authority.cosmopolitanlasvegas.com Open in urlscan Pro
40.80.155.102 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://t.myvisualiq.net/click_pixel?et=c&ago=212&ao=849&aca=-9&si=-9&ci=-9&pi=-9&ad=-9&sv1=-9&advt=%eadv!&chnl=-36&vndr=...
Effective URL:
https://authority.cosmopolitanlasvegas.com/account/login?returnUrl=%2Fconnect%2Fauthorize%2Fcallback%3Fclient_id%3DIdentityOnline%26redirec...
Submission: On May 30 via manual (May 30th 2023, 4:14:56 pm UTC) from US — Scanned from DE

Summary HTTP 127 Redirects Links 1 Behaviour Indicators

Summary

This website contacted 53 IPs in 6 countries across 46 domains to perform 127 HTTP transactions. The main IP is 40.80.155.102, located in San Jose, United States and belongs to MICROSOFT-CORP-MSN-AS-BLOCK, US. The main domain is authority.cosmopolitanlasvegas.com.
TLS certificate: Issued by DigiCert Global G2 TLS RSA SHA256 202... on April 20th 2023. Valid for: a year.

This is the only time authority.cosmopolitanlasvegas.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
6 10	35.157.143.185 35.157.143.185	16509 (AMAZON-02) (AMAZON-02)
1 1	54.149.49.17 54.149.49.17	16509 (AMAZON-02) (AMAZON-02)
2 2	104.42.46.9 104.42.46.9	8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1 13	40.80.155.102 40.80.155.102	8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
2	152.199.19.160 152.199.19.160	15133 (EDGECAST) (EDGECAST)
3	2a00:1450:400... 2a00:1450:4001:80b::2008	15169 (GOOGLE) (GOOGLE)
2	178.249.97.23 178.249.97.23	11054 (LIVEPERSON) (LIVEPERSON)
3	107.178.244.119 107.178.244.119	15169 (GOOGLE) (GOOGLE)
1	2600:9000:214... 2600:9000:214f:b600:1:76cf:fe80:93a1	16509 (AMAZON-02) (AMAZON-02)
2	2620:116:800d... 2620:116:800d:21:ef75:8280:f209:5ba1	16509 (AMAZON-02) (AMAZON-02)
1	216.200.122.13 216.200.122.13	6461 (ZAYO-6461) (ZAYO-6461)
1 11	2606:4700:303... 2606:4700:3033::6815:2773	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1 4	2620:1ec:c11:... 2620:1ec:c11::200	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1 1	151.101.129.182 151.101.129.182	54113 (FASTLY) (FASTLY)
4 6	193.0.160.130 193.0.160.130	54312 (ROCKETFUEL) (ROCKETFUEL)
2	2a03:2880:f08... 2a03:2880:f083:9:face:b00c:0:3	32934 (FACEBOOK) (FACEBOOK)
4 4	142.250.186.102 142.250.186.102	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:82a::2002	15169 (GOOGLE) (GOOGLE)
2 4	185.89.210.20 185.89.210.20	29990 (ASN-APPNEX) (ASN-APPNEX)
6 7	142.250.184.226 142.250.184.226	15169 (GOOGLE) (GOOGLE)
1 1	2a00:1450:400... 2a00:1450:4001:812::200e	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:829::200e	15169 (GOOGLE) (GOOGLE)
2 4	185.89.210.122 185.89.210.122	29990 (ASN-APPNEX) (ASN-APPNEX)
1	35.71.131.137 35.71.131.137	16509 (AMAZON-02) (AMAZON-02)
1	2600:9000:223... 2600:9000:223c:dc00:6:44e3:f8c0:93a1	16509 (AMAZON-02) (AMAZON-02)
2	2620:1ec:4f:1... 2620:1ec:4f:1::44	8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
4 4	65.9.66.64 65.9.66.64	16509 (AMAZON-02) (AMAZON-02)
4	35.244.174.68 35.244.174.68	15169 (GOOGLE) (GOOGLE)
2 4	52.16.141.94 52.16.141.94	16509 (AMAZON-02) (AMAZON-02)
2	185.64.190.80 185.64.190.80	62713 (AS-PUBMATIC) (AS-PUBMATIC)
1	34.98.64.218 34.98.64.218	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
1	3.121.27.153 3.121.27.153	16509 (AMAZON-02) (AMAZON-02)
1	23.52.120.27 23.52.120.27	16625 (AKAMAI-AS) (AKAMAI-AS)
1	52.201.114.204 52.201.114.204	14618 (AMAZON-AES) (AMAZON-AES)
1 3	185.80.39.216 185.80.39.216	27381 (CASALE-MEDIA) (CASALE-MEDIA)
3	104.111.217.14 104.111.217.14	16625 (AKAMAI-AS) (AKAMAI-AS)
1 2	185.94.180.125 185.94.180.125	35220 (SPOTX-AMS) (SPOTX-AMS)
1	2600:1f18:612... 2600:1f18:612b:4264:d57a:9c78:cd9c:28fc	14618 (AMAZON-AES) (AMAZON-AES)
2	52.208.135.117 52.208.135.117	16509 (AMAZON-02) (AMAZON-02)
1	52.209.157.144 52.209.157.144	16509 (AMAZON-02) (AMAZON-02)
1 2	3.65.79.246 3.65.79.246	16509 (AMAZON-02) (AMAZON-02)
2 2	151.101.130.49 151.101.130.49	54113 (FASTLY) (FASTLY)
2	178.249.97.99 178.249.97.99	11054 (LIVEPERSON) (LIVEPERSON)
7	34.149.42.49 34.149.42.49	15169 (GOOGLE) (GOOGLE)
4	2a03:2880:f17... 2a03:2880:f176:84:face:b00c:0:25de	32934 (FACEBOOK) (FACEBOOK)
3	23.96.124.68 23.96.124.68	8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
2	208.89.12.87 208.89.12.87	11054 (LIVEPERSON) (LIVEPERSON)
1 2	68.219.88.97 68.219.88.97	8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1	18.66.112.57 18.66.112.57	16509 (AMAZON-02) (AMAZON-02)
1 1	34.111.113.62 34.111.113.62	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
3	151.101.65.182 151.101.65.182	54113 (FASTLY) (FASTLY)
3	151.101.1.62 151.101.1.62	54113 (FASTLY) (FASTLY)
1	151.101.2.133 151.101.2.133	54113 (FASTLY) (FASTLY)
1	2a00:1450:400... 2a00:1450:4001:831::2004	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:802::2003	15169 (GOOGLE) (GOOGLE)
8 18	52.31.168.141 52.31.168.141	16509 (AMAZON-02) (AMAZON-02)
2 4	52.49.138.187 52.49.138.187	16509 (AMAZON-02) (AMAZON-02)
1	35.186.195.233 35.186.195.233	15169 (GOOGLE) (GOOGLE)
1	95.101.54.106 95.101.54.106	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1 2	54.78.254.47 54.78.254.47	16509 (AMAZON-02) (AMAZON-02)
1	69.173.144.165 69.173.144.165	26667 (RUBICONPR...) (RUBICONPROJECT)
127	53

10 35.157.143.185 (Frankfurt am Main, Germany) 6 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-35-157-143-185.eu-central-1.compute.amazonaws.com

t.myvisualiq.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 54.149.49.17 (Boardman, United States) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-54-149-49-17.us-west-2.compute.amazonaws.com

t2.em.cosmopolitan-lv.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 104.42.46.9 (San Jose, United States) 2 redirects

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

www.cosmopolitanlasvegas.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

13 40.80.155.102 (San Jose, United States) 1 redirects

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

authority.cosmopolitanlasvegas.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 152.199.19.160 (United States)

ASN15133 (EDGECAST, US)

ajax.aspnetcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:80b::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 178.249.97.23 (United States)

ASN11054 (LIVEPERSON, US)

lptag.liveperson.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 107.178.244.119 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 119.244.178.107.bc.googleusercontent.com

beacon.sojern.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
pixel.sojern.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:214f:b600:1:76cf:fe80:93a1 (United States)

ASN16509 (AMAZON-02, US)

c1.rfihub.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2620:116:800d:21:ef75:8280:f209:5ba1 (United States)

ASN16509 (AMAZON-02, US)

secure.quantserve.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
pixel.quantserve.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 216.200.122.13 (Tonganoxie, United States)

ASN6461 (ZAYO-6461, US)
PTR: 216.200.122.13.IPYX-141870-ZYO.zip.zayo.com

ciqtracking.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

11 2606:4700:3033::6815:2773 (United States) 1 redirects

ASN13335 (CLOUDFLARENET, US)

onboard.triptease.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
targeted-messages.triptease.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2620:1ec:c11::200 (United States) 1 redirects

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

bat.bing.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
c.bing.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 151.101.129.182 (United States) 1 redirects

ASN54113 (FASTLY, US)

static.triptease.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 193.0.160.130 (United States) 4 redirects

ASN54312 (ROCKETFUEL, US)

20843572p.rfihub.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
p.rfihub.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
a.rfihub.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a03:2880:f083:9:face:b00c:0:3 (Frankfurt am Main, Germany)

ASN32934 (FACEBOOK, US)

connect.facebook.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 142.250.186.102 (United States) 4 redirects

ASN15169 (GOOGLE, US)
PTR: fra24s06-in-f6.1e100.net

ad.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:82a::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

adservice.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 185.89.210.20 (Frankfurt am Main, Germany) 2 redirects

ASN29990 (ASN-APPNEX, US)
PTR: 944.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net

secure.adnxs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 142.250.184.226 (United States) 6 redirects

ASN15169 (GOOGLE, US)
PTR: fra24s12-in-f2.1e100.net

cm.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:812::200e (Frankfurt am Main, Germany) 1 redirects

ASN15169 (GOOGLE, US)

fcmatch.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:829::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fcmatch.youtube.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 185.89.210.122 (Frankfurt am Main, Germany) 2 redirects

ASN29990 (ASN-APPNEX, US)
PTR: 954.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net

ib.adnxs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 35.71.131.137 (United States)

ASN16509 (AMAZON-02, US)
PTR: a6370ebea231e0c9a.awsglobalaccelerator.com

match.adsrvr.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:223c:dc00:6:44e3:f8c0:93a1 (United States)

ASN16509 (AMAZON-02, US)

rules.quantcount.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2620:1ec:4f:1::44 (United States)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

www.clarity.ms	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 65.9.66.64 (United States) 4 redirects

ASN16509 (AMAZON-02, US)
PTR: server-65-9-66-64.fra56.r.cloudfront.net

live.rezync.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 35.244.174.68 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 68.174.244.35.bc.googleusercontent.com

idsync.rlcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 52.16.141.94 (Dublin, Ireland) 2 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-52-16-141-94.eu-west-1.compute.amazonaws.com

dpm.demdex.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 185.64.190.80 (United Kingdom)

ASN62713 (AS-PUBMATIC, US)

image2.pubmatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 34.98.64.218 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 218.64.98.34.bc.googleusercontent.com

us-u.openx.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 3.121.27.153 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-3-121-27-153.eu-central-1.compute.amazonaws.com

ps.eyeota.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 23.52.120.27 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a23-52-120-27.deploy.static.akamaitechnologies.com

contextual.media.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.201.114.204 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-52-201-114-204.compute-1.amazonaws.com

bpi.rtactivate.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 185.80.39.216 (Canada) 1 redirects

ASN27381 (CASALE-MEDIA, CA)

dsum-sec.casalemedia.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 104.111.217.14 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a104-111-217-14.deploy.static.akamaitechnologies.com

x.dlx.addthis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
tags.bluekai.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 185.94.180.125 (Amsterdam, Netherlands) 1 redirects

ASN35220 (SPOTX-AMS, US)

sync.search.spotxchange.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:1f18:612b:4264:d57a:9c78:cd9c:28fc (Ashburn, United States)

ASN14618 (AMAZON-AES, US)

partners.tremorhub.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 52.208.135.117 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-52-208-135-117.eu-west-1.compute.amazonaws.com

aa.agkn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.209.157.144 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-52-209-157-144.eu-west-1.compute.amazonaws.com

beacon.krxd.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 3.65.79.246 (Frankfurt am Main, Germany) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-3-65-79-246.eu-central-1.compute.amazonaws.com

x.bidswitch.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 151.101.130.49 (United States) 2 redirects

ASN54113 (FASTLY, US)

sync-tm.everesttech.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 178.249.97.99 (United States)

ASN11054 (LIVEPERSON, US)
PTR: lo-accdn.lpsnmedia.net

accdn.lpsnmedia.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 34.149.42.49 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 49.42.149.34.bc.googleusercontent.com

lpcdn-a.lpsnmedia.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a03:2880:f176:84:face:b00c:0:25de (Frankfurt am Main, Germany)

ASN32934 (FACEBOOK, US)

www.facebook.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 23.96.124.68 (Tappahannock, United States)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

s.clarity.ms	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 208.89.12.87 (United States)

ASN11054 (LIVEPERSON, US)
PTR: va.v.liveperson.net

va.v.liveperson.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 68.219.88.97 (Dublin, Ireland) 1 redirects

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

c.clarity.ms	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 18.66.112.57 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-18-66-112-57.fra56.r.cloudfront.net

vt.myvisualiq.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 34.111.113.62 (Kansas City, United States) 1 redirects

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 62.113.111.34.bc.googleusercontent.com

tapestry.tapad.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 151.101.65.182 (United States)

ASN54113 (FASTLY, US)

static-meta.triptease.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 151.101.1.62 (United States)

ASN54113 (FASTLY, US)

b.triptease.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 151.101.2.133 (United States)

ASN54113 (FASTLY, US)

messages.guest-experience.triptease.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:831::2004 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:802::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

18 52.31.168.141 (Dublin, Ireland) 8 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-52-31-168-141.eu-west-1.compute.amazonaws.com

segment.prod.bidr.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 52.49.138.187 (Dublin, Ireland) 2 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-52-49-138-187.eu-west-1.compute.amazonaws.com

match.prod.bidr.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 35.186.195.233 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 233.195.186.35.bc.googleusercontent.com

api.triptease.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 95.101.54.106 (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)
PTR: a95-101-54-106.deploy.static.akamaitechnologies.com

ads.stickyadstv.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 54.78.254.47 (Dublin, Ireland) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-54-78-254-47.eu-west-1.compute.amazonaws.com

loadus.exelator.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 69.173.144.165 (Frankfurt am Main, Germany)

ASN26667 (RUBICONPROJECT, US)

pixel.rubiconproject.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
22	bidr.io 10 redirects segment.prod.bidr.io — Cisco Umbrella Rank: 6530 match.prod.bidr.io — Cisco Umbrella Rank: 520	14 KB
20	triptease.io 2 redirects onboard.triptease.io — Cisco Umbrella Rank: 27183 static.triptease.io — Cisco Umbrella Rank: 51742 targeted-messages.triptease.io — Cisco Umbrella Rank: 42523 static-meta.triptease.io — Cisco Umbrella Rank: 75057 b.triptease.io — Cisco Umbrella Rank: 25366 messages.guest-experience.triptease.io — Cisco Umbrella Rank: 43798 api.triptease.io — Cisco Umbrella Rank: 42585	217 KB
15	cosmopolitanlasvegas.com 3 redirects www.cosmopolitanlasvegas.com — Cisco Umbrella Rank: 398418 authority.cosmopolitanlasvegas.com	782 KB
11	doubleclick.net 10 redirects ad.doubleclick.net — Cisco Umbrella Rank: 165 cm.g.doubleclick.net — Cisco Umbrella Rank: 210 googleads.g.doubleclick.net — Cisco Umbrella Rank: 34	4 KB
11	myvisualiq.net 6 redirects t.myvisualiq.net — Cisco Umbrella Rank: 2496 vt.myvisualiq.net — Cisco Umbrella Rank: 28118	9 KB
9	lpsnmedia.net accdn.lpsnmedia.net — Cisco Umbrella Rank: 2989 lpcdn-a.lpsnmedia.net — Cisco Umbrella Rank: 410497	336 KB
8	adnxs.com 4 redirects secure.adnxs.com — Cisco Umbrella Rank: 417 ib.adnxs.com — Cisco Umbrella Rank: 214	9 KB
7	clarity.ms 1 redirects www.clarity.ms — Cisco Umbrella Rank: 952 s.clarity.ms — Cisco Umbrella Rank: 7903 c.clarity.ms — Cisco Umbrella Rank: 1495	23 KB
6	rfihub.com 4 redirects 20843572p.rfihub.com — Cisco Umbrella Rank: 656853 p.rfihub.com — Cisco Umbrella Rank: 728 a.rfihub.com — Cisco Umbrella Rank: 2743	9 KB
4	facebook.com www.facebook.com — Cisco Umbrella Rank: 102	288 B
4	demdex.net 2 redirects dpm.demdex.net — Cisco Umbrella Rank: 200	3 KB
4	rlcdn.com idsync.rlcdn.com — Cisco Umbrella Rank: 375	158 B
4	rezync.com 4 redirects live.rezync.com — Cisco Umbrella Rank: 1677	3 KB
4	google.com 1 redirects adservice.google.com — Cisco Umbrella Rank: 68 fcmatch.google.com — Cisco Umbrella Rank: 2932 www.google.com — Cisco Umbrella Rank: 2	1 KB
4	bing.com 1 redirects bat.bing.com — Cisco Umbrella Rank: 343 c.bing.com — Cisco Umbrella Rank: 232	15 KB
4	liveperson.net lptag.liveperson.net — Cisco Umbrella Rank: 3083 va.v.liveperson.net — Cisco Umbrella Rank: 3456	114 KB
3	casalemedia.com 1 redirects dsum-sec.casalemedia.com — Cisco Umbrella Rank: 530	2 KB
3	sojern.com beacon.sojern.com — Cisco Umbrella Rank: 4254 pixel.sojern.com — Cisco Umbrella Rank: 6501	2 KB
3	googletagmanager.com www.googletagmanager.com — Cisco Umbrella Rank: 40	198 KB
2	exelator.com 1 redirects loadus.exelator.com — Cisco Umbrella Rank: 1292	2 KB
2	bluekai.com tags.bluekai.com — Cisco Umbrella Rank: 532	753 B
2	everesttech.net 2 redirects sync-tm.everesttech.net — Cisco Umbrella Rank: 606	619 B
2	bidswitch.net 1 redirects x.bidswitch.net — Cisco Umbrella Rank: 290	916 B
2	agkn.com aa.agkn.com — Cisco Umbrella Rank: 493	879 B
2	spotxchange.com 1 redirects sync.search.spotxchange.com — Cisco Umbrella Rank: 694	1 KB
2	pubmatic.com image2.pubmatic.com — Cisco Umbrella Rank: 820	704 B
2	facebook.net connect.facebook.net — Cisco Umbrella Rank: 157	114 KB
2	quantserve.com secure.quantserve.com — Cisco Umbrella Rank: 970 pixel.quantserve.com — Cisco Umbrella Rank: 790	10 KB
2	aspnetcdn.com ajax.aspnetcdn.com — Cisco Umbrella Rank: 1749	9 KB
1	rubiconproject.com pixel.rubiconproject.com — Cisco Umbrella Rank: 315	239 B
1	stickyadstv.com ads.stickyadstv.com — Cisco Umbrella Rank: 560	642 B
1	google.de www.google.de — Cisco Umbrella Rank: 6080	455 B
1	tapad.com 1 redirects tapestry.tapad.com — Cisco Umbrella Rank: 1395	480 B
1	krxd.net beacon.krxd.net — Cisco Umbrella Rank: 601	338 B
1	tremorhub.com partners.tremorhub.com — Cisco Umbrella Rank: 1013	175 B
1	addthis.com x.dlx.addthis.com — Cisco Umbrella Rank: 1269	191 B
1	rtactivate.com bpi.rtactivate.com — Cisco Umbrella Rank: 1486	109 B
1	media.net contextual.media.net — Cisco Umbrella Rank: 599	624 B
1	eyeota.net ps.eyeota.net — Cisco Umbrella Rank: 924	344 B
1	openx.net us-u.openx.net — Cisco Umbrella Rank: 436	273 B
1	quantcount.com rules.quantcount.com — Cisco Umbrella Rank: 918	3 KB
1	adsrvr.org match.adsrvr.org — Cisco Umbrella Rank: 306	265 B
1	youtube.com fcmatch.youtube.com — Cisco Umbrella Rank: 2921	432 B
1	ciqtracking.com ciqtracking.com — Cisco Umbrella Rank: 8711	582 B
1	rfihub.net c1.rfihub.net — Cisco Umbrella Rank: 4600	6 KB
1	cosmopolitan-lv.com 1 redirects t2.em.cosmopolitan-lv.com	867 B
127	46

	Domain	Requested by
18	segment.prod.bidr.io	8 redirects b.triptease.io
13	authority.cosmopolitanlasvegas.com	1 redirects authority.cosmopolitanlasvegas.com
10	t.myvisualiq.net	6 redirects www.googletagmanager.com
9	onboard.triptease.io	1 redirects authority.cosmopolitanlasvegas.com onboard.triptease.io
7	lpcdn-a.lpsnmedia.net	lptag.liveperson.net
6	cm.g.doubleclick.net	6 redirects
4	match.prod.bidr.io	2 redirects b.triptease.io match.prod.bidr.io
4	www.facebook.com	authority.cosmopolitanlasvegas.com
4	dpm.demdex.net	2 redirects authority.cosmopolitanlasvegas.com match.prod.bidr.io
4	idsync.rlcdn.com	authority.cosmopolitanlasvegas.com
4	p.rfihub.com	3 redirects authority.cosmopolitanlasvegas.com
4	live.rezync.com	4 redirects
4	ib.adnxs.com	2 redirects authority.cosmopolitanlasvegas.com match.prod.bidr.io
4	secure.adnxs.com	2 redirects authority.cosmopolitanlasvegas.com
4	ad.doubleclick.net	4 redirects
3	b.triptease.io	onboard.triptease.io b.triptease.io
3	static-meta.triptease.io	onboard.triptease.io static-meta.triptease.io
3	s.clarity.ms	www.clarity.ms
3	dsum-sec.casalemedia.com	1 redirects authority.cosmopolitanlasvegas.com match.prod.bidr.io
3	bat.bing.com	authority.cosmopolitanlasvegas.com bat.bing.com
3	www.googletagmanager.com	authority.cosmopolitanlasvegas.com www.googletagmanager.com
2	loadus.exelator.com	1 redirects match.prod.bidr.io
2	targeted-messages.triptease.io	onboard.triptease.io targeted-messages.triptease.io
2	tags.bluekai.com	match.prod.bidr.io
2	c.clarity.ms	1 redirects
2	va.v.liveperson.net	lptag.liveperson.net
2	accdn.lpsnmedia.net	lptag.liveperson.net
2	sync-tm.everesttech.net	2 redirects
2	x.bidswitch.net	1 redirects authority.cosmopolitanlasvegas.com
2	aa.agkn.com	authority.cosmopolitanlasvegas.com match.prod.bidr.io
2	sync.search.spotxchange.com	1 redirects authority.cosmopolitanlasvegas.com
2	image2.pubmatic.com	authority.cosmopolitanlasvegas.com match.prod.bidr.io
2	www.clarity.ms	bat.bing.com www.clarity.ms
2	pixel.sojern.com	authority.cosmopolitanlasvegas.com
2	adservice.google.com	authority.cosmopolitanlasvegas.com ciqtracking.com
2	connect.facebook.net	beacon.sojern.com connect.facebook.net
2	lptag.liveperson.net	authority.cosmopolitanlasvegas.com
2	ajax.aspnetcdn.com	authority.cosmopolitanlasvegas.com
2	www.cosmopolitanlasvegas.com	2 redirects
1	pixel.rubiconproject.com	match.prod.bidr.io
1	ads.stickyadstv.com	match.prod.bidr.io
1	api.triptease.io	targeted-messages.triptease.io
1	www.google.de
1	www.google.com
1	messages.guest-experience.triptease.io	targeted-messages.triptease.io
1	googleads.g.doubleclick.net	www.googletagmanager.com
1	tapestry.tapad.com	1 redirects
1	vt.myvisualiq.net	www.googletagmanager.com
1	c.bing.com	1 redirects
1	beacon.krxd.net	authority.cosmopolitanlasvegas.com
1	partners.tremorhub.com	authority.cosmopolitanlasvegas.com
1	x.dlx.addthis.com	authority.cosmopolitanlasvegas.com
1	bpi.rtactivate.com	authority.cosmopolitanlasvegas.com
1	contextual.media.net	authority.cosmopolitanlasvegas.com
1	ps.eyeota.net	authority.cosmopolitanlasvegas.com
1	us-u.openx.net	authority.cosmopolitanlasvegas.com
1	a.rfihub.com	1 redirects
1	pixel.quantserve.com	authority.cosmopolitanlasvegas.com
1	rules.quantcount.com	secure.quantserve.com
1	match.adsrvr.org	authority.cosmopolitanlasvegas.com
1	fcmatch.youtube.com	authority.cosmopolitanlasvegas.com
1	fcmatch.google.com	1 redirects
1	20843572p.rfihub.com	c1.rfihub.net
1	static.triptease.io	1 redirects
1	ciqtracking.com	www.googletagmanager.com
1	secure.quantserve.com	authority.cosmopolitanlasvegas.com
1	c1.rfihub.net	authority.cosmopolitanlasvegas.com
1	beacon.sojern.com	authority.cosmopolitanlasvegas.com
1	t2.em.cosmopolitan-lv.com	1 redirects
127	69

This site contains links to these domains. Also see Links.

