbooking.bjquwhcm.com/maxcdn.bootstrapcdn.com/font-awesome/4.7.0/css/ 0
0 123ms
122ms Stylesheet
text/html 50.31.134.90
Server Central Ne...

General

Check archive.org

Show headers Download Go to

Full URL: https://www.itwbooking.bjquwhcm.com/maxcdn.bootstrapcdn.com/font-awesome/4.7.0/css/font-awesome.min.css
Requested by: Host: www.itwbooking.bjquwhcm.com
URL: https://www.itwbooking.bjquwhcm.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 50.31.134.90 Chicago, United States, ASN23352 (SERVERCENTRAL - Server Central Network, US),
Reverse DNS: mocha3026-web1.mochahost.com
Software: nginx /
Resource Hash

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.itwbooking.bjquwhcm.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

status: 404
date: Thu, 17 Oct 2019 11:17:12 GMT
content-encoding: gzip
server: nginx
vary: Accept-Encoding
content-type: text/html

GET
H2 404 easy-social-share-buttonsf9b8.css
www.itwbooking.bjquwhcm.com/etdlwwyzs7ibptm965zo1lyq-wpengine.netdna-ssl.com/wp-content/plugins/easy-social-share-buttons/assets/css/ 0
0 124ms
123ms Stylesheet
text/html 50.31.134.90
Server Central Ne...

General

Check archive.org

Show headers Download Go to

Full URL: https://www.itwbooking.bjquwhcm.com/etdlwwyzs7ibptm965zo1lyq-wpengine.netdna-ssl.com/wp-content/plugins/easy-social-share-buttons/assets/css/easy-social-share-buttonsf9b8.css?ver=4.0
Requested by: Host: www.itwbooking.bjquwhcm.com
URL: https://www.itwbooking.bjquwhcm.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 50.31.134.90 Chicago, United States, ASN23352 (SERVERCENTRAL - Server Central Network, US),
Reverse DNS: mocha3026-web1.mochahost.com
Software: nginx /
Resource Hash

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.itwbooking.bjquwhcm.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

status: 404
date: Thu, 17 Oct 2019 11:17:12 GMT
content-encoding: gzip
server: nginx
vary: Accept-Encoding
content-type: text/html

GET
H2 404 stylesf9b8.css
www.itwbooking.bjquwhcm.com/etdlwwyzs7ibptm965zo1lyq-wpengine.netdna-ssl.com/wp-content/plugins/easy-social-share-buttons/lib/modules/click-to-tweet/assets/css/ 0
0 123ms
122ms Stylesheet
text/html 50.31.134.90
Server Central Ne...

General

Check archive.org

Show headers Download Go to

Full URL: https://www.itwbooking.bjquwhcm.com/etdlwwyzs7ibptm965zo1lyq-wpengine.netdna-ssl.com/wp-content/plugins/easy-social-share-buttons/lib/modules/click-to-tweet/assets/css/stylesf9b8.css?ver=4.0
Requested by: Host: www.itwbooking.bjquwhcm.com
URL: https://www.itwbooking.bjquwhcm.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 50.31.134.90 Chicago, United States, ASN23352 (SERVERCENTRAL - Server Central Network, US),
Reverse DNS: mocha3026-web1.mochahost.com
Software: nginx /
Resource Hash

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.itwbooking.bjquwhcm.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

status: 404
date: Thu, 17 Oct 2019 11:17:12 GMT
content-encoding: gzip
server: nginx
vary: Accept-Encoding
content-type: text/html

GET
H2 404 jquery.carouFredSel-6.2.1-min.js
www.itwbooking.bjquwhcm.com/etdlwwyzs7ibptm965zo1lyq-wpengine.netdna-ssl.com/wp-content/themes/hitherandthither/assets/scripts/ 0
0 124ms
122ms Script
text/html 50.31.134.90
Server Central Ne...

General

Check archive.org

Show headers Download Go to

Full URL: https://www.itwbooking.bjquwhcm.com/etdlwwyzs7ibptm965zo1lyq-wpengine.netdna-ssl.com/wp-content/themes/hitherandthither/assets/scripts/jquery.carouFredSel-6.2.1-min.js
Requested by: Host: www.itwbooking.bjquwhcm.com
URL: https://www.itwbooking.bjquwhcm.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 50.31.134.90 Chicago, United States, ASN23352 (SERVERCENTRAL - Server Central Network, US),
Reverse DNS: mocha3026-web1.mochahost.com
Software: nginx /
Resource Hash

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.itwbooking.bjquwhcm.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

status: 404
date: Thu, 17 Oct 2019 11:17:12 GMT
content-encoding: gzip
server: nginx
vary: Accept-Encoding
content-type: text/html

GET
H2 404 slideout.min.js
www.itwbooking.bjquwhcm.com/etdlwwyzs7ibptm965zo1lyq-wpengine.netdna-ssl.com/wp-content/themes/hitherandthither/assets/scripts/ 0
0 123ms
122ms Script
text/html 50.31.134.90
Server Central Ne...

General

Check archive.org

Show headers Download Go to

Full URL: https://www.itwbooking.bjquwhcm.com/etdlwwyzs7ibptm965zo1lyq-wpengine.netdna-ssl.com/wp-content/themes/hitherandthither/assets/scripts/slideout.min.js
Requested by: Host: www.itwbooking.bjquwhcm.com
URL: https://www.itwbooking.bjquwhcm.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 50.31.134.90 Chicago, United States, ASN23352 (SERVERCENTRAL - Server Central Network, US),
Reverse DNS: mocha3026-web1.mochahost.com
Software: nginx /
Resource Hash

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.itwbooking.bjquwhcm.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

status: 404
date: Thu, 17 Oct 2019 11:17:12 GMT
content-encoding: gzip
server: nginx
vary: Accept-Encoding
content-type: text/html

GET
H2 404 base.js
www.itwbooking.bjquwhcm.com/etdlwwyzs7ibptm965zo1lyq-wpengine.netdna-ssl.com/wp-content/themes/hitherandthither/assets/scripts/ 0
0 124ms
123ms Script
text/html 50.31.134.90
Server Central Ne...

General

Check archive.org

Show headers Download Go to

Full URL: https://www.itwbooking.bjquwhcm.com/etdlwwyzs7ibptm965zo1lyq-wpengine.netdna-ssl.com/wp-content/themes/hitherandthither/assets/scripts/base.js
Requested by: Host: www.itwbooking.bjquwhcm.com
URL: https://www.itwbooking.bjquwhcm.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 50.31.134.90 Chicago, United States, ASN23352 (SERVERCENTRAL - Server Central Network, US),
Reverse DNS: mocha3026-web1.mochahost.com
Software: nginx /
Resource Hash

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.itwbooking.bjquwhcm.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

status: 404
date: Thu, 17 Oct 2019 11:17:12 GMT
content-encoding: gzip
server: nginx
vary: Accept-Encoding
content-type: text/html

GET
H2 200 jquery-1.10.2.min.js Show response
www.itwbooking.bjquwhcm.com/code.jquery.com/ 91 KB
32 KB 117ms
116ms Script
application/javascript 50.31.134.90
Server Central Ne...

General

Check archive.org

Show headers Download Go to

Full URL: https://www.itwbooking.bjquwhcm.com/code.jquery.com/jquery-1.10.2.min.js
Requested by: Host: www.itwbooking.bjquwhcm.com
URL: https://www.itwbooking.bjquwhcm.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 50.31.134.90 Chicago, United States, ASN23352 (SERVERCENTRAL - Server Central Network, US),
Reverse DNS: mocha3026-web1.mochahost.com
Software: nginx /
Resource Hash: 0ba081f546084bd5097aa8a73c75931d5aa1fc4d6e846e53c21f98e6a1509988

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.itwbooking.bjquwhcm.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 17 Oct 2019 11:17:12 GMT
content-encoding: gzip
last-modified: Thu, 08 Nov 2018 17:23:04 GMT
server: nginx
etag: W/"5be470f8-16bb3"
vary: Accept-Encoding
content-type: application/javascript
status: 200
cache-control: max-age=2592000
expires: Sat, 16 Nov 2019 11:17:12 GMT

GET
H2 200 Hither-Thither Show response
static.fmpub.net/header/ 606 B
924 B 111ms
21ms Script
text/plain 151.101.13.182
Fastly

General

Check archive.org

Show headers Download Go to

Full URL: https://static.fmpub.net/header/Hither-Thither
Requested by: Host: www.itwbooking.bjquwhcm.com
URL: https://www.itwbooking.bjquwhcm.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.13.182 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software: Apache/2.4 /
Resource Hash: 8319192b1d195060d51bc8847db4dc3f75843d2aebb7cdea3c095225c3a36f95

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.itwbooking.bjquwhcm.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 17 Oct 2019 11:17:12 GMT
via: 1.1 varnish, 1.1 varnish
age: 249234
x-cache: HIT, HIT
status: 200
x-cache-hits: 2, 1
content-length: 606
x-served-by: cache-mdw17330-MDW, cache-fra19175-FRA
last-modified: Mon, 18 Mar 2019 14:06:00 GMT
server: Apache/2.4
x-timer: S1571311032.465481,VS0,VE6
fastly-debug-digest: b7d8739a9f2cc5a62ff828920c9f35bc177e3090c2d3206901291773a4660baa
access-control-allow-origin: *
cache-control: max-age=2592000
x-server: app1
accept-ranges: bytes
expires: Fri, 17 May 2019 06:20:15 GMT

GET
H2 200 hither-and-thither-sticky-logo.png
www.itwbooking.bjquwhcm.com/etdlwwyzs7ibptm965zo1lyq-wpengine.netdna-ssl.com/wp-content/themes/hitherandthither/images/ 8 KB
9 KB 121ms
120ms Image
image/png 50.31.134.90
Server Central Ne...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.itwbooking.bjquwhcm.com/etdlwwyzs7ibptm965zo1lyq-wpengine.netdna-ssl.com/wp-content/themes/hitherandthither/images/hither-and-thither-sticky-logo.png
Requested by: Host: www.itwbooking.bjquwhcm.com
URL: https://www.itwbooking.bjquwhcm.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 50.31.134.90 Chicago, United States, ASN23352 (SERVERCENTRAL - Server Central Network, US),
Reverse DNS: mocha3026-web1.mochahost.com
Software: nginx /
Resource Hash: 81f84dad654ea32e1084ee4661410aaf1b9eba7a2969b77a3fcad84d73712f2c

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.itwbooking.bjquwhcm.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 17 Oct 2019 11:17:12 GMT
last-modified: Thu, 08 Nov 2018 17:23:12 GMT
server: nginx
etag: "5be47100-2160"
content-type: image/png
status: 200
cache-control: max-age=2592000
accept-ranges: bytes
content-length: 8544
expires: Sat, 16 Nov 2019 11:17:12 GMT

GET
H2 200 hither-and-thither-revised-logo.jpg
www.itwbooking.bjquwhcm.com/etdlwwyzs7ibptm965zo1lyq-wpengine.netdna-ssl.com/wp-content/themes/hitherandthither/images/ 18 KB
18 KB 121ms
121ms Image
image/jpeg 50.31.134.90
Server Central Ne...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.itwbooking.bjquwhcm.com/etdlwwyzs7ibptm965zo1lyq-wpengine.netdna-ssl.com/wp-content/themes/hitherandthither/images/hither-and-thither-revised-logo.jpg
Requested by: Host: www.itwbooking.bjquwhcm.com
URL: https://www.itwbooking.bjquwhcm.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 50.31.134.90 Chicago, United States, ASN23352 (SERVERCENTRAL - Server Central Network, US),
Reverse DNS: mocha3026-web1.mochahost.com
Software: nginx /
Resource Hash: 9be196bc2e9ebb7741882c3598a430520dfe6269a311c363e83089912884f810

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.itwbooking.bjquwhcm.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 17 Oct 2019 11:17:12 GMT
last-modified: Thu, 08 Nov 2018 17:23:12 GMT
server: nginx
etag: "5be47100-4759"
content-type: image/jpeg
status: 200
cache-control: max-age=2592000
accept-ranges: bytes
content-length: 18265
expires: Sat, 16 Nov 2019 11:17:12 GMT

GET
H2 200 wpid9996-hitherandthither-5-225x290.jpg
www.itwbooking.bjquwhcm.com/etdlwwyzs7ibptm965zo1lyq-wpengine.netdna-ssl.com/wp-content/uploads/2013/05/ 17 KB
17 KB 117ms
108ms Image
image/jpeg 50.31.134.90
Server Central Ne...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.itwbooking.bjquwhcm.com/etdlwwyzs7ibptm965zo1lyq-wpengine.netdna-ssl.com/wp-content/uploads/2013/05/wpid9996-hitherandthither-5-225x290.jpg
Requested by: Host: www.itwbooking.bjquwhcm.com
URL: https://www.itwbooking.bjquwhcm.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 50.31.134.90 Chicago, United States, ASN23352 (SERVERCENTRAL - Server Central Network, US),
Reverse DNS: mocha3026-web1.mochahost.com
Software: nginx /
Resource Hash: 133b0c64c47f07b312c0e294d0c10254bf9e405a6bcb7f7ccd05d7cab8ae333d

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.itwbooking.bjquwhcm.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 17 Oct 2019 11:17:12 GMT
last-modified: Thu, 08 Nov 2018 17:24:02 GMT
server: nginx
etag: "5be47132-4245"
content-type: image/jpeg
status: 200
cache-control: max-age=2592000
accept-ranges: bytes
content-length: 16965
expires: Sat, 16 Nov 2019 11:17:12 GMT

GET
H2 200 wpid12894-Hither-and-Thither-2-225x290.jpg
www.itwbooking.bjquwhcm.com/etdlwwyzs7ibptm965zo1lyq-wpengine.netdna-ssl.com/wp-content/uploads/2013/09/ 14 KB
14 KB 117ms
109ms Image
image/jpeg 50.31.134.90
Server Central Ne...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.itwbooking.bjquwhcm.com/etdlwwyzs7ibptm965zo1lyq-wpengine.netdna-ssl.com/wp-content/uploads/2013/09/wpid12894-Hither-and-Thither-2-225x290.jpg
Requested by: Host: www.itwbooking.bjquwhcm.com
URL: https://www.itwbooking.bjquwhcm.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 50.31.134.90 Chicago, United States, ASN23352 (SERVERCENTRAL - Server Central Network, US),
Reverse DNS: mocha3026-web1.mochahost.com
Software: nginx /
Resource Hash: d96de9dbd4e9e5a370141560ccaea6caefab19b971023f3541e3cc4e8e22502d

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.itwbooking.bjquwhcm.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 17 Oct 2019 11:17:12 GMT
last-modified: Thu, 08 Nov 2018 17:24:11 GMT
server: nginx
etag: "5be4713b-3765"
content-type: image/jpeg
status: 200
cache-control: max-age=2592000
accept-ranges: bytes
content-length: 14181
expires: Sat, 16 Nov 2019 11:17:12 GMT

GET
H2 200 wpid13050-Hither-and-Thither-14-225x290.jpg
www.itwbooking.bjquwhcm.com/etdlwwyzs7ibptm965zo1lyq-wpengine.netdna-ssl.com/wp-content/uploads/2013/09/ 18 KB
18 KB 118ms
110ms Image
image/jpeg 50.31.134.90
Server Central Ne...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.itwbooking.bjquwhcm.com/etdlwwyzs7ibptm965zo1lyq-wpengine.netdna-ssl.com/wp-content/uploads/2013/09/wpid13050-Hither-and-Thither-14-225x290.jpg
Requested by: Host: www.itwbooking.bjquwhcm.com
URL: https://www.itwbooking.bjquwhcm.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 50.31.134.90 Chicago, United States, ASN23352 (SERVERCENTRAL - Server Central Network, US),
Reverse DNS: mocha3026-web1.mochahost.com
Software: nginx /
Resource Hash: 098900a62fc3bb14cd2248101ebb232511f555d88913a5a00f7cdd4ccf70fe76

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.itwbooking.bjquwhcm.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 17 Oct 2019 11:17:12 GMT
last-modified: Thu, 08 Nov 2018 17:24:14 GMT
server: nginx
etag: "5be4713e-4618"
content-type: image/jpeg
status: 200
cache-control: max-age=2592000
accept-ranges: bytes
content-length: 17944
expires: Sat, 16 Nov 2019 11:17:12 GMT

GET
H2 200 Living_HitherandThither-4-225x290.jpg
www.itwbooking.bjquwhcm.com/etdlwwyzs7ibptm965zo1lyq-wpengine.netdna-ssl.com/wp-content/uploads/2014/04/ 31 KB
31 KB 119ms
111ms Image
image/jpeg 50.31.134.90
Server Central Ne...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.itwbooking.bjquwhcm.com/etdlwwyzs7ibptm965zo1lyq-wpengine.netdna-ssl.com/wp-content/uploads/2014/04/Living_HitherandThither-4-225x290.jpg
Requested by: Host: www.itwbooking.bjquwhcm.com
URL: https://www.itwbooking.bjquwhcm.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 50.31.134.90 Chicago, United States, ASN23352 (SERVERCENTRAL - Server Central Network, US),
Reverse DNS: mocha3026-web1.mochahost.com
Software: nginx /
Resource Hash: 4160263430f7a9af8def64cdfedc63629067d1e76e7127fd3172d8d99f8b596d

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.itwbooking.bjquwhcm.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 17 Oct 2019 11:17:12 GMT
last-modified: Thu, 08 Nov 2018 17:24:31 GMT
server: nginx
etag: "5be4714f-7a97"
content-type: image/jpeg
status: 200
cache-control: max-age=2592000
accept-ranges: bytes
content-length: 31383
expires: Sat, 16 Nov 2019 11:17:12 GMT

GET
H2 200 wpid27240-IMG_7060-225x290.jpg
www.itwbooking.bjquwhcm.com/etdlwwyzs7ibptm965zo1lyq-wpengine.netdna-ssl.com/wp-content/uploads/2014/09/ 13 KB
13 KB 226ms
218ms Image
image/jpeg 50.31.134.90
Server Central Ne...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.itwbooking.bjquwhcm.com/etdlwwyzs7ibptm965zo1lyq-wpengine.netdna-ssl.com/wp-content/uploads/2014/09/wpid27240-IMG_7060-225x290.jpg
Requested by: Host: www.itwbooking.bjquwhcm.com
URL: https://www.itwbooking.bjquwhcm.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 50.31.134.90 Chicago, United States, ASN23352 (SERVERCENTRAL - Server Central Network, US),
Reverse DNS: mocha3026-web1.mochahost.com
Software: nginx /
Resource Hash: 905867dc2fabc8c138c18856bd76255410d4d2bd4d20d1c99dcf5404e233a24a

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.itwbooking.bjquwhcm.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 17 Oct 2019 11:17:12 GMT
last-modified: Thu, 08 Nov 2018 17:24:39 GMT
server: nginx
etag: "5be47157-3414"
content-type: image/jpeg
status: 200
cache-control: max-age=2592000
accept-ranges: bytes
content-length: 13332
expires: Sat, 16 Nov 2019 11:17:12 GMT

GET
H2 200 Toys-for-Preschoolers1-225x290.jpg
www.itwbooking.bjquwhcm.com/etdlwwyzs7ibptm965zo1lyq-wpengine.netdna-ssl.com/wp-content/uploads/2014/11/ 13 KB
13 KB 227ms
219ms Image
image/jpeg 50.31.134.90
Server Central Ne...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.itwbooking.bjquwhcm.com/etdlwwyzs7ibptm965zo1lyq-wpengine.netdna-ssl.com/wp-content/uploads/2014/11/Toys-for-Preschoolers1-225x290.jpg
Requested by: Host: www.itwbooking.bjquwhcm.com
URL: https://www.itwbooking.bjquwhcm.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 50.31.134.90 Chicago, United States, ASN23352 (SERVERCENTRAL - Server Central Network, US),
Reverse DNS: mocha3026-web1.mochahost.com
Software: nginx /
Resource Hash: 3d83e28a6481d86da8ba2a6a724617d25a711931819275502c0bcaf0ca49f3d1

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.itwbooking.bjquwhcm.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 17 Oct 2019 11:17:12 GMT
last-modified: Thu, 08 Nov 2018 17:24:44 GMT
server: nginx
etag: "5be4715c-321a"
content-type: image/jpeg
status: 200
cache-control: max-age=2592000
accept-ranges: bytes
content-length: 12826
expires: Sat, 16 Nov 2019 11:17:12 GMT

GET
H2 200 Chapin_1-225x290.jpg
www.itwbooking.bjquwhcm.com/etdlwwyzs7ibptm965zo1lyq-wpengine.netdna-ssl.com/wp-content/uploads/2015/02/ 11 KB
11 KB 227ms
219ms Image
image/jpeg 50.31.134.90
Server Central Ne...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.itwbooking.bjquwhcm.com/etdlwwyzs7ibptm965zo1lyq-wpengine.netdna-ssl.com/wp-content/uploads/2015/02/Chapin_1-225x290.jpg
Requested by: Host: www.itwbooking.bjquwhcm.com
URL: https://www.itwbooking.bjquwhcm.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 50.31.134.90 Chicago, United States, ASN23352 (SERVERCENTRAL - Server Central Network, US),
Reverse DNS: mocha3026-web1.mochahost.com
Software: nginx /
Resource Hash: 0e210e8f0c85689be321f4e96c866c7cd2e75a6fcefd9c70bcb9a775eca240aa

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.itwbooking.bjquwhcm.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 17 Oct 2019 11:17:12 GMT
last-modified: Thu, 08 Nov 2018 17:24:47 GMT
server: nginx
etag: "5be4715f-2bbf"
content-type: image/jpeg
status: 200
cache-control: max-age=2592000
accept-ranges: bytes
content-length: 11199
expires: Sat, 16 Nov 2019 11:17:12 GMT

GET
H2 200 caroline-de-maigret-for-madewell-3-700x1117-2-225x290.jpg
www.itwbooking.bjquwhcm.com/etdlwwyzs7ibptm965zo1lyq-wpengine.netdna-ssl.com/wp-content/uploads/2016/01/ 14 KB
14 KB 227ms
219ms Image
image/jpeg 50.31.134.90
Server Central Ne...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.itwbooking.bjquwhcm.com/etdlwwyzs7ibptm965zo1lyq-wpengine.netdna-ssl.com/wp-content/uploads/2016/01/caroline-de-maigret-for-madewell-3-700x1117-2-225x290.jpg
Requested by: Host: www.itwbooking.bjquwhcm.com
URL: https://www.itwbooking.bjquwhcm.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 50.31.134.90 Chicago, United States, ASN23352 (SERVERCENTRAL - Server Central Network, US),
Reverse DNS: mocha3026-web1.mochahost.com
Software: nginx /
Resource Hash: c77350dae6aaf1498d30676195ffdba98348f5cd6b6521a61a0a03b6ae2ecd69

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.itwbooking.bjquwhcm.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 17 Oct 2019 11:17:12 GMT
last-modified: Thu, 08 Nov 2018 17:25:13 GMT
server: nginx
etag: "5be47179-37f6"
content-type: image/jpeg
status: 200
cache-control: max-age=2592000
accept-ranges: bytes
content-length: 14326
expires: Sat, 16 Nov 2019 11:17:12 GMT

GET
H2 200 LosAngeles_HitherandThither-90-225x290.jpg
www.itwbooking.bjquwhcm.com/etdlwwyzs7ibptm965zo1lyq-wpengine.netdna-ssl.com/wp-content/uploads/2015/04/ 13 KB
13 KB 227ms
219ms Image
image/jpeg 50.31.134.90
Server Central Ne...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.itwbooking.bjquwhcm.com/etdlwwyzs7ibptm965zo1lyq-wpengine.netdna-ssl.com/wp-content/uploads/2015/04/LosAngeles_HitherandThither-90-225x290.jpg
Requested by: Host: www.itwbooking.bjquwhcm.com
URL: https://www.itwbooking.bjquwhcm.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 50.31.134.90 Chicago, United States, ASN23352 (SERVERCENTRAL - Server Central Network, US),
Reverse DNS: mocha3026-web1.mochahost.com
Software: nginx /
Resource Hash: 105bed075d39d7162485d10257983e8f23285373c9702bc56c40533ea8507a41

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.itwbooking.bjquwhcm.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 17 Oct 2019 11:17:12 GMT
last-modified: Thu, 08 Nov 2018 17:24:51 GMT
server: nginx
etag: "5be47163-3266"
content-type: image/jpeg
status: 200
cache-control: max-age=2592000
accept-ranges: bytes
content-length: 12902
expires: Sat, 16 Nov 2019 11:17:12 GMT

GET
H2 200 Best-Summer-Sandals-225x290.jpg
www.itwbooking.bjquwhcm.com/etdlwwyzs7ibptm965zo1lyq-wpengine.netdna-ssl.com/wp-content/uploads/2015/07/ 11 KB
11 KB 227ms
220ms Image
image/jpeg 50.31.134.90
Server Central Ne...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.itwbooking.bjquwhcm.com/etdlwwyzs7ibptm965zo1lyq-wpengine.netdna-ssl.com/wp-content/uploads/2015/07/Best-Summer-Sandals-225x290.jpg
Requested by: Host: www.itwbooking.bjquwhcm.com
URL: https://www.itwbooking.bjquwhcm.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 50.31.134.90 Chicago, United States, ASN23352 (SERVERCENTRAL - Server Central Network, US),
Reverse DNS: mocha3026-web1.mochahost.com
Software: nginx /
Resource Hash: 506882a5c80c401495783d6130a37b7a9105d807b04a8cba00c4ed8bbc481015

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.itwbooking.bjquwhcm.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 17 Oct 2019 11:17:12 GMT
last-modified: Thu, 08 Nov 2018 17:24:55 GMT
server: nginx
etag: "5be47167-2c93"
content-type: image/jpeg
status: 200
cache-control: max-age=2592000
accept-ranges: bytes
content-length: 11411
expires: Sat, 16 Nov 2019 11:17:12 GMT

GET
H2 200 Mexico-City-Travelogue-Hither-Thither-51-225x290.jpg
www.itwbooking.bjquwhcm.com/etdlwwyzs7ibptm965zo1lyq-wpengine.netdna-ssl.com/wp-content/uploads/2015/07/ 25 KB
25 KB 227ms
220ms Image
image/jpeg 50.31.134.90
Server Central Ne...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.itwbooking.bjquwhcm.com/etdlwwyzs7ibptm965zo1lyq-wpengine.netdna-ssl.com/wp-content/uploads/2015/07/Mexico-City-Travelogue-Hither-Thither-51-225x290.jpg
Requested by: Host: www.itwbooking.bjquwhcm.com
URL: https://www.itwbooking.bjquwhcm.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 50.31.134.90 Chicago, United States, ASN23352 (SERVERCENTRAL - Server Central Network, US),
Reverse DNS: mocha3026-web1.mochahost.com
Software: nginx /
Resource Hash: c4360c310c5c05c1c037cc69c271d62c6fc6e4b81e075e1b5d81ee94ec028b15

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.itwbooking.bjquwhcm.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 17 Oct 2019 11:17:12 GMT
last-modified: Thu, 08 Nov 2018 17:25:00 GMT
server: nginx
etag: "5be4716c-62b9"
content-type: image/jpeg
status: 200
cache-control: max-age=2592000
accept-ranges: bytes
content-length: 25273
expires: Sat, 16 Nov 2019 11:17:12 GMT

GET
H2 200 Italian-Dinner-Party-Recipe-HitherAndThither-1-225x290.jpg
www.itwbooking.bjquwhcm.com/etdlwwyzs7ibptm965zo1lyq-wpengine.netdna-ssl.com/wp-content/uploads/2016/01/ 24 KB
24 KB 227ms
220ms Image
image/jpeg 50.31.134.90
Server Central Ne...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.itwbooking.bjquwhcm.com/etdlwwyzs7ibptm965zo1lyq-wpengine.netdna-ssl.com/wp-content/uploads/2016/01/Italian-Dinner-Party-Recipe-HitherAndThither-1-225x290.jpg
Requested by: Host: www.itwbooking.bjquwhcm.com
URL: https://www.itwbooking.bjquwhcm.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 50.31.134.90 Chicago, United States, ASN23352 (SERVERCENTRAL - Server Central Network, US),
Reverse DNS: mocha3026-web1.mochahost.com
Software: nginx /
Resource Hash: cc576c8d2a22f7df53d5fdeb71b6909798f5afe85dbf690797d76f0852a95314

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.itwbooking.bjquwhcm.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 17 Oct 2019 11:17:12 GMT
last-modified: Thu, 08 Nov 2018 17:25:14 GMT
server: nginx
etag: "5be4717a-6015"
content-type: image/jpeg
status: 200
cache-control: max-age=2592000
accept-ranges: bytes
content-length: 24597
expires: Sat, 16 Nov 2019 11:17:12 GMT

GET
H2 200 HitherAndThither_Eggs_SoftCooked-01-225x290.jpg
www.itwbooking.bjquwhcm.com/etdlwwyzs7ibptm965zo1lyq-wpengine.netdna-ssl.com/wp-content/uploads/2015/05/ 32 KB
32 KB 227ms
220ms Image
image/jpeg 50.31.134.90
Server Central Ne...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.itwbooking.bjquwhcm.com/etdlwwyzs7ibptm965zo1lyq-wpengine.netdna-ssl.com/wp-content/uploads/2015/05/HitherAndThither_Eggs_SoftCooked-01-225x290.jpg
Requested by: Host: www.itwbooking.bjquwhcm.com
URL: https://www.itwbooking.bjquwhcm.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 50.31.134.90 Chicago, United States, ASN23352 (SERVERCENTRAL - Server Central Network, US),
Reverse DNS: mocha3026-web1.mochahost.com
Software: nginx /
Resource Hash: 50009939c267cc52666aeb9ecced1dfee6071e79a2fbc939cc49a3ff1c21e17f

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.itwbooking.bjquwhcm.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 17 Oct 2019 11:17:12 GMT
last-modified: Thu, 08 Nov 2018 17:24:52 GMT
server: nginx
etag: "5be47164-804b"
content-type: image/jpeg
status: 200
cache-control: max-age=2592000
accept-ranges: bytes
content-length: 32843
expires: Sat, 16 Nov 2019 11:17:12 GMT

GET
H2 200 IMG_0096-225x290.jpg
www.itwbooking.bjquwhcm.com/etdlwwyzs7ibptm965zo1lyq-wpengine.netdna-ssl.com/wp-content/uploads/2016/03/ 14 KB
14 KB 228ms
220ms Image
image/jpeg 50.31.134.90
Server Central Ne...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.itwbooking.bjquwhcm.com/etdlwwyzs7ibptm965zo1lyq-wpengine.netdna-ssl.com/wp-content/uploads/2016/03/IMG_0096-225x290.jpg
Requested by: Host: www.itwbooking.bjquwhcm.com
URL: https://www.itwbooking.bjquwhcm.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 50.31.134.90 Chicago, United States, ASN23352 (SERVERCENTRAL - Server Central Network, US),
Reverse DNS: mocha3026-web1.mochahost.com
Software: nginx /
Resource Hash: cc7e8fa17d9b14711dca51cc0204442c8a8c71e1524dc8d141e2ba029d76e69c

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.itwbooking.bjquwhcm.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 17 Oct 2019 11:17:12 GMT
last-modified: Thu, 08 Nov 2018 17:25:21 GMT
server: nginx
etag: "5be47181-392d"
content-type: image/jpeg
status: 200
cache-control: max-age=2592000
accept-ranges: bytes
content-length: 14637
expires: Sat, 16 Nov 2019 11:17:12 GMT

GET
H2 200 Los-Angeles-Spring-Break-Travelogue-Hither-and-Thither-21-225x290.jpg
www.itwbooking.bjquwhcm.com/etdlwwyzs7ibptm965zo1lyq-wpengine.netdna-ssl.com/wp-content/uploads/2016/04/ 42 KB
42 KB 228ms
221ms Image
image/jpeg 50.31.134.90
Server Central Ne...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.itwbooking.bjquwhcm.com/etdlwwyzs7ibptm965zo1lyq-wpengine.netdna-ssl.com/wp-content/uploads/2016/04/Los-Angeles-Spring-Break-Travelogue-Hither-and-Thither-21-225x290.jpg
Requested by: Host: www.itwbooking.bjquwhcm.com
URL: https://www.itwbooking.bjquwhcm.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 50.31.134.90 Chicago, United States, ASN23352 (SERVERCENTRAL - Server Central Network, US),
Reverse DNS: mocha3026-web1.mochahost.com
Software: nginx /
Resource Hash: 3b4905996edf524768740bc46f713c138c41c9b1af49d39b93e420e95f593a16

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.itwbooking.bjquwhcm.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 17 Oct 2019 11:17:12 GMT
last-modified: Thu, 08 Nov 2018 17:25:27 GMT
server: nginx
etag: "5be47187-a662"
content-type: image/jpeg
status: 200
cache-control: max-age=2592000
accept-ranges: bytes
content-length: 42594
expires: Sat, 16 Nov 2019 11:17:12 GMT

GET
H2 200 Skyler-Bedroom-2018_Hither-and-Thither_-Ashley-Muir-Bruhn-2.jpg
etdlwwyzs7ibptm965zo1lyq-wpengine.netdna-ssl.com/wp-content/uploads/2018/11/ 193 KB
193 KB 37ms
11ms Image
image/jpeg 94.31.29.64
Highwinds Network...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://etdlwwyzs7ibptm965zo1lyq-wpengine.netdna-ssl.com/wp-content/uploads/2018/11/Skyler-Bedroom-2018_Hither-and-Thither_-Ashley-Muir-Bruhn-2.jpg
Requested by: Host: www.itwbooking.bjquwhcm.com
URL: https://www.itwbooking.bjquwhcm.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 94.31.29.64 , United Kingdom, ASN33438 (HIGHWINDS2 - Highwinds Network Group, Inc., US),
Reverse DNS: 94.31.29.64.IPYX-077437-ZYO.above.net
Software: NetDNA-cache/2.2 /
Resource Hash: fc5fb008a73f4352420e68490d398ffbc487ba468344e065db3c0c71242e43bf

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.itwbooking.bjquwhcm.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 17 Oct 2019 11:17:12 GMT
last-modified: Wed, 07 Nov 2018 04:53:24 GMT
server: NetDNA-cache/2.2
status: 200
etag: "5be26fc4-302b6"
vary: Accept-Encoding
x-cache: HIT
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
content-length: 197302

GET
H2 200 email-decode.min.js Show response
www.itwbooking.bjquwhcm.com/cdn-cgi/scripts/5c5dd728/cloudflare-static/ 1 KB
850 B 106ms
104ms Script
application/javascript 50.31.134.90
Server Central Ne...

General

Check archive.org

Show headers Download Go to

Full URL: https://www.itwbooking.bjquwhcm.com/cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js
Requested by: Host: www.itwbooking.bjquwhcm.com
URL: https://www.itwbooking.bjquwhcm.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 50.31.134.90 Chicago, United States, ASN23352 (SERVERCENTRAL - Server Central Network, US),
Reverse DNS: mocha3026-web1.mochahost.com
Software: nginx /
Resource Hash: 2595496fe48df6fcf9b1bc57c29a744c121eb4dd11566466bc13d2e52e6bbcc8

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.itwbooking.bjquwhcm.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 17 Oct 2019 11:17:12 GMT
content-encoding: gzip
last-modified: Thu, 08 Nov 2018 17:18:48 GMT
server: nginx
etag: W/"5be46ff8-4d7"
vary: Accept-Encoding
content-type: application/javascript
status: 200
cache-control: max-age=2592000
expires: Sat, 16 Nov 2019 11:17:12 GMT

GET
H2 200 8733 Show response
static.fmpub.net/zone/ 1 B
255 B 14ms
11ms Script
application/x-javascript 151.101.13.182
Fastly

General

Check archive.org

Show headers Download Go to

Full URL: https://static.fmpub.net/zone/8733
Requested by: Host: www.itwbooking.bjquwhcm.com
URL: https://www.itwbooking.bjquwhcm.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.13.182 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software: Apache/2.4 /
Resource Hash: 6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.itwbooking.bjquwhcm.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 17 Oct 2019 11:17:12 GMT
content-encoding: gzip
age: 2128058
x-cache: HIT, HIT
status: 200
content-length: 21
x-served-by: cache-mdw17336-MDW, cache-fra19175-FRA
access-control-allow-origin: *
last-modified: Tue, 19 Mar 2019 04:21:39 GMT
server: Apache/2.4
x-timer: S1571311032.493130,VS0,VE5
fastly-debug-digest: 6313768e6da38f0d309d628fb0221346d7a418685f59e169fe4d428ae749b238
vary: Accept-Encoding
content-type: application/x-javascript
via: 1.1 varnish, 1.1 varnish
expires: Mon, 24 Jun 2019 20:07:01 GMT
cache-control: max-age=2592000
x-server: app1
accept-ranges: bytes
x-cache-hits: 1, 1

GET
H2 200 This-is-Mexico-City-Abby-Clawson-Low-700x891.jpg
etdlwwyzs7ibptm965zo1lyq-wpengine.netdna-ssl.com/wp-content/uploads/2018/11/ 83 KB
83 KB 363ms
336ms Image
image/jpeg 94.31.29.64
Highwinds Network...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://etdlwwyzs7ibptm965zo1lyq-wpengine.netdna-ssl.com/wp-content/uploads/2018/11/This-is-Mexico-City-Abby-Clawson-Low-700x891.jpg
Requested by: Host: www.itwbooking.bjquwhcm.com
URL: https://www.itwbooking.bjquwhcm.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 94.31.29.64 , United Kingdom, ASN33438 (HIGHWINDS2 - Highwinds Network Group, Inc., US),
Reverse DNS: 94.31.29.64.IPYX-077437-ZYO.above.net
Software: NetDNA-cache/2.2 /
Resource Hash: 92801a1f91c191498c4f00c0484dcd03ae6f9470689b9161fb4967b505b24aa7

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.itwbooking.bjquwhcm.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 17 Oct 2019 11:17:13 GMT
last-modified: Fri, 02 Nov 2018 19:36:28 GMT
server: NetDNA-cache/2.2
status: 200
etag: "5bdca73c-14b0b"
vary: Accept-Encoding
x-cache: MISS
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
content-length: 84747

GET
H2 200 Lake-Tahoe-Hither-and-Thither-12.jpg
etdlwwyzs7ibptm965zo1lyq-wpengine.netdna-ssl.com/wp-content/uploads/2016/10/ 432 KB
432 KB 363ms
336ms Image
image/jpeg 94.31.29.64
Highwinds Network...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://etdlwwyzs7ibptm965zo1lyq-wpengine.netdna-ssl.com/wp-content/uploads/2016/10/Lake-Tahoe-Hither-and-Thither-12.jpg
Requested by: Host: www.itwbooking.bjquwhcm.com
URL: https://www.itwbooking.bjquwhcm.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 94.31.29.64 , United Kingdom, ASN33438 (HIGHWINDS2 - Highwinds Network Group, Inc., US),
Reverse DNS: 94.31.29.64.IPYX-077437-ZYO.above.net
Software: NetDNA-cache/2.2 /
Resource Hash: d45aef198b86e80422ab517eed577c334d8ffbcc0d5ddae603f64f0016056135

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.itwbooking.bjquwhcm.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 17 Oct 2019 11:17:13 GMT
last-modified: Wed, 26 Apr 2017 18:30:16 GMT
server: NetDNA-cache/2.2
status: 200
etag: "5900e738-6beb7"
vary: Accept-Encoding
x-cache: MISS
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
content-length: 442039

GET
H2 200 Ashley-HitherAndThither-1-2-2.jpg
www.itwbooking.bjquwhcm.com/etdlwwyzs7ibptm965zo1lyq-wpengine.netdna-ssl.com/wp-content/themes/hitherandthither/images/ 49 KB
49 KB 227ms
221ms Image
image/jpeg 50.31.134.90
Server Central Ne...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.itwbooking.bjquwhcm.com/etdlwwyzs7ibptm965zo1lyq-wpengine.netdna-ssl.com/wp-content/themes/hitherandthither/images/Ashley-HitherAndThither-1-2-2.jpg
Requested by: Host: www.itwbooking.bjquwhcm.com
URL: https://www.itwbooking.bjquwhcm.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 50.31.134.90 Chicago, United States, ASN23352 (SERVERCENTRAL - Server Central Network, US),
Reverse DNS: mocha3026-web1.mochahost.com
Software: nginx /
Resource Hash: ee3279443fbd6d7e0523ec8d8d37c28e177474c11ccbb77db9fa97bb248a9c72

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.itwbooking.bjquwhcm.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 17 Oct 2019 11:17:12 GMT
last-modified: Thu, 08 Nov 2018 17:23:11 GMT
server: nginx
etag: "5be470ff-c289"
content-type: image/jpeg
status: 200
cache-control: max-age=2592000
accept-ranges: bytes
content-length: 49801
expires: Sat, 16 Nov 2019 11:17:12 GMT

GET
H2 404 Halloween-2018_-Ashley-Muir-Bruhn-11-225x290.jpg
www.itwbooking.bjquwhcm.com/etdlwwyzs7ibptm965zo1lyq-wpengine.netdna-ssl.com/wp-content/uploads/2018/10/ 4 KB
4 KB 228ms
221ms Image
text/html 50.31.134.90
Server Central Ne...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.itwbooking.bjquwhcm.com/etdlwwyzs7ibptm965zo1lyq-wpengine.netdna-ssl.com/wp-content/uploads/2018/10/Halloween-2018_-Ashley-Muir-Bruhn-11-225x290.jpg
Requested by: Host: www.itwbooking.bjquwhcm.com
URL: https://www.itwbooking.bjquwhcm.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 50.31.134.90 Chicago, United States, ASN23352 (SERVERCENTRAL - Server Central Network, US),
Reverse DNS: mocha3026-web1.mochahost.com
Software: nginx /
Resource Hash: 60c223e599936a8606fade4273d8c785bcfb657dea40c6698904d1ee295a1da5

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.itwbooking.bjquwhcm.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

status: 404
date: Thu, 17 Oct 2019 11:17:12 GMT
content-encoding: gzip
server: nginx
vary: Accept-Encoding
content-type: text/html

GET
H2 404 Travelogue-Big-Sur_edited-1-225x290.jpg
www.itwbooking.bjquwhcm.com/etdlwwyzs7ibptm965zo1lyq-wpengine.netdna-ssl.com/wp-content/uploads/2018/10/ 4 KB
4 KB 436ms
429ms Image
text/html 50.31.134.90
Server Central Ne...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.itwbooking.bjquwhcm.com/etdlwwyzs7ibptm965zo1lyq-wpengine.netdna-ssl.com/wp-content/uploads/2018/10/Travelogue-Big-Sur_edited-1-225x290.jpg
Requested by: Host: www.itwbooking.bjquwhcm.com
URL: https://www.itwbooking.bjquwhcm.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 50.31.134.90 Chicago, United States, ASN23352 (SERVERCENTRAL - Server Central Network, US),
Reverse DNS: mocha3026-web1.mochahost.com
Software: nginx /
Resource Hash: 60c223e599936a8606fade4273d8c785bcfb657dea40c6698904d1ee295a1da5

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.itwbooking.bjquwhcm.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

status: 404
date: Thu, 17 Oct 2019 11:17:12 GMT
content-encoding: gzip
server: nginx
vary: Accept-Encoding
content-type: text/html

GET
H2 404 Duffle-Coat-AF-700x875-1.jpeg-225x290.jpg
www.itwbooking.bjquwhcm.com/etdlwwyzs7ibptm965zo1lyq-wpengine.netdna-ssl.com/wp-content/uploads/2018/10/ 4 KB
4 KB 435ms
429ms Image
text/html 50.31.134.90
Server Central Ne...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.itwbooking.bjquwhcm.com/etdlwwyzs7ibptm965zo1lyq-wpengine.netdna-ssl.com/wp-content/uploads/2018/10/Duffle-Coat-AF-700x875-1.jpeg-225x290.jpg
Requested by: Host: www.itwbooking.bjquwhcm.com
URL: https://www.itwbooking.bjquwhcm.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 50.31.134.90 Chicago, United States, ASN23352 (SERVERCENTRAL - Server Central Network, US),
Reverse DNS: mocha3026-web1.mochahost.com
Software: nginx /
Resource Hash: 60c223e599936a8606fade4273d8c785bcfb657dea40c6698904d1ee295a1da5

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.itwbooking.bjquwhcm.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

status: 404
date: Thu, 17 Oct 2019 11:17:12 GMT
content-encoding: gzip
server: nginx
vary: Accept-Encoding
content-type: text/html

GET
H2 404 Point-Lobos_-Hither-and-Thither-7-225x290.jpg
www.itwbooking.bjquwhcm.com/etdlwwyzs7ibptm965zo1lyq-wpengine.netdna-ssl.com/wp-content/uploads/2018/10/ 4 KB
4 KB 436ms
430ms Image
text/html 50.31.134.90
Server Central Ne...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.itwbooking.bjquwhcm.com/etdlwwyzs7ibptm965zo1lyq-wpengine.netdna-ssl.com/wp-content/uploads/2018/10/Point-Lobos_-Hither-and-Thither-7-225x290.jpg
Requested by: Host: www.itwbooking.bjquwhcm.com
URL: https://www.itwbooking.bjquwhcm.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 50.31.134.90 Chicago, United States, ASN23352 (SERVERCENTRAL - Server Central Network, US),
Reverse DNS: mocha3026-web1.mochahost.com
Software: nginx /
Resource Hash: 60c223e599936a8606fade4273d8c785bcfb657dea40c6698904d1ee295a1da5

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.itwbooking.bjquwhcm.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

status: 404
date: Thu, 17 Oct 2019 11:17:12 GMT
content-encoding: gzip
server: nginx
vary: Accept-Encoding
content-type: text/html

GET
H2 404 IMG_6271-700x1050-225x290.jpg
www.itwbooking.bjquwhcm.com/etdlwwyzs7ibptm965zo1lyq-wpengine.netdna-ssl.com/wp-content/uploads/2018/10/ 4 KB
4 KB 435ms
430ms Image
text/html 50.31.134.90
Server Central Ne...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.itwbooking.bjquwhcm.com/etdlwwyzs7ibptm965zo1lyq-wpengine.netdna-ssl.com/wp-content/uploads/2018/10/IMG_6271-700x1050-225x290.jpg
Requested by: Host: www.itwbooking.bjquwhcm.com
URL: https://www.itwbooking.bjquwhcm.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 50.31.134.90 Chicago, United States, ASN23352 (SERVERCENTRAL - Server Central Network, US),
Reverse DNS: mocha3026-web1.mochahost.com
Software: nginx /
Resource Hash: 60c223e599936a8606fade4273d8c785bcfb657dea40c6698904d1ee295a1da5

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.itwbooking.bjquwhcm.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

status: 404
date: Thu, 17 Oct 2019 11:17:12 GMT
content-encoding: gzip
server: nginx
vary: Accept-Encoding
content-type: text/html

GET
H2 404 Halloween-2017-Hither-Thither-1-5-225x290.jpg
www.itwbooking.bjquwhcm.com/etdlwwyzs7ibptm965zo1lyq-wpengine.netdna-ssl.com/wp-content/uploads/2017/11/ 4 KB
4 KB 435ms
430ms Image
text/html 50.31.134.90
Server Central Ne...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.itwbooking.bjquwhcm.com/etdlwwyzs7ibptm965zo1lyq-wpengine.netdna-ssl.com/wp-content/uploads/2017/11/Halloween-2017-Hither-Thither-1-5-225x290.jpg
Requested by: Host: www.itwbooking.bjquwhcm.com
URL: https://www.itwbooking.bjquwhcm.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 50.31.134.90 Chicago, United States, ASN23352 (SERVERCENTRAL - Server Central Network, US),
Reverse DNS: mocha3026-web1.mochahost.com
Software: nginx /
Resource Hash: 60c223e599936a8606fade4273d8c785bcfb657dea40c6698904d1ee295a1da5

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.itwbooking.bjquwhcm.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

status: 404
date: Thu, 17 Oct 2019 11:17:12 GMT
content-encoding: gzip
server: nginx
vary: Accept-Encoding
content-type: text/html

GET
H2 404 Autumn-Harvest-Salad-Wine-Pairing-Frei-Hither-and-Thither-6-225x290.jpg
www.itwbooking.bjquwhcm.com/etdlwwyzs7ibptm965zo1lyq-wpengine.netdna-ssl.com/wp-content/uploads/2018/10/ 4 KB
4 KB 436ms
431ms Image
text/html 50.31.134.90
Server Central Ne...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.itwbooking.bjquwhcm.com/etdlwwyzs7ibptm965zo1lyq-wpengine.netdna-ssl.com/wp-content/uploads/2018/10/Autumn-Harvest-Salad-Wine-Pairing-Frei-Hither-and-Thither-6-225x290.jpg
Requested by: Host: www.itwbooking.bjquwhcm.com
URL: https://www.itwbooking.bjquwhcm.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 50.31.134.90 Chicago, United States, ASN23352 (SERVERCENTRAL - Server Central Network, US),
Reverse DNS: mocha3026-web1.mochahost.com
Software: nginx /
Resource Hash: 60c223e599936a8606fade4273d8c785bcfb657dea40c6698904d1ee295a1da5

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.itwbooking.bjquwhcm.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

status: 404
date: Thu, 17 Oct 2019 11:17:12 GMT
content-encoding: gzip
server: nginx
vary: Accept-Encoding
content-type: text/html

GET
H2 404 Yosemite-Packing-HitherAndThither-9-700x1050-225x290.jpg
www.itwbooking.bjquwhcm.com/etdlwwyzs7ibptm965zo1lyq-wpengine.netdna-ssl.com/wp-content/uploads/2018/10/ 4 KB
4 KB 436ms
431ms Image
text/html 50.31.134.90
Server Central Ne...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.itwbooking.bjquwhcm.com/etdlwwyzs7ibptm965zo1lyq-wpengine.netdna-ssl.com/wp-content/uploads/2018/10/Yosemite-Packing-HitherAndThither-9-700x1050-225x290.jpg
Requested by: Host: www.itwbooking.bjquwhcm.com
URL: https://www.itwbooking.bjquwhcm.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 50.31.134.90 Chicago, United States, ASN23352 (SERVERCENTRAL - Server Central Network, US),
Reverse DNS: mocha3026-web1.mochahost.com
Software: nginx /
Resource Hash: 60c223e599936a8606fade4273d8c785bcfb657dea40c6698904d1ee295a1da5

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.itwbooking.bjquwhcm.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

status: 404
date: Thu, 17 Oct 2019 11:17:12 GMT
content-encoding: gzip
server: nginx
vary: Accept-Encoding
content-type: text/html

GET
H2 200 lightwidget.js Show response
www.itwbooking.bjquwhcm.com/cdn.lightwidget.com/widgets/ 673 B
855 B 107ms
106ms Script
application/javascript 50.31.134.90
Server Central Ne...

