book.rwgenting.com Open in urlscan Pro
170.33.9.200 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://erwg.my/SLK4G
Effective URL:
https://book.rwgenting.com/onelogin/login?mid=5B5BA18CDF117678AD4A556ED500F79A550D62537139386F006D6DC3800866384A73B0794550B...
Submission: On July 21 via manual (July 21st 2022, 5:25:52 am UTC) from SG — Scanned from DE

Summary HTTP 97 Redirects Links 1 Behaviour Indicators

Summary

This website contacted 29 IPs in 8 countries across 26 domains to perform 97 HTTP transactions. The main IP is 170.33.9.200, located in Singapore and belongs to ASEPL-AS-AP Alibaba.com Singapore E-Commerce Private Limited, SG. The main domain is book.rwgenting.com.
TLS certificate: Issued by DigiCert TLS RSA SHA256 2020 CA1 on February 21st 2022. Valid for: a year.

This is the only time book.rwgenting.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
2 2	47.254.192.82 47.254.192.82	45102 (ALIBABA-C...) (ALIBABA-CN-NET Alibaba US Technology Co.)
1 1	136.147.129.35 136.147.129.35	22606 (EXACT-7) (EXACT-7)
1 1	136.147.129.3 136.147.129.3	22606 (EXACT-7) (EXACT-7)
13	170.33.9.200 170.33.9.200	134963 (ASEPL-AS-...) (ASEPL-AS-AP Alibaba.com Singapore E-Commerce Private Limited)
9	2a03:2880:f02... 2a03:2880:f02d:100:face:b00c:0:3	32934 (FACEBOOK) (FACEBOOK)
3	2a00:1450:400... 2a00:1450:4001:828::2008	15169 (GOOGLE) (GOOGLE)
8	2a00:1450:400... 2a00:1450:4001:830::200e	15169 (GOOGLE) (GOOGLE)
7	151.101.194.133 151.101.194.133	54113 (FASTLY) (FASTLY)
1	2a00:1450:400... 2a00:1450:4001:810::200e	15169 (GOOGLE) (GOOGLE)
2	2620:116:800d... 2620:116:800d:21:b314:a0ef:ab7c:d546	16509 (AMAZON-02) (AMAZON-02)
3	18.66.248.12 18.66.248.12	16509 (AMAZON-02) (AMAZON-02)
3	2a00:1450:400... 2a00:1450:400c:c00::9b	15169 (GOOGLE) (GOOGLE)
1	142.250.186.162 142.250.186.162	15169 (GOOGLE) (GOOGLE)
2	2001:4860:480... 2001:4860:4802:32::36	15169 (GOOGLE) (GOOGLE)
4	2a00:1450:400... 2a00:1450:4001:80e::2003	15169 (GOOGLE) (GOOGLE)
1	2600:9000:20f... 2600:9000:20fc:1400:6:44e3:f8c0:93a1	16509 (AMAZON-02) (AMAZON-02)
3	2a00:1450:400... 2a00:1450:4001:827::2004	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:830::2002	15169 (GOOGLE) (GOOGLE)
20	2a03:2880:f12... 2a03:2880:f12d:181:face:b00c:0:25de	32934 (FACEBOOK) (FACEBOOK)
3	52.74.245.38 52.74.245.38	16509 (AMAZON-02) (AMAZON-02)
1 2	142.250.181.230 142.250.181.230	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:806::2002	15169 (GOOGLE) (GOOGLE)
1 1	104.111.215.191 104.111.215.191	16625 (AKAMAI-AS) (AKAMAI-AS)
5 8	34.111.151.213 34.111.151.213	15169 (GOOGLE) (GOOGLE)
1	34.98.64.218 34.98.64.218	15169 (GOOGLE) (GOOGLE)
2 2	52.57.150.184 52.57.150.184	16509 (AMAZON-02) (AMAZON-02)
1	2600:1f18:612... 2600:1f18:612b:4232:fce7:74b5:7c53:e386	14618 (AMAZON-AES) (AMAZON-AES)
1	141.226.228.48 141.226.228.48	200478 (TABOOLA-AS) (TABOOLA-AS)
1 2	185.89.210.20 185.89.210.20	29990 (ASN-APPNEX) (ASN-APPNEX)
1	35.244.174.68 35.244.174.68	15169 (GOOGLE) (GOOGLE)
1 2	35.227.248.159 35.227.248.159	15169 (GOOGLE) (GOOGLE)
1 2	104.18.19.126 104.18.19.126	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	54.74.133.13 54.74.133.13	16509 (AMAZON-02) (AMAZON-02)
97	29

2 47.254.192.82 (Kuala Lumpur, Malaysia) 2 redirects

ASN45102 (ALIBABA-CN-NET Alibaba US Technology Co., Ltd., CN)

erwg.my	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 136.147.129.35 (United States) 1 redirects

ASN22606 (EXACT-7, US)
PTR: ck35.mta.exacttarget.com

pub.s7.exacttarget.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 136.147.129.3 (United States) 1 redirects

ASN22606 (EXACT-7, US)

mcsqjpvz392sd02cs6vv33b0kfhq.pub.sfmc-content.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

13 170.33.9.200 (Singapore)

ASN134963 (ASEPL-AS-AP Alibaba.com Singapore E-Commerce Private Limited, SG)

book.rwgenting.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

9 2a03:2880:f02d:100:face:b00c:0:3 (Frankfurt am Main, Germany)

ASN32934 (FACEBOOK, US)

connect.facebook.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:828::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 2a00:1450:4001:830::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 151.101.194.133 (United States)

ASN54113 (FASTLY, US)

cdn.krxd.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
consumer.krxd.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:810::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googleoptimize.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2620:116:800d:21:b314:a0ef:ab7c:d546 (United States)

ASN16509 (AMAZON-02, US)

secure.quantserve.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
pixel.quantserve.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 18.66.248.12 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-18-66-248-12.dus51.r.cloudfront.net

cdn.brand-display.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:400c:c00::9b (Brussels, Belgium)

ASN15169 (GOOGLE, US)

stats.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 142.250.186.162 (United States)

ASN15169 (GOOGLE, US)
PTR: fra24s08-in-f2.1e100.net

www.googleadservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2001:4860:4802:32::36 (United States)

ASN15169 (GOOGLE, US)

region1.analytics.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a00:1450:4001:80e::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:20fc:1400:6:44e3:f8c0:93a1 (United States)

ASN16509 (AMAZON-02, US)

rules.quantcount.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:827::2004 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:830::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

20 2a03:2880:f12d:181:face:b00c:0:25de (Frankfurt am Main, Germany)

ASN32934 (FACEBOOK, US)

www.facebook.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 52.74.245.38 (Singapore, Singapore)

ASN16509 (AMAZON-02, US)
PTR: ec2-52-74-245-38.ap-southeast-1.compute.amazonaws.com

tr.brand-display.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 142.250.181.230 (United States) 1 redirects

ASN15169 (GOOGLE, US)
PTR: fra16s56-in-f6.1e100.net

8661995.fls.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:806::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

adservice.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.111.215.191 (Frankfurt am Main, Germany) 1 redirects

ASN16625 (AKAMAI-AS, US)
PTR: a104-111-215-191.deploy.static.akamaitechnologies.com

tags.bluekai.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 34.111.151.213 (Kansas City, United States) 5 redirects

ASN15169 (GOOGLE, US)
PTR: 213.151.111.34.bc.googleusercontent.com

dmp.brand-display.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 34.98.64.218 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 218.64.98.34.bc.googleusercontent.com

us-u.openx.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 52.57.150.184 (Frankfurt am Main, Germany) 2 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-52-57-150-184.eu-central-1.compute.amazonaws.com

x.bidswitch.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:1f18:612b:4232:fce7:74b5:7c53:e386 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)

partners.tremorhub.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 141.226.228.48 (Netherlands)

ASN200478 (TABOOLA-AS, IL)

sync.taboola.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 185.89.210.20 (Frankfurt am Main, Germany) 1 redirects

ASN29990 (ASN-APPNEX, US)
PTR: 944.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net

ib.adnxs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 35.244.174.68 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 68.174.244.35.bc.googleusercontent.com

idsync.rlcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 35.227.248.159 (Kansas City, United States) 1 redirects

ASN15169 (GOOGLE, US)
PTR: 159.248.227.35.bc.googleusercontent.com

pixel.tapad.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 104.18.19.126 (None, ) 1 redirects

ASN13335 (CLOUDFLARENET, US)

dsum-sec.casalemedia.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 54.74.133.13 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-54-74-133-13.eu-west-1.compute.amazonaws.com

beacon.krxd.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
20	facebook.com www.facebook.com — Cisco Umbrella Rank: 101	2 KB
14	brand-display.com 5 redirects cdn.brand-display.com — Cisco Umbrella Rank: 41382 tr.brand-display.com — Cisco Umbrella Rank: 41337 dmp.brand-display.com — Cisco Umbrella Rank: 1893	61 KB
13	rwgenting.com book.rwgenting.com	697 KB
9	facebook.net connect.facebook.net — Cisco Umbrella Rank: 155	590 KB
8	krxd.net cdn.krxd.net — Cisco Umbrella Rank: 1400 consumer.krxd.net — Cisco Umbrella Rank: 1812 beacon.krxd.net — Cisco Umbrella Rank: 462	177 KB
8	google-analytics.com www.google-analytics.com — Cisco Umbrella Rank: 52	20 KB
6	google.com region1.analytics.google.com — Cisco Umbrella Rank: 5536 www.google.com — Cisco Umbrella Rank: 10 adservice.google.com — Cisco Umbrella Rank: 96	1 KB
6	doubleclick.net 1 redirects stats.g.doubleclick.net — Cisco Umbrella Rank: 117 googleads.g.doubleclick.net — Cisco Umbrella Rank: 56 8661995.fls.doubleclick.net	4 KB
4	google.de www.google.de — Cisco Umbrella Rank: 5701	735 B
3	googletagmanager.com www.googletagmanager.com — Cisco Umbrella Rank: 93	204 KB
2	casalemedia.com 1 redirects dsum-sec.casalemedia.com — Cisco Umbrella Rank: 531	2 KB
2	tapad.com 1 redirects pixel.tapad.com — Cisco Umbrella Rank: 451	604 B
2	adnxs.com 1 redirects ib.adnxs.com — Cisco Umbrella Rank: 234	2 KB
2	bidswitch.net 2 redirects x.bidswitch.net — Cisco Umbrella Rank: 292	1 KB
2	quantserve.com secure.quantserve.com — Cisco Umbrella Rank: 991 pixel.quantserve.com — Cisco Umbrella Rank: 452	10 KB
2	erwg.my 2 redirects erwg.my	2 KB
1	rlcdn.com idsync.rlcdn.com — Cisco Umbrella Rank: 324	98 B
1	taboola.com sync.taboola.com — Cisco Umbrella Rank: 933	99 B
1	tremorhub.com partners.tremorhub.com — Cisco Umbrella Rank: 901	183 B
1	openx.net us-u.openx.net — Cisco Umbrella Rank: 391	275 B
1	bluekai.com 1 redirects tags.bluekai.com — Cisco Umbrella Rank: 471	542 B
1	quantcount.com rules.quantcount.com — Cisco Umbrella Rank: 942	1 KB
1	googleadservices.com www.googleadservices.com — Cisco Umbrella Rank: 125	15 KB
1	googleoptimize.com www.googleoptimize.com — Cisco Umbrella Rank: 1323	45 KB
1	sfmc-content.com 1 redirects mcsqjpvz392sd02cs6vv33b0kfhq.pub.sfmc-content.com	353 B
1	exacttarget.com 1 redirects pub.s7.exacttarget.com — Cisco Umbrella Rank: 289140	633 B
97	26

	Domain	Requested by
20	www.facebook.com	book.rwgenting.com
13	book.rwgenting.com	book.rwgenting.com
9	connect.facebook.net	book.rwgenting.com www.googletagmanager.com connect.facebook.net
8	dmp.brand-display.com	5 redirects book.rwgenting.com
8	www.google-analytics.com	book.rwgenting.com www.google-analytics.com
5	cdn.krxd.net	book.rwgenting.com cdn.krxd.net
4	www.google.de	book.rwgenting.com
3	tr.brand-display.com	cdn.brand-display.com book.rwgenting.com
3	www.google.com	book.rwgenting.com
3	stats.g.doubleclick.net	www.google-analytics.com www.googletagmanager.com
3	cdn.brand-display.com	book.rwgenting.com cdn.brand-display.com
3	www.googletagmanager.com	book.rwgenting.com www.googletagmanager.com
2	dsum-sec.casalemedia.com	1 redirects book.rwgenting.com
2	pixel.tapad.com	1 redirects book.rwgenting.com
2	ib.adnxs.com	1 redirects book.rwgenting.com
2	x.bidswitch.net	2 redirects
2	8661995.fls.doubleclick.net	1 redirects book.rwgenting.com
2	consumer.krxd.net	cdn.krxd.net
2	region1.analytics.google.com	www.googletagmanager.com
2	erwg.my	2 redirects
1	beacon.krxd.net	cdn.krxd.net
1	idsync.rlcdn.com	book.rwgenting.com
1	sync.taboola.com	book.rwgenting.com
1	partners.tremorhub.com	book.rwgenting.com
1	us-u.openx.net	book.rwgenting.com
1	tags.bluekai.com	1 redirects
1	adservice.google.com	8661995.fls.doubleclick.net
1	pixel.quantserve.com	book.rwgenting.com
1	googleads.g.doubleclick.net	www.googleadservices.com
1	rules.quantcount.com	secure.quantserve.com
1	www.googleadservices.com	www.googletagmanager.com
1	secure.quantserve.com	www.googletagmanager.com
1	www.googleoptimize.com	www.googletagmanager.com
1	mcsqjpvz392sd02cs6vv33b0kfhq.pub.sfmc-content.com	1 redirects
1	pub.s7.exacttarget.com	1 redirects
97	35

This site contains links to these domains. Also see Links.

Domain
www.rwgenting.com

Subject Issuer	Validity	Valid
book.rwgenting.com DigiCert TLS RSA SHA256 2020 CA1	`2022-02-21` - `2023-03-01`	a year	crt.sh
*.facebook.com DigiCert SHA2 High Assurance Server CA	`2022-04-29` - `2022-07-28`	3 months	crt.sh
*.google-analytics.com GTS CA 1C3	`2022-06-27` - `2022-09-19`	3 months	crt.sh
cdn.krxd.net DigiCert TLS RSA SHA256 2020 CA1	`2021-12-30` - `2022-12-29`	a year	crt.sh
*.quantserve.com DigiCert TLS RSA SHA256 2020 CA1	`2021-09-22` - `2022-09-21`	a year	crt.sh
brand-display.com Amazon	`2022-05-14` - `2023-06-12`	a year	crt.sh
*.g.doubleclick.net GTS CA 1C3	`2022-06-27` - `2022-09-19`	3 months	crt.sh
www.googleadservices.com GTS CA 1C3	`2022-06-27` - `2022-09-19`	3 months	crt.sh
www.google.de GTS CA 1C3	`2022-07-04` - `2022-09-26`	3 months	crt.sh
www.google.com GTS CA 1C3	`2022-07-04` - `2022-09-26`	3 months	crt.sh
consumer.krxd.net DigiCert TLS RSA SHA256 2020 CA1	`2022-06-08` - `2023-06-07`	a year	crt.sh
*.google.com GTS CA 1C3	`2022-07-04` - `2022-09-26`	3 months	crt.sh
*.google.de GTS CA 1C3	`2022-07-04` - `2022-09-26`	3 months	crt.sh
*.knorex.com Amazon	`2021-12-10` - `2023-01-08`	a year	crt.sh
*.doubleclick.net GTS CA 1C3	`2022-06-27` - `2022-09-19`	3 months	crt.sh
*.openx.net GeoTrust RSA CA 2018	`2021-07-08` - `2022-08-08`	a year	crt.sh
*.brand-display.com GeoTrust RSA CA 2018	`2022-06-03` - `2023-07-04`	a year	crt.sh
beacon.krxd.net DigiCert TLS RSA SHA256 2020 CA1	`2021-11-03` - `2022-11-02`	a year	crt.sh

This page contains 4 frames:

Primary Page: https://book.rwgenting.com/onelogin/login?mid=5B5BA18CDF117678AD4A556ED500F79A550D62537139386F006D6DC3800866384A73B0794550B7006CB01F8D8C8806AE63A0E64A409145A7B9280D0CD1B123079FF4B25BFBEDEDABFD418D82CC6DDBC24F&hashCode=A3A88955236CD99122BD213EA23933F9E7F81F9BD51A2B4F48BB5B0931A7EC1E0D19AE4D5C8DCFA4D14E015614CAF61112414F4A736E01975F01131A0&language=en
Frame ID: 16F097CD71929C3174E67ACC8F4A52B1
Requests: 92 HTTP requests in this frame

Frame: https://cdn.krxd.net/partnerjs/xdi/proxy.3d2100fd7107262ecb55ce6847f01fa5.html
Frame ID: E7DA11F8344146B5ED679E90D13D9127
Requests: 4 HTTP requests in this frame

Frame: https://cdn.brand-display.com/tr/tag/cfix.html?key=b90894f9b1582df507297d968da7fecece37d93
Frame ID: 0851926D9556B6E10248FFE3114FA568
Requests: 1 HTTP requests in this frame

Frame: https://8661995.fls.doubleclick.net/activityi;dc_pre=CJCM75ififkCFbdGHQkdU5INzw;src=8661995;type=remar0;cat=rwg_g0;u1=;u2=https%3A%2F%2Fbook.rwgenting.com%2Fonelogin%2Flogin%3Fmid%3D5B5BA18CDF117678AD4A556ED500F79A550D62537139386F006D6DC3800866384A73B0794550B7006CB01F8D8C8806AE63A0E64A409145A7B9280D0CD1B123079FF4B25BFBEDEDABFD418D82CC6DDBC24F%26hashCode%3DA3A88955236CD99122BD213EA23933F9E7F81F9BD51A2B4F48BB5B0931A7EC1E0D19AE4D5C8DCFA4D14E015614CAF61112414F4A736E01975F01131A0%26language%3Den;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;ord=1870674817373.5876
Frame ID: F30BC4226C4ECF0E3C5F230F70855DB7
Requests: 2 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Resorts World Genting

Page URL History Show full URLs

http://erwg.my/SLK4G HTTP 302
https://pub.s7.exacttarget.com/0yfvdoqv0wv?custid=8B76C1DF7690DEA3BF4A8DCEA9FCE311&msgid=09ea74bd-b828-4a30... HTTP 301
https://mcsqjpvz392sd02cs6vv33b0kfhq.pub.sfmc-content.com/0yfvdoqv0wv?custid=8B76C1DF7690DEA3BF4A8DCEA9FCE311&msgid=09ea74bd-b828-4a30... HTTP 302
http://erwg.my/RWGRoomBookingLoginEnglish/?langtype=1033&utm_source=sms_monthlyoffer&utm_me... HTTP 302
https://book.rwgenting.com/onelogin/login?mid=5B5BA18CDF117678AD4A556ED500F79A550D62537139386F006D6DC38... Page URL

Detected technologies

AppNexus (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

adnxs\.(?:net|com)

Facebook (Widgets) Expand

Overall confidence: 100%
Detected patterns

//connect\.facebook\.([a-z]+)/[^/]*/[a-z]*\.js

FingerprintJS (JavaScript libraries) Expand

Overall confidence: 100%
Detected patterns

fingerprint(\d)?(?:\.min)?\.js

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

google-analytics\.com/(?:ga|urchin|analytics)\.js

Google Optimize (A/B Testing) Expand

Overall confidence: 100%
Detected patterns

googleoptimize\.com/optimize\.js

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/gtm\.js
googletagmanager\.com/gtag/js

OpenX (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

https?://[^/]*\.openx\.net

Quantcast Measure (Analytics) Expand

Overall confidence: 100%
Detected patterns

\.quantserve\.com/quant\.js

Page Statistics

97
Requests

93 %
HTTPS

42 %
IPv6

26
Domains

35
Subdomains

29
IPs

8
Countries

1831 kB
Transfer

5913 kB
Size

36
Cookies

1 Outgoing links

These are links going to different origins than the main page.