Domain
www.cosmopolitanlasvegas.com

Subject Issuer	Validity	Valid
authority.cosmopolitanlasvegas.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2023-04-20` - `2024-05-20`	a year	crt.sh
*.vo.msecnd.net DigiCert SHA2 Secure Server CA	`2022-07-11` - `2023-07-11`	a year	crt.sh
*.google-analytics.com GTS CA 1C3	`2023-05-08` - `2023-07-31`	3 months	crt.sh
*.liveperson.net Sectigo RSA Organization Validation Secure Server CA	`2023-02-07` - `2024-02-07`	a year	crt.sh
*.sojern.com DigiCert TLS RSA SHA256 2020 CA1	`2023-01-17` - `2024-02-17`	a year	crt.sh
*.rfihub.net Amazon RSA 2048 M01	`2023-02-24` - `2023-12-29`	10 months	crt.sh
*.quantserve.com DigiCert TLS RSA SHA256 2020 CA1	`2022-08-09` - `2023-09-09`	a year	crt.sh
*.ciqtracking.com Sectigo RSA Domain Validation Secure Server CA	`2023-03-27` - `2024-04-04`	a year	crt.sh
www.bing.com Microsoft RSA TLS CA 02	`2023-02-16` - `2023-08-16`	6 months	crt.sh
*.rfihub.com Sectigo RSA Domain Validation Secure Server CA	`2023-04-27` - `2024-04-27`	a year	crt.sh
*.facebook.com DigiCert SHA2 High Assurance Server CA	`2023-03-09` - `2023-06-07`	3 months	crt.sh
*.adsrvr.org GlobalSign GCC R3 DV TLS CA 2020	`2023-04-12` - `2024-05-13`	a year	crt.sh
quantserve.com R3	`2023-04-14` - `2023-07-13`	3 months	crt.sh
onboard.triptease.io GTS CA 1P5	`2023-05-10` - `2023-08-08`	3 months	crt.sh
www.clarity.ms DigiCert TLS RSA SHA256 2020 CA1	`2022-12-01` - `2023-12-01`	a year	crt.sh
*.adnxs.com GeoTrust ECC CA 2018	`2023-02-13` - `2024-03-15`	a year	crt.sh
*.pubmatic.com DigiCert Baltimore TLS RSA SHA256 2020 CA1	`2022-06-13` - `2023-07-14`	a year	crt.sh
*.openx.net GeoTrust RSA CA 2018	`2022-07-21` - `2023-08-21`	a year	crt.sh
*.media.net DigiCert TLS RSA SHA256 2020 CA1	`2023-02-10` - `2024-02-18`	a year	crt.sh
rtactivate.com Amazon RSA 2048 M01	`2023-03-14` - `2024-04-11`	a year	crt.sh
*.rlcdn.com Sectigo RSA Domain Validation Secure Server CA	`2023-02-02` - `2024-03-03`	a year	crt.sh
odc-pixel-prod-01.oracle.com DigiCert TLS RSA SHA256 2020 CA1	`2023-02-07` - `2024-02-08`	a year	crt.sh
*.tremorhub.com Amazon RSA 2048 M01	`2023-02-22` - `2024-03-23`	a year	crt.sh
*.agkn.com RapidSSL Global TLS RSA4096 SHA256 2022 CA1	`2022-09-06` - `2023-09-21`	a year	crt.sh
beacon.krxd.net DigiCert TLS RSA SHA256 2020 CA1	`2023-04-14` - `2024-04-12`	a year	crt.sh
*.lpsnmedia.net Sectigo RSA Organization Validation Secure Server CA	`2023-01-09` - `2024-01-09`	a year	crt.sh
a.clarity.ms Microsoft Azure TLS Issuing CA 06	`2023-02-13` - `2024-02-08`	a year	crt.sh
*.v.liveperson.net Sectigo RSA Organization Validation Secure Server CA	`2023-01-10` - `2024-01-10`	a year	crt.sh
*.myvisualiq.net Amazon RSA 2048 M01	`2023-03-01` - `2023-09-16`	7 months	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2022-12-06` - `2023-12-05`	a year	crt.sh
*.triptease.io GlobalSign Atlas R3 DV TLS CA 2022 Q3	`2022-09-27` - `2023-10-29`	a year	crt.sh
*.g.doubleclick.net GTS CA 1C3	`2023-05-08` - `2023-07-31`	3 months	crt.sh
*.guest-experience.triptease.io R3	`2023-04-23` - `2023-07-22`	3 months	crt.sh
www.google.com GTS CA 1C3	`2023-05-08` - `2023-07-31`	3 months	crt.sh
www.google.de GTS CA 1C3	`2023-05-08` - `2023-07-31`	3 months	crt.sh
*.segment.prod.bidr.io Amazon RSA 2048 M01	`2023-02-10` - `2024-01-26`	a year	crt.sh
*.match.prod.bidr.io Amazon RSA 2048 M02	`2023-02-09` - `2024-01-26`	a year	crt.sh
*.demdex.com DigiCert TLS RSA SHA256 2020 CA1	`2022-09-26` - `2023-10-27`	a year	crt.sh
*.ads.stickyadstv.com DigiCert TLS RSA SHA256 2020 CA1	`2023-04-16` - `2024-04-16`	a year	crt.sh
casalemedia.com Go Daddy Secure Certificate Authority - G2	`2022-12-13` - `2024-01-13`	a year	crt.sh
*.rubiconproject.com DigiCert TLS RSA SHA256 2020 CA1	`2023-03-05` - `2024-04-03`	a year	crt.sh

This page contains 8 frames:

Primary Page: https://authority.cosmopolitanlasvegas.com/account/login?returnUrl=%2Fconnect%2Fauthorize%2Fcallback%3Fclient_id%3DIdentityOnline%26redirect_uri%3Dhttps%253A%252F%252Fwww.cosmopolitanlasvegas.com%252Flogin%252Fauthorize%26scope%3Dprofile%2520openid%2520cosmo-api%2520offline_access%2520api-all-readwrite%26response_type%3Dcode%26state%3DaAYHNwPWGNJihFRWa6yu33JDtlgL32td0sr1L6al
Frame ID: 7763AEC494205971D20643C59A80EC88
Requests: 79 HTTP requests in this frame

Frame: https://ciqtracking.com/p/v/2/63990d17f870814e3d22fa1e/format/iframe?page=https%3A%2F%2Fauthority.cosmopolitanlasvegas.com%2Faccount%2Flogin%3FreturnUrl%3D%252Fconnect%252Fauthorize%252Fcallback%253Fclient_id%253DIdentityOnline%2526redirect_uri%253Dhttps%25253A%25252F%25252Fwww.cosmopolitanlasvegas.com%25252Flogin%25252Fauthorize%2526scope%253Dprofile%252520openid%252520cosmo-api%252520offline_access%252520api-all-readwrite%2526response_type%253Dcode%2526state%253DaAYHNwPWGNJihFRWa6yu33JDtlgL32td0sr1L6al
Frame ID: 8BF402EA3AD07C44B0B2B497BBB0ABCB
Requests: 2 HTTP requests in this frame

Frame: https://20843572p.rfihub.com/ca.html?ver=9&rb=42833&ca=20843572&_o=42833&_t=20843572&pe=https%3A%2F%2Fauthority.cosmopolitanlasvegas.com%2Faccount%2Flogin%3FreturnUrl%3D%252Fconnect%252Fauthorize%252Fcallback%253Fclient_id%253DIdentityOnline%2526redirect_uri%253Dhttps%25253A%25252F%25252Fwww.cosmopolitanlasvegas.com%25252Flogin%25252Fauthorize%2526scope%253Dprofile%252520openid%252520cosmo-api%252520offline_access%252520api-all-readwrite%2526response_type%253Dcode%2526state%253DaAYHNwPWGNJihFRWa6yu33JDtlgL32td0sr1L6al&pf=&ra=20661149408590407
Frame ID: 5A27780F309768E05C5541E9420155EE
Requests: 19 HTTP requests in this frame

Frame: https://onboard.triptease.io/kernel/v6549.76442/kernel-host.html?originHost=authority.cosmopolitanlasvegas.com
Frame ID: 74E00060A023C9AC6CBDE87715A0CA8C
Requests: 2 HTTP requests in this frame

Frame: https://lpcdn-a.lpsnmedia.net/le_secure_storage/3.20.0.0-release_5080/storage.secure.min.html?loc=https%3A%2F%2Fauthority.cosmopolitanlasvegas.com&site=88246722&env=prod&accdn=accdn.lpsnmedia.net
Frame ID: 47F9ACF948D030234EE6B81A81E15AAA
Requests: 1 HTTP requests in this frame

Frame: https://b.triptease.io/?apikey=b46e2da70190d88425348ffad2967bf112aa252c&bucket=1&conversion=false&clicked=false&searched=false&tripteaseUserId=01H1PQ1PMDJNGR7S442WQ1G58R
Frame ID: BA60996F0D5094906E292BC11D320D83
Requests: 12 HTTP requests in this frame

Frame: https://targeted-messages.triptease.io/static/storageIframe.html
Frame ID: 56EA4C28792D513332B391329CA7747B
Requests: 1 HTTP requests in this frame

Frame: https://match.prod.bidr.io/cookie-msync?buzz_key=triptease
Frame ID: 83D3E783D6D1E4ADF3A46BBFD66D0A7C
Requests: 11 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Come in and play - Cosmopolitan.OAuthThe Cosmopolitan of Las Vegas

Page URL History Show full URLs

https://t.myvisualiq.net/click_pixel?et=c&ago=212&ao=849&aca=-9&si=-9&ci=-9&pi=-9&ad=-9&sv1=-9&advt=%... HTTP 302
https://t.myvisualiq.net/ul_cb/click_pixel?et=c&ago=212&ao=849&aca=-9&si=-9&ci=-9&pi=-9&ad=-9&sv1=-9&... HTTP 302
http://t2.em.cosmopolitan-lv.com/r/?id=t13db74a8,174f3aba,174f3ae9&utm_source=CRM&utm_medium=email&utm_campai... HTTP 302
https://www.cosmopolitanlasvegas.com/identity/offers/83BD6743-BE97-44A5-AA4D-E7D8CFB34286?customerId=624846&utm_s... HTTP 302
https://www.cosmopolitanlasvegas.com/login?redirect=https%3A%2F%2Fwww.cosmopolitanlasvegas.com%2Fidentity%2Foffer... HTTP 302
https://authority.cosmopolitanlasvegas.com/connect/authorize?client_id=IdentityOnline&redirect_uri=https%3A%2F%2Fwww.co... HTTP 302
https://authority.cosmopolitanlasvegas.com/account/login?returnUrl=%2Fconnect%2Fauthorize%2Fcallback%3Fclient_id%3DIden... Page URL

Detected technologies

Bootstrap (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js

AppNexus (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

adnxs\.(?:net|com)

Facebook (Widgets) Expand

Overall confidence: 100%
Detected patterns

//connect\.facebook\.([a-z]+)/[^/]*/[a-z]*\.js

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/ns\.html[^>]+></iframe>
googletagmanager\.com/gtm\.js
googletagmanager\.com/gtag/js

OpenX (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

https?://[^/]*\.openx\.net

PubMatic (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

https?://[^/]*\.pubmatic\.com

Quantcast Measure (Analytics) Expand

Overall confidence: 100%
Detected patterns

\.quantserve\.com/quant\.js

Rubicon Project (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

https?://[^/]*\.rubiconproject\.com

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

127
Requests

75 %
HTTPS

25 %
IPv6

46
Domains

69
Subdomains

53
IPs

6
Countries

1858 kB
Transfer

4678 kB
Size

75
Cookies

1 Outgoing links

These are links going to different origins than the main page.

URL: https://www.cosmopolitanlasvegas.com/
Title: .cosmopolitan-logo-1 { isolation: isolate; } .cosmopolitan-logo-3 { fill: #dbd9d6; } .cosmopolitan-logo-4, .cosmopolitan-logo-5 { mix-blend-mode: multiply; } .cosmopolitan-logo-5 { fill: #b3b2b1; } .cosmopolitan-logo-6 { fill: #8c189b; } The Cosmopolitan of

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://t.myvisualiq.net/click_pixel?et=c&ago=212&ao=849&aca=-9&si=-9&ci=-9&pi=-9&ad=-9&sv1=-9&advt=%eadv!&chnl=-36&vndr=115&sz=6134&u=-9&red=http://t2.em.cosmopolitan-lv.com/r/?id=t13db74a8,174f3aba,174f3ae9&utm_source=CRM&utm_medium=email&utm_campaign=Luck_Is_On_The_Menu&p1=www.cosmopolitanlasvegas.com/identity/offers/83BD6743-BE97-44A5-AA4D-E7D8CFB34286?customerId=624846&ref=email HTTP 302
https://t.myvisualiq.net/ul_cb/click_pixel?et=c&ago=212&ao=849&aca=-9&si=-9&ci=-9&pi=-9&ad=-9&sv1=-9&advt=%eadv!&chnl=-36&vndr=115&sz=6134&u=-9&red=http://t2.em.cosmopolitan-lv.com/r/?id=t13db74a8,174f3aba,174f3ae9&utm_source=CRM&utm_medium=email&utm_campaign=Luck_Is_On_The_Menu&p1=www.cosmopolitanlasvegas.com/identity/offers/83BD6743-BE97-44A5-AA4D-E7D8CFB34286?customerId=624846&ref=email HTTP 302
http://t2.em.cosmopolitan-lv.com/r/?id=t13db74a8,174f3aba,174f3ae9&utm_source=CRM&utm_medium=email&utm_campaign=Luck_Is_On_The_Menu&p1=www.cosmopolitanlasvegas.com/identity/offers/83BD6743-BE97-44A5-AA4D-E7D8CFB34286?customerId=624846&ref=email&nclid=rmHC9XCKdsOsZKKQ9fm88yuyF4E1AVzVAhsqa8G0xY6gY8TGJIbznh5hEyGvjYSY HTTP 302
https://www.cosmopolitanlasvegas.com/identity/offers/83BD6743-BE97-44A5-AA4D-E7D8CFB34286?customerId=624846&utm_source=CRM&utm_medium=email&utm_campaign=Luck_Is_On_The_Menu&ref=email&nclid=rmHC9XCKdsOsZKKQ9fm88yuyF4E1AVzVAhsqa8G0xY6gY8TGJIbznh5hEyGvjYSY HTTP 302
https://www.cosmopolitanlasvegas.com/login?redirect=https%3A%2F%2Fwww.cosmopolitanlasvegas.com%2Fidentity%2Foffers%2F83BD6743-BE97-44A5-AA4D-E7D8CFB34286%3FcustomerId%3D624846%26nclid%3DrmHC9XCKdsOsZKKQ9fm88yuyF4E1AVzVAhsqa8G0xY6gY8TGJIbznh5hEyGvjYSY%26ref%3Demail%26utm_campaign%3DLuck_Is_On_The_Menu%26utm_medium%3Demail%26utm_source%3DCRM HTTP 302
https://authority.cosmopolitanlasvegas.com/connect/authorize?client_id=IdentityOnline&redirect_uri=https%3A%2F%2Fwww.cosmopolitanlasvegas.com%2Flogin%2Fauthorize&scope=profile+openid+cosmo-api+offline_access+api-all-readwrite&response_type=code&state=aAYHNwPWGNJihFRWa6yu33JDtlgL32td0sr1L6al HTTP 302
https://authority.cosmopolitanlasvegas.com/account/login?returnUrl=%2Fconnect%2Fauthorize%2Fcallback%3Fclient_id%3DIdentityOnline%26redirect_uri%3Dhttps%253A%252F%252Fwww.cosmopolitanlasvegas.com%252Flogin%252Fauthorize%26scope%3Dprofile%2520openid%2520cosmo-api%2520offline_access%2520api-all-readwrite%26response_type%3Dcode%26state%3DaAYHNwPWGNJihFRWa6yu33JDtlgL32td0sr1L6al Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 20

https://onboard.triptease.io/bootstrap.js?integrationId=01E4X5KNES5SZ07J305WWVJE8C HTTP 307
https://onboard.triptease.io/bootstrap/v6549.76442/bootstrap.js

Request Chain 22

https://static.triptease.io/paperboy/KoP8XXWYLW.js?hotelKey=b46e2da70190d88425348ffad2967bf112aa252c HTTP 307
https://onboard.triptease.io/bootstrap/v6549.76442/bootstrap.js

Request Chain 25

https://ad.doubleclick.net/ddm/activity/src=8133443;type=track0;cat=theco00;qty=1;cost=0;u1=;u16=;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=orderID HTTP 302
https://ad.doubleclick.net/ddm/activity/src=8133443;dc_pre=CLKSwIW4nf8CFU-ZsgodFhkEWQ;type=track0;cat=theco00;qty=1;cost=0;u1=;u16=;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=orderID HTTP 302
https://adservice.google.com/ddm/fls/z/src=8133443;dc_pre=CLKSwIW4nf8CFU-ZsgodFhkEWQ;type=track0;cat=theco00;qty=1;cost=0;u1=;u16=;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=orderID

Request Chain 26

https://secure.adnxs.com/px?id=1474714&t=1 HTTP 307
https://secure.adnxs.com/bounce?%2Fpx%3Fid%3D1474714%26t%3D1

Request Chain 27

https://secure.adnxs.com/seg?add=26344827&t=1 HTTP 307
https://secure.adnxs.com/bounce?%2Fseg%3Fadd%3D26344827%26t%3D1

Request Chain 28

https://cm.g.doubleclick.net/pixel?google_cm=true&google_hm=-Dv49UFei9LGcXIdre1mVA&google_nid=sojern__adx_open_bidder_seat&google_sc=true&sjrn_id=NHnrSLokcDsdiyB4_zAVhOaqhHkPlneeeN_Jzwz8OE7uPKzqX4aaNubdHUA8kei4&sjrn_ula=476905866 HTTP 302
https://cm.g.doubleclick.net/pixel?google_cm=true&google_hm=-Dv49UFei9LGcXIdre1mVA&google_nid=sojern__adx_open_bidder_seat&google_sc=true&sjrn_id=NHnrSLokcDsdiyB4_zAVhOaqhHkPlneeeN_Jzwz8OE7uPKzqX4aaNubdHUA8kei4&sjrn_ula=476905866&google_tc= HTTP 302
https://pixel.sojern.com/idSync/AdX?exchangeProfileId=&sjrn_id=NHnrSLokcDsdiyB4_zAVhOaqhHkPlneeeN_Jzwz8OE7uPKzqX4aaNubdHUA8kei4&sjrn_ula=476905866&google_gid=CAESEKviiyGxtVIeiuvpG7M7zG0&google_cver=1

Request Chain 29

https://cm.g.doubleclick.net/pixel?google_hm=-Dv49UFei9LGcXIdre1mVA&google_nid=sojern_adh HTTP 302
https://cm.g.doubleclick.net/pixel?google_hm=-Dv49UFei9LGcXIdre1mVA&google_nid=sojern_adh&google_tc= HTTP 302
https://fcmatch.google.com/pixel?google_gm=AMnCDooNtRgzBBh1rolaKu1g4dft_N36wQni4N6ckY7Nv3jUtsKu-nNvC7yDZsNgOB2a8ar05Mq6s-RY-rZ5MwW9ceBuktK9KdubYUVdwVhSW9U67mHk7N8 HTTP 302
https://fcmatch.youtube.com/pixel?google_gm=AMnCDooNtRgzBBh1rolaKu1g4dft_N36wQni4N6ckY7Nv3jUtsKu-nNvC7yDZsNgOB2a8ar05Mq6s-RY-rZ5MwW9ceBuktK9KdubYUVdwVhSW9U67mHk7N8

Request Chain 30

https://ib.adnxs.com/getuid?https://pixel.sojern.com/idsync/apn?id=$UID&sjrn_id=NHnrSLokcDsdiyB4_zAVhOaqhHkPlneeeN_Jzwz8OE7uPKzqX4aaNubdHUA8kei4 HTTP 307
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fpixel.sojern.com%2Fidsync%2Fapn%3Fid%3D%24UID%26sjrn_id%3DNHnrSLokcDsdiyB4_zAVhOaqhHkPlneeeN_Jzwz8OE7uPKzqX4aaNubdHUA8kei4 HTTP 302
https://pixel.sojern.com/idsync/apn?id=4137122346784741821&sjrn_id=NHnrSLokcDsdiyB4_zAVhOaqhHkPlneeeN_Jzwz8OE7uPKzqX4aaNubdHUA8kei4

Request Chain 40

https://live.rezync.com/pixel?c=bd8618c307ae9885a12561b7191e2cea&cid=5108559728001295002&referrer=https%3A%2F%2Fauthority.cosmopolitanlasvegas.com%2Faccount%2Flogin%3FreturnUrl%3D%252Fconnect%252Fauthorize%252Fcallback%253Fclient_id%253DIdentityOnline%2526redirect_uri%253Dhttps%25253A%25252F%25252Fwww.cosmopolitanlasvegas.com%25252Flogin%25252Fauthorize%2526scope%253Dprofile%252520openid%252520cosmo-api%252520offline_access%252520api-all-readwrite%2526response_type%253Dcode%2526state%253DaAYHNwPWGNJihFRWa6yu33JDtlgL32td0sr1L6al&forward= HTTP 302
https://p.rfihub.com/cm?pub=39342&in=0&userid=ed0f80d2-b7df-4556-848d-a9f90e6502c6%3A1685463290.316538&forward=https%3A//idsync.rlcdn.com/501709.gif%3Fpartner_uid%3Ded0f80d2-b7df-4556-848d-a9f90e6502c6%253A1685463290.316538%26_%3D1685463290.3182983&cb=1685463290.3183272 HTTP 302
https://live.rezync.com/pixel?c=bd8618c307ae9885a12561b7191e2cea&cid=5108559728001295002&referrer={encSite}&forward=https%3A%2F%2Fidsync.rlcdn.com%2F501709.gif%3Fpartner_uid%3Ded0f80d2-b7df-4556-848d-a9f90e6502c6%253A1685463290.316538%26_%3D1685463290.3182983 HTTP 302
https://idsync.rlcdn.com/501709.gif?partner_uid=ed0f80d2-b7df-4556-848d-a9f90e6502c6%3A1685463290.316538&_=1685463290.3182983