General

Check archive.org

Show headers Download Go to

Full URL: https://www.itwbooking.bjquwhcm.com/cdn.lightwidget.com/widgets/lightwidget.js
Requested by: Host: www.itwbooking.bjquwhcm.com
URL: https://www.itwbooking.bjquwhcm.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 50.31.134.90 Chicago, United States, ASN23352 (SERVERCENTRAL - Server Central Network, US),
Reverse DNS: mocha3026-web1.mochahost.com
Software: nginx /
Resource Hash: 43c9a5ee3fd163a6a99bb61e34c68849684f12eaf7d281ca58b0692458dab182

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.itwbooking.bjquwhcm.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 17 Oct 2019 11:17:12 GMT
last-modified: Thu, 08 Nov 2018 17:23:04 GMT
server: nginx
etag: "5be470f8-2a1"
content-type: application/javascript
status: 200
cache-control: max-age=2592000
accept-ranges: bytes
content-length: 673
expires: Sat, 16 Nov 2019 11:17:12 GMT

GET
H2 200 Screen-Shot-2016-04-03-at-10.10.53-PM-170x170.png
etdlwwyzs7ibptm965zo1lyq-wpengine.netdna-ssl.com/wp-content/uploads/2016/04/ 60 KB
60 KB 473ms
449ms Image
image/png 94.31.29.64
Highwinds Network...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://etdlwwyzs7ibptm965zo1lyq-wpengine.netdna-ssl.com/wp-content/uploads/2016/04/Screen-Shot-2016-04-03-at-10.10.53-PM-170x170.png
Requested by: Host: www.itwbooking.bjquwhcm.com
URL: https://www.itwbooking.bjquwhcm.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 94.31.29.64 , United Kingdom, ASN33438 (HIGHWINDS2 - Highwinds Network Group, Inc., US),
Reverse DNS: 94.31.29.64.IPYX-077437-ZYO.above.net
Software: NetDNA-cache/2.2 /
Resource Hash: 51288b1b3c35b6246e27c44d91bbe7b8da83f8bfc7182fc695c1d44cdeb57ef7

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.itwbooking.bjquwhcm.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 17 Oct 2019 11:17:13 GMT
last-modified: Tue, 30 Jan 2018 14:58:58 GMT
server: NetDNA-cache/2.2
status: 200
etag: "5a708832-ee4f"
vary: Accept-Encoding
x-cache: MISS
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
content-length: 61007

GET
H2 200 51H8x07Fd7L-170x170.jpg
etdlwwyzs7ibptm965zo1lyq-wpengine.netdna-ssl.com/wp-content/uploads/2016/04/ 6 KB
6 KB 248ms
224ms Image
image/jpeg 94.31.29.64
Highwinds Network...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://etdlwwyzs7ibptm965zo1lyq-wpengine.netdna-ssl.com/wp-content/uploads/2016/04/51H8x07Fd7L-170x170.jpg
Requested by: Host: www.itwbooking.bjquwhcm.com
URL: https://www.itwbooking.bjquwhcm.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 94.31.29.64 , United Kingdom, ASN33438 (HIGHWINDS2 - Highwinds Network Group, Inc., US),
Reverse DNS: 94.31.29.64.IPYX-077437-ZYO.above.net
Software: NetDNA-cache/2.2 /
Resource Hash: a1a62d2c7303f84833949bfbd45c62323a96edc820885d8c3954783dc21cefc5

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.itwbooking.bjquwhcm.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 17 Oct 2019 11:17:12 GMT
last-modified: Tue, 30 Jan 2018 14:58:59 GMT
server: NetDNA-cache/2.2
status: 200
etag: "5a708833-17f3"
vary: Accept-Encoding
x-cache: MISS
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
content-length: 6131

GET
H2 200 img-1-170x170.jpeg
etdlwwyzs7ibptm965zo1lyq-wpengine.netdna-ssl.com/wp-content/uploads/2016/04/ 5 KB
6 KB 361ms
336ms Image
image/jpeg 94.31.29.64
Highwinds Network...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://etdlwwyzs7ibptm965zo1lyq-wpengine.netdna-ssl.com/wp-content/uploads/2016/04/img-1-170x170.jpeg
Requested by: Host: www.itwbooking.bjquwhcm.com
URL: https://www.itwbooking.bjquwhcm.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 94.31.29.64 , United Kingdom, ASN33438 (HIGHWINDS2 - Highwinds Network Group, Inc., US),
Reverse DNS: 94.31.29.64.IPYX-077437-ZYO.above.net
Software: NetDNA-cache/2.2 /
Resource Hash: 72a219f9673c9d5d1ea002ff638a2757eb2f7e888e3df92fbdd73101f24059f8

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.itwbooking.bjquwhcm.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 17 Oct 2019 11:17:13 GMT
last-modified: Tue, 30 Jan 2018 14:58:59 GMT
server: NetDNA-cache/2.2
status: 200
etag: "5a708833-15ad"
vary: Accept-Encoding
x-cache: MISS
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
content-length: 5549

GET
H2 200 img-170x170.jpeg
etdlwwyzs7ibptm965zo1lyq-wpengine.netdna-ssl.com/wp-content/uploads/2016/04/ 3 KB
3 KB 217ms
217ms Image
image/jpeg 94.31.29.64
Highwinds Network...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://etdlwwyzs7ibptm965zo1lyq-wpengine.netdna-ssl.com/wp-content/uploads/2016/04/img-170x170.jpeg
Requested by: Host: www.itwbooking.bjquwhcm.com
URL: https://www.itwbooking.bjquwhcm.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 94.31.29.64 , United Kingdom, ASN33438 (HIGHWINDS2 - Highwinds Network Group, Inc., US),
Reverse DNS: 94.31.29.64.IPYX-077437-ZYO.above.net
Software: NetDNA-cache/2.2 /
Resource Hash: 961c8dc4928b59af4df6227f86623b78c9ebb009d0c7f365577f9af6cd021b8f

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.itwbooking.bjquwhcm.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 17 Oct 2019 11:17:12 GMT
last-modified: Tue, 30 Jan 2018 14:58:59 GMT
server: NetDNA-cache/2.2
status: 200
etag: "5a708833-d0b"
vary: Accept-Encoding
x-cache: MISS
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
content-length: 3339

GET
H2 200 the-work-we-do-2.jpg
www.itwbooking.bjquwhcm.com/etdlwwyzs7ibptm965zo1lyq-wpengine.netdna-ssl.com/wp-content/uploads/2016/01/ 7 KB
7 KB 226ms
222ms Image
image/jpeg 50.31.134.90
Server Central Ne...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.itwbooking.bjquwhcm.com/etdlwwyzs7ibptm965zo1lyq-wpengine.netdna-ssl.com/wp-content/uploads/2016/01/the-work-we-do-2.jpg
Requested by: Host: www.itwbooking.bjquwhcm.com
URL: https://www.itwbooking.bjquwhcm.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 50.31.134.90 Chicago, United States, ASN23352 (SERVERCENTRAL - Server Central Network, US),
Reverse DNS: mocha3026-web1.mochahost.com
Software: nginx /
Resource Hash: aa39f9154d818ebe55ad1dd134ea9defe362029b676042b40a06b40d11952abb

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.itwbooking.bjquwhcm.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 17 Oct 2019 11:17:12 GMT
last-modified: Thu, 08 Nov 2018 17:25:16 GMT
server: nginx
etag: "5be4717c-1c55"
content-type: image/jpeg
status: 200
cache-control: max-age=2592000
accept-ranges: bytes
content-length: 7253
expires: Sat, 16 Nov 2019 11:17:12 GMT

GET
H2 200 travelogues-2.jpg
www.itwbooking.bjquwhcm.com/etdlwwyzs7ibptm965zo1lyq-wpengine.netdna-ssl.com/wp-content/uploads/2016/01/ 15 KB
16 KB 226ms
222ms Image
image/jpeg 50.31.134.90
Server Central Ne...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.itwbooking.bjquwhcm.com/etdlwwyzs7ibptm965zo1lyq-wpengine.netdna-ssl.com/wp-content/uploads/2016/01/travelogues-2.jpg
Requested by: Host: www.itwbooking.bjquwhcm.com
URL: https://www.itwbooking.bjquwhcm.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 50.31.134.90 Chicago, United States, ASN23352 (SERVERCENTRAL - Server Central Network, US),
Reverse DNS: mocha3026-web1.mochahost.com
Software: nginx /
Resource Hash: fdb85dcb48df570c26aeeefd28fa305cf4787f8d673cc1b5b50a370c420b5c8f

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.itwbooking.bjquwhcm.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 17 Oct 2019 11:17:12 GMT
last-modified: Thu, 08 Nov 2018 17:25:16 GMT
server: nginx
etag: "5be4717c-3d67"
content-type: image/jpeg
status: 200
cache-control: max-age=2592000
accept-ranges: bytes
content-length: 15719
expires: Sat, 16 Nov 2019 11:17:12 GMT

GET
H2 404 Screen-Shot-2018-05-08-at-10.16.21-AM.png
www.itwbooking.bjquwhcm.com/etdlwwyzs7ibptm965zo1lyq-wpengine.netdna-ssl.com/wp-content/uploads/2018/04/ 4 KB
4 KB 435ms
431ms Image
text/html 50.31.134.90
Server Central Ne...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.itwbooking.bjquwhcm.com/etdlwwyzs7ibptm965zo1lyq-wpengine.netdna-ssl.com/wp-content/uploads/2018/04/Screen-Shot-2018-05-08-at-10.16.21-AM.png
Requested by: Host: www.itwbooking.bjquwhcm.com
URL: https://www.itwbooking.bjquwhcm.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 50.31.134.90 Chicago, United States, ASN23352 (SERVERCENTRAL - Server Central Network, US),
Reverse DNS: mocha3026-web1.mochahost.com
Software: nginx /
Resource Hash: 60c223e599936a8606fade4273d8c785bcfb657dea40c6698904d1ee295a1da5

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.itwbooking.bjquwhcm.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

status: 404
date: Thu, 17 Oct 2019 11:17:12 GMT
content-encoding: gzip
server: nginx
vary: Accept-Encoding
content-type: text/html

GET
H2 404 Screen-Shot-2018-05-08-at-10.12.57-AM.png
www.itwbooking.bjquwhcm.com/etdlwwyzs7ibptm965zo1lyq-wpengine.netdna-ssl.com/wp-content/uploads/2018/04/ 4 KB
4 KB 436ms
432ms Image
text/html 50.31.134.90
Server Central Ne...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.itwbooking.bjquwhcm.com/etdlwwyzs7ibptm965zo1lyq-wpengine.netdna-ssl.com/wp-content/uploads/2018/04/Screen-Shot-2018-05-08-at-10.12.57-AM.png
Requested by: Host: www.itwbooking.bjquwhcm.com
URL: https://www.itwbooking.bjquwhcm.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 50.31.134.90 Chicago, United States, ASN23352 (SERVERCENTRAL - Server Central Network, US),
Reverse DNS: mocha3026-web1.mochahost.com
Software: nginx /
Resource Hash: 60c223e599936a8606fade4273d8c785bcfb657dea40c6698904d1ee295a1da5

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.itwbooking.bjquwhcm.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

status: 404
date: Thu, 17 Oct 2019 11:17:12 GMT
content-encoding: gzip
server: nginx
vary: Accept-Encoding
content-type: text/html

GET
H2 404 Screen-Shot-2018-05-08-at-10.12.34-AM.png
www.itwbooking.bjquwhcm.com/etdlwwyzs7ibptm965zo1lyq-wpengine.netdna-ssl.com/wp-content/uploads/2018/04/ 4 KB
4 KB 436ms
432ms Image
text/html 50.31.134.90
Server Central Ne...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.itwbooking.bjquwhcm.com/etdlwwyzs7ibptm965zo1lyq-wpengine.netdna-ssl.com/wp-content/uploads/2018/04/Screen-Shot-2018-05-08-at-10.12.34-AM.png
Requested by: Host: www.itwbooking.bjquwhcm.com
URL: https://www.itwbooking.bjquwhcm.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 50.31.134.90 Chicago, United States, ASN23352 (SERVERCENTRAL - Server Central Network, US),
Reverse DNS: mocha3026-web1.mochahost.com
Software: nginx /
Resource Hash: 60c223e599936a8606fade4273d8c785bcfb657dea40c6698904d1ee295a1da5

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.itwbooking.bjquwhcm.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

status: 404
date: Thu, 17 Oct 2019 11:17:12 GMT
content-encoding: gzip
server: nginx
vary: Accept-Encoding
content-type: text/html

GET
H2 404 White-Sands-NM-Hither-Thither-25.jpg
www.itwbooking.bjquwhcm.com/etdlwwyzs7ibptm965zo1lyq-wpengine.netdna-ssl.com/wp-content/uploads/2018/04/ 4 KB
4 KB 436ms
432ms Image
text/html 50.31.134.90
Server Central Ne...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.itwbooking.bjquwhcm.com/etdlwwyzs7ibptm965zo1lyq-wpengine.netdna-ssl.com/wp-content/uploads/2018/04/White-Sands-NM-Hither-Thither-25.jpg
Requested by: Host: www.itwbooking.bjquwhcm.com
URL: https://www.itwbooking.bjquwhcm.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 50.31.134.90 Chicago, United States, ASN23352 (SERVERCENTRAL - Server Central Network, US),
Reverse DNS: mocha3026-web1.mochahost.com
Software: nginx /
Resource Hash: 60c223e599936a8606fade4273d8c785bcfb657dea40c6698904d1ee295a1da5

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.itwbooking.bjquwhcm.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

status: 404
date: Thu, 17 Oct 2019 11:17:12 GMT
content-encoding: gzip
server: nginx
vary: Accept-Encoding
content-type: text/html

GET
H2 404 Disneyland-2018-Hither-Thither-27.jpg
www.itwbooking.bjquwhcm.com/etdlwwyzs7ibptm965zo1lyq-wpengine.netdna-ssl.com/wp-content/uploads/2018/02/ 4 KB
4 KB 437ms
433ms Image
text/html 50.31.134.90
Server Central Ne...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.itwbooking.bjquwhcm.com/etdlwwyzs7ibptm965zo1lyq-wpengine.netdna-ssl.com/wp-content/uploads/2018/02/Disneyland-2018-Hither-Thither-27.jpg
Requested by: Host: www.itwbooking.bjquwhcm.com
URL: https://www.itwbooking.bjquwhcm.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 50.31.134.90 Chicago, United States, ASN23352 (SERVERCENTRAL - Server Central Network, US),
Reverse DNS: mocha3026-web1.mochahost.com
Software: nginx /
Resource Hash: 60c223e599936a8606fade4273d8c785bcfb657dea40c6698904d1ee295a1da5

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.itwbooking.bjquwhcm.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

status: 404
date: Thu, 17 Oct 2019 11:17:12 GMT
content-encoding: gzip
server: nginx
vary: Accept-Encoding
content-type: text/html

GET
H2 404 Palm-Springs-Hither-Thither-7.jpg
www.itwbooking.bjquwhcm.com/etdlwwyzs7ibptm965zo1lyq-wpengine.netdna-ssl.com/wp-content/uploads/2017/10/ 4 KB
4 KB 436ms
433ms Image
text/html 50.31.134.90
Server Central Ne...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.itwbooking.bjquwhcm.com/etdlwwyzs7ibptm965zo1lyq-wpengine.netdna-ssl.com/wp-content/uploads/2017/10/Palm-Springs-Hither-Thither-7.jpg
Requested by: Host: www.itwbooking.bjquwhcm.com
URL: https://www.itwbooking.bjquwhcm.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 50.31.134.90 Chicago, United States, ASN23352 (SERVERCENTRAL - Server Central Network, US),
Reverse DNS: mocha3026-web1.mochahost.com
Software: nginx /
Resource Hash: 60c223e599936a8606fade4273d8c785bcfb657dea40c6698904d1ee295a1da5

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.itwbooking.bjquwhcm.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

status: 404
date: Thu, 17 Oct 2019 11:17:12 GMT
content-encoding: gzip
server: nginx
vary: Accept-Encoding
content-type: text/html

GET
H2 200 Aulani-Hither-Thither-3-2.jpg
www.itwbooking.bjquwhcm.com/etdlwwyzs7ibptm965zo1lyq-wpengine.netdna-ssl.com/wp-content/uploads/2017/09/ 125 KB
125 KB 225ms
222ms Image
image/jpeg 50.31.134.90
Server Central Ne...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.itwbooking.bjquwhcm.com/etdlwwyzs7ibptm965zo1lyq-wpengine.netdna-ssl.com/wp-content/uploads/2017/09/Aulani-Hither-Thither-3-2.jpg
Requested by: Host: www.itwbooking.bjquwhcm.com
URL: https://www.itwbooking.bjquwhcm.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 50.31.134.90 Chicago, United States, ASN23352 (SERVERCENTRAL - Server Central Network, US),
Reverse DNS: mocha3026-web1.mochahost.com
Software: nginx /
Resource Hash: 97735ab789bcf52aa49b0168ca3ab7a4a0aa6524cfb9e917cd220f50fa532bb9

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.itwbooking.bjquwhcm.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 17 Oct 2019 11:17:12 GMT
last-modified: Thu, 08 Nov 2018 17:26:14 GMT
server: nginx
etag: "5be471b6-1f32f"
content-type: image/jpeg
status: 200
cache-control: max-age=2592000
accept-ranges: bytes
content-length: 127791
expires: Sat, 16 Nov 2019 11:17:12 GMT

GET
H2 200 North-Shore-Hither-and-Thither-26.jpg
www.itwbooking.bjquwhcm.com/etdlwwyzs7ibptm965zo1lyq-wpengine.netdna-ssl.com/wp-content/uploads/2017/09/ 49 KB
49 KB 225ms
222ms Image
image/jpeg 50.31.134.90
Server Central Ne...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.itwbooking.bjquwhcm.com/etdlwwyzs7ibptm965zo1lyq-wpengine.netdna-ssl.com/wp-content/uploads/2017/09/North-Shore-Hither-and-Thither-26.jpg
Requested by: Host: www.itwbooking.bjquwhcm.com
URL: https://www.itwbooking.bjquwhcm.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 50.31.134.90 Chicago, United States, ASN23352 (SERVERCENTRAL - Server Central Network, US),
Reverse DNS: mocha3026-web1.mochahost.com
Software: nginx /
Resource Hash: 60d98ea9c0d9d9a106268f9ef7fadb16a5bb11523a623f020ef0f52705e9a475

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.itwbooking.bjquwhcm.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 17 Oct 2019 11:17:12 GMT
last-modified: Thu, 08 Nov 2018 17:26:18 GMT
server: nginx
etag: "5be471ba-c218"
content-type: image/jpeg
status: 200
cache-control: max-age=2592000
accept-ranges: bytes
content-length: 49688
expires: Sat, 16 Nov 2019 11:17:12 GMT

GET
H2 200 style-category.jpg
www.itwbooking.bjquwhcm.com/etdlwwyzs7ibptm965zo1lyq-wpengine.netdna-ssl.com/wp-content/themes/hitherandthither/images/ 10 KB
10 KB 226ms
222ms Image
image/jpeg 50.31.134.90
Server Central Ne...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.itwbooking.bjquwhcm.com/etdlwwyzs7ibptm965zo1lyq-wpengine.netdna-ssl.com/wp-content/themes/hitherandthither/images/style-category.jpg
Requested by: Host: www.itwbooking.bjquwhcm.com
URL: https://www.itwbooking.bjquwhcm.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 50.31.134.90 Chicago, United States, ASN23352 (SERVERCENTRAL - Server Central Network, US),
Reverse DNS: mocha3026-web1.mochahost.com
Software: nginx /
Resource Hash: d3232f2f33bc81a96eac0943f91b9d4a0a2468c83d0c41cf733c9b02f74519d1

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.itwbooking.bjquwhcm.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 17 Oct 2019 11:17:12 GMT
last-modified: Thu, 08 Nov 2018 17:23:12 GMT
server: nginx
etag: "5be47100-27d8"
content-type: image/jpeg
status: 200
cache-control: max-age=2592000
accept-ranges: bytes
content-length: 10200
expires: Sat, 16 Nov 2019 11:17:12 GMT

GET
H2 200 home-design-category.jpg
www.itwbooking.bjquwhcm.com/etdlwwyzs7ibptm965zo1lyq-wpengine.netdna-ssl.com/wp-content/themes/hitherandthither/images/ 12 KB
12 KB 226ms
222ms Image
image/jpeg 50.31.134.90
Server Central Ne...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.itwbooking.bjquwhcm.com/etdlwwyzs7ibptm965zo1lyq-wpengine.netdna-ssl.com/wp-content/themes/hitherandthither/images/home-design-category.jpg
Requested by: Host: www.itwbooking.bjquwhcm.com
URL: https://www.itwbooking.bjquwhcm.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 50.31.134.90 Chicago, United States, ASN23352 (SERVERCENTRAL - Server Central Network, US),
Reverse DNS: mocha3026-web1.mochahost.com
Software: nginx /
Resource Hash: b392f7005a264f5b9d37ba90452804986024dc5e936ba0f1b420fbf2af107a34

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.itwbooking.bjquwhcm.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 17 Oct 2019 11:17:12 GMT
last-modified: Thu, 08 Nov 2018 17:23:12 GMT
server: nginx
etag: "5be47100-3120"
content-type: image/jpeg
status: 200
cache-control: max-age=2592000
accept-ranges: bytes
content-length: 12576
expires: Sat, 16 Nov 2019 11:17:12 GMT

GET
H2 200 food-drink-category.jpg
www.itwbooking.bjquwhcm.com/etdlwwyzs7ibptm965zo1lyq-wpengine.netdna-ssl.com/wp-content/themes/hitherandthither/images/ 13 KB
14 KB 226ms
223ms Image
image/jpeg 50.31.134.90
Server Central Ne...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.itwbooking.bjquwhcm.com/etdlwwyzs7ibptm965zo1lyq-wpengine.netdna-ssl.com/wp-content/themes/hitherandthither/images/food-drink-category.jpg
Requested by: Host: www.itwbooking.bjquwhcm.com
URL: https://www.itwbooking.bjquwhcm.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 50.31.134.90 Chicago, United States, ASN23352 (SERVERCENTRAL - Server Central Network, US),
Reverse DNS: mocha3026-web1.mochahost.com
Software: nginx /
Resource Hash: e93ab8f65fddedee3878e9a4d3c6865fb5d4a4d02a0ab7c14b730d7360cfac03

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.itwbooking.bjquwhcm.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 17 Oct 2019 11:17:12 GMT
last-modified: Thu, 08 Nov 2018 17:23:12 GMT
server: nginx
etag: "5be47100-3583"
content-type: image/jpeg
status: 200
cache-control: max-age=2592000
accept-ranges: bytes
content-length: 13699
expires: Sat, 16 Nov 2019 11:17:12 GMT

GET
H2 200 travel-category.jpg
www.itwbooking.bjquwhcm.com/etdlwwyzs7ibptm965zo1lyq-wpengine.netdna-ssl.com/wp-content/themes/hitherandthither/images/ 4 KB
4 KB 226ms
223ms Image
image/jpeg 50.31.134.90
Server Central Ne...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.itwbooking.bjquwhcm.com/etdlwwyzs7ibptm965zo1lyq-wpengine.netdna-ssl.com/wp-content/themes/hitherandthither/images/travel-category.jpg
Requested by: Host: www.itwbooking.bjquwhcm.com
URL: https://www.itwbooking.bjquwhcm.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 50.31.134.90 Chicago, United States, ASN23352 (SERVERCENTRAL - Server Central Network, US),
Reverse DNS: mocha3026-web1.mochahost.com
Software: nginx /
Resource Hash: e63de97516cdcf696dbaacff5307b40f83628eb5ea90f6c40680b554fca583f2

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.itwbooking.bjquwhcm.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 17 Oct 2019 11:17:12 GMT
last-modified: Thu, 08 Nov 2018 17:23:12 GMT
server: nginx
etag: "5be47100-103a"
content-type: image/jpeg
status: 200
cache-control: max-age=2592000
accept-ranges: bytes
content-length: 4154
expires: Sat, 16 Nov 2019 11:17:12 GMT

GET
H2 200 family-category.jpg
www.itwbooking.bjquwhcm.com/etdlwwyzs7ibptm965zo1lyq-wpengine.netdna-ssl.com/wp-content/themes/hitherandthither/images/ 6 KB
7 KB 226ms
223ms Image
image/jpeg 50.31.134.90
Server Central Ne...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.itwbooking.bjquwhcm.com/etdlwwyzs7ibptm965zo1lyq-wpengine.netdna-ssl.com/wp-content/themes/hitherandthither/images/family-category.jpg
Requested by: Host: www.itwbooking.bjquwhcm.com
URL: https://www.itwbooking.bjquwhcm.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 50.31.134.90 Chicago, United States, ASN23352 (SERVERCENTRAL - Server Central Network, US),
Reverse DNS: mocha3026-web1.mochahost.com
Software: nginx /
Resource Hash: 65e65f44373df2186697e92e7bef3257c80a918627f6a2e759e0638302374d04

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.itwbooking.bjquwhcm.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 17 Oct 2019 11:17:12 GMT
last-modified: Thu, 08 Nov 2018 17:23:11 GMT
server: nginx
etag: "5be470ff-19d2"
content-type: image/jpeg
status: 200
cache-control: max-age=2592000
accept-ranges: bytes
content-length: 6610
expires: Sat, 16 Nov 2019 11:17:12 GMT

GET
H2 200 Hither-Thither Show response
static.fmpub.net/site/ 3 KB
1 KB 15ms
15ms Script
application/x-javascript 151.101.13.182
Fastly

General

Check archive.org

Show headers Download Go to

Full URL: https://static.fmpub.net/site/Hither-Thither
Requested by: Host: www.itwbooking.bjquwhcm.com
URL: https://www.itwbooking.bjquwhcm.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.13.182 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software: Apache/2.4 /
Resource Hash: 79165f82c50f95e1b054f2a7f09f25ad16ce2b1ba66574cfde37a68096918325

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.itwbooking.bjquwhcm.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 17 Oct 2019 11:17:12 GMT
content-encoding: gzip
age: 1920759
x-cache: HIT, HIT
status: 200
content-length: 1081
x-served-by: cache-mdw17335-MDW, cache-fra19175-FRA
access-control-allow-origin: *
last-modified: Mon, 18 Mar 2019 14:06:00 GMT
server: Apache/2.4
x-timer: S1571311033.595739,VS0,VE9
fastly-debug-digest: 21fa3f5d950de43d4a15aa5691bd8a49a705edbbe612066de63a48b06050c0a2
vary: Accept-Encoding
content-type: application/x-javascript
via: 1.1 varnish, 1.1 varnish
expires: Fri, 25 Oct 2019 05:44:33 GMT
cache-control: max-age=2592000
x-server: app2
accept-ranges: bytes
x-cache-hits: 1, 1

GET
H2 200 75155X1525201.skimlinks.js Show response
www.itwbooking.bjquwhcm.com/s.skimresources.com/js/ 65 KB
24 KB 111ms
111ms Script
application/javascript 50.31.134.90
Server Central Ne...

General

Check archive.org

Show headers Download Go to

Full URL: https://www.itwbooking.bjquwhcm.com/s.skimresources.com/js/75155X1525201.skimlinks.js
Requested by: Host: www.itwbooking.bjquwhcm.com
URL: https://www.itwbooking.bjquwhcm.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 50.31.134.90 Chicago, United States, ASN23352 (SERVERCENTRAL - Server Central Network, US),
Reverse DNS: mocha3026-web1.mochahost.com
Software: nginx /
Resource Hash: cf7bba49b9fe5056beaf8ae06d699e773adc8df5bfa6d6e9e7ea18be58ed98b3

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.itwbooking.bjquwhcm.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 17 Oct 2019 11:17:12 GMT
content-encoding: gzip
last-modified: Thu, 08 Nov 2018 17:22:56 GMT
server: nginx
etag: W/"5be470f0-10376"
vary: Accept-Encoding
content-type: application/javascript
status: 200
cache-control: max-age=2592000
expires: Sat, 16 Nov 2019 11:17:12 GMT

GET
H2 200 comment-reply.min5010.js Show response
www.itwbooking.bjquwhcm.com/etdlwwyzs7ibptm965zo1lyq-wpengine.netdna-ssl.com/wp-includes/js/ 1 KB
782 B 111ms
111ms Script
application/javascript 50.31.134.90
Server Central Ne...

General

Check archive.org

Show headers Download Go to

Full URL: https://www.itwbooking.bjquwhcm.com/etdlwwyzs7ibptm965zo1lyq-wpengine.netdna-ssl.com/wp-includes/js/comment-reply.min5010.js?ver=4.9.8
Requested by: Host: www.itwbooking.bjquwhcm.com
URL: https://www.itwbooking.bjquwhcm.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 50.31.134.90 Chicago, United States, ASN23352 (SERVERCENTRAL - Server Central Network, US),
Reverse DNS: mocha3026-web1.mochahost.com
Software: nginx /
Resource Hash: 1b1ca0f15010e0124bd4ca481404643c88f7eda1b276e9554d0ed83fb45b7e30

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.itwbooking.bjquwhcm.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 17 Oct 2019 11:17:12 GMT
content-encoding: gzip
last-modified: Thu, 08 Nov 2018 17:23:07 GMT
server: nginx
etag: W/"5be470fb-436"
vary: Accept-Encoding
content-type: application/javascript
status: 200
cache-control: max-age=2592000
expires: Sat, 16 Nov 2019 11:17:12 GMT

GET
H2 200 index5010.html Show response
www.itwbooking.bjquwhcm.com/wp-content/plugins/ 696 B
870 B 112ms
104ms Script
text/html 50.31.134.90
Server Central Ne...

General

Check archive.org

Show headers Download Go to

Full URL: https://www.itwbooking.bjquwhcm.com/wp-content/plugins/index5010.html?ver=4.9.8
Requested by: Host: www.itwbooking.bjquwhcm.com
URL: https://www.itwbooking.bjquwhcm.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 50.31.134.90 Chicago, United States, ASN23352 (SERVERCENTRAL - Server Central Network, US),
Reverse DNS: mocha3026-web1.mochahost.com
Software: nginx /
Resource Hash: af62a4d83a4328d904f5f2eb79cac6d997086117a7088638572e2d1c1487f85d

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.itwbooking.bjquwhcm.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 17 Oct 2019 11:17:12 GMT
last-modified: Thu, 08 Nov 2018 17:22:31 GMT
server: nginx
etag: "5be470d7-2b8"
content-type: text/html
status: 200
cache-control: max-age=2592000
accept-ranges: bytes
content-length: 696
expires: Sat, 16 Nov 2019 11:17:12 GMT

GET
H2 200 sb-instagram.minf24c.js Show response
www.itwbooking.bjquwhcm.com/etdlwwyzs7ibptm965zo1lyq-wpengine.netdna-ssl.com/wp-content/plugins/instagram-feed/js/ 22 KB
7 KB 113ms
105ms Script
application/javascript 50.31.134.90
Server Central Ne...

General

Check archive.org

Show headers Download Go to

Full URL: https://www.itwbooking.bjquwhcm.com/etdlwwyzs7ibptm965zo1lyq-wpengine.netdna-ssl.com/wp-content/plugins/instagram-feed/js/sb-instagram.minf24c.js?ver=1.6
Requested by: Host: www.itwbooking.bjquwhcm.com
URL: https://www.itwbooking.bjquwhcm.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 50.31.134.90 Chicago, United States, ASN23352 (SERVERCENTRAL - Server Central Network, US),
Reverse DNS: mocha3026-web1.mochahost.com
Software: nginx /
Resource Hash: 708084a0d69982fc434fd1c9712e8822d1ef49c438bda13c2298736e79b8af0c

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.itwbooking.bjquwhcm.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 17 Oct 2019 11:17:12 GMT
content-encoding: gzip
last-modified: Thu, 08 Nov 2018 17:23:10 GMT
server: nginx
etag: W/"5be470fe-5641"
vary: Accept-Encoding
content-type: application/javascript
status: 200
cache-control: max-age=2592000
expires: Sat, 16 Nov 2019 11:17:12 GMT

GET
H2 200 collapse744a.js Show response
www.itwbooking.bjquwhcm.com/etdlwwyzs7ibptm965zo1lyq-wpengine.netdna-ssl.com/wp-content/plugins/jquery-collapse-o-matic/js/ 19 KB
4 KB 114ms
106ms Script
application/javascript 50.31.134.90
Server Central Ne...

General

Check archive.org

Show headers Download Go to

Full URL: https://www.itwbooking.bjquwhcm.com/etdlwwyzs7ibptm965zo1lyq-wpengine.netdna-ssl.com/wp-content/plugins/jquery-collapse-o-matic/js/collapse744a.js?ver=1.6.10
Requested by: Host: www.itwbooking.bjquwhcm.com
URL: https://www.itwbooking.bjquwhcm.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 50.31.134.90 Chicago, United States, ASN23352 (SERVERCENTRAL - Server Central Network, US),
Reverse DNS: mocha3026-web1.mochahost.com
Software: nginx /
Resource Hash: 1e5a81fa3340b71856efbd316d30533e585d9938aab23d7923dd62cdd7661dda

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.itwbooking.bjquwhcm.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 17 Oct 2019 11:17:12 GMT
content-encoding: gzip
last-modified: Thu, 08 Nov 2018 17:23:11 GMT
server: nginx
etag: W/"5be470ff-4a0c"
vary: Accept-Encoding
content-type: application/javascript
status: 200
cache-control: max-age=2592000
expires: Sat, 16 Nov 2019 11:17:12 GMT

GET
H2 200 jpibfi.client531b.js Show response
www.itwbooking.bjquwhcm.com/etdlwwyzs7ibptm965zo1lyq-wpengine.netdna-ssl.com/wp-content/plugins/jquery-pin-it-button-for-images/js/ 14 KB
4 KB 115ms
107ms Script
application/javascript 50.31.134.90
Server Central Ne...

General

Check archive.org

Show headers Download Go to

Full URL: https://www.itwbooking.bjquwhcm.com/etdlwwyzs7ibptm965zo1lyq-wpengine.netdna-ssl.com/wp-content/plugins/jquery-pin-it-button-for-images/js/jpibfi.client531b.js?ver=2.3.4
Requested by: Host: www.itwbooking.bjquwhcm.com
URL: https://www.itwbooking.bjquwhcm.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 50.31.134.90 Chicago, United States, ASN23352 (SERVERCENTRAL - Server Central Network, US),
Reverse DNS: mocha3026-web1.mochahost.com
Software: nginx /
Resource Hash: 33860273adf897add00905f411573e4bbaab82f976ba670cac96cb1121a4dd9a

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.itwbooking.bjquwhcm.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 17 Oct 2019 11:17:12 GMT
content-encoding: gzip
last-modified: Thu, 08 Nov 2018 17:23:11 GMT
server: nginx
etag: W/"5be470ff-38d7"
vary: Accept-Encoding
content-type: application/javascript
status: 200
cache-control: max-age=2592000
expires: Sat, 16 Nov 2019 11:17:12 GMT

GET
H2 200 wp-embed.min5010.js Show response
www.itwbooking.bjquwhcm.com/etdlwwyzs7ibptm965zo1lyq-wpengine.netdna-ssl.com/wp-includes/js/ 1 KB
944 B 116ms
107ms Script
application/javascript 50.31.134.90
Server Central Ne...

General

Check archive.org

Show headers Download Go to

Full URL: https://www.itwbooking.bjquwhcm.com/etdlwwyzs7ibptm965zo1lyq-wpengine.netdna-ssl.com/wp-includes/js/wp-embed.min5010.js?ver=4.9.8
Requested by: Host: www.itwbooking.bjquwhcm.com
URL: https://www.itwbooking.bjquwhcm.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 50.31.134.90 Chicago, United States, ASN23352 (SERVERCENTRAL - Server Central Network, US),
Reverse DNS: mocha3026-web1.mochahost.com
Software: nginx /
Resource Hash: dcb5e540e62fc85857254a1066afb6a7e8999279c6d4c583eef855d39f9289c0

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.itwbooking.bjquwhcm.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 17 Oct 2019 11:17:12 GMT
content-encoding: gzip
last-modified: Thu, 08 Nov 2018 17:23:07 GMT
server: nginx
etag: W/"5be470fb-576"
vary: Accept-Encoding
content-type: application/javascript
status: 200
cache-control: max-age=2592000
expires: Sat, 16 Nov 2019 11:17:12 GMT

GET
H2 404 ajax-load-more.min6b00.js
www.itwbooking.bjquwhcm.com/etdlwwyzs7ibptm965zo1lyq-wpengine.netdna-ssl.com/wp-content/plugins/ajax-load-more/core/dist/js/ 0
0 229ms
221ms Script
text/html 50.31.134.90
Server Central Ne...

General

Check archive.org

Show headers Download Go to

Full URL: https://www.itwbooking.bjquwhcm.com/etdlwwyzs7ibptm965zo1lyq-wpengine.netdna-ssl.com/wp-content/plugins/ajax-load-more/core/dist/js/ajax-load-more.min6b00.js?ver=3.4.0
Requested by: Host: www.itwbooking.bjquwhcm.com
URL: https://www.itwbooking.bjquwhcm.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 50.31.134.90 Chicago, United States, ASN23352 (SERVERCENTRAL - Server Central Network, US),
Reverse DNS: mocha3026-web1.mochahost.com
Software: nginx /
Resource Hash

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.itwbooking.bjquwhcm.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

status: 404
date: Thu, 17 Oct 2019 11:17:12 GMT
content-encoding: gzip
server: nginx
vary: Accept-Encoding
content-type: text/html

GET
H2 404 slideout.min.js
www.itwbooking.bjquwhcm.com/etdlwwyzs7ibptm965zo1lyq-wpengine.netdna-ssl.com/wp-content/themes/hitherandthither/assets/scripts/ 0
0 108ms
108ms Script
text/html 50.31.134.90
Server Central Ne...

General

Check archive.org

Show headers Download Go to

Full URL: https://www.itwbooking.bjquwhcm.com/etdlwwyzs7ibptm965zo1lyq-wpengine.netdna-ssl.com/wp-content/themes/hitherandthither/assets/scripts/slideout.min.js
Requested by: Host: www.itwbooking.bjquwhcm.com
URL: https://www.itwbooking.bjquwhcm.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 50.31.134.90 Chicago, United States, ASN23352 (SERVERCENTRAL - Server Central Network, US),
Reverse DNS: mocha3026-web1.mochahost.com
Software: nginx /
Resource Hash

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.itwbooking.bjquwhcm.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

status: 404
date: Thu, 17 Oct 2019 11:17:12 GMT
content-encoding: gzip
server: nginx
vary: Accept-Encoding
content-type: text/html

GET
H2 404 base.js
www.itwbooking.bjquwhcm.com/etdlwwyzs7ibptm965zo1lyq-wpengine.netdna-ssl.com/wp-content/themes/hitherandthither/assets/scripts/ 0
0 109ms
109ms Script
text/html 50.31.134.90
Server Central Ne...

General

Check archive.org

Show headers Download Go to

Full URL: https://www.itwbooking.bjquwhcm.com/etdlwwyzs7ibptm965zo1lyq-wpengine.netdna-ssl.com/wp-content/themes/hitherandthither/assets/scripts/base.js
Requested by: Host: www.itwbooking.bjquwhcm.com
URL: https://www.itwbooking.bjquwhcm.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 50.31.134.90 Chicago, United States, ASN23352 (SERVERCENTRAL - Server Central Network, US),
Reverse DNS: mocha3026-web1.mochahost.com
Software: nginx /
Resource Hash

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.itwbooking.bjquwhcm.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

status: 404
date: Thu, 17 Oct 2019 11:17:12 GMT
content-encoding: gzip
server: nginx
vary: Accept-Encoding
content-type: text/html

GET
H2 200 analytics.js Show response
www.itwbooking.bjquwhcm.com/www.google-analytics.com/ 42 KB
17 KB 226ms
223ms Script
application/javascript 50.31.134.90
Server Central Ne...

General

Check archive.org

Show headers Download Go to

Full URL: https://www.itwbooking.bjquwhcm.com/www.google-analytics.com/analytics.js
Requested by: Host: www.itwbooking.bjquwhcm.com
URL: https://www.itwbooking.bjquwhcm.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 50.31.134.90 Chicago, United States, ASN23352 (SERVERCENTRAL - Server Central Network, US),
Reverse DNS: mocha3026-web1.mochahost.com
Software: nginx /
Resource Hash: 8cb05b675fe6419a9e91eb587c60902c7ed1cb6c42b8cff8ce404ef89f635cde

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.itwbooking.bjquwhcm.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 17 Oct 2019 11:17:12 GMT
content-encoding: gzip
last-modified: Thu, 08 Nov 2018 17:23:02 GMT
server: nginx
etag: W/"5be470f6-a8e1"
vary: Accept-Encoding
content-type: application/javascript
status: 200
cache-control: max-age=2592000
expires: Sat, 16 Nov 2019 11:17:12 GMT

GET

blank.js
gdprexclusion.dmpxs.com.s3-website.eu-west-3.amazonaws.com/
Redirect Chain

https://bob.dmpxs.com/static/bob_010.js?phnxsid=6134&bob_cb=1571311032715240
https://gdprexclusion.dmpxs.com.s3-website.eu-west-3.amazonaws.com/blank.js

0
0

GET
H2 404 2F2E86_0_0.woff2
www.itwbooking.bjquwhcm.com/etdlwwyzs7ibptm965zo1lyq-wpengine.netdna-ssl.com/wp-content/themes/hitherandthither/assets/fonts/ 0
0 224ms
221ms Font
text/html 50.31.134.90
Server Central Ne...

General

Check archive.org

Show headers Download Go to

Full URL: https://www.itwbooking.bjquwhcm.com/etdlwwyzs7ibptm965zo1lyq-wpengine.netdna-ssl.com/wp-content/themes/hitherandthither/assets/fonts/2F2E86_0_0.woff2
Requested by: Host: www.itwbooking.bjquwhcm.com
URL: https://www.itwbooking.bjquwhcm.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 50.31.134.90 Chicago, United States, ASN23352 (SERVERCENTRAL - Server Central Network, US),
Reverse DNS: mocha3026-web1.mochahost.com
Software: nginx /
Resource Hash

Request headers

Sec-Fetch-Mode: cors
Referer: https://www.itwbooking.bjquwhcm.com/etdlwwyzs7ibptm965zo1lyq-wpengine.netdna-ssl.com/wp-content/themes/hitherandthither/style.css
Origin: https://www.itwbooking.bjquwhcm.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

status: 404
date: Thu, 17 Oct 2019 11:17:12 GMT
content-encoding: gzip
server: nginx
vary: Accept-Encoding
content-type: text/html

GET
H2 200 S6u9w4BMUTPHh6UVSwiPGQ3q5d0.woff2
fonts.gstatic.com/s/lato/v16/ 14 KB
14 KB 6ms
5ms Font
font/woff2 2a00:1450:4001:825::2003
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/lato/v16/S6u9w4BMUTPHh6UVSwiPGQ3q5d0.woff2

Requested by

Host: www.itwbooking.bjquwhcm.com
URL: https://www.itwbooking.bjquwhcm.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:825::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

sffe /

Resource Hash

9baad10e85c5be8d5697086479983b6b477197103bf8f0f11817b1bdfb9a7451

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: cors
Referer: https://fonts.googleapis.com/css?family=Lato:400,700
Origin: https://www.itwbooking.bjquwhcm.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 11 Oct 2019 23:30:07 GMT
x-content-type-options: nosniff
last-modified: Tue, 23 Jul 2019 03:45:54 GMT
server: sffe
age: 474425
status: 200
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 14176
x-xss-protection: 0
expires: Sat, 10 Oct 2020 23:30:07 GMT

GET
H2 200 0QIvMX1D_JOuMwr7I_FMl_E.woff2
fonts.gstatic.com/s/lora/v14/ 15 KB
15 KB 5ms
5ms Font
font/woff2 2a00:1450:4001:825::2003
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/lora/v14/0QIvMX1D_JOuMwr7I_FMl_E.woff2

Requested by

Host: www.itwbooking.bjquwhcm.com
URL: https://www.itwbooking.bjquwhcm.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:825::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

sffe /

Resource Hash

bb2a80dc3e72230cd009ad952ebac959905d921e509aebe911704557d0311da3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: cors
Referer: https://fonts.googleapis.com/css?family=Lora:400,400italic,700,700italic
Origin: https://www.itwbooking.bjquwhcm.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 17 Oct 2019 08:10:20 GMT
x-content-type-options: nosniff
last-modified: Mon, 22 Jul 2019 19:23:22 GMT
server: sffe
age: 11212
status: 200
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 15608
x-xss-protection: 0
expires: Fri, 16 Oct 2020 08:10:20 GMT

GET
H2 200 d7ab66202d49542782175051e3f11ee3.html
lightwidget.com/widgets/ Frame DB59 0
0 480ms
448ms Document
text/html 2606:4700:10::6814:33ae
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL: https://lightwidget.com/widgets/d7ab66202d49542782175051e3f11ee3.html
Requested by: Host: www.itwbooking.bjquwhcm.com
URL: https://www.itwbooking.bjquwhcm.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6814:33ae , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

:method: GET
:authority: lightwidget.com
:scheme: https
:path: /widgets/d7ab66202d49542782175051e3f11ee3.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
sec-fetch-site: cross-site
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

status: 200
date: Thu, 17 Oct 2019 11:17:13 GMT
content-type: text/html
set-cookie: __cfduid=dbb45a12c0f473f63b854340708b6b8201571311032; expires=Fri, 16-Oct-20 11:17:12 GMT; path=/; domain=.lightwidget.com; HttpOnly
vary: Accept-Encoding
expires: Thu, 17 Oct 2019 11:18:13 GMT
cache-control: max-age=60
last-modified: Thu, 17 Oct 2019 11:14:04 GMT
x-cache-status: MISS
cf-cache-status: DYNAMIC
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server: cloudflare
cf-ray: 5271dd62fdd95964-VIE
content-encoding: br

GET
H2 200 1d404a9b65565ac99d38266e9dc66726.html
lightwidget.com/widgets/ Frame 56FC 0
0 93ms
64ms Document
text/html 2606:4700:10::6814:33ae
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL: https://lightwidget.com/widgets/1d404a9b65565ac99d38266e9dc66726.html
Requested by: Host: www.itwbooking.bjquwhcm.com
URL: https://www.itwbooking.bjquwhcm.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6814:33ae , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

:method: GET
:authority: lightwidget.com
:scheme: https
:path: /widgets/1d404a9b65565ac99d38266e9dc66726.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
sec-fetch-site: cross-site
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

status: 200
date: Thu, 17 Oct 2019 11:17:12 GMT
content-type: text/html
set-cookie: __cfduid=dbb45a12c0f473f63b854340708b6b8201571311032; expires=Fri, 16-Oct-20 11:17:12 GMT; path=/; domain=.lightwidget.com; HttpOnly
vary: Accept-Encoding
expires: Thu, 17 Oct 2019 11:17:52 GMT
cache-control: max-age=40
last-modified: Thu, 17 Oct 2019 11:14:04 GMT
x-cache-status: MISS
cf-cache-status: DYNAMIC
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server: cloudflare
cf-ray: 5271dd62fdda5964-VIE
content-encoding: br

GET
H/1.1 200
OK beacon.js Show response
sb.scorecardresearch.com/ 1 KB
1 KB 21ms
7ms Script
application/x-javascript 2.19.43.224
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://sb.scorecardresearch.com/beacon.js
Requested by: Host: static.fmpub.net
URL: https://static.fmpub.net/site/Hither-Thither
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.19.43.224 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS: a2-19-43-224.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 76c393f564f53c19e795307e622edc8657a603f7a816c2646385697286d11313

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.itwbooking.bjquwhcm.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Thu, 17 Oct 2019 11:17:12 GMT
Content-Encoding: gzip
Vary: Accept-Encoding
Content-Type: application/x-javascript
Cache-Control: private, no-transform, max-age=86400
Connection: keep-alive
Content-Length: 902
Expires: Fri, 18 Oct 2019 11:17:12 GMT

GET
H2

200

/ Show response
r.skimresources.com/api/
Redirect Chain

https://r.skimresources.com/api/?callback=skimlinksBeaconCallback&data=%7B%22pubcode%22%3A%2275155X1525201%22%2C%22page%22%3A%22https%3A%2F%2Fwww.itwbooking.bjquwhcm.com%2F%22%2C%22domains%22%3A%5B...
https://r.skimresources.com/api/?callback=skimlinksBeaconCallback&persistence=1&xguid=01DQCPZ6EHKYVF5QHCFM9J4CH7&data=%7B%22pubcode%22%3A%2275155X1525201%22%2C%22page%22%3A%22https%3A%2F%2Fwww.itwb...