URL: https://www.rwgenting.com/

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://erwg.my/SLK4G HTTP 302
https://pub.s7.exacttarget.com/0yfvdoqv0wv?custid=8B76C1DF7690DEA3BF4A8DCEA9FCE311&msgid=09ea74bd-b828-4a30-ac84-03b02ba1ef3f&campcode=RDG2YR2CAB&mobile=T2pUalk5M1ZjbUNKVFJ3RlFCejZSUT09&senddate=Jul%2021,%202022%2013:17:29.98&remoteurl=http://erwg.my/RWGRoomBookingLoginEnglish/?langtype=1033&utm_source=sms_monthlyoffer&utm_medium=accommodation&utm_campaign=parent082022_monthlyoffer&utm_term=pmp&utm_content=free&expAfter=6 HTTP 301
https://mcsqjpvz392sd02cs6vv33b0kfhq.pub.sfmc-content.com/0yfvdoqv0wv?custid=8B76C1DF7690DEA3BF4A8DCEA9FCE311&msgid=09ea74bd-b828-4a30-ac84-03b02ba1ef3f&campcode=RDG2YR2CAB&mobile=T2pUalk5M1ZjbUNKVFJ3RlFCejZSUT09&senddate=Jul%2021,%202022%2013:17:29.98&remoteurl=http://erwg.my/RWGRoomBookingLoginEnglish/?langtype=1033&utm_source=sms_monthlyoffer&utm_medium=accommodation&utm_campaign=parent082022_monthlyoffer&utm_term=pmp&utm_content=free&expAfter=6 HTTP 302
http://erwg.my/RWGRoomBookingLoginEnglish/?langtype=1033&utm_source=sms_monthlyoffer&utm_medium=accommodation&utm_campaign=parent082022_monthlyoffer&utm_term=pmp&utm_content=free HTTP 302
https://book.rwgenting.com/onelogin/login?mid=5B5BA18CDF117678AD4A556ED500F79A550D62537139386F006D6DC3800866384A73B0794550B7006CB01F8D8C8806AE63A0E64A409145A7B9280D0CD1B123079FF4B25BFBEDEDABFD418D82CC6DDBC24F&hashCode=A3A88955236CD99122BD213EA23933F9E7F81F9BD51A2B4F48BB5B0931A7EC1E0D19AE4D5C8DCFA4D14E015614CAF61112414F4A736E01975F01131A0&language=en Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 55

https://8661995.fls.doubleclick.net/activityi;src=8661995;type=remar0;cat=rwg_g0;u1=;u2=https%3A%2F%2Fbook.rwgenting.com%2Fonelogin%2Flogin%3Fmid%3D5B5BA18CDF117678AD4A556ED500F79A550D62537139386F006D6DC3800866384A73B0794550B7006CB01F8D8C8806AE63A0E64A409145A7B9280D0CD1B123079FF4B25BFBEDEDABFD418D82CC6DDBC24F%26hashCode%3DA3A88955236CD99122BD213EA23933F9E7F81F9BD51A2B4F48BB5B0931A7EC1E0D19AE4D5C8DCFA4D14E015614CAF61112414F4A736E01975F01131A0%26language%3Den;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;ord=1870674817373.5876 HTTP 302
https://8661995.fls.doubleclick.net/activityi;dc_pre=CJCM75ififkCFbdGHQkdU5INzw;src=8661995;type=remar0;cat=rwg_g0;u1=;u2=https%3A%2F%2Fbook.rwgenting.com%2Fonelogin%2Flogin%3Fmid%3D5B5BA18CDF117678AD4A556ED500F79A550D62537139386F006D6DC3800866384A73B0794550B7006CB01F8D8C8806AE63A0E64A409145A7B9280D0CD1B123079FF4B25BFBEDEDABFD418D82CC6DDBC24F%26hashCode%3DA3A88955236CD99122BD213EA23933F9E7F81F9BD51A2B4F48BB5B0931A7EC1E0D19AE4D5C8DCFA4D14E015614CAF61112414F4A736E01975F01131A0%26language%3Den;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;ord=1870674817373.5876

Request Chain 62

https://tags.bluekai.com/site/46117?id=ed9f2fa61815b51cacadfefeed42bb33&limit=1&redir=https%3A%2F%2Fdmp.brand-display.com%2Fcm2%2Fapi%2Fpixel%3Fpartner%3D0004%26pid%3D%24_BK_UUID%26bf%3Ded9f2fa61815b51cacadfefeed42bb33&_t1658381146333 HTTP 302
https://dmp.brand-display.com/cm2/api/pixel?partner=0004&pid=$_BK_UUID&bf=ed9f2fa61815b51cacadfefeed42bb33

Request Chain 64

https://x.bidswitch.net/sync?dsp_id=316&user_id=ed9f2fa61815b51cacadfefeed42bb33&expires=30 HTTP 302
https://x.bidswitch.net/ul_cb/sync?dsp_id=316&user_id=ed9f2fa61815b51cacadfefeed42bb33&expires=30 HTTP 302
https://partners.tremorhub.com/sync?UIBS=1a62da8e-b459-4812-88e3-1a62a87b4773

Request Chain 65

https://dmp.brand-display.com/cm/api/taboola?_t=1658381146334&bf=ed9f2fa61815b51cacadfefeed42bb33 HTTP 302
https://sync.taboola.com/sg/knorex-network/1/rtb-h/?taboola_hm=ed9f2fa61815b51cacadfefeed42bb33

Request Chain 66

https://dmp.brand-display.com/cm/api/appnexus?_t=1658381146334&bf=ed9f2fa61815b51cacadfefeed42bb33 HTTP 302
https://ib.adnxs.com/setuid?entity=442&code=ed9f2fa61815b51cacadfefeed42bb33 HTTP 307
https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D442%26code%3Ded9f2fa61815b51cacadfefeed42bb33

Request Chain 67

https://dmp.brand-display.com/cm/api/liveramp?_t={CACHEBUSTER}&bf=ed9f2fa61815b51cacadfefeed42bb33 HTTP 302
https://idsync.rlcdn.com/708804.gif?partner_uid=ed9f2fa61815b51cacadfefeed42bb33

Request Chain 68

https://dmp.brand-display.com/cm/api/tapad?_t=1658381146335&bf=ed9f2fa61815b51cacadfefeed42bb33 HTTP 302
https://pixel.tapad.com/idsync/ex/receive?partner_id=3021&partner_device_id=ed9f2fa61815b51cacadfefeed42bb33 HTTP 302
https://pixel.tapad.com/idsync/ex/receive/check?partner_id=3021&partner_device_id=ed9f2fa61815b51cacadfefeed42bb33

Request Chain 71

https://dmp.brand-display.com/cm/api/index?cm_callback_url=%2F%2Fdsum-sec.casalemedia.com%2Frum&cm_dsp_id=191&bf=ed9f2fa61815b51cacadfefeed42bb33 HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=191&expiration=63072000&external_user_id=ed9f2fa61815b51cacadfefeed42bb33 HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=191&expiration=63072000&external_user_id=ed9f2fa61815b51cacadfefeed42bb33&C=1

97 HTTP transactions
2 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1

200
OK

Primary Request login Show response
book.rwgenting.com/onelogin/
Redirect Chain

http://erwg.my/SLK4G
https://pub.s7.exacttarget.com/0yfvdoqv0wv?custid=8B76C1DF7690DEA3BF4A8DCEA9FCE311&msgid=09ea74bd-b828-4a30-ac84-03b02ba1ef3f&campcode=RDG2YR2CAB&mobile=T2pUalk5M1ZjbUNKVFJ3RlFCejZSUT09&senddate=Ju...
https://mcsqjpvz392sd02cs6vv33b0kfhq.pub.sfmc-content.com/0yfvdoqv0wv?custid=8B76C1DF7690DEA3BF4A8DCEA9FCE311&msgid=09ea74bd-b828-4a30-ac84-03b02ba1ef3f&campcode=RDG2YR2CAB&mobile=T2pUalk5M1ZjbUNKV...
http://erwg.my/RWGRoomBookingLoginEnglish/?langtype=1033&utm_source=sms_monthlyoffer&utm_medium=accommodation&utm_campaign=parent082022_monthlyoffer&utm_term=pmp&utm_content=free
https://book.rwgenting.com/onelogin/login?mid=5B5BA18CDF117678AD4A556ED500F79A550D62537139386F006D6DC3800866384A73B0794550B7006CB01F8D8C8806AE63A0E64A409145A7B9280D0CD1B123079FF4B25BFBEDEDABFD418D8...

3 KB
2 KB

870ms
216ms

Document
text/html

170.33.9.200
ASEPL-AS-AP Aliba...

General

Check archive.org

Show headers Download Go to

Full URL

https://book.rwgenting.com/onelogin/login?mid=5B5BA18CDF117678AD4A556ED500F79A550D62537139386F006D6DC3800866384A73B0794550B7006CB01F8D8C8806AE63A0E64A409145A7B9280D0CD1B123079FF4B25BFBEDEDABFD418D82CC6DDBC24F&hashCode=A3A88955236CD99122BD213EA23933F9E7F81F9BD51A2B4F48BB5B0931A7EC1E0D19AE4D5C8DCFA4D14E015614CAF61112414F4A736E01975F01131A0&language=en

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

170.33.9.200 , Singapore, ASN134963 (ASEPL-AS-AP Alibaba.com Singapore E-Commerce Private Limited, SG),

Reverse DNS

Software

/ ASP.NET

Resource Hash

b1fc39e2dc899b1d51abd3d512f8aa29203171512ee55a46fd1cdb193b319006

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1;mode=block

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Connection: keep-alive
Content-Encoding: gzip
Content-Type: text/html
Date: Thu, 21 Jul 2022 05:25:43 GMT
Last-Modified: Mon, 04 Jul 2022 06:10:58 GMT
Transfer-Encoding: chunked
Vary: Accept-Encoding
X-Frame-Options: SAMEORIGIN
X-Powered-By: ASP.NET
X-XSS-PROTECTION: 1;mode=block

Redirect headers

Access-Control-Allow-Headers: Origin,X-Requested-With,Content-Type,authorization,Accept,Access-Control-Request-Headers,Access-Control-Request-Method
Access-Control-Allow-Methods: GET, POST, PUT, DELETE, OPTIONS
Access-Control-Allow-Origin: *
Connection: keep-alive
Content-Length: 762
Content-Type: text/html; charset=utf-8
Date: Thu, 21 Jul 2022 05:25:42 GMT
Location: https://book.rwgenting.com/onelogin/login?mid=5B5BA18CDF117678AD4A556ED500F79A550D62537139386F006D6DC3800866384A73B0794550B7006CB01F8D8C8806AE63A0E64A409145A7B9280D0CD1B123079FF4B25BFBEDEDABFD418D82CC6DDBC24F&hashCode=A3A88955236CD99122BD213EA23933F9E7F81F9BD51A2B4F48BB5B0931A7EC1E0D19AE4D5C8DCFA4D14E015614CAF61112414F4A736E01975F01131A0&language=en
Vary: Accept

GET
H/1.1 200
OK materialIcon.css
book.rwgenting.com/onelogin/assets/ 548 B
934 B 216ms
215ms Stylesheet
text/css 170.33.9.200
ASEPL-AS-AP Aliba...

General

Check archive.org

Show headers Download Go to

Full URL

https://book.rwgenting.com/onelogin/assets/materialIcon.css

Requested by

Host: book.rwgenting.com
URL: https://book.rwgenting.com/onelogin/login?mid=5B5BA18CDF117678AD4A556ED500F79A550D62537139386F006D6DC3800866384A73B0794550B7006CB01F8D8C8806AE63A0E64A409145A7B9280D0CD1B123079FF4B25BFBEDEDABFD418D82CC6DDBC24F&hashCode=A3A88955236CD99122BD213EA23933F9E7F81F9BD51A2B4F48BB5B0931A7EC1E0D19AE4D5C8DCFA4D14E015614CAF61112414F4A736E01975F01131A0&language=en

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

170.33.9.200 , Singapore, ASN134963 (ASEPL-AS-AP Alibaba.com Singapore E-Commerce Private Limited, SG),

Reverse DNS

Software

/ ASP.NET

Resource Hash

11e595017e67ca065944d3f497307003600e83c56c291242d084251e818b7147

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1;mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://book.rwgenting.com/onelogin/login?mid=5B5BA18CDF117678AD4A556ED500F79A550D62537139386F006D6DC3800866384A73B0794550B7006CB01F8D8C8806AE63A0E64A409145A7B9280D0CD1B123079FF4B25BFBEDEDABFD418D82CC6DDBC24F&hashCode=A3A88955236CD99122BD213EA23933F9E7F81F9BD51A2B4F48BB5B0931A7EC1E0D19AE4D5C8DCFA4D14E015614CAF61112414F4A736E01975F01131A0&language=en
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

Date: Thu, 21 Jul 2022 05:25:43 GMT
Last-Modified: Fri, 22 Oct 2021 10:45:08 GMT
X-Powered-By: ASP.NET
ETag: "1d7c731e16c1024"
X-Frame-Options: SAMEORIGIN
Content-Type: text/css
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 548
X-XSS-PROTECTION: 1;mode=block

GET
H/1.1 200
OK styles.f882acbaae2af6f23122.css
book.rwgenting.com/onelogin/ 219 KB
33 KB 821ms
735ms Stylesheet
text/css 170.33.9.200
ASEPL-AS-AP Aliba...

General

Check archive.org

Show headers Download Go to

Full URL

https://book.rwgenting.com/onelogin/styles.f882acbaae2af6f23122.css

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

170.33.9.200 , Singapore, ASN134963 (ASEPL-AS-AP Alibaba.com Singapore E-Commerce Private Limited, SG),

Reverse DNS

Software

/ ASP.NET

Resource Hash

f69881097386a9dcb9e2172792fa97fc38389caddf599dc99800b2855e0006aa

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1;mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://book.rwgenting.com/onelogin/login?mid=5B5BA18CDF117678AD4A556ED500F79A550D62537139386F006D6DC3800866384A73B0794550B7006CB01F8D8C8806AE63A0E64A409145A7B9280D0CD1B123079FF4B25BFBEDEDABFD418D82CC6DDBC24F&hashCode=A3A88955236CD99122BD213EA23933F9E7F81F9BD51A2B4F48BB5B0931A7EC1E0D19AE4D5C8DCFA4D14E015614CAF61112414F4A736E01975F01131A0&language=en
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

Date: Thu, 21 Jul 2022 05:25:44 GMT
Content-Encoding: gzip
Vary: Accept-Encoding
Last-Modified: Mon, 04 Jul 2022 06:06:07 GMT
X-Powered-By: ASP.NET
X-Frame-Options: SAMEORIGIN
Content-Type: text/css
Transfer-Encoding: chunked
Connection: keep-alive
X-XSS-PROTECTION: 1;mode=block

GET
H/1.1 200
OK runtime.7b63b9fd40098a2e8207.js Show response
book.rwgenting.com/onelogin/ 1 KB
1 KB 817ms
733ms Script
application/javascript 170.33.9.200
ASEPL-AS-AP Aliba...

General

Check archive.org

Show headers Download Go to

Full URL

https://book.rwgenting.com/onelogin/runtime.7b63b9fd40098a2e8207.js

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

170.33.9.200 , Singapore, ASN134963 (ASEPL-AS-AP Alibaba.com Singapore E-Commerce Private Limited, SG),

Reverse DNS

Software

/ ASP.NET

Resource Hash

6c5acbb82a46a4971660f65131241dffcc28828f4dbd76b8ec7bab0b468250f8

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1;mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://book.rwgenting.com/onelogin/login?mid=5B5BA18CDF117678AD4A556ED500F79A550D62537139386F006D6DC3800866384A73B0794550B7006CB01F8D8C8806AE63A0E64A409145A7B9280D0CD1B123079FF4B25BFBEDEDABFD418D82CC6DDBC24F&hashCode=A3A88955236CD99122BD213EA23933F9E7F81F9BD51A2B4F48BB5B0931A7EC1E0D19AE4D5C8DCFA4D14E015614CAF61112414F4A736E01975F01131A0&language=en
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

Date: Thu, 21 Jul 2022 05:25:44 GMT
Content-Encoding: gzip
Vary: Accept-Encoding
Last-Modified: Mon, 04 Jul 2022 06:06:07 GMT
X-Powered-By: ASP.NET
X-Frame-Options: SAMEORIGIN
Content-Type: application/javascript
Transfer-Encoding: chunked
Connection: keep-alive
X-XSS-PROTECTION: 1;mode=block

GET
H/1.1 200
OK polyfills.712a53dc69f3622f09f8.js Show response
book.rwgenting.com/onelogin/ 93 KB
30 KB 820ms
735ms Script
application/javascript 170.33.9.200
ASEPL-AS-AP Aliba...

General

Check archive.org

Show headers Download Go to

Full URL

https://book.rwgenting.com/onelogin/polyfills.712a53dc69f3622f09f8.js

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

170.33.9.200 , Singapore, ASN134963 (ASEPL-AS-AP Alibaba.com Singapore E-Commerce Private Limited, SG),

Reverse DNS

Software

/ ASP.NET

Resource Hash

3de97ec8ba594ea4b2129a7b5a02520ed969a92fe07528569533f94be1b3dc61

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1;mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://book.rwgenting.com/onelogin/login?mid=5B5BA18CDF117678AD4A556ED500F79A550D62537139386F006D6DC3800866384A73B0794550B7006CB01F8D8C8806AE63A0E64A409145A7B9280D0CD1B123079FF4B25BFBEDEDABFD418D82CC6DDBC24F&hashCode=A3A88955236CD99122BD213EA23933F9E7F81F9BD51A2B4F48BB5B0931A7EC1E0D19AE4D5C8DCFA4D14E015614CAF61112414F4A736E01975F01131A0&language=en
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

Date: Thu, 21 Jul 2022 05:25:44 GMT
Content-Encoding: gzip
Vary: Accept-Encoding
Last-Modified: Mon, 04 Jul 2022 06:06:07 GMT
X-Powered-By: ASP.NET
X-Frame-Options: SAMEORIGIN
Content-Type: application/javascript
Transfer-Encoding: chunked
Connection: keep-alive
X-XSS-PROTECTION: 1;mode=block

GET
H/1.1 200
OK scripts.53f75ab19ed1f427752e.js Show response
book.rwgenting.com/onelogin/ 148 KB
45 KB 826ms
737ms Script
application/javascript 170.33.9.200
ASEPL-AS-AP Aliba...

General

Check archive.org

Show headers Download Go to

Full URL

https://book.rwgenting.com/onelogin/scripts.53f75ab19ed1f427752e.js

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

170.33.9.200 , Singapore, ASN134963 (ASEPL-AS-AP Alibaba.com Singapore E-Commerce Private Limited, SG),

Reverse DNS

Software

/ ASP.NET

Resource Hash

e307589381e9547197496915557f0f70dbd39f517c5bd0029aa939b2b0ae5734

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1;mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://book.rwgenting.com/onelogin/login?mid=5B5BA18CDF117678AD4A556ED500F79A550D62537139386F006D6DC3800866384A73B0794550B7006CB01F8D8C8806AE63A0E64A409145A7B9280D0CD1B123079FF4B25BFBEDEDABFD418D82CC6DDBC24F&hashCode=A3A88955236CD99122BD213EA23933F9E7F81F9BD51A2B4F48BB5B0931A7EC1E0D19AE4D5C8DCFA4D14E015614CAF61112414F4A736E01975F01131A0&language=en
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

Date: Thu, 21 Jul 2022 05:25:44 GMT
Content-Encoding: gzip
Vary: Accept-Encoding
Last-Modified: Mon, 04 Jul 2022 06:06:07 GMT
X-Powered-By: ASP.NET
X-Frame-Options: SAMEORIGIN
Content-Type: application/javascript
Transfer-Encoding: chunked
Connection: keep-alive
X-XSS-PROTECTION: 1;mode=block

GET
H/1.1 200
OK main.6bdb9ad558709b348c87.js Show response
book.rwgenting.com/onelogin/ 2 MB
416 KB 836ms
746ms Script
application/javascript 170.33.9.200
ASEPL-AS-AP Aliba...

General

Check archive.org

Show headers Download Go to

Full URL

https://book.rwgenting.com/onelogin/main.6bdb9ad558709b348c87.js

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

170.33.9.200 , Singapore, ASN134963 (ASEPL-AS-AP Alibaba.com Singapore E-Commerce Private Limited, SG),

Reverse DNS

Software

/ ASP.NET

Resource Hash

e98538ed9f205ef8127b6be7bb7ea2435c9deb31eff7fbad8489bdbc161002b7

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1;mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://book.rwgenting.com/onelogin/login?mid=5B5BA18CDF117678AD4A556ED500F79A550D62537139386F006D6DC3800866384A73B0794550B7006CB01F8D8C8806AE63A0E64A409145A7B9280D0CD1B123079FF4B25BFBEDEDABFD418D82CC6DDBC24F&hashCode=A3A88955236CD99122BD213EA23933F9E7F81F9BD51A2B4F48BB5B0931A7EC1E0D19AE4D5C8DCFA4D14E015614CAF61112414F4A736E01975F01131A0&language=en
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

Date: Thu, 21 Jul 2022 05:25:44 GMT
Content-Encoding: gzip
Vary: Accept-Encoding
Last-Modified: Mon, 04 Jul 2022 06:06:07 GMT
X-Powered-By: ASP.NET
X-Frame-Options: SAMEORIGIN
Content-Type: application/javascript
Transfer-Encoding: chunked
Connection: keep-alive
X-XSS-PROTECTION: 1;mode=block

GET
H2 200 messenger.Extensions.js Show response
connect.facebook.net/en_US/ 129 KB
38 KB 124ms
39ms Script
application/x-javascript 2a03:2880:f02d:100:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/messenger.Extensions.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f02d:100:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

57f6d8487bab98a2619f66320d98bcc0c51ca41a05a266d253c5c1e259649f41

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://book.rwgenting.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; preload; includeSubDomains
content-encoding: gzip
x-content-type-options: nosniff
content-md5: yu+HPqni4JhU8iN0eISJ0g==
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400,h3-29=":443"; ma=86400
content-length: 38312
x-fb-rlafr: 0
x-fb-debug: wNRVW6rcf/n6z2Z3+xf1OJSX8jb8qwpVB6oxcbyFO1+3MdAkhRu/MPq1SVgav/LuyxAXqS3CiOdHU1mj62QKfw==
x-fb-trip-id: 917726464
x-fb-content-md5: fb0e7014bda87f21db1c3f62241fc378
x-frame-options: DENY
date: Thu, 21 Jul 2022 05:25:43 GMT
vary: Accept-Encoding
content-type: application/x-javascript; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: X-FB-Content-MD5
cache-control: public,max-age=1200,stale-while-revalidate=3600
etag: "a0bc38922504a380c24f169cc831c1a7"
timing-allow-origin: *
priority: u=1,i
expires: Thu, 21 Jul 2022 05:32:18 GMT

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 265 KB
87 KB 144ms
60ms Script
application/javascript 2a00:1450:4001:828::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-K3SJ4N2

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

e3018325ef078b10810876eab67c9f324f4401349cdc8e775eb5223134c6b868

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://book.rwgenting.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

date: Thu, 21 Jul 2022 05:25:43 GMT
content-encoding: br
vary: Accept-Encoding
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 88387
x-xss-protection: 0
last-modified: Thu, 21 Jul 2022 03:00:00 GMT
server: Google Tag Manager
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Thu, 21 Jul 2022 05:25:43 GMT

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 49 KB
20 KB 120ms
36ms Script
text/javascript 2a00:1450:4001:830::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

a1925038db769477ab74b4df34350c35688a795bb718727b0f4292a4a78a6210

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://book.rwgenting.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Wed, 13 Apr 2022 21:02:38 GMT
server: Golfe2
age: 1186
date: Thu, 21 Jul 2022 05:05:57 GMT
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 20006
expires: Thu, 21 Jul 2022 07:05:57 GMT

GET
H2 200 tpjex3u73.js Show response
cdn.krxd.net/controltag/ 19 KB
5 KB 916ms
136ms Script
text/javascript 151.101.194.133
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.krxd.net/controltag/tpjex3u73.js
Requested by: Host: book.rwgenting.com
URL: https://book.rwgenting.com/onelogin/login?mid=5B5BA18CDF117678AD4A556ED500F79A550D62537139386F006D6DC3800866384A73B0794550B7006CB01F8D8C8806AE63A0E64A409145A7B9280D0CD1B123079FF4B25BFBEDEDABFD418D82CC6DDBC24F&hashCode=A3A88955236CD99122BD213EA23933F9E7F81F9BD51A2B4F48BB5B0931A7EC1E0D19AE4D5C8DCFA4D14E015614CAF61112414F4A736E01975F01131A0&language=en
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.194.133 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: 39552c65dca63a153fa82b1463652393f010ea6602e0e963195dc6a46407fb7d

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://book.rwgenting.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

x-cdn-backend: 4FrRTvEr9h480D4BywjehZ--F_config_service_ash_prod
date: Thu, 21 Jul 2022 05:25:44 GMT
via: 1.1 varnish, 1.1 varnish
age: 9
x-cache: MISS, HIT, HIT
x-app-cache: HIT
x-age: 0
content-encoding: gzip
content-length: 4759
x-served-by: config-service-a002-ash-prod.krxd.net, cache-iad-kcgs7200140-IAD, cache-hhn4031-HHN
x-response-time: 1
x-do-esi: esi
x-timer: S1658381144.442004,VS0,VE92
etag: "5fd884d4c6b801fd533305342a74ca84456d71c6"
vary: Accept-Encoding
content-type: text/javascript; charset=utf-8
cache-control: public, max-age=1200
accept-ranges: bytes
x-cache-hits: 0, 1, 1

POST
H2 200 collect Show response
www.google-analytics.com/j/ 4 B
211 B 45ms
44ms XHR
text/plain 2a00:1450:4001:830::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j96&a=501919268&t=pageview&_s=1&dl=https%3A%2F%2Fbook.rwgenting.com%2Fonelogin%2Flogin%3Fmid%3D5B5BA18CDF117678AD4A556ED500F79A550D62537139386F006D6DC3800866384A73B0794550B7006CB01F8D8C8806AE63A0E64A409145A7B9280D0CD1B123079FF4B25BFBEDEDABFD418D82CC6DDBC24F%26hashCode%3DA3A88955236CD99122BD213EA23933F9E7F81F9BD51A2B4F48BB5B0931A7EC1E0D19AE4D5C8DCFA4D14E015614CAF61112414F4A736E01975F01131A0%26language%3Den&ul=en-us&de=UTF-8&dt=Resorts%20World%20Genting&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=IEBAAEABAAAAAC~&jid=718192208&gjid=1113603562&cid=413884077.1658381144&tid=UA-3398302-45&_gid=386319323.1658381144&_r=1&_slc=1&z=46762882

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

aec60bc104db041b1512185839f18f52986df7e569e5445f740dd60f763fbca8

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://book.rwgenting.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Thu, 21 Jul 2022 05:25:43 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://book.rwgenting.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 205 KB
73 KB 144ms
68ms Script
application/javascript 2a00:1450:4001:828::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-2QCFNCZ841&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-K3SJ4N2