Request Chain 41

https://cm.g.doubleclick.net/pixel?&in=0&google_nid=zeta_interactive&google_cm=&google_sc=&google_hm=NTEwODU1OTcyODAwMTI5NTAwMg==&forward= HTTP 302
https://a.rfihub.com/cm?pub=445&in=0&forward=&google_gid=CAESEM3XvzdVttYMSAHxMHIOm8A&google_cver=1 HTTP 302
https://live.rezync.com/pixel?c=bd8618c307ae9885a12561b7191e2cea&cid=5108559728001295002&referrer={encSite}&forward= HTTP 302
https://p.rfihub.com/cm?pub=39342&in=0&userid=94d5c9a4-4a71-432c-85ca-0d859ecb1554%3A1685463290.3829129&forward=https%3A//idsync.rlcdn.com/501709.gif%3Fpartner_uid%3D94d5c9a4-4a71-432c-85ca-0d859ecb1554%253A1685463290.3829129%26_%3D1685463290.3843358&cb=1685463290.3843644 HTTP 302
https://live.rezync.com/pixel?c=bd8618c307ae9885a12561b7191e2cea&cid=5108559728001295002&referrer={encSite}&forward=https%3A%2F%2Fidsync.rlcdn.com%2F501709.gif%3Fpartner_uid%3D94d5c9a4-4a71-432c-85ca-0d859ecb1554%253A1685463290.3829129%26_%3D1685463290.3843358 HTTP 302
https://idsync.rlcdn.com/501709.gif?partner_uid=94d5c9a4-4a71-432c-85ca-0d859ecb1554%3A1685463290.3829129&_=1685463290.3843358

Request Chain 43

https://dpm.demdex.net/ibs:dpid=1121&dpuuid=5108559728001295002&redir= HTTP 302
https://dpm.demdex.net/demconf.jpg?et:ibs%7cdata:dpid=1121&dpuuid=5108559728001295002&redir=

Request Chain 46

https://p.rfihub.com/cm?pub=24472&in=1 HTTP 302
https://ps.eyeota.net/match?uid=5108559728001295002&bid=omt9pi0

Request Chain 49

https://dsum-sec.casalemedia.com/rum?cm_dsp_id=57&external_user_id=5108559728001295002&forward= HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=57&external_user_id=5108559728001295002&forward=&C=1

Request Chain 52

https://sync.search.spotxchange.com/partner?adv_id=7180&uid=5108559728001295002&img=1 HTTP 302
https://sync.search.spotxchange.com/partner?adv_id=7180&uid=5108559728001295002&img=1&__user_check__=1&sync_id=1a9c6bfc-ff05-11ed-a2b3-1a377c5d0506

Request Chain 56

https://x.bidswitch.net/sync?dsp_id=119&user_id=5108559728001295002&expires=30&gdpr={GDPR}&gdpr_consent={GDPR_CONSENT_469}&gdpr_pd={GDPR_PD} HTTP 302
https://x.bidswitch.net/ul_cb/sync?dsp_id=119&user_id=5108559728001295002&expires=30&gdpr={GDPR}&gdpr_consent={GDPR_CONSENT_469}&gdpr_pd={GDPR_PD}

Request Chain 57

https://sync-tm.everesttech.net/upi/pid/Mlpt2JaG/?redir=https%3A%2F%2Fp.rfihub.com%2Fcm%3Fin%3D1%26pub%3D21653%26userid%3D%24%7BTM_USER_ID%7D HTTP 302
https://sync-tm.everesttech.net/ct/upi/pid/Mlpt2JaG/?redir=https%3A%2F%2Fp.rfihub.com%2Fcm%3Fin%3D1%26pub%3D21653%26userid%3D%24%7BTM_USER_ID%7D&_test=ZHYg_gAODuEHpQBa HTTP 302
https://p.rfihub.com/cm?in=1&pub=21653&userid=ZHYg_gAODuEHpQBa&_test=ZHYg_gAODuEHpQBa

Request Chain 74

https://ad.doubleclick.net/ddm/activity/src=6499811;type=invmedia;cat=mgm_c00;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;gdpr=$%7BGDPR%7D;gdpr_consent=$%7BGDPR_CONSENT_755%7D;ord=1 HTTP 302
https://ad.doubleclick.net/ddm/activity/src=6499811;dc_pre=CKvD84W4nf8CFdfFsgodtYsPQA;type=invmedia;cat=mgm_c00;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;gdpr=$%7BGDPR%7D;gdpr_consent=$%7BGDPR_CONSENT_755%7D;ord=1 HTTP 302
https://adservice.google.com/ddm/fls/z/src=6499811;dc_pre=CKvD84W4nf8CFdfFsgodtYsPQA;type=invmedia;cat=mgm_c00;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;gdpr=$%7BGDPR%7D;gdpr_consent=$%7BGDPR_CONSENT_755%7D;ord=1

Request Chain 76

https://c.clarity.ms/c.gif HTTP 302
https://c.bing.com/c.gif?ctsa=mr&CtsSyncId=3505E55E6F4C46A5A775AADD5DA39E1B&RedC=c.clarity.ms&MXFR=2308A69A6F7B6C440675B5BB6B7B62A9 HTTP 302
https://c.clarity.ms/c.gif?ctsa=mr&CtsSyncId=3505E55E6F4C46A5A775AADD5DA39E1B&MUID=3A9A8AC7A1DA69A404CB99E6A07668BA

Request Chain 79

https://tapestry.tapad.com/tapestry/1?ta_partner_id=950&ta_redirect=https%3A%2F%2Ft.myvisualiq.net%2Fsync%3Fprid%3D1001%26ao%3D0%26pruuid%3DTAPAD_%24%7BIDS%3Akey%7D HTTP 302
https://t.myvisualiq.net/sync?prid=1001&ao=0&pruuid=TAPAD_4c76a668-a98f-4877-aab5-6cb9e59f8e89

Request Chain 80

https://t.myvisualiq.net/sync?prid=1002&ao=0&red=https://idsync.rlcdn.com/420356.gif?partner_uid=${UUID} HTTP 302
https://idsync.rlcdn.com/420356.gif?partner_uid=9042862c-9508-45ba-abe2-343ff3b7e3c8

Request Chain 81

https://t.myvisualiq.net/sync?prid=BUKIPNR1&red=https://tags.bluekai.com/site/21398?id=$%7BUUID%7D HTTP 302
https://tags.bluekai.com/site/21398?id=9042862c-9508-45ba-abe2-343ff3b7e3c8

Request Chain 82

https://t.myvisualiq.net/sync?prid=AOEPNR1&ao=0&red=https%3A%2F%2Fdpm.demdex.net%2Fibs%3Adpid%3D125310%26dpuuid%3D%24%7BUUID%7D%26redir%3Dhttps%253A%252F%252Ft.myvisualiq.net%252Fsync%253Fprid%253DAOEPNR1%2526ao%253D0%2526pruuid%253D%2524%257BDD_UUID%257D%250A HTTP 302
https://dpm.demdex.net/ibs:dpid=125310&dpuuid=9042862c-9508-45ba-abe2-343ff3b7e3c8&redir=https%3A%2F%2Ft.myvisualiq.net%2Fsync%3Fprid%3DAOEPNR1%26ao%3D0%26pruuid%3D%24%7BDD_UUID%7D HTTP 302
https://t.myvisualiq.net/sync?prid=AOEPNR1&ao=0&pruuid=28120536432800738234126528738796146679

Request Chain 83

https://t.myvisualiq.net/sync?prid=123&ao=0&red=https%3A%2F%2Fwww.facebook.com%2Ftr%3Fid%3D1626311104111572%26ev%3DPageView%26cd%5Border_id%5D%3D%24%7BUUID%7D%26dpo%3DLDU%26dpoco%3D0%26dpost%3D0 HTTP 302
https://www.facebook.com/tr?id=1626311104111572&ev=PageView&cd[order_id]=9042862c-9508-45ba-abe2-343ff3b7e3c8&dpo=LDU&dpoco=0&dpost=0

Request Chain 102

https://segment.prod.bidr.io/associate-segment?buzz_key=triptease&segment_key=triptease-138&value= HTTP 303
https://segment.prod.bidr.io/associate-segment?buzz_key=triptease&segment_key=triptease-138&value=&_bee_ppp=1

Request Chain 103

https://segment.prod.bidr.io/associate-segment?buzz_key=triptease&segment_key=triptease-139&value= HTTP 303
https://segment.prod.bidr.io/associate-segment?buzz_key=triptease&segment_key=triptease-139&value=&_bee_ppp=1

Request Chain 104

https://segment.prod.bidr.io/associate-segment?buzz_key=triptease&segment_key=triptease-140&value= HTTP 303
https://segment.prod.bidr.io/associate-segment?buzz_key=triptease&segment_key=triptease-140&value=&_bee_ppp=1

Request Chain 105

https://segment.prod.bidr.io/associate-segment?buzz_key=triptease&segment_key=triptease-137&value= HTTP 303
https://segment.prod.bidr.io/associate-segment?buzz_key=triptease&segment_key=triptease-137&value=&_bee_ppp=1

Request Chain 106

https://segment.prod.bidr.io/associate-segment?buzz_key=triptease&segment_key=triptease-18692&value=1 HTTP 303
https://segment.prod.bidr.io/associate-segment?buzz_key=triptease&segment_key=triptease-18692&value=1&_bee_ppp=1

Request Chain 107

https://segment.prod.bidr.io/associate-segment?buzz_key=triptease&segment_key=triptease-18693&value= HTTP 303
https://segment.prod.bidr.io/associate-segment?buzz_key=triptease&segment_key=triptease-18693&value=&_bee_ppp=1

Request Chain 112

https://match.prod.bidr.io/cookie-sync/triptease?buyer_user_id=01H1PQ1PMDJNGR7S442WQ1G58R|b46e2da70190d88425348ffad2967bf112aa252c HTTP 303
https://match.prod.bidr.io/cookie-sync/triptease?buyer_user_id=01H1PQ1PMDJNGR7S442WQ1G58R%7Cb46e2da70190d88425348ffad2967bf112aa252c&_bee_ppp=1 HTTP 303
https://b.triptease.io/cookie-sync?partner=beeswax&beeswax_id=AADvPU7I7EIAACCvuwAmwg&buyer_user_id=01H1PQ1PMDJNGR7S442WQ1G58R%7Cb46e2da70190d88425348ffad2967bf112aa252c

Request Chain 113

https://segment.prod.bidr.io/associate-segment?buzz_key=triptease&segment_key=triptease-1&value=0.5&forward_to_cookie_sync=1 HTTP 303
https://segment.prod.bidr.io/associate-segment?buzz_key=triptease&segment_key=triptease-1&value=0.5&forward_to_cookie_sync=1&_bee_ppp=1 HTTP 303
https://match.prod.bidr.io/cookie-msync?buzz_key=triptease

Request Chain 117

https://cm.g.doubleclick.net/pixel?google_nid=beeswaxio&google_sc=&google_hm=QUFDOEdVN0k3RUlBQUNBek42NHJoQQ&bee_sync_partners=&bee_sync_current_partner=adx&bee_sync_hop_count=1 HTTP 302
https://match.prod.bidr.io/cookie-sync/adx?bee_sync_partners=&bee_sync_current_partner=adx&bee_sync_hop_count=1

Request Chain 121

https://loadus.exelator.com/load/?BUID=AAC8GU7I7EIAACAzN64rhA&p=204&g=117&j=0 HTTP 302
https://loadus.exelator.com/load/?BUID=AAC8GU7I7EIAACAzN64rhA&p=204&g=117&j=0&xl8blockcheck=1

127 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1

200
OK

Primary Request login Show response
authority.cosmopolitanlasvegas.com/account/
Redirect Chain

https://t.myvisualiq.net/click_pixel?et=c&ago=212&ao=849&aca=-9&si=-9&ci=-9&pi=-9&ad=-9&sv1=-9&advt=%eadv!&chnl=-36&vndr=115&sz=6134&u=-9&red=http://t2.em.cosmopolitan-lv.com/r/?id=t13db74a8,174f3a...
https://t.myvisualiq.net/ul_cb/click_pixel?et=c&ago=212&ao=849&aca=-9&si=-9&ci=-9&pi=-9&ad=-9&sv1=-9&advt=%eadv!&chnl=-36&vndr=115&sz=6134&u=-9&red=http://t2.em.cosmopolitan-lv.com/r/?id=t13db74a8,...
http://t2.em.cosmopolitan-lv.com/r/?id=t13db74a8,174f3aba,174f3ae9&utm_source=CRM&utm_medium=email&utm_campaign=Luck_Is_On_The_Menu&p1=www.cosmopolitanlasvegas.com/identity/offers/83BD6743-BE97-44A...
https://www.cosmopolitanlasvegas.com/identity/offers/83BD6743-BE97-44A5-AA4D-E7D8CFB34286?customerId=624846&utm_source=CRM&utm_medium=email&utm_campaign=Luck_Is_On_The_Menu&ref=email&nclid=rmHC9XCK...
https://www.cosmopolitanlasvegas.com/login?redirect=https%3A%2F%2Fwww.cosmopolitanlasvegas.com%2Fidentity%2Foffers%2F83BD6743-BE97-44A5-AA4D-E7D8CFB34286%3FcustomerId%3D624846%26nclid%3DrmHC9XCKdsO...
https://authority.cosmopolitanlasvegas.com/connect/authorize?client_id=IdentityOnline&redirect_uri=https%3A%2F%2Fwww.cosmopolitanlasvegas.com%2Flogin%2Fauthorize&scope=profile+openid+cosmo-api+offl...
https://authority.cosmopolitanlasvegas.com/account/login?returnUrl=%2Fconnect%2Fauthorize%2Fcallback%3Fclient_id%3DIdentityOnline%26redirect_uri%3Dhttps%253A%252F%252Fwww.cosmopolitanlasvegas.com%2...

20 KB
9 KB

160ms
160ms

Document
text/html

40.80.155.102
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://authority.cosmopolitanlasvegas.com/account/login?returnUrl=%2Fconnect%2Fauthorize%2Fcallback%3Fclient_id%3DIdentityOnline%26redirect_uri%3Dhttps%253A%252F%252Fwww.cosmopolitanlasvegas.com%252Flogin%252Fauthorize%26scope%3Dprofile%2520openid%2520cosmo-api%2520offline_access%2520api-all-readwrite%26response_type%3Dcode%26state%3DaAYHNwPWGNJihFRWa6yu33JDtlgL32td0sr1L6al

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

40.80.155.102 San Jose, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Kestrel / ASP.NET

Resource Hash

4b8636dfe9ce8004bfba66630b44e7e33626605f3b616d1711d62115b34fa1f1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Cache-Control: no-cache, no-store
Content-Encoding: gzip
Content-Type: text/html; charset=utf-8
Date: Tue, 30 May 2023 16:14:48 GMT
Expires: -1
Pragma: no-cache
Server: Kestrel
Strict-Transport-Security: max-age=31536000
Transfer-Encoding: chunked
Vary: Accept-Encoding
X-Content-Type-Options: nosniff
X-Frame-Options: DENY
X-Powered-By: ASP.NET
X-XSS-Protection: 1; mode=block

Redirect headers

Content-Length: 0
Date: Tue, 30 May 2023 16:14:48 GMT
Location: https://authority.cosmopolitanlasvegas.com/account/login?returnUrl=%2Fconnect%2Fauthorize%2Fcallback%3Fclient_id%3DIdentityOnline%26redirect_uri%3Dhttps%253A%252F%252Fwww.cosmopolitanlasvegas.com%252Flogin%252Fauthorize%26scope%3Dprofile%2520openid%2520cosmo-api%2520offline_access%2520api-all-readwrite%26response_type%3Dcode%26state%3DaAYHNwPWGNJihFRWa6yu33JDtlgL32td0sr1L6al
Server: Kestrel
Strict-Transport-Security: max-age=31536000
X-Content-Type-Options: nosniff
X-Frame-Options: DENY
X-Powered-By: ASP.NET
X-XSS-Protection: 1; mode=block

GET
H/1.1 200
OK style.css
authority.cosmopolitanlasvegas.com/sf/css/ 320 KB
72 KB 169ms
168ms Stylesheet
text/css 40.80.155.102
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://authority.cosmopolitanlasvegas.com/sf/css/style.css

Requested by

Host: authority.cosmopolitanlasvegas.com
URL: https://authority.cosmopolitanlasvegas.com/account/login?returnUrl=%2Fconnect%2Fauthorize%2Fcallback%3Fclient_id%3DIdentityOnline%26redirect_uri%3Dhttps%253A%252F%252Fwww.cosmopolitanlasvegas.com%252Flogin%252Fauthorize%26scope%3Dprofile%2520openid%2520cosmo-api%2520offline_access%2520api-all-readwrite%26response_type%3Dcode%26state%3DaAYHNwPWGNJihFRWa6yu33JDtlgL32td0sr1L6al

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

40.80.155.102 San Jose, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Kestrel / ASP.NET

Resource Hash

3491ef1ca659bccbaec555c73b1c829b05f72373b0a5588d9387b089b8e8983f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://authority.cosmopolitanlasvegas.com/account/login?returnUrl=%2Fconnect%2Fauthorize%2Fcallback%3Fclient_id%3DIdentityOnline%26redirect_uri%3Dhttps%253A%252F%252Fwww.cosmopolitanlasvegas.com%252Flogin%252Fauthorize%26scope%3Dprofile%2520openid%2520cosmo-api%2520offline_access%2520api-all-readwrite%26response_type%3Dcode%26state%3DaAYHNwPWGNJihFRWa6yu33JDtlgL32td0sr1L6al
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

Date: Tue, 30 May 2023 16:14:48 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Strict-Transport-Security: max-age=31536000
Last-Modified: Wed, 18 Aug 2021 18:34:54 GMT
Server: Kestrel
ETag: "1d7945fbcb99b79"
X-Powered-By: ASP.NET
Transfer-Encoding: chunked
Vary: Accept-Encoding
Content-Type: text/css
X-Frame-Options: DENY
Accept-Ranges: bytes
X-XSS-Protection: 1; mode=block

GET
H/1.1 200
OK sf-override.css
authority.cosmopolitanlasvegas.com/sf/css/ 1 KB
1 KB 171ms
169ms Stylesheet
text/css 40.80.155.102
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://authority.cosmopolitanlasvegas.com/sf/css/sf-override.css

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

40.80.155.102 San Jose, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Kestrel / ASP.NET

Resource Hash

e307f4d4d2208c8b5e06543d942e1348ea1e1e520518647680e24067365de030

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://authority.cosmopolitanlasvegas.com/account/login?returnUrl=%2Fconnect%2Fauthorize%2Fcallback%3Fclient_id%3DIdentityOnline%26redirect_uri%3Dhttps%253A%252F%252Fwww.cosmopolitanlasvegas.com%252Flogin%252Fauthorize%26scope%3Dprofile%2520openid%2520cosmo-api%2520offline_access%2520api-all-readwrite%26response_type%3Dcode%26state%3DaAYHNwPWGNJihFRWa6yu33JDtlgL32td0sr1L6al
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

Date: Tue, 30 May 2023 16:14:48 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Strict-Transport-Security: max-age=31536000
Last-Modified: Wed, 18 Aug 2021 18:34:54 GMT
Server: Kestrel
ETag: "1d7945fbcbc9e87"
X-Powered-By: ASP.NET
Transfer-Encoding: chunked
Vary: Accept-Encoding
Content-Type: text/css
X-Frame-Options: DENY
Accept-Ranges: bytes
X-XSS-Protection: 1; mode=block

GET
H/1.1 200
OK custom-autocomplete.css
authority.cosmopolitanlasvegas.com/css/ 1 KB
1001 B 339ms
167ms Stylesheet
text/css 40.80.155.102
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://authority.cosmopolitanlasvegas.com/css/custom-autocomplete.css

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

40.80.155.102 San Jose, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Kestrel / ASP.NET

Resource Hash

5074816757bcced52a7851e776f5b784ad2a8b085de80d0d391e7da45bf657f1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://authority.cosmopolitanlasvegas.com/account/login?returnUrl=%2Fconnect%2Fauthorize%2Fcallback%3Fclient_id%3DIdentityOnline%26redirect_uri%3Dhttps%253A%252F%252Fwww.cosmopolitanlasvegas.com%252Flogin%252Fauthorize%26scope%3Dprofile%2520openid%2520cosmo-api%2520offline_access%2520api-all-readwrite%26response_type%3Dcode%26state%3DaAYHNwPWGNJihFRWa6yu33JDtlgL32td0sr1L6al
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

Date: Tue, 30 May 2023 16:14:48 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Strict-Transport-Security: max-age=31536000
Last-Modified: Wed, 18 Aug 2021 18:34:54 GMT
Server: Kestrel
ETag: "1d7945fbcbc9f9e"
X-Powered-By: ASP.NET
Transfer-Encoding: chunked
Vary: Accept-Encoding
Content-Type: text/css
X-Frame-Options: DENY
Accept-Ranges: bytes
X-XSS-Protection: 1; mode=block

GET
H/1.1 200
OK jquery.js Show response
authority.cosmopolitanlasvegas.com/lib/jquery/dist/ 262 KB
102 KB 502ms
182ms Script
application/javascript 40.80.155.102
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://authority.cosmopolitanlasvegas.com/lib/jquery/dist/jquery.js

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

40.80.155.102 San Jose, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Kestrel / ASP.NET

Resource Hash

03903375e5192415755f63297022c723f882093152a41027d91bd9b612aae403

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://authority.cosmopolitanlasvegas.com/account/login?returnUrl=%2Fconnect%2Fauthorize%2Fcallback%3Fclient_id%3DIdentityOnline%26redirect_uri%3Dhttps%253A%252F%252Fwww.cosmopolitanlasvegas.com%252Flogin%252Fauthorize%26scope%3Dprofile%2520openid%2520cosmo-api%2520offline_access%2520api-all-readwrite%26response_type%3Dcode%26state%3DaAYHNwPWGNJihFRWa6yu33JDtlgL32td0sr1L6al
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

Date: Tue, 30 May 2023 16:14:48 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Strict-Transport-Security: max-age=31536000
Last-Modified: Wed, 18 Aug 2021 18:34:54 GMT
Server: Kestrel
ETag: "1d7945fbcb88cbb"
X-Powered-By: ASP.NET
Transfer-Encoding: chunked
Vary: Accept-Encoding
Content-Type: application/javascript
X-Frame-Options: DENY
Accept-Ranges: bytes
X-XSS-Protection: 1; mode=block

GET
H/1.1 200
OK bootstrap.js Show response
authority.cosmopolitanlasvegas.com/lib/bootstrap/dist/js/ 70 KB
21 KB 499ms
179ms Script
application/javascript 40.80.155.102
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://authority.cosmopolitanlasvegas.com/lib/bootstrap/dist/js/bootstrap.js

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

40.80.155.102 San Jose, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Kestrel / ASP.NET

Resource Hash

d5fa375baaa8c2ae0f8a7a42b0ab21695a9ec04c68166ceb44118a6d27405449

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://authority.cosmopolitanlasvegas.com/account/login?returnUrl=%2Fconnect%2Fauthorize%2Fcallback%3Fclient_id%3DIdentityOnline%26redirect_uri%3Dhttps%253A%252F%252Fwww.cosmopolitanlasvegas.com%252Flogin%252Fauthorize%26scope%3Dprofile%2520openid%2520cosmo-api%2520offline_access%2520api-all-readwrite%26response_type%3Dcode%26state%3DaAYHNwPWGNJihFRWa6yu33JDtlgL32td0sr1L6al
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

Date: Tue, 30 May 2023 16:14:48 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Strict-Transport-Security: max-age=31536000
Last-Modified: Wed, 18 Aug 2021 18:34:54 GMT
Server: Kestrel
ETag: "1d7945fbcbd8294"
X-Powered-By: ASP.NET
Transfer-Encoding: chunked
Vary: Accept-Encoding
Content-Type: application/javascript
X-Frame-Options: DENY
Accept-Ranges: bytes
X-XSS-Protection: 1; mode=block

GET
H/1.1 200
OK site.js Show response
authority.cosmopolitanlasvegas.com/js/ 5 B
579 B 494ms
172ms Script
application/javascript 40.80.155.102
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://authority.cosmopolitanlasvegas.com/js/site.js?v=8Bo3TpyB49uJs6QpQMTWpUR2hJhqEpbkK_E_GW7tYpU