192 B
491 B

15ms
15ms

Script
application/javascript

35.190.59.101
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://r.skimresources.com/api/?callback=skimlinksBeaconCallback&persistence=1&xguid=01DQCPZ6EHKYVF5QHCFM9J4CH7&data=%7B%22pubcode%22%3A%2275155X1525201%22%2C%22page%22%3A%22https%3A%2F%2Fwww.itwbooking.bjquwhcm.com%2F%22%2C%22domains%22%3A%5B%22ikea.com%22%2C%22semitix.com%22%2C%22hislide.io%22%2C%22sekurigi.com%22%2C%22instagram.com%22%2C%22amzn.to%22%2C%22academy.swingleft.org%22%2C%22thelastweekend.org%22%2C%22feeds.feedburner.com%22%2C%22bloglovin.com%22%2C%22pinterest.com%22%5D%7D&checksum=c3fc0c9890f63300775b27ecad7ea575c88c4a1535f6f13ef542bbfb7282d875

Requested by

Host: www.itwbooking.bjquwhcm.com
URL: https://www.itwbooking.bjquwhcm.com/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

35.190.59.101 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

101.59.190.35.bc.googleusercontent.com

Software

openresty/1.11.2.5 /

Resource Hash

3a27595adae3d121a627554a2db70bf247bcb303f77a8846b066754ac38140f5

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.itwbooking.bjquwhcm.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 17 Oct 2019 11:17:12 GMT
via: 1.1 google
x-content-type-options: nosniff
server: openresty/1.11.2.5
status: 200
p3p: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
access-control-allow-origin: https://www.itwbooking.bjquwhcm.com
access-control-allow-credentials: true
content-type: application/javascript
alt-svc: clear
content-length: 192

Redirect headers

date: Thu, 17 Oct 2019 11:17:12 GMT
via: 1.1 google
server: openresty/1.11.2.5
status: 302
location: //r.skimresources.com/api/?callback=skimlinksBeaconCallback&persistence=1&xguid=01DQCPZ6EHKYVF5QHCFM9J4CH7&data=%7B%22pubcode%22%3A%2275155X1525201%22%2C%22page%22%3A%22https%3A%2F%2Fwww.itwbooking.bjquwhcm.com%2F%22%2C%22domains%22%3A%5B%22ikea.com%22%2C%22semitix.com%22%2C%22hislide.io%22%2C%22sekurigi.com%22%2C%22instagram.com%22%2C%22amzn.to%22%2C%22academy.swingleft.org%22%2C%22thelastweekend.org%22%2C%22feeds.feedburner.com%22%2C%22bloglovin.com%22%2C%22pinterest.com%22%5D%7D&checksum=c3fc0c9890f63300775b27ecad7ea575c88c4a1535f6f13ef542bbfb7282d875
p3p: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
access-control-allow-origin: https://www.itwbooking.bjquwhcm.com
access-control-allow-credentials: true
content-type: text/html
alt-svc: clear
content-length: 167

GET
H2 200 px.gif
p.skimresources.com/ 43 B
508 B 22ms
7ms Image
image/gif 151.139.128.10
Highwinds Network...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://p.skimresources.com/px.gif?ch=1&rn=4.783396076182603
Requested by: Host: www.itwbooking.bjquwhcm.com
URL: https://www.itwbooking.bjquwhcm.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.139.128.10 Dallas, United States, ASN20446 (HIGHWINDS3 - Highwinds Network Group, Inc., US),
Reverse DNS
Software: UploadServer /
Resource Hash: dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.itwbooking.bjquwhcm.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-goog-hash: crc32c=xra6Ow==, md5=+DeqYLb+g0WPeQ22DVKfyQ==
date: Thu, 17 Oct 2019 11:17:12 GMT
x-guploader-uploadid: AEnB2UpQRqYC_RxThvGRrvHXnLRaVquZD3GJ3bB1bpR_O4PiuhdkMrlaOiXZfBacxuWGTA5Vx0ivZeMgH7U0axtkBivbIZJBAQ
x-goog-storage-class: MULTI_REGIONAL
status: 200
x-goog-metageneration: 4
x-goog-stored-content-encoding: identity
content-length: 43
last-modified: Tue, 23 Oct 2018 13:19:28 GMT
server: UploadServer
etag: "f837aa60b6fe83458f790db60d529fc9"
x-hw: 1571311032.cds145.fr8.hn,1571311032.cds054.fr8.c
x-goog-generation: 1540300768038458
cache-control: public, max-age=7200
x-goog-stored-content-length: 43
accept-ranges: bytes
content-type: image/gif

GET
H2 200 px.gif
p.skimresources.com/ 43 B
107 B 22ms
7ms Image
image/gif 151.139.128.10
Highwinds Network...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://p.skimresources.com/px.gif?ch=2&rn=4.783396076182603
Requested by: Host: www.itwbooking.bjquwhcm.com
URL: https://www.itwbooking.bjquwhcm.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.139.128.10 Dallas, United States, ASN20446 (HIGHWINDS3 - Highwinds Network Group, Inc., US),
Reverse DNS
Software: UploadServer /
Resource Hash: dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.itwbooking.bjquwhcm.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-goog-hash: crc32c=xra6Ow==, md5=+DeqYLb+g0WPeQ22DVKfyQ==
date: Thu, 17 Oct 2019 11:17:12 GMT
x-guploader-uploadid: AEnB2UpQRqYC_RxThvGRrvHXnLRaVquZD3GJ3bB1bpR_O4PiuhdkMrlaOiXZfBacxuWGTA5Vx0ivZeMgH7U0axtkBivbIZJBAQ
x-goog-storage-class: MULTI_REGIONAL
status: 200
x-goog-metageneration: 4
x-goog-stored-content-encoding: identity
content-length: 43
last-modified: Tue, 23 Oct 2018 13:19:28 GMT
server: UploadServer
etag: "f837aa60b6fe83458f790db60d529fc9"
x-hw: 1571311032.cds145.fr8.hn,1571311032.cds054.fr8.c
x-goog-generation: 1540300768038458
cache-control: public, max-age=7200
x-goog-stored-content-length: 43
accept-ranges: bytes
content-type: image/gif

GET
H2 200 ga6Iaw1J5X9T9RW6j9bNfFcWaDq8fMU.woff2
fonts.gstatic.com/s/notoserif/v8/ 13 KB
13 KB 6ms
5ms Font
font/woff2 2a00:1450:4001:825::2003
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/notoserif/v8/ga6Iaw1J5X9T9RW6j9bNfFcWaDq8fMU.woff2

Requested by

Host: www.itwbooking.bjquwhcm.com
URL: https://www.itwbooking.bjquwhcm.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:825::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

sffe /

Resource Hash

e7be357ddd89fe4f85dd3a2f16929f2344148d0ede966e9bf92febe1b998cc9b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: cors
Referer: https://fonts.googleapis.com/css?family=Noto+Serif:400,700
Origin: https://www.itwbooking.bjquwhcm.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Wed, 16 Oct 2019 05:07:58 GMT
x-content-type-options: nosniff
last-modified: Mon, 22 Jul 2019 19:17:21 GMT
server: sffe
age: 108554
status: 200
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 13192
x-xss-protection: 0
expires: Thu, 15 Oct 2020 05:07:58 GMT

GET
H2 200 0QIgMX1D_JOuO7HeNtxumtus-7w.woff2
fonts.gstatic.com/s/lora/v14/ 15 KB
15 KB 6ms
5ms Font
font/woff2 2a00:1450:4001:825::2003
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/lora/v14/0QIgMX1D_JOuO7HeNtxumtus-7w.woff2

Requested by

Host: www.itwbooking.bjquwhcm.com
URL: https://www.itwbooking.bjquwhcm.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:825::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

sffe /

Resource Hash

723031ba032ca338ff8300fcfe6179862105ff2ca741f2ca89787d537d779576

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: cors
Referer: https://fonts.googleapis.com/css?family=Lora:400,400italic,700,700italic
Origin: https://www.itwbooking.bjquwhcm.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Wed, 09 Oct 2019 19:08:45 GMT
x-content-type-options: nosniff
last-modified: Mon, 22 Jul 2019 19:22:43 GMT
server: sffe
age: 662907
status: 200
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 15616
x-xss-protection: 0
expires: Thu, 08 Oct 2020 19:08:45 GMT

GET
H2 200 0QIhMX1D_JOuMw_LIftLtfOm8w.woff2
fonts.gstatic.com/s/lora/v14/ 17 KB
17 KB 6ms
6ms Font
font/woff2 2a00:1450:4001:825::2003
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/lora/v14/0QIhMX1D_JOuMw_LIftLtfOm8w.woff2

Requested by

Host: www.itwbooking.bjquwhcm.com
URL: https://www.itwbooking.bjquwhcm.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:825::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

sffe /

Resource Hash

dcc0ab8a6f3bef59fa6897752ed594f6074fc60b06c1a73622f212c83691237b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: cors
Referer: https://fonts.googleapis.com/css?family=Lora:400,400italic,700,700italic
Origin: https://www.itwbooking.bjquwhcm.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 10 Oct 2019 20:53:22 GMT
x-content-type-options: nosniff
last-modified: Mon, 22 Jul 2019 19:22:22 GMT
server: sffe
age: 570230
status: 200
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 17172
x-xss-protection: 0
expires: Fri, 09 Oct 2020 20:53:22 GMT

GET
H/1.1

204
No Content

b2
sb.scorecardresearch.com/
Redirect Chain

https://sb.scorecardresearch.com/b?c1=8&c2=6035610&c3=36782&c4=http%253A%252F%252Fwww.hitherandthither.net%252F&ns__t=1571311032798&ns_c=UTF-8&cv=3.1e&c8=Hither%20%26%20Thither&c7=https%3A%2F%2Fwww...
https://sb.scorecardresearch.com/b2?c1=8&c2=6035610&c3=36782&c4=http%253A%252F%252Fwww.hitherandthither.net%252F&ns__t=1571311032798&ns_c=UTF-8&cv=3.1e&c8=Hither%20%26%20Thither&c7=https%3A%2F%2Fww...

0
248 B

6ms
6ms

Image
text/plain

2.19.43.224
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sb.scorecardresearch.com/b2?c1=8&c2=6035610&c3=36782&c4=http%253A%252F%252Fwww.hitherandthither.net%252F&ns__t=1571311032798&ns_c=UTF-8&cv=3.1e&c8=Hither%20%26%20Thither&c7=https%3A%2F%2Fwww.itwbooking.bjquwhcm.com%2F&c9=
Requested by: Host: www.itwbooking.bjquwhcm.com
URL: https://www.itwbooking.bjquwhcm.com/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.19.43.224 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS: a2-19-43-224.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.itwbooking.bjquwhcm.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 17 Oct 2019 11:17:12 GMT
Cache-Control: private, no-cache, no-cache=Set-Cookie, no-store, proxy-revalidate
Connection: keep-alive
Content-Length: 0
Expires: Mon, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location: https://sb.scorecardresearch.com/b2?c1=8&c2=6035610&c3=36782&c4=http%253A%252F%252Fwww.hitherandthither.net%252F&ns__t=1571311032798&ns_c=UTF-8&cv=3.1e&c8=Hither%20%26%20Thither&c7=https%3A%2F%2Fwww.itwbooking.bjquwhcm.com%2F&c9=
Pragma: no-cache
Date: Thu, 17 Oct 2019 11:17:12 GMT
Cache-Control: private, no-cache, no-cache=Set-Cookie, no-store, proxy-revalidate
Connection: keep-alive
Content-Length: 0
Expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

204
No Content

b2
sb.scorecardresearch.com/
Redirect Chain

https://sb.scorecardresearch.com/b?c1=2&c2=6035610&c3=36782&c4=http%253A%252F%252Fwww.hitherandthither.net%252F&ns__t=1571311032798&ns_c=UTF-8&cv=3.1e&c8=Hither%20%26%20Thither&c7=https%3A%2F%2Fwww...
https://sb.scorecardresearch.com/b2?c1=2&c2=6035610&c3=36782&c4=http%253A%252F%252Fwww.hitherandthither.net%252F&ns__t=1571311032798&ns_c=UTF-8&cv=3.1e&c8=Hither%20%26%20Thither&c7=https%3A%2F%2Fww...

0
248 B

6ms
6ms

Image
text/plain

2.19.43.224
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sb.scorecardresearch.com/b2?c1=2&c2=6035610&c3=36782&c4=http%253A%252F%252Fwww.hitherandthither.net%252F&ns__t=1571311032798&ns_c=UTF-8&cv=3.1e&c8=Hither%20%26%20Thither&c7=https%3A%2F%2Fwww.itwbooking.bjquwhcm.com%2F&c9=
Requested by: Host: www.itwbooking.bjquwhcm.com
URL: https://www.itwbooking.bjquwhcm.com/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.19.43.224 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS: a2-19-43-224.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.itwbooking.bjquwhcm.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 17 Oct 2019 11:17:12 GMT
Cache-Control: private, no-cache, no-cache=Set-Cookie, no-store, proxy-revalidate
Connection: keep-alive
Content-Length: 0
Expires: Mon, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location: https://sb.scorecardresearch.com/b2?c1=2&c2=6035610&c3=36782&c4=http%253A%252F%252Fwww.hitherandthither.net%252F&ns__t=1571311032798&ns_c=UTF-8&cv=3.1e&c8=Hither%20%26%20Thither&c7=https%3A%2F%2Fwww.itwbooking.bjquwhcm.com%2F&c9=
Pragma: no-cache
Date: Thu, 17 Oct 2019 11:17:12 GMT
Cache-Control: private, no-cache, no-cache=Set-Cookie, no-store, proxy-revalidate
Connection: keep-alive
Content-Length: 0
Expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H2 200 iab Show response
api.skimlinks.mgr.consensu.org/ 772 B
646 B 47ms
15ms XHR
application/json 35.190.40.172
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://api.skimlinks.mgr.consensu.org/iab

Requested by

Host: www.itwbooking.bjquwhcm.com
URL: https://www.itwbooking.bjquwhcm.com/s.skimresources.com/js/75155X1525201.skimlinks.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

35.190.40.172 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

172.40.190.35.bc.googleusercontent.com

Software

nginx/1.14.0 /

Resource Hash

4898c2b9f8c2f931ef6a819d36e0019867931d9519af933ab4bd5edce724b2a8

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Sec-Fetch-Mode: cors
Referer: https://www.itwbooking.bjquwhcm.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 17 Oct 2019 11:17:12 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: nginx/1.14.0
access-control-allow-headers: *
status: 200
vary: Accept-Encoding
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS
p3p: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
access-control-allow-origin: https://www.itwbooking.bjquwhcm.com
access-control-allow-credentials: true
content-type: application/json
alt-svc: clear
via: 1.1 google

GET
H2

200

/
p.skimresources.com/ Frame 6BBD
Redirect Chain

https://x.skimresources.com/?provider=exelate
https://loadeu.exelator.com/load/?p=787&g=001&j=0&
https://loadeu.exelator.com/load/?p=787&g=001&j=0&&xl8blockcheck=1
https://x.skimresources.com/?provider=exelate&skim_mapping=true&provider_id=bb4d2d0cb739fd2597b72ebf60af4cea
https://p.skimresources.com/?provider_id=bb4d2d0cb739fd2597b72ebf60af4cea&skim_mapping=true

43 B
278 B

36ms
36ms

Image
image/gif

151.139.128.10
Highwinds Network...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://p.skimresources.com/?provider_id=bb4d2d0cb739fd2597b72ebf60af4cea&skim_mapping=true
Requested by: Host: www.itwbooking.bjquwhcm.com
URL: https://www.itwbooking.bjquwhcm.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.139.128.10 Dallas, United States, ASN20446 (HIGHWINDS3 - Highwinds Network Group, Inc., US),
Reverse DNS
Software: UploadServer /
Resource Hash: dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-goog-hash: crc32c=xra6Ow==, md5=+DeqYLb+g0WPeQ22DVKfyQ==
date: Thu, 17 Oct 2019 11:17:13 GMT
age: 1
x-guploader-uploadid: AEnB2UrAfm8T2cXJ_HKQ5W2GZIqnAnzMXOuBwjOoYUBVcfmbvlO3VAaNGT-cKyxhhbqtlKT6o2hxoYMS6mZ-unNdHPI5As-HMQ
x-goog-storage-class: MULTI_REGIONAL
status: 200
x-goog-metageneration: 4
x-goog-stored-content-encoding: identity
content-length: 43
last-modified: Tue, 23 Oct 2018 13:19:28 GMT
server: UploadServer
etag: "f837aa60b6fe83458f790db60d529fc9"
x-hw: 1571311033.cds145.fr8.hn,1571311033.cds135.fr8.sc,1571311033.cds135.fr8.pr
x-goog-generation: 1540300768038458
cache-control: public, max-age=7200
x-goog-stored-content-length: 43
accept-ranges: bytes
content-type: image/gif

Redirect headers

Location: https://p.skimresources.com?provider_id=bb4d2d0cb739fd2597b72ebf60af4cea&skim_mapping=true
Date: Thu, 17 Oct 2019 11:17:13 GMT
Server: TornadoServer/2.4.1
Connection: keep-alive
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Content-Length: 0
Content-Type: text/html; charset=UTF-8

GET
H2 200 admin-ajax.html Show response
www.itwbooking.bjquwhcm.com/wp-admin/ 1 B
171 B 199ms
199ms XHR
text/html 50.31.134.90
Server Central Ne...

General

Check archive.org

Show headers Download Go to

Full URL: https://www.itwbooking.bjquwhcm.com/wp-admin/admin-ajax.html?action=google-get-comments&postid=36688&cpage=
Requested by: Host: www.itwbooking.bjquwhcm.com
URL: https://www.itwbooking.bjquwhcm.com/etdlwwyzs7ibptm965zo1lyq-wpengine.netdna-ssl.com/wp-includes/js/jquery/jqueryb8ff.js?ver=1.12.4
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 50.31.134.90 Chicago, United States, ASN23352 (SERVERCENTRAL - Server Central Network, US),
Reverse DNS: mocha3026-web1.mochahost.com
Software: nginx /
Resource Hash: 5feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9

Request headers

Accept: */*
Referer: https://www.itwbooking.bjquwhcm.com/
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode: cors

Response headers

date: Thu, 17 Oct 2019 11:17:13 GMT
last-modified: Thu, 08 Nov 2018 17:22:31 GMT
server: nginx
etag: "5be470d7-1"
content-type: text/html
status: 200
cache-control: max-age=2592000
accept-ranges: bytes
content-length: 1
expires: Sat, 16 Nov 2019 11:17:13 GMT

GET
H2 200 event Show response
logger.adthrive.com/ 19 B
465 B 406ms
379ms XHR
application/json 143.204.101.34
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://logger.adthrive.com/event?siteId=58262713bbb11e24413c230b&siteName=Hither%20and%20Thither&bucket=gdpr&branch=AC-1299-Fix-Connatix-Prebid-Compatibility-GDPR%234284ef7&threshold=34&message=AdThrive%3A%3Ainit%20started&body=%5B%5D
Requested by: Host: ads.adthrive.com
URL: https://ads.adthrive.com/core/v1/js/adthrive.min.js?threshold=34
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 143.204.101.34 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: server-143-204-101-34.fra50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 0e063443c9fc17b47a6c56347534058fd75e60bf5b6ff58cbfdc72472ecd93ab

Request headers

Sec-Fetch-Mode: cors
Referer: https://www.itwbooking.bjquwhcm.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 17 Oct 2019 11:17:14 GMT
via: 1.1 5317564e96c9dceb46123f6c5f149a03.cloudfront.net (CloudFront)
vary: Origin,Access-Control-Request-Headers,Access-Control-Request-Method
x-amz-cf-pop: FRA50-C1
x-cache: Miss from cloudfront
status: 200
content-length: 19
last-modified: Tue, 28 Feb 2017 17:20:56 GMT
server: AmazonS3
etag: "30bfc97c194c30846355ddd7f4e77a41"
access-control-max-age: 3000
access-control-allow-methods: GET
content-type: application/json
access-control-allow-origin: *
accept-ranges: bytes
x-amz-cf-id: wzfBd8zhLb550Rv4muF-IiYa-0Hp7phnmuZNMTJfp8B31OgCQQEI5w==

GET
H/1.1 200
OK beacon.js Show response
sb.scorecardresearch.com/ 1 KB
1 KB 7ms
7ms Script
application/x-javascript 2.19.43.224
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://sb.scorecardresearch.com/beacon.js?cs_ucfr=0
Requested by: Host: ads.adthrive.com
URL: https://ads.adthrive.com/core/v1/js/adthrive.min.js?threshold=34
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.19.43.224 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS: a2-19-43-224.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 76c393f564f53c19e795307e622edc8657a603f7a816c2646385697286d11313

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.itwbooking.bjquwhcm.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Thu, 17 Oct 2019 11:17:13 GMT
Content-Encoding: gzip
Vary: Accept-Encoding
Content-Type: application/x-javascript
Cache-Control: private, no-transform, max-age=86400
Connection: keep-alive
Content-Length: 902
Expires: Fri, 18 Oct 2019 11:17:13 GMT

GET
H/1.1 200
OK wrap.js Show response
clarium.global.ssl.fastly.net/gpt/a/ 64 KB
22 KB 24ms
5ms Script
application/x-javascript 151.101.113.194
Fastly

General

Check archive.org

Show headers Download Go to

Full URL: https://clarium.global.ssl.fastly.net/gpt/a/wrap.js?v2_1
Requested by: Host: ads.adthrive.com
URL: https://ads.adthrive.com/core/v1/js/adthrive.min.js?threshold=34
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.113.194 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software: nginx /
Resource Hash: e938f15952b6e13ea24ecf23acb6564042c2ab3895bda089b730d4f9188a53dc

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.itwbooking.bjquwhcm.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Thu, 17 Oct 2019 11:17:13 GMT
Content-Encoding: gzip
Age: 3197
X-Cache: HIT
Connection: keep-alive
Content-Length: 22067
X-Served-By: cache-hhn4081-HHN
Last-Modified: Mon, 14 Oct 2019 17:31:19 GMT
Server: nginx
X-Timer: S1571311033.027274,VS0,VE0
ETag: "5da4b0e7-10024"
Vary: Accept-Encoding
Content-Type: application/x-javascript
Via: 1.1 varnish
Cache-Control: private, max-age=900, stale-while-revalidate=3600
Accept-Ranges: bytes
X-Cache-Hits: 3222

GET
H2 200 ads.min.css
ads.adthrive.com/sites/58262713bbb11e24413c230b/ 54 B
438 B 10ms
10ms Stylesheet
text/css 13.225.78.50
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://ads.adthrive.com/sites/58262713bbb11e24413c230b/ads.min.css
Requested by: Host: ads.adthrive.com
URL: https://ads.adthrive.com/core/v1/js/adthrive.min.js?threshold=34
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 13.225.78.50 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: server-13-225-78-50.fra2.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 8cc401e8eb15e573a68a906d6a3e049bd5d97ad9d2cdda1b368dbdca2f67baae

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.itwbooking.bjquwhcm.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Wed, 16 Oct 2019 16:52:17 GMT
via: 1.1 2f194b62c8c43859cbf5af8e53a8d2a7.cloudfront.net (CloudFront)
last-modified: Fri, 12 Apr 2019 12:33:08 GMT
server: AmazonS3
age: 1397
etag: "ecfaf019495f58bb76c2f5410a30b793"
x-cache: Hit from cloudfront
x-amz-version-id: mNMuStBes50ERlv9xrvIAFSyOKqLmhUH
status: 200
cache-control: max-age=3600
x-amz-cf-pop: FRA2-C2
accept-ranges: bytes
content-type: text/css
content-length: 54
x-amz-cf-id: A7_lcZGg92FQdVx0PRWgydex98MMgZaFpElmMZnHIv4YUG26YeFO8g==

POST
H/1.1 200
OK cookie_sync Show response
prebid.adnxs.com/pbs/v1/ 42 B
414 B 44ms
14ms XHR
application/json 37.252.161.184
AppNexus

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid.adnxs.com/pbs/v1/cookie_sync
Requested by: Host: ads.adthrive.com
URL: https://ads.adthrive.com/core/gdpr/vendor/prebid/prebid.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 37.252.161.184 , Ascension Island, ASN29990 (ASN-APPNEXUS - AppNexus, Inc, US),
Reverse DNS: prebid.ams1.adnexus.net
Software: nginx/1.13.10 /
Resource Hash: 57ce2b08ef8da65d0f5627d6e41c7725efd32d3e377dea3c91025a375ae93fdf

Request headers

Sec-Fetch-Mode: cors
Referer: https://www.itwbooking.bjquwhcm.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Thu, 17 Oct 2019 11:17:15 GMT
Server: nginx/1.13.10
Vary: Origin
Content-Type: application/json; charset=utf-8
Access-Control-Allow-Origin: https://www.itwbooking.bjquwhcm.com
Cache-Control: no-cache, no-store, must-revalidate
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 42
Expires: 0

POST
H/1.1 200
OK auction Show response
prebid.adnxs.com/pbs/v1/openrtb2/ 126 B
484 B 142ms
113ms XHR
application/json 37.252.161.184
AppNexus

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid.adnxs.com/pbs/v1/openrtb2/auction
Requested by: Host: ads.adthrive.com
URL: https://ads.adthrive.com/core/gdpr/vendor/prebid/prebid.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 37.252.161.184 , Ascension Island, ASN29990 (ASN-APPNEXUS - AppNexus, Inc, US),
Reverse DNS: prebid.ams1.adnexus.net
Software: nginx/1.13.10 /
Resource Hash: 9a9fb4a11eb156ec45f11fc9333d08758f5c36873794ff06058497e50a4f778a

Request headers

Sec-Fetch-Mode: cors
Referer: https://www.itwbooking.bjquwhcm.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Thu, 17 Oct 2019 11:17:15 GMT
Server: nginx/1.13.10
Vary: Origin
Content-Type: application/json
Access-Control-Allow-Origin: https://www.itwbooking.bjquwhcm.com
Cache-Control: no-cache, no-store, must-revalidate
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 126
Expires: 0

GET
H/1.1 200
OK cygnus Show response
as-sec.casalemedia.com/ 24 B
916 B 201ms
188ms XHR
application/json 2.18.234.21
Akamai Technologies

General

Check archive.org

Show headers Download Go to

Full URL: https://as-sec.casalemedia.com/cygnus?s=185761&v=7.2&r=%7B%22id%22%3A%22594e59715efb7c%22%2C%22imp%22%3A%5B%7B%22id%22%3A%22643c8d4e9855d4%22%2C%22banner%22%3A%7B%22w%22%3A300%2C%22h%22%3A250%2C%22topframe%22%3A1%7D%2C%22ext%22%3A%7B%22siteID%22%3A%22185761%22%2C%22sid%22%3A%223_2%22%7D%7D%2C%7B%22id%22%3A%227441d592660e2b%22%2C%22banner%22%3A%7B%22w%22%3A320%2C%22h%22%3A50%2C%22topframe%22%3A1%7D%2C%22ext%22%3A%7B%22siteID%22%3A%22185761%22%2C%22sid%22%3A%223_4%22%7D%7D%2C%7B%22id%22%3A%228f6b6b7e2c673a%22%2C%22banner%22%3A%7B%22w%22%3A320%2C%22h%22%3A100%2C%22topframe%22%3A1%7D%2C%22ext%22%3A%7B%22siteID%22%3A%22185761%22%2C%22sid%22%3A%223_5%22%7D%7D%5D%2C%22site%22%3A%7B%22page%22%3A%22https%3A%2F%2Fwww.itwbooking.bjquwhcm.com%2F%3F%23PD%3Adesktop%23Topic%3AFamily%20and%20Parenting%23Topic%3AHome%20Decor%20and%20Design%23Topic%3AFood%23Topic%3ATravel%23Topic%3AWomens%20Style%23Topic%3Aholmm1%23Topic%3Ahlwn1%23Topic%3Abkf1%23MCMP%3A%22%7D%2C%22ext%22%3A%7B%22source%22%3A%22prebid%22%7D%2C%22regs%22%3A%7B%22ext%22%3A%7B%22gdpr%22%3A0%7D%7D%2C%22user%22%3A%7B%22ext%22%3A%7B%22consent%22%3A%22%22%7D%7D%7D&ac=j&sd=1&
Requested by: Host: ads.adthrive.com
URL: https://ads.adthrive.com/core/gdpr/vendor/prebid/prebid.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.18.234.21 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS: a2-18-234-21.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: 2cd72e38c4c6b45fa93aee7dbb399ac0badcd9fa885e63f5f6a666fb2ee1b146

Request headers

Sec-Fetch-Mode: cors
Referer: https://www.itwbooking.bjquwhcm.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Thu, 17 Oct 2019 11:17:13 GMT
Content-Encoding: gzip
Server: Apache
Vary: Accept-Encoding
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Access-Control-Allow-Origin: https://www.itwbooking.bjquwhcm.com
Cache-Control: max-age=0, no-cache, no-store
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/json
Content-Length: 44
Expires: Thu, 17 Oct 2019 11:17:13 GMT

POST
H2 200 bid-request Show response
a.teads.tv/hb/ 16 B
366 B 112ms
94ms XHR
application/json 2.18.232.7
Akamai Technologies

General

Check archive.org

Show headers Download Go to

Full URL: https://a.teads.tv/hb/bid-request
Requested by: Host: ads.adthrive.com
URL: https://ads.adthrive.com/core/gdpr/vendor/prebid/prebid.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.18.232.7 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS: a2-18-232-7.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 6a7b0c8bf87b2bd5ca31557f25cf2a6c80f93af72bf68a6085e9b55a87fe908c

Request headers

Sec-Fetch-Mode: cors
Referer: https://www.itwbooking.bjquwhcm.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Thu, 17 Oct 2019 11:17:13 GMT
content-encoding: gzip
status: 200
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: https://www.itwbooking.bjquwhcm.com
cache-control: max-age=0, no-cache, no-store
access-control-allow-credentials: true
content-length: 42
expires: Thu, 17 Oct 2019 11:17:13 GMT

POST
H2 200 bid-request Show response
a.teads.tv/hb/ 16 B
366 B 199ms
181ms XHR
application/json 2.18.232.7
Akamai Technologies

General

Check archive.org

Show headers Download Go to

Full URL: https://a.teads.tv/hb/bid-request
Requested by: Host: ads.adthrive.com
URL: https://ads.adthrive.com/core/gdpr/vendor/prebid/prebid.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.18.232.7 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS: a2-18-232-7.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 6a7b0c8bf87b2bd5ca31557f25cf2a6c80f93af72bf68a6085e9b55a87fe908c

Request headers

Sec-Fetch-Mode: cors
Referer: https://www.itwbooking.bjquwhcm.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Thu, 17 Oct 2019 11:17:13 GMT
content-encoding: gzip
status: 200
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: https://www.itwbooking.bjquwhcm.com
cache-control: max-age=0, no-cache, no-store
access-control-allow-credentials: true
content-length: 42
expires: Thu, 17 Oct 2019 11:17:13 GMT

POST
H2 204 translator Show response
hbopenbid.pubmatic.com/ 0
125 B 50ms
17ms XHR
text/plain 185.64.189.112
PubMatic

General

Check archive.org

Show headers Download Go to

Full URL: https://hbopenbid.pubmatic.com/translator?source=prebid-client
Requested by: Host: ads.adthrive.com
URL: https://ads.adthrive.com/core/gdpr/vendor/prebid/prebid.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.64.189.112 , United Kingdom, ASN62713 (AS-PUBMATIC - PubMatic, Inc., US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Sec-Fetch-Mode: cors
Referer: https://www.itwbooking.bjquwhcm.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: text/plain

Response headers

status: 204
date: Thu, 17 Oct 2019 11:17:13 GMT
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
access-control-allow-origin: https://www.itwbooking.bjquwhcm.com

GET
H2 200 arj Show response
cafemedia-d.openx.net/w/1.0/ 172 B
551 B 46ms
18ms XHR
application/json 34.95.120.147
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL: https://cafemedia-d.openx.net/w/1.0/arj?ju=https%3A%2F%2Fwww.itwbooking.bjquwhcm.com%2F&jr=&ch=UTF-8&res=1600x1200x24&ifr=false&tz=-120&tws=1600x1200&be=1&bc=hb_pb_2.1.7&dddid=d8924be7-6e36-4ef8-b2c7-4410d4c48c06&nocache=1571311033036&aus=300x250%2C320x50%2C336x280%2C300x50%2C320x100%2C468x60%2C250x250%2C120x240%2C1x1%2C300x300%2C552x334&divIds=AdThrive_Content_1_desktop&auid=538699864&tps=aGlfYXU9aW50ZXJzY3JvbGxlcixtaW5pc2Nyb2xsZXI%3D&
Requested by: Host: ads.adthrive.com
URL: https://ads.adthrive.com/core/gdpr/vendor/prebid/prebid.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.95.120.147 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS: 147.120.95.34.bc.googleusercontent.com
Software: OXGW/16.163.0 /
Resource Hash: 2da6484d341f988b572a1cf4872eb857d39e816a7112de7e8209e695065ae975

Request headers

Sec-Fetch-Mode: cors
Referer: https://www.itwbooking.bjquwhcm.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Thu, 17 Oct 2019 11:17:13 GMT
via: 1.1 google
server: OXGW/16.163.0
status: 200
vary: Accept
p3p: CP="CUR ADM OUR NOR STA NID"
access-control-allow-origin: https://www.itwbooking.bjquwhcm.com
cache-control: private, max-age=0, no-cache
access-control-allow-credentials: true
content-type: application/json
alt-svc: clear
content-length: 172
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H/1.1 200
OK trinity.json Show response
apex.go.sonobi.com/ 150 B
1 KB 106ms
66ms XHR
application/json 178.162.133.150
LEASEWEB-NL-AMS-0...

General

Check archive.org

Show headers Download Go to

Full URL

https://apex.go.sonobi.com/trinity.json?key_maker=%7B%2220b0926830014fa%22%3A%225ff6fad3a94f2bce2881%7C300x250%2C320x50%2C336x280%2C300x50%2C320x100%2C468x60%2C250x250%2C120x240%2C1x1%2C300x300%2C552x334%22%7D&ref=https%3A%2F%2Fwww.itwbooking.bjquwhcm.com%2F&s=c22aff69-e860-4308-950f-6f2297c94ea4&pv=d60d2552-2971-4b84-8675-01f1fb3dd5b2&vp=desktop&lib_name=prebid&lib_v=2.32.0&us=5&ius=1&gdpr=false&

Requested by

Host: ads.adthrive.com
URL: https://ads.adthrive.com/core/gdpr/vendor/prebid/prebid.min.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

178.162.133.150 , Netherlands, ASN60781 (LEASEWEB-NL-AMS-01 Netherlands, NL),

Reverse DNS

ams-1-apex.go.sonobi.com

Software

sonobi-go /

Resource Hash

04239df4928b033d4a029c4a00bed9baf459e68d2e6b2f0dbccbef164f62babe

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: cors
Referer: https://www.itwbooking.bjquwhcm.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Thu, 17 Oct 2019 11:17:13 GMT
Content-Encoding: gzip
Server: sonobi-go
Vary: negotiate,Accept-Encoding
X-Go-Server: apex-ams-1-6-10
P3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Access-Control-Allow-Origin: https://www.itwbooking.bjquwhcm.com
Cache-Control: no-cache, no-store, private
Access-Control-Allow-Credentials: true
Tcn: Choice
Content-Type: application/json
Content-Length: 152
X-Xss-Protection: 0
Expires: Sat, 26 Jul 1997 05:00:00 GMT

POST
H2 204 cdb Show response
bidder.criteo.com/ 0
157 B 48ms
13ms XHR
text/plain 178.250.2.152
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL: https://bidder.criteo.com/cdb?profileId=207&av=20&wv=2.32.0&cb=4684490811
Requested by: Host: ads.adthrive.com
URL: https://ads.adthrive.com/core/gdpr/vendor/prebid/prebid.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 178.250.2.152 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),
Reverse DNS
Software: Finatra /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Sec-Fetch-Mode: cors
Referer: https://www.itwbooking.bjquwhcm.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: text/plain

Response headers

status: 204
date: Thu, 17 Oct 2019 11:17:12 GMT
access-control-allow-credentials: true
server: Finatra
access-control-allow-origin: https://www.itwbooking.bjquwhcm.com
timing-allow-origin: *
vary: Origin

GET
H/1.1 200
OK fastlane.json Show response
fastlane.rubiconproject.com/a/api/ 273 B
2 KB 117ms
89ms XHR
application/json 69.173.144.141
The Rubicon Project

General

Check archive.org

Show headers Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=9262&site_id=180726&zone_id=881398&size_id=15&alt_size_ids=1%2C14%2C16%2C43%2C44%2C48%2C117&p_pos=unknown&rf=https%3A%2F%2Fwww.itwbooking.bjquwhcm.com%2F&tk_flint=pbjs_lite_v2.32.0&x_source.tid=d8924be7-6e36-4ef8-b2c7-4410d4c48c06&p_screen_res=1600x1200&rp_floor=0.01&rp_secure=1&slots=1&rand=0.054950555016504365
Requested by: Host: ads.adthrive.com
URL: https://ads.adthrive.com/core/gdpr/vendor/prebid/prebid.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_128_GCM
Server: 69.173.144.141 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT - The Rubicon Project, Inc., US),
Reverse DNS
Software: RAS 2.4 /
Resource Hash: adf9998d6dad686b2a96d3396d999082c35d61c97757adba45fcc7944ccb296c

Request headers

Sec-Fetch-Mode: cors
Referer: https://www.itwbooking.bjquwhcm.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Thu, 17 Oct 2019 11:17:13 GMT
Server: RAS 2.4
Vary: Accept-Encoding
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Access-Control-Allow-Origin: https://www.itwbooking.bjquwhcm.com
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Access-Control-Allow-Credentials: true
Connection: Keep-Alive
Content-Type: application/json
Keep-Alive: timeout=5, max=81
Content-Length: 273
Expires: Wed, 17 Sep 1975 21:32:10 GMT

POST
H2 204 v1 Show response
dmx.districtm.io/b/ 0
38 B 143ms
124ms XHR
text/plain 104.16.190.66
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL

https://dmx.districtm.io/b/v1

Requested by

Host: ads.adthrive.com
URL: https://ads.adthrive.com/core/gdpr/vendor/prebid/prebid.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.190.66 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

Sec-Fetch-Mode: cors
Referer: https://www.itwbooking.bjquwhcm.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: application/json

Response headers

date: Thu, 17 Oct 2019 11:17:13 GMT
cf-cache-status: DYNAMIC
server: cloudflare
status: 204
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: origin
access-control-allow-methods: OPTIONS, POST
access-control-allow-origin: https://www.itwbooking.bjquwhcm.com
access-control-allow-credentials: true
strict-transport-security: max-age=31536000; includeSubDomains; preload
cf-ray: 5271dd65ad83d6bd-FRA
access-control-allow-headers: origin, content-type

POST
H2 204 hb Show response
hb.undertone.com/ 0
468 B 488ms
167ms XHR
text/plain 54.67.106.161
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://hb.undertone.com/hb?pid=2002&domain=bjquwhcm.com&gdpr=0&gdprstr=
Requested by: Host: ads.adthrive.com
URL: https://ads.adthrive.com/core/gdpr/vendor/prebid/prebid.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.67.106.161 San Jose, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: ec2-54-67-106-161.us-west-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Sec-Fetch-Mode: cors
Referer: https://www.itwbooking.bjquwhcm.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Thu, 17 Oct 2019 11:17:13 GMT
status: 204
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR NID CURa DEVa PSDo OUR BUS UNI COM NAV"
access-control-allow-origin: https://www.itwbooking.bjquwhcm.com
cache-control: private, max-age=0, no-cache
access-control-allow-credentials: true
expires: Mon, 26 Jul 1997 05:00:00 GMT

POST
H2 200 auction Show response
tlx.3lift.com/header/ 19 B
581 B 28ms
7ms XHR
application/json 52.58.198.43
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL

https://tlx.3lift.com/header/auction?lib=prebid&v=2.32.0&referrer=https%3A%2F%2Fwww.itwbooking.bjquwhcm.com%2F&tmax=2400

Requested by

Host: ads.adthrive.com
URL: https://ads.adthrive.com/core/gdpr/vendor/prebid/prebid.min.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.58.198.43 Frankfurt am Main, Germany, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),

Reverse DNS

ec2-52-58-198-43.eu-central-1.compute.amazonaws.com

Software

Resource Hash

0535c3bb3a17e4ac0fb7d29214d2181275662129dc2bdd2a89c35934e9fc5ba5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: cors
Referer: https://www.itwbooking.bjquwhcm.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Thu, 17 Oct 2019 11:17:13 GMT
x-auction-status: 3, 3
status: 200
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
access-control-allow-origin: https://www.itwbooking.bjquwhcm.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
content-type: application/json; charset=utf-8
content-length: 19
x-xss-protection: 0
expires: Thu, 15 Oct 1992 20:10:00 GMT

POST
H/1.1 200
OK bid Show response
ap.lijit.com/rtb/ 24 B
488 B 65ms
16ms XHR
application/json 72.251.249.14
Internap Corporation

General

Check archive.org

Show headers Download Go to

Full URL: https://ap.lijit.com/rtb/bid?src=prebid_prebid_2.32.0
Requested by: Host: ads.adthrive.com
URL: https://ads.adthrive.com/core/gdpr/vendor/prebid/prebid.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 72.251.249.14 Amsterdam, Netherlands, ASN29791 (VOXEL-DOT-NET - Internap Corporation, US),
Reverse DNS
Software: nginx /
Resource Hash: b406f5ec6022f228c04959332bf2495701f684fc1030db97a6d08be088f58a63

Request headers

Sec-Fetch-Mode: cors
Referer: https://www.itwbooking.bjquwhcm.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: text/plain

Response headers

Date: Thu, 17 Oct 2019 11:17:13 GMT
Content-Encoding: gzip
Server: nginx
Transfer-Encoding: chunked
Vary: Accept-Encoding
Access-Control-Allow-Methods: GET, POST, DELETE, PUT
Content-Type: application/json
Access-Control-Allow-Origin: https://www.itwbooking.bjquwhcm.com
Access-Control-Allow-Credentials: true
X-Sovrn-Pod: ap1ams1
Access-Control-Allow-Headers: X-Requested-With, Content-Type

POST
H/1.1 200
OK prebid Show response
ib.adnxs.com/ut/v3/ 262 B
1 KB 59ms
31ms XHR
application/json 185.33.223.216
AppNexus

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/ut/v3/prebid

Requested by

Host: ads.adthrive.com
URL: https://ads.adthrive.com/core/gdpr/vendor/prebid/prebid.min.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.33.223.216 , Netherlands, ASN29990 (ASN-APPNEXUS - AppNexus, Inc, US),

Reverse DNS

312.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net

Software

nginx/1.13.4 /

Resource Hash

73f166a1b1c2b7f4b0e872901034f59e7dd8528492f0c4845b7761aef8f0db9e

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: cors
Referer: https://www.itwbooking.bjquwhcm.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Thu, 17 Oct 2019 11:17:15 GMT
X-Proxy-Origin: 144.76.109.30; 144.76.109.30; 312.bm-nginx-loadbalancer.mgmt.ams1; *.adnxs.com; 185.33.220.102:80
AN-X-Request-Uuid: 3a2d1d5b-8db4-4bda-9cac-19d964ab21db
Server: nginx/1.13.4
P3P: policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: https://www.itwbooking.bjquwhcm.com
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/json; charset=utf-8
Content-Length: 262
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H/1.1 200
OK prebid Show response
ib.adnxs.com/ut/v3/ 144 B
1 KB 112ms
80ms XHR
application/json 185.33.223.216
AppNexus

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/ut/v3/prebid

Requested by

Host: ads.adthrive.com
URL: https://ads.adthrive.com/core/gdpr/vendor/prebid/prebid.min.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.33.223.216 , Netherlands, ASN29990 (ASN-APPNEXUS - AppNexus, Inc, US),

Reverse DNS

312.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net

Software

nginx/1.13.4 /

Resource Hash

0481304135fb3784cb4e1ae14d83b952abeae77693a4d1d00838c974cb5115f1

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: cors
Referer: https://www.itwbooking.bjquwhcm.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Thu, 17 Oct 2019 11:17:15 GMT
X-Proxy-Origin: 144.76.109.30; 144.76.109.30; 312.bm-nginx-loadbalancer.mgmt.ams1; *.adnxs.com; 185.33.220.22:80
AN-X-Request-Uuid: 41513efc-18d8-4cef-8ee2-db22f89e1ac7
Server: nginx/1.13.4
P3P: policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: https://www.itwbooking.bjquwhcm.com
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/json; charset=utf-8
Content-Length: 144
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H/1.1 200
OK auction Show response
prebid.adnxs.com/pbs/v1/openrtb2/ 127 B
485 B 152ms
122ms XHR
application/json 37.252.161.184
AppNexus

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid.adnxs.com/pbs/v1/openrtb2/auction
Requested by: Host: ads.adthrive.com
URL: https://ads.adthrive.com/core/gdpr/vendor/prebid/prebid.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 37.252.161.184 , Ascension Island, ASN29990 (ASN-APPNEXUS - AppNexus, Inc, US),
Reverse DNS: prebid.ams1.adnexus.net
Software: nginx/1.13.10 /
Resource Hash: ed16ca821d23e0210a6e44dec1d95ce259ce50a0c585f8f3ced0a6c46453b223

Request headers

Sec-Fetch-Mode: cors
Referer: https://www.itwbooking.bjquwhcm.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Thu, 17 Oct 2019 11:17:15 GMT
Server: nginx/1.13.10
Vary: Origin
Content-Type: application/json
Access-Control-Allow-Origin: https://www.itwbooking.bjquwhcm.com
Cache-Control: no-cache, no-store, must-revalidate
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 127
Expires: 0

POST
H/1.1 200
OK prebid Show response
ib.adnxs.com/ut/v3/ 144 B
1 KB 81ms
51ms XHR
application/json 185.33.223.216
AppNexus

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/ut/v3/prebid

Requested by

Host: ads.adthrive.com
URL: https://ads.adthrive.com/core/gdpr/vendor/prebid/prebid.min.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.33.223.216 , Netherlands, ASN29990 (ASN-APPNEXUS - AppNexus, Inc, US),

Reverse DNS

312.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net

Software

nginx/1.13.4 /

Resource Hash

38f6b68eb85195bf01d9d78048f73791b66bd343d3ce384111d2355fc312cc5e

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: cors
Referer: https://www.itwbooking.bjquwhcm.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Thu, 17 Oct 2019 11:17:15 GMT
X-Proxy-Origin: 144.76.109.30; 144.76.109.30; 312.bm-nginx-loadbalancer.mgmt.ams1; *.adnxs.com; 185.33.223.239:80
AN-X-Request-Uuid: 3fd02e12-ccb5-43fa-b851-3d9b102faa63
Server: nginx/1.13.4
P3P: policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: https://www.itwbooking.bjquwhcm.com
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/json; charset=utf-8
Content-Length: 144
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H/1.1 200
OK trinity.json Show response
apex.go.sonobi.com/ 150 B
1 KB 136ms
96ms XHR
application/json 178.162.133.150
LEASEWEB-NL-AMS-0...