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

b9c555b75e4d1620a4c0cfccea19e3ac4e54e4555654edbe353e4ce1263f01f3

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://book.rwgenting.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

date: Thu, 21 Jul 2022 05:25:43 GMT
content-encoding: br
server: Google Tag Manager
access-control-allow-headers: Cache-Control
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; includeSubDomains
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 74428
x-xss-protection: 0
expires: Thu, 21 Jul 2022 05:25:43 GMT

GET
H2 200 optimize.js Show response
www.googleoptimize.com/ 120 KB
45 KB 611ms
63ms Script
application/javascript 2a00:1450:4001:810::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googleoptimize.com/optimize.js?id=GTM-M89PTDB

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-K3SJ4N2

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

96b5758d29b5bbe4540eb1261b04bdde68fb77355e9367a9d1cafab13615f13a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://book.rwgenting.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

date: Thu, 21 Jul 2022 05:25:44 GMT
content-encoding: br
server: Google Tag Manager
access-control-allow-headers: Cache-Control
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; includeSubDomains
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 45854
x-xss-protection: 0
expires: Thu, 21 Jul 2022 05:25:44 GMT

GET
H3 200 fbevents.js Show response
connect.facebook.net/en_US/ 98 KB
25 KB 78ms
37ms Script
application/x-javascript 2a03:2880:f02d:100:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/fbevents.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-K3SJ4N2

Protocol

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f02d:100:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

6e164ad4aa1f1905c44c2e4e57088f313738d18320a99a7e6a984b862523d96d

Security Headers

Name	Value
Content-Security-Policy	default-src facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com data: blob: 'self';script-src .fbcdn.net .facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;connect-src .fbcdn.net .facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://book.rwgenting.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

content-security-policy: default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
content-encoding: gzip
x-content-type-options: nosniff
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400,h3-29=":443"; ma=86400
content-length: 26001
x-xss-protection: 0
pragma: public
x-fb-debug: ik++fhX13pmWYKtE23/4ovo4Fsxh7cl7cLP29F9HRZfBYr5JppIJ/A/9AFkD8Mrl6qn+DGvki+AyIe9/UNq73g==
x-frame-options: DENY
date: Thu, 21 Jul 2022 05:25:43 GMT
strict-transport-security: max-age=31536000; preload; includeSubDomains
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cache-control: public, max-age=1200
x-fb-rlafr: 0
priority: u=3,i
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 quant.js Show response
secure.quantserve.com/ 24 KB
10 KB 592ms
48ms Script
application/javascript 2620:116:800d:21:b314:a0ef:ab7c:d546
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://secure.quantserve.com/quant.js
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-K3SJ4N2
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2620:116:800d:21:b314:a0ef:ab7c:d546 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: dafa3ce4de4cc56876b0fc6c36628fbcade9f4b07d7f27e4ca67744d91b2beb7

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://book.rwgenting.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

date: Thu, 21 Jul 2022 05:25:44 GMT
content-encoding: gzip
etag: "77f5L8LR6ldZZZ+q4Q+xaw=="
vary: Accept-Encoding
content-type: application/javascript
cache-control: private, max-age=604800
accept-ranges: bytes
expires: Thu, 28 Jul 2022 05:25:44 GMT

GET
H2 200 b90894f9b1582df507297d968da7fecece37d93.js Show response
cdn.brand-display.com/tr/knx15814/ 23 KB
23 KB 601ms
59ms Script
text/javascript 18.66.248.12
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.brand-display.com/tr/knx15814/b90894f9b1582df507297d968da7fecece37d93.js?v1=%%PAGE_CATEGORY%%&v2=https%3A%2F%2Fbook.rwgenting.com%2Fonelogin%2Flogin%3Fmid%3D5B5BA18CDF117678AD4A556ED500F79A550D62537139386F006D6DC3800866384A73B0794550B7006CB01F8D8C8806AE63A0E64A409145A7B9280D0CD1B123079FF4B25BFBEDEDABFD418D82CC6DDBC24F%26hashCode%3DA3A88955236CD99122BD213EA23933F9E7F81F9BD51A2B4F48BB5B0931A7EC1E0D19AE4D5C8DCFA4D14E015614CAF61112414F4A736E01975F01131A0%26language%3Den&_t=1658381143888
Requested by: Host: book.rwgenting.com
URL: https://book.rwgenting.com/onelogin/login?mid=5B5BA18CDF117678AD4A556ED500F79A550D62537139386F006D6DC3800866384A73B0794550B7006CB01F8D8C8806AE63A0E64A409145A7B9280D0CD1B123079FF4B25BFBEDEDABFD418D82CC6DDBC24F&hashCode=A3A88955236CD99122BD213EA23933F9E7F81F9BD51A2B4F48BB5B0931A7EC1E0D19AE4D5C8DCFA4D14E015614CAF61112414F4A736E01975F01131A0&language=en
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.66.248.12 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-66-248-12.dus51.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: c08e671967a1e37c99c6644d9ce66597c324639607a4df7df671d4d6b4229268

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://book.rwgenting.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

x-amz-version-id: tOXJK.mG6DRpfvXzPon70dkZrK06OlQH
via: 1.1 1b18b0df6149933160ee945c6867dc2c.cloudfront.net (CloudFront)
last-modified: Mon, 30 Nov 2020 18:06:07 GMT
server: AmazonS3
age: 11831
etag: "8309c31a6749ee17ee6655d88ca91426"
x-cache: Hit from cloudfront
content-type: text/javascript
cache-control: no-cache, must-revalidate, proxy-revalidate, public, max-age=0
date: Thu, 21 Jul 2022 02:08:34 GMT
x-amz-cf-pop: DUS51-P1
accept-ranges: bytes
content-length: 23323
x-amz-cf-id: l0XZHavCUR-qN_wIx770tQKIbM8ULB5FzwHBRZamuEQMqP8XquWb2Q==

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 115 KB
45 KB 119ms
52ms Script
application/javascript 2a00:1450:4001:828::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-941664267

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-K3SJ4N2

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

9196de04e6e0a1b5325caf766f9773a39d100491086d5cfc2a79a9a22a3c32d2

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://book.rwgenting.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

date: Thu, 21 Jul 2022 05:25:43 GMT
content-encoding: br
vary: Accept-Encoding
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 45695
x-xss-protection: 0
last-modified: Thu, 21 Jul 2022 03:00:00 GMT
server: Google Tag Manager
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Thu, 21 Jul 2022 05:25:43 GMT

GET
H3 200 xfbml.customerchat.js Show response
connect.facebook.net/en_GB/sdk/ 308 KB
88 KB 110ms
74ms Script
application/x-javascript 2a03:2880:f02d:100:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_GB/sdk/xfbml.customerchat.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f02d:100:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

a6167d3e3b6ff969ee4607699d515d7373e183e5fbb7683428354e7dd8157bd7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://book.rwgenting.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; preload; includeSubDomains
content-encoding: gzip
x-content-type-options: nosniff
content-md5: TkPKWSJza5LjiLkFOIhMNg==
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
expires: Thu, 21 Jul 2022 05:36:04 GMT
alt-svc: h3=":443"; ma=86400,h3-29=":443"; ma=86400
content-length: 89899
x-fb-rlafr: 0
x-fb-debug: 2jhPFIRGfzqzjEXx3O63Dh3H27PRuOcF/spcJeYidUbsssm/3R0szS1DxbeK4uYhalja/jELMflbi7f7/0hVLA==
x-fb-content-md5: c674034eecd90c4c4e6d46cbbac0ad8c
cross-origin-opener-policy: same-origin-allow-popups
date: Thu, 21 Jul 2022 05:25:43 GMT
x-frame-options: DENY
report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/?minimize=0"}],"group":"coop_report","include_subdomains":true}
content-type: application/x-javascript; charset=utf-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public,max-age=1200,stale-while-revalidate=3600
etag: "f15a93c8ecff85cf9df36ae289027afa"
timing-allow-origin: *
priority: u=3,i
access-control-expose-headers: X-FB-Content-MD5

POST
H2 200 collect Show response
stats.g.doubleclick.net/j/ 4 B
444 B 155ms
47ms XHR
text/plain 2a00:1450:400c:c00::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j96&tid=UA-3398302-45&cid=413884077.1658381144&jid=718192208&gjid=1113603562&_gid=386319323.1658381144&_u=IEBAAEAAAAAAAC~&z=1109940053

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400c:c00::9b Brussels, Belgium, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://book.rwgenting.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
strict-transport-security: max-age=10886400; includeSubDomains; preload
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
date: Thu, 21 Jul 2022 05:25:44 GMT
content-type: text/plain
access-control-allow-origin: https://book.rwgenting.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 identity.js Show response
connect.facebook.net/signals/plugins/ 64 KB
20 KB 38ms
38ms Script
application/x-javascript 2a03:2880:f02d:100:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/signals/plugins/identity.js?v=2.9.65

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f02d:100:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

d4edbbe1037c50c8ffa90860286c8166860ad9da450ed5e16a28e2fc9bce3c23

Security Headers

Name	Value
Content-Security-Policy	default-src facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com data: blob: 'self';script-src .fbcdn.net .facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;connect-src .fbcdn.net .facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://book.rwgenting.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

content-security-policy: default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
content-encoding: gzip
x-content-type-options: nosniff
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400,h3-29=":443"; ma=86400
content-length: 20715
x-xss-protection: 0
pragma: public
x-fb-debug: osWzJ2VslMwseGpjVf1sBVmjY7OFeTmrKSS596B7gRT//77SNM5ucH0yTPcf8t03ZLBJzvMjSD15tF4+EsBE2w==
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: DENY
date: Thu, 21 Jul 2022 05:25:44 GMT
strict-transport-security: max-age=31536000; preload; includeSubDomains
report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/?minimize=0"}],"group":"coop_report","include_subdomains":true}
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cache-control: public, max-age=1200
x-fb-rlafr: 0
priority: u=3,i
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H3 200 498877868265126 Show response
connect.facebook.net/signals/config/ 292 KB
84 KB 192ms
192ms Script
application/x-javascript 2a03:2880:f02d:100:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/signals/config/498877868265126?v=2.9.65&r=stable

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f02d:100:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

d3f21d08879d324cab618b79ee82ed48366b99516b384c5e6413037223c0901c

Security Headers

Name	Value
Content-Security-Policy	default-src facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com data: blob: 'self';script-src .fbcdn.net .facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;connect-src .fbcdn.net .facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://book.rwgenting.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

content-security-policy: default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
content-encoding: gzip
x-content-type-options: nosniff
document-policy: force-load-at-top
report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/?minimize=0"}],"group":"coop_report","include_subdomains":true}
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400,h3-29=":443"; ma=86400
x-xss-protection: 0
pragma: public
x-fb-debug: 7yxFNU5M4lOWM7EE94omhWsKTp9vibXrZ+WrjXZKydhXe1SOKaFrccpRDKGcvv5Y/V5kCBrbacf9kw+GpnOZlw==
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: DENY
date: Thu, 21 Jul 2022 05:25:44 GMT
strict-transport-security: max-age=31536000; preload; includeSubDomains
x-content-cdn-origin-ts: 1658381144610
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cache-control: public, max-age=1200
x-fb-rlafr: 0
priority: u=3,i
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 conversion_async.js Show response
www.googleadservices.com/pagead/ 40 KB
15 KB 167ms
64ms Script
text/javascript 142.250.186.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googleadservices.com/pagead/conversion_async.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-941664267

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s08-in-f2.1e100.net

Software

cafe /

Resource Hash

b3b810fd46e7aad5b789896519011ab5366b39dbb19a5663c53525f756e89bfb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://book.rwgenting.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

date: Thu, 21 Jul 2022 05:25:44 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15160
x-xss-protection: 0
server: cafe
etag: 9823212955285023900
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600
timing-allow-origin: *
expires: Thu, 21 Jul 2022 05:25:44 GMT

POST
H2 204 collect
region1.analytics.google.com/g/ 0
349 B 142ms
44ms Ping
text/plain 2001:4860:4802:32::36
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://region1.analytics.google.com/g/collect?v=2&tid=G-2QCFNCZ841&gtm=2oe7i0&_p=501919268&_z=ccd.v9B&_gaz=1&cid=413884077.1658381144&ul=en-us&sr=1600x1200&_s=1&sid=1658381144&sct=1&seg=0&dl=https%3A%2F%2Fbook.rwgenting.com%2Fonelogin%2Flogin%3Fmid%3D5B5BA18CDF117678AD4A556ED500F79A550D62537139386F006D6DC3800866384A73B0794550B7006CB01F8D8C8806AE63A0E64A409145A7B9280D0CD1B123079FF4B25BFBEDEDABFD418D82CC6DDBC24F%26hashCode%3DA3A88955236CD99122BD213EA23933F9E7F81F9BD51A2B4F48BB5B0931A7EC1E0D19AE4D5C8DCFA4D14E015614CAF61112414F4A736E01975F01131A0%26language%3Den&dt=Resorts%20World%20Genting&en=page_view&_fv=1&_ss=1
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-2QCFNCZ841&l=dataLayer&cx=c
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4860:4802:32::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://book.rwgenting.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 21 Jul 2022 05:25:44 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://book.rwgenting.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 204 collect
stats.g.doubleclick.net/g/ 0
56 B 113ms
48ms Ping
text/plain 2a00:1450:400c:c00::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://stats.g.doubleclick.net/g/collect?v=2&tid=G-2QCFNCZ841&cid=413884077.1658381144&gtm=2oe7i0&aip=1
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-2QCFNCZ841&l=dataLayer&cx=c
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:400c:c00::9b Brussels, Belgium, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://book.rwgenting.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 21 Jul 2022 05:25:44 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://book.rwgenting.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ga-audiences
www.google.de/ads/ 42 B
501 B 132ms
49ms Image
image/gif 2a00:1450:4001:80e::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/ads/ga-audiences?v=1&t=sr&slf_rd=1&_r=4&tid=G-2QCFNCZ841&cid=413884077.1658381144&gtm=2oe7i0&aip=1&z=1635170408

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80e::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://book.rwgenting.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 21 Jul 2022 05:25:44 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 rules-p-ju4brbPEmhN_U.js Show response
rules.quantcount.com/ 784 B
1 KB 756ms
634ms Script
application/javascript 2600:9000:20fc:1400:6:44e3:f8c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://rules.quantcount.com/rules-p-ju4brbPEmhN_U.js
Requested by: Host: secure.quantserve.com
URL: https://secure.quantserve.com/quant.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:20fc:1400:6:44e3:f8c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: a916bd4fc8460bb0b3f39ebdd10982c740dd3135a1d45705d008700ffbe2f776

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://book.rwgenting.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

date: Thu, 21 Jul 2022 05:25:45 GMT
via: 1.1 52bb5852b1acec80b918512e69d8f7dc.cloudfront.net (CloudFront)
x-amz-cf-pop: ARN54-C1
x-amz-server-side-encryption: AES256
x-cache: RefreshHit from cloudfront
cross-origin-resource-policy: cross-origin
content-length: 784
last-modified: Thu, 08 Aug 2019 05:47:43 GMT
server: AmazonS3
etag: "1f2e1057abe844788f26f2f7ec2adfe1"
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=3600
accept-ranges: bytes
x-amz-cf-id: -8wEQMyiHlrfoL4SopvyUEfsuJBQgInHajr7mnS8VlmyNY0z01d4EA==

GET
H2 200 fingerprint2.min.js Show response
cdn.brand-display.com/sv/js/ 29 KB
29 KB 50ms
50ms Script
application/javascript 18.66.248.12
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.brand-display.com/sv/js/fingerprint2.min.js
Requested by: Host: cdn.brand-display.com
URL: https://cdn.brand-display.com/tr/knx15814/b90894f9b1582df507297d968da7fecece37d93.js?v1=%%PAGE_CATEGORY%%&v2=https%3A%2F%2Fbook.rwgenting.com%2Fonelogin%2Flogin%3Fmid%3D5B5BA18CDF117678AD4A556ED500F79A550D62537139386F006D6DC3800866384A73B0794550B7006CB01F8D8C8806AE63A0E64A409145A7B9280D0CD1B123079FF4B25BFBEDEDABFD418D82CC6DDBC24F%26hashCode%3DA3A88955236CD99122BD213EA23933F9E7F81F9BD51A2B4F48BB5B0931A7EC1E0D19AE4D5C8DCFA4D14E015614CAF61112414F4A736E01975F01131A0%26language%3Den&_t=1658381143888
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.66.248.12 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-66-248-12.dus51.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: ba50544bc52682e3884d79402fa65bbc8149866ff097223c48d9da54bb02e280

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://book.rwgenting.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

x-amz-version-id: FMv4TnIx_EkiUylzRiS37tBQkjLZO1jg
via: 1.1 1b18b0df6149933160ee945c6867dc2c.cloudfront.net (CloudFront)
last-modified: Fri, 10 Apr 2020 12:22:17 GMT
server: AmazonS3
age: 68
etag: "3b1a8d0a55f588f5675fa2ecd2abc5c2"
x-cache: Hit from cloudfront
content-type: application/javascript
date: Thu, 21 Jul 2022 05:24:42 GMT
x-amz-cf-pop: DUS51-P1
accept-ranges: bytes
content-length: 29420
x-amz-cf-id: yYGHXdd8YsKRX49pjz89igBT6NwZRZC5ADLs6_QtmtEJLzN2z4McBg==

POST
H3 200 collect Show response
www.google-analytics.com/j/ 2 B
22 B 44ms
44ms XHR
text/plain 2a00:1450:4001:830::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j96&a=501919268&t=pageview&_s=1&dl=https%3A%2F%2Fbook.rwgenting.com%2Fonelogin%2Flogin%3Fmid%3D5B5BA18CDF117678AD4A556ED500F79A550D62537139386F006D6DC3800866384A73B0794550B7006CB01F8D8C8806AE63A0E64A409145A7B9280D0CD1B123079FF4B25BFBEDEDABFD418D82CC6DDBC24F%26hashCode%3DA3A88955236CD99122BD213EA23933F9E7F81F9BD51A2B4F48BB5B0931A7EC1E0D19AE4D5C8DCFA4D14E015614CAF61112414F4A736E01975F01131A0%26language%3Den&ul=en-us&de=UTF-8&dt=Resorts%20World%20Genting&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=aGDACEABRAAAAC~&jid=764320372&gjid=1955331191&cid=413884077.1658381144&tid=UA-3398302-45&_gid=386319323.1658381144&_r=1&gtm=2wg7i0K3SJ4N2&z=644584206

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

de3246094525b21a870fc7d2a67490d0132535c6fa5993755c549f1a9d1bd8af

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://book.rwgenting.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Thu, 21 Jul 2022 05:25:44 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://book.rwgenting.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 controltag.js.0631b7d64dbbd3656a8b7368ad227a04 Show response
cdn.krxd.net/ctjs/ 259 KB
83 KB 37ms
37ms Script
application/javascript 151.101.194.133
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.krxd.net/ctjs/controltag.js.0631b7d64dbbd3656a8b7368ad227a04
Requested by: Host: cdn.krxd.net
URL: https://cdn.krxd.net/controltag/tpjex3u73.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.194.133 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: b9b47c8bafc4618d804c7c54ac03c39b29beb9ed5b1e7d9dbadb0f28d71c3d94

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://book.rwgenting.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

x-cdn-backend: 4FrRTvEr9h480D4BywjehZ--F_Controltag_S3
date: Thu, 21 Jul 2022 05:25:44 GMT
content-encoding: gzip
age: 8653657
x-amz-server-side-encryption: AES256
x-cache: HIT
x-cache-hits: 38793
content-length: 84451
x-served-by: cache-hhn4031-HHN
last-modified: Thu, 15 Oct 2020 07:09:29 GMT
x-timer: S1658381145.589177,VS0,VE0
etag: "0631b7d64dbbd3656a8b7368ad227a04"
content-type: application/javascript
via: 1.1 varnish
cache-control: public, max-age=315360000
accept-ranges: bytes
expires: Sun, 13 Oct 2030 07:09:28 GMT

GET
H2 200 ga-audiences
www.google.com/ads/ 42 B
501 B 138ms
48ms Image
image/gif 2a00:1450:4001:827::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j96&tid=UA-3398302-45&cid=413884077.1658381144&jid=718192208&_u=IEBAAEAAAAAAAC~&z=10580994

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://book.rwgenting.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 21 Jul 2022 05:25:44 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ga-audiences
www.google.de/ads/ 42 B
107 B 47ms
47ms Image
image/gif 2a00:1450:4001:80e::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j96&tid=UA-3398302-45&cid=413884077.1658381144&jid=718192208&_u=IEBAAEAAAAAAAC~&z=10580994

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80e::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://book.rwgenting.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 21 Jul 2022 05:25:44 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H3 200 collect Show response
stats.g.doubleclick.net/j/ 4 B
25 B 142ms
48ms XHR
text/plain 2a00:1450:400c:c00::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j96&tid=UA-3398302-45&cid=413884077.1658381144&jid=764320372&gjid=1955331191&_gid=386319323.1658381144&_u=aGDACEABRAAAAC~&z=1310032942

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:400c:c00::9b Brussels, Belgium, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://book.rwgenting.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
strict-transport-security: max-age=10886400; includeSubDomains; preload
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
date: Thu, 21 Jul 2022 05:25:44 GMT
content-type: text/plain
access-control-allow-origin: https://book.rwgenting.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/941664267/ 3 KB
2 KB 134ms
51ms Script
text/javascript 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/941664267/?random=1658381144623&cv=9&fst=1658381144623&num=1&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa7i0&sendb=1&ig=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fbook.rwgenting.com%2Fonelogin%2Flogin%3Fmid%3D5B5BA18CDF117678AD4A556ED500F79A550D62537139386F006D6DC3800866384A73B0794550B7006CB01F8D8C8806AE63A0E64A409145A7B9280D0CD1B123079FF4B25BFBEDEDABFD418D82CC6DDBC24F%26hashCode%3DA3A88955236CD99122BD213EA23933F9E7F81F9BD51A2B4F48BB5B0931A7EC1E0D19AE4D5C8DCFA4D14E015614CAF61112414F4A736E01975F01131A0%26language%3Den&tiba=Resorts%20World%20Genting&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4

Requested by

Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/conversion_async.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

cedcf159346f2821fe551254c57c7e79c95fe4d3a13fdf70ce5fda4bd83f41f3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://book.rwgenting.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 21 Jul 2022 05:25:44 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1297
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 1408760949555385 Show response
connect.facebook.net/signals/config/ 292 KB
84 KB 90ms
89ms Script
application/x-javascript 2a03:2880:f02d:100:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/signals/config/1408760949555385?v=2.9.65&r=stable

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f02d:100:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