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

40.80.155.102 San Jose, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Kestrel / ASP.NET

Resource Hash

7eb70257593da06f682a3ddda54a9d260d4fc514f645237f5ca74b08f8da61a6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://authority.cosmopolitanlasvegas.com/account/login?returnUrl=%2Fconnect%2Fauthorize%2Fcallback%3Fclient_id%3DIdentityOnline%26redirect_uri%3Dhttps%253A%252F%252Fwww.cosmopolitanlasvegas.com%252Flogin%252Fauthorize%26scope%3Dprofile%2520openid%2520cosmo-api%2520offline_access%2520api-all-readwrite%26response_type%3Dcode%26state%3DaAYHNwPWGNJihFRWa6yu33JDtlgL32td0sr1L6al
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

Date: Tue, 30 May 2023 16:14:48 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Strict-Transport-Security: max-age=31536000
Last-Modified: Wed, 18 Aug 2021 18:34:54 GMT
Server: Kestrel
ETag: "1d7945fbcbc9b05"
X-Powered-By: ASP.NET
Transfer-Encoding: chunked
Vary: Accept-Encoding
Content-Type: application/javascript
X-Frame-Options: DENY
Accept-Ranges: bytes
X-XSS-Protection: 1; mode=block

GET
H/1.1 200
OK sf-override.js Show response
authority.cosmopolitanlasvegas.com/sf/js/ 502 B
831 B 503ms
175ms Script
application/javascript 40.80.155.102
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://authority.cosmopolitanlasvegas.com/sf/js/sf-override.js

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

40.80.155.102 San Jose, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Kestrel / ASP.NET

Resource Hash

f6a1edd7e817eaba3aa6efc1dbebaf2f9c80b03cc6ded9945a1a70dd27ad8610

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://authority.cosmopolitanlasvegas.com/account/login?returnUrl=%2Fconnect%2Fauthorize%2Fcallback%3Fclient_id%3DIdentityOnline%26redirect_uri%3Dhttps%253A%252F%252Fwww.cosmopolitanlasvegas.com%252Flogin%252Fauthorize%26scope%3Dprofile%2520openid%2520cosmo-api%2520offline_access%2520api-all-readwrite%26response_type%3Dcode%26state%3DaAYHNwPWGNJihFRWa6yu33JDtlgL32td0sr1L6al
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

Date: Tue, 30 May 2023 16:14:48 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Strict-Transport-Security: max-age=31536000
Last-Modified: Wed, 18 Aug 2021 18:34:54 GMT
Server: Kestrel
ETag: "1d7945fbcbc9af6"
X-Powered-By: ASP.NET
Transfer-Encoding: chunked
Vary: Accept-Encoding
Content-Type: application/javascript
X-Frame-Options: DENY
Accept-Ranges: bytes
X-XSS-Protection: 1; mode=block

GET
H2 200 jquery.validate.min.js Show response
ajax.aspnetcdn.com/ajax/jquery.validate/1.14.0/ 21 KB
7 KB 36ms
7ms Script
application/javascript 152.199.19.160
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL

https://ajax.aspnetcdn.com/ajax/jquery.validate/1.14.0/jquery.validate.min.js

Requested by

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

152.199.19.160 , United States, ASN15133 (EDGECAST, US),

Reverse DNS

Software

ECAcc (frc/4CCC) /

Resource Hash

2e3e3b2660cbfaac5febf7a50b31d0494159989626a84102b2c3792cffe27d13

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://authority.cosmopolitanlasvegas.com/
Origin: https://authority.cosmopolitanlasvegas.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date: Tue, 30 May 2023 16:14:49 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 22266087
x-cache: HIT
content-length: 6807
x-xss-protection: 1; mode=block
last-modified: Mon, 31 Oct 2016 23:42:30 GMT
server: ECAcc (frc/4CCC)
etag: "0b7a471d033d21:0"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: public,max-age=31536000
accept-ranges: bytes
timing-allow-origin: *

GET
H2 200 jquery.validate.unobtrusive.min.js Show response
ajax.aspnetcdn.com/ajax/jquery.validation.unobtrusive/3.2.6/ 5 KB
3 KB 37ms
8ms Script
application/javascript 152.199.19.160
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL

https://ajax.aspnetcdn.com/ajax/jquery.validation.unobtrusive/3.2.6/jquery.validate.unobtrusive.min.js

Requested by

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

152.199.19.160 , United States, ASN15133 (EDGECAST, US),

Reverse DNS

Software

ECAcc (frc/4CF9) /

Resource Hash

13243171b1f5976e74f79647f612a1d879bfa606816a204f72a833c0e89f269a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://authority.cosmopolitanlasvegas.com/
Origin: https://authority.cosmopolitanlasvegas.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date: Tue, 30 May 2023 16:14:49 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 22265797
x-cache: HIT
content-length: 2475
x-xss-protection: 1; mode=block
last-modified: Mon, 31 Oct 2016 23:43:24 GMT
server: ECAcc (frc/4CF9)
etag: "53b63b92d033d21:0"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: public,max-age=31536000
accept-ranges: bytes
timing-allow-origin: *

GET
H/1.1 200
OK turquoise.png
authority.cosmopolitanlasvegas.com/sf/images/ 298 KB
299 KB 202ms
202ms Image
image/png 40.80.155.102
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://authority.cosmopolitanlasvegas.com/sf/images/turquoise.png

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

40.80.155.102 San Jose, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Kestrel / ASP.NET

Resource Hash

def5a8ee75fd584a03109d0d6db139dbe5e962e0a9a4b9a9caf36abd7341f3c4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://authority.cosmopolitanlasvegas.com/account/login?returnUrl=%2Fconnect%2Fauthorize%2Fcallback%3Fclient_id%3DIdentityOnline%26redirect_uri%3Dhttps%253A%252F%252Fwww.cosmopolitanlasvegas.com%252Flogin%252Fauthorize%26scope%3Dprofile%2520openid%2520cosmo-api%2520offline_access%2520api-all-readwrite%26response_type%3Dcode%26state%3DaAYHNwPWGNJihFRWa6yu33JDtlgL32td0sr1L6al
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

Date: Tue, 30 May 2023 16:14:49 GMT
Strict-Transport-Security: max-age=31536000
X-Content-Type-Options: nosniff
Last-Modified: Wed, 18 Aug 2021 18:34:54 GMT
Server: Kestrel
ETag: "1d7945fbcb83272"
X-Powered-By: ASP.NET
X-Frame-Options: DENY
Content-Type: image/png
Accept-Ranges: bytes
Content-Length: 305522
X-XSS-Protection: 1; mode=block

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 324 KB
98 KB 52ms
29ms Script
application/javascript 2a00:1450:4001:80b::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-TXCSKP

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80b::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

99c71cdb0e5657877604a19c23958637dc2fb343805eba06e6a454d6b6b3621f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://authority.cosmopolitanlasvegas.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date: Tue, 30 May 2023 16:14:49 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 99771
x-xss-protection: 0
last-modified: Tue, 30 May 2023 15:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Tue, 30 May 2023 16:14:49 GMT

GET
H2 200 tag.js Show response
lptag.liveperson.net/tag/ 21 KB
8 KB 184ms
46ms Script
application/javascript 178.249.97.23
LIVEPERSON

General

Check archive.org

Show headers Download Go to

Full URL

https://lptag.liveperson.net/tag/tag.js?site=88246722

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

178.249.97.23 , United States, ASN11054 (LIVEPERSON, US),

Reverse DNS

Software

ws /

Resource Hash

5624aeb2703037c9b669b4903e1961a38778408edcd3bea47e370e5de9f6c571

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://authority.cosmopolitanlasvegas.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date: Tue, 30 May 2023 16:14:50 GMT
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=63072000; includeSubDomains
last-modified: Wed, 07 Dec 2022 20:20:28 GMT
server: ws
etag: "6390f58c-1da4"
access-control-allow-methods: GET, POST, PATCH
content-type: application/javascript
access-control-expose-headers: X-Requested-With, X-HTTP-Method-Override, LP-DOMAIN-REFERER, LP-URL, ETag, ac-revision, X-LP-Last-Modified, If-Match, Authentication-Method, Credit-Card-Ref, Automation-Secret, Email-Token, x-lp-host, Lp-Req-Time, date, x-application-context, strict-transport-security, x-content-type-options, x-download-options, x-xss-protection, x-cache-status, x-amz-id-2, x-amz-request-id, expires, last-modified, set-cookie, content-security-policy, x-frame-options
cache-control: public, max-age=630
access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization, X-HTTP-Method-Override, LP-DOMAIN-REFERER, LP-URL, ETag, ac-revision, X-LP-Last-Modified, If-Match, Authentication-Method, Credit-Card-Ref, Automation-Secret, Email-Token
content-length: 7588

GET
H/1.1 200
OK icons.svg
authority.cosmopolitanlasvegas.com/sf/ 104 KB
105 KB 175ms
175ms Other
image/svg+xml 40.80.155.102
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://authority.cosmopolitanlasvegas.com/sf/icons.svg

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

40.80.155.102 San Jose, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Kestrel / ASP.NET

Resource Hash

abb78d31c33ab80d8dce5b86ab97f511b9dd18336b5be9af057bb72314eb0a0a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://authority.cosmopolitanlasvegas.com/account/login?returnUrl=%2Fconnect%2Fauthorize%2Fcallback%3Fclient_id%3DIdentityOnline%26redirect_uri%3Dhttps%253A%252F%252Fwww.cosmopolitanlasvegas.com%252Flogin%252Fauthorize%26scope%3Dprofile%2520openid%2520cosmo-api%2520offline_access%2520api-all-readwrite%26response_type%3Dcode%26state%3DaAYHNwPWGNJihFRWa6yu33JDtlgL32td0sr1L6al
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

Date: Tue, 30 May 2023 16:14:49 GMT
Strict-Transport-Security: max-age=31536000
X-Content-Type-Options: nosniff
Last-Modified: Wed, 18 Aug 2021 18:34:54 GMT
Server: Kestrel
ETag: "1d7945fbcbd3ac1"
X-Powered-By: ASP.NET
X-Frame-Options: DENY
Content-Type: image/svg+xml
Accept-Ranges: bytes
Content-Length: 106945
X-XSS-Protection: 1; mode=block

GET
H/1.1 200
OK 34BD98_0_0.woff
authority.cosmopolitanlasvegas.com/sf/fonts/ 80 KB
80 KB 173ms
172ms Font
application/font-woff 40.80.155.102
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://authority.cosmopolitanlasvegas.com/sf/fonts/34BD98_0_0.woff

Requested by

Host: authority.cosmopolitanlasvegas.com
URL: https://authority.cosmopolitanlasvegas.com/sf/css/style.css

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

40.80.155.102 San Jose, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Kestrel / ASP.NET

Resource Hash

a6cd4b6c0ed5513f3c190bf21dfbf21d3f6ff633835ada97a64317ea5298e978

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

Referer: https://authority.cosmopolitanlasvegas.com/sf/css/style.css
Origin: https://authority.cosmopolitanlasvegas.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

Date: Tue, 30 May 2023 16:14:49 GMT
Strict-Transport-Security: max-age=31536000
X-Content-Type-Options: nosniff
Last-Modified: Wed, 18 Aug 2021 18:34:54 GMT
Server: Kestrel
ETag: "1d7945fbcbda496"
X-Powered-By: ASP.NET
X-Frame-Options: DENY
Content-Type: application/font-woff
Accept-Ranges: bytes
Content-Length: 81814
X-XSS-Protection: 1; mode=block

GET
H/1.1 200
OK 35CE65_0_0.woff
authority.cosmopolitanlasvegas.com/sf/fonts/ 82 KB
82 KB 178ms
177ms Font
application/font-woff 40.80.155.102
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://authority.cosmopolitanlasvegas.com/sf/fonts/35CE65_0_0.woff

Requested by

Host: authority.cosmopolitanlasvegas.com
URL: https://authority.cosmopolitanlasvegas.com/sf/css/style.css

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

40.80.155.102 San Jose, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Kestrel / ASP.NET

Resource Hash

18cf414b2e7746b79dc3d6e1ed267c4da4e24e96183d28fd0353c6e34ed2e0fb

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

Referer: https://authority.cosmopolitanlasvegas.com/sf/css/style.css
Origin: https://authority.cosmopolitanlasvegas.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

Date: Tue, 30 May 2023 16:14:49 GMT
Strict-Transport-Security: max-age=31536000
X-Content-Type-Options: nosniff
Last-Modified: Wed, 18 Aug 2021 18:34:54 GMT
Server: Kestrel
ETag: "1d7945fbcbddc1f"
X-Powered-By: ASP.NET
X-Frame-Options: DENY
Content-Type: application/font-woff
Accept-Ranges: bytes
Content-Length: 83743
X-XSS-Protection: 1; mode=block

GET
H2 200 74843 Show response
beacon.sojern.com/pixel/p/ 5 KB
1 KB 68ms
18ms Script
application/javascript 107.178.244.119
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://beacon.sojern.com/pixel/p/74843?f_v=v6_js&p_v=1&vid=hot&cid=
Requested by: Host: authority.cosmopolitanlasvegas.com
URL: https://authority.cosmopolitanlasvegas.com/account/login?returnUrl=%2Fconnect%2Fauthorize%2Fcallback%3Fclient_id%3DIdentityOnline%26redirect_uri%3Dhttps%253A%252F%252Fwww.cosmopolitanlasvegas.com%252Flogin%252Fauthorize%26scope%3Dprofile%2520openid%2520cosmo-api%2520offline_access%2520api-all-readwrite%26response_type%3Dcode%26state%3DaAYHNwPWGNJihFRWa6yu33JDtlgL32td0sr1L6al
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 107.178.244.119 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 119.244.178.107.bc.googleusercontent.com
Software: /
Resource Hash: 3219b89ad1082ed6423e640c95fd68041ea666a600296b392435eb6f7e5531be

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://authority.cosmopolitanlasvegas.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date: Tue, 30 May 2023 16:14:50 GMT
content-encoding: gzip
via: 1.1 google
vary: Accept-Encoding
content-type: application/javascript
p3p: policyref="/w3c/p3p.xml", CP="ADMa OUR IND DSP NON LAW"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1081

GET
H2 200 tc.min.js Show response
c1.rfihub.net/js/ 19 KB
6 KB 34ms
7ms Script
application/x-javascript 2600:9000:214f:b600:1:76cf:fe80:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c1.rfihub.net/js/tc.min.js
Requested by: Host: authority.cosmopolitanlasvegas.com
URL: https://authority.cosmopolitanlasvegas.com/account/login?returnUrl=%2Fconnect%2Fauthorize%2Fcallback%3Fclient_id%3DIdentityOnline%26redirect_uri%3Dhttps%253A%252F%252Fwww.cosmopolitanlasvegas.com%252Flogin%252Fauthorize%26scope%3Dprofile%2520openid%2520cosmo-api%2520offline_access%2520api-all-readwrite%26response_type%3Dcode%26state%3DaAYHNwPWGNJihFRWa6yu33JDtlgL32td0sr1L6al
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:214f:b600:1:76cf:fe80:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: Jetty(9.4.51.v20230217) /
Resource Hash: 7ef97b12890fc6fee67f869c6e1f74b6719de7d66ac0d649c8d7386a80b4c30f

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://authority.cosmopolitanlasvegas.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date: Tue, 30 May 2023 15:54:22 GMT
content-encoding: gzip
via: 1.1 997f66fda0069dac50a85c7a4fa51b7e.cloudfront.net (CloudFront)
last-modified: Tue, 30 May 2023 15:54:12 GMT
server: Jetty(9.4.51.v20230217)
x-amz-cf-pop: FRA53-C1
age: 1227
x-cache: Hit from cloudfront
content-type: application/x-javascript
p3p: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
cache-control: public, max-age=3600
content-length: 6162
x-amz-cf-id: p1PbyJTxqeQB-F4VpfKxvMIUWl_CtIFbUbFre-X8xJWz_IPFulg28w==
expires: Tue, 30 May 2023 16:54:22 GMT

GET
H2 200 quant.js Show response
secure.quantserve.com/ 22 KB
9 KB 72ms
10ms Script
application/javascript 2620:116:800d:21:ef75:8280:f209:5ba1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://secure.quantserve.com/quant.js
Requested by: Host: authority.cosmopolitanlasvegas.com
URL: https://authority.cosmopolitanlasvegas.com/account/login?returnUrl=%2Fconnect%2Fauthorize%2Fcallback%3Fclient_id%3DIdentityOnline%26redirect_uri%3Dhttps%253A%252F%252Fwww.cosmopolitanlasvegas.com%252Flogin%252Fauthorize%26scope%3Dprofile%2520openid%2520cosmo-api%2520offline_access%2520api-all-readwrite%26response_type%3Dcode%26state%3DaAYHNwPWGNJihFRWa6yu33JDtlgL32td0sr1L6al
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2620:116:800d:21:ef75:8280:f209:5ba1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: e23decabee8464b650d1d0241283ba0c469806e14a2199efc5bb41771cb673c1

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://authority.cosmopolitanlasvegas.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date: Tue, 30 May 2023 16:14:50 GMT
content-encoding: gzip
etag: "sLp6xTjO7svFVaOemhLWUQ=="
vary: Accept-Encoding
content-type: application/javascript
cache-control: private, max-age=604800
accept-ranges: bytes
expires: Tue, 06 Jun 2023 16:14:50 GMT

GET
H/1.1 200 iframe Show response
ciqtracking.com/p/v/2/63990d17f870814e3d22fa1e/format/ Frame 8BF4 287 B
582 B 927ms
160ms Document
text/html 216.200.122.13
ZAYO-6461

General

Check archive.org

Show headers Download Go to

Full URL: https://ciqtracking.com/p/v/2/63990d17f870814e3d22fa1e/format/iframe?page=https%3A%2F%2Fauthority.cosmopolitanlasvegas.com%2Faccount%2Flogin%3FreturnUrl%3D%252Fconnect%252Fauthorize%252Fcallback%253Fclient_id%253DIdentityOnline%2526redirect_uri%253Dhttps%25253A%25252F%25252Fwww.cosmopolitanlasvegas.com%25252Flogin%25252Fauthorize%2526scope%253Dprofile%252520openid%252520cosmo-api%252520offline_access%252520api-all-readwrite%2526response_type%253Dcode%2526state%253DaAYHNwPWGNJihFRWa6yu33JDtlgL32td0sr1L6al
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-TXCSKP
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 216.200.122.13 Tonganoxie, United States, ASN6461 (ZAYO-6461, US),
Reverse DNS: 216.200.122.13.IPYX-141870-ZYO.zip.zayo.com
Software: /
Resource Hash: 3a7da1d234dae0a679724e6e8d6bed0fe395b54d98ddc53e78676a8019ef2db1

Request headers

Referer: https://authority.cosmopolitanlasvegas.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Content-Language: de-DE
Content-Type: text/html;charset=ISO-8859-1
Date: Tue, 30 May 2023 16:14:50 GMT
Transfer-Encoding: chunked

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 123 KB
48 KB 20ms
19ms Script
application/javascript 2a00:1450:4001:80b::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=DC-3917468

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-TXCSKP

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80b::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

9e763360358cf0ad122e88688a6c116c257dbfe22dd2613f1debf334edfa43a9

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://authority.cosmopolitanlasvegas.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date: Tue, 30 May 2023 16:14:49 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 48759
x-xss-protection: 0
last-modified: Tue, 30 May 2023 15:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Tue, 30 May 2023 16:14:49 GMT

GET
H2

200

bootstrap.js Show response
onboard.triptease.io/bootstrap/v6549.76442/
Redirect Chain

https://onboard.triptease.io/bootstrap.js?integrationId=01E4X5KNES5SZ07J305WWVJE8C
https://onboard.triptease.io/bootstrap/v6549.76442/bootstrap.js

108 KB
33 KB

22ms
21ms

Script
application/javascript

2606:4700:3033::6815:2773
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://onboard.triptease.io/bootstrap/v6549.76442/bootstrap.js

Requested by

Protocol

Server

2606:4700:3033::6815:2773 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

8689d372d731116268e28c632749193f4bbc95b9d6321cf0891d4973aa88bec9

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://authority.cosmopolitanlasvegas.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date: Tue, 30 May 2023 16:14:50 GMT
strict-transport-security: max-age=15552000
content-encoding: br
cf-cache-status: HIT
x-goog-meta-git-hash: 2d805b421166b4fc8cc4e3eabbacd1bcb13b00c1
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 14694
x-guploader-uploadid: ADPycdto4iotyZI5ozT-4kwwA3foPKn2SF6mfXfKtg6CVpLy2fC1e3SELiZYTPmI0aoz6o5Pxam3K-puyKZEk2x3e6cmRExMNY1F
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
x-goog-meta-build-version: 6549.76442
alt-svc: h3=":443"; ma=86400
last-modified: Tue, 30 May 2023 12:01:36 GMT
server: cloudflare
etag: W/"c9d08ba00704f3e031b2c9614389ecfc"
vary: Accept-Encoding
x-goog-generation: 1685448096194569
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
x-goog-hash: crc32c=dezoJw==, md5=ydCLoAcE8+AxsslhQ4ns/A==
access-control-expose-headers: Content-Type
cache-control: public, max-age=31536000
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=KeqX%2BVhlhmkk6fK9TLmdwgsE4FtiZw1W%2FGPjsCCBZdYVFt7XMHDbKVIWCp%2BNtTTdt7LPwUFueLT1EN0mROPC8rPKd4lBg3Lhq2r9FEhEH72Tl%2BFT7%2BqS7cnxKNlRc7%2FZPHl7Bvb9z3RZC0QYaw9iKp7r3w%3D%3D"}],"group":"cf-nel","max_age":604800}
x-goog-stored-content-length: 110151
cf-ray: 7cf845bafb6e8fe8-FRA
expires: Wed, 29 May 2024 12:09:55 GMT

Redirect headers

date: Tue, 30 May 2023 16:14:50 GMT
strict-transport-security: max-age=15552000
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=CqsWBPfplbr%2F5PyTnr6TVU18T5i2T9YOr3vM7DU8wIcdQEL%2F4TNPaVjmdgwYnCPM0jha9mllB7MF0p021%2FY1LA%2FDLGJQsJ1jY0YO7w672VTIENS0ql2bcH93rKSbBo4uRZd4mmYYVvMCu5usdbbhed8jzg%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/plain;charset=UTF-8
location: https://onboard.triptease.io/bootstrap/v6549.76442/bootstrap.js
access-control-allow-origin: *
cache-control: public, max-age=600
cf-ray: 7cf845bacb308fe8-FRA
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept
content-length: 63
alt-svc: h3=":443"; ma=86400

GET
H2 200 bat.js Show response
bat.bing.com/ 40 KB
12 KB 61ms
36ms Script
application/javascript 2620:1ec:c11::200
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://bat.bing.com/bat.js

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

679804e244b4127b7ecd99a513b57d6a4f91866410e16da69ce02f98f534051d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://authority.cosmopolitanlasvegas.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
content-encoding: gzip
date: Tue, 30 May 2023 16:14:49 GMT
last-modified: Thu, 11 May 2023 18:08:27 GMT
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: BA7B80AE61154BFE8E27EBF10500B4BC Ref B: FRA31EDGE0710 Ref C: 2023-05-30T16:14:49Z
etag: "80df77953384d91:0"
vary: Accept-Encoding
x-cache: CONFIG_NOCACHE
content-type: application/javascript
cache-control: private,max-age=1800
accept-ranges: bytes
content-length: 12183

GET
H2

200

bootstrap.js Show response
onboard.triptease.io/bootstrap/v6549.76442/
Redirect Chain

https://static.triptease.io/paperboy/KoP8XXWYLW.js?hotelKey=b46e2da70190d88425348ffad2967bf112aa252c
https://onboard.triptease.io/bootstrap/v6549.76442/bootstrap.js

108 KB
33 KB

24ms
24ms

Script
application/javascript

2606:4700:3033::6815:2773
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://onboard.triptease.io/bootstrap/v6549.76442/bootstrap.js