General

Check archive.org

Show headers Download Go to

Full URL

https://apex.go.sonobi.com/trinity.json?key_maker=%7B%2248517bfc3aa6ed5%22%3A%22ae770dbd5c856e025a1d%7C300x250%2C300x600%2C320x50%2C160x600%2C300x1050%2C300x50%2C320x100%2C250x250%2C120x240%2C1x1%2C300x420%22%7D&ref=https%3A%2F%2Fwww.itwbooking.bjquwhcm.com%2F&s=3a907aca-1cb6-49a6-a1ba-f745cb55a9cc&pv=d60d2552-2971-4b84-8675-01f1fb3dd5b2&vp=desktop&lib_name=prebid&lib_v=2.32.0&us=5&ius=1&gdpr=false&

Requested by

Host: ads.adthrive.com
URL: https://ads.adthrive.com/core/gdpr/vendor/prebid/prebid.min.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

178.162.133.150 , Netherlands, ASN60781 (LEASEWEB-NL-AMS-01 Netherlands, NL),

Reverse DNS

ams-1-apex.go.sonobi.com

Software

sonobi-go /

Resource Hash

fbb5aad40705d04efa585a182c61ca9158701446bbace70773eb381b204dbdf8

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: cors
Referer: https://www.itwbooking.bjquwhcm.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Thu, 17 Oct 2019 11:17:13 GMT
Content-Encoding: gzip
Server: sonobi-go
Vary: negotiate,Accept-Encoding
X-Go-Server: apex-ams-1-6-10
P3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Access-Control-Allow-Origin: https://www.itwbooking.bjquwhcm.com
Cache-Control: no-cache, no-store, private
Access-Control-Allow-Credentials: true
Tcn: Choice
Content-Type: application/json
Content-Length: 152
X-Xss-Protection: 0
Expires: Sat, 26 Jul 1997 05:00:00 GMT

POST
H2 204 cdb Show response
bidder.criteo.com/ 0
157 B 39ms
14ms XHR
text/plain 178.250.2.152
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL: https://bidder.criteo.com/cdb?profileId=207&av=20&wv=2.32.0&cb=24747741983
Requested by: Host: ads.adthrive.com
URL: https://ads.adthrive.com/core/gdpr/vendor/prebid/prebid.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 178.250.2.152 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),
Reverse DNS
Software: Finatra /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Sec-Fetch-Mode: cors
Referer: https://www.itwbooking.bjquwhcm.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: text/plain

Response headers

status: 204
date: Thu, 17 Oct 2019 11:17:12 GMT
access-control-allow-credentials: true
server: Finatra
access-control-allow-origin: https://www.itwbooking.bjquwhcm.com
timing-allow-origin: *
vary: Origin

POST
H/1.1 200
OK prebid Show response
ib.adnxs.com/ut/v3/ 145 B
1 KB 94ms
65ms XHR
application/json 185.33.223.216
AppNexus

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/ut/v3/prebid

Requested by

Host: ads.adthrive.com
URL: https://ads.adthrive.com/core/gdpr/vendor/prebid/prebid.min.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.33.223.216 , Netherlands, ASN29990 (ASN-APPNEXUS - AppNexus, Inc, US),

Reverse DNS

312.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net

Software

nginx/1.13.4 /

Resource Hash

81ab8637975ba26ca10e4ea175981a99fd31607e2af47f4b1f73657bf82decfe

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: cors
Referer: https://www.itwbooking.bjquwhcm.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Thu, 17 Oct 2019 11:17:15 GMT
X-Proxy-Origin: 144.76.109.30; 144.76.109.30; 312.bm-nginx-loadbalancer.mgmt.ams1; *.adnxs.com; 185.33.220.75:80
AN-X-Request-Uuid: be920004-dd9a-4a3d-8b0f-3724fe9b8eb9
Server: nginx/1.13.4
P3P: policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: https://www.itwbooking.bjquwhcm.com
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/json; charset=utf-8
Content-Length: 145
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H/1.1 200
OK cygnus Show response
as-sec.casalemedia.com/ 25 B
917 B 322ms
308ms XHR
application/json 2.18.234.21
Akamai Technologies

General

Check archive.org

Show headers Download Go to

Full URL: https://as-sec.casalemedia.com/cygnus?s=185787&v=7.2&r=%7B%22id%22%3A%2253408d1c79c98ec%22%2C%22imp%22%3A%5B%7B%22id%22%3A%22540019815a1732c%22%2C%22banner%22%3A%7B%22w%22%3A300%2C%22h%22%3A250%2C%22topframe%22%3A1%7D%2C%22ext%22%3A%7B%22siteID%22%3A%22185787%22%2C%22sid%22%3A%2227_1%22%7D%7D%2C%7B%22id%22%3A%2255d1be492255e89%22%2C%22banner%22%3A%7B%22w%22%3A300%2C%22h%22%3A600%2C%22topframe%22%3A1%7D%2C%22ext%22%3A%7B%22siteID%22%3A%22185787%22%2C%22sid%22%3A%2227_2%22%7D%7D%2C%7B%22id%22%3A%225665e963689d87e%22%2C%22banner%22%3A%7B%22w%22%3A160%2C%22h%22%3A600%2C%22topframe%22%3A1%7D%2C%22ext%22%3A%7B%22siteID%22%3A%22185787%22%2C%22sid%22%3A%2227_4%22%7D%7D%2C%7B%22id%22%3A%225761c375ab280ba%22%2C%22banner%22%3A%7B%22w%22%3A300%2C%22h%22%3A50%2C%22topframe%22%3A1%7D%2C%22ext%22%3A%7B%22siteID%22%3A%22185787%22%2C%22sid%22%3A%2227_5%22%7D%7D%2C%7B%22id%22%3A%2258f2388fec25364%22%2C%22banner%22%3A%7B%22w%22%3A300%2C%22h%22%3A1050%2C%22topframe%22%3A1%7D%2C%22ext%22%3A%7B%22siteID%22%3A%22185787%22%2C%22sid%22%3A%2227_3%22%7D%7D%5D%2C%22site%22%3A%7B%22page%22%3A%22https%3A%2F%2Fwww.itwbooking.bjquwhcm.com%2F%3F%23PD%3Adesktop%23Topic%3AFamily%20and%20Parenting%23Topic%3AHome%20Decor%20and%20Design%23Topic%3AFood%23Topic%3ATravel%23Topic%3AWomens%20Style%23Topic%3Aholmm1%23Topic%3Ahlwn1%23Topic%3Abkf1%23MCMP%3A%22%7D%2C%22ext%22%3A%7B%22source%22%3A%22prebid%22%7D%2C%22regs%22%3A%7B%22ext%22%3A%7B%22gdpr%22%3A0%7D%7D%2C%22user%22%3A%7B%22ext%22%3A%7B%22consent%22%3A%22%22%7D%7D%7D&ac=j&sd=1&
Requested by: Host: ads.adthrive.com
URL: https://ads.adthrive.com/core/gdpr/vendor/prebid/prebid.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.18.234.21 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS: a2-18-234-21.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: 5be95ba717fd38cf19615dca6a1e75b7f52a78fbe60295c5cb53c432371a0c3f

Request headers

Sec-Fetch-Mode: cors
Referer: https://www.itwbooking.bjquwhcm.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Thu, 17 Oct 2019 11:17:13 GMT
Content-Encoding: gzip
Server: Apache
Vary: Accept-Encoding
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Access-Control-Allow-Origin: https://www.itwbooking.bjquwhcm.com
Cache-Control: max-age=0, no-cache, no-store
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/json
Content-Length: 45
Expires: Thu, 17 Oct 2019 11:17:13 GMT

GET
H2 200 arj Show response
cafemedia-d.openx.net/w/1.0/ 172 B
356 B 35ms
20ms XHR
application/json 34.95.120.147
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL: https://cafemedia-d.openx.net/w/1.0/arj?ju=https%3A%2F%2Fwww.itwbooking.bjquwhcm.com%2F&jr=&ch=UTF-8&res=1600x1200x24&ifr=false&tz=-120&tws=1600x1200&be=1&bc=hb_pb_2.1.7&dddid=59e0ae52-c97b-41aa-a4d4-94d37f3af1d4&nocache=1571311033049&aus=300x250%2C300x600%2C320x50%2C160x600%2C300x1050%2C300x50%2C320x100%2C250x250%2C120x240%2C1x1%2C300x420&divIds=AdThrive_Sidebar_1_desktop&auid=538699853&tps=aGlfYXU9&
Requested by: Host: ads.adthrive.com
URL: https://ads.adthrive.com/core/gdpr/vendor/prebid/prebid.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.95.120.147 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS: 147.120.95.34.bc.googleusercontent.com
Software: OXGW/16.163.0 /
Resource Hash: 927bdf93bc931761af166153ef1ff877515fed5815388a9c18640dabd4ffe646

Request headers

Sec-Fetch-Mode: cors
Referer: https://www.itwbooking.bjquwhcm.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Thu, 17 Oct 2019 11:17:13 GMT
via: 1.1 google
server: OXGW/16.163.0
status: 200
vary: Accept
p3p: CP="CUR ADM OUR NOR STA NID"
access-control-allow-origin: https://www.itwbooking.bjquwhcm.com
cache-control: private, max-age=0, no-cache
access-control-allow-credentials: true
content-type: application/json
alt-svc: clear
content-length: 172
expires: Mon, 26 Jul 1997 05:00:00 GMT

POST
H2 204 v1 Show response
dmx.districtm.io/b/ 0
427 B 130ms
113ms XHR
text/plain 104.16.190.66
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL

https://dmx.districtm.io/b/v1

Requested by

Host: ads.adthrive.com
URL: https://ads.adthrive.com/core/gdpr/vendor/prebid/prebid.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.190.66 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

Sec-Fetch-Mode: cors
Referer: https://www.itwbooking.bjquwhcm.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: application/json

Response headers

date: Thu, 17 Oct 2019 11:17:13 GMT
cf-cache-status: DYNAMIC
server: cloudflare
status: 204
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: origin
access-control-allow-methods: OPTIONS, POST
access-control-allow-origin: https://www.itwbooking.bjquwhcm.com
access-control-allow-credentials: true
strict-transport-security: max-age=31536000; includeSubDomains; preload
cf-ray: 5271dd65ad87d6bd-FRA
access-control-allow-headers: origin, content-type

GET
H/1.1 200
OK fastlane.json Show response
fastlane.rubiconproject.com/a/api/ 273 B
2 KB 129ms
98ms XHR
application/json 69.173.144.141
The Rubicon Project

General

Check archive.org

Show headers Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=9262&site_id=180726&zone_id=881440&size_id=15&alt_size_ids=9%2C10%2C14%2C43%2C44%2C54%2C117&p_pos=unknown&rf=https%3A%2F%2Fwww.itwbooking.bjquwhcm.com%2F&tk_flint=pbjs_lite_v2.32.0&x_source.tid=59e0ae52-c97b-41aa-a4d4-94d37f3af1d4&p_screen_res=1600x1200&rp_floor=0.01&rp_secure=1&slots=1&rand=0.1677287313209861
Requested by: Host: ads.adthrive.com
URL: https://ads.adthrive.com/core/gdpr/vendor/prebid/prebid.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_128_GCM
Server: 69.173.144.141 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT - The Rubicon Project, Inc., US),
Reverse DNS
Software: RAS 2.4 /
Resource Hash: a1ec30f4f04ec9601e2ccd7a92400156817d91e3302be9b757c3c90901f6bcdb

Request headers

Sec-Fetch-Mode: cors
Referer: https://www.itwbooking.bjquwhcm.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Thu, 17 Oct 2019 11:17:13 GMT
Server: RAS 2.4
Vary: Accept-Encoding
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Access-Control-Allow-Origin: https://www.itwbooking.bjquwhcm.com
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Access-Control-Allow-Credentials: true
Connection: Keep-Alive
Content-Type: application/json
Keep-Alive: timeout=5, max=219
Content-Length: 273
Expires: Wed, 17 Sep 1975 21:32:10 GMT

POST
H2 204 translator Show response
hbopenbid.pubmatic.com/ 0
69 B 274ms
256ms XHR
text/plain 185.64.189.112
PubMatic

General

Check archive.org

Show headers Download Go to

Full URL: https://hbopenbid.pubmatic.com/translator?source=prebid-client
Requested by: Host: ads.adthrive.com
URL: https://ads.adthrive.com/core/gdpr/vendor/prebid/prebid.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.64.189.112 , United Kingdom, ASN62713 (AS-PUBMATIC - PubMatic, Inc., US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Sec-Fetch-Mode: cors
Referer: https://www.itwbooking.bjquwhcm.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: text/plain

Response headers

status: 204
date: Thu, 17 Oct 2019 11:17:13 GMT
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
access-control-allow-origin: https://www.itwbooking.bjquwhcm.com

POST
H/1.1 200
OK bid Show response
ap.lijit.com/rtb/ 24 B
488 B 55ms
14ms XHR
application/json 72.251.249.14
Internap Corporation

General

Check archive.org

Show headers Download Go to

Full URL: https://ap.lijit.com/rtb/bid?src=prebid_prebid_2.32.0
Requested by: Host: ads.adthrive.com
URL: https://ads.adthrive.com/core/gdpr/vendor/prebid/prebid.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 72.251.249.14 Amsterdam, Netherlands, ASN29791 (VOXEL-DOT-NET - Internap Corporation, US),
Reverse DNS
Software: nginx /
Resource Hash: a98027fd320cd46ef032675e7421574d1e038512923f0a541c638ac1247aaa51

Request headers

Sec-Fetch-Mode: cors
Referer: https://www.itwbooking.bjquwhcm.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: text/plain

Response headers

Date: Thu, 17 Oct 2019 11:17:13 GMT
Content-Encoding: gzip
Server: nginx
Transfer-Encoding: chunked
Vary: Accept-Encoding
Access-Control-Allow-Methods: GET, POST, DELETE, PUT
Content-Type: application/json
Access-Control-Allow-Origin: https://www.itwbooking.bjquwhcm.com
Access-Control-Allow-Credentials: true
X-Sovrn-Pod: ap1ams1
Access-Control-Allow-Headers: X-Requested-With, Content-Type

POST
H2 200 bid-request Show response
a.teads.tv/hb/ 16 B
366 B 93ms
91ms XHR
application/json 2.18.232.7
Akamai Technologies

General

Check archive.org

Show headers Download Go to

Full URL: https://a.teads.tv/hb/bid-request
Requested by: Host: ads.adthrive.com
URL: https://ads.adthrive.com/core/gdpr/vendor/prebid/prebid.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.18.232.7 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS: a2-18-232-7.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 6a7b0c8bf87b2bd5ca31557f25cf2a6c80f93af72bf68a6085e9b55a87fe908c

Request headers

Sec-Fetch-Mode: cors
Referer: https://www.itwbooking.bjquwhcm.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Thu, 17 Oct 2019 11:17:13 GMT
content-encoding: gzip
status: 200
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: https://www.itwbooking.bjquwhcm.com
cache-control: max-age=0, no-cache, no-store
access-control-allow-credentials: true
content-length: 42
expires: Thu, 17 Oct 2019 11:17:13 GMT

POST
H2 204 hb Show response
hb.undertone.com/ 0
469 B 469ms
157ms XHR
text/plain 54.67.106.161
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://hb.undertone.com/hb?pid=2002&domain=bjquwhcm.com&gdpr=0&gdprstr=
Requested by: Host: ads.adthrive.com
URL: https://ads.adthrive.com/core/gdpr/vendor/prebid/prebid.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.67.106.161 San Jose, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: ec2-54-67-106-161.us-west-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Sec-Fetch-Mode: cors
Referer: https://www.itwbooking.bjquwhcm.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Thu, 17 Oct 2019 11:17:13 GMT
status: 204
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR NID CURa DEVa PSDo OUR BUS UNI COM NAV"
access-control-allow-origin: https://www.itwbooking.bjquwhcm.com
cache-control: private, max-age=0, no-cache
access-control-allow-credentials: true
expires: Mon, 26 Jul 1997 05:00:00 GMT

POST
H2 200 auction Show response
tlx.3lift.com/header/ 19 B
565 B 19ms
7ms XHR
application/json 52.58.198.43
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL

https://tlx.3lift.com/header/auction?lib=prebid&v=2.32.0&referrer=https%3A%2F%2Fwww.itwbooking.bjquwhcm.com%2F&tmax=2400

Requested by

Host: ads.adthrive.com
URL: https://ads.adthrive.com/core/gdpr/vendor/prebid/prebid.min.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.58.198.43 Frankfurt am Main, Germany, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),

Reverse DNS

ec2-52-58-198-43.eu-central-1.compute.amazonaws.com

Software

Resource Hash

0535c3bb3a17e4ac0fb7d29214d2181275662129dc2bdd2a89c35934e9fc5ba5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: cors
Referer: https://www.itwbooking.bjquwhcm.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Thu, 17 Oct 2019 11:17:13 GMT
x-auction-status: 3
status: 200
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
access-control-allow-origin: https://www.itwbooking.bjquwhcm.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
content-type: application/json; charset=utf-8
content-length: 19
x-xss-protection: 0
expires: Thu, 15 Oct 1992 20:10:00 GMT

GET
H/1.1 200
OK / Show response
i.skimresources.com/api/ 221 B
597 B 462ms
363ms Script
application/javascript 54.76.37.45
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL

https://i.skimresources.com/api/?version=10&js=1&callback=instantDataCallback&data=%7B%22instant%22%3A%221%22%2C%22page%22%3A%22https%3A%2F%2Fwww.itwbooking.bjquwhcm.com%2F%22%2C%22pref%22%3A%22%22%2C%22pubcode%22%3A%2275155X1525201%22%7D&filter=diy

Requested by

Host: www.itwbooking.bjquwhcm.com
URL: https://www.itwbooking.bjquwhcm.com/s.skimresources.com/js/75155X1525201.skimlinks.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.76.37.45 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),

Reverse DNS

ec2-54-76-37-45.eu-west-1.compute.amazonaws.com

Software

nginx/1.10.2 /

Resource Hash

d8e63983258eb8134047ccf84cd78b37347dbccad7f3907ec2b38c846d61c246

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.itwbooking.bjquwhcm.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Thu, 17 Oct 2019 11:17:13 GMT
X-Content-Type-Options: nosniff
Server: nginx/1.10.2
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Access-Control-Allow-Origin: https://www.itwbooking.bjquwhcm.com
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/javascript
Content-Length: 221

POST
H2 200 link Show response
t.skimresources.com/api/ 22 B
419 B 37ms
19ms XHR
application/javascript 35.201.67.47
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://t.skimresources.com/api/link

Requested by

Host: www.itwbooking.bjquwhcm.com
URL: https://www.itwbooking.bjquwhcm.com/s.skimresources.com/js/75155X1525201.skimlinks.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

35.201.67.47 , Ascension Island, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

47.67.201.35.bc.googleusercontent.com

Software

Python/3.7 aiohttp/3.5.4 /

Resource Hash

fcc83a5b6aef86420c1ad553167106df96bd0ff4192ffe52b1647599948edbcf

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Sec-Fetch-Mode: cors
Referer: https://www.itwbooking.bjquwhcm.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-type: application/x-www-form-urlencoded

Response headers

pragma: no-cache
date: Thu, 17 Oct 2019 11:17:13 GMT
via: 1.1 google
x-content-type-options: nosniff
server: Python/3.7 aiohttp/3.5.4
access-control-allow-headers: Origin, Accept, Content-Type, X-Requested-With, X-CSRF-Token
status: 200
access-control-allow-methods: GET, POST, OPTIONS
content-type: text/plain; charset=utf-8, application/javascript
access-control-allow-origin: https://www.itwbooking.bjquwhcm.com
cache-control: no-store, no-cache, must-revalidate
access-control-allow-credentials: true
warning: 299 - "Deprecated API"
alt-svc: clear
content-length: 22

GET
H2

200

/
p.skimresources.com/ Frame 6BBD
Redirect Chain

https://sync.crwdcntrl.net/map/c=7505/tp=SKIM/?https%3A%2F%2Fx.skimresources.com%2F%3Fprovider%3Dlotame%26skim_mapping%3Dtrue%26provider_id%3D%24%7Bprofile_id%7D
https://sync.crwdcntrl.net/map/ct=y/c=7505/tp=SKIM/?https%3A%2F%2Fx.skimresources.com%2F%3Fprovider%3Dlotame%26skim_mapping%3Dtrue%26provider_id%3D%24%7Bprofile_id%7D
https://x.skimresources.com/?provider=lotame&skim_mapping=true&provider_id=a664d2f56e90ac2155d971ac19d463a3
https://p.skimresources.com/?provider_id=a664d2f56e90ac2155d971ac19d463a3&skim_mapping=true

43 B
188 B

33ms
33ms

Image
image/gif

151.139.128.10
Highwinds Network...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://p.skimresources.com/?provider_id=a664d2f56e90ac2155d971ac19d463a3&skim_mapping=true
Requested by: Host: www.itwbooking.bjquwhcm.com
URL: https://www.itwbooking.bjquwhcm.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.139.128.10 Dallas, United States, ASN20446 (HIGHWINDS3 - Highwinds Network Group, Inc., US),
Reverse DNS
Software: UploadServer /
Resource Hash: dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-goog-hash: crc32c=xra6Ow==, md5=+DeqYLb+g0WPeQ22DVKfyQ==
date: Thu, 17 Oct 2019 11:17:13 GMT
age: 1
x-guploader-uploadid: AEnB2UrWFl4JSF7D-FZ_-DxX3YR6iJ90poW32KMqtd0utWTyalRV0RKQ7E9GZyda7B_iFZhEElLA_W0mgktulJDdgsbhxIpLcg
x-goog-storage-class: MULTI_REGIONAL
status: 200
x-goog-metageneration: 4
x-goog-stored-content-encoding: identity
content-length: 43
last-modified: Tue, 23 Oct 2018 13:19:28 GMT
server: UploadServer
etag: "f837aa60b6fe83458f790db60d529fc9"
x-hw: 1571311033.cds145.fr8.hn,1571311033.cds135.fr8.sc,1571311033.cds135.fr8.pr
x-goog-generation: 1540300768038458
cache-control: public, max-age=7200
x-goog-stored-content-length: 43
accept-ranges: bytes
content-type: image/gif

Redirect headers

Location: https://p.skimresources.com?provider_id=a664d2f56e90ac2155d971ac19d463a3&skim_mapping=true
Date: Thu, 17 Oct 2019 11:17:13 GMT
Server: TornadoServer/2.4.1
Connection: keep-alive
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Content-Length: 0
Content-Type: text/html; charset=UTF-8

GET
H2 404 2F2E86_0_0.woff
www.itwbooking.bjquwhcm.com/etdlwwyzs7ibptm965zo1lyq-wpengine.netdna-ssl.com/wp-content/themes/hitherandthither/assets/fonts/ 0
0 112ms
112ms Font
text/html 50.31.134.90
Server Central Ne...

General

Check archive.org

Show headers Download Go to

Full URL: https://www.itwbooking.bjquwhcm.com/etdlwwyzs7ibptm965zo1lyq-wpengine.netdna-ssl.com/wp-content/themes/hitherandthither/assets/fonts/2F2E86_0_0.woff
Requested by: Host: www.itwbooking.bjquwhcm.com
URL: https://www.itwbooking.bjquwhcm.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 50.31.134.90 Chicago, United States, ASN23352 (SERVERCENTRAL - Server Central Network, US),
Reverse DNS: mocha3026-web1.mochahost.com
Software: nginx /
Resource Hash

Request headers

Sec-Fetch-Mode: cors
Referer: https://www.itwbooking.bjquwhcm.com/etdlwwyzs7ibptm965zo1lyq-wpengine.netdna-ssl.com/wp-content/themes/hitherandthither/style.css
Origin: https://www.itwbooking.bjquwhcm.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

status: 404
date: Thu, 17 Oct 2019 11:17:13 GMT
content-encoding: gzip
server: nginx
vary: Accept-Encoding
content-type: text/html

POST
H/1.1 200
OK auction Show response
prebid.adnxs.com/pbs/v1/openrtb2/ 126 B
484 B 109ms
109ms XHR
application/json 37.252.161.184
AppNexus

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid.adnxs.com/pbs/v1/openrtb2/auction
Requested by: Host: ads.adthrive.com
URL: https://ads.adthrive.com/core/gdpr/vendor/prebid/prebid.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 37.252.161.184 , Ascension Island, ASN29990 (ASN-APPNEXUS - AppNexus, Inc, US),
Reverse DNS: prebid.ams1.adnexus.net
Software: nginx/1.13.10 /
Resource Hash: f3c8a34883f2b44956b45912ceab56124951275fb886b3d4cfb3322b8ce645c1

Request headers

Sec-Fetch-Mode: cors
Referer: https://www.itwbooking.bjquwhcm.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Thu, 17 Oct 2019 11:17:15 GMT
Server: nginx/1.13.10
Vary: Origin
Content-Type: application/json
Access-Control-Allow-Origin: https://www.itwbooking.bjquwhcm.com
Cache-Control: no-cache, no-store, must-revalidate
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 126
Expires: 0

POST
H2 204 cdb Show response
bidder.criteo.com/ 0
157 B 14ms
13ms XHR
text/plain 178.250.2.152
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL: https://bidder.criteo.com/cdb?profileId=207&av=20&wv=2.32.0&cb=11634262410
Requested by: Host: ads.adthrive.com
URL: https://ads.adthrive.com/core/gdpr/vendor/prebid/prebid.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 178.250.2.152 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),
Reverse DNS
Software: Finatra /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Sec-Fetch-Mode: cors
Referer: https://www.itwbooking.bjquwhcm.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: text/plain

Response headers

status: 204
date: Thu, 17 Oct 2019 11:17:12 GMT
access-control-allow-credentials: true
server: Finatra
access-control-allow-origin: https://www.itwbooking.bjquwhcm.com
timing-allow-origin: *
vary: Origin

POST
H/1.1 200
OK prebid Show response
ib.adnxs.com/ut/v3/ 145 B
1 KB 68ms
68ms XHR
application/json 185.33.223.216
AppNexus

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/ut/v3/prebid

Requested by

Host: ads.adthrive.com
URL: https://ads.adthrive.com/core/gdpr/vendor/prebid/prebid.min.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.33.223.216 , Netherlands, ASN29990 (ASN-APPNEXUS - AppNexus, Inc, US),

Reverse DNS

312.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net

Software

nginx/1.13.4 /

Resource Hash

ccc73259c16d17a3c0cb5858b8795860cadead685079bdd25dcb7b415f87a3e7

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: cors
Referer: https://www.itwbooking.bjquwhcm.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Thu, 17 Oct 2019 11:17:15 GMT
X-Proxy-Origin: 144.76.109.30; 144.76.109.30; 312.bm-nginx-loadbalancer.mgmt.ams1; *.adnxs.com; 185.33.223.180:80
AN-X-Request-Uuid: 92e68084-5c50-412e-8f70-d9121d3ab5d7
Server: nginx/1.13.4
P3P: policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: https://www.itwbooking.bjquwhcm.com
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/json; charset=utf-8
Content-Length: 145
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H/1.1 200
OK trinity.json Show response
apex.go.sonobi.com/ 150 B
1 KB 101ms
87ms XHR
application/json 178.162.133.150
LEASEWEB-NL-AMS-0...

General

Check archive.org

Show headers Download Go to

Full URL

https://apex.go.sonobi.com/trinity.json?key_maker=%7B%2288d838c5b75ae1c%22%3A%2208546c43f1c9c99b2f34%7C728x90%2C320x50%2C970x250%2C970x90%2C300x50%2C320x100%2C468x60%2C1x1%2C728x250%22%7D&ref=https%3A%2F%2Fwww.itwbooking.bjquwhcm.com%2F&s=8d676f7a-44e0-4f5a-873a-2b8636116ac2&pv=d60d2552-2971-4b84-8675-01f1fb3dd5b2&vp=desktop&lib_name=prebid&lib_v=2.32.0&us=5&ius=1&gdpr=false&

Requested by

Host: ads.adthrive.com
URL: https://ads.adthrive.com/core/gdpr/vendor/prebid/prebid.min.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

178.162.133.150 , Netherlands, ASN60781 (LEASEWEB-NL-AMS-01 Netherlands, NL),

Reverse DNS

ams-1-apex.go.sonobi.com

Software

sonobi-go /

Resource Hash

47ec836ca89dbd7753d41f563f4ea7394f4529a10ed5e5b6b8c997504240b5af

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: cors
Referer: https://www.itwbooking.bjquwhcm.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Thu, 17 Oct 2019 11:17:13 GMT
Content-Encoding: gzip
Server: sonobi-go
Vary: negotiate,Accept-Encoding
X-Go-Server: apex-ams-1-6-8
P3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Access-Control-Allow-Origin: https://www.itwbooking.bjquwhcm.com
Cache-Control: no-cache, no-store, private
Access-Control-Allow-Credentials: true
Tcn: Choice
Content-Type: application/json
Content-Length: 151
X-Xss-Protection: 0
Expires: Sat, 26 Jul 1997 05:00:00 GMT

GET
H/1.1 200
OK cygnus Show response
as-sec.casalemedia.com/ 25 B
915 B 161ms
151ms XHR
application/json 2.18.234.21
Akamai Technologies

General

Check archive.org

Show headers Download Go to

Full URL: https://as-sec.casalemedia.com/cygnus?s=185774&v=7.2&r=%7B%22id%22%3A%228900c135df9009c%22%2C%22imp%22%3A%5B%7B%22id%22%3A%229089ae3cf75d2ff%22%2C%22banner%22%3A%7B%22w%22%3A728%2C%22h%22%3A90%2C%22topframe%22%3A1%7D%2C%22ext%22%3A%7B%22siteID%22%3A%22185774%22%2C%22sid%22%3A%2215_1%22%7D%7D%2C%7B%22id%22%3A%2291b5c9b6794df78%22%2C%22banner%22%3A%7B%22w%22%3A970%2C%22h%22%3A250%2C%22topframe%22%3A1%7D%2C%22ext%22%3A%7B%22siteID%22%3A%22185774%22%2C%22sid%22%3A%2215_3%22%7D%7D%2C%7B%22id%22%3A%2292191e2a4af37db%22%2C%22banner%22%3A%7B%22w%22%3A320%2C%22h%22%3A50%2C%22topframe%22%3A1%7D%2C%22ext%22%3A%7B%22siteID%22%3A%22185774%22%2C%22sid%22%3A%2215_4%22%7D%7D%2C%7B%22id%22%3A%22936bf81d8e5fafa%22%2C%22banner%22%3A%7B%22w%22%3A970%2C%22h%22%3A90%2C%22topframe%22%3A1%7D%2C%22ext%22%3A%7B%22siteID%22%3A%22185774%22%2C%22sid%22%3A%2215_2%22%7D%7D%5D%2C%22site%22%3A%7B%22page%22%3A%22https%3A%2F%2Fwww.itwbooking.bjquwhcm.com%2F%3F%23PD%3Adesktop%23Topic%3AFamily%20and%20Parenting%23Topic%3AHome%20Decor%20and%20Design%23Topic%3AFood%23Topic%3ATravel%23Topic%3AWomens%20Style%23Topic%3Aholmm1%23Topic%3Ahlwn1%23Topic%3Abkf1%23MCMP%3A%22%7D%2C%22ext%22%3A%7B%22source%22%3A%22prebid%22%7D%2C%22regs%22%3A%7B%22ext%22%3A%7B%22gdpr%22%3A0%7D%7D%2C%22user%22%3A%7B%22ext%22%3A%7B%22consent%22%3A%22%22%7D%7D%7D&ac=j&sd=1&
Requested by: Host: ads.adthrive.com
URL: https://ads.adthrive.com/core/gdpr/vendor/prebid/prebid.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.18.234.21 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS: a2-18-234-21.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: 3a5f70c2bb1108d9f4f334225ed95af455338b1eb491e81f0e4c119f3ccf99c1

Request headers

Sec-Fetch-Mode: cors
Referer: https://www.itwbooking.bjquwhcm.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Thu, 17 Oct 2019 11:17:13 GMT
Content-Encoding: gzip
Server: Apache
Vary: Accept-Encoding
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Access-Control-Allow-Origin: https://www.itwbooking.bjquwhcm.com
Cache-Control: max-age=0, no-cache, no-store
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/json
Content-Length: 43
Expires: Thu, 17 Oct 2019 11:17:13 GMT

POST
H2 204 translator Show response
hbopenbid.pubmatic.com/ 0
69 B 14ms
14ms XHR
text/plain 185.64.189.112
PubMatic

General

Check archive.org

Show headers Download Go to

Full URL: https://hbopenbid.pubmatic.com/translator?source=prebid-client
Requested by: Host: ads.adthrive.com
URL: https://ads.adthrive.com/core/gdpr/vendor/prebid/prebid.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.64.189.112 , United Kingdom, ASN62713 (AS-PUBMATIC - PubMatic, Inc., US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Sec-Fetch-Mode: cors
Referer: https://www.itwbooking.bjquwhcm.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: text/plain

Response headers

status: 204
date: Thu, 17 Oct 2019 11:17:13 GMT
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
access-control-allow-origin: https://www.itwbooking.bjquwhcm.com

POST
H/1.1 200
OK bid Show response
ap.lijit.com/rtb/ 25 B
489 B 28ms
28ms XHR
application/json 72.251.249.14
Internap Corporation

General

Check archive.org

Show headers Download Go to

Full URL: https://ap.lijit.com/rtb/bid?src=prebid_prebid_2.32.0
Requested by: Host: ads.adthrive.com
URL: https://ads.adthrive.com/core/gdpr/vendor/prebid/prebid.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 72.251.249.14 Amsterdam, Netherlands, ASN29791 (VOXEL-DOT-NET - Internap Corporation, US),
Reverse DNS
Software: nginx /
Resource Hash: 9c62b9826a169620028cf881a8d9b45165f88b25f6e6e675eb01c0a9b86e9aa2

Request headers

Sec-Fetch-Mode: cors
Referer: https://www.itwbooking.bjquwhcm.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: text/plain

Response headers

Date: Thu, 17 Oct 2019 11:17:13 GMT
Content-Encoding: gzip
Server: nginx
Transfer-Encoding: chunked
Vary: Accept-Encoding
Access-Control-Allow-Methods: GET, POST, DELETE, PUT
Content-Type: application/json
Access-Control-Allow-Origin: https://www.itwbooking.bjquwhcm.com
Access-Control-Allow-Credentials: true
X-Sovrn-Pod: ap1ams1
Access-Control-Allow-Headers: X-Requested-With, Content-Type

POST
H2 204 v1 Show response
dmx.districtm.io/b/ 0
39 B 134ms
134ms XHR
text/plain 104.16.190.66
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL

https://dmx.districtm.io/b/v1

Requested by

Host: ads.adthrive.com
URL: https://ads.adthrive.com/core/gdpr/vendor/prebid/prebid.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.190.66 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

Sec-Fetch-Mode: cors
Referer: https://www.itwbooking.bjquwhcm.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: application/json

Response headers

date: Thu, 17 Oct 2019 11:17:13 GMT
cf-cache-status: DYNAMIC
server: cloudflare
status: 204
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: origin
access-control-allow-methods: OPTIONS, POST
access-control-allow-origin: https://www.itwbooking.bjquwhcm.com
access-control-allow-credentials: true
strict-transport-security: max-age=31536000; includeSubDomains; preload
cf-ray: 5271dd65cdf5d6bd-FRA
access-control-allow-headers: origin, content-type

GET
H2 200 arj Show response
cafemedia-d.openx.net/w/1.0/ 172 B
356 B 25ms
25ms XHR
application/json 34.95.120.147
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL: https://cafemedia-d.openx.net/w/1.0/arj?ju=https%3A%2F%2Fwww.itwbooking.bjquwhcm.com%2F&jr=&ch=UTF-8&res=1600x1200x24&ifr=false&tz=-120&tws=1600x1200&be=1&bc=hb_pb_2.1.7&dddid=a5d8ad7a-71c6-4328-a5fd-7f33782995fd&nocache=1571311033133&aus=728x90%2C320x50%2C970x250%2C970x90%2C300x50%2C320x100%2C468x60%2C1x1%2C728x250&divIds=AdThrive_Header_1_desktop&auid=538699873&tps=aGlfYXU9&
Requested by: Host: ads.adthrive.com
URL: https://ads.adthrive.com/core/gdpr/vendor/prebid/prebid.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.95.120.147 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS: 147.120.95.34.bc.googleusercontent.com
Software: OXGW/16.163.0 /
Resource Hash: c98691eef331dcc74624602509d16fd4ac494a2f513eb3a718ba6ad7565b8560

Request headers

Sec-Fetch-Mode: cors
Referer: https://www.itwbooking.bjquwhcm.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Thu, 17 Oct 2019 11:17:13 GMT
via: 1.1 google
server: OXGW/16.163.0
status: 200
vary: Accept
p3p: CP="CUR ADM OUR NOR STA NID"
access-control-allow-origin: https://www.itwbooking.bjquwhcm.com
cache-control: private, max-age=0, no-cache
access-control-allow-credentials: true
content-type: application/json
alt-svc: clear
content-length: 172
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H/1.1 200
OK fastlane.json Show response
fastlane.rubiconproject.com/a/api/ 273 B
2 KB 186ms
154ms XHR
application/json 69.173.144.141
The Rubicon Project

General

Check archive.org

Show headers Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=9262&site_id=180726&zone_id=881422&size_id=2&alt_size_ids=1%2C43%2C44%2C55%2C57%2C117&p_pos=unknown&rf=https%3A%2F%2Fwww.itwbooking.bjquwhcm.com%2F&tk_flint=pbjs_lite_v2.32.0&x_source.tid=a5d8ad7a-71c6-4328-a5fd-7f33782995fd&p_screen_res=1600x1200&rp_floor=0.01&rp_secure=1&slots=1&rand=0.5025049222642073
Requested by: Host: ads.adthrive.com
URL: https://ads.adthrive.com/core/gdpr/vendor/prebid/prebid.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_128_GCM
Server: 69.173.144.141 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT - The Rubicon Project, Inc., US),
Reverse DNS
Software: RAS 2.4 /
Resource Hash: 2153b99005f54e6c1e2a727f6a5423071cf51d41fea05889e363b2ebf2e48b5d

Request headers

Sec-Fetch-Mode: cors
Referer: https://www.itwbooking.bjquwhcm.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Thu, 17 Oct 2019 11:17:13 GMT
Server: RAS 2.4
Vary: Accept-Encoding
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Access-Control-Allow-Origin: https://www.itwbooking.bjquwhcm.com
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Access-Control-Allow-Credentials: true
Connection: Keep-Alive
Content-Type: application/json
Keep-Alive: timeout=5, max=263
Content-Length: 273
Expires: Wed, 17 Sep 1975 21:32:10 GMT

POST
H2 200 auction Show response
tlx.3lift.com/header/ 19 B
565 B 9ms
9ms XHR
application/json 52.58.198.43
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL

https://tlx.3lift.com/header/auction?lib=prebid&v=2.32.0&referrer=https%3A%2F%2Fwww.itwbooking.bjquwhcm.com%2F&tmax=2400

Requested by

Host: ads.adthrive.com
URL: https://ads.adthrive.com/core/gdpr/vendor/prebid/prebid.min.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.58.198.43 Frankfurt am Main, Germany, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),

Reverse DNS

ec2-52-58-198-43.eu-central-1.compute.amazonaws.com

Software

Resource Hash

0535c3bb3a17e4ac0fb7d29214d2181275662129dc2bdd2a89c35934e9fc5ba5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: cors
Referer: https://www.itwbooking.bjquwhcm.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Thu, 17 Oct 2019 11:17:13 GMT
x-auction-status: 3
status: 200
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
access-control-allow-origin: https://www.itwbooking.bjquwhcm.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
content-type: application/json; charset=utf-8
content-length: 19
x-xss-protection: 0
expires: Thu, 15 Oct 1992 20:10:00 GMT

POST
H2 200 bid-request Show response
a.teads.tv/hb/ 16 B
366 B 62ms
62ms XHR
application/json 2.18.232.7
Akamai Technologies

General

Check archive.org

Show headers Download Go to

Full URL: https://a.teads.tv/hb/bid-request
Requested by: Host: ads.adthrive.com
URL: https://ads.adthrive.com/core/gdpr/vendor/prebid/prebid.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.18.232.7 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS: a2-18-232-7.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 6a7b0c8bf87b2bd5ca31557f25cf2a6c80f93af72bf68a6085e9b55a87fe908c

Request headers

Sec-Fetch-Mode: cors
Referer: https://www.itwbooking.bjquwhcm.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Thu, 17 Oct 2019 11:17:13 GMT
content-encoding: gzip
status: 200
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: https://www.itwbooking.bjquwhcm.com
cache-control: max-age=0, no-cache, no-store
access-control-allow-credentials: true
content-length: 42
expires: Thu, 17 Oct 2019 11:17:13 GMT

POST
H/1.1 200
OK prebid Show response
ib.adnxs.com/ut/v3/ 145 B
1 KB 41ms
41ms XHR
application/json 185.33.223.216
AppNexus

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/ut/v3/prebid

Requested by

Host: ads.adthrive.com
URL: https://ads.adthrive.com/core/gdpr/vendor/prebid/prebid.min.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.33.223.216 , Netherlands, ASN29990 (ASN-APPNEXUS - AppNexus, Inc, US),

Reverse DNS

312.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net

Software

nginx/1.13.4 /

Resource Hash

6d032b4fb89fc2989dd99f1f9f27dad2d085e95b66e602ccda920b93dd840735

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: cors
Referer: https://www.itwbooking.bjquwhcm.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Thu, 17 Oct 2019 11:17:15 GMT
X-Proxy-Origin: 144.76.109.30; 144.76.109.30; 312.bm-nginx-loadbalancer.mgmt.ams1; *.adnxs.com; 185.33.222.245:80
AN-X-Request-Uuid: 1b2c72b9-01ce-4ba3-a868-66022d634748
Server: nginx/1.13.4
P3P: policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: https://www.itwbooking.bjquwhcm.com
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/json; charset=utf-8
Content-Length: 145
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H/1.1 204
No Content b
sb.scorecardresearch.com/ 0
248 B 8ms
6ms Image
text/plain 2.19.43.224
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sb.scorecardresearch.com/b?c1=2&c2=20567959&ns__t=1571311033157&ns_c=UTF-8&cv=3.1e&c8=Hither%20%26%20Thither&c7=https%3A%2F%2Fwww.itwbooking.bjquwhcm.com%2F&c9=
Requested by: Host: www.itwbooking.bjquwhcm.com
URL: https://www.itwbooking.bjquwhcm.com/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.19.43.224 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS: a2-19-43-224.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.itwbooking.bjquwhcm.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 17 Oct 2019 11:17:13 GMT
Cache-Control: private, no-cache, no-cache=Set-Cookie, no-store, proxy-revalidate
Connection: keep-alive
Content-Length: 0
Expires: Mon, 01 Jan 1990 00:00:00 GMT

POST
H/1.1 200
OK auction Show response
prebid.adnxs.com/pbs/v1/openrtb2/ 126 B
484 B 126ms
110ms XHR
application/json 37.252.161.184
AppNexus

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid.adnxs.com/pbs/v1/openrtb2/auction
Requested by: Host: ads.adthrive.com
URL: https://ads.adthrive.com/core/gdpr/vendor/prebid/prebid.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 37.252.161.184 , Ascension Island, ASN29990 (ASN-APPNEXUS - AppNexus, Inc, US),
Reverse DNS: prebid.ams1.adnexus.net
Software: nginx/1.13.10 /
Resource Hash: db7e90d7d2080e196ee3f61b089270bb906fbf204d32b5f23ecc54dd553e5a2d

Request headers

Sec-Fetch-Mode: cors
Referer: https://www.itwbooking.bjquwhcm.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Thu, 17 Oct 2019 11:17:15 GMT
Server: nginx/1.13.10
Vary: Origin
Content-Type: application/json
Access-Control-Allow-Origin: https://www.itwbooking.bjquwhcm.com
Cache-Control: no-cache, no-store, must-revalidate
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 126
Expires: 0

GET
H/1.1 200
OK cygnus Show response
as-sec.casalemedia.com/ 25 B
917 B 219ms
208ms XHR
application/json 2.18.234.21
Akamai Technologies

General

Check archive.org

Show headers Download Go to

Full URL: https://as-sec.casalemedia.com/cygnus?s=185795&v=7.2&r=%7B%22id%22%3A%22116821d7cfd3aa7%22%2C%22imp%22%3A%5B%7B%22id%22%3A%22117dc3ded4372fd8%22%2C%22banner%22%3A%7B%22w%22%3A300%2C%22h%22%3A250%2C%22topframe%22%3A1%7D%2C%22ext%22%3A%7B%22siteID%22%3A%22185795%22%2C%22sid%22%3A%2235_1%22%7D%7D%2C%7B%22id%22%3A%2211844430834c76d5%22%2C%22banner%22%3A%7B%22w%22%3A300%2C%22h%22%3A600%2C%22topframe%22%3A1%7D%2C%22ext%22%3A%7B%22siteID%22%3A%22185795%22%2C%22sid%22%3A%2235_2%22%7D%7D%2C%7B%22id%22%3A%22119bf3e164e817e2%22%2C%22banner%22%3A%7B%22w%22%3A160%2C%22h%22%3A600%2C%22topframe%22%3A1%7D%2C%22ext%22%3A%7B%22siteID%22%3A%22185795%22%2C%22sid%22%3A%2235_4%22%7D%7D%2C%7B%22id%22%3A%22120d052d2565f637%22%2C%22banner%22%3A%7B%22w%22%3A300%2C%22h%22%3A50%2C%22topframe%22%3A1%7D%2C%22ext%22%3A%7B%22siteID%22%3A%22185795%22%2C%22sid%22%3A%2235_5%22%7D%7D%2C%7B%22id%22%3A%221218437c1d6b6649%22%2C%22banner%22%3A%7B%22w%22%3A300%2C%22h%22%3A1050%2C%22topframe%22%3A1%7D%2C%22ext%22%3A%7B%22siteID%22%3A%22185795%22%2C%22sid%22%3A%2235_3%22%7D%7D%5D%2C%22site%22%3A%7B%22page%22%3A%22https%3A%2F%2Fwww.itwbooking.bjquwhcm.com%2F%3F%23PD%3Adesktop%23Topic%3AFamily%20and%20Parenting%23Topic%3AHome%20Decor%20and%20Design%23Topic%3AFood%23Topic%3ATravel%23Topic%3AWomens%20Style%23Topic%3Aholmm1%23Topic%3Ahlwn1%23Topic%3Abkf1%23MCMP%3A%22%7D%2C%22ext%22%3A%7B%22source%22%3A%22prebid%22%7D%2C%22regs%22%3A%7B%22ext%22%3A%7B%22gdpr%22%3A0%7D%7D%2C%22user%22%3A%7B%22ext%22%3A%7B%22consent%22%3A%22%22%7D%7D%7D&ac=j&sd=1&
Requested by: Host: ads.adthrive.com
URL: https://ads.adthrive.com/core/gdpr/vendor/prebid/prebid.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.18.234.21 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS: a2-18-234-21.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: d460b9dd1f0a030761351c80b470610a2418f3ef46f5bffc79758b1c02dbde50

Request headers

Sec-Fetch-Mode: cors
Referer: https://www.itwbooking.bjquwhcm.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Thu, 17 Oct 2019 11:17:13 GMT
Content-Encoding: gzip
Server: Apache
Vary: Accept-Encoding
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Access-Control-Allow-Origin: https://www.itwbooking.bjquwhcm.com
Cache-Control: max-age=0, no-cache, no-store
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/json
Content-Length: 45
Expires: Thu, 17 Oct 2019 11:17:13 GMT

GET
H/1.1 200
OK fastlane.json Show response
fastlane.rubiconproject.com/a/api/ 277 B
1 KB 150ms
147ms XHR
application/json 69.173.144.141
The Rubicon Project

General

Check archive.org

Show headers Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=9262&site_id=180726&zone_id=881478&size_id=15&alt_size_ids=9%2C10%2C14%2C43%2C44%2C54%2C117&p_pos=unknown&rf=https%3A%2F%2Fwww.itwbooking.bjquwhcm.com%2F&tk_flint=pbjs_lite_v2.32.0&x_source.tid=77853185-fc2f-4c7d-9050-77e3e96ad808&p_screen_res=1600x1200&rp_floor=0.01&rp_secure=1&slots=1&rand=0.7375976381849616
Requested by: Host: ads.adthrive.com
URL: https://ads.adthrive.com/core/gdpr/vendor/prebid/prebid.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_128_GCM
Server: 69.173.144.141 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT - The Rubicon Project, Inc., US),
Reverse DNS
Software: RAS 2.4 /
Resource Hash: d44b4983cfd347d95d4f01ba6b1049da856e0ac6e11a4ddb959517fe27125c79

Request headers

Sec-Fetch-Mode: cors
Referer: https://www.itwbooking.bjquwhcm.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Thu, 17 Oct 2019 11:17:13 GMT
Server: RAS 2.4
Vary: Accept-Encoding
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Access-Control-Allow-Origin: https://www.itwbooking.bjquwhcm.com
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Access-Control-Allow-Credentials: true
Connection: Keep-Alive
Content-Type: application/json
Keep-Alive: timeout=5, max=479
Content-Length: 277
Expires: Wed, 17 Sep 1975 21:32:10 GMT

POST
H/1.1 200
OK prebid Show response
ib.adnxs.com/ut/v3/ 145 B
1 KB 73ms
69ms XHR
application/json 185.33.223.216
AppNexus

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/ut/v3/prebid

Requested by

Host: ads.adthrive.com
URL: https://ads.adthrive.com/core/gdpr/vendor/prebid/prebid.min.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.33.223.216 , Netherlands, ASN29990 (ASN-APPNEXUS - AppNexus, Inc, US),

Reverse DNS

312.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net

Software

nginx/1.13.4 /

Resource Hash

c36f239ce79e35dadbff0ff5db8575f16cde7aabac186805458218dd667eccfe

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: cors
Referer: https://www.itwbooking.bjquwhcm.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Thu, 17 Oct 2019 11:17:15 GMT
X-Proxy-Origin: 144.76.109.30; 144.76.109.30; 312.bm-nginx-loadbalancer.mgmt.ams1; *.adnxs.com; 185.33.222.247:80
AN-X-Request-Uuid: 90ad69fb-732f-49af-a4d9-d0f51e04e0b1
Server: nginx/1.13.4
P3P: policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: https://www.itwbooking.bjquwhcm.com
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/json; charset=utf-8
Content-Length: 145
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H/1.1 200
OK prebid Show response
ib.adnxs.com/ut/v3/ 145 B
1 KB 50ms
47ms XHR
application/json 185.33.223.216
AppNexus

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/ut/v3/prebid

Requested by

Host: ads.adthrive.com
URL: https://ads.adthrive.com/core/gdpr/vendor/prebid/prebid.min.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.33.223.216 , Netherlands, ASN29990 (ASN-APPNEXUS - AppNexus, Inc, US),

Reverse DNS

312.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net

Software

nginx/1.13.4 /

Resource Hash

2c14bcd9fdbed13183fba882813ade21f5e803924b295c330d317eabbf8c7391

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: cors
Referer: https://www.itwbooking.bjquwhcm.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Thu, 17 Oct 2019 11:17:15 GMT
X-Proxy-Origin: 144.76.109.30; 144.76.109.30; 312.bm-nginx-loadbalancer.mgmt.ams1; *.adnxs.com; 185.33.223.137:80
AN-X-Request-Uuid: 3871b12f-2674-44ab-ac79-c5ffa5e9b8ab
Server: nginx/1.13.4
P3P: policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: https://www.itwbooking.bjquwhcm.com
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/json; charset=utf-8
Content-Length: 145
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H2 204 cdb Show response
bidder.criteo.com/ 0
157 B 18ms
13ms XHR
text/plain 178.250.2.152
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL: https://bidder.criteo.com/cdb?profileId=207&av=20&wv=2.32.0&cb=16648961180
Requested by: Host: ads.adthrive.com
URL: https://ads.adthrive.com/core/gdpr/vendor/prebid/prebid.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 178.250.2.152 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),
Reverse DNS
Software: Finatra /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Sec-Fetch-Mode: cors
Referer: https://www.itwbooking.bjquwhcm.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: text/plain

Response headers

status: 204
date: Thu, 17 Oct 2019 11:17:12 GMT
access-control-allow-credentials: true
server: Finatra
access-control-allow-origin: https://www.itwbooking.bjquwhcm.com
timing-allow-origin: *
vary: Origin

POST
H2 204 hb Show response
hb.undertone.com/ 0
470 B 358ms
157ms XHR
text/plain 54.67.106.161
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://hb.undertone.com/hb?pid=2002&domain=bjquwhcm.com&gdpr=0&gdprstr=
Requested by: Host: ads.adthrive.com
URL: https://ads.adthrive.com/core/gdpr/vendor/prebid/prebid.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.67.106.161 San Jose, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: ec2-54-67-106-161.us-west-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Sec-Fetch-Mode: cors
Referer: https://www.itwbooking.bjquwhcm.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Thu, 17 Oct 2019 11:17:13 GMT
status: 204
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR NID CURa DEVa PSDo OUR BUS UNI COM NAV"
access-control-allow-origin: https://www.itwbooking.bjquwhcm.com
cache-control: private, max-age=0, no-cache
access-control-allow-credentials: true
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H2 200 arj Show response
cafemedia-d.openx.net/w/1.0/ 172 B
356 B 29ms
25ms XHR
application/json 34.95.120.147
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL: https://cafemedia-d.openx.net/w/1.0/arj?ju=https%3A%2F%2Fwww.itwbooking.bjquwhcm.com%2F&jr=&ch=UTF-8&res=1600x1200x24&ifr=false&tz=-120&tws=1600x1200&be=1&bc=hb_pb_2.1.7&dddid=77853185-fc2f-4c7d-9050-77e3e96ad808&nocache=1571311033162&aus=300x250%2C300x600%2C320x50%2C160x600%2C300x1050%2C300x50%2C320x100%2C250x250%2C120x240%2C1x1%2C300x420&divIds=AdThrive_Sidebar_9_desktop&auid=538699861&tps=aGlfYXU9&
Requested by: Host: ads.adthrive.com
URL: https://ads.adthrive.com/core/gdpr/vendor/prebid/prebid.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.95.120.147 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS: 147.120.95.34.bc.googleusercontent.com
Software: OXGW/16.163.0 /
Resource Hash: ce2ec84646438506023b05fc4b1cb584eaac33d5739bf66a242d38e63a129ab0

Request headers

Sec-Fetch-Mode: cors
Referer: https://www.itwbooking.bjquwhcm.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Thu, 17 Oct 2019 11:17:13 GMT
via: 1.1 google
server: OXGW/16.163.0
status: 200
vary: Accept
p3p: CP="CUR ADM OUR NOR STA NID"
access-control-allow-origin: https://www.itwbooking.bjquwhcm.com
cache-control: private, max-age=0, no-cache
access-control-allow-credentials: true
content-type: application/json
alt-svc: clear
content-length: 172
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H/1.1 200
OK trinity.json Show response
apex.go.sonobi.com/ 151 B
1 KB 87ms
64ms XHR
application/json 178.162.133.150
LEASEWEB-NL-AMS-0...