63a9d69c6229b4cfbc63999cbd0a0b463208b2b0bd28d0e56d350d0c77bd4591

Security Headers

Name	Value
Content-Security-Policy	default-src facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com data: blob: 'self';script-src .fbcdn.net .facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;connect-src .fbcdn.net .facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://book.rwgenting.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

content-security-policy: default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
content-encoding: gzip
x-content-type-options: nosniff
document-policy: force-load-at-top
report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/?minimize=0"}],"group":"coop_report","include_subdomains":true}
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400,h3-29=":443"; ma=86400
x-xss-protection: 0
pragma: public
x-fb-debug: FnU16ZOe/QznGnH2MGGb616WLtdYUqnGsnY4mBtA97VVp9G/D4SFKuF0hurxHGwKrURQtH2vsME8WFB45I0n5w==
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: DENY
date: Thu, 21 Jul 2022 05:25:44 GMT
strict-transport-security: max-age=31536000; preload; includeSubDomains
x-content-cdn-origin-ts: 1658381144719
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cache-control: public, max-age=1200
x-fb-rlafr: 0
priority: u=3,i
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 /
www.facebook.com/tr/ 44 B
297 B 124ms
39ms Image
image/gif 2a03:2880:f12d:181:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=498877868265126&ev=PageView&dl=https%3A%2F%2Fbook.rwgenting.com%2Fonelogin%2Flogin%3Fmid%3D5B5BA18CDF117678AD4A556ED500F79A550D62537139386F006D6DC3800866384A73B0794550B7006CB01F8D8C8806AE63A0E64A409145A7B9280D0CD1B123079FF4B25BFBEDEDABFD418D82CC6DDBC24F%26hashCode%3DA3A88955236CD99122BD213EA23933F9E7F81F9BD51A2B4F48BB5B0931A7EC1E0D19AE4D5C8DCFA4D14E015614CAF61112414F4A736E01975F01131A0%26language%3Den&rl=&if=false&ts=1658381144648&sw=1600&sh=1200&v=2.9.65&r=stable&a=tmSimo-GTM-WebTemplate&ec=0&o=30&fbp=fb.1.1658381144647.1787190418&it=1658381144437&coo=false&tm=1&exp=u0&rqm=GET

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f12d:181:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://book.rwgenting.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

date: Thu, 21 Jul 2022 05:25:44 GMT
last-modified: Fri, 21 Dec 2012 00:00:01 GMT
server: proxygen-bolt
strict-transport-security: max-age=31536000; includeSubDomains
content-type: image/gif
cache-control: no-cache, must-revalidate, max-age=0
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 44
expires: Thu, 21 Jul 2022 05:25:44 GMT

GET
H2 200 proxy.3d2100fd7107262ecb55ce6847f01fa5.html Show response
cdn.krxd.net/partnerjs/xdi/ Frame E7DA 805 B
826 B 37ms
37ms Document
text/html 151.101.194.133
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.krxd.net/partnerjs/xdi/proxy.3d2100fd7107262ecb55ce6847f01fa5.html
Requested by: Host: cdn.krxd.net
URL: https://cdn.krxd.net/ctjs/controltag.js.0631b7d64dbbd3656a8b7368ad227a04
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.194.133 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: 3bcfa04dbc2db44af54bd72a0f7b98912368f16f525729a1b9b673f62ca7e5c9

Request headers

Referer: https://book.rwgenting.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 5628807
cache-control: public, max-age=315360000
content-encoding: gzip
content-length: 525
content-type: text/html
date: Thu, 21 Jul 2022 05:25:44 GMT
etag: "3d2100fd7107262ecb55ce6847f01fa5"
expires: Fri, 19 Feb 2027 17:50:50 GMT
last-modified: Tue, 21 Feb 2017 17:50:54 GMT
p3p: policyref="https://cdn.krxd.net/kruxcontent/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
vary: Accept-Encoding
via: 1.1 varnish
x-cache: HIT
x-cache-hits: 484800
x-cdn-backend: 4FrRTvEr9h480D4BywjehZ--F_Partner_JS_S3
x-served-by: cache-hhn4031-HHN
x-timer: S1658381145.702881,VS0,VE0

GET
H2 200 02a4d1b4-9afb-42e8-bb16-e9bfe48451b4 Show response
consumer.krxd.net/consent/get/ 235 B
425 B 151ms
65ms Script
text/javascript 151.101.194.133
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://consumer.krxd.net/consent/get/02a4d1b4-9afb-42e8-bb16-e9bfe48451b4?idt=device&dt=kxcookie&callback=Krux.ns.genting.kxjsonp_consent_get_0
Requested by: Host: cdn.krxd.net
URL: https://cdn.krxd.net/ctjs/controltag.js.0631b7d64dbbd3656a8b7368ad227a04
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.194.133 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: e08a8b816844b1b36de422161848b43b2f43b83a9c3363523b239ad7dedf8477

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://book.rwgenting.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

date: Thu, 21 Jul 2022 05:25:44 GMT
via: 1.1 varnish
age: 0
x-served-by: consumer-a010-dub-prod.krxd.net, cache-hhn4064-HHN
vary: Accept-Encoding
x-cache: MISS, MISS
content-type: text/javascript; charset=UTF-8
content-encoding: gzip
cache-control: max-age=1800
x-age: 0
accept-ranges: bytes
x-timer: S1658381145.851279,VS0,VE29
content-length: 186
x-cache-hits: 0, 0

GET
H2 200 tpjex3u73.js Show response
cdn.krxd.net/controltag/ Frame E7DA 19 KB
5 KB 38ms
37ms Script
text/javascript 151.101.194.133
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.krxd.net/controltag/tpjex3u73.js
Requested by: Host: cdn.krxd.net
URL: https://cdn.krxd.net/partnerjs/xdi/proxy.3d2100fd7107262ecb55ce6847f01fa5.html
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.194.133 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: 39552c65dca63a153fa82b1463652393f010ea6602e0e963195dc6a46407fb7d

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://cdn.krxd.net/partnerjs/xdi/proxy.3d2100fd7107262ecb55ce6847f01fa5.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

x-cdn-backend: 4FrRTvEr9h480D4BywjehZ--F_config_service_ash_prod
date: Thu, 21 Jul 2022 05:25:44 GMT
via: 1.1 varnish, 1.1 varnish
age: 9
x-cache: MISS, HIT, HIT
x-app-cache: HIT
x-age: 0
content-encoding: gzip
content-length: 4759
x-served-by: config-service-a002-ash-prod.krxd.net, cache-iad-kcgs7200140-IAD, cache-hhn4031-HHN
x-response-time: 1
x-do-esi: esi
x-timer: S1658381145.768787,VS0,VE0
etag: "5fd884d4c6b801fd533305342a74ca84456d71c6"
vary: Accept-Encoding
content-type: text/javascript; charset=utf-8
cache-control: public, max-age=1200
accept-ranges: bytes
x-cache-hits: 0, 1, 2

GET
H3 200 ga-audiences
www.google.com/ads/ 42 B
63 B 127ms
48ms Image
image/gif 2a00:1450:4001:827::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j96&tid=UA-3398302-45&cid=413884077.1658381144&jid=764320372&_u=aGDACEABRAAAAC~&z=1376943824

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://book.rwgenting.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 21 Jul 2022 05:25:44 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ga-audiences
www.google.de/ads/ 42 B
63 B 127ms
50ms Image
image/gif 2a00:1450:4001:80e::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j96&tid=UA-3398302-45&cid=413884077.1658381144&jid=764320372&_u=aGDACEABRAAAAC~&z=1376943824

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://book.rwgenting.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 21 Jul 2022 05:25:44 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 /
www.google.com/pagead/1p-user-list/941664267/ 42 B
64 B 124ms
51ms Image
image/gif 2a00:1450:4001:827::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/941664267/?random=1658381144623&cv=9&fst=1658379600000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa7i0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fbook.rwgenting.com%2Fonelogin%2Flogin%3Fmid%3D5B5BA18CDF117678AD4A556ED500F79A550D62537139386F006D6DC3800866384A73B0794550B7006CB01F8D8C8806AE63A0E64A409145A7B9280D0CD1B123079FF4B25BFBEDEDABFD418D82CC6DDBC24F%26hashCode%3DA3A88955236CD99122BD213EA23933F9E7F81F9BD51A2B4F48BB5B0931A7EC1E0D19AE4D5C8DCFA4D14E015614CAF61112414F4A736E01975F01131A0%26language%3Den&tiba=Resorts%20World%20Genting&async=1&fmt=3&is_vtc=1&random=2950092514&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://book.rwgenting.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 21 Jul 2022 05:25:44 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 /
www.google.de/pagead/1p-user-list/941664267/ 42 B
64 B 123ms
50ms Image
image/gif 2a00:1450:4001:80e::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/941664267/?random=1658381144623&cv=9&fst=1658379600000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa7i0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fbook.rwgenting.com%2Fonelogin%2Flogin%3Fmid%3D5B5BA18CDF117678AD4A556ED500F79A550D62537139386F006D6DC3800866384A73B0794550B7006CB01F8D8C8806AE63A0E64A409145A7B9280D0CD1B123079FF4B25BFBEDEDABFD418D82CC6DDBC24F%26hashCode%3DA3A88955236CD99122BD213EA23933F9E7F81F9BD51A2B4F48BB5B0931A7EC1E0D19AE4D5C8DCFA4D14E015614CAF61112414F4A736E01975F01131A0%26language%3Den&tiba=Resorts%20World%20Genting&async=1&fmt=3&is_vtc=1&random=2950092514&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://book.rwgenting.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 21 Jul 2022 05:25:44 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK brown-regular.c8432e8b6aee3f38b857.woff2
book.rwgenting.com/onelogin/ 19 KB
20 KB 217ms
217ms Font
font/woff2 170.33.9.200
ASEPL-AS-AP Aliba...

General

Check archive.org

Show headers Download Go to

Full URL

https://book.rwgenting.com/onelogin/brown-regular.c8432e8b6aee3f38b857.woff2

Requested by

Host: book.rwgenting.com
URL: https://book.rwgenting.com/onelogin/styles.f882acbaae2af6f23122.css

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

170.33.9.200 , Singapore, ASN134963 (ASEPL-AS-AP Alibaba.com Singapore E-Commerce Private Limited, SG),

Reverse DNS

Software

/ ASP.NET

Resource Hash

3bad7d670a6660817708b9fb30b07ab22cd3db5d87f2bc2f141a67f4da9ebeb7

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1;mode=block

Request headers

Referer: https://book.rwgenting.com/onelogin/styles.f882acbaae2af6f23122.css
Origin: https://book.rwgenting.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

Date: Thu, 21 Jul 2022 05:25:44 GMT
Last-Modified: Mon, 04 Jul 2022 06:06:07 GMT
X-Powered-By: ASP.NET
ETag: "1d88f6c26583c48"
X-Frame-Options: SAMEORIGIN
Content-Type: font/woff2
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 19912
X-XSS-PROTECTION: 1;mode=block

GET
H2 200 controltag.js.0631b7d64dbbd3656a8b7368ad227a04 Show response
cdn.krxd.net/ctjs/ Frame E7DA 259 KB
83 KB 39ms
39ms Script
application/javascript 151.101.194.133
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.krxd.net/ctjs/controltag.js.0631b7d64dbbd3656a8b7368ad227a04
Requested by: Host: cdn.krxd.net
URL: https://cdn.krxd.net/controltag/tpjex3u73.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.194.133 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: b9b47c8bafc4618d804c7c54ac03c39b29beb9ed5b1e7d9dbadb0f28d71c3d94

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://cdn.krxd.net/partnerjs/xdi/proxy.3d2100fd7107262ecb55ce6847f01fa5.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

x-cdn-backend: 4FrRTvEr9h480D4BywjehZ--F_Controltag_S3
date: Thu, 21 Jul 2022 05:25:44 GMT
content-encoding: gzip
age: 8653657
x-amz-server-side-encryption: AES256
x-cache: HIT
x-cache-hits: 38794
content-length: 84451
x-served-by: cache-hhn4031-HHN
last-modified: Thu, 15 Oct 2020 07:09:29 GMT
x-timer: S1658381145.822806,VS0,VE0
etag: "0631b7d64dbbd3656a8b7368ad227a04"
content-type: application/javascript
via: 1.1 varnish
cache-control: public, max-age=315360000
accept-ranges: bytes
expires: Sun, 13 Oct 2030 07:09:28 GMT

GET
H3 200 408482393299012 Show response
connect.facebook.net/signals/config/ 292 KB
84 KB 98ms
97ms Script
application/x-javascript 2a03:2880:f02d:100:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/signals/config/408482393299012?v=2.9.65&r=stable

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f02d:100:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

5413c124c49172d18069165214409ce8b4c6427692e8bbbcfe640b7598ce6328

Security Headers

Name	Value
Content-Security-Policy	default-src facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com data: blob: 'self';script-src .fbcdn.net .facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;connect-src .fbcdn.net .facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://book.rwgenting.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

content-security-policy: default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
content-encoding: gzip
x-content-type-options: nosniff
document-policy: force-load-at-top
report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/?minimize=0"}],"group":"coop_report","include_subdomains":true}
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400,h3-29=":443"; ma=86400
x-xss-protection: 0
pragma: public
x-fb-debug: FDHaJri8gt4A+hRg3y4vZ9fE3/N8g7azbwj0VqZDsNGR6vlf+2DMJO/39U8OxJV9NpJTOLZcX4vIgwC+02tGpw==
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: DENY
date: Thu, 21 Jul 2022 05:25:44 GMT
strict-transport-security: max-age=31536000; preload; includeSubDomains
x-content-cdn-origin-ts: 1658381144887
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cache-control: public, max-age=1200
x-fb-rlafr: 0
priority: u=3,i
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H3 200 /
www.facebook.com/tr/ 44 B
91 B 78ms
37ms Image
image/gif 2a03:2880:f12d:181:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=1408760949555385&ev=PageView&dl=https%3A%2F%2Fbook.rwgenting.com%2Fonelogin%2Flogin%3Fmid%3D5B5BA18CDF117678AD4A556ED500F79A550D62537139386F006D6DC3800866384A73B0794550B7006CB01F8D8C8806AE63A0E64A409145A7B9280D0CD1B123079FF4B25BFBEDEDABFD418D82CC6DDBC24F%26hashCode%3DA3A88955236CD99122BD213EA23933F9E7F81F9BD51A2B4F48BB5B0931A7EC1E0D19AE4D5C8DCFA4D14E015614CAF61112414F4A736E01975F01131A0%26language%3Den&rl=&if=false&ts=1658381144808&sw=1600&sh=1200&v=2.9.65&r=stable&a=tmSimo-GTM-WebTemplate&ec=0&o=30&fbp=fb.1.1658381144647.1787190418&it=1658381144437&coo=false&tm=1&exp=u0&rqm=GET

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f12d:181:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://book.rwgenting.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

date: Thu, 21 Jul 2022 05:25:44 GMT
last-modified: Fri, 21 Dec 2012 00:00:01 GMT
server: proxygen-bolt
strict-transport-security: max-age=31536000; includeSubDomains
content-type: image/gif
cache-control: no-cache, must-revalidate, max-age=0
cross-origin-resource-policy: cross-origin
content-length: 44
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
priority: u=3,i
expires: Thu, 21 Jul 2022 05:25:44 GMT

GET
H2 200 02a4d1b4-9afb-42e8-bb16-e9bfe48451b4 Show response
consumer.krxd.net/consent/get/ Frame E7DA 220 B
278 B 67ms
66ms Script
text/javascript 151.101.194.133
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://consumer.krxd.net/consent/get/02a4d1b4-9afb-42e8-bb16-e9bfe48451b4?idt=device&dt=kxcookie&callback=Krux.ns.genting.kxjsonp_consent_get_0
Requested by: Host: cdn.krxd.net
URL: https://cdn.krxd.net/ctjs/controltag.js.0631b7d64dbbd3656a8b7368ad227a04
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.194.133 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: 7d3a589c487b5b54dbf677604978568337d209733a3f6bcb5bf1d993b3075ec2

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://cdn.krxd.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

date: Thu, 21 Jul 2022 05:25:44 GMT
via: 1.1 varnish
age: 0
x-served-by: consumer-a006-dub-prod.krxd.net, cache-hhn4064-HHN
vary: Accept-Encoding
x-cache: MISS, MISS
content-type: text/javascript; charset=UTF-8
content-encoding: gzip
cache-control: max-age=1800
x-age: 0
accept-ranges: bytes
x-timer: S1658381145.894573,VS0,VE30
content-length: 178
x-cache-hits: 0, 0

GET
H3 200 537857393380708 Show response
connect.facebook.net/signals/config/ 292 KB
84 KB 93ms
92ms Script
application/x-javascript 2a03:2880:f02d:100:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/signals/config/537857393380708?v=2.9.65&r=stable

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f02d:100:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

3df7235b92047d8a0e8142e7473f08078890502c88bfaa0638beb55bd83cd66d

Security Headers

Name	Value
Content-Security-Policy	default-src facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com data: blob: 'self';script-src .fbcdn.net .facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;connect-src .fbcdn.net .facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://book.rwgenting.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

content-security-policy: default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
content-encoding: gzip
x-content-type-options: nosniff
document-policy: force-load-at-top
report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/?minimize=0"}],"group":"coop_report","include_subdomains":true}
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400,h3-29=":443"; ma=86400
x-xss-protection: 0
pragma: public
x-fb-debug: 0tPfo+JVuPTwjMMStgXd50gT5qW3W5dVASqWwiQ32nKo8YOvUp5xV4eBEPuCPS96axnBHsoMIo637DZ8olWHxw==
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: DENY
date: Thu, 21 Jul 2022 05:25:44 GMT
strict-transport-security: max-age=31536000; preload; includeSubDomains
x-content-cdn-origin-ts: 1658381144996
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cache-control: public, max-age=1200
x-fb-rlafr: 0
priority: u=3,i
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H3 200 /
www.facebook.com/tr/ 44 B
88 B 39ms
38ms Image
image/gif 2a03:2880:f12d:181:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=498877868265126&ev=PageView&dl=https%3A%2F%2Fbook.rwgenting.com%2Fonelogin%2Flogin%3Fmid%3D5B5BA18CDF117678AD4A556ED500F79A550D62537139386F006D6DC3800866384A73B0794550B7006CB01F8D8C8806AE63A0E64A409145A7B9280D0CD1B123079FF4B25BFBEDEDABFD418D82CC6DDBC24F%26hashCode%3DA3A88955236CD99122BD213EA23933F9E7F81F9BD51A2B4F48BB5B0931A7EC1E0D19AE4D5C8DCFA4D14E015614CAF61112414F4A736E01975F01131A0%26language%3Den&rl=&if=false&ts=1658381144921&sw=1600&sh=1200&v=2.9.65&r=stable&a=tmSimo-GTM-WebTemplate&ec=1&o=30&fbp=fb.1.1658381144647.1787190418&it=1658381144437&coo=false&exp=u0&rqm=GET

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f12d:181:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://book.rwgenting.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

date: Thu, 21 Jul 2022 05:25:44 GMT
last-modified: Fri, 21 Dec 2012 00:00:01 GMT
server: proxygen-bolt
strict-transport-security: max-age=31536000; includeSubDomains
content-type: image/gif
cache-control: no-cache, must-revalidate, max-age=0
cross-origin-resource-policy: cross-origin
content-length: 44
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
priority: u=3,i
expires: Thu, 21 Jul 2022 05:25:44 GMT

GET
H3 200 /
www.facebook.com/tr/ 44 B
88 B 39ms
39ms Image
image/gif 2a03:2880:f12d:181:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=1408760949555385&ev=PageView&dl=https%3A%2F%2Fbook.rwgenting.com%2Fonelogin%2Flogin%3Fmid%3D5B5BA18CDF117678AD4A556ED500F79A550D62537139386F006D6DC3800866384A73B0794550B7006CB01F8D8C8806AE63A0E64A409145A7B9280D0CD1B123079FF4B25BFBEDEDABFD418D82CC6DDBC24F%26hashCode%3DA3A88955236CD99122BD213EA23933F9E7F81F9BD51A2B4F48BB5B0931A7EC1E0D19AE4D5C8DCFA4D14E015614CAF61112414F4A736E01975F01131A0%26language%3Den&rl=&if=false&ts=1658381144922&sw=1600&sh=1200&v=2.9.65&r=stable&a=tmSimo-GTM-WebTemplate&ec=1&o=30&fbp=fb.1.1658381144647.1787190418&it=1658381144437&coo=false&exp=u0&rqm=GET

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f12d:181:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://book.rwgenting.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

date: Thu, 21 Jul 2022 05:25:44 GMT
last-modified: Fri, 21 Dec 2012 00:00:01 GMT
server: proxygen-bolt
strict-transport-security: max-age=31536000; includeSubDomains
content-type: image/gif
cache-control: no-cache, must-revalidate, max-age=0
cross-origin-resource-policy: cross-origin
content-length: 44
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
priority: u=3,i
expires: Thu, 21 Jul 2022 05:25:44 GMT

GET
H3 200 /
www.facebook.com/tr/ 44 B
88 B 39ms
39ms Image
image/gif 2a03:2880:f12d:181:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=408482393299012&ev=PageView&dl=https%3A%2F%2Fbook.rwgenting.com%2Fonelogin%2Flogin%3Fmid%3D5B5BA18CDF117678AD4A556ED500F79A550D62537139386F006D6DC3800866384A73B0794550B7006CB01F8D8C8806AE63A0E64A409145A7B9280D0CD1B123079FF4B25BFBEDEDABFD418D82CC6DDBC24F%26hashCode%3DA3A88955236CD99122BD213EA23933F9E7F81F9BD51A2B4F48BB5B0931A7EC1E0D19AE4D5C8DCFA4D14E015614CAF61112414F4A736E01975F01131A0%26language%3Den&rl=&if=false&ts=1658381144922&sw=1600&sh=1200&v=2.9.65&r=stable&a=tmgoogletagmanager&ec=0&o=30&fbp=fb.1.1658381144647.1787190418&it=1658381144437&coo=false&exp=u0&rqm=GET

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f12d:181:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://book.rwgenting.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

date: Thu, 21 Jul 2022 05:25:44 GMT
last-modified: Fri, 21 Dec 2012 00:00:01 GMT
server: proxygen-bolt
strict-transport-security: max-age=31536000; includeSubDomains
content-type: image/gif
cache-control: no-cache, must-revalidate, max-age=0
cross-origin-resource-policy: cross-origin
content-length: 44
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
priority: u=3,i
expires: Thu, 21 Jul 2022 05:25:44 GMT

GET
H3 200 /
www.facebook.com/tr/ 44 B
88 B 37ms
37ms Image
image/gif 2a03:2880:f12d:181:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=537857393380708&ev=PageView&dl=https%3A%2F%2Fbook.rwgenting.com%2Fonelogin%2Flogin%3Fmid%3D5B5BA18CDF117678AD4A556ED500F79A550D62537139386F006D6DC3800866384A73B0794550B7006CB01F8D8C8806AE63A0E64A409145A7B9280D0CD1B123079FF4B25BFBEDEDABFD418D82CC6DDBC24F%26hashCode%3DA3A88955236CD99122BD213EA23933F9E7F81F9BD51A2B4F48BB5B0931A7EC1E0D19AE4D5C8DCFA4D14E015614CAF61112414F4A736E01975F01131A0%26language%3Den&rl=&if=false&ts=1658381145045&sw=1600&sh=1200&v=2.9.65&r=stable&ec=0&o=30&fbp=fb.1.1658381144647.1787190418&it=1658381144437&coo=false&exp=u0&rqm=GET

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f12d:181:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://book.rwgenting.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

date: Thu, 21 Jul 2022 05:25:45 GMT
last-modified: Fri, 21 Dec 2012 00:00:01 GMT
server: proxygen-bolt
strict-transport-security: max-age=31536000; includeSubDomains
content-type: image/gif
cache-control: no-cache, must-revalidate, max-age=0
cross-origin-resource-policy: cross-origin
content-length: 44
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
priority: u=3,i
expires: Thu, 21 Jul 2022 05:25:45 GMT