Requested by

Protocol

Server

2606:4700:3033::6815:2773 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

8689d372d731116268e28c632749193f4bbc95b9d6321cf0891d4973aa88bec9

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://authority.cosmopolitanlasvegas.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date: Tue, 30 May 2023 16:14:50 GMT
strict-transport-security: max-age=15552000
content-encoding: br
cf-cache-status: HIT
x-goog-meta-git-hash: 2d805b421166b4fc8cc4e3eabbacd1bcb13b00c1
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 14694
x-guploader-uploadid: ADPycdto4iotyZI5ozT-4kwwA3foPKn2SF6mfXfKtg6CVpLy2fC1e3SELiZYTPmI0aoz6o5Pxam3K-puyKZEk2x3e6cmRExMNY1F
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
x-goog-meta-build-version: 6549.76442
alt-svc: h3=":443"; ma=86400
last-modified: Tue, 30 May 2023 12:01:36 GMT
server: cloudflare
etag: W/"c9d08ba00704f3e031b2c9614389ecfc"
vary: Accept-Encoding
x-goog-generation: 1685448096194569
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
x-goog-hash: crc32c=dezoJw==, md5=ydCLoAcE8+AxsslhQ4ns/A==
access-control-expose-headers: Content-Type
cache-control: public, max-age=31536000
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Ia8ph8%2BEnk0mNGM%2B9zzHF9f3X1aoljOhZWH7rFPGcF67syOdNUzLexiOi8Cd2a2wX11WI182hbGE%2BtDd4Zyd4qNmmNjB1Moqucuy8x5map2PiQcgYXAcOIDf6otEKsETUmYHEG32uYA3IyjN42FGy4OiCA%3D%3D"}],"group":"cf-nel","max_age":604800}
x-goog-stored-content-length: 110151
cf-ray: 7cf845bafb648fe8-FRA
expires: Wed, 29 May 2024 12:09:55 GMT

Redirect headers

date: Tue, 30 May 2023 16:14:50 GMT
via: 1.1 varnish
surrogate-key-debug: paperboy paperboy-KoP8XXWYLW paperboy-js?hotelKey=b46e2da70190d88425348ffad2967bf112aa252c
strict-transport-security: max-age=31557600
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-cache: MISS
backend-url: /paperboy/KoP8XXWYLW.js?hotelKey=b46e2da70190d88425348ffad2967bf112aa252c
content-length: 63
x-served-by: cache-fra-eddf8230131-FRA
server: cloudflare
x-timer: S1685463290.031434,VS0,VE29
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=jQ7njwWicz9WPyOMtCQcx7BhKwrtw1zct7GGFEF8apZuPbc8%2BBlfgTH2FjTSaM1ZzVhiMKmMl1ebKOahQxtatobqH%2F475rZ8YAZNll5PRl5wJABoMTqH3%2Bs64AEMW9a80NGCeg79zg%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/plain;charset=UTF-8
location: https://onboard.triptease.io/bootstrap/v6549.76442/bootstrap.js
access-control-allow-origin: *
pseudo-device-id: 6ff99241b279fb3be3dfd7189056af1c20c5cf5157a8d8dd52ab7d4b2a9fd35f
cache-control: public, max-age=600
pseudo-session-id: eb26b095dce4f41030161a3e432b55dcff76443f992fa83cfa8a4353dbebaee2
accept-ranges: bytes
cf-ray: 7cf845bab8a7bbe5-FRA
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept
x-cache-hits: 0

GET
H/1.1 200
OK ca.html Show response
20843572p.rfihub.com/ Frame 5A27 3 KB
4 KB 145ms
23ms Document
text/html 193.0.160.130
ROCKETFUEL

General

Check archive.org

Show headers Download Go to

Full URL: https://20843572p.rfihub.com/ca.html?ver=9&rb=42833&ca=20843572&_o=42833&_t=20843572&pe=https%3A%2F%2Fauthority.cosmopolitanlasvegas.com%2Faccount%2Flogin%3FreturnUrl%3D%252Fconnect%252Fauthorize%252Fcallback%253Fclient_id%253DIdentityOnline%2526redirect_uri%253Dhttps%25253A%25252F%25252Fwww.cosmopolitanlasvegas.com%25252Flogin%25252Fauthorize%2526scope%253Dprofile%252520openid%252520cosmo-api%252520offline_access%252520api-all-readwrite%2526response_type%253Dcode%2526state%253DaAYHNwPWGNJihFRWa6yu33JDtlgL32td0sr1L6al&pf=&ra=20661149408590407
Requested by: Host: c1.rfihub.net
URL: https://c1.rfihub.net/js/tc.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 193.0.160.130 , United States, ASN54312 (ROCKETFUEL, US),
Reverse DNS
Software: Jetty(9.4.51.v20230217) /
Resource Hash: 55c024cff6e1308cae2ff17839d38e8e3db427881d51a79165fa935ce8df74fc

Request headers

Referer: https://authority.cosmopolitanlasvegas.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Cache-Control: no-cache
Content-Length: 3071
Content-Type: text/html;charset=utf-8
Date: Tue, 30 May 2023 16:14:50 GMT
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Server: Jetty(9.4.51.v20230217)

GET
H2 200 fbevents.js Show response
connect.facebook.net/en_US/ 106 KB
28 KB 29ms
7ms Script
application/x-javascript 2a03:2880:f083:9:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/fbevents.js

Requested by

Host: beacon.sojern.com
URL: https://beacon.sojern.com/pixel/p/74843?f_v=v6_js&p_v=1&vid=hot&cid=

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f083:9:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

c5100cd90a95aa459fe237adc409043e20f8fd06caa5cd3b74d66f79387ae0fb

Security Headers

Name	Value
Content-Security-Policy	default-src facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com data: blob: 'self';script-src .fbcdn.net .facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;connect-src .fbcdn.net .facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://authority.cosmopolitanlasvegas.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

content-security-policy: default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; preload; includeSubDomains
date: Tue, 30 May 2023 16:14:50 GMT
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 27498
x-fb-rlafr: 0
x-xss-protection: 0
pragma: public
x-fb-debug: BzYgiIuw3ie2aFMrnRfo8ajxEic1m2td/BC1xyJ2yczn6q2r4/+VQ7/L7wuC3Be2gMD5IOy1Nxp0Na0iSe64fA==
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
x-fb-trip-id: 1679558926
cross-origin-opener-policy: same-origin-allow-popups
vary: Accept-Encoding
report-to: {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/?minimize=0"}],"group":"coep_report"}
content-type: application/x-javascript; charset=utf-8
x-frame-options: DENY
cache-control: public, max-age=1200
permissions-policy: accelerometer=(), ambient-light-sensor=(), bluetooth=(), gyroscope=(), hid=(), idle-detection=(), magnetometer=(), midi=(), payment=(), screen-wake-lock=(), serial=(), usb=()
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2

200

src=8133443;dc_pre=CLKSwIW4nf8CFU-ZsgodFhkEWQ;type=track0;cat=theco00;qty=1;cost=0;u1=;u16=;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=orderID
adservice.google.com/ddm/fls/z/
Redirect Chain

https://ad.doubleclick.net/ddm/activity/src=8133443;type=track0;cat=theco00;qty=1;cost=0;u1=;u16=;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=orderID
https://ad.doubleclick.net/ddm/activity/src=8133443;dc_pre=CLKSwIW4nf8CFU-ZsgodFhkEWQ;type=track0;cat=theco00;qty=1;cost=0;u1=;u16=;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=orderID
https://adservice.google.com/ddm/fls/z/src=8133443;dc_pre=CLKSwIW4nf8CFU-ZsgodFhkEWQ;type=track0;cat=theco00;qty=1;cost=0;u1=;u16=;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=orderID

42 B
401 B

75ms
44ms

Image
image/gif

2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://adservice.google.com/ddm/fls/z/src=8133443;dc_pre=CLKSwIW4nf8CFU-ZsgodFhkEWQ;type=track0;cat=theco00;qty=1;cost=0;u1=;u16=;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=orderID

Requested by

Protocol

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://authority.cosmopolitanlasvegas.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 30 May 2023 16:14:50 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Tue, 30 May 2023 16:14:50 GMT
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://adservice.google.com/ddm/fls/z/src=8133443;dc_pre=CLKSwIW4nf8CFU-ZsgodFhkEWQ;type=track0;cat=theco00;qty=1;cost=0;u1=;u16=;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=orderID
content-type: text/html; charset=UTF-8
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

bounce
secure.adnxs.com/
Redirect Chain

https://secure.adnxs.com/px?id=1474714&t=1
https://secure.adnxs.com/bounce?%2Fpx%3Fid%3D1474714%26t%3D1

0
1 KB

14ms
14ms

Image
application/javascript

185.89.210.20
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://secure.adnxs.com/bounce?%2Fpx%3Fid%3D1474714%26t%3D1

Requested by

Protocol

HTTP/1.1

Server

185.89.210.20 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

944.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net

Software

nginx/1.21.3 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://authority.cosmopolitanlasvegas.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 30 May 2023 16:14:50 GMT
AN-X-Request-Uuid: 9f658bfb-1f29-4ab3-82d4-922ceebc3ef6
Server: nginx/1.21.3
Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type: application/javascript; charset=utf-8
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
X-Proxy-Origin: 138.199.38.134; 138.199.38.134; 944.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Tue, 30 May 2023 16:14:50 GMT
AN-X-Request-Uuid: b48b32fe-5f4c-43d6-9b80-b79b56c42a21
Server: nginx/1.21.3
Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type: text/html; charset=utf-8
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://secure.adnxs.com/bounce?%2Fpx%3Fid%3D1474714%26t%3D1
Cache-Control: no-store, no-cache, private
Connection: keep-alive
X-Proxy-Origin: 138.199.38.134; 138.199.38.134; 944.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H/1.1

200
OK

bounce
secure.adnxs.com/
Redirect Chain

https://secure.adnxs.com/seg?add=26344827&t=1
https://secure.adnxs.com/bounce?%2Fseg%3Fadd%3D26344827%26t%3D1

0
1 KB

17ms
17ms

Image
application/javascript

185.89.210.20
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://secure.adnxs.com/bounce?%2Fseg%3Fadd%3D26344827%26t%3D1

Requested by

Protocol

HTTP/1.1

Server

185.89.210.20 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

944.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net

Software

nginx/1.21.3 /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://authority.cosmopolitanlasvegas.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 30 May 2023 16:14:50 GMT
AN-X-Request-Uuid: 75e3f362-1ec4-443a-9128-56daa85124d3
Server: nginx/1.21.3
Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type: application/javascript; charset=utf-8
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
X-Proxy-Origin: 138.199.38.134; 138.199.38.134; 944.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

Date: Tue, 30 May 2023 16:14:50 GMT
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Connection: keep-alive
X-Proxy-Origin: 138.199.38.134; 138.199.38.134; 944.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
Content-Length: 0
X-XSS-Protection: 0
Pragma: no-cache
AN-X-Request-Uuid: dcc40822-6a82-4b64-9f85-c9bdb2eba740
Server: nginx/1.21.3
Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type: text/html; charset=utf-8
Access-Control-Allow-Origin: *
Location: https://secure.adnxs.com/bounce?%2Fseg%3Fadd%3D26344827%26t%3D1
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2

200

AdX
pixel.sojern.com/idSync/
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_cm=true&google_hm=-Dv49UFei9LGcXIdre1mVA&google_nid=sojern__adx_open_bidder_seat&google_sc=true&sjrn_id=NHnrSLokcDsdiyB4_zAVhOaqhHkPlneeeN_Jzwz8OE7uPKzqX4a...
https://cm.g.doubleclick.net/pixel?google_cm=true&google_hm=-Dv49UFei9LGcXIdre1mVA&google_nid=sojern__adx_open_bidder_seat&google_sc=true&sjrn_id=NHnrSLokcDsdiyB4_zAVhOaqhHkPlneeeN_Jzwz8OE7uPKzqX4a...
https://pixel.sojern.com/idSync/AdX?exchangeProfileId=&sjrn_id=NHnrSLokcDsdiyB4_zAVhOaqhHkPlneeeN_Jzwz8OE7uPKzqX4aaNubdHUA8kei4&sjrn_ula=476905866&google_gid=CAESEKviiyGxtVIeiuvpG7M7zG0&google_cver=1

42 B
283 B

41ms
20ms

Image
image/gif

107.178.244.119
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.sojern.com/idSync/AdX?exchangeProfileId=&sjrn_id=NHnrSLokcDsdiyB4_zAVhOaqhHkPlneeeN_Jzwz8OE7uPKzqX4aaNubdHUA8kei4&sjrn_ula=476905866&google_gid=CAESEKviiyGxtVIeiuvpG7M7zG0&google_cver=1
Requested by: Host: authority.cosmopolitanlasvegas.com
URL: https://authority.cosmopolitanlasvegas.com/account/login?returnUrl=%2Fconnect%2Fauthorize%2Fcallback%3Fclient_id%3DIdentityOnline%26redirect_uri%3Dhttps%253A%252F%252Fwww.cosmopolitanlasvegas.com%252Flogin%252Fauthorize%26scope%3Dprofile%2520openid%2520cosmo-api%2520offline_access%2520api-all-readwrite%26response_type%3Dcode%26state%3DaAYHNwPWGNJihFRWa6yu33JDtlgL32td0sr1L6al
Protocol: H2
Server: 107.178.244.119 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 119.244.178.107.bc.googleusercontent.com
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://authority.cosmopolitanlasvegas.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

p3p: policyref="/w3c/p3p.xml", CP="ADMa OUR IND DSP NON LAW"
date: Tue, 30 May 2023 16:14:50 GMT
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
vary: Accept-Encoding
content-type: image/gif

Redirect headers

pragma: no-cache
date: Tue, 30 May 2023 16:14:50 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://pixel.sojern.com/idSync/AdX?exchangeProfileId=&sjrn_id=NHnrSLokcDsdiyB4_zAVhOaqhHkPlneeeN_Jzwz8OE7uPKzqX4aaNubdHUA8kei4&sjrn_ula=476905866&google_gid=CAESEKviiyGxtVIeiuvpG7M7zG0&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 412
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

pixel
fcmatch.youtube.com/
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_hm=-Dv49UFei9LGcXIdre1mVA&google_nid=sojern_adh
https://cm.g.doubleclick.net/pixel?google_hm=-Dv49UFei9LGcXIdre1mVA&google_nid=sojern_adh&google_tc=
https://fcmatch.google.com/pixel?google_gm=AMnCDooNtRgzBBh1rolaKu1g4dft_N36wQni4N6ckY7Nv3jUtsKu-nNvC7yDZsNgOB2a8ar05Mq6s-RY-rZ5MwW9ceBuktK9KdubYUVdwVhSW9U67mHk7N8
https://fcmatch.youtube.com/pixel?google_gm=AMnCDooNtRgzBBh1rolaKu1g4dft_N36wQni4N6ckY7Nv3jUtsKu-nNvC7yDZsNgOB2a8ar05Mq6s-RY-rZ5MwW9ceBuktK9KdubYUVdwVhSW9U67mHk7N8

170 B
432 B

76ms
15ms

Image
image/png

2a00:1450:4001:829::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://fcmatch.youtube.com/pixel?google_gm=AMnCDooNtRgzBBh1rolaKu1g4dft_N36wQni4N6ckY7Nv3jUtsKu-nNvC7yDZsNgOB2a8ar05Mq6s-RY-rZ5MwW9ceBuktK9KdubYUVdwVhSW9U67mHk7N8

Requested by

Protocol

Server

2a00:1450:4001:829::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://authority.cosmopolitanlasvegas.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 30 May 2023 16:14:50 GMT
server: HTTP server (unknown)
x-frame-options: SAMEORIGIN
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Tue, 30 May 2023 16:14:50 GMT
server: HTTP server (unknown)
x-frame-options: SAMEORIGIN
content-type: text/html; charset=UTF-8
location: https://fcmatch.youtube.com/pixel?google_gm=AMnCDooNtRgzBBh1rolaKu1g4dft_N36wQni4N6ckY7Nv3jUtsKu-nNvC7yDZsNgOB2a8ar05Mq6s-RY-rZ5MwW9ceBuktK9KdubYUVdwVhSW9U67mHk7N8
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 360
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

apn
pixel.sojern.com/idsync/
Redirect Chain

https://ib.adnxs.com/getuid?https://pixel.sojern.com/idsync/apn?id=$UID&sjrn_id=NHnrSLokcDsdiyB4_zAVhOaqhHkPlneeeN_Jzwz8OE7uPKzqX4aaNubdHUA8kei4
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fpixel.sojern.com%2Fidsync%2Fapn%3Fid%3D%24UID%26sjrn_id%3DNHnrSLokcDsdiyB4_zAVhOaqhHkPlneeeN_Jzwz8OE7uPKzqX4aaNubdHUA8kei4
https://pixel.sojern.com/idsync/apn?id=4137122346784741821&sjrn_id=NHnrSLokcDsdiyB4_zAVhOaqhHkPlneeeN_Jzwz8OE7uPKzqX4aaNubdHUA8kei4

42 B
265 B

54ms
21ms

Image
image/gif

107.178.244.119
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.sojern.com/idsync/apn?id=4137122346784741821&sjrn_id=NHnrSLokcDsdiyB4_zAVhOaqhHkPlneeeN_Jzwz8OE7uPKzqX4aaNubdHUA8kei4
Requested by: Host: authority.cosmopolitanlasvegas.com
URL: https://authority.cosmopolitanlasvegas.com/account/login?returnUrl=%2Fconnect%2Fauthorize%2Fcallback%3Fclient_id%3DIdentityOnline%26redirect_uri%3Dhttps%253A%252F%252Fwww.cosmopolitanlasvegas.com%252Flogin%252Fauthorize%26scope%3Dprofile%2520openid%2520cosmo-api%2520offline_access%2520api-all-readwrite%26response_type%3Dcode%26state%3DaAYHNwPWGNJihFRWa6yu33JDtlgL32td0sr1L6al
Protocol: H2
Server: 107.178.244.119 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 119.244.178.107.bc.googleusercontent.com
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://authority.cosmopolitanlasvegas.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

p3p: policyref="/w3c/p3p.xml", CP="ADMa OUR IND DSP NON LAW"
date: Tue, 30 May 2023 16:14:50 GMT
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
vary: Accept-Encoding
content-type: image/gif

Redirect headers

Date: Tue, 30 May 2023 16:14:50 GMT
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Connection: keep-alive
X-Proxy-Origin: 138.199.38.134; 138.199.38.134; 954.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
Content-Length: 0
X-XSS-Protection: 0
Pragma: no-cache
AN-X-Request-Uuid: a58e6f2c-1407-4259-907e-66f5054ece7b
Server: nginx/1.21.3
Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type: text/html; charset=utf-8
Access-Control-Allow-Origin: *
Location: https://pixel.sojern.com/idsync/apn?id=4137122346784741821&sjrn_id=NHnrSLokcDsdiyB4_zAVhOaqhHkPlneeeN_Jzwz8OE7uPKzqX4aaNubdHUA8kei4
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2 200 generic
match.adsrvr.org/track/cmf/ 70 B
265 B 106ms
32ms Image
image/gif 35.71.131.137
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://match.adsrvr.org/track/cmf/generic?ttd_pid=ombl9hp&ttd_puid=NHnrSLokcDsdiyB4_zAVhOaqhHkPlneeeN_Jzwz8OE7uPKzqX4aaNubdHUA8kei4&ttd_tpi=1
Requested by: Host: authority.cosmopolitanlasvegas.com
URL: https://authority.cosmopolitanlasvegas.com/account/login?returnUrl=%2Fconnect%2Fauthorize%2Fcallback%3Fclient_id%3DIdentityOnline%26redirect_uri%3Dhttps%253A%252F%252Fwww.cosmopolitanlasvegas.com%252Flogin%252Fauthorize%26scope%3Dprofile%2520openid%2520cosmo-api%2520offline_access%2520api-all-readwrite%26response_type%3Dcode%26state%3DaAYHNwPWGNJihFRWa6yu33JDtlgL32td0sr1L6al
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.71.131.137 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a6370ebea231e0c9a.awsglobalaccelerator.com
Software: /
Resource Hash: 8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://authority.cosmopolitanlasvegas.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

content-type: image/gif
pragma: no-cache
date: Tue, 30 May 2023 16:14:50 GMT
cache-control: private,no-cache, must-revalidate
x-aspnet-version: 4.0.30319
content-length: 70
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"

GET
H2 200 151002868.js Show response
bat.bing.com/p/action/ 4 KB
2 KB 111ms
111ms Script
application/javascript 2620:1ec:c11::200
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://bat.bing.com/p/action/151002868.js

Requested by

Host: bat.bing.com
URL: https://bat.bing.com/bat.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

/ ARR/3.0

Resource Hash

b41b956ae1f0b84d1229027a0fd64f1761755652e40539e04d494b0428cf6ee4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://authority.cosmopolitanlasvegas.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
content-encoding: gzip
date: Tue, 30 May 2023 16:14:49 GMT
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 0CD84AA0CC4E43A18B3B86ADBF03DDE3 Ref B: FRA31EDGE0710 Ref C: 2023-05-30T16:14:50Z
x-powered-by: ARR/3.0
vary: Accept-Encoding
x-cache: CONFIG_NOCACHE
content-type: application/javascript; charset=utf-8
cache-control: private,max-age=60
content-length: 1497

GET
H2 204 0
bat.bing.com/action/ 0
288 B 30ms
30ms Image
text/plain 2620:1ec:c11::200
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://bat.bing.com/action/0?ti=151002868&Ver=2&mid=b4ae6f8e-ad72-49ee-9baf-d656afcb7dc9&sid=1a5ba450ff0511edbc3739e09e0d3c29&vid=1a5bc6c0ff0511ed8f64d5f657a7afe7&vids=1&msclkid=N&pi=1200101525&lg=en-US&sw=1600&sh=1200&sc=24&tl=Come%20in%20and%20play%20-%20Cosmopolitan.OAuth&p=https%3A%2F%2Fauthority.cosmopolitanlasvegas.com%2Faccount%2Flogin%3FreturnUrl%3D%252Fconnect%252Fauthorize%252Fcallback%253Fclient_id%253DIdentityOnline%2526redirect_uri%253Dhttps%25253A%25252F%25252Fwww.cosmopolitanlasvegas.com%25252Flogin%25252Fauthorize%2526scope%253Dprofile%252520openid%252520cosmo-api%252520offline_access%252520api-all-readwrite%2526response_type%253Dcode%2526state%253DaAYHNwPWGNJihFRWa6yu33JDtlgL32td0sr1L6al&r=&lt=3072&evt=pageLoad&sv=1&rn=212913

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://authority.cosmopolitanlasvegas.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

pragma: no-cache
strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Tue, 30 May 2023 16:14:49 GMT
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 7423F84D25CF4A1EADE3DD35C24960B8 Ref B: FRA31EDGE0710 Ref C: 2023-05-30T16:14:50Z
x-cache: CONFIG_NOCACHE
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 rules-p-51fVpTbV0X0fw.js Show response
rules.quantcount.com/ 13 KB
3 KB 38ms
11ms Script
application/javascript 2600:9000:223c:dc00:6:44e3:f8c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://rules.quantcount.com/rules-p-51fVpTbV0X0fw.js
Requested by: Host: secure.quantserve.com
URL: https://secure.quantserve.com/quant.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:223c:dc00:6:44e3:f8c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 2e6286b4ec577f49126e30dd1c328dd278a786a4314fed650663a38e503475dd

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://authority.cosmopolitanlasvegas.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date: Tue, 30 May 2023 16:14:50 GMT
content-encoding: gzip
via: 1.1 c2e56cd54e2593df95ccca8a6d98c958.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-P2
age: 1177
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
cross-origin-resource-policy: cross-origin
last-modified: Thu, 01 Dec 2022 23:36:41 GMT
server: AmazonS3
etag: W/"d5b2132a022438e13c7e1c1c9240d5fe"
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=3600
x-amz-cf-id: lRYuqCY6-gQcso4loctPoEs76syS4Wm2bZUv48o_rqXLHWVuQ1162Q==