General

Check archive.org

Show headers Download Go to

Full URL

https://apex.go.sonobi.com/trinity.json?key_maker=%7B%22135ee859b2555064%22%3A%22c185c26b43fffcdbd8ac%7C300x250%2C300x600%2C320x50%2C160x600%2C300x1050%2C300x50%2C320x100%2C250x250%2C120x240%2C1x1%2C300x420%22%7D&ref=https%3A%2F%2Fwww.itwbooking.bjquwhcm.com%2F&s=96558f40-5fae-4281-9f59-cdd9b6f202a2&pv=d60d2552-2971-4b84-8675-01f1fb3dd5b2&vp=desktop&lib_name=prebid&lib_v=2.32.0&us=5&ius=1&gdpr=false&

Requested by

Host: ads.adthrive.com
URL: https://ads.adthrive.com/core/gdpr/vendor/prebid/prebid.min.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

178.162.133.150 , Netherlands, ASN60781 (LEASEWEB-NL-AMS-01 Netherlands, NL),

Reverse DNS

ams-1-apex.go.sonobi.com

Software

sonobi-go /

Resource Hash

3f49ab4dde6b0ea517096e321122f485e4d5c6ec94c61a01dc5274c99da05010

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: cors
Referer: https://www.itwbooking.bjquwhcm.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Thu, 17 Oct 2019 11:17:13 GMT
Content-Encoding: gzip
Server: sonobi-go
Vary: negotiate,Accept-Encoding
X-Go-Server: apex-ams-1-6-10
P3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Access-Control-Allow-Origin: https://www.itwbooking.bjquwhcm.com
Cache-Control: no-cache, no-store, private
Access-Control-Allow-Credentials: true
Tcn: Choice
Content-Type: application/json
Content-Length: 153
X-Xss-Protection: 0
Expires: Sat, 26 Jul 1997 05:00:00 GMT

POST
H2 200 bid-request Show response
a.teads.tv/hb/ 16 B
257 B 71ms
68ms XHR
application/json 2.18.232.7
Akamai Technologies

General

Check archive.org

Show headers Download Go to

Full URL: https://a.teads.tv/hb/bid-request
Requested by: Host: ads.adthrive.com
URL: https://ads.adthrive.com/core/gdpr/vendor/prebid/prebid.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.18.232.7 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS: a2-18-232-7.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 6a7b0c8bf87b2bd5ca31557f25cf2a6c80f93af72bf68a6085e9b55a87fe908c

Request headers

Sec-Fetch-Mode: cors
Referer: https://www.itwbooking.bjquwhcm.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Thu, 17 Oct 2019 11:17:13 GMT
content-encoding: gzip
status: 200
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: https://www.itwbooking.bjquwhcm.com
cache-control: max-age=0, no-cache, no-store
access-control-allow-credentials: true
content-length: 42
expires: Thu, 17 Oct 2019 11:17:13 GMT

POST
H2 200 auction Show response
tlx.3lift.com/header/ 19 B
580 B 10ms
8ms XHR
application/json 52.58.198.43
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL

https://tlx.3lift.com/header/auction?lib=prebid&v=2.32.0&referrer=https%3A%2F%2Fwww.itwbooking.bjquwhcm.com%2F&tmax=2400

Requested by

Host: ads.adthrive.com
URL: https://ads.adthrive.com/core/gdpr/vendor/prebid/prebid.min.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.58.198.43 Frankfurt am Main, Germany, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),

Reverse DNS

ec2-52-58-198-43.eu-central-1.compute.amazonaws.com

Software

Resource Hash

0535c3bb3a17e4ac0fb7d29214d2181275662129dc2bdd2a89c35934e9fc5ba5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: cors
Referer: https://www.itwbooking.bjquwhcm.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Thu, 17 Oct 2019 11:17:13 GMT
x-auction-status: 3, 3
status: 200
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
access-control-allow-origin: https://www.itwbooking.bjquwhcm.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
content-type: application/json; charset=utf-8
content-length: 19
x-xss-protection: 0
expires: Thu, 15 Oct 1992 20:10:00 GMT

POST
H2 204 v1 Show response
dmx.districtm.io/b/ 0
39 B 117ms
117ms XHR
text/plain 104.16.190.66
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL

https://dmx.districtm.io/b/v1

Requested by

Host: ads.adthrive.com
URL: https://ads.adthrive.com/core/gdpr/vendor/prebid/prebid.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.190.66 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

Sec-Fetch-Mode: cors
Referer: https://www.itwbooking.bjquwhcm.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: application/json

Response headers

date: Thu, 17 Oct 2019 11:17:13 GMT
cf-cache-status: DYNAMIC
server: cloudflare
status: 204
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: origin
access-control-allow-methods: OPTIONS, POST
access-control-allow-origin: https://www.itwbooking.bjquwhcm.com
access-control-allow-credentials: true
strict-transport-security: max-age=31536000; includeSubDomains; preload
cf-ray: 5271dd65fed5d6bd-FRA
access-control-allow-headers: origin, content-type

POST
H2 204 translator Show response
hbopenbid.pubmatic.com/ 0
69 B 46ms
45ms XHR
text/plain 185.64.189.112
PubMatic

General

Check archive.org

Show headers Download Go to

Full URL: https://hbopenbid.pubmatic.com/translator?source=prebid-client
Requested by: Host: ads.adthrive.com
URL: https://ads.adthrive.com/core/gdpr/vendor/prebid/prebid.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.64.189.112 , United Kingdom, ASN62713 (AS-PUBMATIC - PubMatic, Inc., US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Sec-Fetch-Mode: cors
Referer: https://www.itwbooking.bjquwhcm.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: text/plain

Response headers

status: 204
date: Thu, 17 Oct 2019 11:17:13 GMT
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
access-control-allow-origin: https://www.itwbooking.bjquwhcm.com

POST
H/1.1 200
OK bid Show response
ap.lijit.com/rtb/ 25 B
489 B 20ms
19ms XHR
application/json 72.251.249.14
Internap Corporation

General

Check archive.org

Show headers Download Go to

Full URL: https://ap.lijit.com/rtb/bid?src=prebid_prebid_2.32.0
Requested by: Host: ads.adthrive.com
URL: https://ads.adthrive.com/core/gdpr/vendor/prebid/prebid.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 72.251.249.14 Amsterdam, Netherlands, ASN29791 (VOXEL-DOT-NET - Internap Corporation, US),
Reverse DNS
Software: nginx /
Resource Hash: fda1a8137725b0aef1dd2012400760015b4b0d5e1376dd0ee45738b311e8f95f

Request headers

Sec-Fetch-Mode: cors
Referer: https://www.itwbooking.bjquwhcm.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: text/plain

Response headers

Date: Thu, 17 Oct 2019 11:17:13 GMT
Content-Encoding: gzip
Server: nginx
Transfer-Encoding: chunked
Vary: Accept-Encoding
Access-Control-Allow-Methods: GET, POST, DELETE, PUT
Content-Type: application/json
Access-Control-Allow-Origin: https://www.itwbooking.bjquwhcm.com
Access-Control-Allow-Credentials: true
X-Sovrn-Pod: ap1ams1
Access-Control-Allow-Headers: X-Requested-With, Content-Type

POST
H2 200 collect Show response
www.google-analytics.com/j/ 2 B
97 B 18ms
17ms XHR
text/plain 2a00:1450:4001:80b::200e
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j71&a=580493411&t=pageview&_s=1&dl=https%3A%2F%2Fwww.itwbooking.bjquwhcm.com%2F&ul=en-us&de=UTF-8&dt=Hither%20%26%20Thither&sd=24-bit&sr=1600x1200&vp=1585x1200&je=0&_u=IEBAAMABAAAAAC~&jid=261349882&gjid=1928546239&cid=1294322800.1571311033&tid=UA-12720189-1&_gid=1578907386.1571311033&_r=1&z=846261710

Requested by

Host: www.itwbooking.bjquwhcm.com
URL: https://www.itwbooking.bjquwhcm.com/www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80b::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

de3246094525b21a870fc7d2a67490d0132535c6fa5993755c549f1a9d1bd8af

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Sec-Fetch-Mode: cors
Referer: https://www.itwbooking.bjquwhcm.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Thu, 17 Oct 2019 11:17:13 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
status: 200
content-type: text/plain
access-control-allow-origin: https://www.itwbooking.bjquwhcm.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 2
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 200 collect Show response
stats.g.doubleclick.net/j/ 1 B
98 B 15ms
15ms XHR
text/plain 2a00:1450:400c:c04::9d
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j71&tid=UA-12720189-1&cid=1294322800.1571311033&jid=261349882&gjid=1928546239&_gid=1578907386.1571311033&_u=IEBAAMAAAAAAAC~&z=210518756

Requested by

Host: www.itwbooking.bjquwhcm.com
URL: https://www.itwbooking.bjquwhcm.com/www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400c:c04::9d Brussels, Belgium, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Sec-Fetch-Mode: cors
Referer: https://www.itwbooking.bjquwhcm.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
strict-transport-security: max-age=10886400; includeSubDomains; preload
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
date: Thu, 17 Oct 2019 11:17:13 GMT
status: 200
content-type: text/plain
access-control-allow-origin: https://www.itwbooking.bjquwhcm.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 1
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 404 2F2E86_0_0.ttf
www.itwbooking.bjquwhcm.com/etdlwwyzs7ibptm965zo1lyq-wpengine.netdna-ssl.com/wp-content/themes/hitherandthither/assets/fonts/ 0
0 113ms
113ms Font
text/html 50.31.134.90
Server Central Ne...

General

Check archive.org

Show headers Download Go to

Full URL: https://www.itwbooking.bjquwhcm.com/etdlwwyzs7ibptm965zo1lyq-wpengine.netdna-ssl.com/wp-content/themes/hitherandthither/assets/fonts/2F2E86_0_0.ttf
Requested by: Host: www.itwbooking.bjquwhcm.com
URL: https://www.itwbooking.bjquwhcm.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 50.31.134.90 Chicago, United States, ASN23352 (SERVERCENTRAL - Server Central Network, US),
Reverse DNS: mocha3026-web1.mochahost.com
Software: nginx /
Resource Hash

Request headers

Sec-Fetch-Mode: cors
Referer: https://www.itwbooking.bjquwhcm.com/etdlwwyzs7ibptm965zo1lyq-wpengine.netdna-ssl.com/wp-content/themes/hitherandthither/style.css
Origin: https://www.itwbooking.bjquwhcm.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

status: 404
date: Thu, 17 Oct 2019 11:17:13 GMT
content-encoding: gzip
server: nginx
vary: Accept-Encoding
content-type: text/html

POST
H/1.1 200
OK auction Show response
prebid.adnxs.com/pbs/v1/openrtb2/ 126 B
484 B 113ms
113ms XHR
application/json 37.252.161.184
AppNexus

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid.adnxs.com/pbs/v1/openrtb2/auction
Requested by: Host: ads.adthrive.com
URL: https://ads.adthrive.com/core/gdpr/vendor/prebid/prebid.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 37.252.161.184 , Ascension Island, ASN29990 (ASN-APPNEXUS - AppNexus, Inc, US),
Reverse DNS: prebid.ams1.adnexus.net
Software: nginx/1.13.10 /
Resource Hash: 82740f4599ff169ca34dc08425e0e14b2880a1f41a200926d183c1dd137d3616

Request headers

Sec-Fetch-Mode: cors
Referer: https://www.itwbooking.bjquwhcm.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Thu, 17 Oct 2019 11:17:15 GMT
Server: nginx/1.13.10
Vary: Origin
Content-Type: application/json
Access-Control-Allow-Origin: https://www.itwbooking.bjquwhcm.com
Cache-Control: no-cache, no-store, must-revalidate
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 126
Expires: 0

POST
H2 204 cdb Show response
bidder.criteo.com/ 0
157 B 14ms
14ms XHR
text/plain 178.250.2.152
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL: https://bidder.criteo.com/cdb?profileId=207&av=20&wv=2.32.0&cb=6137768619
Requested by: Host: ads.adthrive.com
URL: https://ads.adthrive.com/core/gdpr/vendor/prebid/prebid.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 178.250.2.152 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),
Reverse DNS
Software: Finatra /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Sec-Fetch-Mode: cors
Referer: https://www.itwbooking.bjquwhcm.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: text/plain

Response headers

status: 204
date: Thu, 17 Oct 2019 11:17:13 GMT
access-control-allow-credentials: true
server: Finatra
access-control-allow-origin: https://www.itwbooking.bjquwhcm.com
timing-allow-origin: *
vary: Origin

GET
H/1.1 200
OK fastlane.json Show response
fastlane.rubiconproject.com/a/api/ 266 B
1 KB 107ms
107ms XHR
application/json 69.173.144.141
The Rubicon Project

General

Check archive.org

Show headers Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=9262&site_id=180726&zone_id=881416&size_id=2&alt_size_ids=1%2C43%2C44%2C55%2C117&p_pos=unknown&rf=https%3A%2F%2Fwww.itwbooking.bjquwhcm.com%2F&tk_flint=pbjs_lite_v2.32.0&x_source.tid=ccb23927-d3af-42db-a7ca-8849100899c1&p_screen_res=1600x1200&rp_floor=0.01&rp_secure=1&slots=1&rand=0.7509697081161368
Requested by: Host: ads.adthrive.com
URL: https://ads.adthrive.com/core/gdpr/vendor/prebid/prebid.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_128_GCM
Server: 69.173.144.141 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT - The Rubicon Project, Inc., US),
Reverse DNS
Software: RAS 2.4 /
Resource Hash: 8e6a4dbb9bee14e26fbcd0c262ca561cafa8a528f383c7bb9904744a576747e3

Request headers

Sec-Fetch-Mode: cors
Referer: https://www.itwbooking.bjquwhcm.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Thu, 17 Oct 2019 11:17:13 GMT
Server: RAS 2.4
Vary: Accept-Encoding
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Access-Control-Allow-Origin: https://www.itwbooking.bjquwhcm.com
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Access-Control-Allow-Credentials: true
Connection: Keep-Alive
Content-Type: application/json
Keep-Alive: timeout=5, max=250
Content-Length: 266
Expires: Wed, 17 Sep 1975 21:32:10 GMT

POST
H/1.1 200
OK prebid Show response
ib.adnxs.com/ut/v3/ 146 B
1 KB 88ms
88ms XHR
application/json 185.33.223.216
AppNexus

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/ut/v3/prebid

Requested by

Host: ads.adthrive.com
URL: https://ads.adthrive.com/core/gdpr/vendor/prebid/prebid.min.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.33.223.216 , Netherlands, ASN29990 (ASN-APPNEXUS - AppNexus, Inc, US),

Reverse DNS

312.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net

Software

nginx/1.13.4 /

Resource Hash

4e27d292b3bde8504ee4c4a218bd9f4cac93db055082004fccd9c848bb0e2ad7

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: cors
Referer: https://www.itwbooking.bjquwhcm.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Thu, 17 Oct 2019 11:17:15 GMT
X-Proxy-Origin: 144.76.109.30; 144.76.109.30; 312.bm-nginx-loadbalancer.mgmt.ams1; *.adnxs.com; 185.33.220.46:80
AN-X-Request-Uuid: e2cc5736-164b-4f0f-b621-b4171eeb38f2
Server: nginx/1.13.4
P3P: policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: https://www.itwbooking.bjquwhcm.com
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/json; charset=utf-8
Content-Length: 146
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H2 200 auction Show response
tlx.3lift.com/header/ 19 B
565 B 7ms
7ms XHR
application/json 52.58.198.43
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL

https://tlx.3lift.com/header/auction?lib=prebid&v=2.32.0&referrer=https%3A%2F%2Fwww.itwbooking.bjquwhcm.com%2F&tmax=2400

Requested by

Host: ads.adthrive.com
URL: https://ads.adthrive.com/core/gdpr/vendor/prebid/prebid.min.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.58.198.43 Frankfurt am Main, Germany, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),

Reverse DNS

ec2-52-58-198-43.eu-central-1.compute.amazonaws.com

Software

Resource Hash

0535c3bb3a17e4ac0fb7d29214d2181275662129dc2bdd2a89c35934e9fc5ba5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: cors
Referer: https://www.itwbooking.bjquwhcm.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Thu, 17 Oct 2019 11:17:13 GMT
x-auction-status: 3
status: 200
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
access-control-allow-origin: https://www.itwbooking.bjquwhcm.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
content-type: application/json; charset=utf-8
content-length: 19
x-xss-protection: 0
expires: Thu, 15 Oct 1992 20:10:00 GMT

GET
H2 200 arj Show response
cafemedia-d.openx.net/w/1.0/ 172 B
356 B 27ms
27ms XHR
application/json 34.95.120.147
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL: https://cafemedia-d.openx.net/w/1.0/arj?ju=https%3A%2F%2Fwww.itwbooking.bjquwhcm.com%2F&jr=&ch=UTF-8&res=1600x1200x24&ifr=false&tz=-120&tws=1600x1200&be=1&bc=hb_pb_2.1.7&dddid=ccb23927-d3af-42db-a7ca-8849100899c1&nocache=1571311033336&aus=728x90%2C320x50%2C970x90%2C300x50%2C320x100%2C468x60%2C1x1&divIds=AdThrive_Footer_1_desktop&auid=538699840&tps=aGlfYXU9&
Requested by: Host: ads.adthrive.com
URL: https://ads.adthrive.com/core/gdpr/vendor/prebid/prebid.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.95.120.147 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS: 147.120.95.34.bc.googleusercontent.com
Software: OXGW/16.163.0 /
Resource Hash: e190d2c4d1fc1a8236494bb78f998cdb77331d21a649e711a4c5ae1032929085

Request headers

Sec-Fetch-Mode: cors
Referer: https://www.itwbooking.bjquwhcm.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Thu, 17 Oct 2019 11:17:13 GMT
via: 1.1 google
server: OXGW/16.163.0
status: 200
vary: Accept
p3p: CP="CUR ADM OUR NOR STA NID"
access-control-allow-origin: https://www.itwbooking.bjquwhcm.com
cache-control: private, max-age=0, no-cache
access-control-allow-credentials: true
content-type: application/json
alt-svc: clear
content-length: 172
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H/1.1 200
OK trinity.json Show response
apex.go.sonobi.com/ 151 B
1 KB 77ms
76ms XHR
application/json 178.162.133.150
LEASEWEB-NL-AMS-0...

General

Check archive.org

Show headers Download Go to

Full URL

https://apex.go.sonobi.com/trinity.json?key_maker=%7B%22165a8d0d2e4382b1%22%3A%22d27a3a50cff6192a4f81%7C728x90%2C320x50%2C970x90%2C300x50%2C320x100%2C468x60%2C1x1%22%7D&ref=https%3A%2F%2Fwww.itwbooking.bjquwhcm.com%2F&s=615ec83c-075d-4cdb-b65a-9f7519bd11f4&pv=d60d2552-2971-4b84-8675-01f1fb3dd5b2&vp=desktop&lib_name=prebid&lib_v=2.32.0&us=5&ius=1&gdpr=false&

Requested by

Host: ads.adthrive.com
URL: https://ads.adthrive.com/core/gdpr/vendor/prebid/prebid.min.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

178.162.133.150 , Netherlands, ASN60781 (LEASEWEB-NL-AMS-01 Netherlands, NL),

Reverse DNS

ams-1-apex.go.sonobi.com

Software

sonobi-go /

Resource Hash

f7486dda8dd63b1e783fb86771b77297d4cb9aa33b39f73ee3d9b68518d87a75

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: cors
Referer: https://www.itwbooking.bjquwhcm.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Thu, 17 Oct 2019 11:17:13 GMT
Content-Encoding: gzip
Server: sonobi-go
Vary: negotiate,Accept-Encoding
X-Go-Server: apex-ams-1-6-8
P3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Access-Control-Allow-Origin: https://www.itwbooking.bjquwhcm.com
Cache-Control: no-cache, no-store, private
Access-Control-Allow-Credentials: true
Tcn: Choice
Content-Type: application/json
Content-Length: 152
X-Xss-Protection: 0
Expires: Sat, 26 Jul 1997 05:00:00 GMT

POST
H/1.1 200
OK bid Show response
ap.lijit.com/rtb/ 24 B
488 B 44ms
19ms XHR
application/json 72.251.249.14
Internap Corporation

General

Check archive.org

Show headers Download Go to

Full URL: https://ap.lijit.com/rtb/bid?src=prebid_prebid_2.32.0
Requested by: Host: ads.adthrive.com
URL: https://ads.adthrive.com/core/gdpr/vendor/prebid/prebid.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 72.251.249.14 Amsterdam, Netherlands, ASN29791 (VOXEL-DOT-NET - Internap Corporation, US),
Reverse DNS
Software: nginx /
Resource Hash: 0dfc8902fd2900ef5cb13c84bbf526be4952bf715bcf609b4e92270db62e1e65

Request headers

Sec-Fetch-Mode: cors
Referer: https://www.itwbooking.bjquwhcm.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: text/plain

Response headers

Date: Thu, 17 Oct 2019 11:17:13 GMT
Content-Encoding: gzip
Server: nginx
Transfer-Encoding: chunked
Vary: Accept-Encoding
Access-Control-Allow-Methods: GET, POST, DELETE, PUT
Content-Type: application/json
Access-Control-Allow-Origin: https://www.itwbooking.bjquwhcm.com
Access-Control-Allow-Credentials: true
X-Sovrn-Pod: ap1ams1
Access-Control-Allow-Headers: X-Requested-With, Content-Type

POST
H2 204 translator Show response
hbopenbid.pubmatic.com/ 0
69 B 13ms
13ms XHR
text/plain 185.64.189.112
PubMatic

General

Check archive.org

Show headers Download Go to

Full URL: https://hbopenbid.pubmatic.com/translator?source=prebid-client
Requested by: Host: ads.adthrive.com
URL: https://ads.adthrive.com/core/gdpr/vendor/prebid/prebid.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.64.189.112 , United Kingdom, ASN62713 (AS-PUBMATIC - PubMatic, Inc., US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Sec-Fetch-Mode: cors
Referer: https://www.itwbooking.bjquwhcm.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: text/plain

Response headers

status: 204
date: Thu, 17 Oct 2019 11:17:13 GMT
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
access-control-allow-origin: https://www.itwbooking.bjquwhcm.com

GET
H/1.1 200
OK cygnus Show response
as-sec.casalemedia.com/ 2 KB
2 KB 200ms
200ms XHR
application/json 2.18.234.21
Akamai Technologies

General

Check archive.org

Show headers Download Go to

Full URL: https://as-sec.casalemedia.com/cygnus?s=185770&v=7.2&r=%7B%22id%22%3A%221714d48110e49865%22%2C%22imp%22%3A%5B%7B%22id%22%3A%22172a3ea809a9d031%22%2C%22banner%22%3A%7B%22w%22%3A728%2C%22h%22%3A90%2C%22topframe%22%3A1%7D%2C%22ext%22%3A%7B%22siteID%22%3A%22185770%22%2C%22sid%22%3A%2212_1%22%7D%7D%2C%7B%22id%22%3A%2217368634f0d8353c%22%2C%22banner%22%3A%7B%22w%22%3A320%2C%22h%22%3A50%2C%22topframe%22%3A1%7D%2C%22ext%22%3A%7B%22siteID%22%3A%22185770%22%2C%22sid%22%3A%2212_3%22%7D%7D%2C%7B%22id%22%3A%2217410c739b69d27f%22%2C%22banner%22%3A%7B%22w%22%3A970%2C%22h%22%3A90%2C%22topframe%22%3A1%7D%2C%22ext%22%3A%7B%22siteID%22%3A%22185770%22%2C%22sid%22%3A%2212_2%22%7D%7D%5D%2C%22site%22%3A%7B%22page%22%3A%22https%3A%2F%2Fwww.itwbooking.bjquwhcm.com%2F%3F%23PD%3Adesktop%23Topic%3AFamily%20and%20Parenting%23Topic%3AHome%20Decor%20and%20Design%23Topic%3AFood%23Topic%3ATravel%23Topic%3AWomens%20Style%23Topic%3Aholmm1%23Topic%3Ahlwn1%23Topic%3Abkf1%23MCMP%3A%22%7D%2C%22ext%22%3A%7B%22source%22%3A%22prebid%22%7D%2C%22regs%22%3A%7B%22ext%22%3A%7B%22gdpr%22%3A0%7D%7D%2C%22user%22%3A%7B%22ext%22%3A%7B%22consent%22%3A%22%22%7D%7D%7D&ac=j&sd=1&
Requested by: Host: ads.adthrive.com
URL: https://ads.adthrive.com/core/gdpr/vendor/prebid/prebid.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.18.234.21 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS: a2-18-234-21.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: 5ff44f04f8f5c9162a0f3b94cdab16c1209b1a27da8c4f9807e7b8654a9b505c

Request headers

Sec-Fetch-Mode: cors
Referer: https://www.itwbooking.bjquwhcm.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Thu, 17 Oct 2019 11:17:13 GMT
Content-Encoding: gzip
Server: Apache
Vary: Accept-Encoding
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Access-Control-Allow-Origin: https://www.itwbooking.bjquwhcm.com
Cache-Control: max-age=0, no-cache, no-store
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/json
Content-Length: 1106
Expires: Thu, 17 Oct 2019 11:17:13 GMT

GET
H2 200 imp Show response
g2.gumgum.com/hbid/ 942 B
1 KB 98ms
41ms XHR
application/json 52.51.196.221
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://g2.gumgum.com/hbid/imp?t=g95nznmj&pi=2&gdprApplies=0&vw=1600&vh=1200&sw=1600&sh=1200&pu=https%3A%2F%2Fwww.itwbooking.bjquwhcm.com%2F&ce=true&dpr=1&jcsi=%7B%22t%22%3A0%2C%22rq%22%3A8%7D&ogu=https%3A%2F%2Fhitherandthither.net%2F&ns=10240&
Requested by: Host: ads.adthrive.com
URL: https://ads.adthrive.com/core/gdpr/vendor/prebid/prebid.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.51.196.221 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: ec2-52-51-196-221.eu-west-1.compute.amazonaws.com
Software: nginx /
Resource Hash: a448712fe848f122c6456889704b10a01b47227a2a14e1902a630c13869ea289

Request headers

Sec-Fetch-Mode: cors
Referer: https://www.itwbooking.bjquwhcm.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Thu, 17 Oct 2019 11:17:13 GMT
content-encoding: gzip
content-type: application/json;charset=UTF-8
server: nginx
status: 200
p3p: CP="This is not a P3P policy"
access-control-allow-origin: https://www.itwbooking.bjquwhcm.com
cache-control: private, no-store, must-revalidate, max-age=0
access-control-allow-credentials: true
timing-allow-origin: *
expires: 0

POST
H/1.1 200
OK prebid Show response
ib.adnxs.com/ut/v3/ 145 B
1 KB 45ms
45ms XHR
application/json 185.33.223.216
AppNexus

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/ut/v3/prebid

Requested by

Host: ads.adthrive.com
URL: https://ads.adthrive.com/core/gdpr/vendor/prebid/prebid.min.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.33.223.216 , Netherlands, ASN29990 (ASN-APPNEXUS - AppNexus, Inc, US),

Reverse DNS

312.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net

Software

nginx/1.13.4 /

Resource Hash

72a11f11b9bad38740a435fa16b8c9d589ef4006162eb368cbd1fb9531e267ea

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: cors
Referer: https://www.itwbooking.bjquwhcm.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Thu, 17 Oct 2019 11:17:15 GMT
X-Proxy-Origin: 144.76.109.30; 144.76.109.30; 312.bm-nginx-loadbalancer.mgmt.ams1; *.adnxs.com; 185.33.220.101:80
AN-X-Request-Uuid: cb9f5780-dd9e-4d1e-92e3-54c95585cc07
Server: nginx/1.13.4
P3P: policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: https://www.itwbooking.bjquwhcm.com
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/json; charset=utf-8
Content-Length: 145
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H2 200 bid-request Show response
a.teads.tv/hb/ 16 B
257 B 77ms
77ms XHR
application/json 2.18.232.7
Akamai Technologies

General

Check archive.org

Show headers Download Go to

Full URL: https://a.teads.tv/hb/bid-request
Requested by: Host: ads.adthrive.com
URL: https://ads.adthrive.com/core/gdpr/vendor/prebid/prebid.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.18.232.7 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS: a2-18-232-7.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 6a7b0c8bf87b2bd5ca31557f25cf2a6c80f93af72bf68a6085e9b55a87fe908c

Request headers

Sec-Fetch-Mode: cors
Referer: https://www.itwbooking.bjquwhcm.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Thu, 17 Oct 2019 11:17:13 GMT
content-encoding: gzip
status: 200
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: https://www.itwbooking.bjquwhcm.com
cache-control: max-age=0, no-cache, no-store
access-control-allow-credentials: true
content-length: 42
expires: Thu, 17 Oct 2019 11:17:13 GMT

POST
H2 204 v1 Show response
dmx.districtm.io/b/ 0
38 B 115ms
114ms XHR
text/plain 104.16.190.66
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL

https://dmx.districtm.io/b/v1

Requested by

Host: ads.adthrive.com
URL: https://ads.adthrive.com/core/gdpr/vendor/prebid/prebid.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.190.66 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

Sec-Fetch-Mode: cors
Referer: https://www.itwbooking.bjquwhcm.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: application/json

Response headers

date: Thu, 17 Oct 2019 11:17:13 GMT
cf-cache-status: DYNAMIC
server: cloudflare
status: 204
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: origin
access-control-allow-methods: OPTIONS, POST
access-control-allow-origin: https://www.itwbooking.bjquwhcm.com
access-control-allow-credentials: true
strict-transport-security: max-age=31536000; includeSubDomains; preload
cf-ray: 5271dd6719f7d6bd-FRA
access-control-allow-headers: origin, content-type

GET
H2

200

/
p.skimresources.com/ Frame 6BBD
Redirect Chain

https://x.skimresources.com/?provider=exelate
https://loadeu.exelator.com/load/?p=787&g=001&j=0&
https://x.skimresources.com/?provider=exelate&skim_mapping=true&provider_id=bb4d2d0cb739fd2597b72ebf60af4cea
https://p.skimresources.com/?provider_id=bb4d2d0cb739fd2597b72ebf60af4cea&skim_mapping=true

43 B
188 B

39ms
39ms

Image
image/gif

151.139.128.10
Highwinds Network...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://p.skimresources.com/?provider_id=bb4d2d0cb739fd2597b72ebf60af4cea&skim_mapping=true
Requested by: Host: www.itwbooking.bjquwhcm.com
URL: https://www.itwbooking.bjquwhcm.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.139.128.10 Dallas, United States, ASN20446 (HIGHWINDS3 - Highwinds Network Group, Inc., US),
Reverse DNS
Software: UploadServer /
Resource Hash: dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-goog-hash: crc32c=xra6Ow==, md5=+DeqYLb+g0WPeQ22DVKfyQ==
date: Thu, 17 Oct 2019 11:17:13 GMT
age: 1
x-guploader-uploadid: AEnB2Ur4oMVRQIqoC-qA52QNe6wePEJ0WV8Vgs5iTNHVQgMbygAqQb5tET3MQpbuA-sA9HUC4ZnAzZ6yglSKHvMe-ZFJsY-hWw
x-goog-storage-class: MULTI_REGIONAL
status: 200
x-goog-metageneration: 4
x-goog-stored-content-encoding: identity
content-length: 43
last-modified: Tue, 23 Oct 2018 13:19:28 GMT
server: UploadServer
etag: "f837aa60b6fe83458f790db60d529fc9"
x-hw: 1571311033.cds145.fr8.hn,1571311033.cds135.fr8.sc,1571311033.cds135.fr8.pr
x-goog-generation: 1540300768038458
cache-control: public, max-age=7200
x-goog-stored-content-length: 43
accept-ranges: bytes
content-type: image/gif

Redirect headers

Location: https://p.skimresources.com?provider_id=bb4d2d0cb739fd2597b72ebf60af4cea&skim_mapping=true
Date: Thu, 17 Oct 2019 11:17:13 GMT
Server: TornadoServer/2.4.1
Connection: keep-alive
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Content-Length: 0
Content-Type: text/html; charset=UTF-8

GET
H2 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 17 KB
5 KB 98ms
97ms XHR
text/plain 172.217.16.162
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=1614664204568859&correlator=3029527796768222&output=ldjh&impl=fifs&adsid=NT&eid=21064780%2C21062415%2C21064679&vrg=2019100301&npa=1&guci=1.2.0.0.2.1.0.0&plat=1%3A536903688%2C2%3A553680904%2C8%3A134250504&sc=1&sfv=1-0-35&ecs=20191017&iu_parts=18190176%2CAdThrive_Header_1%2C58262713bbb11e24413c230b&enc_prev_ius=%2F0%2F1%2F2&prev_iu_szs=320x50%7C728x90%7C320x50%7C970x250%7C970x90%7C300x50%7C320x100%7C468x60%7C1x1%7C728x250&fluid=height&fsbs=1&prev_scp=location%3DHeader%26sequence%3D1%26id%3DAdThrive_Header_1_desktop%26xfloor%3D0.3%26refresh%3D00&eri=5&cust_params=siteId%3D58262713bbb11e24413c230b%26siteName%3DHither%2520and%2520Thither%26verticals%3DFamily%2520and%2520Parenting%252CHome%2520Decor%2520and%2520Design%252CFood%252CTravel%252CWomens%2520Style%26deal%3D%26abgroup%3Dhbho%253Aoff%252Cdynflr%253Abuyrules%252Cloglevel%253Aoff%252Cpbs2s_appnexus%253Aoff%252Cpbs2s_districtm%253Aoff%252Cpbs2s_sovrn%253Aoff%252Cpbs2s_openx%253Aoff%252Cpbs2s_pubmatic%253Aoff%252Cpbs2s_rubicon%253Aoff%252Croxot%253Aoff%252Cto_initial%253A2400%252Cidmod%253Aon%252Cemx%253Aoff%252Csbi%253Aon%252Cdecref%253Aon%26bucket%3Dgdpr%26topics%3Dholmm1%252Chlwn1%252Cbkf1%26site_code%3D%26marmalade%3Dfalse%26domain%3Dwww.itwbooking.bjquwhcm.com%26hi_au%3Danimatedfooter%252Cexpandablefooter%252Cinterscroller%252Cminiscroller%252Cnativemobilecontent%252Cnativedesktopcontent%252Cnativedesktopsidebar%252Cnativedesktoprecipe%252Cnativemobilerecipe%252Coutstreamdesktop%252Coutstreammobile%26vpwxvph%3D1600x1200%26ri%3D22%26pvk%3D01DQCPZ6M0K09FTMWQHGZ2P4F2%26sess%3D01DQCPZ6M1D8VMPRZVM0GWPSHY%26branch%3DAC-1299-Fix-Connatix-Prebid-Compatibility-GDPR%25234284ef7%26niet%3D4g%26utm_medium%3D(not%2520set)%26utm_campaign%3D(not%2520set)%26utm_session%3D(not%2520set)%26utm_source%3D(not%2520set)&cookie_enabled=1&cdm=www.itwbooking.bjquwhcm.com&bc=31&abxe=1&lmt=1563407865&dt=1571311033386&dlt=1571311031575&idt=757&frm=20&biw=1585&bih=1200&oid=3&adxs=243&adys=733&adks=2878570791&ucis=1&ifi=1&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Fwww.itwbooking.bjquwhcm.com%2Findex.html&loc=https%3A%2F%2Fwww.itwbooking.bjquwhcm.com%2F&dssz=48&icsg=1120126401052671&std=0&vis=1&dmc=8&scr_x=0&scr_y=0&psz=1100x5383&msz=1100x90&ga_vid=1294322800.1571311033&ga_sid=1571311033&ga_hid=580493411&fws=0&ohw=0

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2019100301.js?21064780

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.16.162 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

fra15s11-in-f2.1e100.net

Software

cafe /

Resource Hash

25a121474d3c82e8b9e8e2006f6337217dec7a551247351ca0e76ea754bffa1d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: cors
Referer: https://www.itwbooking.bjquwhcm.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 17 Oct 2019 11:17:13 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status: 200
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 4988
x-xss-protection: 0
google-lineitem-id: 5139771563
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: 138248453528
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://www.itwbooking.bjquwhcm.com
access-control-expose-headers: x-google-amp-ad-validated-version
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 pubads_impl_rendering_2019100301.js Show response
securepubads.g.doubleclick.net/gpt/ 63 KB
24 KB 39ms
39ms Script
text/javascript 172.217.16.162
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gpt/pubads_impl_rendering_2019100301.js?21064780

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2019100301.js?21064780

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.16.162 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

fra15s11-in-f2.1e100.net

Software

sffe /

Resource Hash

33e7cfb629c6fc28bec6f0039c2b843ac7d63cb54a883599ca33ce2384e251fa

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.itwbooking.bjquwhcm.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 17 Oct 2019 11:17:13 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Thu, 03 Oct 2019 13:06:21 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, immutable, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 24653
x-xss-protection: 0
expires: Thu, 17 Oct 2019 11:17:13 GMT

GET
H2 200 container.html
tpc.googlesyndication.com/safeframe/1-0-35/html/ 0
0 20ms
7ms Other
text/html 2a00:1450:4001:81f::2001
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL: https://tpc.googlesyndication.com/safeframe/1-0-35/html/container.html
Requested by: Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2019100301.js?21064780
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:4001:81f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software: /
Resource Hash

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.itwbooking.bjquwhcm.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

GET
H2 200 amp4ads-host-v0.js Show response
cdn.ampproject.org/rtv/011909241711100/ 20 KB
7 KB 44ms
13ms Script
text/javascript 2a00:1450:4001:821::2001
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/011909241711100/amp4ads-host-v0.js

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2019100301.js?21064780

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:821::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

sffe /

Resource Hash

37a8b06eab08134f2037c797f4596c7688dd564a8395cb7e072577f371d8f993

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp-collector.appspot.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.itwbooking.bjquwhcm.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp-collector.appspot.com/csp/amp
content-encoding: br
etag: "beb093e69c81d951"
age: 494703
status: 200
strict-transport-security: max-age=31536000; includeSubDomains; preload
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 7119
x-xss-protection: 0
server: sffe
date: Fri, 11 Oct 2019 17:52:10 GMT
vary: Accept-Encoding
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
x-content-type-options: nosniff
expires: Sat, 10 Oct 2020 17:52:10 GMT

GET
H2 200 amp4ads-v0.js Show response
cdn.ampproject.org/rtv/011909241711100/ Frame 096A 252 KB
69 KB 43ms
13ms Script
text/javascript 2a00:1450:4001:821::2001
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/011909241711100/amp4ads-v0.js

Requested by

Host: clarium.global.ssl.fastly.net
URL: https://clarium.global.ssl.fastly.net/gpt/a/wrap.js?v2_1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:821::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

sffe /

Resource Hash

6d157866400e2e50e077448f9cf06a9f29f70e031612ad6679d3626909a4c4e5

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp-collector.appspot.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.itwbooking.bjquwhcm.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp-collector.appspot.com/csp/amp
content-encoding: br
etag: "96c1a383c63a0e85"
age: 12361
status: 200
strict-transport-security: max-age=31536000; includeSubDomains; preload
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 70044
x-xss-protection: 0
server: sffe
date: Thu, 17 Oct 2019 07:51:12 GMT
vary: Accept-Encoding
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
x-content-type-options: nosniff
expires: Fri, 16 Oct 2020 07:51:12 GMT

GET
H2 200 amp-analytics-0.1.js Show response
cdn.ampproject.org/rtv/011909241711100/v0/ Frame 096A 150 KB
41 KB 36ms
6ms Script
text/javascript 2a00:1450:4001:821::2001
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/011909241711100/v0/amp-analytics-0.1.js

Requested by

Host: clarium.global.ssl.fastly.net
URL: https://clarium.global.ssl.fastly.net/gpt/a/wrap.js?v2_1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:821::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

sffe /

Resource Hash

197c294e1520b32d787d2678660c02fd195c1c93fee3441de596ef22c34ed425

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp-collector.appspot.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.itwbooking.bjquwhcm.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp-collector.appspot.com/csp/amp
content-encoding: br
etag: "31e12d286572e15e"
age: 742992
status: 200
strict-transport-security: max-age=31536000; includeSubDomains; preload
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 40838
x-xss-protection: 0
server: sffe
date: Tue, 08 Oct 2019 20:54:01 GMT
vary: Accept-Encoding
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
x-content-type-options: nosniff
expires: Wed, 07 Oct 2020 20:54:01 GMT

GET
DATA 200
OK truncated
/ Frame 096A 214 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: e1967f20ba2287aeb795371e9df4c23fcd7db88086b68181f688d27158ef56b0

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 15842465133016810807
tpc.googlesyndication.com/simgad/ Frame 096A 43 B
209 B 6ms
6ms Image
image/gif 2a00:1450:4001:81f::2001
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/15842465133016810807

Requested by

Host: www.itwbooking.bjquwhcm.com
URL: https://www.itwbooking.bjquwhcm.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

sffe /

Resource Hash

4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.itwbooking.bjquwhcm.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 11 Oct 2019 03:45:20 GMT
x-content-type-options: nosniff
age: 545513
x-dns-prefetch-control: off
status: 200
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 43
x-xss-protection: 0
last-modified: Wed, 30 May 2018 18:01:52 GMT
server: sffe
content-type: image/gif
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 10 Oct 2020 03:45:20 GMT

GET
H2 200 view
securepubads.g.doubleclick.net/pcs/ Frame 096A 0
75 B 19ms
19ms Image
image/gif 172.217.16.162
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjstubyZ3c4tjPnQaAQgwb2m82O-Eywz2L_E8X_SCMEcNEsiaYcDdXeyOMbEAcBavI7QLUA6TvOFa7tXQ0__htimBf73TtEAwZ_ECg7Dbjb4IFEf6XcCIKdFswWWeO1KAMqK32FlSuwvjhjua7pyWJIeISTplXa2gPE_vZayskwmt6ZnNU92i1KCuRvRphHpKu9LRfXtANlngP4mYmxYusmp3lJxH34KBqwa183RSmieJks_FeOgTZLkRcGm0nT8Q9r7HZjTn-3gjiq8_wZHvWxarrYNYSxrjhUjCDqURk_Y2YOObPqEACgw_FRWnHf-SVQ&sai=AMfl-YSoqpDi_YVMzUTK2LE5lkACK-aSIJo8HDbkjBKJxdzadl5oRnSWkQk7ENjSWzUCq9vtRzSn2x3Fl1YPRL8eqSmMqOzYRbccDVnayqdS&sig=Cg0ArKJSzBFc4r9LzjOlEAE&adurl=

Requested by

Host: www.itwbooking.bjquwhcm.com
URL: https://www.itwbooking.bjquwhcm.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.16.162 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

fra15s11-in-f2.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.itwbooking.bjquwhcm.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

timing-allow-origin: *
date: Thu, 17 Oct 2019 11:17:13 GMT
x-content-type-options: nosniff
server: cafe
status: 200
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
content-type: image/gif
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H2 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 15 KB
5 KB 104ms
104ms XHR
text/plain 172.217.16.162
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=1614664204568859&correlator=86408207688382&output=ldjh&impl=fifs&adsid=NT&eid=21064780%2C21062415%2C21064679&vrg=2019100301&npa=1&guci=1.2.0.0.2.1.0.0&plat=1%3A536903688%2C2%3A553680904%2C8%3A134250504&sc=1&sfv=1-0-35&ecs=20191017&iu_parts=18190176%2CAdThrive_Sidebar_9%2C58262713bbb11e24413c230b&enc_prev_ius=%2F0%2F1%2F2&prev_iu_szs=320x50%7C300x250%7C300x600%7C320x50%7C160x600%7C300x1050%7C300x50%7C320x100%7C250x250%7C120x240%7C1x1%7C300x420&fluid=height&fsbs=1&prev_scp=location%3DSidebar%26sequence%3D9%26id%3DAdThrive_Sidebar_9_desktop%26sticky%3Dtrue%26xfloor%3D0.3%26refresh%3D00&eri=5&cust_params=siteId%3D58262713bbb11e24413c230b%26siteName%3DHither%2520and%2520Thither%26verticals%3DFamily%2520and%2520Parenting%252CHome%2520Decor%2520and%2520Design%252CFood%252CTravel%252CWomens%2520Style%26deal%3D%26abgroup%3Dhbho%253Aoff%252Cdynflr%253Abuyrules%252Cloglevel%253Aoff%252Cpbs2s_appnexus%253Aoff%252Cpbs2s_districtm%253Aoff%252Cpbs2s_sovrn%253Aoff%252Cpbs2s_openx%253Aoff%252Cpbs2s_pubmatic%253Aoff%252Cpbs2s_rubicon%253Aoff%252Croxot%253Aoff%252Cto_initial%253A2400%252Cidmod%253Aon%252Cemx%253Aoff%252Csbi%253Aon%252Cdecref%253Aon%26bucket%3Dgdpr%26topics%3Dholmm1%252Chlwn1%252Cbkf1%26site_code%3D%26marmalade%3Dfalse%26domain%3Dwww.itwbooking.bjquwhcm.com%26hi_au%3Danimatedfooter%252Cexpandablefooter%252Cinterscroller%252Cminiscroller%252Cnativemobilecontent%252Cnativedesktopcontent%252Cnativedesktopsidebar%252Cnativedesktoprecipe%252Cnativemobilerecipe%252Coutstreamdesktop%252Coutstreammobile%26vpwxvph%3D1600x1200%26ri%3D22%26pvk%3D01DQCPZ6M0K09FTMWQHGZ2P4F2%26sess%3D01DQCPZ6M1D8VMPRZVM0GWPSHY%26branch%3DAC-1299-Fix-Connatix-Prebid-Compatibility-GDPR%25234284ef7%26niet%3D4g%26utm_medium%3D(not%2520set)%26utm_campaign%3D(not%2520set)%26utm_session%3D(not%2520set)%26utm_source%3D(not%2520set)&cookie=ID%3D5ebd80c6a481e763%3AT%3D1571311033%3AS%3DALNI_MaiUVIJWfJdQ5T49UvHnttDPvqS6A&cookie_enabled=1&cdm=www.itwbooking.bjquwhcm.com&bc=31&abxe=1&lmt=1563407865&dt=1571311033526&dlt=1571311031575&idt=757&frm=20&biw=1585&bih=1200&oid=3&adxs=1043&adys=2970&adks=3977059557&ucis=2&ifi=2&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Fwww.itwbooking.bjquwhcm.com%2Findex.html&loc=https%3A%2F%2Fwww.itwbooking.bjquwhcm.com%2F&dssz=50&icsg=1120126401052671&std=0&vis=1&dmc=8&scr_x=0&scr_y=0&psz=300x2525&msz=300x250&psts=CjQIq-HqkhNCBcfejLIBeAHoAZj7_4GDBIICEKCamQiYm5kI6IPID_CU6B3RAnpLVwyC7MoE&ga_vid=1294322800.1571311033&ga_sid=1571311033&ga_hid=580493411&fws=4&ohw=300