GET
H2 200 pixel;r=953139232;labels=_fp.event.Default;source=gtm;event=refresh;rf=0;a=p-ju4brbPEmhN_U;url=https%3A%2F%2Fbook.rwgenting.com%2Fonelogin%2Flogin%3Fmid%3D5B5BA18CDF117678AD4A556ED500F79A550D625371...
pixel.quantserve.com/ 35 B
371 B 74ms
43ms Image
image/gif 2620:116:800d:21:b314:a0ef:ab7c:d546
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pixel.quantserve.com/pixel;r=953139232;labels=_fp.event.Default;source=gtm;event=refresh;rf=0;a=p-ju4brbPEmhN_U;url=https%3A%2F%2Fbook.rwgenting.com%2Fonelogin%2Flogin%3Fmid%3D5B5BA18CDF117678AD4A556ED500F79A550D62537139386F006D6DC3800866384A73B0794550B7006CB01F8D8C8806AE63A0E64A409145A7B9280D0CD1B123079FF4B25BFBEDEDABFD418D82CC6DDBC24F%26hashCode%3DA3A88955236CD99122BD213EA23933F9E7F81F9BD51A2B4F48BB5B0931A7EC1E0D19AE4D5C8DCFA4D14E015614CAF61112414F4A736E01975F01131A0%26language%3Den;uht=2;fpan=1;fpa=P0-1278437762-1658381145251;pbc=;ns=0;ce=1;qjs=1;qv=623fd1d5-20220713234410;cm=;gdpr=0;ref=;d=rwgenting.com;dst=0;et=1658381145251;tzo=0;ogl=

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2620:116:800d:21:b314:a0ef:ab7c:d546 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://book.rwgenting.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 21 Jul 2022 05:25:45 GMT
strict-transport-security: max-age=86400
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAo PSDo OUR SAMa IND COM NAV"
cache-control: private, no-cache, no-store, proxy-revalidate
content-type: image/gif
content-length: 35
expires: Fri, 04 Aug 1978 12:00:00 GMT

GET
H2 200 cfix.html Show response
cdn.brand-display.com/tr/tag/ Frame 0851 2 KB
2 KB 40ms
40ms Document
text/html 18.66.248.12
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.brand-display.com/tr/tag/cfix.html?key=b90894f9b1582df507297d968da7fecece37d93
Requested by: Host: cdn.brand-display.com
URL: https://cdn.brand-display.com/tr/knx15814/b90894f9b1582df507297d968da7fecece37d93.js?v1=%%PAGE_CATEGORY%%&v2=https%3A%2F%2Fbook.rwgenting.com%2Fonelogin%2Flogin%3Fmid%3D5B5BA18CDF117678AD4A556ED500F79A550D62537139386F006D6DC3800866384A73B0794550B7006CB01F8D8C8806AE63A0E64A409145A7B9280D0CD1B123079FF4B25BFBEDEDABFD418D82CC6DDBC24F%26hashCode%3DA3A88955236CD99122BD213EA23933F9E7F81F9BD51A2B4F48BB5B0931A7EC1E0D19AE4D5C8DCFA4D14E015614CAF61112414F4A736E01975F01131A0%26language%3Den&_t=1658381143888
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.66.248.12 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-66-248-12.dus51.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 27988668fad87e9782d62f51b22f6feda6fdb2ef16a315b968728f164be1c6f7

Request headers

Referer: https://book.rwgenting.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 6073
cache-control: no-cache, must-revalidate, proxy-revalidate, public, max-age=0
content-length: 2031
content-type: text/html
date: Thu, 21 Jul 2022 03:44:33 GMT
etag: "073b35c69744014f5d2406710e188e97"
last-modified: Mon, 18 Mar 2019 15:45:52 GMT
server: AmazonS3
via: 1.1 1b18b0df6149933160ee945c6867dc2c.cloudfront.net (CloudFront)
x-amz-cf-id: YJGq_BH08Zas4FkEDfdBuh8HDQRd5osVvpUFZ0D8GTdjTvq7nBBCYg==
x-amz-cf-pop: DUS51-P1
x-amz-version-id: wdA6oWpnBvGweZ2olIlUbqk0DcpmZdej
x-cache: Hit from cloudfront

GET
H2 200 remarketing Show response
tr.brand-display.com/tracking/api/ 3 KB
3 KB 738ms
244ms Script
application/javascript 52.74.245.38
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tr.brand-display.com/tracking/api/remarketing?_t=1658381145778&advertiserId=knx15814&id=b90894f9b1582df507297d968da7fecece37d93&v1=&v2=https%3A%2F%2Fbook.rwgenting.com%2Fonelogin%2Flogin%3Fmid%3D5B5BA18CDF117678AD4A556ED500F79A550D62537139386F006D6DC3800866384A73B0794550B7006CB01F8D8C8806AE63A0E64A409145A7B9280D0CD1B123079FF4B25BFBEDEDABFD418D82CC6DDBC24F%26hashCode%3DA3A88955236CD99122BD213EA23933F9E7F81F9BD51A2B4F48BB5B0931A7EC1E0D19AE4D5C8DCFA4D14E015614CAF61112414F4A736E01975F01131A0%26language%3Den&_t=1658381143888&url=https%3A%2F%2Fbook.rwgenting.com%2Fonelogin%2Flogin%3Fmid%3D5B5BA18CDF117678AD4A556ED500F79A550D62537139386F006D6DC3800866384A73B0794550B7006CB01F8D8C8806AE63A0E64A409145A7B9280D0CD1B123079FF4B25BFBEDEDABFD418D82CC6DDBC24F%26hashCode%3DA3A88955236CD99122BD213EA23933F9E7F81F9BD51A2B4F48BB5B0931A7EC1E0D19AE4D5C8DCFA4D14E015614CAF61112414F4A736E01975F01131A0%26language%3Den&referer=&aurl=&areferer=&required=0&extra=%7B%22id%22%3A%22all%22%7D&d=1&r=0
Requested by: Host: cdn.brand-display.com
URL: https://cdn.brand-display.com/tr/knx15814/b90894f9b1582df507297d968da7fecece37d93.js?v1=%%PAGE_CATEGORY%%&v2=https%3A%2F%2Fbook.rwgenting.com%2Fonelogin%2Flogin%3Fmid%3D5B5BA18CDF117678AD4A556ED500F79A550D62537139386F006D6DC3800866384A73B0794550B7006CB01F8D8C8806AE63A0E64A409145A7B9280D0CD1B123079FF4B25BFBEDEDABFD418D82CC6DDBC24F%26hashCode%3DA3A88955236CD99122BD213EA23933F9E7F81F9BD51A2B4F48BB5B0931A7EC1E0D19AE4D5C8DCFA4D14E015614CAF61112414F4A736E01975F01131A0%26language%3Den&_t=1658381143888
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.74.245.38 Singapore, Singapore, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-74-245-38.ap-southeast-1.compute.amazonaws.com
Software: nginx/1.23.0 /
Resource Hash: 05c4cc82e30439bb88e3189e19b3ae0ea83c22fff0eb8c94aea737fd377be643

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://book.rwgenting.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

date: Thu, 21 Jul 2022 05:25:46 GMT
cache-control: max-age=3600
user-region: EU
server: nginx/1.23.0
content-length: 3094
content-type: application/javascript

GET
H3

200

activityi;dc_pre=CJCM75ififkCFbdGHQkdU5INzw;src=8661995;type=remar0;cat=rwg_g0;u1=;u2=https%3A%2F%2Fbook.rwgenting.com%2Fonelogin%2Flogin%3Fmid%3D5B5BA18CDF117678AD4A556ED500F79A550D62537139386F006... Show response
8661995.fls.doubleclick.net/ Frame F30B
Redirect Chain

https://8661995.fls.doubleclick.net/activityi;src=8661995;type=remar0;cat=rwg_g0;u1=;u2=https%3A%2F%2Fbook.rwgenting.com%2Fonelogin%2Flogin%3Fmid%3D5B5BA18CDF117678AD4A556ED500F79A550D62537139386F0...
https://8661995.fls.doubleclick.net/activityi;dc_pre=CJCM75ififkCFbdGHQkdU5INzw;src=8661995;type=remar0;cat=rwg_g0;u1=;u2=https%3A%2F%2Fbook.rwgenting.com%2Fonelogin%2Flogin%3Fmid%3D5B5BA18CDF11767...

780 B
616 B

139ms
60ms

Document
text/html

142.250.181.230
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://8661995.fls.doubleclick.net/activityi;dc_pre=CJCM75ififkCFbdGHQkdU5INzw;src=8661995;type=remar0;cat=rwg_g0;u1=;u2=https%3A%2F%2Fbook.rwgenting.com%2Fonelogin%2Flogin%3Fmid%3D5B5BA18CDF117678AD4A556ED500F79A550D62537139386F006D6DC3800866384A73B0794550B7006CB01F8D8C8806AE63A0E64A409145A7B9280D0CD1B123079FF4B25BFBEDEDABFD418D82CC6DDBC24F%26hashCode%3DA3A88955236CD99122BD213EA23933F9E7F81F9BD51A2B4F48BB5B0931A7EC1E0D19AE4D5C8DCFA4D14E015614CAF61112414F4A736E01975F01131A0%26language%3Den;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;ord=1870674817373.5876?

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.181.230 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s56-in-f6.1e100.net

Software

cafe /

Resource Hash

e643829c116356bde28926714ce3b0481f1d3dca3310e6aaf89ce7ff2d319613

Security Headers

Name	Value
Strict-Transport-Security	max-age=21600
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://book.rwgenting.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private, max-age=0
content-encoding: gzip
content-length: 591
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Thu, 21 Jul 2022 05:25:46 GMT
expires: Thu, 21 Jul 2022 05:25:46 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
strict-transport-security: max-age=21600
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

Redirect headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: no-cache, must-revalidate
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Thu, 21 Jul 2022 05:25:45 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
follow-only-when-prerender-shown: 1
location: https://8661995.fls.doubleclick.net/activityi;dc_pre=CJCM75ififkCFbdGHQkdU5INzw;src=8661995;type=remar0;cat=rwg_g0;u1=;u2=https%3A%2F%2Fbook.rwgenting.com%2Fonelogin%2Flogin%3Fmid%3D5B5BA18CDF117678AD4A556ED500F79A550D62537139386F006D6DC3800866384A73B0794550B7006CB01F8D8C8806AE63A0E64A409145A7B9280D0CD1B123079FF4B25BFBEDEDABFD418D82CC6DDBC24F%26hashCode%3DA3A88955236CD99122BD213EA23933F9E7F81F9BD51A2B4F48BB5B0931A7EC1E0D19AE4D5C8DCFA4D14E015614CAF61112414F4A736E01975F01131A0%26language%3Den;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;ord=1870674817373.5876?
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
pragma: no-cache
server: cafe
strict-transport-security: max-age=21600
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3 200 1994258390890728 Show response
connect.facebook.net/signals/config/ 292 KB
84 KB 89ms
88ms Script
application/x-javascript 2a03:2880:f02d:100:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/signals/config/1994258390890728?v=2.9.65&r=stable

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f02d:100:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

ef26e4419a7f9729a9fe8567f6b6559c0264166a029ed1f3e807171ff529b569

Security Headers

Name	Value
Content-Security-Policy	default-src facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com data: blob: 'self';script-src .fbcdn.net .facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;connect-src .fbcdn.net .facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://book.rwgenting.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

content-security-policy: default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
content-encoding: gzip
x-content-type-options: nosniff
document-policy: force-load-at-top
report-to: {"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/?minimize=0"}],"group":"coop_report","include_subdomains":true}
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400,h3-29=":443"; ma=86400
x-xss-protection: 0
pragma: public
x-fb-debug: rMurwVxSEw+qU1iQEU3j07W2yXIB/xB6FAjJCrFEtz7NTaf8FCmhDML+o6OJIcuFGEUI0KHJ/OLAP896snOddg==
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: DENY
date: Thu, 21 Jul 2022 05:25:45 GMT
strict-transport-security: max-age=31536000; preload; includeSubDomains
x-content-cdn-origin-ts: 1658381145900
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cache-control: public, max-age=1200
x-fb-rlafr: 0
priority: u=3,i
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H3 200 /
www.facebook.com/tr/ 44 B
88 B 38ms
37ms Image
image/gif 2a03:2880:f12d:181:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=1994258390890728&ev=PageView&dl=https%3A%2F%2Fbook.rwgenting.com%2Fonelogin%2Flogin%3Fmid%3D5B5BA18CDF117678AD4A556ED500F79A550D62537139386F006D6DC3800866384A73B0794550B7006CB01F8D8C8806AE63A0E64A409145A7B9280D0CD1B123079FF4B25BFBEDEDABFD418D82CC6DDBC24F%26hashCode%3DA3A88955236CD99122BD213EA23933F9E7F81F9BD51A2B4F48BB5B0931A7EC1E0D19AE4D5C8DCFA4D14E015614CAF61112414F4A736E01975F01131A0%26language%3Den&rl=&if=false&ts=1658381145938&sw=1600&sh=1200&v=2.9.65&r=stable&ec=0&o=30&fbp=fb.1.1658381144647.1787190418&it=1658381144437&coo=false&exp=u0&rqm=GET

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f12d:181:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://book.rwgenting.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

date: Thu, 21 Jul 2022 05:25:45 GMT
last-modified: Fri, 21 Dec 2012 00:00:01 GMT
server: proxygen-bolt
strict-transport-security: max-age=31536000; includeSubDomains
content-type: image/gif
cache-control: no-cache, must-revalidate, max-age=0
cross-origin-resource-policy: cross-origin
content-length: 44
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
priority: u=3,i
expires: Thu, 21 Jul 2022 05:25:45 GMT

GET
H3 200 /
www.facebook.com/tr/ 44 B
88 B 39ms
38ms Image
image/gif 2a03:2880:f12d:181:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=498877868265126&ev=Microdata&dl=https%3A%2F%2Fbook.rwgenting.com%2Fonelogin%2Flogin%3Fmid%3D5B5BA18CDF117678AD4A556ED500F79A550D62537139386F006D6DC3800866384A73B0794550B7006CB01F8D8C8806AE63A0E64A409145A7B9280D0CD1B123079FF4B25BFBEDEDABFD418D82CC6DDBC24F%26hashCode%3DA3A88955236CD99122BD213EA23933F9E7F81F9BD51A2B4F48BB5B0931A7EC1E0D19AE4D5C8DCFA4D14E015614CAF61112414F4A736E01975F01131A0%26language%3Den&rl=&if=false&ts=1658381146150&cd[DataLayer]=%5B%5D&cd[Meta]=%7B%22title%22%3A%22Resorts%20World%20Genting%22%7D&cd[OpenGraph]=%7B%7D&cd[Schema.org]=%5B%5D&cd[JSON-LD]=%5B%5D&sw=1600&sh=1200&v=2.9.65&r=stable&a=tmSimo-GTM-WebTemplate&ec=2&o=30&fbp=fb.1.1658381144647.1787190418&it=1658381144437&coo=false&es=automatic&tm=3&exp=u0&rqm=GET

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f12d:181:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://book.rwgenting.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

date: Thu, 21 Jul 2022 05:25:46 GMT
last-modified: Fri, 21 Dec 2012 00:00:01 GMT
server: proxygen-bolt
strict-transport-security: max-age=31536000; includeSubDomains
content-type: image/gif
cache-control: no-cache, must-revalidate, max-age=0
cross-origin-resource-policy: cross-origin
content-length: 44
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
priority: u=3,i
expires: Thu, 21 Jul 2022 05:25:46 GMT

GET
H2 200 dc_pre=CJCM75ififkCFbdGHQkdU5INzw;src=8661995;type=remar0;cat=rwg_g0;u1=;u2=https%3A%2F%2Fbook.rwgenting.com%2Fonelogin%2Flogin%3Fmid%3D5B5BA18CDF117678AD4A556ED500F79A550D62537139386F006D6DC380086...
adservice.google.com/ddm/fls/z/ Frame F30B 42 B
494 B 167ms
75ms Image
image/gif 2a00:1450:4001:806::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://adservice.google.com/ddm/fls/z/dc_pre=CJCM75ififkCFbdGHQkdU5INzw;src=8661995;type=remar0;cat=rwg_g0;u1=;u2=https%3A%2F%2Fbook.rwgenting.com%2Fonelogin%2Flogin%3Fmid%3D5B5BA18CDF117678AD4A556ED500F79A550D62537139386F006D6DC3800866384A73B0794550B7006CB01F8D8C8806AE63A0E64A409145A7B9280D0CD1B123079FF4B25BFBEDEDABFD418D82CC6DDBC24F%26hashCode%3DA3A88955236CD99122BD213EA23933F9E7F81F9BD51A2B4F48BB5B0931A7EC1E0D19AE4D5C8DCFA4D14E015614CAF61112414F4A736E01975F01131A0%26language%3Den;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;ord=1870674817373.5876

Requested by

Host: 8661995.fls.doubleclick.net
URL: https://8661995.fls.doubleclick.net/activityi;dc_pre=CJCM75ififkCFbdGHQkdU5INzw;src=8661995;type=remar0;cat=rwg_g0;u1=;u2=https%3A%2F%2Fbook.rwgenting.com%2Fonelogin%2Flogin%3Fmid%3D5B5BA18CDF117678AD4A556ED500F79A550D62537139386F006D6DC3800866384A73B0794550B7006CB01F8D8C8806AE63A0E64A409145A7B9280D0CD1B123079FF4B25BFBEDEDABFD418D82CC6DDBC24F%26hashCode%3DA3A88955236CD99122BD213EA23933F9E7F81F9BD51A2B4F48BB5B0931A7EC1E0D19AE4D5C8DCFA4D14E015614CAF61112414F4A736E01975F01131A0%26language%3Den;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;ord=1870674817373.5876?

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:806::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://8661995.fls.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 21 Jul 2022 05:25:46 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 /
www.facebook.com/tr/ 44 B
88 B 38ms
37ms Image
image/gif 2a03:2880:f12d:181:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=1408760949555385&ev=Microdata&dl=https%3A%2F%2Fbook.rwgenting.com%2Fonelogin%2Flogin%3Fmid%3D5B5BA18CDF117678AD4A556ED500F79A550D62537139386F006D6DC3800866384A73B0794550B7006CB01F8D8C8806AE63A0E64A409145A7B9280D0CD1B123079FF4B25BFBEDEDABFD418D82CC6DDBC24F%26hashCode%3DA3A88955236CD99122BD213EA23933F9E7F81F9BD51A2B4F48BB5B0931A7EC1E0D19AE4D5C8DCFA4D14E015614CAF61112414F4A736E01975F01131A0%26language%3Den&rl=&if=false&ts=1658381146310&cd[DataLayer]=%5B%5D&cd[Meta]=%7B%22title%22%3A%22Resorts%20World%20Genting%22%7D&cd[OpenGraph]=%7B%7D&cd[Schema.org]=%5B%5D&cd[JSON-LD]=%5B%5D&sw=1600&sh=1200&v=2.9.65&r=stable&a=tmSimo-GTM-WebTemplate&ec=2&o=30&fbp=fb.1.1658381144647.1787190418&it=1658381144437&coo=false&es=automatic&tm=3&exp=u0&rqm=GET

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f12d:181:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://book.rwgenting.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

date: Thu, 21 Jul 2022 05:25:46 GMT
last-modified: Fri, 21 Dec 2012 00:00:01 GMT
server: proxygen-bolt
strict-transport-security: max-age=31536000; includeSubDomains
content-type: image/gif
cache-control: no-cache, must-revalidate, max-age=0
cross-origin-resource-policy: cross-origin
content-length: 44
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
priority: u=3,i
expires: Thu, 21 Jul 2022 05:25:46 GMT

GET
H2 200 r
tr.brand-display.com/tracking/api/ 0
919 B 240ms
237ms Image
image/gif 52.74.245.38
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tr.brand-display.com/tracking/api/r?r0=1&rurl=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dknorex%26google_hm%3D%25%25KNXQ_B64_ENC%25%25%26google_cm&bf=ed9f2fa61815b51cacadfefeed42bb33
Requested by: Host: book.rwgenting.com
URL: https://book.rwgenting.com/onelogin/login?mid=5B5BA18CDF117678AD4A556ED500F79A550D62537139386F006D6DC3800866384A73B0794550B7006CB01F8D8C8806AE63A0E64A409145A7B9280D0CD1B123079FF4B25BFBEDEDABFD418D82CC6DDBC24F&hashCode=A3A88955236CD99122BD213EA23933F9E7F81F9BD51A2B4F48BB5B0931A7EC1E0D19AE4D5C8DCFA4D14E015614CAF61112414F4A736E01975F01131A0&language=en
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.74.245.38 Singapore, Singapore, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-74-245-38.ap-southeast-1.compute.amazonaws.com
Software: nginx/1.23.0 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://book.rwgenting.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

date: Thu, 21 Jul 2022 05:25:46 GMT
cache-control: max-age=3600
user-region: EU
server: nginx/1.23.0
content-type: image/gif
content-length: 0
p3p: CP='This is not a P3P policy!'