GET
H2 200 .jsonp Show response
lptag.liveperson.net/lptag/api/account/88246722/configuration/applications/taglets/ 293 KB
104 KB 38ms
37ms Script
application/x-javascript 178.249.97.23
LIVEPERSON

General

Check archive.org

Show headers Download Go to

Full URL

https://lptag.liveperson.net/lptag/api/account/88246722/configuration/applications/taglets/.jsonp?v=2.0&df=undefined&b=undefined

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

178.249.97.23 , United States, ASN11054 (LIVEPERSON, US),

Reverse DNS

Software

ws /

Resource Hash

b4f963da9920a6beae0f689b3650b399a8a90b373109ceb91aade27a264e95ea

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://authority.cosmopolitanlasvegas.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date: Tue, 30 May 2023 16:14:50 GMT
strict-transport-security: max-age=63072000; includeSubDomains
x-content-type-options: nosniff
content-encoding: gzip
server: ws
x-cache-status: EXPIRED
access-control-allow-methods: GET, POST, PATCH
content-type: application/x-javascript
access-control-expose-headers: X-Requested-With, X-HTTP-Method-Override, LP-DOMAIN-REFERER, LP-URL, ETag, ac-revision, X-LP-Last-Modified, If-Match, Authentication-Method, Credit-Card-Ref, Automation-Secret, Email-Token, x-lp-host, Lp-Req-Time, date, x-application-context, strict-transport-security, x-content-type-options, x-download-options, x-xss-protection, x-cache-status, x-amz-id-2, x-amz-request-id, expires, last-modified, set-cookie, content-security-policy, x-frame-options
cache-control: public, max-age=630
access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization, X-HTTP-Method-Override, LP-DOMAIN-REFERER, LP-URL, ETag, ac-revision, X-LP-Last-Modified, If-Match, Authentication-Method, Credit-Card-Ref, Automation-Secret, Email-Token

GET
H2 200 722264932049379 Show response
connect.facebook.net/signals/config/ 300 KB
86 KB 137ms
136ms Script
application/x-javascript 2a03:2880:f083:9:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/signals/config/722264932049379?v=2.9.104&r=stable

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f083:9:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

d23cfa254dc9eeb59be2aae9e3fe06e2ac10be703179e50b65588658150dd2ba

Security Headers

Name	Value
Content-Security-Policy	default-src facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com data: blob: 'self';script-src .fbcdn.net .facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;connect-src .fbcdn.net .facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://authority.cosmopolitanlasvegas.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

content-security-policy: default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; preload; includeSubDomains
date: Tue, 30 May 2023 16:14:50 GMT
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
x-fb-rlafr: 0
x-xss-protection: 0
pragma: public
x-fb-debug: gSTsdVzPl94awkYD+yF/BdBokUDBIANHMDg5rC/DZRNLlnuDu2tHPbwIkJEv8Hbjk4pMJy3Ve2r9LzXeepbJcg==
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
x-fb-trip-id: 1679558926
cross-origin-opener-policy: same-origin-allow-popups
vary: Accept-Encoding
report-to: {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/?minimize=0"}],"group":"coep_report"}
content-type: application/x-javascript; charset=utf-8
x-frame-options: DENY
origin-agent-cluster: ?0
cache-control: public, max-age=1200
permissions-policy: accelerometer=(), ambient-light-sensor=(), bluetooth=(), gyroscope=(), hid=(), idle-detection=(), magnetometer=(), midi=(), screen-wake-lock=(), serial=(), usb=()
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H3 200 kernel-host.html Show response
onboard.triptease.io/kernel/v6549.76442/ Frame 74E0 57 KB
19 KB 146ms
145ms Document
text/html 2606:4700:3033::6815:2773
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://onboard.triptease.io/kernel/v6549.76442/kernel-host.html?originHost=authority.cosmopolitanlasvegas.com

Requested by

Host: onboard.triptease.io
URL: https://onboard.triptease.io/bootstrap.js?integrationId=01E4X5KNES5SZ07J305WWVJE8C

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:3033::6815:2773 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

1c6507958246e187149d583ddac48d6b211e7873200c4e82fc4e0ea9b9625ac2

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

Referer: https://authority.cosmopolitanlasvegas.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

access-control-allow-origin: *
access-control-expose-headers: Content-Type
alt-svc: h3=":443"; ma=86400
cache-control: public, max-age=31536000
cf-cache-status: MISS
cf-ray: 7cf845bb49bebbc7-FRA
content-encoding: br
content-type: text/html; charset=utf-8
date: Tue, 30 May 2023 16:14:50 GMT
expires: Wed, 29 May 2024 16:14:50 GMT
last-modified: Tue, 30 May 2023 12:01:55 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=TTYldd0umrPwxS4j0enkunBfDYKYzr2uJtsVwT74VrtYA%2BjzZUbBEefYAeEQW2u12VST%2BExNrqJJuqR%2BDsAu%2BKijrm6mQmdKj6cqMWHm2C8hV5jEQdewwYMpqrj7JkXEMjfJLeue%2BF%2BEtQWERYcmOcglwQ%3D%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
strict-transport-security: max-age=15552000
vary: Accept-Encoding
x-goog-generation: 1685448114983412
x-goog-hash: crc32c=cu1/BQ== md5=gSY68AIHQ8h1Fph+GBxocQ==
x-goog-meta-build-version: 6549.76442
x-goog-meta-git-hash: 2d805b421166b4fc8cc4e3eabbacd1bcb13b00c1
x-goog-metageneration: 2
x-goog-storage-class: MULTI_REGIONAL
x-goog-stored-content-encoding: identity
x-goog-stored-content-length: 58293
x-guploader-uploadid: ADPycds6hk8fE18TiitAcyPoHKnXTNw10yrQvW4kJClR1v406eDDooZAzf_qEilUDPihuWCcr6nENJDhMZ1WRVQN4CYwpl73tcdK

GET
H2 200 pixel;r=1746013159;labels=_fp.event.Default;rf=0;a=p-51fVpTbV0X0fw;url=https%3A%2F%2Fauthority.cosmopolitanlasvegas.com%2Faccount%2Flogin%3FreturnUrl%3D%252Fconnect%252Fauthorize%252Fcallback%253Fc...
pixel.quantserve.com/ 35 B
471 B 18ms
8ms Image
image/gif 2620:116:800d:21:ef75:8280:f209:5ba1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pixel.quantserve.com/pixel;r=1746013159;labels=_fp.event.Default;rf=0;a=p-51fVpTbV0X0fw;url=https%3A%2F%2Fauthority.cosmopolitanlasvegas.com%2Faccount%2Flogin%3FreturnUrl%3D%252Fconnect%252Fauthorize%252Fcallback%253Fclient_id%253DIdentityOnline%2526redirect_uri%253Dhttps%25253A%25252F%25252Fwww.cosmopolitanlasvegas.com%25252Flogin%25252Fauthorize%2526scope%253Dprofile%252520openid%252520cosmo-api%252520offline_access%252520api-all-readwrite%2526response_type%253Dcode%2526state%253DaAYHNwPWGNJihFRWa6yu33JDtlgL32td0sr1L6al;uh=e51ed67dfb8d91dc24b15e2ace0c3bc33bc53c3e1dfb09200d6c2f8387d67ea6;uht=2;fpan=1;fpa=P0-797795175-1685463290053;pbc=;ns=0;ce=1;qjs=1;qv=c818c8ec-20230509111053;cm=;gdpr=0;ref=;d=cosmopolitanlasvegas.com;dst=0;et=1685463290142;tzo=0;ogl=;ses=2a9f0148-61e0-4e64-8b7e-ec56662202a9;mdl=

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2620:116:800d:21:ef75:8280:f209:5ba1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://authority.cosmopolitanlasvegas.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 30 May 2023 16:14:50 GMT
strict-transport-security: max-age=86400
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAo PSDo OUR SAMa IND COM NAV"
content-type: image/gif
cache-control: private, no-cache, no-store, proxy-revalidate
content-length: 35
expires: Fri, 04 Aug 1978 12:00:00 GMT

GET
H2 200 151002868 Show response
www.clarity.ms/tag/uet/ 826 B
1 KB 172ms
121ms Script
application/x-javascript 2620:1ec:4f:1::44
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://www.clarity.ms/tag/uet/151002868
Requested by: Host: bat.bing.com
URL: https://bat.bing.com/p/action/151002868.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2620:1ec:4f:1::44 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: 57ddc31031e1b05a80132ac388b81ea3055a2393ed6f24564f153a9d8633b5a7

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://authority.cosmopolitanlasvegas.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

request-context: appId=cid-v1:67bc0b23-8423-4b52-b1ca-6a87709ceaa2
date: Tue, 30 May 2023 16:14:50 GMT
x-azure-ref: 0+iB2ZAAAAABOA0C4JOspR42wNeaEX+3BRlJBMzFFREdFMDMxNwA2Y2ZiZWVlMC01MDI3LTQ4NGItODk2Ny00YTI5YWY3N2YxZTE=
x-cache: CONFIG_NOCACHE
content-type: application/x-javascript
cache-control: no-cache, no-store
content-length: 826
expires: -1

GET
H2

451

501709.gif
idsync.rlcdn.com/ Frame 5A27
Redirect Chain

https://live.rezync.com/pixel?c=bd8618c307ae9885a12561b7191e2cea&cid=5108559728001295002&referrer=https%3A%2F%2Fauthority.cosmopolitanlasvegas.com%2Faccount%2Flogin%3FreturnUrl%3D%252Fconnect%252Fa...
https://p.rfihub.com/cm?pub=39342&in=0&userid=ed0f80d2-b7df-4556-848d-a9f90e6502c6%3A1685463290.316538&forward=https%3A//idsync.rlcdn.com/501709.gif%3Fpartner_uid%3Ded0f80d2-b7df-4556-848d-a9f90e65...
https://live.rezync.com/pixel?c=bd8618c307ae9885a12561b7191e2cea&cid=5108559728001295002&referrer={encSite}&forward=https%3A%2F%2Fidsync.rlcdn.com%2F501709.gif%3Fpartner_uid%3Ded0f80d2-b7df-4556-84...
https://idsync.rlcdn.com/501709.gif?partner_uid=ed0f80d2-b7df-4556-848d-a9f90e6502c6%3A1685463290.316538&_=1685463290.3182983

0
42 B

16ms
15ms

Image
text/plain

35.244.174.68
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://idsync.rlcdn.com/501709.gif?partner_uid=ed0f80d2-b7df-4556-848d-a9f90e6502c6%3A1685463290.316538&_=1685463290.3182983
Requested by: Host: authority.cosmopolitanlasvegas.com
URL: https://authority.cosmopolitanlasvegas.com/account/login?returnUrl=%2Fconnect%2Fauthorize%2Fcallback%3Fclient_id%3DIdentityOnline%26redirect_uri%3Dhttps%253A%252F%252Fwww.cosmopolitanlasvegas.com%252Flogin%252Fauthorize%26scope%3Dprofile%2520openid%2520cosmo-api%2520offline_access%2520api-all-readwrite%26response_type%3Dcode%26state%3DaAYHNwPWGNJihFRWa6yu33JDtlgL32td0sr1L6al
Protocol: H2
Server: 35.244.174.68 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 68.174.244.35.bc.googleusercontent.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://20843572p.rfihub.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date: Tue, 30 May 2023 16:14:50 GMT
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

Redirect headers

date: Tue, 30 May 2023 16:14:50 GMT
via: 1.1 c2b4a332b09677da722930ae336c8bfc.cloudfront.net (CloudFront)
server: lighttpd/1.4.59
x-amz-cf-pop: FRA56-C1
vary: Cookie
x-cache: Miss from cloudfront
content-type: text/html; charset=utf-8
location: https://idsync.rlcdn.com/501709.gif?partner_uid=ed0f80d2-b7df-4556-848d-a9f90e6502c6%3A1685463290.316538&_=1685463290.3182983
content-length: 445
x-amz-cf-id: 9fhfNHMV_A0EmrsNj-sc0fv5zxijaXR_tdioHfoKQK0cVooMu65zFg==

GET
H3

451

501709.gif
idsync.rlcdn.com/ Frame 5A27
Redirect Chain

https://cm.g.doubleclick.net/pixel?&in=0&google_nid=zeta_interactive&google_cm=&google_sc=&google_hm=NTEwODU1OTcyODAwMTI5NTAwMg==&forward=
https://a.rfihub.com/cm?pub=445&in=0&forward=&google_gid=CAESEM3XvzdVttYMSAHxMHIOm8A&google_cver=1
https://live.rezync.com/pixel?c=bd8618c307ae9885a12561b7191e2cea&cid=5108559728001295002&referrer={encSite}&forward=
https://p.rfihub.com/cm?pub=39342&in=0&userid=94d5c9a4-4a71-432c-85ca-0d859ecb1554%3A1685463290.3829129&forward=https%3A//idsync.rlcdn.com/501709.gif%3Fpartner_uid%3D94d5c9a4-4a71-432c-85ca-0d859ec...
https://live.rezync.com/pixel?c=bd8618c307ae9885a12561b7191e2cea&cid=5108559728001295002&referrer={encSite}&forward=https%3A%2F%2Fidsync.rlcdn.com%2F501709.gif%3Fpartner_uid%3D94d5c9a4-4a71-432c-85...
https://idsync.rlcdn.com/501709.gif?partner_uid=94d5c9a4-4a71-432c-85ca-0d859ecb1554%3A1685463290.3829129&_=1685463290.3843358

0
9 B

16ms
16ms

Image
text/plain

35.244.174.68
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://idsync.rlcdn.com/501709.gif?partner_uid=94d5c9a4-4a71-432c-85ca-0d859ecb1554%3A1685463290.3829129&_=1685463290.3843358
Requested by: Host: authority.cosmopolitanlasvegas.com
URL: https://authority.cosmopolitanlasvegas.com/account/login?returnUrl=%2Fconnect%2Fauthorize%2Fcallback%3Fclient_id%3DIdentityOnline%26redirect_uri%3Dhttps%253A%252F%252Fwww.cosmopolitanlasvegas.com%252Flogin%252Fauthorize%26scope%3Dprofile%2520openid%2520cosmo-api%2520offline_access%2520api-all-readwrite%26response_type%3Dcode%26state%3DaAYHNwPWGNJihFRWa6yu33JDtlgL32td0sr1L6al
Protocol: H3
Server: 35.244.174.68 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 68.174.244.35.bc.googleusercontent.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://20843572p.rfihub.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date: Tue, 30 May 2023 16:14:50 GMT
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

Redirect headers

date: Tue, 30 May 2023 16:14:50 GMT
via: 1.1 c2b4a332b09677da722930ae336c8bfc.cloudfront.net (CloudFront)
server: lighttpd/1.4.59
x-amz-cf-pop: FRA56-C1
vary: Cookie
x-cache: Miss from cloudfront
content-type: text/html; charset=utf-8
location: https://idsync.rlcdn.com/501709.gif?partner_uid=94d5c9a4-4a71-432c-85ca-0d859ecb1554%3A1685463290.3829129&_=1685463290.3843358
content-length: 447
x-amz-cf-id: CtUuHhQ-f9d9zjBbq4uqwHvdzQ5zXPcn7KOemzRE12eoZcNf31_nDw==

GET
H/1.1 200
OK setuid
ib.adnxs.com/ Frame 5A27 43 B
1 KB 19ms
15ms Image
image/gif 185.89.210.122
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/setuid?entity=18&code=5108559728001295002

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.89.210.122 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

954.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net

Software

nginx/1.21.3 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://20843572p.rfihub.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 30 May 2023 16:14:50 GMT
AN-X-Request-Uuid: d93aebfb-89eb-4d93-ba93-c5c51b5cc8c9
Server: nginx/1.21.3
Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type: image/gif
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
X-Proxy-Origin: 138.199.38.134; 138.199.38.134; 954.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
Content-Length: 43
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H/1.1

200
OK

demconf.jpg
dpm.demdex.net/ Frame 5A27
Redirect Chain

https://dpm.demdex.net/ibs:dpid=1121&dpuuid=5108559728001295002&redir=
https://dpm.demdex.net/demconf.jpg?et:ibs%7cdata:dpid=1121&dpuuid=5108559728001295002&redir=

42 B
942 B

37ms
37ms

Image
image/gif

52.16.141.94
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dpm.demdex.net/demconf.jpg?et:ibs%7cdata:dpid=1121&dpuuid=5108559728001295002&redir=

Requested by

Protocol

HTTP/1.1

Server

52.16.141.94 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-52-16-141-94.eu-west-1.compute.amazonaws.com

Software

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://20843572p.rfihub.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

DCS: dcs-prod-irl1-1-v048-0c10a81bc.edge-irl1.demdex.com 4 ms
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
content-encoding: gzip
X-Content-Type-Options: nosniff
X-TID: vwByJ2a0QMo=
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Content-Type: image/gif
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection: keep-alive
Content-Length: 59
Expires: Thu, 01 Jan 1970 00:00:00 UTC

Redirect headers

DCS: dcs-prod-irl1-2-v048-0e78ca5d4.edge-irl1.demdex.com 0 ms
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-TID: +SiAoAXDQhM=
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Location: https://dpm.demdex.net/demconf.jpg?et:ibs%7cdata:dpid=1121&dpuuid=5108559728001295002&redir=
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection: keep-alive
Content-Length: 0
Expires: Thu, 01 Jan 1970 00:00:00 UTC

GET
H2 200 Pug
image2.pubmatic.com/AdServer/ Frame 5A27 42 B
424 B 66ms
19ms Image
image/gif 185.64.190.80
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI3MzkmdGw9MTI5NjAw==&piggybackCookie=5108559728001295002&r=
Requested by: Host: authority.cosmopolitanlasvegas.com
URL: https://authority.cosmopolitanlasvegas.com/account/login?returnUrl=%2Fconnect%2Fauthorize%2Fcallback%3Fclient_id%3DIdentityOnline%26redirect_uri%3Dhttps%253A%252F%252Fwww.cosmopolitanlasvegas.com%252Flogin%252Fauthorize%26scope%3Dprofile%2520openid%2520cosmo-api%2520offline_access%2520api-all-readwrite%26response_type%3Dcode%26state%3DaAYHNwPWGNJihFRWa6yu33JDtlgL32td0sr1L6al
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.64.190.80 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://20843572p.rfihub.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

content-type: image/gif; charset=utf-8
date: Tue, 30 May 2023 16:14:49 GMT
cache-control: no-store, no-cache, private
server: nginx
content-length: 42
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

GET
H2 200 sd
us-u.openx.net/w/1.0/ Frame 5A27 43 B
273 B 58ms
27ms Image
image/gif 34.98.64.218
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537073062&val=5108559728001295002&r=
Requested by: Host: authority.cosmopolitanlasvegas.com
URL: https://authority.cosmopolitanlasvegas.com/account/login?returnUrl=%2Fconnect%2Fauthorize%2Fcallback%3Fclient_id%3DIdentityOnline%26redirect_uri%3Dhttps%253A%252F%252Fwww.cosmopolitanlasvegas.com%252Flogin%252Fauthorize%26scope%3Dprofile%2520openid%2520cosmo-api%2520offline_access%2520api-all-readwrite%26response_type%3Dcode%26state%3DaAYHNwPWGNJihFRWa6yu33JDtlgL32td0sr1L6al
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.98.64.218 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/0.0.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://20843572p.rfihub.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 30 May 2023 16:14:50 GMT
via: 1.1 google
server: OXGW/0.0.0
vary: Accept
content-type: image/gif
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
expires: Mon, 26 Jul 1997 05:00:00 GMT

GET
H/1.1

200
OK

match
ps.eyeota.net/ Frame 5A27
Redirect Chain

https://p.rfihub.com/cm?pub=24472&in=1
https://ps.eyeota.net/match?uid=5108559728001295002&bid=omt9pi0

0
344 B

46ms
8ms

Image
text/plain

3.121.27.153
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ps.eyeota.net/match?uid=5108559728001295002&bid=omt9pi0
Requested by: Host: authority.cosmopolitanlasvegas.com
URL: https://authority.cosmopolitanlasvegas.com/account/login?returnUrl=%2Fconnect%2Fauthorize%2Fcallback%3Fclient_id%3DIdentityOnline%26redirect_uri%3Dhttps%253A%252F%252Fwww.cosmopolitanlasvegas.com%252Flogin%252Fauthorize%26scope%3Dprofile%2520openid%2520cosmo-api%2520offline_access%2520api-all-readwrite%26response_type%3Dcode%26state%3DaAYHNwPWGNJihFRWa6yu33JDtlgL32td0sr1L6al
Protocol: HTTP/1.1
Server: 3.121.27.153 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-121-27-153.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://20843572p.rfihub.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

Date: Tue, 30 May 2023 16:14:50 GMT
Content-Length: 0
P3P: CP="CURa ADMa DEVa TAIo PSAo PSDo OUR SAMo BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR", policyref="http://ps.eyeota.net/w3c/p3p.xml"

Redirect headers

Location: https://ps.eyeota.net/match?uid=5108559728001295002&bid=omt9pi0
Date: Tue, 30 May 2023 16:14:50 GMT
Server: Jetty(9.4.51.v20230217)
Content-Length: 0
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

GET
H2 200 cksync.php
contextual.media.net/ Frame 5A27 61 B
624 B 91ms
56ms Image
image/gif 23.52.120.27
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://contextual.media.net/cksync.php?cs=3&type=rkt&ovsid=5108559728001295002

Requested by

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.52.120.27 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-52-120-27.deploy.static.akamaitechnologies.com

Software

Apache /

Resource Hash

cc0e716595a20cd577f4cba25c11b4b54d92311f5f4bf22b992af281cabbc0c7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://20843572p.rfihub.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

pragma: no-cache
strict-transport-security: max-age=31536000
date: Tue, 30 May 2023 16:14:50 GMT
server: Apache
p3p: CP="NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA", CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA, CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA
content-type: image/gif
cache-control: max-age=0, no-cache, no-store
content-length: 61
x-mnet-hl2: E
expires: Tue, 30 May 2023 16:14:50 GMT

GET
H2 200 /
bpi.rtactivate.com/tag/ Frame 5A27 43 B
109 B 360ms
139ms Image
image/gif 52.201.114.204
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://bpi.rtactivate.com/tag/?id=11017&user_id=5108559728001295002
Requested by: Host: authority.cosmopolitanlasvegas.com
URL: https://authority.cosmopolitanlasvegas.com/account/login?returnUrl=%2Fconnect%2Fauthorize%2Fcallback%3Fclient_id%3DIdentityOnline%26redirect_uri%3Dhttps%253A%252F%252Fwww.cosmopolitanlasvegas.com%252Flogin%252Fauthorize%26scope%3Dprofile%2520openid%2520cosmo-api%2520offline_access%2520api-all-readwrite%26response_type%3Dcode%26state%3DaAYHNwPWGNJihFRWa6yu33JDtlgL32td0sr1L6al
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.201.114.204 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-201-114-204.compute-1.amazonaws.com
Software: awselb/2.0 /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://20843572p.rfihub.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date: Tue, 30 May 2023 16:14:50 GMT
server: awselb/2.0
content-length: 43
content-type: image/gif

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame 5A27
Redirect Chain

https://dsum-sec.casalemedia.com/rum?cm_dsp_id=57&external_user_id=5108559728001295002&forward=
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=57&external_user_id=5108559728001295002&forward=&C=1

43 B
766 B

8ms
8ms

Image
image/gif

185.80.39.216
CASALE-MEDIA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=57&external_user_id=5108559728001295002&forward=&C=1
Requested by: Host: authority.cosmopolitanlasvegas.com
URL: https://authority.cosmopolitanlasvegas.com/account/login?returnUrl=%2Fconnect%2Fauthorize%2Fcallback%3Fclient_id%3DIdentityOnline%26redirect_uri%3Dhttps%253A%252F%252Fwww.cosmopolitanlasvegas.com%252Flogin%252Fauthorize%26scope%3Dprofile%2520openid%2520cosmo-api%2520offline_access%2520api-all-readwrite%26response_type%3Dcode%26state%3DaAYHNwPWGNJihFRWa6yu33JDtlgL32td0sr1L6al
Protocol: HTTP/1.1
Server: 185.80.39.216 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://20843572p.rfihub.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 30 May 2023 16:14:50 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type: image/gif
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=499
Content-Length: 43
Expires: 0