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2019100301.js?21064780

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.16.162 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

fra15s11-in-f2.1e100.net

Software

cafe /

Resource Hash

da9762ba55689a76aef7a7131f77c75ba0e98f7b94425d3de64f1acfaca4cd25

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: cors
Referer: https://www.itwbooking.bjquwhcm.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 17 Oct 2019 11:17:13 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status: 200
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 4421
x-xss-protection: 0
google-lineitem-id: 5139771563
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: 138248453531
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://www.itwbooking.bjquwhcm.com
access-control-expose-headers: x-google-amp-ad-validated-version
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 15 KB
5 KB 134ms
134ms XHR
text/plain 172.217.16.162
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=1614664204568859&correlator=3224482874542208&output=ldjh&impl=fifs&adsid=NT&eid=21064780%2C21062415%2C21064679&vrg=2019100301&npa=1&guci=1.2.0.0.2.1.0.0&plat=1%3A536903688%2C2%3A553680904%2C8%3A134250504&sc=1&sfv=1-0-35&ecs=20191017&iu_parts=18190176%2CAdThrive_Sidebar_1%2C58262713bbb11e24413c230b&enc_prev_ius=%2F0%2F1%2F2&prev_iu_szs=320x50%7C300x250%7C300x600%7C320x50%7C160x600%7C300x1050%7C300x50%7C320x100%7C250x250%7C120x240%7C1x1%7C300x420&fluid=height&fsbs=1&prev_scp=location%3DSidebar%26sequence%3D1%26id%3DAdThrive_Sidebar_1_desktop%26ATF%3Dtrue%26xfloor%3D0.3%26refresh%3D00&eri=5&cust_params=siteId%3D58262713bbb11e24413c230b%26siteName%3DHither%2520and%2520Thither%26verticals%3DFamily%2520and%2520Parenting%252CHome%2520Decor%2520and%2520Design%252CFood%252CTravel%252CWomens%2520Style%26deal%3D%26abgroup%3Dhbho%253Aoff%252Cdynflr%253Abuyrules%252Cloglevel%253Aoff%252Cpbs2s_appnexus%253Aoff%252Cpbs2s_districtm%253Aoff%252Cpbs2s_sovrn%253Aoff%252Cpbs2s_openx%253Aoff%252Cpbs2s_pubmatic%253Aoff%252Cpbs2s_rubicon%253Aoff%252Croxot%253Aoff%252Cto_initial%253A2400%252Cidmod%253Aon%252Cemx%253Aoff%252Csbi%253Aon%252Cdecref%253Aon%26bucket%3Dgdpr%26topics%3Dholmm1%252Chlwn1%252Cbkf1%26site_code%3D%26marmalade%3Dfalse%26domain%3Dwww.itwbooking.bjquwhcm.com%26hi_au%3Danimatedfooter%252Cexpandablefooter%252Cinterscroller%252Cminiscroller%252Cnativemobilecontent%252Cnativedesktopcontent%252Cnativedesktopsidebar%252Cnativedesktoprecipe%252Cnativemobilerecipe%252Coutstreamdesktop%252Coutstreammobile%26vpwxvph%3D1600x1200%26ri%3D22%26pvk%3D01DQCPZ6M0K09FTMWQHGZ2P4F2%26sess%3D01DQCPZ6M1D8VMPRZVM0GWPSHY%26branch%3DAC-1299-Fix-Connatix-Prebid-Compatibility-GDPR%25234284ef7%26niet%3D4g%26utm_medium%3D(not%2520set)%26utm_campaign%3D(not%2520set)%26utm_session%3D(not%2520set)%26utm_source%3D(not%2520set)&cookie=ID%3D5ebd80c6a481e763%3AT%3D1571311033%3AS%3DALNI_MaiUVIJWfJdQ5T49UvHnttDPvqS6A&cookie_enabled=1&cdm=www.itwbooking.bjquwhcm.com&bc=31&abxe=1&lmt=1563407865&dt=1571311033533&dlt=1571311031575&idt=757&frm=20&biw=1585&bih=1200&oid=3&adxs=1043&adys=1830&adks=4070991005&ucis=3&ifi=3&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Fwww.itwbooking.bjquwhcm.com%2Findex.html&loc=https%3A%2F%2Fwww.itwbooking.bjquwhcm.com%2F&dssz=50&icsg=1120126401052671&std=0&vis=1&dmc=8&scr_x=0&scr_y=0&psz=300x2525&msz=300x250&psts=CjQIq-HqkhNCBcfejLIBeAHoAZj7_4GDBIICEKCamQiYm5kI6IPID_CU6B3RAnpLVwyC7MoE&ga_vid=1294322800.1571311033&ga_sid=1571311033&ga_hid=580493411&fws=4&ohw=300

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2019100301.js?21064780

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.16.162 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

fra15s11-in-f2.1e100.net

Software

cafe /

Resource Hash

feb248b7a818478c2b7f6ae21ae78e140201ab3f694733ed8626704aaf7da122

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: cors
Referer: https://www.itwbooking.bjquwhcm.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 17 Oct 2019 11:17:13 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status: 200
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 4425
x-xss-protection: 0
google-lineitem-id: 5139771563
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: 138234767358
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://www.itwbooking.bjquwhcm.com
access-control-expose-headers: x-google-amp-ad-validated-version
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 17 KB
5 KB 119ms
118ms XHR
text/plain 172.217.16.162
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=1614664204568859&correlator=539568815405900&output=ldjh&impl=fifs&adsid=NT&eid=21064780%2C21062415%2C21064679&vrg=2019100301&npa=1&guci=1.2.0.0.2.1.0.0&plat=1%3A536903688%2C2%3A553680904%2C8%3A134250504&sc=1&sfv=1-0-35&ecs=20191017&iu_parts=18190176%2CAdThrive_Content_1%2C58262713bbb11e24413c230b&enc_prev_ius=%2F0%2F1%2F2&prev_iu_szs=320x50%7C300x250%7C320x50%7C336x280%7C300x50%7C320x100%7C468x60%7C250x250%7C120x240%7C1x1%7C300x300%7C552x334&fluid=height&fsbs=1&prev_scp=location%3DContent%26sequence%3D1%26id%3DAdThrive_Content_1_desktop%26ATF%3Dtrue%26xfloor%3D0.3%26refresh%3D00&eri=5&cust_params=siteId%3D58262713bbb11e24413c230b%26siteName%3DHither%2520and%2520Thither%26verticals%3DFamily%2520and%2520Parenting%252CHome%2520Decor%2520and%2520Design%252CFood%252CTravel%252CWomens%2520Style%26deal%3D%26abgroup%3Dhbho%253Aoff%252Cdynflr%253Abuyrules%252Cloglevel%253Aoff%252Cpbs2s_appnexus%253Aoff%252Cpbs2s_districtm%253Aoff%252Cpbs2s_sovrn%253Aoff%252Cpbs2s_openx%253Aoff%252Cpbs2s_pubmatic%253Aoff%252Cpbs2s_rubicon%253Aoff%252Croxot%253Aoff%252Cto_initial%253A2400%252Cidmod%253Aon%252Cemx%253Aoff%252Csbi%253Aon%252Cdecref%253Aon%26bucket%3Dgdpr%26topics%3Dholmm1%252Chlwn1%252Cbkf1%26site_code%3D%26marmalade%3Dfalse%26domain%3Dwww.itwbooking.bjquwhcm.com%26hi_au%3Danimatedfooter%252Cexpandablefooter%252Cinterscroller%252Cminiscroller%252Cnativemobilecontent%252Cnativedesktopcontent%252Cnativedesktopsidebar%252Cnativedesktoprecipe%252Cnativemobilerecipe%252Coutstreamdesktop%252Coutstreammobile%26vpwxvph%3D1600x1200%26ri%3D22%26pvk%3D01DQCPZ6M0K09FTMWQHGZ2P4F2%26sess%3D01DQCPZ6M1D8VMPRZVM0GWPSHY%26branch%3DAC-1299-Fix-Connatix-Prebid-Compatibility-GDPR%25234284ef7%26niet%3D4g%26utm_medium%3D(not%2520set)%26utm_campaign%3D(not%2520set)%26utm_session%3D(not%2520set)%26utm_source%3D(not%2520set)&cookie=ID%3D5ebd80c6a481e763%3AT%3D1571311033%3AS%3DALNI_MaiUVIJWfJdQ5T49UvHnttDPvqS6A&cookie_enabled=1&cdm=www.itwbooking.bjquwhcm.com&bc=31&abxe=1&lmt=1563407865&dt=1571311033541&dlt=1571311031575&idt=757&frm=20&biw=1585&bih=1200&oid=3&adxs=243&adys=3841&adks=2419511935&ucis=4&ifi=4&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Fwww.itwbooking.bjquwhcm.com%2Findex.html&loc=https%3A%2F%2Fwww.itwbooking.bjquwhcm.com%2F&dssz=50&icsg=1120126401052671&std=0&vis=1&dmc=8&scr_x=0&scr_y=0&psz=700x316&msz=700x250&psts=CjQIq-HqkhNCBcfejLIBeAHoAZj7_4GDBIICEKCamQiYm5kI6IPID_CU6B3RAnpLVwyC7MoE&ga_vid=1294322800.1571311033&ga_sid=1571311033&ga_hid=580493411&fws=4&ohw=700

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2019100301.js?21064780

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.16.162 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

fra15s11-in-f2.1e100.net

Software

cafe /

Resource Hash

f2ca0a93810af3237f7530ee5ea7e707edbe0eca8484003dd40a25c32b0b6d4f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: cors
Referer: https://www.itwbooking.bjquwhcm.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 17 Oct 2019 11:17:13 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status: 200
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 4825
x-xss-protection: 0
google-lineitem-id: 5139771563
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: 138248641366
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://www.itwbooking.bjquwhcm.com
access-control-expose-headers: x-google-amp-ad-validated-version
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H/1.1 200
OK / Show response
i.skimresources.com/api/ 6 KB
6 KB 80ms
80ms XHR
application/json 54.76.37.45
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL

https://i.skimresources.com/api/

Requested by

Host: www.itwbooking.bjquwhcm.com
URL: https://www.itwbooking.bjquwhcm.com/s.skimresources.com/js/75155X1525201.skimlinks.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.76.37.45 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),

Reverse DNS

ec2-54-76-37-45.eu-west-1.compute.amazonaws.com

Software

nginx/1.10.2 /

Resource Hash

35e135ac6cfcb9f681cc77bb55f8b7f6a055b82b6568babc372d7c6293e90158

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Sec-Fetch-Mode: cors
Referer: https://www.itwbooking.bjquwhcm.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-type: application/x-www-form-urlencoded

Response headers

Date: Thu, 17 Oct 2019 11:17:13 GMT
X-Content-Type-Options: nosniff
Server: nginx/1.10.2
P3P: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Access-Control-Allow-Origin: https://www.itwbooking.bjquwhcm.com
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/json
Content-Length: 6010

GET
H2 200 ads Show response
securepubads.g.doubleclick.net/gampad/ 4 KB
2 KB 98ms
97ms XHR
text/plain 172.217.16.162
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=1614664204568859&correlator=3813152524226721&output=ldjh&impl=fifs&adsid=NT&eid=21064780%2C21062415%2C21064679&vrg=2019100301&npa=1&guci=1.2.0.0.2.1.0.0&plat=1%3A536903688%2C2%3A553680904%2C8%3A134250504&sc=1&sfv=1-0-35&ecs=20191017&iu_parts=18190176%2CAdThrive_Footer_1%2C58262713bbb11e24413c230b&enc_prev_ius=%2F0%2F1%2F2&prev_iu_szs=320x50%7C728x90%7C320x50%7C970x90%7C300x50%7C320x100%7C468x60%7C1x1&fluid=height&fsbs=1&prev_scp=location%3DFooter%26sequence%3D1%26id%3DAdThrive_Footer_1_desktop%26ATF%3Dtrue%26sticky%3Dtrue%26xfloor%3D0.5%26refresh%3D00%26hb_format%3Dbanner%26hb_size%3D728x90%26hb_pb%3D0.10%26hb_adid%3D1867fa7819633b7b%26hb_bidder%3Dix&eri=5&cust_params=siteId%3D58262713bbb11e24413c230b%26siteName%3DHither%2520and%2520Thither%26verticals%3DFamily%2520and%2520Parenting%252CHome%2520Decor%2520and%2520Design%252CFood%252CTravel%252CWomens%2520Style%26deal%3D%26abgroup%3Dhbho%253Aoff%252Cdynflr%253Abuyrules%252Cloglevel%253Aoff%252Cpbs2s_appnexus%253Aoff%252Cpbs2s_districtm%253Aoff%252Cpbs2s_sovrn%253Aoff%252Cpbs2s_openx%253Aoff%252Cpbs2s_pubmatic%253Aoff%252Cpbs2s_rubicon%253Aoff%252Croxot%253Aoff%252Cto_initial%253A2400%252Cidmod%253Aon%252Cemx%253Aoff%252Csbi%253Aon%252Cdecref%253Aon%26bucket%3Dgdpr%26topics%3Dholmm1%252Chlwn1%252Cbkf1%26site_code%3D%26marmalade%3Dfalse%26domain%3Dwww.itwbooking.bjquwhcm.com%26hi_au%3Danimatedfooter%252Cexpandablefooter%252Cinterscroller%252Cminiscroller%252Cnativemobilecontent%252Cnativedesktopcontent%252Cnativedesktopsidebar%252Cnativedesktoprecipe%252Cnativemobilerecipe%252Coutstreamdesktop%252Coutstreammobile%26vpwxvph%3D1600x1200%26ri%3D22%26pvk%3D01DQCPZ6M0K09FTMWQHGZ2P4F2%26sess%3D01DQCPZ6M1D8VMPRZVM0GWPSHY%26branch%3DAC-1299-Fix-Connatix-Prebid-Compatibility-GDPR%25234284ef7%26niet%3D4g%26utm_medium%3D(not%2520set)%26utm_campaign%3D(not%2520set)%26utm_session%3D(not%2520set)%26utm_source%3D(not%2520set)&cookie=ID%3D5ebd80c6a481e763%3AT%3D1571311033%3AS%3DALNI_MaiUVIJWfJdQ5T49UvHnttDPvqS6A&cookie_enabled=1&cdm=www.itwbooking.bjquwhcm.com&bc=31&abxe=1&lmt=1563407865&dt=1571311033576&dlt=1571311031575&idt=757&frm=20&biw=1585&bih=1200&oid=3&adxs=429&adys=1110&adks=3708889229&ucis=5&ifi=5&u_tz=120&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Fwww.itwbooking.bjquwhcm.com%2Findex.html&loc=https%3A%2F%2Fwww.itwbooking.bjquwhcm.com%2F&dssz=50&icsg=1120126401052671&std=0&vis=1&dmc=8&scr_x=0&scr_y=0&psz=1585x8156&msz=1585x-1&psts=CjQIq-HqkhNCBcfejLIBeAHoAZj7_4GDBIICEKCamQiYm5kI6IPID_CU6B3RAnpLVwyC7MoE&ga_vid=1294322800.1571311033&ga_sid=1571311033&ga_hid=580493411&fws=516&ohw=1585

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2019100301.js?21064780

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.16.162 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

fra15s11-in-f2.1e100.net

Software

cafe /

Resource Hash

440264cff5188aab5845f4fc061232648f3db4c5c19030c8136cdaf63e7db170

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: cors
Referer: https://www.itwbooking.bjquwhcm.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 17 Oct 2019 11:17:13 GMT
content-encoding: br
x-content-type-options: nosniff
google-mediationgroup-id: -2
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status: 200
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 1996
x-xss-protection: 0
google-lineitem-id: 4935403085
pragma: no-cache
server: cafe
google-mediationtag-id: -2
google-creative-id: 138260080545
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://www.itwbooking.bjquwhcm.com
cache-control: no-cache, must-revalidate
access-control-allow-credentials: true
timing-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 amp4ads-v0.js Show response
cdn.ampproject.org/rtv/031910071804120/ Frame C2EA 251 KB
68 KB 6ms
5ms Script
text/javascript 2a00:1450:4001:821::2001
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/031910071804120/amp4ads-v0.js

Requested by

Host: clarium.global.ssl.fastly.net
URL: https://clarium.global.ssl.fastly.net/gpt/a/wrap.js?v2_1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:821::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

sffe /

Resource Hash

0bb863f59549233b7c3b23886d1168914248570ebfbf5eb30cf9461f0883dd03

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp-collector.appspot.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.itwbooking.bjquwhcm.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp-collector.appspot.com/csp/amp
content-encoding: br
etag: "52892db21ddd2422"
age: 499056
status: 200
strict-transport-security: max-age=31536000; includeSubDomains; preload
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 69627
x-xss-protection: 0
server: sffe
date: Fri, 11 Oct 2019 16:39:37 GMT
vary: Accept-Encoding
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
x-content-type-options: nosniff
expires: Sat, 10 Oct 2020 16:39:37 GMT

GET
H2 200 amp-analytics-0.1.js Show response
cdn.ampproject.org/rtv/031910071804120/v0/ Frame C2EA 150 KB
40 KB 8ms
7ms Script
text/javascript 2a00:1450:4001:821::2001
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/031910071804120/v0/amp-analytics-0.1.js

Requested by

Host: clarium.global.ssl.fastly.net
URL: https://clarium.global.ssl.fastly.net/gpt/a/wrap.js?v2_1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:821::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

sffe /

Resource Hash

aa95eb8757140f09d3424399b939ed3f10a20c45c6c52476c614c9bc375eb667

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp-collector.appspot.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.itwbooking.bjquwhcm.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp-collector.appspot.com/csp/amp
content-encoding: br
etag: "8beba9134cdf5c44"
age: 569403
status: 200
strict-transport-security: max-age=31536000; includeSubDomains; preload
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 40847
x-xss-protection: 0
server: sffe
date: Thu, 10 Oct 2019 21:07:10 GMT
vary: Accept-Encoding
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
x-content-type-options: nosniff
expires: Fri, 09 Oct 2020 21:07:10 GMT

GET
H2 200 15842465133016810807
tpc.googlesyndication.com/simgad/ Frame C2EA 43 B
104 B 6ms
6ms Image
image/gif 2a00:1450:4001:81f::2001
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/15842465133016810807

Requested by

Host: clarium.global.ssl.fastly.net
URL: https://clarium.global.ssl.fastly.net/gpt/a/wrap.js?v2_1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

sffe /

Resource Hash

4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.itwbooking.bjquwhcm.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 11 Oct 2019 03:45:20 GMT
x-content-type-options: nosniff
age: 545513
x-dns-prefetch-control: off
status: 200
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 43
x-xss-protection: 0
last-modified: Wed, 30 May 2018 18:01:52 GMT
server: sffe
content-type: image/gif
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 10 Oct 2020 03:45:20 GMT

GET
DATA 200
OK truncated
/ Frame C2EA 212 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: f4fa2972df47cfcc6d36fec94e11c40112e92e43fcd09a8828c3740c34d4196d

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 view
securepubads.g.doubleclick.net/pcs/ Frame C2EA 0
48 B 20ms
19ms Image
image/gif 172.217.16.162
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsuCVyuXPY7ceV_QneNGN49cMZeqwrXbieZfGsGHeh20LYznYI1jxVXPt_P-qlBkD6LhUATSNgYFqBEeFbM8S0qkyCkly-XOX0fNetIbRl8IZNurgnW8iBdNrl9b-iuwmH7y1O4qzz8T-qQFO7nAF5LZGajZm3gpUAmGLzscgnOtFC3WmHlZWqEc_Dc5prdtkKsyzbzBTubc35Khx1Fu9PP8spGRZ-lG_1OKv3Fc36HccKU7wQtf2c1Eer2AolufxO__zLNiw0WOoZOsRygCsrKrHd773iqQ8YYcU83I77GSbSdfG_4ZBit_OMApJllAPoo&sig=Cg0ArKJSzNMpct0nlz_HEAE&adurl=

Requested by

Host: www.itwbooking.bjquwhcm.com
URL: https://www.itwbooking.bjquwhcm.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.16.162 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

fra15s11-in-f2.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.itwbooking.bjquwhcm.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

timing-allow-origin: *
date: Thu, 17 Oct 2019 11:17:13 GMT
x-content-type-options: nosniff
server: cafe
status: 200
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
content-type: image/gif
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

POST
H2 200 track.php Show response
t.skimresources.com/api/ 22 B
92 B 25ms
25ms XHR
application/javascript 35.201.67.47
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://t.skimresources.com/api/track.php

Requested by

Host: www.itwbooking.bjquwhcm.com
URL: https://www.itwbooking.bjquwhcm.com/s.skimresources.com/js/75155X1525201.skimlinks.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

35.201.67.47 , Ascension Island, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

47.67.201.35.bc.googleusercontent.com

Software

Python/3.7 aiohttp/3.5.4 /

Resource Hash

fcc83a5b6aef86420c1ad553167106df96bd0ff4192ffe52b1647599948edbcf

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Sec-Fetch-Mode: cors
Referer: https://www.itwbooking.bjquwhcm.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-type: application/x-www-form-urlencoded

Response headers

pragma: no-cache
date: Thu, 17 Oct 2019 11:17:13 GMT
via: 1.1 google
x-content-type-options: nosniff
server: Python/3.7 aiohttp/3.5.4
access-control-allow-headers: Origin, Accept, Content-Type, X-Requested-With, X-CSRF-Token
status: 200
access-control-allow-methods: GET, POST, OPTIONS
content-type: text/plain; charset=utf-8, application/javascript
access-control-allow-origin: https://www.itwbooking.bjquwhcm.com
cache-control: no-store, no-cache, must-revalidate
access-control-allow-credentials: true
warning: 299 - "Deprecated API"
alt-svc: clear
content-length: 22

GET
H2 200 amp4ads-v0.js Show response
cdn.ampproject.org/rtv/011909241711100/ Frame B009 252 KB
69 KB 6ms
5ms Script
text/javascript 2a00:1450:4001:821::2001
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/011909241711100/amp4ads-v0.js

Requested by

Host: clarium.global.ssl.fastly.net
URL: https://clarium.global.ssl.fastly.net/gpt/a/wrap.js?v2_1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:821::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

sffe /

Resource Hash

6d157866400e2e50e077448f9cf06a9f29f70e031612ad6679d3626909a4c4e5

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp-collector.appspot.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.itwbooking.bjquwhcm.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp-collector.appspot.com/csp/amp
content-encoding: br
etag: "96c1a383c63a0e85"
age: 12361
status: 200
strict-transport-security: max-age=31536000; includeSubDomains; preload
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 70044
x-xss-protection: 0
server: sffe
date: Thu, 17 Oct 2019 07:51:12 GMT
vary: Accept-Encoding
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
x-content-type-options: nosniff
expires: Fri, 16 Oct 2020 07:51:12 GMT

GET
H2 200 amp-analytics-0.1.js Show response
cdn.ampproject.org/rtv/011909241711100/v0/ Frame B009 150 KB
40 KB 8ms
7ms Script
text/javascript 2a00:1450:4001:821::2001
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/011909241711100/v0/amp-analytics-0.1.js

Requested by

Host: clarium.global.ssl.fastly.net
URL: https://clarium.global.ssl.fastly.net/gpt/a/wrap.js?v2_1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:821::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

sffe /

Resource Hash

197c294e1520b32d787d2678660c02fd195c1c93fee3441de596ef22c34ed425

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp-collector.appspot.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.itwbooking.bjquwhcm.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp-collector.appspot.com/csp/amp
content-encoding: br
etag: "31e12d286572e15e"
age: 742992
status: 200
strict-transport-security: max-age=31536000; includeSubDomains; preload
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 40838
x-xss-protection: 0
server: sffe
date: Tue, 08 Oct 2019 20:54:01 GMT
vary: Accept-Encoding
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
x-content-type-options: nosniff
expires: Wed, 07 Oct 2020 20:54:01 GMT

GET
H2 200 15842465133016810807
tpc.googlesyndication.com/simgad/ Frame B009 43 B
104 B 6ms
6ms Image
image/gif 2a00:1450:4001:81f::2001
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/15842465133016810807

Requested by

Host: clarium.global.ssl.fastly.net
URL: https://clarium.global.ssl.fastly.net/gpt/a/wrap.js?v2_1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

sffe /

Resource Hash

4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.itwbooking.bjquwhcm.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 11 Oct 2019 03:45:20 GMT
x-content-type-options: nosniff
age: 545513
x-dns-prefetch-control: off
status: 200
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 43
x-xss-protection: 0
last-modified: Wed, 30 May 2018 18:01:52 GMT
server: sffe
content-type: image/gif
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 10 Oct 2020 03:45:20 GMT

GET
DATA 200
OK truncated
/ Frame B009 210 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 6cbf610854f96a518bc7858c1db0c389e414a8b1d99d3f928768602ecd3df5c9

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 view
securepubads.g.doubleclick.net/pcs/ Frame B009 0
57 B 21ms
21ms Image
image/gif 172.217.16.162
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjstoHu3cdhKdBs9BuwLINzhv4GAwWGPsjacMKbjtN3lj76KIth6y0RdjKydvRZWYTib8mvNn3zm5kWlO1qxelUZACE3HIhfmnncXAMtn5ixsrSWz98XSRlUGwyTRv0J2_e0KhVLu6SEPv5NHiC9lNwYJhjH2H07jMZ0pz2iK_P_PFcIwwzPFrekDYSt7qE1uj2LYZzKXU7tDS-Hbu8SX4hUBj1oRpjeQGiNEJxB-Ubv-sDIVhT1AEQqArkDdU_WhvisRPMGq63OFhwajxBoSPfhSFIVFMrJAds2SGB4PwNHBSDGNMdtvEKPh2Dqmj-aV_zE&sig=Cg0ArKJSzF3ItBA6eUdwEAE&adurl=

Requested by

Host: www.itwbooking.bjquwhcm.com
URL: https://www.itwbooking.bjquwhcm.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.16.162 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

fra15s11-in-f2.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.itwbooking.bjquwhcm.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

timing-allow-origin: *
date: Thu, 17 Oct 2019 11:17:13 GMT
x-content-type-options: nosniff
server: cafe
status: 200
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
content-type: image/gif
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H2 204 l
www.google.com/ads/measurement/ Frame B009 0
0 14ms
14ms Image
text/html 2a00:1450:4001:800::2004
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.google.com/ads/measurement/l?ebcid=ALh7CaTebsQzZNzivG35rJZsrqNvGl8Se_t7B0d2a4Wtd6weDF19i6UX4bh4JcPz1jE5AxCQGIWi
Requested by: Host: www.itwbooking.bjquwhcm.com
URL: https://www.itwbooking.bjquwhcm.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:4001:800::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.itwbooking.bjquwhcm.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

GET
H2 200 amp4ads-v0.js Show response
cdn.ampproject.org/rtv/221910071804120/ Frame 241D 251 KB
68 KB 6ms
5ms Script
text/javascript 2a00:1450:4001:821::2001
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/221910071804120/amp4ads-v0.js

Requested by

Host: clarium.global.ssl.fastly.net
URL: https://clarium.global.ssl.fastly.net/gpt/a/wrap.js?v2_1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:821::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

sffe /

Resource Hash

0443e8c80b41cec35957a39ae5eee9c4e6a34a178e649be29c52d85553a00bfd

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp-collector.appspot.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.itwbooking.bjquwhcm.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp-collector.appspot.com/csp/amp
content-encoding: br
etag: "5a10fba13f1c116d"
age: 507864
status: 200
strict-transport-security: max-age=31536000; includeSubDomains; preload
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 69650
x-xss-protection: 0
server: sffe
date: Fri, 11 Oct 2019 14:12:49 GMT
vary: Accept-Encoding
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
x-content-type-options: nosniff
expires: Sat, 10 Oct 2020 14:12:49 GMT

GET
H2 200 amp-analytics-0.1.js Show response
cdn.ampproject.org/rtv/221910071804120/v0/ Frame 241D 150 KB
40 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:821::2001
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.ampproject.org/rtv/221910071804120/v0/amp-analytics-0.1.js

Requested by

Host: clarium.global.ssl.fastly.net
URL: https://clarium.global.ssl.fastly.net/gpt/a/wrap.js?v2_1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:821::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

sffe /

Resource Hash

aa95eb8757140f09d3424399b939ed3f10a20c45c6c52476c614c9bc375eb667

Security Headers

Name	Value
Content-Security-Policy	default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp-collector.appspot.com/csp/amp
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.itwbooking.bjquwhcm.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

content-security-policy: default-src * blob: data:; script-src blob: https://cdn.ampproject.org/esm/ https://cdn.ampproject.org/mp/ https://cdn.ampproject.org/rtv/ https://cdn.ampproject.org/sp/ https://cdn.ampproject.org/sw/ https://cdn.ampproject.org/v0.js https://cdn.ampproject.org/v0/ https://cdn.ampproject.org/viewer/; object-src 'none'; style-src 'unsafe-inline' https://cdn.ampproject.org/rtv/ https://cdn.materialdesignicons.com https://cloud.typography.com https://fast.fonts.net https://fonts.googleapis.com https://maxcdn.bootstrapcdn.com https://p.typekit.net https://pro.fontawesome.com https://use.fontawesome.com https://use.typekit.net; report-uri https://csp-collector.appspot.com/csp/amp
content-encoding: br
etag: "81d87e94d0f109ba"
age: 558843
status: 200
strict-transport-security: max-age=31536000; includeSubDomains; preload
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 40847
x-xss-protection: 0
server: sffe
date: Fri, 11 Oct 2019 00:03:10 GMT
vary: Accept-Encoding
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
x-content-type-options: nosniff
expires: Sat, 10 Oct 2020 00:03:10 GMT

GET
H2 200 15842465133016810807
tpc.googlesyndication.com/simgad/ Frame 241D 43 B
104 B 6ms
6ms Image
image/gif 2a00:1450:4001:81f::2001
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/15842465133016810807

Requested by

Host: clarium.global.ssl.fastly.net
URL: https://clarium.global.ssl.fastly.net/gpt/a/wrap.js?v2_1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

sffe /

Resource Hash

4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.itwbooking.bjquwhcm.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 11 Oct 2019 03:45:20 GMT
x-content-type-options: nosniff
age: 545513
x-dns-prefetch-control: off
status: 200
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 43
x-xss-protection: 0
last-modified: Wed, 30 May 2018 18:01:52 GMT
server: sffe
content-type: image/gif
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 10 Oct 2020 03:45:20 GMT

GET
DATA 200
OK truncated
/ Frame 241D 211 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: d0f8ba8df3451fabff93326ecebf941327ef62ba805a5292cfad6c2625a29d0a

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 view
securepubads.g.doubleclick.net/pcs/ Frame 241D 0
48 B 20ms
20ms Image
image/gif 172.217.16.162
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjstRRR34qV6kleggvIKEhpuGtkntXz9Gjq3_5_nSl6jMFcj5Re4iM92Fg-au9MbzE4pdLnxmYxULzLpe9Qaidw-JDUcuiR-_fQ9k-bN_AlJGEPTgB8Wt0yA680Rnlwp4fCTWCuoczZZkwC368li0-b1xIRgkZsFts2o_YYYOJKEO1mYXqNrdyyJ5Z5SlD2XXx7nK3JiLSi18cghPeWbHIZHO468Lrr-vlM-gaGkgNuZso98-YQ5z_BYZ-hpfhVSjtzMC97InY7iI5gTZlmzd6HEs4OLDvPJuT6QcBhP0UXHn5iQSElFxE9Pev_DhygJwSH0&sig=Cg0ArKJSzGBs0RQxA9uSEAE&adurl=

Requested by

Host: www.itwbooking.bjquwhcm.com
URL: https://www.itwbooking.bjquwhcm.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.16.162 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

fra15s11-in-f2.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.itwbooking.bjquwhcm.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

timing-allow-origin: *
date: Thu, 17 Oct 2019 11:17:13 GMT
x-content-type-options: nosniff
server: cafe
status: 200
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
content-type: image/gif
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H2 200 15842465133016810807
tpc.googlesyndication.com/simgad/ Frame C2EA 43 B
104 B 6ms
6ms Image
image/gif 2a00:1450:4001:81f::2001
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/15842465133016810807

Requested by

Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/rtv/031910071804120/amp4ads-v0.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

sffe /

Resource Hash

4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.itwbooking.bjquwhcm.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 11 Oct 2019 03:45:20 GMT
x-content-type-options: nosniff
age: 545513
x-dns-prefetch-control: off
status: 200
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 43
x-xss-protection: 0
last-modified: Wed, 30 May 2018 18:01:52 GMT
server: sffe
content-type: image/gif
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 10 Oct 2020 03:45:20 GMT

GET
H/1.1 200
OK / Show response
clarium.global.ssl.fastly.net/ Frame 29C7 161 KB
43 KB 16ms
5ms Script
text/javascript 151.101.113.194
Fastly

General

Check archive.org

Show headers Download Go to

Full URL: https://clarium.global.ssl.fastly.net/?wrapper=mOinGM9MTu5v-Lto835XLhlrSPY&tpid=bU9pbkdNOU1UdTV2LUx0bzgzNVhMaGxyU1BZLzI0NzY3MDI0OTE6MXgx&v=v2lgcycid&d=eyJ3aCI6ImJVOXBia2ROT1UxVWRUVjJMVXgwYnpnek5WaE1hR3h5VTFCWkx6STBOelkzTURJME9URTZNWGd4Iiwid2QiOnsibyI6MjQ3NjcwMjQ5MSwidyI6IjEiLCJoIjoiMSJ9LCJ3ciI6Mn0=
Requested by: Host: www.itwbooking.bjquwhcm.com
URL: https://www.itwbooking.bjquwhcm.com/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.113.194 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software: nginx /
Resource Hash: b888c82e155e7fc6fe76ad50ea3214188e51774f0ae356217a3b2da14ca58823

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.itwbooking.bjquwhcm.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Thu, 17 Oct 2019 11:17:13 GMT
Content-Encoding: gzip
Age: 275
X-Cache-Status: hit
X-Cache: HIT
Connection: keep-alive
Content-Length: 44010
X-Served-By: cache-hhn4075-HHN
Access-Control-Allow-Origin: *
Server: nginx
X-Timer: S1571311034.733607,VS0,VE0
Vary: Accept-Encoding
Content-Type: text/javascript; charset=utf-8
Via: 1.1 varnish
Cache-Control: private, max-age=900, stale-while-revalidate=3600
Accept-Ranges: bytes
X-Cache-Hits: 2

GET
H2 200 osd.js Show response
www.googletagservices.com/activeview/js/current/ 77 KB
29 KB 53ms
39ms Script
text/javascript 2a00:1450:4001:81c::2002
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/osd.js?cb=%2Fr20100101

Requested by

Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2019100301.js?21064780

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81c::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

sffe /

Resource Hash

f425f66d90f1150499b36ab47b56fa6fb1a68136e4f42befca20a920ff85306b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.itwbooking.bjquwhcm.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 17 Oct 2019 11:17:13 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1571051767941600"
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 29055
x-xss-protection: 0
expires: Thu, 17 Oct 2019 11:17:13 GMT

GET
H2 200 view Show response
securepubads.g.doubleclick.net/pcs/ Frame 29C7 0
57 B 19ms
19ms Fetch
image/gif 172.217.16.162
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsvLffFajavvcmEg7E1uapI93osgnHITk6KUXkBxw3D-wpuLwjTjnEUDlPJtU1OE6T54tf_veK6DAQjBlwd4Igxb_KCukjQ5mKQsuOzjy2Scr47XaXZEPLMnWOQ9huO59cpfMtN5cZ1DsD8JJxQ-yf2SBNaCku0hS9Y2vYIIAfSZ7Io-X-l_8L6Uqe7YnvUR0OLn4Yl67l-qHRJK0G0NkVGG2rg4M0HOOHNPWqdBW8mOWjZIr5ARjGxQEotqGH1j8upvfbJilgooVbBex0hGlzgDHq2-DWIpUK01gEctmT6UBKYRh6b-3MOFe0Z1xMqTHviG&sig=Cg0ArKJSzFdkEYNB1qWGEAE&urlfix=1&adurl=

Requested by

Host: www.itwbooking.bjquwhcm.com
URL: https://www.itwbooking.bjquwhcm.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.16.162 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

fra15s11-in-f2.1e100.net

Software

cafe /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.itwbooking.bjquwhcm.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

timing-allow-origin: *
date: Thu, 17 Oct 2019 11:17:13 GMT
x-content-type-options: nosniff
server: cafe
status: 200
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin: *
cache-control: private
content-type: image/gif
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 0
x-xss-protection: 0

GET
H/1.1 200
OK Cookie set ifnotify
a3226.casalemedia.com/ Frame BBBD 0
0 189ms
14ms Document
text/html 185.80.38.195
Index Exchange Inc.

General

Check archive.org

Show headers Download Go to

Full URL: https://a3226.casalemedia.com/ifnotify?gdprconsent=1&c=1323407&r=BC99D054&t=5DA84DB9&u=WGFoTnVibFFKc01BQUZ3amhLSUFBQUFj&m=6bfe32698564dc112214a72541353b9e&wp=11&aid=78AC9E464D5DAEEA&tid=FDD0&s=2D5AA&cp=0.17&n=www.itwbooking.bjquwhcm.com&pr=xx&sid=317f-3180-36f6-37bc-38c8-38cb-38d0-38d3-38d8-38db-3996-3996-3996-3996-3999-3999-3999-3999-39c3-3bcf-40ea-438f-4427-4769-50a7-50aa-55d5-55e4-55e9-55e9-55e9-55e9-57b4-5a20-5f68-93ce-b149&epr=1714d48110e49865
Requested by: Host: clarium.global.ssl.fastly.net
URL: https://clarium.global.ssl.fastly.net/?wrapper=mOinGM9MTu5v-Lto835XLhlrSPY&tpid=bU9pbkdNOU1UdTV2LUx0bzgzNVhMaGxyU1BZLzI0NzY3MDI0OTE6MXgx&v=v2lgcycid&d=eyJ3aCI6ImJVOXBia2ROT1UxVWRUVjJMVXgwYnpnek5WaE1hR3h5VTFCWkx6STBOelkzTURJME9URTZNWGd4Iiwid2QiOnsibyI6MjQ3NjcwMjQ5MSwidyI6IjEiLCJoIjoiMSJ9LCJ3ciI6Mn0=
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.80.38.195 , Netherlands, ASN27381 (CASALE-MEDIA - Index Exchange Inc., CA),
Reverse DNS
Software: Apache /
Resource Hash

Request headers

Host: a3226.casalemedia.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode: nested-navigate
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Sec-Fetch-Site: cross-site
Referer: https://www.itwbooking.bjquwhcm.com/
Accept-Encoding: gzip, deflate, br
Cookie: CMPS=3226; CMST=XahNuV2oTbkB; CMDD=AAJvRAE*; CMID=XahNublQJsMAAFwjhKIAAAAc; CMPRO=1173
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode: nested-navigate
Referer: https://www.itwbooking.bjquwhcm.com/

Response headers

Date: Thu, 17 Oct 2019 11:17:13 GMT
Server: Apache
Pragma: no-cache
Cache-Control: no-cache
Expires: 0
Set-Cookie: CMST=XahNuV2oTbkB;domain=casalemedia.com;path=/;expires=Fri, 18 Oct 2019 11:17:13 GMT CMDD=AAJvRAE*;domain=casalemedia.com;path=/;expires=Fri, 18 Oct 2019 11:17:13 GMT CMRUM3=835da84db905a0&275da84db90b40&395da84db905a0&035da84db905a0&b05da84db905a0&585da84db905a0&2d5da84db905a0&695da84db905a0;domain=casalemedia.com;path=/;expires=Fri, 16 Oct 2020 11:17:13 GMT
Keep-Alive: timeout=1, max=100
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html

GET
H/1.1 200
OK js Show response
tags.mathtag.com/notify/ Frame 29C7 2 KB
2 KB 78ms
28ms Script
application/x-javascript 185.29.133.52
MediaMath Inc

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.mathtag.com/notify/js?id=5aW95q2jLzIwLyAvTlRJeE1tTTBPVEF0TnpSa1ppMDVPVEV4TFRBd01EQXRNREF3TURBd01EQXdNREF3LzcxMjM2MjM0NjE2MzE0NzQ0OS82ODY0MDU1LzQ4MDIzNzIvMTUvRGY4S3NyWFFLWUhnOEc3eWpiMVp4VG5VWmxYS3JJclo1Q3hueU03akRxdy8xLzE1LzAvMC85NTY4MDMvMjQyMDkyNzc0NC8yMTY1MzYvNjUxODcxLzEvMC8wL01EQXdNREF3TURBdE1EQXdNQzB3TURBd0xUQXdNREF0TURBd01EQXdNREF3TURBdy8wLzAvMC8wLzAvNzEyMzYyMzQ2MTYzMTQ3NDQ5L3pyaC8wLzIwNDUvNTUvOTk5LzQwLzE0NC43Ni4xMDkuMC8wLjAwMC8xNTcxMzExMDMzLw/lhwKoCzHjDXrZUXXdIGTs2M0uic&nodeid=39&auctionid=712362346163147449&exch=cas&sid=4802372&cid=6864055&price=0.17&act=LiIiJiQocHxrPSwuJCMqcHxrKy5wfGshIioqJCMqcHxrOiwkOQsiPwQgPQMiOSQrcH0&group=eu&bp=a_bhgaac
Requested by: Host: clarium.global.ssl.fastly.net
URL: https://clarium.global.ssl.fastly.net/?wrapper=mOinGM9MTu5v-Lto835XLhlrSPY&tpid=bU9pbkdNOU1UdTV2LUx0bzgzNVhMaGxyU1BZLzI0NzY3MDI0OTE6MXgx&v=v2lgcycid&d=eyJ3aCI6ImJVOXBia2ROT1UxVWRUVjJMVXgwYnpnek5WaE1hR3h5VTFCWkx6STBOelkzTURJME9URTZNWGd4Iiwid2QiOnsibyI6MjQ3NjcwMjQ5MSwidyI6IjEiLCJoIjoiMSJ9LCJ3ciI6Mn0=
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.29.133.52 , United Kingdom, ASN30419 (MEDIAMATH-INC - MediaMath Inc, US),
Reverse DNS
Software: MMBD/3.157.2 /
Resource Hash: 6ec96c54f077ca13b9547200c26b24a0e16bf964cf2d7804955d906f46308f28

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.itwbooking.bjquwhcm.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Thu, 17 Oct 2019 11:17:13 GMT
Content-Encoding: gzip
x-mm-bid-request-time: 1571311033
Last-Modified: Thu, 17 Oct 2019 11:17:13 GMT
Server: MMBD/3.157.2
x-mm-latency: 1 (0)
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
x-mm-dbg: count
Cache-Control: no-cache
x-mm-host: zrh-router-x38, zrh-bidder-x7
Connection: close
Content-Type: application/x-javascript; charset=UTF-8
Expires: Thu, 17 Oct 2019 11:17:12 GMT

GET
H2 200 osd_listener.js Show response
www.googletagservices.com/activeview/js/current/ Frame 29C7 77 KB
29 KB 41ms
40ms Script
text/javascript 2a00:1450:4001:81c::2002
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagservices.com/activeview/js/current/osd_listener.js?cache=r20110914

Requested by

Host: clarium.global.ssl.fastly.net
URL: https://clarium.global.ssl.fastly.net/?wrapper=mOinGM9MTu5v-Lto835XLhlrSPY&tpid=bU9pbkdNOU1UdTV2LUx0bzgzNVhMaGxyU1BZLzI0NzY3MDI0OTE6MXgx&v=v2lgcycid&d=eyJ3aCI6ImJVOXBia2ROT1UxVWRUVjJMVXgwYnpnek5WaE1hR3h5VTFCWkx6STBOelkzTURJME9URTZNWGd4Iiwid2QiOnsibyI6MjQ3NjcwMjQ5MSwidyI6IjEiLCJoIjoiMSJ9LCJ3ciI6Mn0=

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81c::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

sffe /

Resource Hash

f820f689e79fe927155372514936423b30eb400c1d2b87b6503d1398f6d352c7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.itwbooking.bjquwhcm.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 17 Oct 2019 11:17:13 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: sffe
etag: "1571051767941600"
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: private, max-age=3000
accept-ranges: bytes
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 29551
x-xss-protection: 0
expires: Thu, 17 Oct 2019 11:17:13 GMT

GET
H/1.1 200
OK pixel
protected-by.clarium.io/ Frame 29C7 68 B
345 B 30ms
8ms Image
image/png 18.195.61.72
Amazon.com

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://protected-by.clarium.io/pixel?tag=wt_bU9pbkdNOU1UdTV2LUx0bzgzNVhMaGxyU1BZLzI0NzY3MDI0OTE6MXgx&v=5&s=f3140ea5ce64369632e22f754c23bdb6c87348a5&id=eyJkZnAiOnsiYWQiOjQxMzY3ODU3NiwiYyI6MCwibCI6MCwibyI6MjQ3NjcwMjQ5MSwiQSI6Ii8xODE5MDE3Ni9BZFRocml2ZV9Gb290ZXJfMS81ODI2MjcxM2JiYjExZTI0NDEzYzIzMGIiLCJ5IjowLCJjbyI6MCwicyI6IkFkVGhyaXZlX0Zvb3Rlcl8xX2Rlc2t0b3AifX0%3D&sb=4&cb=8574039&h=www.itwbooking.bjquwhcm.com
Requested by: Host: www.itwbooking.bjquwhcm.com
URL: https://www.itwbooking.bjquwhcm.com/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.195.61.72 Frankfurt am Main, Germany, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: ec2-18-195-61-72.eu-central-1.compute.amazonaws.com
Software: nginx/1.14.0 (Ubuntu) /
Resource Hash: 69539b5b3777cffda28a66d7f2aa9b17c91ee1ec8fd50c00c442af91753a60f7

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.itwbooking.bjquwhcm.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 17 Oct 2019 11:17:13 GMT
Server: nginx/1.14.0 (Ubuntu)
Content-Type: image/png
Cache-Control: no-store, no-cache, must-revalidate, max-age=0
Connection: keep-alive
Content-Length: 68
Expires: Sat, 26 Jul 1997 05:00:00 GMT

GET
H2 200 15842465133016810807
tpc.googlesyndication.com/simgad/ Frame 241D 43 B
104 B 6ms
6ms Image
image/gif 2a00:1450:4001:81f::2001
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tpc.googlesyndication.com/simgad/15842465133016810807

Requested by

Host: cdn.ampproject.org
URL: https://cdn.ampproject.org/rtv/221910071804120/amp4ads-v0.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

sffe /

Resource Hash

4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.itwbooking.bjquwhcm.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 11 Oct 2019 03:45:20 GMT
x-content-type-options: nosniff
age: 545513
x-dns-prefetch-control: off
status: 200
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 43
x-xss-protection: 0
last-modified: Wed, 30 May 2018 18:01:52 GMT
server: sffe
content-type: image/gif
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 10 Oct 2020 03:45:20 GMT

GET
H/1.1 200
OK df2muyo5c9nk Show response
hal9000.redintelligence.net/zone/ Frame 29C7 10 KB
3 KB 5ms
1ms Script
text/html 136.243.51.232
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal9000.redintelligence.net/zone/df2muyo5c9nk?subid=&rnd=712362346163147449&extVar[]=DOUBLEBORDER:1&redirectClick=http%3A%2F%2Fpixel.mathtag.com%2Fclick%2Fimg%3Fmt_aid%3D712362346163147449%26mt_id%3D6864055%26mt_adid%3D216536%26mt_sid%3D4802372%26mt_exid%3D15%26mt_inapp%3D0%26mt_uuid%3D27655da8-4db9-4601-bf0d-b028a2e3f837%26redirect%3D
Requested by: Host: clarium.global.ssl.fastly.net
URL: https://clarium.global.ssl.fastly.net/?wrapper=mOinGM9MTu5v-Lto835XLhlrSPY&tpid=bU9pbkdNOU1UdTV2LUx0bzgzNVhMaGxyU1BZLzI0NzY3MDI0OTE6MXgx&v=v2lgcycid&d=eyJ3aCI6ImJVOXBia2ROT1UxVWRUVjJMVXgwYnpnek5WaE1hR3h5VTFCWkx6STBOelkzTURJME9URTZNWGd4Iiwid2QiOnsibyI6MjQ3NjcwMjQ5MSwidyI6IjEiLCJoIjoiMSJ9LCJ3ciI6Mn0=
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 136.243.51.232 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.232.51.243.136.clients.your-server.de
Software: Apache /
Resource Hash: 56f2841fe45d3b86b2f633cde34810835d804b869070ab9dc7bf66a00e63aba1

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.itwbooking.bjquwhcm.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Thu, 17 Oct 2019 11:17:13 GMT
Content-Encoding: gzip
Server: Apache
Connection: close
Content-Length: 2749
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8

GET
H/1.1 200
OK img
pixel.mathtag.com/event/ Frame 29C7 43 B
360 B 34ms
22ms Image
image/gif 2.18.233.201
Akamai Technologies

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.mathtag.com/event/img?mt_id=1368875&mt_adid=216764&v1=15&v2=712362346163147449&v3=651871&v4=4802372&v5=6864055&mt_nsync=1&no_attr=1
Requested by: Host: clarium.global.ssl.fastly.net
URL: https://clarium.global.ssl.fastly.net/?wrapper=mOinGM9MTu5v-Lto835XLhlrSPY&tpid=bU9pbkdNOU1UdTV2LUx0bzgzNVhMaGxyU1BZLzI0NzY3MDI0OTE6MXgx&v=v2lgcycid&d=eyJ3aCI6ImJVOXBia2ROT1UxVWRUVjJMVXgwYnpnek5WaE1hR3h5VTFCWkx6STBOelkzTURJME9URTZNWGd4Iiwid2QiOnsibyI6MjQ3NjcwMjQ5MSwidyI6IjEiLCJoIjoiMSJ9LCJ3ciI6Mn0=
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.18.233.201 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS: a2-18-233-201.deploy.static.akamaitechnologies.com
Software: MT3 1796 9706391 master cdg-pixel-x21 /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.itwbooking.bjquwhcm.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Thu, 17 Oct 2019 11:17:13 GMT
Server: MT3 1796 9706391 master cdg-pixel-x21
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Cache-Control: no-cache
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Thu, 17 Oct 2019 11:17:12 GMT

GET
H/1.1 200
OK img
tags.mathtag.com/event/ Frame 29C7 49 B
328 B 72ms
25ms Image
image/gif 185.29.133.52
MediaMath Inc

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tags.mathtag.com/event/img?type=mmImpTrack&exch=cas&bid=712362346163147449&st=4802372&time=1571311033&nodeid=39
Requested by: Host: clarium.global.ssl.fastly.net
URL: https://clarium.global.ssl.fastly.net/?wrapper=mOinGM9MTu5v-Lto835XLhlrSPY&tpid=bU9pbkdNOU1UdTV2LUx0bzgzNVhMaGxyU1BZLzI0NzY3MDI0OTE6MXgx&v=v2lgcycid&d=eyJ3aCI6ImJVOXBia2ROT1UxVWRUVjJMVXgwYnpnek5WaE1hR3h5VTFCWkx6STBOelkzTURJME9URTZNWGd4Iiwid2QiOnsibyI6MjQ3NjcwMjQ5MSwidyI6IjEiLCJoIjoiMSJ9LCJ3ciI6Mn0=
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.29.133.52 , United Kingdom, ASN30419 (MEDIAMATH-INC - MediaMath Inc, US),
Reverse DNS
Software: MMBD/3.157.2 /
Resource Hash: 1cd58a827318c4a29b32a0db15c8c39d5651b42d8cad227519ad81bce4adb944

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.itwbooking.bjquwhcm.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Thu, 17 Oct 2019 11:17:13 GMT
Server: MMBD/3.157.2
Content-Type: image/gif
Cache-Control: no-cache
x-mm-host: zrh-router-x26, zrh-bidder-x7
Connection: keep-alive
Keep-Alive: timeout=360
Content-Length: 49
Expires: Thu, 17 Oct 2019 11:17:12 GMT

GET
H/1.1

200
OK

request.php Show response
hal900037.redintelligence.net/ Frame 29C7
Redirect Chain

https://hal900037.redintelligence.net/request.php?zone=df2muyo5c9nk&nw=20&renderingType=javascript&namespace=d8d567ed8b&subid=&uid=b30fde7be28a1416&screenSize=1600x1200&screenSizeAvail=1600x1200&cl...
https://hal900037.redintelligence.net/request.php?zone=df2muyo5c9nk&nw=20&renderingType=javascript&namespace=d8d567ed8b&subid=&uid=b30fde7be28a1416&screenSize=1600x1200&screenSizeAvail=1600x1200&cl...