GET
H3

200

pixel
dmp.brand-display.com/cm2/api/
Redirect Chain

https://tags.bluekai.com/site/46117?id=ed9f2fa61815b51cacadfefeed42bb33&limit=1&redir=https%3A%2F%2Fdmp.brand-display.com%2Fcm2%2Fapi%2Fpixel%3Fpartner%3D0004%26pid%3D%24_BK_UUID%26bf%3Ded9f2fa6181...
https://dmp.brand-display.com/cm2/api/pixel?partner=0004&pid=$_BK_UUID&bf=ed9f2fa61815b51cacadfefeed42bb33

0
13 B

190ms
151ms

Image
image/gif

34.111.151.213
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dmp.brand-display.com/cm2/api/pixel?partner=0004&pid=$_BK_UUID&bf=ed9f2fa61815b51cacadfefeed42bb33
Requested by: Host: book.rwgenting.com
URL: https://book.rwgenting.com/onelogin/login?mid=5B5BA18CDF117678AD4A556ED500F79A550D62537139386F006D6DC3800866384A73B0794550B7006CB01F8D8C8806AE63A0E64A409145A7B9280D0CD1B123079FF4B25BFBEDEDABFD418D82CC6DDBC24F&hashCode=A3A88955236CD99122BD213EA23933F9E7F81F9BD51A2B4F48BB5B0931A7EC1E0D19AE4D5C8DCFA4D14E015614CAF61112414F4A736E01975F01131A0&language=en
Protocol: H3
Server: 34.111.151.213 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 213.151.111.34.bc.googleusercontent.com
Software: nginx/1.23.1 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://book.rwgenting.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 21 Jul 2022 05:25:46 GMT
via: 1.1 google
server: nginx/1.23.1
content-type: image/gif
cache-control: max-age=3600
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

Redirect headers

location: https://dmp.brand-display.com/cm2/api/pixel?partner=0004&pid=$_BK_UUID&bf=ed9f2fa61815b51cacadfefeed42bb33
date: Thu, 21 Jul 2022 05:25:46 GMT
content-length: 0
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV", policyref="http://tags.bluekai.com/w3c/p3p.xml"

GET
H2 200 sd
us-u.openx.net/w/1.0/ 43 B
275 B 150ms
50ms Image
image/gif 34.98.64.218
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=539237773&val=ed9f2fa61815b51cacadfefeed42bb33
Requested by: Host: book.rwgenting.com
URL: https://book.rwgenting.com/onelogin/login?mid=5B5BA18CDF117678AD4A556ED500F79A550D62537139386F006D6DC3800866384A73B0794550B7006CB01F8D8C8806AE63A0E64A409145A7B9280D0CD1B123079FF4B25BFBEDEDABFD418D82CC6DDBC24F&hashCode=A3A88955236CD99122BD213EA23933F9E7F81F9BD51A2B4F48BB5B0931A7EC1E0D19AE4D5C8DCFA4D14E015614CAF61112414F4A736E01975F01131A0&language=en
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.98.64.218 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/485d39a /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://book.rwgenting.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 21 Jul 2022 05:25:46 GMT
via: 1.1 google
server: OXGW/485d39a
vary: Accept
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H2

200

sync
partners.tremorhub.com/
Redirect Chain

https://x.bidswitch.net/sync?dsp_id=316&user_id=ed9f2fa61815b51cacadfefeed42bb33&expires=30
https://x.bidswitch.net/ul_cb/sync?dsp_id=316&user_id=ed9f2fa61815b51cacadfefeed42bb33&expires=30
https://partners.tremorhub.com/sync?UIBS=1a62da8e-b459-4812-88e3-1a62a87b4773

43 B
183 B

390ms
121ms

Image
image/gif

2600:1f18:612b:4232:fce7:74b5:7c53:e386
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://partners.tremorhub.com/sync?UIBS=1a62da8e-b459-4812-88e3-1a62a87b4773
Requested by: Host: book.rwgenting.com
URL: https://book.rwgenting.com/onelogin/login?mid=5B5BA18CDF117678AD4A556ED500F79A550D62537139386F006D6DC3800866384A73B0794550B7006CB01F8D8C8806AE63A0E64A409145A7B9280D0CD1B123079FF4B25BFBEDEDABFD418D82CC6DDBC24F&hashCode=A3A88955236CD99122BD213EA23933F9E7F81F9BD51A2B4F48BB5B0931A7EC1E0D19AE4D5C8DCFA4D14E015614CAF61112414F4A736E01975F01131A0&language=en
Protocol: H2
Server: 2600:1f18:612b:4232:fce7:74b5:7c53:e386 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: Apache-Coyote/1.1 /
Resource Hash: a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://book.rwgenting.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

date: Thu, 21 Jul 2022 05:25:47 GMT
server: Apache-Coyote/1.1
p3p: CP='This is not a P3P policy. See https://telaria.com/privacy-policy/'
content-type: image/gif

Redirect headers

Location: //partners.tremorhub.com/sync?UIBS=1a62da8e-b459-4812-88e3-1a62a87b4773
Date: Thu, 21 Jul 2022 05:25:46 GMT
Cache-Control: no-cache, no-store, must-revalidate
Connection: keep-alive
Content-Length: 0

GET
H2

200

/
sync.taboola.com/sg/knorex-network/1/rtb-h/
Redirect Chain

https://dmp.brand-display.com/cm/api/taboola?_t=1658381146334&bf=ed9f2fa61815b51cacadfefeed42bb33
https://sync.taboola.com/sg/knorex-network/1/rtb-h/?taboola_hm=ed9f2fa61815b51cacadfefeed42bb33

0
99 B

291ms
41ms

Image
text/plain

141.226.228.48
TABOOLA-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.taboola.com/sg/knorex-network/1/rtb-h/?taboola_hm=ed9f2fa61815b51cacadfefeed42bb33
Requested by: Host: book.rwgenting.com
URL: https://book.rwgenting.com/onelogin/login?mid=5B5BA18CDF117678AD4A556ED500F79A550D62537139386F006D6DC3800866384A73B0794550B7006CB01F8D8C8806AE63A0E64A409145A7B9280D0CD1B123079FF4B25BFBEDEDABFD418D82CC6DDBC24F&hashCode=A3A88955236CD99122BD213EA23933F9E7F81F9BD51A2B4F48BB5B0931A7EC1E0D19AE4D5C8DCFA4D14E015614CAF61112414F4A736E01975F01131A0&language=en
Protocol: H2
Server: 141.226.228.48 , Netherlands, ASN200478 (TABOOLA-AS, IL),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://book.rwgenting.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

date: Thu, 21 Jul 2022 05:25:46 GMT
access-control-allow-credentials: true
server: nginx
x-fastly-to-nlb-rtt: 40810

Redirect headers

date: Thu, 21 Jul 2022 05:25:46 GMT
via: 1.1 google
server: nginx/1.23.1
access-control-allow-origin: *
p3p: CP='This is not a P3P policy!'
location: https://sync.taboola.com/sg/knorex-network/1/rtb-h/?taboola_hm=ed9f2fa61815b51cacadfefeed42bb33
cache-control: max-age=3600
content-type: text/html; charset=utf-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 118

GET
H/1.1

200
OK

bounce
ib.adnxs.com/
Redirect Chain

https://dmp.brand-display.com/cm/api/appnexus?_t=1658381146334&bf=ed9f2fa61815b51cacadfefeed42bb33
https://ib.adnxs.com/setuid?entity=442&code=ed9f2fa61815b51cacadfefeed42bb33
https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D442%26code%3Ded9f2fa61815b51cacadfefeed42bb33

43 B
1 KB

44ms
44ms

Image
image/gif

185.89.210.20
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D442%26code%3Ded9f2fa61815b51cacadfefeed42bb33

Requested by

Protocol

HTTP/1.1

Server

185.89.210.20 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

944.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net

Software

nginx/1.21.3 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://book.rwgenting.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 21 Jul 2022 05:25:46 GMT
X-Proxy-Origin: 80.255.7.105; 80.255.7.105; 944.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
AN-X-Request-Uuid: 48def7d8-ef0a-48f9-b801-e71bec450b44
Server: nginx/1.21.3
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Thu, 21 Jul 2022 05:25:46 GMT
X-Proxy-Origin: 80.255.7.105; 80.255.7.105; 944.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
AN-X-Request-Uuid: b18fb06d-1469-49a2-8900-90ad033dcf9f
Server: nginx/1.21.3
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D442%26code%3Ded9f2fa61815b51cacadfefeed42bb33
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2

451

708804.gif
idsync.rlcdn.com/
Redirect Chain

https://dmp.brand-display.com/cm/api/liveramp?_t={CACHEBUSTER}&bf=ed9f2fa61815b51cacadfefeed42bb33
https://idsync.rlcdn.com/708804.gif?partner_uid=ed9f2fa61815b51cacadfefeed42bb33

0
98 B

295ms
45ms

Image
text/plain

35.244.174.68
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://idsync.rlcdn.com/708804.gif?partner_uid=ed9f2fa61815b51cacadfefeed42bb33
Requested by: Host: book.rwgenting.com
URL: https://book.rwgenting.com/onelogin/login?mid=5B5BA18CDF117678AD4A556ED500F79A550D62537139386F006D6DC3800866384A73B0794550B7006CB01F8D8C8806AE63A0E64A409145A7B9280D0CD1B123079FF4B25BFBEDEDABFD418D82CC6DDBC24F&hashCode=A3A88955236CD99122BD213EA23933F9E7F81F9BD51A2B4F48BB5B0931A7EC1E0D19AE4D5C8DCFA4D14E015614CAF61112414F4A736E01975F01131A0&language=en
Protocol: H2
Server: 35.244.174.68 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 68.174.244.35.bc.googleusercontent.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://book.rwgenting.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

date: Thu, 21 Jul 2022 05:25:46 GMT
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

Redirect headers

date: Thu, 21 Jul 2022 05:25:46 GMT
via: 1.1 google
server: nginx/1.23.1
access-control-allow-origin: *
p3p: CP='This is not a P3P policy!'
location: https://idsync.rlcdn.com/708804.gif?partner_uid=ed9f2fa61815b51cacadfefeed42bb33
cache-control: max-age=3600
content-type: text/html; charset=utf-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 103

GET
H3

200

check
pixel.tapad.com/idsync/ex/receive/
Redirect Chain

https://dmp.brand-display.com/cm/api/tapad?_t=1658381146335&bf=ed9f2fa61815b51cacadfefeed42bb33
https://pixel.tapad.com/idsync/ex/receive?partner_id=3021&partner_device_id=ed9f2fa61815b51cacadfefeed42bb33
https://pixel.tapad.com/idsync/ex/receive/check?partner_id=3021&partner_device_id=ed9f2fa61815b51cacadfefeed42bb33

95 B
113 B

87ms
46ms

Image
image/png

35.227.248.159
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pixel.tapad.com/idsync/ex/receive/check?partner_id=3021&partner_device_id=ed9f2fa61815b51cacadfefeed42bb33

Requested by

Protocol

Server

35.227.248.159 Kansas City, United States, ASN15169 (GOOGLE, US),

Reverse DNS

159.248.227.35.bc.googleusercontent.com

Software

Resource Hash

3eb10792d1f0c7e07e7248273540f1952d9a5a2996f4b5df70ab026cd9f05517

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://book.rwgenting.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

date: Thu, 21 Jul 2022 05:25:46 GMT
via: 1.1 google
content-type: image/png
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 95
strict-transport-security: max-age=31536000
p3p: policyref="http://tapad-taptags.s3.amazonaws.com/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"

Redirect headers

location: https://pixel.tapad.com/idsync/ex/receive/check?partner_id=3021&partner_device_id=ed9f2fa61815b51cacadfefeed42bb33
date: Thu, 21 Jul 2022 05:25:46 GMT
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
strict-transport-security: max-age=31536000
p3p: policyref="http://tapad-taptags.s3.amazonaws.com/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"

GET
H2 200 roqad
dmp.brand-display.com/cm/api/ 0
65 B 237ms
149ms Image
image/gif 34.111.151.213
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dmp.brand-display.com/cm/api/roqad?_t=1658381146335&bf=ed9f2fa61815b51cacadfefeed42bb33
Requested by: Host: book.rwgenting.com
URL: https://book.rwgenting.com/onelogin/login?mid=5B5BA18CDF117678AD4A556ED500F79A550D62537139386F006D6DC3800866384A73B0794550B7006CB01F8D8C8806AE63A0E64A409145A7B9280D0CD1B123079FF4B25BFBEDEDABFD418D82CC6DDBC24F&hashCode=A3A88955236CD99122BD213EA23933F9E7F81F9BD51A2B4F48BB5B0931A7EC1E0D19AE4D5C8DCFA4D14E015614CAF61112414F4A736E01975F01131A0&language=en
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.111.151.213 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 213.151.111.34.bc.googleusercontent.com
Software: nginx/1.23.1 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://book.rwgenting.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 21 Jul 2022 05:25:46 GMT
via: 1.1 google
server: nginx/1.23.1
content-type: image/gif
cache-control: max-age=3600
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

GET
H2 200 smaato
dmp.brand-display.com/cm/api/ 0
42 B 149ms
149ms Image
image/gif 34.111.151.213
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dmp.brand-display.com/cm/api/smaato?bf=ed9f2fa61815b51cacadfefeed42bb33
Requested by: Host: book.rwgenting.com
URL: https://book.rwgenting.com/onelogin/login?mid=5B5BA18CDF117678AD4A556ED500F79A550D62537139386F006D6DC3800866384A73B0794550B7006CB01F8D8C8806AE63A0E64A409145A7B9280D0CD1B123079FF4B25BFBEDEDABFD418D82CC6DDBC24F&hashCode=A3A88955236CD99122BD213EA23933F9E7F81F9BD51A2B4F48BB5B0931A7EC1E0D19AE4D5C8DCFA4D14E015614CAF61112414F4A736E01975F01131A0&language=en
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.111.151.213 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 213.151.111.34.bc.googleusercontent.com
Software: nginx/1.23.1 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://book.rwgenting.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 21 Jul 2022 05:25:46 GMT
via: 1.1 google
server: nginx/1.23.1
content-type: image/gif
cache-control: max-age=3600
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

GET
H3

200

rum
dsum-sec.casalemedia.com/
Redirect Chain

https://dmp.brand-display.com/cm/api/index?cm_callback_url=%2F%2Fdsum-sec.casalemedia.com%2Frum&cm_dsp_id=191&bf=ed9f2fa61815b51cacadfefeed42bb33
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=191&expiration=63072000&external_user_id=ed9f2fa61815b51cacadfefeed42bb33
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=191&expiration=63072000&external_user_id=ed9f2fa61815b51cacadfefeed42bb33&C=1

43 B
948 B

93ms
52ms

Image
image/gif

104.18.19.126
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=191&expiration=63072000&external_user_id=ed9f2fa61815b51cacadfefeed42bb33&C=1
Requested by: Host: book.rwgenting.com
URL: https://book.rwgenting.com/onelogin/login?mid=5B5BA18CDF117678AD4A556ED500F79A550D62537139386F006D6DC3800866384A73B0794550B7006CB01F8D8C8806AE63A0E64A409145A7B9280D0CD1B123079FF4B25BFBEDEDABFD418D82CC6DDBC24F&hashCode=A3A88955236CD99122BD213EA23933F9E7F81F9BD51A2B4F48BB5B0931A7EC1E0D19AE4D5C8DCFA4D14E015614CAF61112414F4A736E01975F01131A0&language=en
Protocol: H3
Server: 104.18.19.126 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://book.rwgenting.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

cf-ray: 72e1849869b19bd4-FRA
pragma: no-cache
date: Thu, 21 Jul 2022 05:25:46 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=UVw81xk%2BGqqLf%2BpVlbyou%2Byl880hXEHD4tGuHBxS8gZsi88rqbeYV9kTOaQR7sARiT81qwhyWwKSWwMZ6yikI%2BGjSKh%2FtX92ZpO3d2u4p9qJKQiU2A0wi912ffEq1M10NoJ%2Fe3Ghz7aeXg%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
cache-control: no-cache
content-type: image/gif
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

pragma: no-cache
date: Thu, 21 Jul 2022 05:25:46 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=pdnHKvbn2efSIhVb45sfGs2LFoxynA9tul9mR0pNTgj6lKs9U5bHpI5TnGNHsfparMazDcFUeg2RrapNNQAgSPyWHlrzlyLDiHH2JQ5X6e7UXWYZiq%2Fbcdhs3ILeseR5DPlr1kOUi%2Fbzdg%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
location: /rum?cm_dsp_id=191&expiration=63072000&external_user_id=ed9f2fa61815b51cacadfefeed42bb33&C=1
cache-control: no-cache
cf-ray: 72e18497ce7e5c5c-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 0
expires: 0

GET
H3 200 /
www.facebook.com/tr/ 44 B
88 B 38ms
38ms Image
image/gif 2a03:2880:f12d:181:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=408482393299012&ev=Microdata&dl=https%3A%2F%2Fbook.rwgenting.com%2Fonelogin%2Flogin%3Fmid%3D5B5BA18CDF117678AD4A556ED500F79A550D62537139386F006D6DC3800866384A73B0794550B7006CB01F8D8C8806AE63A0E64A409145A7B9280D0CD1B123079FF4B25BFBEDEDABFD418D82CC6DDBC24F%26hashCode%3DA3A88955236CD99122BD213EA23933F9E7F81F9BD51A2B4F48BB5B0931A7EC1E0D19AE4D5C8DCFA4D14E015614CAF61112414F4A736E01975F01131A0%26language%3Den&rl=&if=false&ts=1658381146425&cd[DataLayer]=%5B%5D&cd[Meta]=%7B%22title%22%3A%22Resorts%20World%20Genting%22%7D&cd[OpenGraph]=%7B%7D&cd[Schema.org]=%5B%5D&cd[JSON-LD]=%5B%5D&sw=1600&sh=1200&v=2.9.65&r=stable&a=tmgoogletagmanager&ec=1&o=30&fbp=fb.1.1658381144647.1787190418&it=1658381144437&coo=false&es=automatic&tm=3&exp=u0&rqm=GET

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f12d:181:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://book.rwgenting.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

date: Thu, 21 Jul 2022 05:25:46 GMT
last-modified: Fri, 21 Dec 2012 00:00:01 GMT
server: proxygen-bolt
strict-transport-security: max-age=31536000; includeSubDomains
content-type: image/gif
cache-control: no-cache, must-revalidate, max-age=0
cross-origin-resource-policy: cross-origin
content-length: 44
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
priority: u=3,i
expires: Thu, 21 Jul 2022 05:25:46 GMT

GET
H2 200 remarketing
tr.brand-display.com/tracking/api/ 0
919 B 237ms
237ms Image
image/gif 52.74.245.38
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tr.brand-display.com/tracking/api/remarketing?_t=1658381145778&advertiserId=knx15814&id=b90894f9b1582df507297d968da7fecece37d93&v1=&v2=https%253A%252F%252Fbook.rwgenting.com%252Fonelogin%252Flogin%253Fmid%253D5B5BA18CDF117678AD4A556ED500F79A550D62537139386F006D6DC3800866384A73B0794550B7006CB01F8D8C8806AE63A0E64A409145A7B9280D0CD1B123079FF4B25BFBEDEDABFD418D82CC6DDBC24F%2526hashCode%253DA3A88955236CD99122BD213EA23933F9E7F81F9BD51A2B4F48BB5B0931A7EC1E0D19AE4D5C8DCFA4D14E015614CAF61112414F4A736E01975F01131A0%2526language%253Den&_t=1658381143888&url=https%253A%252F%252Fbook.rwgenting.com%252Fonelogin%252Flogin%253Fmid%253D5B5BA18CDF117678AD4A556ED500F79A550D62537139386F006D6DC3800866384A73B0794550B7006CB01F8D8C8806AE63A0E64A409145A7B9280D0CD1B123079FF4B25BFBEDEDABFD418D82CC6DDBC24F%2526hashCode%253DA3A88955236CD99122BD213EA23933F9E7F81F9BD51A2B4F48BB5B0931A7EC1E0D19AE4D5C8DCFA4D14E015614CAF61112414F4A736E01975F01131A0%2526language%253Den&referer=&aurl=&areferer=&required=0&extra=%257B%2522id%2522%253A%2522all%2522%257D&d=1&r=0&bf=ed9f2fa61815b51cacadfefeed42bb33&itp=true
Requested by: Host: book.rwgenting.com
URL: https://book.rwgenting.com/onelogin/login?mid=5B5BA18CDF117678AD4A556ED500F79A550D62537139386F006D6DC3800866384A73B0794550B7006CB01F8D8C8806AE63A0E64A409145A7B9280D0CD1B123079FF4B25BFBEDEDABFD418D82CC6DDBC24F&hashCode=A3A88955236CD99122BD213EA23933F9E7F81F9BD51A2B4F48BB5B0931A7EC1E0D19AE4D5C8DCFA4D14E015614CAF61112414F4A736E01975F01131A0&language=en
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.74.245.38 Singapore, Singapore, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-74-245-38.ap-southeast-1.compute.amazonaws.com
Software: nginx/1.23.0 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://book.rwgenting.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

date: Thu, 21 Jul 2022 05:25:46 GMT
cache-control: max-age=3600
user-region: EU
server: nginx/1.23.0
content-type: image/gif
content-length: 0
p3p: CP='This is not a P3P policy!'

GET
H3 200 /
www.facebook.com/tr/ 44 B
88 B 38ms
37ms Image
image/gif 2a03:2880:f12d:181:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=537857393380708&ev=Microdata&dl=https%3A%2F%2Fbook.rwgenting.com%2Fonelogin%2Flogin%3Fmid%3D5B5BA18CDF117678AD4A556ED500F79A550D62537139386F006D6DC3800866384A73B0794550B7006CB01F8D8C8806AE63A0E64A409145A7B9280D0CD1B123079FF4B25BFBEDEDABFD418D82CC6DDBC24F%26hashCode%3DA3A88955236CD99122BD213EA23933F9E7F81F9BD51A2B4F48BB5B0931A7EC1E0D19AE4D5C8DCFA4D14E015614CAF61112414F4A736E01975F01131A0%26language%3Den&rl=&if=false&ts=1658381146546&cd[DataLayer]=%5B%5D&cd[Meta]=%7B%22title%22%3A%22Resorts%20World%20Genting%22%7D&cd[OpenGraph]=%7B%7D&cd[Schema.org]=%5B%5D&cd[JSON-LD]=%5B%5D&sw=1600&sh=1200&v=2.9.65&r=stable&ec=1&o=30&fbp=fb.1.1658381144647.1787190418&it=1658381144437&coo=false&es=automatic&tm=3&exp=u0&rqm=GET

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f12d:181:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://book.rwgenting.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

date: Thu, 21 Jul 2022 05:25:46 GMT
last-modified: Fri, 21 Dec 2012 00:00:01 GMT
server: proxygen-bolt
strict-transport-security: max-age=31536000; includeSubDomains
content-type: image/gif
cache-control: no-cache, must-revalidate, max-age=0
cross-origin-resource-policy: cross-origin
content-length: 44
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
priority: u=3,i
expires: Thu, 21 Jul 2022 05:25:46 GMT

GET
H3 200 /
www.facebook.com/tr/ 44 B
88 B 37ms
37ms Image
image/gif 2a03:2880:f12d:181:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=1994258390890728&ev=Microdata&dl=https%3A%2F%2Fbook.rwgenting.com%2Fonelogin%2Flogin%3Fmid%3D5B5BA18CDF117678AD4A556ED500F79A550D62537139386F006D6DC3800866384A73B0794550B7006CB01F8D8C8806AE63A0E64A409145A7B9280D0CD1B123079FF4B25BFBEDEDABFD418D82CC6DDBC24F%26hashCode%3DA3A88955236CD99122BD213EA23933F9E7F81F9BD51A2B4F48BB5B0931A7EC1E0D19AE4D5C8DCFA4D14E015614CAF61112414F4A736E01975F01131A0%26language%3Den&rl=&if=false&ts=1658381147440&cd[DataLayer]=%5B%5D&cd[Meta]=%7B%22title%22%3A%22Resorts%20World%20Genting%22%7D&cd[OpenGraph]=%7B%7D&cd[Schema.org]=%5B%5D&cd[JSON-LD]=%5B%5D&sw=1600&sh=1200&v=2.9.65&r=stable&ec=1&o=30&fbp=fb.1.1658381144647.1787190418&it=1658381144437&coo=false&es=automatic&tm=3&exp=u0&rqm=GET

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f12d:181:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://book.rwgenting.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

date: Thu, 21 Jul 2022 05:25:47 GMT
last-modified: Fri, 21 Dec 2012 00:00:01 GMT
server: proxygen-bolt
strict-transport-security: max-age=31536000; includeSubDomains
content-type: image/gif
cache-control: no-cache, must-revalidate, max-age=0
cross-origin-resource-policy: cross-origin
content-length: 44
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
priority: u=3,i
expires: Thu, 21 Jul 2022 05:25:47 GMT

GET
H/1.1 200
OK brown-bold.5e1c785cd98d3be3ffe8.woff2
book.rwgenting.com/onelogin/ 20 KB
20 KB 221ms
221ms Font
font/woff2 170.33.9.200
ASEPL-AS-AP Aliba...

General

Check archive.org

Show headers Download Go to

Full URL

https://book.rwgenting.com/onelogin/brown-bold.5e1c785cd98d3be3ffe8.woff2

Requested by

Host: book.rwgenting.com
URL: https://book.rwgenting.com/onelogin/styles.f882acbaae2af6f23122.css

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

170.33.9.200 , Singapore, ASN134963 (ASEPL-AS-AP Alibaba.com Singapore E-Commerce Private Limited, SG),

Reverse DNS

Software

/ ASP.NET

Resource Hash

f5c2adae89718a53679c5a07e14dbeb4cde33d917a1419006aa26b81968eece1

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1;mode=block

Request headers

Referer: https://book.rwgenting.com/onelogin/styles.f882acbaae2af6f23122.css
Origin: https://book.rwgenting.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

Date: Thu, 21 Jul 2022 05:25:47 GMT
Last-Modified: Mon, 04 Jul 2022 06:06:07 GMT
X-Powered-By: ASP.NET
ETag: "1d88f6c26583fe8"
X-Frame-Options: SAMEORIGIN
Content-Type: font/woff2
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 20072
X-XSS-PROTECTION: 1;mode=block

GET
H/1.1 200
OK en.json Show response
book.rwgenting.com/assets/i18n/ 10 KB
11 KB 216ms
216ms XHR
application/json 170.33.9.200
ASEPL-AS-AP Aliba...