Redirect headers

Pragma: no-cache
Date: Tue, 30 May 2023 16:14:50 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Location: /rum?cm_dsp_id=57&external_user_id=5108559728001295002&forward=&C=1
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=500
Content-Length: 0
Expires: 0

GET
H2 451 360947.gif
idsync.rlcdn.com/ Frame 5A27 0
98 B 48ms
16ms Image
text/plain 35.244.174.68
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://idsync.rlcdn.com/360947.gif?partner_uid=5108559728001295002
Requested by: Host: authority.cosmopolitanlasvegas.com
URL: https://authority.cosmopolitanlasvegas.com/account/login?returnUrl=%2Fconnect%2Fauthorize%2Fcallback%3Fclient_id%3DIdentityOnline%26redirect_uri%3Dhttps%253A%252F%252Fwww.cosmopolitanlasvegas.com%252Flogin%252Fauthorize%26scope%3Dprofile%2520openid%2520cosmo-api%2520offline_access%2520api-all-readwrite%26response_type%3Dcode%26state%3DaAYHNwPWGNJihFRWa6yu33JDtlgL32td0sr1L6al
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.174.68 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 68.174.244.35.bc.googleusercontent.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://20843572p.rfihub.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date: Tue, 30 May 2023 16:14:50 GMT
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

GET
H2 200 rocketfuel_sync
x.dlx.addthis.com/e/ Frame 5A27 43 B
191 B 213ms
155ms Image
image/gif 104.111.217.14
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://x.dlx.addthis.com/e/rocketfuel_sync?na_exid=5108559728001295002

Requested by

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

104.111.217.14 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-111-217-14.deploy.static.akamaitechnologies.com

Software

Resource Hash

548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Security Headers

Name	Value
Strict-Transport-Security	max-age=2628000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://20843572p.rfihub.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

expires: Tue, 30 May 2023 16:14:50 GMT
pragma: no-cache
date: Tue, 30 May 2023 16:14:50 GMT
cache-control: max-age=0, no-cache, no-store
strict-transport-security: max-age=2628000
content-length: 43
content-type: image/gif

GET
H/1.1

200

partner
sync.search.spotxchange.com/ Frame 5A27
Redirect Chain

https://sync.search.spotxchange.com/partner?adv_id=7180&uid=5108559728001295002&img=1
https://sync.search.spotxchange.com/partner?adv_id=7180&uid=5108559728001295002&img=1&__user_check__=1&sync_id=1a9c6bfc-ff05-11ed-a2b3-1a377c5d0506

43 B
549 B

32ms
32ms

Image
image/gif

185.94.180.125
SPOTX-AMS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.search.spotxchange.com/partner?adv_id=7180&uid=5108559728001295002&img=1&__user_check__=1&sync_id=1a9c6bfc-ff05-11ed-a2b3-1a377c5d0506
Requested by: Host: authority.cosmopolitanlasvegas.com
URL: https://authority.cosmopolitanlasvegas.com/account/login?returnUrl=%2Fconnect%2Fauthorize%2Fcallback%3Fclient_id%3DIdentityOnline%26redirect_uri%3Dhttps%253A%252F%252Fwww.cosmopolitanlasvegas.com%252Flogin%252Fauthorize%26scope%3Dprofile%2520openid%2520cosmo-api%2520offline_access%2520api-all-readwrite%26response_type%3Dcode%26state%3DaAYHNwPWGNJihFRWa6yu33JDtlgL32td0sr1L6al
Protocol: HTTP/1.1
Server: 185.94.180.125 Amsterdam, Netherlands, ASN35220 (SPOTX-AMS, US),
Reverse DNS
Software: nginx /
Resource Hash: e586a84d8523747f42e510d78e141015b6424cf67d612854e892a7bcedc8ec9e

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://20843572p.rfihub.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

Date: Tue, 30 May 2023 16:14:50 GMT
Server: nginx
Access-Control-Allow-Methods: GET, POST, OPTIONS
Content-Type: image/gif
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
Access-Control-Allow-Credentials: false
X-fe: 109
Connection: keep-alive
Content-Length: 43

Redirect headers

Date: Tue, 30 May 2023 16:14:50 GMT
Server: nginx
Access-Control-Allow-Methods: GET, POST, OPTIONS
Content-Type: text/plain
Location: /partner?adv_id=7180&uid=5108559728001295002&img=1&__user_check__=1&sync_id=1a9c6bfc-ff05-11ed-a2b3-1a377c5d0506
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
Access-Control-Allow-Credentials: false
X-fe: 65
Connection: keep-alive
Content-Length: 0

GET
H2 200 sync
partners.tremorhub.com/ Frame 5A27 43 B
175 B 292ms
92ms Image
image/gif 2600:1f18:612b:4264:d57a:9c78:cd9c:28fc
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://partners.tremorhub.com/sync?UIRF=5108559728001295002&r=SCcdXwdLE2Or
Requested by: Host: authority.cosmopolitanlasvegas.com
URL: https://authority.cosmopolitanlasvegas.com/account/login?returnUrl=%2Fconnect%2Fauthorize%2Fcallback%3Fclient_id%3DIdentityOnline%26redirect_uri%3Dhttps%253A%252F%252Fwww.cosmopolitanlasvegas.com%252Flogin%252Fauthorize%26scope%3Dprofile%2520openid%2520cosmo-api%2520offline_access%2520api-all-readwrite%26response_type%3Dcode%26state%3DaAYHNwPWGNJihFRWa6yu33JDtlgL32td0sr1L6al
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:1f18:612b:4264:d57a:9c78:cd9c:28fc Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: nginx /
Resource Hash: a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://20843572p.rfihub.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

p3p: CP='This is not a P3P policy. See https://telaria.com/privacy-policy/'
date: Tue, 30 May 2023 16:14:50 GMT
server: nginx
content-type: image/gif

GET
H2 200 g.pixel
aa.agkn.com/adscores/ Frame 5A27 43 B
377 B 116ms
33ms Image
image/gif 52.208.135.117
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://aa.agkn.com/adscores/g.pixel?sid=9212192898&rf=5108559728001295002
Requested by: Host: authority.cosmopolitanlasvegas.com
URL: https://authority.cosmopolitanlasvegas.com/account/login?returnUrl=%2Fconnect%2Fauthorize%2Fcallback%3Fclient_id%3DIdentityOnline%26redirect_uri%3Dhttps%253A%252F%252Fwww.cosmopolitanlasvegas.com%252Flogin%252Fauthorize%26scope%3Dprofile%2520openid%2520cosmo-api%2520offline_access%2520api-all-readwrite%26response_type%3Dcode%26state%3DaAYHNwPWGNJihFRWa6yu33JDtlgL32td0sr1L6al
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.208.135.117 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-208-135-117.eu-west-1.compute.amazonaws.com
Software: AAWebServer /
Resource Hash: 98b3d9d20e032f90aca49e9b116225d539ff6fbdb7e42c3c363f63896ac03d2a

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://20843572p.rfihub.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 30 May 2023 16:14:50 GMT
server: AAWebServer
access-control-allow-methods: GET, POST, OPTIONS
p3p: policyref="https://www.agkn.com/p3p/p3p.xml",CP="NOI NID"
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
access-control-allow-headers: accept, cache-control, origin, x-requested-with, x-file-name, content-type
content-length: 43
expires: 0

GET
H2 204 usermatch.gif
beacon.krxd.net/ Frame 5A27 0
338 B 103ms
31ms Image
text/plain 52.209.157.144
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://beacon.krxd.net/usermatch.gif?partner_id=rfuel&partner_user_id=5108559728001295002
Requested by: Host: authority.cosmopolitanlasvegas.com
URL: https://authority.cosmopolitanlasvegas.com/account/login?returnUrl=%2Fconnect%2Fauthorize%2Fcallback%3Fclient_id%3DIdentityOnline%26redirect_uri%3Dhttps%253A%252F%252Fwww.cosmopolitanlasvegas.com%252Flogin%252Fauthorize%26scope%3Dprofile%2520openid%2520cosmo-api%2520offline_access%2520api-all-readwrite%26response_type%3Dcode%26state%3DaAYHNwPWGNJihFRWa6yu33JDtlgL32td0sr1L6al
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.209.157.144 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-209-157-144.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://20843572p.rfihub.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

x-served-by: beacon-n021-dub-prod.krxd.net
date: Tue, 30 May 2023 16:14:50 GMT
cache-control: private, no-cache, no-store
x-request-time: D=46 t=1685463290
p3p: policyref="https://cdn.krxd.net/kruxcontent/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

GET
H2

200

sync
x.bidswitch.net/ul_cb/ Frame 5A27
Redirect Chain

https://x.bidswitch.net/sync?dsp_id=119&user_id=5108559728001295002&expires=30&gdpr={GDPR}&gdpr_consent={GDPR_CONSENT_469}&gdpr_pd={GDPR_PD}
https://x.bidswitch.net/ul_cb/sync?dsp_id=119&user_id=5108559728001295002&expires=30&gdpr={GDPR}&gdpr_consent={GDPR_CONSENT_469}&gdpr_pd={GDPR_PD}

43 B
345 B

9ms
8ms

Image
image/gif

3.65.79.246
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://x.bidswitch.net/ul_cb/sync?dsp_id=119&user_id=5108559728001295002&expires=30&gdpr={GDPR}&gdpr_consent={GDPR_CONSENT_469}&gdpr_pd={GDPR_PD}
Requested by: Host: authority.cosmopolitanlasvegas.com
URL: https://authority.cosmopolitanlasvegas.com/account/login?returnUrl=%2Fconnect%2Fauthorize%2Fcallback%3Fclient_id%3DIdentityOnline%26redirect_uri%3Dhttps%253A%252F%252Fwww.cosmopolitanlasvegas.com%252Flogin%252Fauthorize%26scope%3Dprofile%2520openid%2520cosmo-api%2520offline_access%2520api-all-readwrite%26response_type%3Dcode%26state%3DaAYHNwPWGNJihFRWa6yu33JDtlgL32td0sr1L6al
Protocol: H2
Server: 3.65.79.246 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-65-79-246.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://20843572p.rfihub.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date: Tue, 30 May 2023 16:14:50 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 43
content-type: image/gif

Redirect headers

location: https://x.bidswitch.net/ul_cb/sync?dsp_id=119&user_id=5108559728001295002&expires=30&gdpr={GDPR}&gdpr_consent={GDPR_CONSENT_469}&gdpr_pd={GDPR_PD}
date: Tue, 30 May 2023 16:14:50 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 0

GET
H/1.1

200
OK

cm
p.rfihub.com/ Frame 5A27
Redirect Chain

https://sync-tm.everesttech.net/upi/pid/Mlpt2JaG/?redir=https%3A%2F%2Fp.rfihub.com%2Fcm%3Fin%3D1%26pub%3D21653%26userid%3D%24%7BTM_USER_ID%7D
https://sync-tm.everesttech.net/ct/upi/pid/Mlpt2JaG/?redir=https%3A%2F%2Fp.rfihub.com%2Fcm%3Fin%3D1%26pub%3D21653%26userid%3D%24%7BTM_USER_ID%7D&_test=ZHYg_gAODuEHpQBa
https://p.rfihub.com/cm?in=1&pub=21653&userid=ZHYg_gAODuEHpQBa&_test=ZHYg_gAODuEHpQBa

42 B
1 KB

16ms
14ms

Image
image/gif

193.0.160.130
ROCKETFUEL

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://p.rfihub.com/cm?in=1&pub=21653&userid=ZHYg_gAODuEHpQBa&_test=ZHYg_gAODuEHpQBa
Requested by: Host: authority.cosmopolitanlasvegas.com
URL: https://authority.cosmopolitanlasvegas.com/account/login?returnUrl=%2Fconnect%2Fauthorize%2Fcallback%3Fclient_id%3DIdentityOnline%26redirect_uri%3Dhttps%253A%252F%252Fwww.cosmopolitanlasvegas.com%252Flogin%252Fauthorize%26scope%3Dprofile%2520openid%2520cosmo-api%2520offline_access%2520api-all-readwrite%26response_type%3Dcode%26state%3DaAYHNwPWGNJihFRWa6yu33JDtlgL32td0sr1L6al
Protocol: HTTP/1.1
Server: 193.0.160.130 , United States, ASN54312 (ROCKETFUEL, US),
Reverse DNS
Software: Jetty(9.4.51.v20230217) /
Resource Hash: 47043e4823a6c21a8881de789b4185355330b5804629d23f6b43dd93f5265292

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://20843572p.rfihub.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

Content-Type: image/gif
Date: Tue, 30 May 2023 16:14:50 GMT
Cache-Control: no-cache
Server: Jetty(9.4.51.v20230217)
Content-Length: 42
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

Redirect headers

x-served-by: cache-fra-eddf8230095-FRA
pragma: no-cache
date: Tue, 30 May 2023 16:14:50 GMT
via: 1.1 varnish
server: Varnish
x-timer: S1685463290.476734,VS0,VE0
x-cache: HIT
location: https://p.rfihub.com/cm?in=1&pub=21653&userid=ZHYg_gAODuEHpQBa&_test=ZHYg_gAODuEHpQBa
cache-control: no-cache
accept-ranges: bytes
content-length: 0
retry-after: 0
x-cache-hits: 0

GET
H2 200 / Show response
accdn.lpsnmedia.net/api/account/88246722/configuration/setting/accountproperties/ 6 KB
3 KB 124ms
24ms Script
application/javascript 178.249.97.99
LIVEPERSON

General

Check archive.org

Show headers Download Go to

Full URL

https://accdn.lpsnmedia.net/api/account/88246722/configuration/setting/accountproperties/?cb=accountSettingsCB

Requested by

Host: lptag.liveperson.net
URL: https://lptag.liveperson.net/lptag/api/account/88246722/configuration/applications/taglets/.jsonp?v=2.0&df=undefined&b=undefined

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

178.249.97.99 , United States, ASN11054 (LIVEPERSON, US),

Reverse DNS

lo-accdn.lpsnmedia.net

Software

ws /

Resource Hash

811e57dfa425f18746d554724a44ac1d7fc761c5dda00176fe1a40c0918ebe4c

Security Headers

Name	Value
Strict-Transport-Security	max-age=99999999999; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://authority.cosmopolitanlasvegas.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date: Tue, 30 May 2023 16:14:50 GMT
x-envoy-decorator-operation: lp-accdn-app.default.svc.lokube01.int.liveperson.net:8080/*
x-content-type-options: nosniff
strict-transport-security: max-age=99999999999; includeSubDomains
content-encoding: gzip
server: ws
x-cache-status: EXPIRED
vary: Accept
access-control-allow-methods: GET, POST, PATCH
content-type: application/javascript
access-control-expose-headers: X-Requested-With, X-HTTP-Method-Override, LP-DOMAIN-REFERER, LP-URL, ETag, ac-revision, X-LP-Last-Modified, If-Match, Authentication-Method, Credit-Card-Ref, Automation-Secret, Email-Token, x-lp-host, Lp-Req-Time, date, x-application-context, strict-transport-security, x-content-type-options, x-download-options, x-xss-protection, x-cache-status, x-amz-id-2, x-amz-request-id, expires, last-modified, set-cookie, content-security-policy, x-frame-options
x-envoy-upstream-service-time: 0
access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization, X-HTTP-Method-Override, LP-DOMAIN-REFERER, LP-URL, ETag, ac-revision, X-LP-Last-Modified, If-Match, Authentication-Method, Credit-Card-Ref, Automation-Secret, Email-Token
expires: Tue, 30 May 2023 16:15:50 GMT

GET
H2 200 ui-framework.js Show response
lpcdn-a.lpsnmedia.net/le_unified_window/10.27.1.0-release_5569/ 40 KB
13 KB 38ms
8ms Script
application/javascript 34.149.42.49
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://lpcdn-a.lpsnmedia.net/le_unified_window/10.27.1.0-release_5569/ui-framework.js?version=10.27.1.0-release_5569
Requested by: Host: lptag.liveperson.net
URL: https://lptag.liveperson.net/lptag/api/account/88246722/configuration/applications/taglets/.jsonp?v=2.0&df=undefined&b=undefined
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.149.42.49 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 49.42.149.34.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: 3e4f5d07904cf355da7bfbca5d4eee18a4c09fc9e6a79df958d0bb1225572983

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://authority.cosmopolitanlasvegas.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date: Sat, 20 May 2023 03:28:53 GMT
content-encoding: br
age: 909957
x-guploader-uploadid: ADPycdug_Z8zp6wRdDdB1bS-W8X7VedTmDC2DjKWf4a_MVO11u3QVj6VP6f0zpUiEWza-Z5fP_51M0_Urm1vg0u675_G6tBI2Z8w
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 12458
last-modified: Tue, 16 May 2023 07:53:16 GMT
server: UploadServer
etag: W/"0dfc7fa7d2051d776d5937b7a3a7c4dd"
vary: Accept-Encoding
x-goog-generation: 1684223596823367
x-goog-hash: crc32c=wefPQw==, md5=Dfx/p9IFHXdtWTe3o6fE3Q==
access-control-allow-origin: *
access-control-expose-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization, X-HTTP-Method-Override, LP-DOMAIN-REFERER, LP-URL, ETag, ac-revision, X-LP-Last-Modified, If-Match, Authentication-Method, Credit-Card-Ref, Automation-Secret, Email-Token, x-lp-state-rev
cache-control: max-age=31536000,public
x-goog-stored-content-length: 40455
accept-ranges: none
content-type: application/javascript

GET
H2 200 UMSClientAPI.min.js Show response
lpcdn-a.lpsnmedia.net/le_unified_window/10.27.1.0-release_5569/ 89 KB
25 KB 45ms
15ms Script
application/javascript 34.149.42.49
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://lpcdn-a.lpsnmedia.net/le_unified_window/10.27.1.0-release_5569/UMSClientAPI.min.js?version=10.27.1.0-release_5569
Requested by: Host: lptag.liveperson.net
URL: https://lptag.liveperson.net/lptag/api/account/88246722/configuration/applications/taglets/.jsonp?v=2.0&df=undefined&b=undefined
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.149.42.49 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 49.42.149.34.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: 859bc4211e3119cc7d51b174c5326aabc4eff82eda99e9f7eccfb1796cfdca1b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://authority.cosmopolitanlasvegas.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date: Sat, 20 May 2023 03:28:53 GMT
content-encoding: br
age: 909957
x-guploader-uploadid: ADPycdsnIkkbCD76lacNPoJZ1J3k7SsmwUwx7dhNwqHx7xD2jalbBEbyTgpWmO3ws2B1zfNyh5q1Ig-sVoVwkDHc-OSLOGwIbw2D
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 25095
last-modified: Tue, 16 May 2023 07:53:16 GMT
server: UploadServer
etag: W/"3a47dcee87fde0d961b04c48e5c865b0"
vary: Accept-Encoding
x-goog-generation: 1684223596790742
x-goog-hash: crc32c=cX57mA==, md5=Okfc7of94NlhsExI5chlsA==
access-control-allow-origin: *
access-control-expose-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization, X-HTTP-Method-Override, LP-DOMAIN-REFERER, LP-URL, ETag, ac-revision, X-LP-Last-Modified, If-Match, Authentication-Method, Credit-Card-Ref, Automation-Secret, Email-Token, x-lp-state-rev
cache-control: max-age=31536000,public
x-goog-stored-content-length: 91330
accept-ranges: none
content-type: application/javascript

GET
H2 200 lpChatV3.min.js Show response
lpcdn-a.lpsnmedia.net/le_unified_window/10.27.1.0-release_5569/ 92 KB
26 KB 39ms
9ms Script
application/javascript 34.149.42.49
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://lpcdn-a.lpsnmedia.net/le_unified_window/10.27.1.0-release_5569/lpChatV3.min.js?version=10.27.1.0-release_5569
Requested by: Host: lptag.liveperson.net
URL: https://lptag.liveperson.net/lptag/api/account/88246722/configuration/applications/taglets/.jsonp?v=2.0&df=undefined&b=undefined
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.149.42.49 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 49.42.149.34.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: 5941d1622373ff4da4a0ec6ae2c474a80f2e65763aca377b069690ed4cc26d02

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://authority.cosmopolitanlasvegas.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date: Sat, 20 May 2023 03:28:53 GMT
content-encoding: br
age: 909957
x-guploader-uploadid: ADPycdtvh9AAhgFNNXguLe9lCG8PaPTvDOcn6UCsQt2Zcx3TJ4-kjhPIqoOgeOmy38wHEHKbOaKULpsi4M2KY5SrlbHiPPvu-Dfa
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 26314
last-modified: Tue, 16 May 2023 07:53:17 GMT
server: UploadServer
etag: W/"d32e789b3183ed4536dc36e4cabf74ec"
vary: Accept-Encoding
x-goog-generation: 1684223597289531
x-goog-hash: crc32c=JX6E+w==, md5=0y54mzGD7UU23Dbkyr907A==
access-control-allow-origin: *
access-control-expose-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization, X-HTTP-Method-Override, LP-DOMAIN-REFERER, LP-URL, ETag, ac-revision, X-LP-Last-Modified, If-Match, Authentication-Method, Credit-Card-Ref, Automation-Secret, Email-Token, x-lp-state-rev
cache-control: max-age=31536000,public
x-goog-stored-content-length: 93955
accept-ranges: none
content-type: application/javascript

GET
H2 200 surveylogicinstance.min.js Show response
lpcdn-a.lpsnmedia.net/le_unified_window/10.27.1.0-release_5569/ 8 KB
3 KB 46ms
17ms Script
application/javascript 34.149.42.49
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://lpcdn-a.lpsnmedia.net/le_unified_window/10.27.1.0-release_5569/surveylogicinstance.min.js?version=10.27.1.0-release_5569
Requested by: Host: lptag.liveperson.net
URL: https://lptag.liveperson.net/lptag/api/account/88246722/configuration/applications/taglets/.jsonp?v=2.0&df=undefined&b=undefined
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.149.42.49 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 49.42.149.34.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: 0ca2d5d4dece21114294a8783944cdd00a4351935831b27f9a83b8eb543c6438

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://authority.cosmopolitanlasvegas.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date: Sat, 20 May 2023 03:28:53 GMT
content-encoding: br
age: 909957
x-guploader-uploadid: ADPycdsdGcKvFvHvdNXnNZWm8n8Ujt-9q5fgEwJPbyJ-itvv7_ZSvAAYLISkvjNkLLq8TR5mBBUGaWN5fy3j57eZ-iZbMvPuD7Ms
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2377
last-modified: Tue, 16 May 2023 07:53:16 GMT
server: UploadServer
etag: W/"d53092c1d6e0a7a3d1bb802c67a6e1e9"
vary: Accept-Encoding
x-goog-generation: 1684223596791957
x-goog-hash: crc32c=GIGCsg==, md5=1TCSwdbgp6PRu4AsZ6bh6Q==
access-control-allow-origin: *
access-control-expose-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization, X-HTTP-Method-Override, LP-DOMAIN-REFERER, LP-URL, ETag, ac-revision, X-LP-Last-Modified, If-Match, Authentication-Method, Credit-Card-Ref, Automation-Secret, Email-Token, x-lp-state-rev
cache-control: max-age=31536000,public
x-goog-stored-content-length: 7866
accept-ranges: none
content-type: application/javascript

GET
H2 200 zones Show response
accdn.lpsnmedia.net/api/account/88246722/configuration/le-campaigns/ 2 KB
2 KB 136ms
42ms Script
application/javascript 178.249.97.99
LIVEPERSON

General

Check archive.org

Show headers Download Go to

Full URL

https://accdn.lpsnmedia.net/api/account/88246722/configuration/le-campaigns/zones?fields=id&fields=zoneValue&cb=lpZonesStaticCB

Requested by

Host: lptag.liveperson.net
URL: https://lptag.liveperson.net/lptag/api/account/88246722/configuration/applications/taglets/.jsonp?v=2.0&df=undefined&b=undefined