4 KB
2 KB

65ms
63ms

Script
application/x-javascript

136.243.54.219
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal900037.redintelligence.net/request.php?zone=df2muyo5c9nk&nw=20&renderingType=javascript&namespace=d8d567ed8b&subid=&uid=b30fde7be28a1416&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=728x90&scrollPos=0x0&extData[]=&extVar[]=DOUBLEBORDER%3A1&envData=&redirectClick=http%3A%2F%2Fpixel.mathtag.com%2Fclick%2Fimg%3Fmt_aid%3D712362346163147449%26mt_id%3D6864055%26mt_adid%3D216536%26mt_sid%3D4802372%26mt_exid%3D15%26mt_inapp%3D0%26mt_uuid%3D27655da8-4db9-4601-bf0d-b028a2e3f837%26redirect%3D&documentReferer=https%3A%2F%2Fwww.itwbooking.bjquwhcm.com%2F&ancestorOrigins=https%3A%2F%2Fwww.itwbooking.bjquwhcm.com&random=9122350899755&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0&uidRedirect=1
Requested by: Host: www.itwbooking.bjquwhcm.com
URL: https://www.itwbooking.bjquwhcm.com/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 136.243.54.219 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.219.54.243.136.clients.your-server.de
Software: Apache /
Resource Hash: f03c0497b62fce9366403fdda94b7a8708999225f83dd9af3284ad4ba3de5784

Request headers

Referer: https://www.itwbooking.bjquwhcm.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 17 Oct 2019 11:17:13 GMT
Content-Encoding: gzip
Server: Apache
Vary: Accept-Encoding
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Cache-Control: no-store, no-cache, must-revalidate, max-age=0
X-NEORY-SubId: 95383400085078601049054011019037
Connection: close
Content-Type: application/x-javascript; charset=utf-8
Content-Length: 1221
Expires: Thu, 17 Oct 2019 12:17:13 +0200

Redirect headers

Pragma: no-cache
Date: Thu, 17 Oct 2019 11:17:13 GMT
Server: Apache
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Location: request.php?zone=df2muyo5c9nk&nw=20&renderingType=javascript&namespace=d8d567ed8b&subid=&uid=b30fde7be28a1416&screenSize=1600x1200&screenSizeAvail=1600x1200&clientSize=728x90&scrollPos=0x0&extData[]=&extVar[]=DOUBLEBORDER%3A1&envData=&redirectClick=http%3A%2F%2Fpixel.mathtag.com%2Fclick%2Fimg%3Fmt_aid%3D712362346163147449%26mt_id%3D6864055%26mt_adid%3D216536%26mt_sid%3D4802372%26mt_exid%3D15%26mt_inapp%3D0%26mt_uuid%3D27655da8-4db9-4601-bf0d-b028a2e3f837%26redirect%3D&documentReferer=https%3A%2F%2Fwww.itwbooking.bjquwhcm.com%2F&ancestorOrigins=https%3A%2F%2Fwww.itwbooking.bjquwhcm.com&random=9122350899755&isIframe=1&container=&adPos=0x0&adPosCheck=1x1&adtagId=0&uidRedirect=1
Cache-Control: no-store, no-cache, must-revalidate, max-age=0
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 0
Expires: Thu, 17 Oct 2019 12:17:13 +0200

GET
H2

200

awin.html
www.vehiculum.de/leasing/htlp/ Frame D9D0
Redirect Chain

https://www.awin1.com/cshow.php?s=2335133&v=16039&q=356706&r=296283&pref1=95383400085078601049054011019037&pv=1
https://www.vehiculum.de/leasing/htlp/awin.html

0
0

328ms
290ms

Document
text/html

2606:4700:30::681b:b368
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL: https://www.vehiculum.de/leasing/htlp/awin.html
Requested by: Host: clarium.global.ssl.fastly.net
URL: https://clarium.global.ssl.fastly.net/?wrapper=mOinGM9MTu5v-Lto835XLhlrSPY&tpid=bU9pbkdNOU1UdTV2LUx0bzgzNVhMaGxyU1BZLzI0NzY3MDI0OTE6MXgx&v=v2lgcycid&d=eyJ3aCI6ImJVOXBia2ROT1UxVWRUVjJMVXgwYnpnek5WaE1hR3h5VTFCWkx6STBOelkzTURJME9URTZNWGd4Iiwid2QiOnsibyI6MjQ3NjcwMjQ5MSwidyI6IjEiLCJoIjoiMSJ9LCJ3ciI6Mn0=
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:30::681b:b368 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

:method: GET
:authority: www.vehiculum.de
:scheme: https
:path: /leasing/htlp/awin.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-mode: nested-navigate
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
sec-fetch-site: cross-site
referer: https://www.itwbooking.bjquwhcm.com/
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode: nested-navigate
Referer: https://www.itwbooking.bjquwhcm.com/

Response headers

status: 200
date: Thu, 17 Oct 2019 11:17:14 GMT
content-type: text/html; charset=UTF-8
set-cookie: __cfduid=d7701ff63b270201091d64ad496aa45641571311034; expires=Fri, 16-Oct-20 11:17:14 GMT; path=/; domain=.vehiculum.de; HttpOnly
last-modified: Thu, 17 Oct 2019 00:16:50 GMT
via: 1.1 vegur, 1.1 vegur, 1.1 vegur
cf-cache-status: DYNAMIC
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server: cloudflare
cf-ray: 5271dd6b2de6cbb0-VIE
content-encoding: br

Redirect headers

Location: https://www.vehiculum.de/leasing/htlp/awin.html
Node: Helix
P3P: policyref="http://www.awin1.com/w3c/p3p.xml", CP="NOI NID CURa ADMa PSAa HISa OUR IND UNI PUR COM NAV"
Content-Length: 0
Date: Thu, 17 Oct 2019 11:17:14 GMT
Connection: keep-alive
Set-Cookie: awpv16039=296283|1571311034|abaa6c00-f0cf-11e9-a727-692d0d7ca6ed;domain=.awin1.com;path=/;expires=Sunday, 17-Nov-2019 11:17:14 UTC; AWSESS=356706:2335133;domain=.awin1.com;path=/;
Awin-Akamai-Rule-Set: default

GET
H2 200 htlp-webgains
www.11teamsports.com/de-de/ Frame C399 0
0 29ms
29ms Document
text/html 2606:4700::6810:a727
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL: https://www.11teamsports.com/de-de/htlp-webgains
Requested by: Host: clarium.global.ssl.fastly.net
URL: https://clarium.global.ssl.fastly.net/?wrapper=mOinGM9MTu5v-Lto835XLhlrSPY&tpid=bU9pbkdNOU1UdTV2LUx0bzgzNVhMaGxyU1BZLzI0NzY3MDI0OTE6MXgx&v=v2lgcycid&d=eyJ3aCI6ImJVOXBia2ROT1UxVWRUVjJMVXgwYnpnek5WaE1hR3h5VTFCWkx6STBOelkzTURJME9URTZNWGd4Iiwid2QiOnsibyI6MjQ3NjcwMjQ5MSwidyI6IjEiLCJoIjoiMSJ9LCJ3ciI6Mn0=
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6810:a727 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

:method: GET
:authority: www.11teamsports.com
:scheme: https
:path: /de-de/htlp-webgains
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-mode: nested-navigate
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
sec-fetch-site: cross-site
referer: https://www.itwbooking.bjquwhcm.com/
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode: nested-navigate
Referer: https://www.itwbooking.bjquwhcm.com/

Response headers

status: 200
date: Thu, 17 Oct 2019 11:17:14 GMT
content-type: text/html
content-length: 0
set-cookie: __cfduid=dc8fefce056a869ff9148883f90e1ff601571311033; expires=Fri, 16-Oct-20 11:17:13 GMT; path=/; domain=.11teamsports.com; HttpOnly wgPostView=true; Expires=Sat, 16 Nov 2019 11:17:14 GMT; Path='/'; Domain=.11teamsports.com;
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
server: cloudflare
cf-ray: 5271dd6a69bc59be-VIE

GET
H/1.1

200
OK

onepixel.gif
ad.zanox.com/ppv/images/ Frame 5523
Redirect Chain

https://ad.zanox.com/tpv/?45475836C666538628T&zpar0=95383400085078601049054011019037
https://pb.media01.eu/view.aspx?trackid=91C09AA007C123F60FDC6F5FD61F1F1B&dt_subid1=45475836C666538628SV1yq32186858000568747841422036599273yb5yb7T2619872353978952707&dt_subid2=&actionid=879111&produ...
https://ad.zanox.com/ppv/images/onepixel.gif?foo=45475836C666538628SV1yq32186858000568747841422036599273yb5yb7T2619872353978952707&dyn_id=

0
0

32ms
29ms

Document
image/gif

195.216.249.67
ZANOX

General

Check archive.org

Show headers Download Go to

Full URL: https://ad.zanox.com/ppv/images/onepixel.gif?foo=45475836C666538628SV1yq32186858000568747841422036599273yb5yb7T2619872353978952707&dyn_id=
Requested by: Host: clarium.global.ssl.fastly.net
URL: https://clarium.global.ssl.fastly.net/?wrapper=mOinGM9MTu5v-Lto835XLhlrSPY&tpid=bU9pbkdNOU1UdTV2LUx0bzgzNVhMaGxyU1BZLzI0NzY3MDI0OTE6MXgx&v=v2lgcycid&d=eyJ3aCI6ImJVOXBia2ROT1UxVWRUVjJMVXgwYnpnek5WaE1hR3h5VTFCWkx6STBOelkzTURJME9URTZNWGd4Iiwid2QiOnsibyI6MjQ3NjcwMjQ5MSwidyI6IjEiLCJoIjoiMSJ9LCJ3ciI6Mn0=
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 195.216.249.67 , France, ASN47268 (ZANOX, FR),
Reverse DNS
Software: Microsoft-IIS/7.5 / ASP.NET
Resource Hash

Request headers

Host: ad.zanox.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode: nested-navigate
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Sec-Fetch-Site: cross-site
Referer: https://www.itwbooking.bjquwhcm.com/
Accept-Encoding: gzip, deflate, br
Cookie: zttpvc=5C97445S2619872353978952707T0II5C108222S2619872353983147008T0II45475836C0SV1yq32186858000568747841422036599273yb5yb7T2619872353978952707; zptpvc=5C97445S2619872353978952707T0II5C108222S2619872353983147008T0II45475836C0SV1yq32186858000568747841422036599273yb5yb7T2619872353978952707
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode: nested-navigate
Referer: https://www.itwbooking.bjquwhcm.com/

Response headers

Content-Type: image/gif
Last-Modified: Thu, 04 May 2000 17:04:38 GMT
Accept-Ranges: bytes
ETag: "09764d4eab5bf1:0"
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
P3P: policyref="http://ad.zanox.com/w3c/p3p.xml", CP="NOI CUR OUR STP"
jobs-at-zanox: https://www.zanox.com/jobs/international
Date: Thu, 17 Oct 2019 11:17:23 GMT
Content-Length: 43
Via: 10.30.0.116%1
Vary: Accept-Encoding

Redirect headers

Cache-Control: no-cache, must-revalidate
Pragma: no-cache
Content-Type: text/html; charset=UTF-8
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Last-Modified: Thu, 17 Oct 2019 01:17:10 GMT
Location: https://ad.zanox.com/ppv/images/onepixel.gif?foo=45475836C666538628SV1yq32186858000568747841422036599273yb5yb7T2619872353978952707&dyn_id=
Server: Microsoft-IIS/8.5
Set-Cookie: ASP.NET_SessionId=yg2fj3qfvsqao5kfxg0kkrtq; path=/; HttpOnly DTU=0CFBE629B7A7F0895566497F82C38658; expires=Sun, 17-Oct-2021 11:17:10 GMT; path=/
P3P: policyref="https://pb.media01.eu/pb.media01.eu/p3p.xml", CP="NOI NID PSA OUR BUS NAV STA"
Access-Control-Allow-Origin: *
Access-Control-Allow-Credentials: true
X-XSS-Protection: 1; mode=block
Access-Control-Allow-Methods: GET,POST
Access-Control-Allow-Headers: Content-Type, Content-Range, Content-Disposition, Content-Description, X-XSRF-TOKEN, X-Location
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Date: Thu, 17 Oct 2019 11:17:10 GMT
Content-Length: 0

GET
H/1.1 200
OK link.html Show response
track.webgains.com/ Frame 29C7 12 KB
12 KB 189ms
126ms Script
text/html 46.236.13.147
DEDIPOWER

General

Check archive.org

Show headers Download Go to

Full URL: https://track.webgains.com/link.html?wglinkid=2919345&wgcampaignid=99582&js=1&viewref=95383400085078601049054011019037
Requested by: Host: clarium.global.ssl.fastly.net
URL: https://clarium.global.ssl.fastly.net/?wrapper=mOinGM9MTu5v-Lto835XLhlrSPY&tpid=bU9pbkdNOU1UdTV2LUx0bzgzNVhMaGxyU1BZLzI0NzY3MDI0OTE6MXgx&v=v2lgcycid&d=eyJ3aCI6ImJVOXBia2ROT1UxVWRUVjJMVXgwYnpnek5WaE1hR3h5VTFCWkx6STBOelkzTURJME9URTZNWGd4Iiwid2QiOnsibyI6MjQ3NjcwMjQ5MSwidyI6IjEiLCJoIjoiMSJ9LCJ3ciI6Mn0=
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_128_CBC
Server: 46.236.13.147 , United Kingdom, ASN24931 (DEDIPOWER, GB),
Reverse DNS: 46-236-13-147.servers.dedipower.net
Software: Apache /
Resource Hash: 7fc34714e3f622740bf2eb865fa6b0e09003d12bc4bd66cd316af50792b6735d

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.itwbooking.bjquwhcm.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 17 Oct 2019 11:17:14 GMT
Last-Modified: Thu, 17 Oct 2019 11:17:14 GMT
Server: Apache
Transfer-Encoding: chunked
P3P: policyref="http://www.webgains.com/w3c/p3p.xml", CP="NON DSP COR NID ADM DEV CURi OUR NOR COM NAV"
X-WG-cache: hit
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Connection: close
Content-Type: text/html;charset=utf-8
Expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H/1.1

200
OK

onepixel.gif
ad.zanox.com/ppv/images/ Frame 29C7
Redirect Chain

https://ad.zanox.com/ppv/?45475836C666538628&zpar0=95383400085078601049054011019037
https://ad.zanox.com/ppv/images/onepixel.gif

43 B
460 B

114ms
28ms

Image
image/gif

195.216.249.67
ZANOX

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ad.zanox.com/ppv/images/onepixel.gif
Requested by: Host: www.itwbooking.bjquwhcm.com
URL: https://www.itwbooking.bjquwhcm.com/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 195.216.249.67 , France, ASN47268 (ZANOX, FR),
Reverse DNS
Software: Microsoft-IIS/7.5 / ASP.NET
Resource Hash: 73e88dfcd0f3a535341fb641c5400fcf772ffe36c628241104f829d3cf48e29b

Request headers

Referer: https://www.itwbooking.bjquwhcm.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Thu, 17 Oct 2019 11:17:23 GMT
Via: 10.30.0.116%1
Last-Modified: Thu, 04 May 2000 17:04:38 GMT
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
ETag: "09764d4eab5bf1:0"
Vary: Accept-Encoding
P3P: policyref="http://ad.zanox.com/w3c/p3p.xml", CP="NOI CUR OUR STP"
jobs-at-zanox: https://www.zanox.com/jobs/international
Accept-Ranges: bytes
Content-Type: image/gif
Content-Length: 43

Redirect headers

Pragma: no-cache
Date: Thu, 17 Oct 2019 11:17:23 GMT
Via: 10.30.2.230%1
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
P3P: policyref="http://ad.zanox.com/w3c/p3p.xml", CP="NOI CUR OUR STP"
Location: https://ad.zanox.com/ppv/images/onepixel.gif
Cache-Control: no-store
Connection: close
Content-Length: 0
jobs-at-zanox: https://www.zanox.com/jobs/international

GET
H2 200 clk.min.js Show response
analytics.webgains.io/ Frame 29C7 42 KB
13 KB 50ms
7ms Script
application/javascript 2600:9000:20eb:5600:9:352d:a240:93a1
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://analytics.webgains.io/clk.min.js
Requested by: Host: track.webgains.com
URL: https://track.webgains.com/link.html?wglinkid=2919345&wgcampaignid=99582&js=1&viewref=95383400085078601049054011019037
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:9000:20eb:5600:9:352d:a240:93a1 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: a64965074ae9c066ee0eba6d07c513849b733347df50fb6c51eef73cc72a73b9

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.itwbooking.bjquwhcm.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Wed, 02 Oct 2019 18:43:37 GMT
content-encoding: gzip
last-modified: Wed, 02 Oct 2019 18:43:32 GMT
server: AmazonS3
age: 59588
vary: Accept-Encoding
x-cache: Hit from cloudfront
x-amz-version-id: nj5zGoE7xjveWLPiPieT9Tu.0h81rmGl
status: 200
x-amz-cf-pop: FRA2-C1
content-type: application/javascript
x-amz-cf-id: RRsFjX75qeZscXdSMXeABHuSo3ONjlKHCVdoKGqcKBxH03dUGjUOnw==
via: 1.1 ba5b5e2e7fd98c4a472633bc4c1d4480.cloudfront.net (CloudFront)

GET
H/1.1 200
OK hit Show response
diapi.webgains.com/2.0/ Frame 29C7 79 B
267 B 102ms
37ms Script
text/javascript 46.236.12.250
DEDIPOWER

General

Check archive.org

Show headers Download Go to

Full URL: https://diapi.webgains.com/2.0/hit?callback=hitCallback&wgpayload=sWa44iFBBNlY5Du4UXuKrnZ2CI9XkPrwXC_JEkNgvlE4yy2XElgebiYMpztNKscKsoUs_43wuZPup_nH2t05oaYAhrcpMxE6DBUr5xj6KkuJCjCBeipa2hvLG9mhORoVidPZW2AUMnGWVQdgMVQdgAYx92u2p.j.2UMnGWFfwMHDCQyG5me6sBLSsbXzU0l6sqKIrGfuzwg9wJ9wPEwHXXTSHCSPmtd0wVYPIG_qvoPfybYb5EvYTrYesS95raaKMPn0qxf7_OLgiPFMtrs1OeyjaY1vSiwutrKsspwIybnenpUPMTydeneNufuyPBDjaY2ftckuyPBB2SCX0iakJodJ_A1Z9cJrAR0odm_dhrxbuJjkWxv5iJ3A0KAGYiJpw.5B0KB4WDA9RcWqrTKyLKyJEjNpp0iJ3A0KFgBFY5BNlrApjMk.1pO&wgcookie=%7B%22wgifp274615%22%3A%5B%2299582%22%2C%22274615%22%2C%222919345%22%2C%22%22%2C%221571311034%22%2C%22https%253A%252F%252Fwww.itwbooking.bjquwhcm.com%252F%22%2C%22%22%2C%22%22%2C%221579087034%22%2C%2295383400085078601049054011019037%22%5D%7D&wgchecksum=27bfeb2c8e7e1f0bd5b20a60ca5a99d0&userIP=144.76.109.30&doAffectv=1&wgtime=1571311034
Requested by: Host: track.webgains.com
URL: https://track.webgains.com/link.html?wglinkid=2919345&wgcampaignid=99582&js=1&viewref=95383400085078601049054011019037
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_128_CBC
Server: 46.236.12.250 , United Kingdom, ASN24931 (DEDIPOWER, GB),
Reverse DNS: 46-236-12-250.servers.dedipower.net
Software: Apache /
Resource Hash: 94bdeaea0d33cb654b89540e96e02fe28afceb1624d8ed58f7a43f3609fb4a17

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.itwbooking.bjquwhcm.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Access-Control-Allow-Origin: *
Date: Thu, 17 Oct 2019 11:17:14 GMT
Server: Apache
Connection: close
Content-Length: 79
Content-Type: text/javascript;charset=utf-8

GET
H/1.1 200
OK link.html
track.webgains.com/ Frame 29C7 3 KB
3 KB 68ms
26ms Image
image/png 46.236.13.147
DEDIPOWER

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://track.webgains.com/link.html?wgcampaignid=99582&viewref=83267100092627000951393011019011&wglinkid=2919345
Requested by: Host: www.itwbooking.bjquwhcm.com
URL: https://www.itwbooking.bjquwhcm.com/
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_128_CBC
Server: 46.236.13.147 , United Kingdom, ASN24931 (DEDIPOWER, GB),
Reverse DNS: 46-236-13-147.servers.dedipower.net
Software: Apache /
Resource Hash: 232d3fbf590a584138bb563319747dbef0c9e41db91f19ff45d41e785a5f4f98

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.itwbooking.bjquwhcm.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 17 Oct 2019 11:17:14 GMT
Last-Modified: Thu, 17 Oct 2019 11:17:14 GMT
Server: Apache
P3P: policyref="http://www.webgains.com/w3c/p3p.xml", CP="NON DSP COR NID ADM DEV CURi OUR NOR COM NAV"
X-WG-cache: hit
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Connection: close
Content-Type: image/png
Content-Length: 2808
Expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H2

200

activityi;dc_pre=CPfumuCVo-UCFVH2dwodJQoP8Q;src=5994599;type=invmedia;cat=g2slskko;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=4217308203254.1196
5994599.fls.doubleclick.net/ Frame E18D
Redirect Chain

https://5994599.fls.doubleclick.net/activityi;src=5994599;type=invmedia;cat=g2slskko;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=4217308203254.1196?
https://5994599.fls.doubleclick.net/activityi;dc_pre=CPfumuCVo-UCFVH2dwodJQoP8Q;src=5994599;type=invmedia;cat=g2slskko;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=4217308203254.1196?

0
0

24ms
23ms

Document
text/html

216.58.205.230
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://5994599.fls.doubleclick.net/activityi;dc_pre=CPfumuCVo-UCFVH2dwodJQoP8Q;src=5994599;type=invmedia;cat=g2slskko;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=4217308203254.1196?

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

216.58.205.230 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

fra15s24-in-f230.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=21600
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: 5994599.fls.doubleclick.net
:scheme: https
:path: /activityi;dc_pre=CPfumuCVo-UCFVH2dwodJQoP8Q;src=5994599;type=invmedia;cat=g2slskko;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=4217308203254.1196?
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-mode: nested-navigate
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
sec-fetch-site: cross-site
referer: https://www.itwbooking.bjquwhcm.com/
accept-encoding: gzip, deflate, br
cookie: IDE=AHWqTUnRbWBftTzpmkuwWL-IPURT45_Ob8R-OvplS2TckuLZeLUIHRFUDqAG5ORw
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode: nested-navigate
Referer: https://www.itwbooking.bjquwhcm.com/

Response headers

status: 200
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
date: Thu, 17 Oct 2019 11:17:14 GMT
expires: Thu, 17 Oct 2019 11:17:14 GMT
cache-control: private, max-age=0
strict-transport-security: max-age=21600
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 323
x-xss-protection: 0
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000

Redirect headers

status: 302
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
date: Thu, 17 Oct 2019 11:17:14 GMT
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
cache-control: no-cache, must-revalidate
follow-only-when-prerender-shown: 1
strict-transport-security: max-age=21600
location: https://5994599.fls.doubleclick.net/activityi;dc_pre=CPfumuCVo-UCFVH2dwodJQoP8Q;src=5994599;type=invmedia;cat=g2slskko;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=4217308203254.1196?
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
server: cafe
content-length: 0
x-xss-protection: 0
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000

GET
H/1.1 200
OK request_content.php
hal900037.redintelligence.net/ Frame 9133 0
0 7ms
2ms Document
text/html 136.243.54.219
HETZNER-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://hal900037.redintelligence.net/request_content.php?s=95383400085078601049054011019037&a=45feb6ef
Requested by: Host: www.itwbooking.bjquwhcm.com
URL: https://www.itwbooking.bjquwhcm.com/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 136.243.54.219 , Germany, ASN24940 (HETZNER-AS, DE),
Reverse DNS: static.219.54.243.136.clients.your-server.de
Software: Apache /
Resource Hash

Request headers

Host: hal900037.redintelligence.net
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode: nested-navigate
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Sec-Fetch-Site: cross-site
Referer: https://www.itwbooking.bjquwhcm.com/
Accept-Encoding: gzip, deflate, br
Cookie: 8lcfmzhxc8d6_uid=6f97b61ff5a908ab
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode: nested-navigate
Referer: https://www.itwbooking.bjquwhcm.com/

Response headers

Date: Thu, 17 Oct 2019 11:17:13 GMT
Server: Apache
Cache-Control: no-store, no-cache, must-revalidate, max-age=0
Expires: Thu, 17 Oct 2019 12:17:13 +0200
Pragma: no-cache
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Vary: Accept-Encoding
Content-Encoding: gzip
Content-Length: 1479
Connection: close
Content-Type: text/html; charset=utf-8

GET
H/1.1 200
OK id.js Show response
mathid.mathtag.com/device/ Frame 29C7 54 KB
19 KB 58ms
28ms Script
text/javascript 185.29.135.48
MediaMath Inc

General

Check archive.org

Show headers Download Go to

Full URL: https://mathid.mathtag.com/device/id.js
Requested by: Host: www.itwbooking.bjquwhcm.com
URL: https://www.itwbooking.bjquwhcm.com/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.29.135.48 , United Kingdom, ASN30419 (MEDIAMATH-INC - MediaMath Inc, US),
Reverse DNS
Software: / Express
Resource Hash: b08fefb255b40cd18b0f7db8ec21c6f0c79d16aa828d7ed9157da12a38538682

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.itwbooking.bjquwhcm.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Thu, 17 Oct 2019 11:17:14 GMT
Content-Encoding: gzip
X-Powered-By: Express
Vary: Accept-Encoding
Access-Control-Allow-Methods: GET,PUT,POST,DELETE
Content-Type: text/javascript
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=3600
Transfer-Encoding: chunked
X-MM-Host: cdg-mathid-x2
Connection: keep-alive
Access-Control-Allow-Headers: Content-type, X-Optout
Keep-Alive: timeout=360
Expires: Thu, 17 Oct 2019 12:17:14 GMT

GET
DATA 200
OK truncated
/ Frame 29C7 213 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: a0f093386fdbc1840bd86d3fc6f9069a9a2aaf3f178d72c60a0d962f53afc095

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 tag Show response
w-it.m-t.io/ Frame 29C7 62 B
243 B 47ms
25ms Script
application/javascript 2a00:1450:4001:81a::2013
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL: https://w-it.m-t.io/tag?type=impr&date=1571311034243
Requested by: Host: analytics.webgains.io
URL: https://analytics.webgains.io/clk.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:4001:81a::2013 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software: Google Frontend /
Resource Hash: 2e9e23cd777ca027732622b59b32bcccaaf2564899eedc5c7e11b8fed8dde4d4

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.itwbooking.bjquwhcm.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 17 Oct 2019 11:17:14 GMT
content-encoding: gzip
server: Google Frontend
vary: Accept-Encoding
content-type: application/javascript;charset=utf-8
status: 200
x-cloud-trace-context: f237a0669014ef713a3be2e6cf146f27
cache-control: private
content-length: 73

GET
H2 200 script Show response
w-it.m-t.io/ Frame 29C7 51 B
203 B 22ms
22ms Script
application/javascript 2a00:1450:4001:81a::2013
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL: https://w-it.m-t.io/script?programId=274615
Requested by: Host: analytics.webgains.io
URL: https://analytics.webgains.io/clk.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:4001:81a::2013 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software: Google Frontend /
Resource Hash: 8dc2590a64daad767066641d05a825dc55d12ac2577f113f80b568e93f296d1a

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.itwbooking.bjquwhcm.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 17 Oct 2019 11:17:14 GMT
content-encoding: gzip
server: Google Frontend
vary: Accept-Encoding
content-type: application/javascript;charset=utf-8
status: 200
x-cloud-trace-context: ee4692c6802dc4526b2db69fd8acb7d1
cache-control: private, max-age=2592000
content-length: 71
expires: Fri Oct 18 11:17:14 UTC 2019

GET
H2 200 track Show response
w-it.m-t.io/ Frame 29C7 0
78 B 31ms
31ms Script
application/javascript 2a00:1450:4001:81a::2013
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL: https://w-it.m-t.io/track?campaignId=99582&clickId=274615_99582_15713110340579_d00a86b44f&programId=274615&expiry=1579087034&acc=wg&scriptTag=1571311034352-274615-5078785&type=postview&indicator=77c0d399223919cbd9154436cbf2d5bd&
Requested by: Host: analytics.webgains.io
URL: https://analytics.webgains.io/clk.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:4001:81a::2013 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software: Google Frontend /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.itwbooking.bjquwhcm.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

status: 200
x-cloud-trace-context: 7917e36046e4151f170c14567a009ce9
server: Google Frontend
date: Thu, 17 Oct 2019 11:17:14 GMT
content-length: 0
content-type: application/javascript;charset=utf-8

GET
H/1.1 200
OK ck-confirm
tags.mathtag.com/ Frame 29C7 49 B
328 B 31ms
30ms Image
image/gif 185.29.133.52
MediaMath Inc

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tags.mathtag.com/ck-confirm?bid_id=712362346163147449&node_id=39&exch_id=15&mathid_data=%7B%22dv1%22%3A%22TW96aWxsYS81LjAgKE1hY2ludG9zaDsgSW50ZWwgTWFjIE9TIFggMTBfMTRfNSkgQXBwbGVXZWJLaXQvNTM3LjM2IChLSFRNTCwgbGlrZSBHZWNrbykgQ2hyb21lLzc0LjAuMzcyOS4xNjkgU2FmYXJpLzUzNy4zNg%3D%3D%22%2C%22dv2%22%3A%22NWI2NjgwZjU1ZmFiYmMxM2YxMGMwMDgyNTM4NjQ0OTk%3D%22%2C%22dv3%22%3A%22%22%2C%22dv4%22%3A%22MTYwMHwxMjAwfDE2MDB8MTIwMHwyNHx8%22%2C%22dv5%22%3A%22RXVyb3BlL0Jlcmxpbg%3D%3D%22%2C%22dv6%22%3A%22%22%2C%22dv7%22%3A%22MA%3D%3D%22%2C%22dv8%22%3A%22ZmFsc2V8dHJ1ZXx0cnVl%22%2C%22dv9%22%3A%22fGVuLVVTfA%3D%3D%22%2C%22dv10%22%3A%22TW96aWxsYXxOZXRzY2FwZXxMaW51eCB4ODZfNjR8%22%7D
Requested by: Host: www.itwbooking.bjquwhcm.com
URL: https://www.itwbooking.bjquwhcm.com/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.29.133.52 , United Kingdom, ASN30419 (MEDIAMATH-INC - MediaMath Inc, US),
Reverse DNS
Software: MMBD/3.157.2 /
Resource Hash: 1cd58a827318c4a29b32a0db15c8c39d5651b42d8cad227519ad81bce4adb944

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.itwbooking.bjquwhcm.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Thu, 17 Oct 2019 11:17:14 GMT
Server: MMBD/3.157.2
Content-Type: image/gif
Cache-Control: no-cache
x-mm-host: zrh-router-x42, zrh-bidder-x7
Connection: keep-alive
Keep-Alive: timeout=360
Content-Length: 49
Expires: Thu, 17 Oct 2019 11:17:13 GMT

GET
H2 200 activeview
pagead2.googlesyndication.com/pcs/ Frame 096A 42 B
111 B 17ms
17ms Image
image/gif 2a00:1450:4001:814::2002
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsu74sracw8TqXoIVYMC8p4RrpIG1dWMjCQPviKKfXuM8pGfRKb8RnxIY8YPId0joCzit9WgD28eahLYbQRWJf4MnhB5qqUwQnpJr5lnIUk&sig=Cg0ArKJSzDOh60EbuB0rEAE&id=ampim&o=792,733&d=1,1&ss=1600,1200&bs=1600,1200&mcvt=1002&mtos=0,0,1002,1002,1002&tos=0,0,1002,0,0&tfs=45&tls=1047&g=100&h=100&pt=116&tt=1047&rpt=116&rst=1571311033498&r=v&adk=2878570791&avms=ampa

Requested by

Host: www.itwbooking.bjquwhcm.com
URL: https://www.itwbooking.bjquwhcm.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:814::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.itwbooking.bjquwhcm.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 17 Oct 2019 11:17:14 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
status: 200
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
content-type: image/gif
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 activeview
pagead2.googlesyndication.com/pcs/ Frame 29C7 42 B
111 B 17ms
17ms Image
image/gif 2a00:1450:4001:814::2002
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjssKD0_YKryE2RS3mGXWJgkeVEwp7GVVLPFhrE1rROZBoXd1T2_u3JJYj0T9O30-J1cDjmtaIhD52d0EgP_HHlKocRkoDshyi2vKftn_Iyc&sig=Cg0ArKJSzItp_AUVZ2xoEAE&adk=3708889229&tt=-1&bs=1585%2C1200&mtos=1008,1008,1008,1008,1008&tos=1008,0,0,0,0&p=1110,429,1200,1157&mcvt=1008&rs=3&ht=0&tfs=520&tls=1528&mc=1&lte=1&bas=0&bac=0&met=no&avms=nio&niot_obs=9&niot_cbk=26&md=2&lm=2&rst=1571311033718&rpt=606&isd=0&msd=0&ext=mvo%3D-1%26brt%3D746&oseid=3&xdi=0&xosd=1&ps=1585%2C8214&ss=1600%2C1200&pt=-1&bin=1&deb=1-1-1-5-15-15-28-15-0-0-0&tvt=1518&r=v&id=osdim&vs=4&uc=12&upc=10&tgt=DIV&cl=1&cec=1&clc=1&cac=1&cd=0x0&itpl=19&v=20191014

Requested by

Host: www.itwbooking.bjquwhcm.com
URL: https://www.itwbooking.bjquwhcm.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:814::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.itwbooking.bjquwhcm.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 17 Oct 2019 11:17:15 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
status: 200
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
content-type: image/gif
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 publishertag.prebid.js Show response
static.criteo.net/js/ld/ 42 KB
14 KB 53ms
20ms Script
text/javascript 178.250.0.130
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL: https://static.criteo.net/js/ld/publishertag.prebid.js
Requested by: Host: ads.adthrive.com
URL: https://ads.adthrive.com/core/gdpr/vendor/prebid/prebid.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 178.250.0.130 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),
Reverse DNS
Software: nginx /
Resource Hash: 8e1d670a9b0de4b0e0848acabed1cc085b84c44a266e47298e3027fcebb55d5d

Request headers

Sec-Fetch-Mode: no-cors
Referer: https://www.itwbooking.bjquwhcm.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 17 Oct 2019 11:17:15 GMT
content-encoding: gzip
last-modified: Thu, 10 Oct 2019 07:51:08 GMT
server: nginx
etag: W/"5d9ee2ec-a74a"
status: 200
content-type: text/javascript
access-control-allow-origin: *
cache-control: max-age=86400, public
timing-allow-origin: *
expires: Fri, 18 Oct 2019 11:17:15 GMT

POST
H/1.1 200
OK auction Show response
prebid.adnxs.com/pbs/v1/openrtb2/ 127 B
485 B 154ms
128ms XHR
application/json 37.252.161.184
AppNexus

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid.adnxs.com/pbs/v1/openrtb2/auction
Requested by: Host: ads.adthrive.com
URL: https://ads.adthrive.com/core/gdpr/vendor/prebid/prebid.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 37.252.161.184 , Ascension Island, ASN29990 (ASN-APPNEXUS - AppNexus, Inc, US),
Reverse DNS: prebid.ams1.adnexus.net
Software: nginx/1.13.10 /
Resource Hash: d3002495ee50fe8b18952545f65b74204782d8292a644238d1139563f1f9c9fb

Request headers

Sec-Fetch-Mode: cors
Referer: https://www.itwbooking.bjquwhcm.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Thu, 17 Oct 2019 11:17:43 GMT
Server: nginx/1.13.10
Vary: Origin
Content-Type: application/json
Access-Control-Allow-Origin: https://www.itwbooking.bjquwhcm.com
Cache-Control: no-cache, no-store, must-revalidate
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 127
Expires: 0

GET
H/1.1 200
OK trinity.json Show response
apex.go.sonobi.com/ 151 B
1 KB 154ms
129ms XHR
application/json 178.162.133.150
LEASEWEB-NL-AMS-0...

General

Check archive.org

Show headers Download Go to

Full URL

https://apex.go.sonobi.com/trinity.json?key_maker=%7B%221923e35c0719e63c%22%3A%2208546c43f1c9c99b2f34%7C728x90%2C320x50%2C970x250%2C970x90%2C300x50%2C320x100%2C468x60%2C1x1%2C728x250%22%7D&ref=https%3A%2F%2Fwww.itwbooking.bjquwhcm.com%2F&s=b82a9a66-3c7a-48fc-b5c1-bfcc5587dca5&pv=d60d2552-2971-4b84-8675-01f1fb3dd5b2&vp=desktop&lib_name=prebid&lib_v=2.32.0&us=5&ius=1&gdpr=false&

Requested by

Host: ads.adthrive.com
URL: https://ads.adthrive.com/core/gdpr/vendor/prebid/prebid.min.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

178.162.133.150 , Netherlands, ASN60781 (LEASEWEB-NL-AMS-01 Netherlands, NL),

Reverse DNS

ams-1-apex.go.sonobi.com

Software

sonobi-go /

Resource Hash

67701da10fde40445bec6f2d334ec51bffe4b52cd0434ac2a7831765c3549bf6

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: cors
Referer: https://www.itwbooking.bjquwhcm.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Thu, 17 Oct 2019 11:17:41 GMT
Content-Encoding: gzip
Server: sonobi-go
Vary: negotiate,Accept-Encoding
X-Go-Server: apex-ams-1-6-132
P3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Access-Control-Allow-Origin: https://www.itwbooking.bjquwhcm.com
Cache-Control: no-cache, no-store, private
Access-Control-Allow-Credentials: true
Tcn: Choice
Content-Type: application/json
Content-Length: 152
X-Xss-Protection: 0
Expires: Sat, 26 Jul 1997 05:00:00 GMT

POST
H/1.1 200
OK prebid Show response
ib.adnxs.com/ut/v3/ 146 B
1 KB 92ms
67ms XHR
application/json 185.33.223.216
AppNexus

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/ut/v3/prebid

Requested by

Host: ads.adthrive.com
URL: https://ads.adthrive.com/core/gdpr/vendor/prebid/prebid.min.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.33.223.216 , Netherlands, ASN29990 (ASN-APPNEXUS - AppNexus, Inc, US),

Reverse DNS

312.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net

Software

nginx/1.13.4 /

Resource Hash

b538e1cf2ac5e30dbf2cbf1d6cfa0e05025d89a13e7173978b6f9400c0a41cd6

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: cors
Referer: https://www.itwbooking.bjquwhcm.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Thu, 17 Oct 2019 11:17:43 GMT
X-Proxy-Origin: 144.76.109.30; 144.76.109.30; 312.bm-nginx-loadbalancer.mgmt.ams1; *.adnxs.com; 185.33.223.58:80
AN-X-Request-Uuid: 2e684cfe-8cfb-4b4c-b731-c9ec6cae3d39
Server: nginx/1.13.4
P3P: policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: https://www.itwbooking.bjquwhcm.com
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/json; charset=utf-8
Content-Length: 146
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H/1.1 200
OK fastlane.json Show response
fastlane.rubiconproject.com/a/api/ 3 KB
3 KB 121ms
88ms XHR
application/json 69.173.144.141
The Rubicon Project

General

Check archive.org

Show headers Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=9262&site_id=180726&zone_id=881422&size_id=2&alt_size_ids=1%2C43%2C44%2C55%2C57%2C117&p_pos=unknown&rf=https%3A%2F%2Fwww.itwbooking.bjquwhcm.com%2F&tk_flint=pbjs_lite_v2.32.0&x_source.tid=fdc4279e-eb77-4e2f-b389-0d8611065295&p_screen_res=1600x1200&rp_floor=0.01&rp_secure=1&slots=1&rand=0.9992986073400261
Requested by: Host: ads.adthrive.com
URL: https://ads.adthrive.com/core/gdpr/vendor/prebid/prebid.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_128_GCM
Server: 69.173.144.141 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT - The Rubicon Project, Inc., US),
Reverse DNS
Software: RAS 2.4 /
Resource Hash: bfb85c1805c04ce5aea2aa3b318ef05b2bb3e662578443c9561861f429561873

Request headers

Sec-Fetch-Mode: cors
Referer: https://www.itwbooking.bjquwhcm.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Thu, 17 Oct 2019 11:17:41 GMT
Content-Encoding: gzip
Server: RAS 2.4
Vary: Accept-Encoding
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Access-Control-Allow-Origin: https://www.itwbooking.bjquwhcm.com
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Access-Control-Allow-Credentials: true
Connection: Keep-Alive
Content-Type: application/json
Keep-Alive: timeout=5, max=297
Content-Length: 1500
Expires: Wed, 17 Sep 1975 21:32:10 GMT

POST
H2 204 translator Show response
hbopenbid.pubmatic.com/ 0
69 B 174ms
172ms XHR
text/plain 185.64.189.112
PubMatic

General

Check archive.org

Show headers Download Go to

Full URL: https://hbopenbid.pubmatic.com/translator?source=prebid-client
Requested by: Host: ads.adthrive.com
URL: https://ads.adthrive.com/core/gdpr/vendor/prebid/prebid.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.64.189.112 , United Kingdom, ASN62713 (AS-PUBMATIC - PubMatic, Inc., US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Sec-Fetch-Mode: cors
Referer: https://www.itwbooking.bjquwhcm.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: text/plain

Response headers

status: 204
date: Thu, 17 Oct 2019 11:17:41 GMT
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
access-control-allow-origin: https://www.itwbooking.bjquwhcm.com

GET
H/1.1 200
OK cygnus Show response
as-sec.casalemedia.com/ 26 B
918 B 257ms
246ms XHR
application/json 2.18.234.21
Akamai Technologies

General

Check archive.org

Show headers Download Go to

Full URL: https://as-sec.casalemedia.com/cygnus?s=185774&v=7.2&r=%7B%22id%22%3A%221999b045990f13c4%22%2C%22imp%22%3A%5B%7B%22id%22%3A%22200d7a389ebc2644%22%2C%22banner%22%3A%7B%22w%22%3A728%2C%22h%22%3A90%2C%22topframe%22%3A1%7D%2C%22ext%22%3A%7B%22siteID%22%3A%22185774%22%2C%22sid%22%3A%2215_1%22%7D%7D%2C%7B%22id%22%3A%222017ac92c6cddb4e%22%2C%22banner%22%3A%7B%22w%22%3A970%2C%22h%22%3A250%2C%22topframe%22%3A1%7D%2C%22ext%22%3A%7B%22siteID%22%3A%22185774%22%2C%22sid%22%3A%2215_3%22%7D%7D%2C%7B%22id%22%3A%222024d7e35c0298dd%22%2C%22banner%22%3A%7B%22w%22%3A320%2C%22h%22%3A50%2C%22topframe%22%3A1%7D%2C%22ext%22%3A%7B%22siteID%22%3A%22185774%22%2C%22sid%22%3A%2215_4%22%7D%7D%2C%7B%22id%22%3A%222039270414b8e865%22%2C%22banner%22%3A%7B%22w%22%3A970%2C%22h%22%3A90%2C%22topframe%22%3A1%7D%2C%22ext%22%3A%7B%22siteID%22%3A%22185774%22%2C%22sid%22%3A%2215_2%22%7D%7D%5D%2C%22site%22%3A%7B%22page%22%3A%22https%3A%2F%2Fwww.itwbooking.bjquwhcm.com%2F%3F%23Refresh%3ATrue%23PD%3Adesktop%23Topic%3AFamily%20and%20Parenting%23Topic%3AHome%20Decor%20and%20Design%23Topic%3AFood%23Topic%3ATravel%23Topic%3AWomens%20Style%23Topic%3Aholmm1%23Topic%3Ahlwn1%23Topic%3Abkf1%23MCMP%3A%22%7D%2C%22ext%22%3A%7B%22source%22%3A%22prebid%22%7D%2C%22regs%22%3A%7B%22ext%22%3A%7B%22gdpr%22%3A0%7D%7D%2C%22user%22%3A%7B%22ext%22%3A%7B%22consent%22%3A%22%22%7D%7D%7D&ac=j&sd=1&
Requested by: Host: ads.adthrive.com
URL: https://ads.adthrive.com/core/gdpr/vendor/prebid/prebid.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.18.234.21 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS: a2-18-234-21.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: 9cddb0c618605df4988bccd4b141e11e755691c01ac43aa12fb277cb2432651d

Request headers

Sec-Fetch-Mode: cors
Referer: https://www.itwbooking.bjquwhcm.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Thu, 17 Oct 2019 11:17:41 GMT
Content-Encoding: gzip
Server: Apache
Vary: Accept-Encoding
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Access-Control-Allow-Origin: https://www.itwbooking.bjquwhcm.com
Cache-Control: max-age=0, no-cache, no-store
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/json
Content-Length: 46
Expires: Thu, 17 Oct 2019 11:17:41 GMT

GET
H2 200 arj Show response
cafemedia-d.openx.net/w/1.0/ 172 B
356 B 29ms
28ms XHR
application/json 34.95.120.147
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL: https://cafemedia-d.openx.net/w/1.0/arj?ju=https%3A%2F%2Fwww.itwbooking.bjquwhcm.com%2F&jr=&ch=UTF-8&res=1600x1200x24&ifr=false&tz=-120&tws=1600x1200&be=1&bc=hb_pb_2.1.7&dddid=fdc4279e-eb77-4e2f-b389-0d8611065295&nocache=1571311061529&aus=728x90%2C320x50%2C970x250%2C970x90%2C300x50%2C320x100%2C468x60%2C1x1%2C728x250&divIds=AdThrive_Header_1_desktop&auid=538699873&tps=aGlfYXU9&
Requested by: Host: ads.adthrive.com
URL: https://ads.adthrive.com/core/gdpr/vendor/prebid/prebid.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.95.120.147 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS: 147.120.95.34.bc.googleusercontent.com
Software: OXGW/16.163.0 /
Resource Hash: dd2b5f8a499eece26eb4e8f46fd5f0f0336dd06043b9df90d7a809d3eafc09ca

Request headers

Sec-Fetch-Mode: cors
Referer: https://www.itwbooking.bjquwhcm.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Thu, 17 Oct 2019 11:17:41 GMT
via: 1.1 google
server: OXGW/16.163.0
status: 200
vary: Accept
p3p: CP="CUR ADM OUR NOR STA NID"
access-control-allow-origin: https://www.itwbooking.bjquwhcm.com
cache-control: private, max-age=0, no-cache
access-control-allow-credentials: true
content-type: application/json
alt-svc: clear
content-length: 172
expires: Mon, 26 Jul 1997 05:00:00 GMT

POST
H/1.1 200
OK prebid Show response
ib.adnxs.com/ut/v3/ 145 B
1 KB 66ms
42ms XHR
application/json 185.33.223.216
AppNexus