General

Check archive.org

Show headers Download Go to

Full URL

https://book.rwgenting.com/assets/i18n/en.json

Requested by

Host: book.rwgenting.com
URL: https://book.rwgenting.com/onelogin/polyfills.712a53dc69f3622f09f8.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

170.33.9.200 , Singapore, ASN134963 (ASEPL-AS-AP Alibaba.com Singapore E-Commerce Private Limited, SG),

Reverse DNS

Software

/ ASP.NET

Resource Hash

8b84e2bf2590e230009a170bdcbe31fbe63c3404750408de8c6bc1c3ff960a1c

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1;mode=block

Request headers

Accept: application/json, text/plain, */*
Referer: https://book.rwgenting.com/onelogin/login?mid=5B5BA18CDF117678AD4A556ED500F79A550D62537139386F006D6DC3800866384A73B0794550B7006CB01F8D8C8806AE63A0E64A409145A7B9280D0CD1B123079FF4B25BFBEDEDABFD418D82CC6DDBC24F&hashCode=A3A88955236CD99122BD213EA23933F9E7F81F9BD51A2B4F48BB5B0931A7EC1E0D19AE4D5C8DCFA4D14E015614CAF61112414F4A736E01975F01131A0&language=en
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

Date: Thu, 21 Jul 2022 05:25:47 GMT
Last-Modified: Thu, 03 Mar 2022 08:15:50 GMT
X-Powered-By: ASP.NET
ETag: "681a8e5d62ed81:0:dtagent10237220328075400AbXY"
X-Frame-Options: SAMEORIGIN
Content-Type: application/json
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 10329
X-XSS-PROTECTION: 1;mode=block

GET
H/1.1 200
OK materialIcon.woff2
book.rwgenting.com/onelogin/assets/fonts/ 113 KB
113 KB 219ms
219ms Font
font/woff2 170.33.9.200
ASEPL-AS-AP Aliba...

General

Check archive.org

Show headers Download Go to

Full URL

https://book.rwgenting.com/onelogin/assets/fonts/materialIcon.woff2

Requested by

Host: book.rwgenting.com
URL: https://book.rwgenting.com/onelogin/assets/materialIcon.css

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

170.33.9.200 , Singapore, ASN134963 (ASEPL-AS-AP Alibaba.com Singapore E-Commerce Private Limited, SG),

Reverse DNS

Software

/ ASP.NET

Resource Hash

0c2c69ba33a4d4eb53419c912ea55131208d76852cc632e2544833497d165bc3

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1;mode=block

Request headers

Referer: https://book.rwgenting.com/onelogin/assets/materialIcon.css
Origin: https://book.rwgenting.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

Date: Thu, 21 Jul 2022 05:25:47 GMT
Last-Modified: Fri, 22 Oct 2021 10:36:01 GMT
X-Powered-By: ASP.NET
ETag: "1d7c7309b63bc84"
X-Frame-Options: SAMEORIGIN
Content-Type: font/woff2
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 115204
X-XSS-PROTECTION: 1;mode=block

GET
DATA 200
OK truncated
/ 90 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 4a2bd7ca82f65229847b16e0997562b09c4f45415269af9325c18a3f1e61a37d

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ 37 KB
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 99ce5a68e2cb305eedee5447ea9d99adef35c44449ca9de31d4279d9de87eea4

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

Content-Type: image/png

POST
H/1.1 200
OK page Show response
book.rwgenting.com/onelogin/gentingoneid/ 30 B
345 B 216ms
216ms XHR
application/json 170.33.9.200
ASEPL-AS-AP Aliba...

General

Check archive.org

Show headers Download Go to

Full URL

https://book.rwgenting.com/onelogin/gentingoneid/page

Requested by

Host: book.rwgenting.com
URL: https://book.rwgenting.com/onelogin/polyfills.712a53dc69f3622f09f8.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

170.33.9.200 , Singapore, ASN134963 (ASEPL-AS-AP Alibaba.com Singapore E-Commerce Private Limited, SG),

Reverse DNS

Software

/ ASP.NET

Resource Hash

1f8e18b8acecf86cc2a1151ad9ac83122ac95087ff67ec80c4b1feb3951ac958

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1;mode=block

Request headers

Accept: application/json, text/plain, */*
Referer: https://book.rwgenting.com/onelogin/login
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36
Content-Type: application/json

Response headers

Date: Thu, 21 Jul 2022 05:25:47 GMT
Connection: keep-alive
X-Frame-Options: SAMEORIGIN
X-Powered-By: ASP.NET
Content-Length: 30
X-XSS-PROTECTION: 1;mode=block
Content-Type: application/json; charset=utf-8

GET
H/1.1 200
OK gentingLogo.png
book.rwgenting.com/assets/img/ 5 KB
6 KB 215ms
214ms Image
image/png 170.33.9.200
ASEPL-AS-AP Aliba...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://book.rwgenting.com/assets/img/gentingLogo.png

Requested by

Host: book.rwgenting.com
URL: https://book.rwgenting.com/onelogin/login

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

170.33.9.200 , Singapore, ASN134963 (ASEPL-AS-AP Alibaba.com Singapore E-Commerce Private Limited, SG),

Reverse DNS

Software

/ ASP.NET

Resource Hash

4204debecf775801a4d82917e933f87b9bf0019771aa7dcc6f39e0f0104bf240

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1;mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://book.rwgenting.com/onelogin/login
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

Date: Thu, 21 Jul 2022 05:25:47 GMT
Last-Modified: Sun, 24 Oct 2021 14:58:04 GMT
X-Powered-By: ASP.NET
ETag: "066d98be7c8d71:0"
X-Frame-Options: SAMEORIGIN
Content-Type: image/png
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 5311
X-XSS-PROTECTION: 1;mode=block

GET
H3 200 /
www.facebook.com/tr/ 44 B
88 B 39ms
38ms Image
image/gif 2a03:2880:f12d:181:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=498877868265126&ev=PageView&dl=https%3A%2F%2Fbook.rwgenting.com%2Fonelogin%2Flogin&rl=&if=false&ts=1658381147742&sw=1600&sh=1200&v=2.9.65&r=stable&a=tmSimo-GTM-WebTemplate&ec=3&o=30&fbp=fb.1.1658381144647.1787190418&it=1658381144437&coo=false&exp=u0&rqm=GET

Requested by

Host: book.rwgenting.com
URL: https://book.rwgenting.com/onelogin/login

Protocol

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f12d:181:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://book.rwgenting.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

date: Thu, 21 Jul 2022 05:25:47 GMT
last-modified: Fri, 21 Dec 2012 00:00:01 GMT
server: proxygen-bolt
strict-transport-security: max-age=31536000; includeSubDomains
content-type: image/gif
cache-control: no-cache, must-revalidate, max-age=0
cross-origin-resource-policy: cross-origin
content-length: 44
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
priority: u=3,i
expires: Thu, 21 Jul 2022 05:25:47 GMT

GET
H3 200 /
www.facebook.com/tr/ 44 B
88 B 42ms
41ms Image
image/gif 2a03:2880:f12d:181:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=1408760949555385&ev=PageView&dl=https%3A%2F%2Fbook.rwgenting.com%2Fonelogin%2Flogin&rl=&if=false&ts=1658381147743&sw=1600&sh=1200&v=2.9.65&r=stable&a=tmSimo-GTM-WebTemplate&ec=3&o=30&fbp=fb.1.1658381144647.1787190418&it=1658381144437&coo=false&exp=u0&rqm=GET

Requested by

Host: book.rwgenting.com
URL: https://book.rwgenting.com/onelogin/login

Protocol

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f12d:181:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://book.rwgenting.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

date: Thu, 21 Jul 2022 05:25:47 GMT
last-modified: Fri, 21 Dec 2012 00:00:01 GMT
server: proxygen-bolt
strict-transport-security: max-age=31536000; includeSubDomains
content-type: image/gif
cache-control: no-cache, must-revalidate, max-age=0
cross-origin-resource-policy: cross-origin
content-length: 44
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
priority: u=3,i
expires: Thu, 21 Jul 2022 05:25:47 GMT

GET
H3 200 /
www.facebook.com/tr/ 44 B
88 B 43ms
42ms Image
image/gif 2a03:2880:f12d:181:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=408482393299012&ev=PageView&dl=https%3A%2F%2Fbook.rwgenting.com%2Fonelogin%2Flogin&rl=&if=false&ts=1658381147743&sw=1600&sh=1200&v=2.9.65&r=stable&a=tmgoogletagmanager&ec=2&o=30&fbp=fb.1.1658381144647.1787190418&it=1658381144437&coo=false&exp=u0&rqm=GET

Requested by

Host: book.rwgenting.com
URL: https://book.rwgenting.com/onelogin/login

Protocol

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f12d:181:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://book.rwgenting.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

date: Thu, 21 Jul 2022 05:25:47 GMT
last-modified: Fri, 21 Dec 2012 00:00:01 GMT
server: proxygen-bolt
strict-transport-security: max-age=31536000; includeSubDomains
content-type: image/gif
cache-control: no-cache, must-revalidate, max-age=0
cross-origin-resource-policy: cross-origin
content-length: 44
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
priority: u=3,i
expires: Thu, 21 Jul 2022 05:25:47 GMT

GET
H3 200 /
www.facebook.com/tr/ 44 B
88 B 43ms
43ms Image
image/gif 2a03:2880:f12d:181:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=537857393380708&ev=PageView&dl=https%3A%2F%2Fbook.rwgenting.com%2Fonelogin%2Flogin&rl=&if=false&ts=1658381147744&sw=1600&sh=1200&v=2.9.65&r=stable&ec=2&o=30&fbp=fb.1.1658381144647.1787190418&it=1658381144437&coo=false&exp=u0&rqm=GET

Requested by

Host: book.rwgenting.com
URL: https://book.rwgenting.com/onelogin/login

Protocol

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f12d:181:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://book.rwgenting.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

date: Thu, 21 Jul 2022 05:25:47 GMT
last-modified: Fri, 21 Dec 2012 00:00:01 GMT
server: proxygen-bolt
strict-transport-security: max-age=31536000; includeSubDomains
content-type: image/gif
cache-control: no-cache, must-revalidate, max-age=0
cross-origin-resource-policy: cross-origin
content-length: 44
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
priority: u=3,i
expires: Thu, 21 Jul 2022 05:25:47 GMT

GET
H3 200 /
www.facebook.com/tr/ 44 B
88 B 45ms
44ms Image
image/gif 2a03:2880:f12d:181:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=1994258390890728&ev=PageView&dl=https%3A%2F%2Fbook.rwgenting.com%2Fonelogin%2Flogin&rl=&if=false&ts=1658381147745&sw=1600&sh=1200&v=2.9.65&r=stable&ec=2&o=30&fbp=fb.1.1658381144647.1787190418&it=1658381144437&coo=false&exp=u0&rqm=GET

Requested by

Host: book.rwgenting.com
URL: https://book.rwgenting.com/onelogin/login

Protocol

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f12d:181:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://book.rwgenting.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

date: Thu, 21 Jul 2022 05:25:47 GMT
last-modified: Fri, 21 Dec 2012 00:00:01 GMT
server: proxygen-bolt
strict-transport-security: max-age=31536000; includeSubDomains
content-type: image/gif
cache-control: no-cache, must-revalidate, max-age=0
cross-origin-resource-policy: cross-origin
content-length: 44
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
priority: u=3,i
expires: Thu, 21 Jul 2022 05:25:47 GMT

GET
H3 200 / Show response
www.facebook.com/plugins/customer_chat/SDK/ 0
31 B 117ms
74ms XHR
text/html 2a03:2880:f12d:181:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://www.facebook.com/plugins/customer_chat/SDK/?app_id=&attribution=biz_inbox&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fx%2Fconnect%2Fxd_arbiter%2F%3Fversion%3D46%23cb%3Df3ac84a67b9722%26domain%3Dbook.rwgenting.com%26is_canvas%3Dfalse%26origin%3Dhttps%253A%252F%252Fbook.rwgenting.com%252Ff88ff3950496e8%26relation%3Dparent.parent&current_url=https%3A%2F%2Fbook.rwgenting.com%2Fonelogin%2Flogin&event_name=chat_plugin_sdk_facade_create&is_loaded_by_facade=true&loading_time=0&locale=en_GB&log_id=c007d8d5-d34a-4d6f-9c40-b7941e99359c&page_id=180512280998&request_time=1658381147756&sdk=joey&suppress_http_code=1

Requested by

Host: book.rwgenting.com
URL: https://book.rwgenting.com/onelogin/polyfills.712a53dc69f3622f09f8.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f12d:181:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	default-src data: blob: 'self' https://.fbsbx.com 'unsafe-inline' .facebook.com 'unsafe-eval' .fbcdn.net;script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self' connect.facebook.net;style-src fonts.googleapis.com .fbcdn.net data: .facebook.com 'unsafe-inline';connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com:* wss://.whatsapp.com: wss://.fbcdn.net attachment.fbsbx.com ws://localhost: blob: .cdninstagram.com 'self' wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d-test.facebook.com/ wss://kaios-d.facebook.com/ v.whatsapp.net .fbsbx.com .fb.com;font-src data: .gstatic.com .facebook.com .fbcdn.net .fbsbx.com;img-src .fbcdn.net .facebook.com data: https://.fbsbx.com .tenor.co media.tenor.com facebook.com .cdninstagram.com fbsbx.com fbcdn.net .giphy.com connect.facebook.net .carriersignal.info blob: android-webview-video-poster: googleads.g.doubleclick.net www.googleadservices.com .whatsapp.net .fb.com .oculuscdn.com;media-src .cdninstagram.com blob: .fbcdn.net .fbsbx.com www.facebook.com .facebook.com https://.giphy.com data:;frame-src .doubleclick.net .google.com .facebook.com www.googleadservices.com .fbsbx.com fbsbx.com data: www.instagram.com .fbcdn.net https://paywithmybank.com;worker-src blob: .facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

Referer: https://book.rwgenting.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36
Content-type: application/x-www-form-urlencoded

Response headers

content-security-policy: default-src data: blob: 'self' https://*.fbsbx.com 'unsafe-inline' *.facebook.com 'unsafe-eval' *.fbcdn.net;script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self' connect.facebook.net;style-src fonts.googleapis.com *.fbcdn.net data: *.facebook.com 'unsafe-inline';connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d-test.facebook.com/ wss://kaios-d.facebook.com/ v.whatsapp.net *.fbsbx.com *.fb.com;font-src data: *.gstatic.com *.facebook.com *.fbcdn.net *.fbsbx.com;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com *.tenor.co media.tenor.com facebook.com *.cdninstagram.com fbsbx.com fbcdn.net *.giphy.com connect.facebook.net *.carriersignal.info blob: android-webview-video-poster: googleads.g.doubleclick.net www.googleadservices.com *.whatsapp.net *.fb.com *.oculuscdn.com;media-src *.cdninstagram.com blob: *.fbcdn.net *.fbsbx.com www.facebook.com *.facebook.com https://*.giphy.com data:;frame-src *.doubleclick.net *.google.com *.facebook.com www.googleadservices.com *.fbsbx.com fbsbx.com data: www.instagram.com *.fbcdn.net https://paywithmybank.com;worker-src blob: *.facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;
x-content-type-options: nosniff
document-policy: force-load-at-top
content-security-policy-report-only: default-src data: blob: 'self' https://*.fbsbx.com 'unsafe-inline' *.facebook.com 'unsafe-eval' *.fbcdn.net;script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self' connect.facebook.net;style-src fonts.googleapis.com *.fbcdn.net data: *.facebook.com 'unsafe-inline';connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d-test.facebook.com/ wss://kaios-d.facebook.com/ v.whatsapp.net *.fbsbx.com *.fb.com;font-src data: *.gstatic.com *.facebook.com *.fbcdn.net *.fbsbx.com;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com *.tenor.co media.tenor.com facebook.com *.cdninstagram.com fbsbx.com fbcdn.net *.giphy.com connect.facebook.net *.carriersignal.info blob: android-webview-video-poster: googleads.g.doubleclick.net www.googleadservices.com *.whatsapp.net *.fb.com *.oculuscdn.com;media-src *.cdninstagram.com blob: *.fbcdn.net *.fbsbx.com www.facebook.com *.facebook.com https://*.giphy.com data:;frame-src *.doubleclick.net *.google.com *.facebook.com www.googleadservices.com *.fbsbx.com fbsbx.com data: www.instagram.com *.fbcdn.net https://paywithmybank.com;worker-src blob: *.facebook.com data:;report-uri https://www.facebook.com/csp/reporting/?minimize=0;
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 0
x-fb-rlafr: 0
pragma: no-cache
x-fb-debug: cfLgez7mLfltJtVzzwjcP2PmnVCD4PjIJRiK3G/o9T5ubGfHxInsCrTUua1irFD4GISX9j8C0NvnEzdxhnd42w==
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: DENY
date: Thu, 21 Jul 2022 05:25:47 GMT
strict-transport-security: max-age=15552000; preload
report-to: {"max_age":259200,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/?device_level=unknown"}]}
content-type: text/html; charset="utf-8"
access-control-allow-origin: https://book.rwgenting.com
x-xss-protection: 0
cache-control: private, no-cache, no-store, must-revalidate
priority: u=1
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H3 200 / Show response
www.facebook.com/plugins/customer_chat/facade/ 718 B
483 B 241ms
200ms XHR
application/json 2a03:2880:f12d:181:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://www.facebook.com/plugins/customer_chat/facade/?app_id=&attribution=biz_inbox&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fx%2Fconnect%2Fxd_arbiter%2F%3Fversion%3D46%23cb%3Df3ac84a67b9722%26domain%3Dbook.rwgenting.com%26is_canvas%3Dfalse%26origin%3Dhttps%253A%252F%252Fbook.rwgenting.com%252Ff88ff3950496e8%26relation%3Dparent.parent&current_url=https%3A%2F%2Fbook.rwgenting.com%2Fonelogin%2Flogin&is_loaded_by_facade=true&locale=en_GB&log_id=c007d8d5-d34a-4d6f-9c40-b7941e99359c&page_id=180512280998&request_time=1658381147756&sdk=joey&suppress_http_code=1

Requested by

Host: book.rwgenting.com
URL: https://book.rwgenting.com/onelogin/polyfills.712a53dc69f3622f09f8.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f12d:181:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

6b074595152322833e9795937ef71c1840b08a479cc456daa327e77229db88e0

Security Headers

Name	Value
Content-Security-Policy	default-src data: blob: 'self' https://.fbsbx.com 'unsafe-inline' .facebook.com 'unsafe-eval' .fbcdn.net;script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self' connect.facebook.net;style-src fonts.googleapis.com .fbcdn.net data: .facebook.com 'unsafe-inline';connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com:* wss://.whatsapp.com: wss://.fbcdn.net attachment.fbsbx.com ws://localhost: blob: .cdninstagram.com 'self' wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d-test.facebook.com/ wss://kaios-d.facebook.com/ v.whatsapp.net .fbsbx.com .fb.com;font-src data: .gstatic.com .facebook.com .fbcdn.net .fbsbx.com;img-src .fbcdn.net .facebook.com data: https://.fbsbx.com .tenor.co media.tenor.com facebook.com .cdninstagram.com fbsbx.com fbcdn.net .giphy.com connect.facebook.net .carriersignal.info blob: android-webview-video-poster: googleads.g.doubleclick.net www.googleadservices.com .whatsapp.net .fb.com .oculuscdn.com;media-src .cdninstagram.com blob: .fbcdn.net .fbsbx.com www.facebook.com .facebook.com https://.giphy.com data:;frame-src .doubleclick.net .google.com .facebook.com www.googleadservices.com .fbsbx.com fbsbx.com data: www.instagram.com .fbcdn.net https://paywithmybank.com;worker-src blob: .facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

Referer: https://book.rwgenting.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36
Content-type: application/x-www-form-urlencoded

Response headers

content-security-policy: default-src data: blob: 'self' https://*.fbsbx.com 'unsafe-inline' *.facebook.com 'unsafe-eval' *.fbcdn.net;script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self' connect.facebook.net;style-src fonts.googleapis.com *.fbcdn.net data: *.facebook.com 'unsafe-inline';connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d-test.facebook.com/ wss://kaios-d.facebook.com/ v.whatsapp.net *.fbsbx.com *.fb.com;font-src data: *.gstatic.com *.facebook.com *.fbcdn.net *.fbsbx.com;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com *.tenor.co media.tenor.com facebook.com *.cdninstagram.com fbsbx.com fbcdn.net *.giphy.com connect.facebook.net *.carriersignal.info blob: android-webview-video-poster: googleads.g.doubleclick.net www.googleadservices.com *.whatsapp.net *.fb.com *.oculuscdn.com;media-src *.cdninstagram.com blob: *.fbcdn.net *.fbsbx.com www.facebook.com *.facebook.com https://*.giphy.com data:;frame-src *.doubleclick.net *.google.com *.facebook.com www.googleadservices.com *.fbsbx.com fbsbx.com data: www.instagram.com *.fbcdn.net https://paywithmybank.com;worker-src blob: *.facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;
content-encoding: br
x-content-type-options: nosniff
document-policy: force-load-at-top
content-security-policy-report-only: default-src data: blob: 'self' https://*.fbsbx.com 'unsafe-inline' *.facebook.com 'unsafe-eval' *.fbcdn.net;script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self' connect.facebook.net;style-src fonts.googleapis.com *.fbcdn.net data: *.facebook.com 'unsafe-inline';connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d-test.facebook.com/ wss://kaios-d.facebook.com/ v.whatsapp.net *.fbsbx.com *.fb.com;font-src data: *.gstatic.com *.facebook.com *.fbcdn.net *.fbsbx.com;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com *.tenor.co media.tenor.com facebook.com *.cdninstagram.com fbsbx.com fbcdn.net *.giphy.com connect.facebook.net *.carriersignal.info blob: android-webview-video-poster: googleads.g.doubleclick.net www.googleadservices.com *.whatsapp.net *.fb.com *.oculuscdn.com;media-src *.cdninstagram.com blob: *.fbcdn.net *.fbsbx.com www.facebook.com *.facebook.com https://*.giphy.com data:;frame-src *.doubleclick.net *.google.com *.facebook.com www.googleadservices.com *.fbsbx.com fbsbx.com data: www.instagram.com *.fbcdn.net https://paywithmybank.com;worker-src blob: *.facebook.com data:;report-uri https://www.facebook.com/csp/reporting/?minimize=0;
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-xss-protection: 0
pragma: no-cache
x-fb-debug: aIY6Ax+QODynvkrBhgRlbEwVz5FeM0TwicxC3qhIfpuR/DP8+NOF1IcIrxPJpg3V6JSm2nRMnnayQePrTZ1RIw==
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: DENY
date: Thu, 21 Jul 2022 05:25:47 GMT
strict-transport-security: max-age=15552000; preload
report-to: {"max_age":259200,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/?device_level=unknown"}]}
content-type: application/json; charset=utf-8
access-control-allow-origin: https://book.rwgenting.com
vary: Accept-Encoding
cache-control: private, no-cache, no-store, must-revalidate
x-fb-rlafr: 0
priority: u=1
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 optout_check Show response
beacon.krxd.net/ 80 B
240 B 189ms
55ms Script
text/javascript 54.74.133.13
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://beacon.krxd.net/optout_check?callback=Krux.ns.genting.kxjsonp_optOutCheck
Requested by: Host: cdn.krxd.net
URL: https://cdn.krxd.net/ctjs/controltag.js.0631b7d64dbbd3656a8b7368ad227a04
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.74.133.13 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-74-133-13.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: e9b5aa8ca7b302e3cbe1dfbec86e6e2c1d8c6ebfce351182c8fe17b358dcfce8