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/ut/v3/prebid

Requested by

Host: ads.adthrive.com
URL: https://ads.adthrive.com/core/gdpr/vendor/prebid/prebid.min.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.33.223.216 , Netherlands, ASN29990 (ASN-APPNEXUS - AppNexus, Inc, US),

Reverse DNS

312.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net

Software

nginx/1.13.4 /

Resource Hash

c088e39a5f6c8f5bb5f8918a5c190fe5aaf41db798d2396afc3c6ac28caaba61

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: cors
Referer: https://www.itwbooking.bjquwhcm.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Thu, 17 Oct 2019 11:17:43 GMT
X-Proxy-Origin: 144.76.109.30; 144.76.109.30; 312.bm-nginx-loadbalancer.mgmt.ams1; *.adnxs.com; 185.33.222.238:80
AN-X-Request-Uuid: dce2545d-222f-43b2-bbb3-c78994640d3b
Server: nginx/1.13.4
P3P: policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: https://www.itwbooking.bjquwhcm.com
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/json; charset=utf-8
Content-Length: 145
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

POST
H/1.1 200
OK bid Show response
ap.lijit.com/rtb/ 25 B
489 B 49ms
23ms XHR
application/json 72.251.249.14
Internap Corporation

General

Check archive.org

Show headers Download Go to

Full URL: https://ap.lijit.com/rtb/bid?src=prebid_prebid_2.32.0
Requested by: Host: ads.adthrive.com
URL: https://ads.adthrive.com/core/gdpr/vendor/prebid/prebid.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 72.251.249.14 Amsterdam, Netherlands, ASN29791 (VOXEL-DOT-NET - Internap Corporation, US),
Reverse DNS
Software: nginx /
Resource Hash: 3dbcc657282addb94b06cb03e7364b7b9b96fcf9c80589e555eebe902df88459

Request headers

Sec-Fetch-Mode: cors
Referer: https://www.itwbooking.bjquwhcm.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: text/plain

Response headers

Date: Thu, 17 Oct 2019 11:17:41 GMT
Content-Encoding: gzip
Server: nginx
Transfer-Encoding: chunked
Vary: Accept-Encoding
Access-Control-Allow-Methods: GET, POST, DELETE, PUT
Content-Type: application/json
Access-Control-Allow-Origin: https://www.itwbooking.bjquwhcm.com
Access-Control-Allow-Credentials: true
X-Sovrn-Pod: ap1ams1
Access-Control-Allow-Headers: X-Requested-With, Content-Type

POST
H2 204 v1 Show response
dmx.districtm.io/b/ 0
157 B 112ms
112ms XHR
text/plain 104.16.190.66
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL

https://dmx.districtm.io/b/v1

Requested by

Host: ads.adthrive.com
URL: https://ads.adthrive.com/core/gdpr/vendor/prebid/prebid.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.190.66 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

Sec-Fetch-Mode: cors
Referer: https://www.itwbooking.bjquwhcm.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: application/json

Response headers

date: Thu, 17 Oct 2019 11:17:41 GMT
cf-cache-status: DYNAMIC
server: cloudflare
status: 204
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: origin
access-control-allow-methods: OPTIONS, POST
access-control-allow-origin: https://www.itwbooking.bjquwhcm.com
access-control-allow-credentials: true
strict-transport-security: max-age=31536000; includeSubDomains; preload
cf-ray: 5271de1749e4d6bd-FRA
access-control-allow-headers: origin, content-type

POST
H2 200 bid-request Show response
a.teads.tv/hb/ 16 B
366 B 59ms
58ms XHR
application/json 2.18.232.7
Akamai Technologies

General

Check archive.org

Show headers Download Go to

Full URL: https://a.teads.tv/hb/bid-request
Requested by: Host: ads.adthrive.com
URL: https://ads.adthrive.com/core/gdpr/vendor/prebid/prebid.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.18.232.7 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS: a2-18-232-7.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 6a7b0c8bf87b2bd5ca31557f25cf2a6c80f93af72bf68a6085e9b55a87fe908c

Request headers

Sec-Fetch-Mode: cors
Referer: https://www.itwbooking.bjquwhcm.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Thu, 17 Oct 2019 11:17:41 GMT
content-encoding: gzip
status: 200
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: https://www.itwbooking.bjquwhcm.com
cache-control: max-age=0, no-cache, no-store
access-control-allow-credentials: true
content-length: 42
expires: Thu, 17 Oct 2019 11:17:41 GMT

POST
H2 200 auction Show response
tlx.3lift.com/header/ 19 B
565 B 20ms
19ms XHR
application/json 52.58.198.43
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL

https://tlx.3lift.com/header/auction?lib=prebid&v=2.32.0&referrer=https%3A%2F%2Fwww.itwbooking.bjquwhcm.com%2F&tmax=2000

Requested by

Host: ads.adthrive.com
URL: https://ads.adthrive.com/core/gdpr/vendor/prebid/prebid.min.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.58.198.43 Frankfurt am Main, Germany, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),

Reverse DNS

ec2-52-58-198-43.eu-central-1.compute.amazonaws.com

Software

Resource Hash

0535c3bb3a17e4ac0fb7d29214d2181275662129dc2bdd2a89c35934e9fc5ba5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: cors
Referer: https://www.itwbooking.bjquwhcm.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Thu, 17 Oct 2019 11:17:41 GMT
x-auction-status: 3
status: 200
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
access-control-allow-origin: https://www.itwbooking.bjquwhcm.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
content-type: application/json; charset=utf-8
content-length: 19
x-xss-protection: 0
expires: Thu, 15 Oct 1992 20:10:00 GMT

POST
H2 200 cdb Show response
bidder.criteo.com/ 376 B
380 B 16ms
16ms XHR
application/json 178.250.2.152
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL: https://bidder.criteo.com/cdb?ptv=74&profileId=185&av=20&wv=2.32.0&cb=18054751184
Requested by: Host: ads.adthrive.com
URL: https://ads.adthrive.com/core/gdpr/vendor/prebid/prebid.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 178.250.2.152 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),
Reverse DNS
Software: Finatra /
Resource Hash: 9bffc61a75e1a781f4c57fe81b218952707cc1ddc6a59cc0e98d77663f267181

Request headers

Sec-Fetch-Mode: cors
Referer: https://www.itwbooking.bjquwhcm.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: text/plain

Response headers

date: Thu, 17 Oct 2019 11:17:41 GMT
content-encoding: gzip
server: Finatra
status: 200
vary: Origin
content-type: application/json; charset=utf-8
access-control-allow-origin: https://www.itwbooking.bjquwhcm.com
access-control-allow-credentials: true
timing-allow-origin: *
content-length: 161

POST
H/1.1 200
OK auction Show response
prebid.adnxs.com/pbs/v1/openrtb2/ 126 B
484 B 112ms
111ms XHR
application/json 37.252.161.184
AppNexus

General

Check archive.org

Show headers Download Go to

Full URL: https://prebid.adnxs.com/pbs/v1/openrtb2/auction
Requested by: Host: ads.adthrive.com
URL: https://ads.adthrive.com/core/gdpr/vendor/prebid/prebid.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 37.252.161.184 , Ascension Island, ASN29990 (ASN-APPNEXUS - AppNexus, Inc, US),
Reverse DNS: prebid.ams1.adnexus.net
Software: nginx/1.13.10 /
Resource Hash: 6b31ca05910830620622a6917d32cfd3102633cf0f04cff3b45895d6689c212f

Request headers

Sec-Fetch-Mode: cors
Referer: https://www.itwbooking.bjquwhcm.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Thu, 17 Oct 2019 11:17:43 GMT
Server: nginx/1.13.10
Vary: Origin
Content-Type: application/json
Access-Control-Allow-Origin: https://www.itwbooking.bjquwhcm.com
Cache-Control: no-cache, no-store, must-revalidate
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 126
Expires: 0

POST
H2 200 bid-request Show response
a.teads.tv/hb/ 16 B
257 B 38ms
37ms XHR
application/json 2.18.232.7
Akamai Technologies

General

Check archive.org

Show headers Download Go to

Full URL: https://a.teads.tv/hb/bid-request
Requested by: Host: ads.adthrive.com
URL: https://ads.adthrive.com/core/gdpr/vendor/prebid/prebid.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.18.232.7 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS: a2-18-232-7.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 6a7b0c8bf87b2bd5ca31557f25cf2a6c80f93af72bf68a6085e9b55a87fe908c

Request headers

Sec-Fetch-Mode: cors
Referer: https://www.itwbooking.bjquwhcm.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Thu, 17 Oct 2019 11:17:41 GMT
content-encoding: gzip
status: 200
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: https://www.itwbooking.bjquwhcm.com
cache-control: max-age=0, no-cache, no-store
access-control-allow-credentials: true
content-length: 42
expires: Thu, 17 Oct 2019 11:17:41 GMT

POST
H2 204 v1 Show response
dmx.districtm.io/b/ 0
38 B 115ms
115ms XHR
text/plain 104.16.190.66
Cloudflare

General

Check archive.org

Show headers Download Go to

Full URL

https://dmx.districtm.io/b/v1

Requested by

Host: ads.adthrive.com
URL: https://ads.adthrive.com/core/gdpr/vendor/prebid/prebid.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.190.66 , United States, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

Sec-Fetch-Mode: cors
Referer: https://www.itwbooking.bjquwhcm.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: application/json

Response headers

date: Thu, 17 Oct 2019 11:17:41 GMT
cf-cache-status: DYNAMIC
server: cloudflare
status: 204
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: origin
access-control-allow-methods: OPTIONS, POST
access-control-allow-origin: https://www.itwbooking.bjquwhcm.com
access-control-allow-credentials: true
strict-transport-security: max-age=31536000; includeSubDomains; preload
cf-ray: 5271de18ada5d6bd-FRA
access-control-allow-headers: origin, content-type

POST
H/1.1 200
OK bid Show response
ap.lijit.com/rtb/ 25 B
489 B 19ms
19ms XHR
application/json 72.251.249.14
Internap Corporation

General

Check archive.org

Show headers Download Go to

Full URL: https://ap.lijit.com/rtb/bid?src=prebid_prebid_2.32.0
Requested by: Host: ads.adthrive.com
URL: https://ads.adthrive.com/core/gdpr/vendor/prebid/prebid.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 72.251.249.14 Amsterdam, Netherlands, ASN29791 (VOXEL-DOT-NET - Internap Corporation, US),
Reverse DNS
Software: nginx /
Resource Hash: 166fe2e06f8ddf2e2e441ac2c97319c9b4920015facf0bac290b866ecd534bd9

Request headers

Sec-Fetch-Mode: cors
Referer: https://www.itwbooking.bjquwhcm.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: text/plain

Response headers

Date: Thu, 17 Oct 2019 11:17:41 GMT
Content-Encoding: gzip
Server: nginx
Transfer-Encoding: chunked
Vary: Accept-Encoding
Access-Control-Allow-Methods: GET, POST, DELETE, PUT
Content-Type: application/json
Access-Control-Allow-Origin: https://www.itwbooking.bjquwhcm.com
Access-Control-Allow-Credentials: true
X-Sovrn-Pod: ap1ams1
Access-Control-Allow-Headers: X-Requested-With, Content-Type

POST
H2 204 cdb Show response
bidder.criteo.com/ 0
157 B 13ms
13ms XHR
text/plain 178.250.2.152
ASN-CRITEO-EUROPE

General

Check archive.org

Show headers Download Go to

Full URL: https://bidder.criteo.com/cdb?ptv=74&profileId=185&av=20&wv=2.32.0&cb=83904635348
Requested by: Host: ads.adthrive.com
URL: https://ads.adthrive.com/core/gdpr/vendor/prebid/prebid.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 178.250.2.152 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),
Reverse DNS
Software: Finatra /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Sec-Fetch-Mode: cors
Referer: https://www.itwbooking.bjquwhcm.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: text/plain

Response headers

status: 204
date: Thu, 17 Oct 2019 11:17:41 GMT
access-control-allow-credentials: true
server: Finatra
access-control-allow-origin: https://www.itwbooking.bjquwhcm.com
timing-allow-origin: *
vary: Origin

GET
H2 200 imp Show response
g2.gumgum.com/hbid/ 942 B
1 KB 37ms
37ms XHR
application/json 52.51.196.221
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://g2.gumgum.com/hbid/imp?pv=3ca26f99-e33d-4853-925a-60a1df571a58&t=g95nznmj&pi=2&gdprApplies=0&vw=1600&vh=1200&sw=1600&sh=1200&pu=https%3A%2F%2Fwww.itwbooking.bjquwhcm.com%2F&ce=true&dpr=1&jcsi=%7B%22t%22%3A0%2C%22rq%22%3A8%7D&ogu=https%3A%2F%2Fhitherandthither.net%2F&ns=10240&
Requested by: Host: ads.adthrive.com
URL: https://ads.adthrive.com/core/gdpr/vendor/prebid/prebid.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.51.196.221 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: ec2-52-51-196-221.eu-west-1.compute.amazonaws.com
Software: nginx /
Resource Hash: a448712fe848f122c6456889704b10a01b47227a2a14e1902a630c13869ea289

Request headers

Sec-Fetch-Mode: cors
Referer: https://www.itwbooking.bjquwhcm.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Thu, 17 Oct 2019 11:17:41 GMT
content-encoding: gzip
content-type: application/json;charset=UTF-8
server: nginx
status: 200
p3p: CP="This is not a P3P policy"
access-control-allow-origin: https://www.itwbooking.bjquwhcm.com
cache-control: private, no-store, must-revalidate, max-age=0
access-control-allow-credentials: true
timing-allow-origin: *
expires: 0

GET
H/1.1 200
OK trinity.json Show response
apex.go.sonobi.com/ 151 B
1 KB 25ms
25ms XHR
application/json 178.162.133.150
LEASEWEB-NL-AMS-0...

General

Check archive.org

Show headers Download Go to

Full URL

https://apex.go.sonobi.com/trinity.json?key_maker=%7B%2223857a1b211e8114%22%3A%22d27a3a50cff6192a4f81%7C728x90%2C320x50%2C970x90%2C300x50%2C320x100%2C468x60%2C1x1%22%7D&ref=https%3A%2F%2Fwww.itwbooking.bjquwhcm.com%2F&s=71e3019b-39b9-4123-8a28-de6703543285&pv=d60d2552-2971-4b84-8675-01f1fb3dd5b2&vp=desktop&lib_name=prebid&lib_v=2.32.0&us=5&ius=1&gdpr=false&

Requested by

Host: ads.adthrive.com
URL: https://ads.adthrive.com/core/gdpr/vendor/prebid/prebid.min.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

178.162.133.150 , Netherlands, ASN60781 (LEASEWEB-NL-AMS-01 Netherlands, NL),

Reverse DNS

ams-1-apex.go.sonobi.com

Software

sonobi-go /

Resource Hash

044fb0f190df4554b3b18e93cf7871f33a4c533d00788f3c4aff1627f510dad3

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: cors
Referer: https://www.itwbooking.bjquwhcm.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Thu, 17 Oct 2019 11:17:41 GMT
Content-Encoding: gzip
Server: sonobi-go
Vary: negotiate,Accept-Encoding
X-Go-Server: apex-ams-1-6-132
P3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Access-Control-Allow-Origin: https://www.itwbooking.bjquwhcm.com
Cache-Control: no-cache, no-store, private
Access-Control-Allow-Credentials: true
Tcn: Choice
Content-Type: application/json
Content-Length: 152
X-Xss-Protection: 0
Expires: Sat, 26 Jul 1997 05:00:00 GMT

POST
H2 200 auction Show response
tlx.3lift.com/header/ 19 B
565 B 7ms
6ms XHR
application/json 52.58.198.43
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL

https://tlx.3lift.com/header/auction?lib=prebid&v=2.32.0&referrer=https%3A%2F%2Fwww.itwbooking.bjquwhcm.com%2F&tmax=2000

Requested by

Host: ads.adthrive.com
URL: https://ads.adthrive.com/core/gdpr/vendor/prebid/prebid.min.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.58.198.43 Frankfurt am Main, Germany, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),

Reverse DNS

ec2-52-58-198-43.eu-central-1.compute.amazonaws.com

Software

Resource Hash

0535c3bb3a17e4ac0fb7d29214d2181275662129dc2bdd2a89c35934e9fc5ba5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: cors
Referer: https://www.itwbooking.bjquwhcm.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Thu, 17 Oct 2019 11:17:41 GMT
x-auction-status: 3
status: 200
p3p: policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
access-control-allow-origin: https://www.itwbooking.bjquwhcm.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
content-type: application/json; charset=utf-8
content-length: 19
x-xss-protection: 0
expires: Thu, 15 Oct 1992 20:10:00 GMT

POST
H/1.1 200
OK prebid Show response
ib.adnxs.com/ut/v3/ 146 B
1 KB 128ms
128ms XHR
application/json 185.33.223.216
AppNexus

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/ut/v3/prebid

Requested by

Host: ads.adthrive.com
URL: https://ads.adthrive.com/core/gdpr/vendor/prebid/prebid.min.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.33.223.216 , Netherlands, ASN29990 (ASN-APPNEXUS - AppNexus, Inc, US),

Reverse DNS

312.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net

Software

nginx/1.13.4 /

Resource Hash

4546fb07808b44b1ab4f71750062f1ed9ef4e19426120a0d9cb6e46b9d491912

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: cors
Referer: https://www.itwbooking.bjquwhcm.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Thu, 17 Oct 2019 11:17:43 GMT
X-Proxy-Origin: 144.76.109.30; 144.76.109.30; 312.bm-nginx-loadbalancer.mgmt.ams1; *.adnxs.com; 185.33.223.167:80
AN-X-Request-Uuid: a47ee3fc-2ee4-4645-b074-b899172e32c0
Server: nginx/1.13.4
P3P: policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: https://www.itwbooking.bjquwhcm.com
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/json; charset=utf-8
Content-Length: 146
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H/1.1 200
OK fastlane.json Show response
fastlane.rubiconproject.com/a/api/ 3 KB
2 KB 89ms
89ms XHR
application/json 69.173.144.141
The Rubicon Project

General

Check archive.org

Show headers Download Go to

Full URL: https://fastlane.rubiconproject.com/a/api/fastlane.json?account_id=9262&site_id=180726&zone_id=881416&size_id=2&alt_size_ids=1%2C43%2C44%2C55%2C117&p_pos=unknown&rf=https%3A%2F%2Fwww.itwbooking.bjquwhcm.com%2F&tk_flint=pbjs_lite_v2.32.0&x_source.tid=fb520e3f-25af-4ee1-b956-a057c8d7fe13&p_screen_res=1600x1200&rp_floor=0.01&rp_secure=1&slots=1&rand=0.28952002438678615
Requested by: Host: ads.adthrive.com
URL: https://ads.adthrive.com/core/gdpr/vendor/prebid/prebid.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_128_GCM
Server: 69.173.144.141 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT - The Rubicon Project, Inc., US),
Reverse DNS
Software: RAS 2.4 /
Resource Hash: 846886d99ef41daf29aef58d71aee6d995f0bee00bc26f4159962c72c5245c71

Request headers

Sec-Fetch-Mode: cors
Referer: https://www.itwbooking.bjquwhcm.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Thu, 17 Oct 2019 11:17:41 GMT
Content-Encoding: gzip
Server: RAS 2.4
Vary: Accept-Encoding
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Access-Control-Allow-Origin: https://www.itwbooking.bjquwhcm.com
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Access-Control-Allow-Credentials: true
Connection: Keep-Alive
Content-Type: application/json
Keep-Alive: timeout=5, max=198
Content-Length: 1503
Expires: Wed, 17 Sep 1975 21:32:10 GMT

POST
H2 204 translator Show response
hbopenbid.pubmatic.com/ 0
69 B 14ms
13ms XHR
text/plain 185.64.189.112
PubMatic

General

Check archive.org

Show headers Download Go to

Full URL: https://hbopenbid.pubmatic.com/translator?source=prebid-client
Requested by: Host: ads.adthrive.com
URL: https://ads.adthrive.com/core/gdpr/vendor/prebid/prebid.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.64.189.112 , United Kingdom, ASN62713 (AS-PUBMATIC - PubMatic, Inc., US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Sec-Fetch-Mode: cors
Referer: https://www.itwbooking.bjquwhcm.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: text/plain

Response headers

status: 204
date: Thu, 17 Oct 2019 11:17:41 GMT
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
access-control-allow-origin: https://www.itwbooking.bjquwhcm.com

GET
H/1.1 200
OK cygnus Show response
as-sec.casalemedia.com/ 26 B
918 B 202ms
191ms XHR
application/json 2.18.234.21
Akamai Technologies

General

Check archive.org

Show headers Download Go to

Full URL: https://as-sec.casalemedia.com/cygnus?s=185770&v=7.2&r=%7B%22id%22%3A%2224764330ff9ceafb%22%2C%22imp%22%3A%5B%7B%22id%22%3A%22248b7a5980df23ed%22%2C%22banner%22%3A%7B%22w%22%3A728%2C%22h%22%3A90%2C%22topframe%22%3A1%7D%2C%22ext%22%3A%7B%22siteID%22%3A%22185770%22%2C%22sid%22%3A%2212_1%22%7D%7D%2C%7B%22id%22%3A%222495467810fe2fe3%22%2C%22banner%22%3A%7B%22w%22%3A320%2C%22h%22%3A50%2C%22topframe%22%3A1%7D%2C%22ext%22%3A%7B%22siteID%22%3A%22185770%22%2C%22sid%22%3A%2212_3%22%7D%7D%2C%7B%22id%22%3A%222507689c52a975bb%22%2C%22banner%22%3A%7B%22w%22%3A970%2C%22h%22%3A90%2C%22topframe%22%3A1%7D%2C%22ext%22%3A%7B%22siteID%22%3A%22185770%22%2C%22sid%22%3A%2212_2%22%7D%7D%5D%2C%22site%22%3A%7B%22page%22%3A%22https%3A%2F%2Fwww.itwbooking.bjquwhcm.com%2F%3F%23Refresh%3ATrue%23PD%3Adesktop%23Topic%3AFamily%20and%20Parenting%23Topic%3AHome%20Decor%20and%20Design%23Topic%3AFood%23Topic%3ATravel%23Topic%3AWomens%20Style%23Topic%3Aholmm1%23Topic%3Ahlwn1%23Topic%3Abkf1%23MCMP%3A%22%7D%2C%22ext%22%3A%7B%22source%22%3A%22prebid%22%7D%2C%22regs%22%3A%7B%22ext%22%3A%7B%22gdpr%22%3A0%7D%7D%2C%22user%22%3A%7B%22ext%22%3A%7B%22consent%22%3A%22%22%7D%7D%7D&ac=j&sd=1&
Requested by: Host: ads.adthrive.com
URL: https://ads.adthrive.com/core/gdpr/vendor/prebid/prebid.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.18.234.21 , Ascension Island, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS: a2-18-234-21.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: bc1a94c78cc7737370be4771d747c1a2277916e3012436239a7fb02792b68973

Request headers

Sec-Fetch-Mode: cors
Referer: https://www.itwbooking.bjquwhcm.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Thu, 17 Oct 2019 11:17:41 GMT
Content-Encoding: gzip
Server: Apache
Vary: Accept-Encoding
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Access-Control-Allow-Origin: https://www.itwbooking.bjquwhcm.com
Cache-Control: max-age=0, no-cache, no-store
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/json
Content-Length: 46
Expires: Thu, 17 Oct 2019 11:17:41 GMT

GET arj
cafemedia-d.openx.net/w/1.0/ 0
0

POST
H/1.1 200
OK prebid Show response
ib.adnxs.com/ut/v3/ 145 B
1 KB 55ms
31ms XHR
application/json 185.33.223.216
AppNexus

General

Check archive.org

Show headers Download Go to

Full URL

https://ib.adnxs.com/ut/v3/prebid

Requested by

Host: ads.adthrive.com
URL: https://ads.adthrive.com/core/gdpr/vendor/prebid/prebid.min.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.33.223.216 , Netherlands, ASN29990 (ASN-APPNEXUS - AppNexus, Inc, US),

Reverse DNS

312.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net

Software

nginx/1.13.4 /

Resource Hash

f3b87feafc613df82db0984ba24177ee9eea2da8e5a03c4a6eabb1af291715db

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Sec-Fetch-Mode: cors
Referer: https://www.itwbooking.bjquwhcm.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: text/plain

Response headers

Pragma: no-cache
Date: Thu, 17 Oct 2019 11:17:43 GMT
X-Proxy-Origin: 144.76.109.30; 144.76.109.30; 312.bm-nginx-loadbalancer.mgmt.ams1; *.adnxs.com; 185.33.220.13:80
AN-X-Request-Uuid: 9da90041-28fd-4aae-9bef-8ed56c7a6156
Server: nginx/1.13.4
P3P: policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: https://www.itwbooking.bjquwhcm.com
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/json; charset=utf-8
Content-Length: 145
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: hello.myfonts.net
URL: http://hello.myfonts.net/count/2f2e86

Domain: gdprexclusion.dmpxs.com.s3-website.eu-west-3.amazonaws.com
URL: https://gdprexclusion.dmpxs.com.s3-website.eu-west-3.amazonaws.com/blank.js

Domain: cafemedia-d.openx.net
URL: https://cafemedia-d.openx.net/w/1.0/arj?ju=https%3A%2F%2Fwww.itwbooking.bjquwhcm.com%2F&jr=&ch=UTF-8&res=1600x1200x24&ifr=false&tz=-120&tws=1600x1200&be=1&bc=hb_pb_2.1.7&dddid=fb520e3f-25af-4ee1-b956-a057c8d7fe13&nocache=1571311061751&aus=728x90%2C320x50%2C970x90%2C300x50%2C320x100%2C468x60%2C1x1&divIds=AdThrive_Footer_1_desktop&auid=538699840&tps=aGlfYXU9&

Verdicts & Comments Add Verdict or Comment

113 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

7 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
console-api	log	URL: https://www.itwbooking.bjquwhcm.com/etdlwwyzs7ibptm965zo1lyq-wpengine.netdna-ssl.com/wp-includes/js/jquery/jquery-migrate.min330a.js?ver=1.4.1(Line 2) Message: JQMIGRATE: Migrate is installed, version 1.4.1
console-api	log	URL: https://ads.adthrive.com/core/v1/js/adthrive.min.js?threshold=34(Line 1) Message: %cAdThrive::init started color: #999; font-weight: bold;
console-api	info	URL: https://cdn.ampproject.org/rtv/011909241711100/amp4ads-v0.js(Line 527) Message: Powered by AMP ⚡ HTML – Version 1909241711100 https://www.itwbooking.bjquwhcm.com/
console-api	info	URL: https://cdn.ampproject.org/rtv/031910071804120/amp4ads-v0.js(Line 529) Message: Powered by AMP ⚡ HTML – Version 1910071804120 https://www.itwbooking.bjquwhcm.com/
console-api	info	URL: https://cdn.ampproject.org/rtv/011909241711100/amp4ads-v0.js(Line 527) Message: Powered by AMP ⚡ HTML – Version 1909241711100 https://www.itwbooking.bjquwhcm.com/
console-api	info	URL: https://cdn.ampproject.org/rtv/221910071804120/amp4ads-v0.js(Line 529) Message: Powered by AMP ⚡ HTML – Version 1910071804120 https://www.itwbooking.bjquwhcm.com/
console-api	log	URL: https://analytics.webgains.io/clk.min.js(Line 1) Message: W-IT I

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

5994599.fls.doubleclick.net
a.teads.tv
a3226.casalemedia.com
ad.zanox.com
ads.adthrive.com
adservice.google.com
adservice.google.de
analytics.webgains.io
ap.lijit.com
apex.go.sonobi.com
api.skimlinks.mgr.consensu.org
as-sec.casalemedia.com
bidder.criteo.com
cafemedia-d.openx.net
cdn.ampproject.org
clarium.global.ssl.fastly.net
diapi.webgains.com
dmx.districtm.io
etdlwwyzs7ibptm965zo1lyq-wpengine.netdna-ssl.com
fastlane.rubiconproject.com
fonts.googleapis.com
fonts.gstatic.com
g2.gumgum.com
gdprexclusion.dmpxs.com.s3-website.eu-west-3.amazonaws.com
hal9000.redintelligence.net
hal900037.redintelligence.net
hb.undertone.com
hbopenbid.pubmatic.com
hello.myfonts.net
hitherandthither.net
i.skimresources.com
ib.adnxs.com
lightwidget.com
loadeu.exelator.com
logger.adthrive.com
mathid.mathtag.com
p.skimresources.com
pagead2.googlesyndication.com
pb.media01.eu
pixel.mathtag.com
prebid.adnxs.com
protected-by.clarium.io
r.skimresources.com
sb.scorecardresearch.com
securepubads.g.doubleclick.net
static.criteo.net
static.fmpub.net
stats.g.doubleclick.net
sync.crwdcntrl.net
t.skimresources.com
tags.mathtag.com
tlx.3lift.com
tpc.googlesyndication.com
track.webgains.com
w-it.m-t.io
www.11teamsports.com
www.awin1.com
www.google-analytics.com
www.google.com
www.googletagservices.com
www.itwbooking.bjquwhcm.com
www.vehiculum.de
x.skimresources.com
cafemedia-d.openx.net
gdprexclusion.dmpxs.com.s3-website.eu-west-3.amazonaws.com
hello.myfonts.net
104.109.83.210
104.16.190.66
13.225.78.50
136.243.51.232
136.243.54.219
143.204.101.34
147.75.102.200
151.101.113.194
151.101.13.182
151.139.128.10
172.217.16.162
178.162.133.150
178.250.0.130
178.250.2.152
18.195.61.72
185.29.133.52
185.29.135.48
185.33.223.216
185.64.189.112
185.80.38.195
195.216.249.67
2.18.232.7
2.18.233.201
2.18.234.21
2.19.43.224
216.58.205.230
2600:9000:20eb:5600:9:352d:a240:93a1
2606:4700:10::6814:33ae
2606:4700:30::681b:b368
2606:4700:30::681c:c3d
2606:4700::6810:a727
2a00:1450:4001:800::2002
2a00:1450:4001:800::2004
2a00:1450:4001:80b::200e
2a00:1450:4001:814::2002
2a00:1450:4001:815::2002
2a00:1450:4001:81a::2013
2a00:1450:4001:81c::2002
2a00:1450:4001:81f::2001
2a00:1450:4001:821::2001
2a00:1450:4001:821::200a
2a00:1450:4001:825::2003
2a00:1450:400c:c04::9d
34.95.120.147
35.190.40.172
35.190.59.101
35.201.67.47
37.252.161.184
46.236.12.250
46.236.13.147
50.31.134.90
52.51.196.221
52.58.198.43
54.67.106.161
54.76.37.45
54.76.79.46
63.33.115.128
69.173.144.141
72.251.249.14
85.10.231.199
94.31.29.64
04239df4928b033d4a029c4a00bed9baf459e68d2e6b2f0dbccbef164f62babe
0443e8c80b41cec35957a39ae5eee9c4e6a34a178e649be29c52d85553a00bfd
044fb0f190df4554b3b18e93cf7871f33a4c533d00788f3c4aff1627f510dad3
0481304135fb3784cb4e1ae14d83b952abeae77693a4d1d00838c974cb5115f1
0482a98d09daebc18a0d2e1ed8f748da5b0179e61223ed541101df1f4699f073
0535c3bb3a17e4ac0fb7d29214d2181275662129dc2bdd2a89c35934e9fc5ba5
098900a62fc3bb14cd2248101ebb232511f555d88913a5a00f7cdd4ccf70fe76
0ba081f546084bd5097aa8a73c75931d5aa1fc4d6e846e53c21f98e6a1509988
0bb863f59549233b7c3b23886d1168914248570ebfbf5eb30cf9461f0883dd03
0dfc8902fd2900ef5cb13c84bbf526be4952bf715bcf609b4e92270db62e1e65
0e063443c9fc17b47a6c56347534058fd75e60bf5b6ff58cbfdc72472ecd93ab
0e210e8f0c85689be321f4e96c866c7cd2e75a6fcefd9c70bcb9a775eca240aa
0f0858d77245751f1e5908486cd3fb8919798139fdaa5f78bf40e1f4107ec6b2
105bed075d39d7162485d10257983e8f23285373c9702bc56c40533ea8507a41
133b0c64c47f07b312c0e294d0c10254bf9e405a6bcb7f7ccd05d7cab8ae333d
166fe2e06f8ddf2e2e441ac2c97319c9b4920015facf0bac290b866ecd534bd9
197c294e1520b32d787d2678660c02fd195c1c93fee3441de596ef22c34ed425
1b1ca0f15010e0124bd4ca481404643c88f7eda1b276e9554d0ed83fb45b7e30
1cd58a827318c4a29b32a0db15c8c39d5651b42d8cad227519ad81bce4adb944
1e5a81fa3340b71856efbd316d30533e585d9938aab23d7923dd62cdd7661dda
20b65e8f8de30a77aec4888993b537ab0aa6243c3ff5a5da2a816edf48b87643
2153b99005f54e6c1e2a727f6a5423071cf51d41fea05889e363b2ebf2e48b5d
232d3fbf590a584138bb563319747dbef0c9e41db91f19ff45d41e785a5f4f98
2595496fe48df6fcf9b1bc57c29a744c121eb4dd11566466bc13d2e52e6bbcc8
25a121474d3c82e8b9e8e2006f6337217dec7a551247351ca0e76ea754bffa1d
2c14bcd9fdbed13183fba882813ade21f5e803924b295c330d317eabbf8c7391
2cd72e38c4c6b45fa93aee7dbb399ac0badcd9fa885e63f5f6a666fb2ee1b146
2da6484d341f988b572a1cf4872eb857d39e816a7112de7e8209e695065ae975
2e9e23cd777ca027732622b59b32bcccaaf2564899eedc5c7e11b8fed8dde4d4
33860273adf897add00905f411573e4bbaab82f976ba670cac96cb1121a4dd9a
33e7cfb629c6fc28bec6f0039c2b843ac7d63cb54a883599ca33ce2384e251fa
35e135ac6cfcb9f681cc77bb55f8b7f6a055b82b6568babc372d7c6293e90158
377c8a27860862294f56f8ba7ec15484b681ffa1a530114a56f957baacbb7acd
37a8b06eab08134f2037c797f4596c7688dd564a8395cb7e072577f371d8f993
38f6b68eb85195bf01d9d78048f73791b66bd343d3ce384111d2355fc312cc5e
3a27595adae3d121a627554a2db70bf247bcb303f77a8846b066754ac38140f5
3a5f70c2bb1108d9f4f334225ed95af455338b1eb491e81f0e4c119f3ccf99c1
3b4905996edf524768740bc46f713c138c41c9b1af49d39b93e420e95f593a16
3d83e28a6481d86da8ba2a6a724617d25a711931819275502c0bcaf0ca49f3d1
3dbcc657282addb94b06cb03e7364b7b9b96fcf9c80589e555eebe902df88459
3f49ab4dde6b0ea517096e321122f485e4d5c6ec94c61a01dc5274c99da05010
4160263430f7a9af8def64cdfedc63629067d1e76e7127fd3172d8d99f8b596d
43c9a5ee3fd163a6a99bb61e34c68849684f12eaf7d281ca58b0692458dab182
440264cff5188aab5845f4fc061232648f3db4c5c19030c8136cdaf63e7db170
4546fb07808b44b1ab4f71750062f1ed9ef4e19426120a0d9cb6e46b9d491912
460167894ad901de30a5cf5e658a49a62375593f310b3efb56b4dceb21b99950
47ec836ca89dbd7753d41f563f4ea7394f4529a10ed5e5b6b8c997504240b5af
4898c2b9f8c2f931ef6a819d36e0019867931d9519af933ab4bd5edce724b2a8
48eb8b500ae6a38617b5738d2b3faec481922a7782246e31d2755c034a45cd5d
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49
4e27d292b3bde8504ee4c4a218bd9f4cac93db055082004fccd9c848bb0e2ad7
4f199aabd06ef777d574559d88fe197591dda8bf97877036f9639cfca693f58e
50009939c267cc52666aeb9ecced1dfee6071e79a2fbc939cc49a3ff1c21e17f
506882a5c80c401495783d6130a37b7a9105d807b04a8cba00c4ed8bbc481015
50b6a58af23a06c1dc2b5c68a5b0383cd87f8749caf956c35d8e79dde677f4bf
51288b1b3c35b6246e27c44d91bbe7b8da83f8bfc7182fc695c1d44cdeb57ef7
56f2841fe45d3b86b2f633cde34810835d804b869070ab9dc7bf66a00e63aba1
57ce2b08ef8da65d0f5627d6e41c7725efd32d3e377dea3c91025a375ae93fdf
5be95ba717fd38cf19615dca6a1e75b7f52a78fbe60295c5cb53c432371a0c3f
5bfb6d4691e1ec8296fad43d296a2c9d8185460e6ae2294766006233a5f55dc5
5feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9
5ff44f04f8f5c9162a0f3b94cdab16c1209b1a27da8c4f9807e7b8654a9b505c
60c223e599936a8606fade4273d8c785bcfb657dea40c6698904d1ee295a1da5
60d98ea9c0d9d9a106268f9ef7fadb16a5bb11523a623f020ef0f52705e9a475
63c297f6cb8e2e58bb21c0c509ba1f63e375715095293f4b67ff522774b5ee80
65e65f44373df2186697e92e7bef3257c80a918627f6a2e759e0638302374d04
6714e4568db4ecbeafc76e9cbc77c1fbd6de19c1b5b7603bc5bd68db08f601d9
67701da10fde40445bec6f2d334ec51bffe4b52cd0434ac2a7831765c3549bf6
69539b5b3777cffda28a66d7f2aa9b17c91ee1ec8fd50c00c442af91753a60f7
6a7b0c8bf87b2bd5ca31557f25cf2a6c80f93af72bf68a6085e9b55a87fe908c
6b31ca05910830620622a6917d32cfd3102633cf0f04cff3b45895d6689c212f
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
6cbf610854f96a518bc7858c1db0c389e414a8b1d99d3f928768602ecd3df5c9
6d032b4fb89fc2989dd99f1f9f27dad2d085e95b66e602ccda920b93dd840735
6d157866400e2e50e077448f9cf06a9f29f70e031612ad6679d3626909a4c4e5
6ec96c54f077ca13b9547200c26b24a0e16bf964cf2d7804955d906f46308f28
708084a0d69982fc434fd1c9712e8822d1ef49c438bda13c2298736e79b8af0c
723031ba032ca338ff8300fcfe6179862105ff2ca741f2ca89787d537d779576
72a11f11b9bad38740a435fa16b8c9d589ef4006162eb368cbd1fb9531e267ea
72a219f9673c9d5d1ea002ff638a2757eb2f7e888e3df92fbdd73101f24059f8
73e88dfcd0f3a535341fb641c5400fcf772ffe36c628241104f829d3cf48e29b
73f166a1b1c2b7f4b0e872901034f59e7dd8528492f0c4845b7761aef8f0db9e
76c393f564f53c19e795307e622edc8657a603f7a816c2646385697286d11313
79165f82c50f95e1b054f2a7f09f25ad16ce2b1ba66574cfde37a68096918325
7fc34714e3f622740bf2eb865fa6b0e09003d12bc4bd66cd316af50792b6735d
81ab8637975ba26ca10e4ea175981a99fd31607e2af47f4b1f73657bf82decfe
81f84dad654ea32e1084ee4661410aaf1b9eba7a2969b77a3fcad84d73712f2c
8235befaa90794559978bcf134955b78f0d560f7448cb0119a7079e74de9b322
82740f4599ff169ca34dc08425e0e14b2880a1f41a200926d183c1dd137d3616
8319192b1d195060d51bc8847db4dc3f75843d2aebb7cdea3c095225c3a36f95
846886d99ef41daf29aef58d71aee6d995f0bee00bc26f4159962c72c5245c71
8cb05b675fe6419a9e91eb587c60902c7ed1cb6c42b8cff8ce404ef89f635cde
8cc401e8eb15e573a68a906d6a3e049bd5d97ad9d2cdda1b368dbdca2f67baae
8dc2590a64daad767066641d05a825dc55d12ac2577f113f80b568e93f296d1a
8e1d670a9b0de4b0e0848acabed1cc085b84c44a266e47298e3027fcebb55d5d
8e6a4dbb9bee14e26fbcd0c262ca561cafa8a528f383c7bb9904744a576747e3
905867dc2fabc8c138c18856bd76255410d4d2bd4d20d1c99dcf5404e233a24a
927bdf93bc931761af166153ef1ff877515fed5815388a9c18640dabd4ffe646
92801a1f91c191498c4f00c0484dcd03ae6f9470689b9161fb4967b505b24aa7
94bdeaea0d33cb654b89540e96e02fe28afceb1624d8ed58f7a43f3609fb4a17
961c8dc4928b59af4df6227f86623b78c9ebb009d0c7f365577f9af6cd021b8f
97735ab789bcf52aa49b0168ca3ab7a4a0aa6524cfb9e917cd220f50fa532bb9
9a9fb4a11eb156ec45f11fc9333d08758f5c36873794ff06058497e50a4f778a
9baad10e85c5be8d5697086479983b6b477197103bf8f0f11817b1bdfb9a7451
9be196bc2e9ebb7741882c3598a430520dfe6269a311c363e83089912884f810
9bffc61a75e1a781f4c57fe81b218952707cc1ddc6a59cc0e98d77663f267181
9c62b9826a169620028cf881a8d9b45165f88b25f6e6e675eb01c0a9b86e9aa2
9cddb0c618605df4988bccd4b141e11e755691c01ac43aa12fb277cb2432651d
a0f093386fdbc1840bd86d3fc6f9069a9a2aaf3f178d72c60a0d962f53afc095
a1a62d2c7303f84833949bfbd45c62323a96edc820885d8c3954783dc21cefc5
a1ec30f4f04ec9601e2ccd7a92400156817d91e3302be9b757c3c90901f6bcdb
a3f36a24a6d011969e763ac244a23822ae3301204a75e1c5366e9ff00edf6505
a448712fe848f122c6456889704b10a01b47227a2a14e1902a630c13869ea289
a64965074ae9c066ee0eba6d07c513849b733347df50fb6c51eef73cc72a73b9
a98027fd320cd46ef032675e7421574d1e038512923f0a541c638ac1247aaa51
aa39f9154d818ebe55ad1dd134ea9defe362029b676042b40a06b40d11952abb
aa95eb8757140f09d3424399b939ed3f10a20c45c6c52476c614c9bc375eb667
adf9998d6dad686b2a96d3396d999082c35d61c97757adba45fcc7944ccb296c
af62a4d83a4328d904f5f2eb79cac6d997086117a7088638572e2d1c1487f85d
b08fefb255b40cd18b0f7db8ec21c6f0c79d16aa828d7ed9157da12a38538682
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
b392f7005a264f5b9d37ba90452804986024dc5e936ba0f1b420fbf2af107a34
b406f5ec6022f228c04959332bf2495701f684fc1030db97a6d08be088f58a63
b538e1cf2ac5e30dbf2cbf1d6cfa0e05025d89a13e7173978b6f9400c0a41cd6
b888c82e155e7fc6fe76ad50ea3214188e51774f0ae356217a3b2da14ca58823
bb2a80dc3e72230cd009ad952ebac959905d921e509aebe911704557d0311da3
bc1a94c78cc7737370be4771d747c1a2277916e3012436239a7fb02792b68973
bdc6c5bde5c04d6d26c81a650422b68960244543c6901d4d2cb09b19517c0fd2
bfb85c1805c04ce5aea2aa3b318ef05b2bb3e662578443c9561861f429561873
c088e39a5f6c8f5bb5f8918a5c190fe5aaf41db798d2396afc3c6ac28caaba61
c18fe22eb7d7d041ee06e0017cff51877b1d51601c99b8f2a00550043568e1db
c36f239ce79e35dadbff0ff5db8575f16cde7aabac186805458218dd667eccfe
c4360c310c5c05c1c037cc69c271d62c6fc6e4b81e075e1b5d81ee94ec028b15
c77350dae6aaf1498d30676195ffdba98348f5cd6b6521a61a0a03b6ae2ecd69
c98691eef331dcc74624602509d16fd4ac494a2f513eb3a718ba6ad7565b8560
cb6f68118b51eb89379519cbbc3526e741af47d7cec5b33622fb77c9be246494
cc576c8d2a22f7df53d5fdeb71b6909798f5afe85dbf690797d76f0852a95314
cc7e8fa17d9b14711dca51cc0204442c8a8c71e1524dc8d141e2ba029d76e69c
ccc73259c16d17a3c0cb5858b8795860cadead685079bdd25dcb7b415f87a3e7
ce2ec84646438506023b05fc4b1cb584eaac33d5739bf66a242d38e63a129ab0
cf7bba49b9fe5056beaf8ae06d699e773adc8df5bfa6d6e9e7ea18be58ed98b3
d0f8ba8df3451fabff93326ecebf941327ef62ba805a5292cfad6c2625a29d0a
d2458b9fd9089fdcb9de317093e004ef3a65597dc68b9adfdeb15a7c9968d0d5
d3002495ee50fe8b18952545f65b74204782d8292a644238d1139563f1f9c9fb
d3232f2f33bc81a96eac0943f91b9d4a0a2468c83d0c41cf733c9b02f74519d1
d44b4983cfd347d95d4f01ba6b1049da856e0ac6e11a4ddb959517fe27125c79
d45aef198b86e80422ab517eed577c334d8ffbcc0d5ddae603f64f0016056135
d460b9dd1f0a030761351c80b470610a2418f3ef46f5bffc79758b1c02dbde50
d8e63983258eb8134047ccf84cd78b37347dbccad7f3907ec2b38c846d61c246
d96de9dbd4e9e5a370141560ccaea6caefab19b971023f3541e3cc4e8e22502d
d98e77e558ef5c298f4c28cdd1604914a16a3fcc9249904ba70c57d989fb6aab
da9762ba55689a76aef7a7131f77c75ba0e98f7b94425d3de64f1acfaca4cd25
db7e90d7d2080e196ee3f61b089270bb906fbf204d32b5f23ecc54dd553e5a2d
dcb5e540e62fc85857254a1066afb6a7e8999279c6d4c583eef855d39f9289c0
dcc0ab8a6f3bef59fa6897752ed594f6074fc60b06c1a73622f212c83691237b
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
dd2b5f8a499eece26eb4e8f46fd5f0f0336dd06043b9df90d7a809d3eafc09ca
de3246094525b21a870fc7d2a67490d0132535c6fa5993755c549f1a9d1bd8af
e190d2c4d1fc1a8236494bb78f998cdb77331d21a649e711a4c5ae1032929085
e1967f20ba2287aeb795371e9df4c23fcd7db88086b68181f688d27158ef56b0
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e63de97516cdcf696dbaacff5307b40f83628eb5ea90f6c40680b554fca583f2
e7be357ddd89fe4f85dd3a2f16929f2344148d0ede966e9bf92febe1b998cc9b
e938f15952b6e13ea24ecf23acb6564042c2ab3895bda089b730d4f9188a53dc
e93ab8f65fddedee3878e9a4d3c6865fb5d4a4d02a0ab7c14b730d7360cfac03
ed16ca821d23e0210a6e44dec1d95ce259ce50a0c585f8f3ced0a6c46453b223
ee3279443fbd6d7e0523ec8d8d37c28e177474c11ccbb77db9fa97bb248a9c72
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f03c0497b62fce9366403fdda94b7a8708999225f83dd9af3284ad4ba3de5784
f2ca0a93810af3237f7530ee5ea7e707edbe0eca8484003dd40a25c32b0b6d4f
f3b87feafc613df82db0984ba24177ee9eea2da8e5a03c4a6eabb1af291715db
f3c8a34883f2b44956b45912ceab56124951275fb886b3d4cfb3322b8ce645c1
f425f66d90f1150499b36ab47b56fa6fb1a68136e4f42befca20a920ff85306b
f4fa2972df47cfcc6d36fec94e11c40112e92e43fcd09a8828c3740c34d4196d
f7486dda8dd63b1e783fb86771b77297d4cb9aa33b39f73ee3d9b68518d87a75
f820f689e79fe927155372514936423b30eb400c1d2b87b6503d1398f6d352c7
fbb5aad40705d04efa585a182c61ca9158701446bbace70773eb381b204dbdf8
fbcadc50fa4ac76ebceea52b5afee2223a3cbd73c25cdd581492074df794dfc3
fc48d1d80ece71a79a7b39877f4104d49d3da6c3665cf6dc203000fb7df4447e
fc5fb008a73f4352420e68490d398ffbc487ba468344e065db3c0c71242e43bf
fc9105b8fff111487346d24228117b01b120a025e7226ca3e618c5d80533b780
fcc83a5b6aef86420c1ad553167106df96bd0ff4192ffe52b1647599948edbcf
fda1a8137725b0aef1dd2012400760015b4b0d5e1376dd0ee45738b311e8f95f
fdb85dcb48df570c26aeeefd28fa305cf4787f8d673cc1b5b50a370c420b5c8f
feb248b7a818478c2b7f6ae21ae78e140201ab3f694733ed8626704aaf7da122

www.itwbooking.bjquwhcm.com Open in urlscan Pro 50.31.134.90 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

286 Requests

99 %HTTPS

28 %IPv6

48 Domains

63 Subdomains

57 IPs

9 Countries

2734 kBTransfer

5333 kBSize

0 Cookies

12 Outgoing links

Redirected requests

286 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 5 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

www.itwbooking.bjquwhcm.com Open in urlscan Pro
50.31.134.90 Public Scan

Screenshot
Live screenshot

Full Image

286
Requests

99 %
HTTPS

28 %
IPv6

48
Domains

63
Subdomains

57
IPs

9
Countries

2734 kB
Transfer

5333 kB
Size

0
Cookies

286 HTTP transactions
5 data transactions