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://book.rwgenting.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

date: Thu, 21 Jul 2022 05:25:47 GMT
cache-control: private, max-age=0, s-max-age=0
x-request-time: D=29 t=1658381147
x-served-by: beacon-n019-dub-prod.krxd.net
content-type: text/javascript

GET
H3 200 / Show response
www.facebook.com/plugins/customer_chat/SDK/ 0
25 B 80ms
80ms XHR
text/html 2a03:2880:f12d:181:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://www.facebook.com/plugins/customer_chat/SDK/?app_id=&attribution=biz_inbox&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fx%2Fconnect%2Fxd_arbiter%2F%3Fversion%3D46%23cb%3Df3ac84a67b9722%26domain%3Dbook.rwgenting.com%26is_canvas%3Dfalse%26origin%3Dhttps%253A%252F%252Fbook.rwgenting.com%252Ff88ff3950496e8%26relation%3Dparent.parent&current_url=https%3A%2F%2Fbook.rwgenting.com%2Fonelogin%2Flogin&event_name=chat_plugin_sdk_facade_load&is_loaded_by_facade=true&loading_time=248&locale=en_GB&log_id=c007d8d5-d34a-4d6f-9c40-b7941e99359c&page_id=180512280998&request_time=1658381148004&sdk=joey&suppress_http_code=1

Requested by

Host: book.rwgenting.com
URL: https://book.rwgenting.com/onelogin/polyfills.712a53dc69f3622f09f8.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f12d:181:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	default-src data: blob: 'self' https://.fbsbx.com 'unsafe-inline' .facebook.com 'unsafe-eval' .fbcdn.net;script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self' connect.facebook.net;style-src fonts.googleapis.com .fbcdn.net data: .facebook.com 'unsafe-inline';connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com:* wss://.whatsapp.com: wss://.fbcdn.net attachment.fbsbx.com ws://localhost: blob: .cdninstagram.com 'self' wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d-test.facebook.com/ wss://kaios-d.facebook.com/ v.whatsapp.net .fbsbx.com .fb.com;font-src data: .gstatic.com .facebook.com .fbcdn.net .fbsbx.com;img-src .fbcdn.net .facebook.com data: https://.fbsbx.com .tenor.co media.tenor.com facebook.com .cdninstagram.com fbsbx.com fbcdn.net .giphy.com connect.facebook.net .carriersignal.info blob: android-webview-video-poster: googleads.g.doubleclick.net www.googleadservices.com .whatsapp.net .fb.com .oculuscdn.com;media-src .cdninstagram.com blob: .fbcdn.net .fbsbx.com www.facebook.com .facebook.com https://.giphy.com data:;frame-src .doubleclick.net .google.com .facebook.com www.googleadservices.com .fbsbx.com fbsbx.com data: www.instagram.com .fbcdn.net https://paywithmybank.com;worker-src blob: .facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

Referer: https://book.rwgenting.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36
Content-type: application/x-www-form-urlencoded

Response headers

content-security-policy: default-src data: blob: 'self' https://*.fbsbx.com 'unsafe-inline' *.facebook.com 'unsafe-eval' *.fbcdn.net;script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self' connect.facebook.net;style-src fonts.googleapis.com *.fbcdn.net data: *.facebook.com 'unsafe-inline';connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d-test.facebook.com/ wss://kaios-d.facebook.com/ v.whatsapp.net *.fbsbx.com *.fb.com;font-src data: *.gstatic.com *.facebook.com *.fbcdn.net *.fbsbx.com;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com *.tenor.co media.tenor.com facebook.com *.cdninstagram.com fbsbx.com fbcdn.net *.giphy.com connect.facebook.net *.carriersignal.info blob: android-webview-video-poster: googleads.g.doubleclick.net www.googleadservices.com *.whatsapp.net *.fb.com *.oculuscdn.com;media-src *.cdninstagram.com blob: *.fbcdn.net *.fbsbx.com www.facebook.com *.facebook.com https://*.giphy.com data:;frame-src *.doubleclick.net *.google.com *.facebook.com www.googleadservices.com *.fbsbx.com fbsbx.com data: www.instagram.com *.fbcdn.net https://paywithmybank.com;worker-src blob: *.facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;
x-content-type-options: nosniff
document-policy: force-load-at-top
content-security-policy-report-only: default-src data: blob: 'self' https://*.fbsbx.com 'unsafe-inline' *.facebook.com 'unsafe-eval' *.fbcdn.net;script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self' connect.facebook.net;style-src fonts.googleapis.com *.fbcdn.net data: *.facebook.com 'unsafe-inline';connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d-test.facebook.com/ wss://kaios-d.facebook.com/ v.whatsapp.net *.fbsbx.com *.fb.com;font-src data: *.gstatic.com *.facebook.com *.fbcdn.net *.fbsbx.com;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com *.tenor.co media.tenor.com facebook.com *.cdninstagram.com fbsbx.com fbcdn.net *.giphy.com connect.facebook.net *.carriersignal.info blob: android-webview-video-poster: googleads.g.doubleclick.net www.googleadservices.com *.whatsapp.net *.fb.com *.oculuscdn.com;media-src *.cdninstagram.com blob: *.fbcdn.net *.fbsbx.com www.facebook.com *.facebook.com https://*.giphy.com data:;frame-src *.doubleclick.net *.google.com *.facebook.com www.googleadservices.com *.fbsbx.com fbsbx.com data: www.instagram.com *.fbcdn.net https://paywithmybank.com;worker-src blob: *.facebook.com data:;report-uri https://www.facebook.com/csp/reporting/?minimize=0;
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 0
x-fb-rlafr: 0
pragma: no-cache
x-fb-debug: Jt/ifrfaQFmlu20OqyvU81wwL5M9BGuSnKiRKrw/Ts67I8YC7lWqsPkh+caic/pmEzp+/LTnmycI2YI9ZQ7mjA==
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: DENY
date: Thu, 21 Jul 2022 05:25:48 GMT
strict-transport-security: max-age=15552000; preload
report-to: {"max_age":259200,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/?device_level=unknown"}]}
content-type: text/html; charset="utf-8"
access-control-allow-origin: https://book.rwgenting.com
x-xss-protection: 0
cache-control: private, no-cache, no-store, must-revalidate
priority: u=1
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H3 200 collect
www.google-analytics.com/ 35 B
55 B 39ms
39ms Image
image/gif 2a00:1450:4001:830::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j96&a=501919268&t=event&ni=1&_s=1&dl=https%3A%2F%2Fbook.rwgenting.com%2Fonelogin%2Flogin&ul=en-us&de=UTF-8&dt=Resorts%20World%20Genting&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&ec=Scrolling&ea=10&el=percent&_u=aGDACEABRAAAAC~&jid=&gjid=&cid=413884077.1658381144&tid=UA-3398302-45&_gid=386319323.1658381144&gtm=2wg7i0K3SJ4N2&z=1364108493

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://book.rwgenting.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 20 Jul 2022 21:57:34 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 26894
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H3 200 collect
www.google-analytics.com/ 35 B
55 B 41ms
40ms Image
image/gif 2a00:1450:4001:830::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j96&a=501919268&t=event&ni=1&_s=1&dl=https%3A%2F%2Fbook.rwgenting.com%2Fonelogin%2Flogin&ul=en-us&de=UTF-8&dt=Resorts%20World%20Genting&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&ec=Scrolling&ea=25&el=percent&_u=aGDACEABRAAAAC~&jid=&gjid=&cid=413884077.1658381144&tid=UA-3398302-45&_gid=386319323.1658381144&gtm=2wg7i0K3SJ4N2&z=453390857

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://book.rwgenting.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 20 Jul 2022 21:57:34 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 26894
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H3 200 collect
www.google-analytics.com/ 35 B
55 B 42ms
41ms Image
image/gif 2a00:1450:4001:830::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j96&a=501919268&t=event&ni=1&_s=1&dl=https%3A%2F%2Fbook.rwgenting.com%2Fonelogin%2Flogin&ul=en-us&de=UTF-8&dt=Resorts%20World%20Genting&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&ec=Scrolling&ea=50&el=percent&_u=aGDACEABRAAAAC~&jid=&gjid=&cid=413884077.1658381144&tid=UA-3398302-45&_gid=386319323.1658381144&gtm=2wg7i0K3SJ4N2&z=1738596074

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://book.rwgenting.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 20 Jul 2022 21:57:34 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 26894
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H3 200 collect
www.google-analytics.com/ 35 B
55 B 44ms
43ms Image
image/gif 2a00:1450:4001:830::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j96&a=501919268&t=event&ni=1&_s=1&dl=https%3A%2F%2Fbook.rwgenting.com%2Fonelogin%2Flogin&ul=en-us&de=UTF-8&dt=Resorts%20World%20Genting&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&ec=Scrolling&ea=75&el=percent&_u=aGDACEABRAAAAC~&jid=&gjid=&cid=413884077.1658381144&tid=UA-3398302-45&_gid=386319323.1658381144&gtm=2wg7i0K3SJ4N2&z=1287999239

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://book.rwgenting.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 20 Jul 2022 21:57:34 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 26894
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H3 200 collect
www.google-analytics.com/ 35 B
55 B 46ms
46ms Image
image/gif 2a00:1450:4001:830::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j96&a=501919268&t=event&ni=1&_s=1&dl=https%3A%2F%2Fbook.rwgenting.com%2Fonelogin%2Flogin&ul=en-us&de=UTF-8&dt=Resorts%20World%20Genting&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&ec=Scrolling&ea=90&el=percent&_u=aGDACEABRAAAAC~&jid=&gjid=&cid=413884077.1658381144&tid=UA-3398302-45&_gid=386319323.1658381144&gtm=2wg7i0K3SJ4N2&z=1827416294

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://book.rwgenting.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 20 Jul 2022 21:57:34 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 26894
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

POST
H3 204 collect
region1.analytics.google.com/g/ 0
17 B 123ms
44ms Ping
text/plain 2001:4860:4802:32::36
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://region1.analytics.google.com/g/collect?v=2&tid=G-2QCFNCZ841&gtm=2oe7i0&_p=501919268&_z=ccd.v9B&cid=413884077.1658381144&ul=en-us&sr=1600x1200&sid=1658381144&sct=1&seg=0&dl=https%3A%2F%2Fbook.rwgenting.com%2Fonelogin%2Flogin%3Fmid%3D5B5BA18CDF117678AD4A556ED500F79A550D62537139386F006D6DC3800866384A73B0794550B7006CB01F8D8C8806AE63A0E64A409145A7B9280D0CD1B123079FF4B25BFBEDEDABFD418D82CC6DDBC24F%26hashCode%3DA3A88955236CD99122BD213EA23933F9E7F81F9BD51A2B4F48BB5B0931A7EC1E0D19AE4D5C8DCFA4D14E015614CAF61112414F4A736E01975F01131A0%26language%3Den&dt=Resorts%20World%20Genting&_s=2
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-2QCFNCZ841&l=dataLayer&cx=c
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2001:4860:4802:32::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://book.rwgenting.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

pragma: no-cache
date: Thu, 21 Jul 2022 05:25:49 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://book.rwgenting.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Verdicts & Comments Add Verdict or Comment

196 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

36 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
book.rwgenting.com/	1969-12-31 23:59:59	Name: aliyungf_tc Value: f14d45bd9ff35014c24479272d7f00ae1f5485c91e6d389899a62f836229c202
book.rwgenting.com/	1970-01-20 04:39:42	Name: acw_tc Value: aa21200616583811434273098e05d59ed4e569242efd4d2b44874e6110aedb
.rwgenting.com/	1970-01-20 04:41:07	Name: _gid Value: GA1.2.386319323.1658381144
.rwgenting.com/	1970-01-20 04:39:41	Name: _gat Value: 1
.rwgenting.com/	1970-01-20 06:49:17	Name: _gcl_au Value: 1.1.1124404431.1658381144
.rwgenting.com/	1970-01-20 22:10:53	Name: _ga Value: GA1.2.413884077.1658381144
.rwgenting.com/	1970-01-20 04:39:41	Name: _gat_UA-3398302-45 Value: 1
.rwgenting.com/	1970-01-20 06:49:17	Name: _fbp Value: fb.1.1658381144647.1787190418
.krxd.net/	1970-01-20 08:58:53	Name: _kuid_ Value: O-EhbTuc
.quantserve.com/	1970-01-20 14:09:55	Name: mc Value: 62d8e359-4af0b-8cb06-9c2a2
.rwgenting.com/	1970-01-20 14:04:09	Name: __qca Value: P0-1278437762-1658381145251
.doubleclick.net/	1970-01-20 14:01:17	Name: IDE Value: AHWqTUmgE7dGnMZK3VE_pqm9jQfgQ7uWuSDd92w_bTaHsB1IbY2cnr2zybkdUM9RfoQ
book.rwgenting.com/	1970-01-20 05:22:53	Name: _knxcm_ Value: googleT1658381146.0004T1658381146.0005T1658381146.0006T1658381146.0008T1658381146.0010T1658381146.0011T1658381146.0013T1658381146.0015T1658381146.0016T1658381146.0011T1658381146
.brand-display.com/	1970-01-20 22:10:53	Name: _knxp_ Value:
.brand-display.com/	1970-01-20 22:10:53	Name: _knxcv_ Value:
.brand-display.com/	1970-01-20 22:10:53	Name: _knxu_ Value:
.brand-display.com/	1970-01-20 22:10:53	Name: _knxcm_ Value:
.brand-display.com/	1970-01-20 22:10:53	Name: _ga Value:
.brand-display.com/	1970-01-20 22:10:53	Name: __gads Value:
.brand-display.com/	1970-01-20 22:10:53	Name: __utma Value:
.brand-display.com/	1970-01-20 22:10:53	Name: allowCookies Value: false
.brand-display.com/	1970-01-20 22:10:53	Name: _knxq_ Value:
.adnxs.com/	1970-01-20 06:49:17	Name: uuid2 Value: 8779483372208526133
.tapad.com/	1970-01-20 06:06:05	Name: TapAd_TS Value: 1658381146849
.tapad.com/	1970-01-20 06:06:05	Name: TapAd_DID Value: 24fd7a2f-1b5c-4e74-aab3-e91fed3e7880
.casalemedia.com/	1970-01-20 13:25:17	Name: CMID Value: YtjjWqI7JSZbxojgDWOXuQAA
.casalemedia.com/	1970-01-20 06:49:17	Name: CMPS Value: 1104
.casalemedia.com/	1970-01-20 06:49:17	Name: CMPRO Value: 1104
.bidswitch.net/	1970-01-20 13:25:17	Name: tuuid Value: 1a62da8e-b459-4812-88e3-1a62a87b4773
.bidswitch.net/	1970-01-20 13:25:17	Name: c Value: 1658381146
.bidswitch.net/	1970-01-20 13:25:17	Name: tuuid_lu Value: 1658381146
.adnxs.com/	1970-01-20 06:49:17	Name: anj Value: dTM7k!M4.FE:2jUF']wIg2GUbua:t8!@wnfH8KWOOm^3y=0L464@m7!iIOyWhswpt3OGoN3iWH22R$I+e%iZkRDd_/gBK/X%W#.wL4W1Qw2_*Hn$4
.tapad.com/	1970-01-20 06:06:05	Name: TapAd_3WAY_SYNCS Value:
.casalemedia.com/	1970-01-20 06:49:17	Name: CMTS Value: 5141
book.rwgenting.com/	1969-12-31 23:59:59	Name: SERVERID Value: a0805ad1284e0c1744f9170ad58ce16c\|1658381147\|1658381143
.rwgenting.com/	1970-01-20 22:10:53	Name: _ga_2QCFNCZ841 Value: GS1.1.1658381144.1.1.1658381148.56

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://idsync.rlcdn.com/708804.gif?partner_uid=ed9f2fa61815b51cacadfefeed42bb33 Message: Failed to load resource: the server responded with a status of 451 ()

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1;mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

8661995.fls.doubleclick.net
adservice.google.com
beacon.krxd.net
book.rwgenting.com
cdn.brand-display.com
cdn.krxd.net
connect.facebook.net
consumer.krxd.net
dmp.brand-display.com
dsum-sec.casalemedia.com
erwg.my
googleads.g.doubleclick.net
ib.adnxs.com
idsync.rlcdn.com
mcsqjpvz392sd02cs6vv33b0kfhq.pub.sfmc-content.com
partners.tremorhub.com
pixel.quantserve.com
pixel.tapad.com
pub.s7.exacttarget.com
region1.analytics.google.com
rules.quantcount.com
secure.quantserve.com
stats.g.doubleclick.net
sync.taboola.com
tags.bluekai.com
tr.brand-display.com
us-u.openx.net
www.facebook.com
www.google-analytics.com
www.google.com
www.google.de
www.googleadservices.com
www.googleoptimize.com
www.googletagmanager.com
x.bidswitch.net
104.111.215.191
104.18.19.126
136.147.129.3
136.147.129.35
141.226.228.48
142.250.181.230
142.250.186.162
151.101.194.133
170.33.9.200
18.66.248.12
185.89.210.20
2001:4860:4802:32::36
2600:1f18:612b:4232:fce7:74b5:7c53:e386
2600:9000:20fc:1400:6:44e3:f8c0:93a1
2620:116:800d:21:b314:a0ef:ab7c:d546
2a00:1450:4001:806::2002
2a00:1450:4001:80e::2003
2a00:1450:4001:810::200e
2a00:1450:4001:827::2004
2a00:1450:4001:828::2008
2a00:1450:4001:830::2002
2a00:1450:4001:830::200e
2a00:1450:400c:c00::9b
2a03:2880:f02d:100:face:b00c:0:3
2a03:2880:f12d:181:face:b00c:0:25de
34.111.151.213
34.98.64.218
35.227.248.159
35.244.174.68
47.254.192.82
52.57.150.184
52.74.245.38
54.74.133.13
05c4cc82e30439bb88e3189e19b3ae0ea83c22fff0eb8c94aea737fd377be643
0c2c69ba33a4d4eb53419c912ea55131208d76852cc632e2544833497d165bc3
10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa
11e595017e67ca065944d3f497307003600e83c56c291242d084251e818b7147
1f8e18b8acecf86cc2a1151ad9ac83122ac95087ff67ec80c4b1feb3951ac958
27988668fad87e9782d62f51b22f6feda6fdb2ef16a315b968728f164be1c6f7
39552c65dca63a153fa82b1463652393f010ea6602e0e963195dc6a46407fb7d
3bad7d670a6660817708b9fb30b07ab22cd3db5d87f2bc2f141a67f4da9ebeb7
3bcfa04dbc2db44af54bd72a0f7b98912368f16f525729a1b9b673f62ca7e5c9
3de97ec8ba594ea4b2129a7b5a02520ed969a92fe07528569533f94be1b3dc61
3df7235b92047d8a0e8142e7473f08078890502c88bfaa0638beb55bd83cd66d
3eb10792d1f0c7e07e7248273540f1952d9a5a2996f4b5df70ab026cd9f05517
4204debecf775801a4d82917e933f87b9bf0019771aa7dcc6f39e0f0104bf240
4a2bd7ca82f65229847b16e0997562b09c4f45415269af9325c18a3f1e61a37d
4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49
5413c124c49172d18069165214409ce8b4c6427692e8bbbcfe640b7598ce6328
57f6d8487bab98a2619f66320d98bcc0c51ca41a05a266d253c5c1e259649f41
63a9d69c6229b4cfbc63999cbd0a0b463208b2b0bd28d0e56d350d0c77bd4591
6b074595152322833e9795937ef71c1840b08a479cc456daa327e77229db88e0
6c5acbb82a46a4971660f65131241dffcc28828f4dbd76b8ec7bab0b468250f8
6e164ad4aa1f1905c44c2e4e57088f313738d18320a99a7e6a984b862523d96d
7d3a589c487b5b54dbf677604978568337d209733a3f6bcb5bf1d993b3075ec2
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80
8b84e2bf2590e230009a170bdcbe31fbe63c3404750408de8c6bc1c3ff960a1c
9196de04e6e0a1b5325caf766f9773a39d100491086d5cfc2a79a9a22a3c32d2
96b5758d29b5bbe4540eb1261b04bdde68fb77355e9367a9d1cafab13615f13a
99ce5a68e2cb305eedee5447ea9d99adef35c44449ca9de31d4279d9de87eea4
a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7
a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8
a1925038db769477ab74b4df34350c35688a795bb718727b0f4292a4a78a6210
a6167d3e3b6ff969ee4607699d515d7373e183e5fbb7683428354e7dd8157bd7
a916bd4fc8460bb0b3f39ebdd10982c740dd3135a1d45705d008700ffbe2f776
aec60bc104db041b1512185839f18f52986df7e569e5445f740dd60f763fbca8
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
b1fc39e2dc899b1d51abd3d512f8aa29203171512ee55a46fd1cdb193b319006
b3b810fd46e7aad5b789896519011ab5366b39dbb19a5663c53525f756e89bfb
b9b47c8bafc4618d804c7c54ac03c39b29beb9ed5b1e7d9dbadb0f28d71c3d94
b9c555b75e4d1620a4c0cfccea19e3ac4e54e4555654edbe353e4ce1263f01f3
ba50544bc52682e3884d79402fa65bbc8149866ff097223c48d9da54bb02e280
c08e671967a1e37c99c6644d9ce66597c324639607a4df7df671d4d6b4229268
cedcf159346f2821fe551254c57c7e79c95fe4d3a13fdf70ce5fda4bd83f41f3
d3f21d08879d324cab618b79ee82ed48366b99516b384c5e6413037223c0901c
d4edbbe1037c50c8ffa90860286c8166860ad9da450ed5e16a28e2fc9bce3c23
dafa3ce4de4cc56876b0fc6c36628fbcade9f4b07d7f27e4ca67744d91b2beb7
de3246094525b21a870fc7d2a67490d0132535c6fa5993755c549f1a9d1bd8af
e08a8b816844b1b36de422161848b43b2f43b83a9c3363523b239ad7dedf8477
e3018325ef078b10810876eab67c9f324f4401349cdc8e775eb5223134c6b868
e307589381e9547197496915557f0f70dbd39f517c5bd0029aa939b2b0ae5734
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e643829c116356bde28926714ce3b0481f1d3dca3310e6aaf89ce7ff2d319613
e98538ed9f205ef8127b6be7bb7ea2435c9deb31eff7fbad8489bdbc161002b7
e9b5aa8ca7b302e3cbe1dfbec86e6e2c1d8c6ebfce351182c8fe17b358dcfce8
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
ef26e4419a7f9729a9fe8567f6b6559c0264166a029ed1f3e807171ff529b569
f5c2adae89718a53679c5a07e14dbeb4cde33d917a1419006aa26b81968eece1
f69881097386a9dcb9e2172792fa97fc38389caddf599dc99800b2855e0006aa

book.rwgenting.com Open in urlscan Pro 170.33.9.200 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

97 Requests

93 %HTTPS

42 %IPv6

26 Domains

35 Subdomains

29 IPs

8 Countries

1831 kBTransfer

5913 kBSize

36 Cookies

1 Outgoing links

Page URL History

Redirected requests

97 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 2 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

book.rwgenting.com Open in urlscan Pro
170.33.9.200 Public Scan

Screenshot
Live screenshot

Full Image

97
Requests

93 %
HTTPS

42 %
IPv6

26
Domains

35
Subdomains

29
IPs

8
Countries

1831 kB
Transfer

5913 kB
Size

36
Cookies

97 HTTP transactions
2 data transactions