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

178.249.97.99 , United States, ASN11054 (LIVEPERSON, US),

Reverse DNS

lo-accdn.lpsnmedia.net

Software

ws /

Resource Hash

ebf9705e21d5bfdf0868b6455e788c3491a59f654ee882c1c5dcfaad7168f62a

Security Headers

Name	Value
Strict-Transport-Security	max-age=99999999999; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://authority.cosmopolitanlasvegas.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date: Tue, 30 May 2023 16:14:50 GMT
x-envoy-decorator-operation: lp-accdn-app.default.svc.lokube01.int.liveperson.net:8080/*
x-content-type-options: nosniff
strict-transport-security: max-age=99999999999; includeSubDomains
content-encoding: gzip
server: ws
x-cache-status: EXPIRED
vary: Accept
access-control-allow-methods: GET, POST, PATCH
content-type: application/javascript
access-control-expose-headers: X-Requested-With, X-HTTP-Method-Override, LP-DOMAIN-REFERER, LP-URL, ETag, ac-revision, X-LP-Last-Modified, If-Match, Authentication-Method, Credit-Card-Ref, Automation-Secret, Email-Token, x-lp-host, Lp-Req-Time, date, x-application-context, strict-transport-security, x-content-type-options, x-download-options, x-xss-protection, x-cache-status, x-amz-id-2, x-amz-request-id, expires, last-modified, set-cookie, content-security-policy, x-frame-options
x-envoy-upstream-service-time: 0
access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization, X-HTTP-Method-Override, LP-DOMAIN-REFERER, LP-URL, ETag, ac-revision, X-LP-Last-Modified, If-Match, Authentication-Method, Credit-Card-Ref, Automation-Secret, Email-Token
expires: Tue, 30 May 2023 16:15:50 GMT

GET
H2 200 /
www.facebook.com/tr/ 0
185 B 25ms
7ms Image
text/plain 2a03:2880:f176:84:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=722264932049379&ev=PageView&dl=https%3A%2F%2Fauthority.cosmopolitanlasvegas.com%2Faccount%2Flogin%3FreturnUrl%3D%252Fconnect%252Fauthorize%252Fcallback%253Fclient_id%253DIdentityOnline%2526redirect_uri%253Dhttps%25253A%25252F%25252Fwww.cosmopolitanlasvegas.com%25252Flogin%25252Fauthorize%2526scope%253Dprofile%252520openid%252520cosmo-api%252520offline_access%252520api-all-readwrite%2526response_type%253Dcode%2526state%253DaAYHNwPWGNJihFRWa6yu33JDtlgL32td0sr1L6al&rl=&if=false&ts=1685463290263&sw=1600&sh=1200&v=2.9.104&r=stable&a=trplsojern&ec=0&o=30&fbp=fb.1.1685463290262.1823599126&it=1685463290083&coo=false&tm=1&rqm=GET

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f176:84:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://authority.cosmopolitanlasvegas.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
date: Tue, 30 May 2023 16:14:50 GMT
server: proxygen-bolt
content-type: text/plain
access-control-allow-origin
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 0

GET
H2 200 /
www.facebook.com/tr/ 0
31 B 26ms
7ms Image
text/plain 2a03:2880:f176:84:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=722264932049379&ev=Tracking&dl=https%3A%2F%2Fauthority.cosmopolitanlasvegas.com%2Faccount%2Flogin%3FreturnUrl%3D%252Fconnect%252Fauthorize%252Fcallback%253Fclient_id%253DIdentityOnline%2526redirect_uri%253Dhttps%25253A%25252F%25252Fwww.cosmopolitanlasvegas.com%25252Flogin%25252Fauthorize%2526scope%253Dprofile%252520openid%252520cosmo-api%252520offline_access%252520api-all-readwrite%2526response_type%253Dcode%2526state%253DaAYHNwPWGNJihFRWa6yu33JDtlgL32td0sr1L6al&rl=&if=false&ts=1685463290265&cd[content_type]=hotel&sw=1600&sh=1200&v=2.9.104&r=stable&a=trplsojern&ec=1&o=30&fbp=fb.1.1685463290262.1823599126&it=1685463290083&coo=false&tm=2&rqm=GET

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f176:84:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://authority.cosmopolitanlasvegas.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
date: Tue, 30 May 2023 16:14:50 GMT
server: proxygen-bolt
content-type: text/plain
access-control-allow-origin
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 0

GET
H2 200 desktopEmbedded.js Show response
lpcdn-a.lpsnmedia.net/le_unified_window/10.27.1.0-release_5569/ 983 KB
239 KB 17ms
10ms Script
application/javascript 34.149.42.49
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://lpcdn-a.lpsnmedia.net/le_unified_window/10.27.1.0-release_5569/desktopEmbedded.js?version=10.27.1.0-release_5569
Requested by: Host: lptag.liveperson.net
URL: https://lptag.liveperson.net/lptag/api/account/88246722/configuration/applications/taglets/.jsonp?v=2.0&df=undefined&b=undefined
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.149.42.49 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 49.42.149.34.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: 5e6db8e8290df4a3cc2c84e184c5302d377e10c4619179b71e88e71409bae101

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://authority.cosmopolitanlasvegas.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date: Sat, 20 May 2023 03:36:09 GMT
content-encoding: br
age: 909521
x-guploader-uploadid: ADPycdvaQb85gFQievFmfPcUPq3B7e2GwckFzflAfJfU-mRnMdO8Yv9d__ftRUsGF-k98jUSCgOUYjLkRWi-vnVytRBd4g
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 244288
last-modified: Tue, 16 May 2023 07:53:18 GMT
server: UploadServer
etag: W/"85d4e0749f6e1944cc459dbd77773033"
vary: Accept-Encoding
x-goog-generation: 1684223598353602
x-goog-hash: crc32c=aZLsVw==, md5=hdTgdJ9uGUTMRZ29d3cwMw==
access-control-allow-origin: *
access-control-expose-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization, X-HTTP-Method-Override, LP-DOMAIN-REFERER, LP-URL, ETag, ac-revision, X-LP-Last-Modified, If-Match, Authentication-Method, Credit-Card-Ref, Automation-Secret, Email-Token, x-lp-state-rev
cache-control: max-age=31536000,public
x-goog-stored-content-length: 1006112
accept-ranges: none
content-type: application/javascript

GET
H3 200 kernel.js
onboard.triptease.io/kernel/v6549.76442/ Frame 74E0 62 KB
20 KB 76ms
74ms Other
application/javascript 2606:4700:3033::6815:2773
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://onboard.triptease.io/kernel/v6549.76442/kernel.js?

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:3033::6815:2773 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

716565d1b7a9e63d8f6c12ec21b14a1716eeeba39dd490a673d3f48b59dc8208

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://onboard.triptease.io/kernel/v6549.76442/kernel-host.html?originHost=authority.cosmopolitanlasvegas.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date: Tue, 30 May 2023 16:14:50 GMT
strict-transport-security: max-age=15552000
content-encoding: br
cf-cache-status: HIT
x-goog-meta-git-hash: 2d805b421166b4fc8cc4e3eabbacd1bcb13b00c1
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 14692
x-guploader-uploadid: ADPycdtQGKvvM1F04vSv5ZImCv7e8K_fdQJgu8et-lFH4X5NN1DZOn28cbhNtIiBZYDXz7xSL5twIUzJpIQ6bh-t1lOofl2Btvyb
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
x-goog-meta-build-version: 6549.76442
alt-svc: h3=":443"; ma=86400
last-modified: Tue, 30 May 2023 12:01:55 GMT
server: cloudflare
etag: W/"910285789d382a7532a4b05ae2828d7e"
vary: Accept-Encoding
x-goog-generation: 1685448114979883
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
x-goog-hash: crc32c=Ix+aFA==, md5=kQKFeJ04KnUypLBa4oKNfg==
access-control-expose-headers: Content-Type
cache-control: public, max-age=31536000
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=PHDWDO8SLDxEal%2FfPgeFuDkaELd0Os498vSrpUvP85Jbji1a4%2BcJuppTNfafx6rrfwyrM%2Bj5ZBfP0pjjt0XM4gnJqIFvZ%2F5tz1B3R0eXCD9iXaWJp8w2sw1riPHMzLCeGq6YQMg47WuPcBwioRIOVOXDDw%3D%3D"}],"group":"cf-nel","max_age":604800}
x-goog-stored-content-length: 63658
cf-ray: 7cf845bc6b8ebbc7-FRA
expires: Wed, 29 May 2024 12:09:47 GMT

GET
H2 200 clarity.js Show response
www.clarity.ms/s/0.7.8/ 57 KB
20 KB 9ms
9ms Script
application/javascript 2620:1ec:4f:1::44
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://www.clarity.ms/s/0.7.8/clarity.js
Requested by: Host: www.clarity.ms
URL: https://www.clarity.ms/tag/uet/151002868
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2620:1ec:4f:1::44 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: 9987dcc652130026523219440b654a3e307d16f186019031ad60a28d6f73aa2a

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://authority.cosmopolitanlasvegas.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date: Tue, 30 May 2023 16:14:50 GMT
content-encoding: br
last-modified: Tue, 30 May 2023 02:32:08 GMT
x-azure-ref-originshield: 0Mvh1ZAAAAAAxC5Gu3Uc3RolVSv3dNawORlJBMjMxMDUwNDE4MDUzADZjZmJlZWUwLTUwMjctNDg0Yi04OTY3LTRhMjlhZjc3ZjFlMQ==
etag: "0x8DB60B610B985EC"
x-azure-ref: 0+iB2ZAAAAACibpPpVHRgRJh2cL3+MLuERlJBMzFFREdFMDMxNwA2Y2ZiZWVlMC01MDI3LTQ4NGItODk2Ny00YTI5YWY3N2YxZTE=
x-cache: TCP_HIT
content-type: application/javascript;charset=utf-8
access-control-allow-origin: *
x-ms-request-id: e65bfcc7-801e-0015-13bc-923968000000
cache-control: public, max-age=86400
x-ms-version: 2018-03-28
accept-ranges: bytes

GET
H3 200 storage.secure.min.html Show response
lpcdn-a.lpsnmedia.net/le_secure_storage/3.20.0.0-release_5080/ Frame 47F9 39 KB
13 KB 9ms
8ms Document
text/html 34.149.42.49
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://lpcdn-a.lpsnmedia.net/le_secure_storage/3.20.0.0-release_5080/storage.secure.min.html?loc=https%3A%2F%2Fauthority.cosmopolitanlasvegas.com&site=88246722&env=prod&accdn=accdn.lpsnmedia.net
Requested by: Host: lptag.liveperson.net
URL: https://lptag.liveperson.net/lptag/api/account/88246722/configuration/applications/taglets/.jsonp?v=2.0&df=undefined&b=undefined
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 34.149.42.49 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 49.42.149.34.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: 287cdbeac6168db5e2e7a1320b41059ca7969631f4b2d048dc8faa37d5e8fb48

Request headers

Referer: https://authority.cosmopolitanlasvegas.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: none
access-control-allow-origin: *
access-control-expose-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization, X-HTTP-Method-Override, LP-DOMAIN-REFERER, LP-URL, ETag, ac-revision, X-LP-Last-Modified, If-Match, Authentication-Method, Credit-Card-Ref, Automation-Secret, Email-Token, x-lp-state-rev
age: 971
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public,max-age=3600
content-encoding: br
content-length: 13678
content-type: text/html
date: Tue, 30 May 2023 15:58:39 GMT
etag: W/"c324135b527679ce95ee8393a719af9d"
last-modified: Sun, 14 May 2023 01:46:40 GMT
server: UploadServer
vary: Accept-Encoding
x-goog-generation: 1684028800306695
x-goog-hash: crc32c=Au+7sg== md5=wyQTW1J2ec6V7oOTpxmvnQ==
x-goog-metageneration: 1
x-goog-storage-class: MULTI_REGIONAL
x-goog-stored-content-encoding: identity
x-goog-stored-content-length: 39463
x-guploader-uploadid: ADPycdtWQlGk_aTS8hpB76iRtZju9CeR3yCez9DZDM4Tf5a-9KxsdHfkDkg_ZXEifxA4_XmaQ5nZG6LruZHdRrp8HD5eDX2mTbCN

GET
H3 200 default.js Show response
onboard.triptease.io/integrations/v6549.76442/ 150 KB
48 KB 54ms
38ms Script
application/javascript 2606:4700:3033::6815:2773
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://onboard.triptease.io/integrations/v6549.76442/default.js

Requested by

Host: onboard.triptease.io
URL: https://onboard.triptease.io/bootstrap.js?integrationId=01E4X5KNES5SZ07J305WWVJE8C

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:3033::6815:2773 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

6054d9e523ef631e292b2d961cc669b048d7d7ff69b688810c685437c0781673

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

Referer: https://authority.cosmopolitanlasvegas.com/
Origin: https://authority.cosmopolitanlasvegas.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date: Tue, 30 May 2023 16:14:50 GMT
strict-transport-security: max-age=15552000
content-encoding: br
cf-cache-status: MISS
x-goog-meta-git-hash: 2d805b421166b4fc8cc4e3eabbacd1bcb13b00c1
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-guploader-uploadid: ADPycduI_GD9DUdnK0sB4AEboDYQqJzD7XOgZOQvYg6EfOhPkUr0D9FPXG1FO--FFuUDFFKmOcGOuM6qkCtFr8RK2FOKF5rnWZjY
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
x-goog-meta-build-version: 6549.76442
alt-svc: h3=":443"; ma=86400
last-modified: Tue, 30 May 2023 12:07:12 GMT
server: cloudflare
etag: W/"0fa3b1825b8accfb908cb12a6083c43a"
vary: Accept-Encoding
x-goog-generation: 1685448432272280
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
x-goog-hash: crc32c=fIhvxQ==, md5=D6OxgluKzPuQjLEqYIPEOg==
access-control-expose-headers: Content-Length, Content-Type, Date, Server, Transfer-Encoding, X-GUploader-UploadID, X-Google-Trace
cache-control: public, max-age=31536000
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=0V78AwI6lDpdkKC%2Ft%2FfRGfBBUYSYyR5Io0ehYLAzksQGrcd8N7X4jWJ55oFl4WUCl%2BuOfj2IBoHOLaKNtWhiQLN20N0rDVd5LuBi4oFK87L1JTLoX%2BmxWTUPNRli%2FE1tA7vDm8IFX5z7LVb38cW65Pc8QA%3D%3D"}],"group":"cf-nel","max_age":604800}
x-goog-stored-content-length: 154043
cf-ray: 7cf845bd9842036e-FRA
expires: Wed, 29 May 2024 16:11:47 GMT

POST
H/1.1 204
No Content collect Show response
s.clarity.ms/ 0
314 B 293ms
97ms XHR
text/plain 23.96.124.68
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://s.clarity.ms/collect
Requested by: Host: www.clarity.ms
URL: https://www.clarity.ms/s/0.7.8/clarity.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.96.124.68 Tappahannock, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: nginx/1.18.0 (Ubuntu) /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept: application/x-clarity-gzip
Referer: https://authority.cosmopolitanlasvegas.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

Access-Control-Allow-Origin: https://authority.cosmopolitanlasvegas.com
Date: Tue, 30 May 2023 16:14:50 GMT
Access-Control-Allow-Credentials: true
Server: nginx/1.18.0 (Ubuntu)
Connection: keep-alive
Vary: Origin
Request-Context: appId=cid-v1:b1d896b3-bec7-448b-b764-240152e813e8

GET
H3 200 storage.secure.min.js Show response
lpcdn-a.lpsnmedia.net/le_secure_storage/3.20.0.0-release_5080/ 37 KB
13 KB 9ms
8ms Script
application/javascript 34.149.42.49
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://lpcdn-a.lpsnmedia.net/le_secure_storage/3.20.0.0-release_5080/storage.secure.min.js?loc=https%3A%2F%2Fauthority.cosmopolitanlasvegas.com&site=88246722&force=1&env=prod&accdn=accdn.lpsnmedia.net
Requested by: Host: lptag.liveperson.net
URL: https://lptag.liveperson.net/lptag/api/account/88246722/configuration/applications/taglets/.jsonp?v=2.0&df=undefined&b=undefined
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 34.149.42.49 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 49.42.149.34.bc.googleusercontent.com
Software: UploadServer /
Resource Hash: a729f36b3c8810b6c5d3de55e61ee4e1737f8e09ccbfc9c6a27a153e8fcf5d48

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://authority.cosmopolitanlasvegas.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date: Tue, 30 May 2023 16:14:35 GMT
content-encoding: br
age: 15
x-guploader-uploadid: ADPycdsoZQb87_8Om2kqyqdX8zvC5qNi0iELO0JL_5iG5Brp_mwhE5eqjpIezV1YRRuS9cGofDRb2oj-n0YGKOJ9TVJNEg
x-goog-storage-class: MULTI_REGIONAL
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13407
last-modified: Sun, 14 May 2023 01:46:40 GMT
server: UploadServer
etag: W/"c45eeed74a24f46b0e7a5c5faaae4731"
vary: Accept-Encoding
x-goog-generation: 1684028800330369
x-goog-hash: crc32c=s01eVg==, md5=xF7u10ok9GsOelxfqq5HMQ==
access-control-allow-origin: *
access-control-expose-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization, X-HTTP-Method-Override, LP-DOMAIN-REFERER, LP-URL, ETag, ac-revision, X-LP-Last-Modified, If-Match, Authentication-Method, Credit-Card-Ref, Automation-Secret, Email-Token, x-lp-state-rev
cache-control: public,max-age=3600
x-goog-stored-content-length: 38358
accept-ranges: none
content-type: application/javascript

GET
H2 200 88246722 Show response
va.v.liveperson.net/api/js/ 244 B
1 KB 520ms
187ms Script
application/javascript 208.89.12.87
LIVEPERSON

General

Check archive.org

Show headers Download Go to

Full URL

https://va.v.liveperson.net/api/js/88246722?&cb=lpCb18937x62507&t=sp&ts=1685463290238&pid=5836859472&tid=6837298768&pt=Come%20in%20and%20play%20-%20Cosmopolitan.OAuth&u=https%3A%2F%2Fauthority.cosmopolitanlasvegas.com%2Faccount%2Flogin%3FreturnUrl%3D%252Fconnect%252Fauthorize%252Fcallback%253Fclient_id%253DIdentityOnline%2526redirect_uri%253Dhttps%25253A%25252F%25252Fwww.cosmopolitanlasvegas.com%25252Flogin%25252Fauthorize%2526scope%253Dprofile%252520openid%252520cosmo-api%252520offline_access%252520api-all-readwrite%2526response_type%253Dcode%2526state%253DaAYHNwPWGNJihFRWa6yu33JDtlgL32td0sr1L6al&df=0&os=0&identities=%5B%7B%22iss%22%3A%22LivePerson%22%2C%22acr%22%3A%220%22%7D%5D

Requested by

Host: lptag.liveperson.net
URL: https://lptag.liveperson.net/lptag/api/account/88246722/configuration/applications/taglets/.jsonp?v=2.0&df=undefined&b=undefined

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

208.89.12.87 , United States, ASN11054 (LIVEPERSON, US),

Reverse DNS

va.v.liveperson.net

Software

ws /

Resource Hash

021ae3202f13a58edf75fc2fd0a0bb0422e8953f2d3edf65e929b4f8bd663678

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://authority.cosmopolitanlasvegas.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date: Tue, 30 May 2023 16:14:50 GMT
strict-transport-security: max-age=31536000; includeSubDomains
content-encoding: gzip
server: ws
access-control-allow-methods: GET, POST, PATCH
content-type: application/javascript
access-control-expose-headers: X-Requested-With, X-HTTP-Method-Override, LP-DOMAIN-REFERER, LP-URL, ETag, ac-revision, X-LP-Last-Modified, If-Match, Authentication-Method, Credit-Card-Ref, Automation-Secret, Email-Token, x-lp-host, Lp-Req-Time, date, x-application-context, strict-transport-security, x-content-type-options, x-download-options, x-xss-protection, x-cache-status, x-amz-id-2, x-amz-request-id, expires, last-modified, set-cookie, content-security-policy, x-frame-options
cache-control: no-store
access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization, X-HTTP-Method-Override, LP-DOMAIN-REFERER, LP-URL, ETag, ac-revision, X-LP-Last-Modified, If-Match, Authentication-Method, Credit-Card-Ref, Automation-Secret, Email-Token

GET
H2

200

src=6499811;dc_pre=CKvD84W4nf8CFdfFsgodtYsPQA;type=invmedia;cat=mgm_c00;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;gdpr=$%7BGDPR%7D;gdpr_consent=$%7BGDPR_CONSENT_755%7D;ord=1
adservice.google.com/ddm/fls/z/ Frame 8BF4
Redirect Chain

https://ad.doubleclick.net/ddm/activity/src=6499811;type=invmedia;cat=mgm_c00;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;gdpr=$%7BGDPR%7D;gdpr_consent=$%7BGDPR_CONSENT_755%7D;ord=1?
https://ad.doubleclick.net/ddm/activity/src=6499811;dc_pre=CKvD84W4nf8CFdfFsgodtYsPQA;type=invmedia;cat=mgm_c00;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;gdpr=$%7BGDPR%7D;gdpr_c...
https://adservice.google.com/ddm/fls/z/src=6499811;dc_pre=CKvD84W4nf8CFdfFsgodtYsPQA;type=invmedia;cat=mgm_c00;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;gdpr=$%7BGDPR%7D;gdpr_co...

42 B
107 B

45ms
44ms

Image
image/gif

2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://adservice.google.com/ddm/fls/z/src=6499811;dc_pre=CKvD84W4nf8CFdfFsgodtYsPQA;type=invmedia;cat=mgm_c00;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;gdpr=$%7BGDPR%7D;gdpr_consent=$%7BGDPR_CONSENT_755%7D;ord=1

Requested by

Host: ciqtracking.com
URL: https://ciqtracking.com/p/v/2/63990d17f870814e3d22fa1e/format/iframe?page=https%3A%2F%2Fauthority.cosmopolitanlasvegas.com%2Faccount%2Flogin%3FreturnUrl%3D%252Fconnect%252Fauthorize%252Fcallback%253Fclient_id%253DIdentityOnline%2526redirect_uri%253Dhttps%25253A%25252F%25252Fwww.cosmopolitanlasvegas.com%25252Flogin%25252Fauthorize%2526scope%253Dprofile%252520openid%252520cosmo-api%252520offline_access%252520api-all-readwrite%2526response_type%253Dcode%2526state%253DaAYHNwPWGNJihFRWa6yu33JDtlgL32td0sr1L6al

Protocol

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://ciqtracking.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 30 May 2023 16:14:51 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Tue, 30 May 2023 16:14:50 GMT
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://adservice.google.com/ddm/fls/z/src=6499811;dc_pre=CKvD84W4nf8CFdfFsgodtYsPQA;type=invmedia;cat=mgm_c00;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;gdpr=$%7BGDPR%7D;gdpr_consent=$%7BGDPR_CONSENT_755%7D;ord=1
content-type: text/html; charset=UTF-8
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 88246722 Show response
va.v.liveperson.net/api/js/ 110 B
899 B 96ms
96ms Script
application/javascript 208.89.12.87
LIVEPERSON

General

Check archive.org

Show headers Download Go to

Full URL

https://va.v.liveperson.net/api/js/88246722?sid=jxdR5NjORHOEz3HOlCKXBg&cb=lpCb1289x56063&t=pl&ts=1685463290532&pid=5836859472&tid=6837298768&vid=I4OWE4NWVjYmVjM2M3MjY3

Requested by

Host: lptag.liveperson.net
URL: https://lptag.liveperson.net/lptag/api/account/88246722/configuration/applications/taglets/.jsonp?v=2.0&df=undefined&b=undefined

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

208.89.12.87 , United States, ASN11054 (LIVEPERSON, US),

Reverse DNS

va.v.liveperson.net

Software

ws /

Resource Hash

104578954004889160a0a8b698f99f9e446582afb1779182523be8a4bc4f1d02

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://authority.cosmopolitanlasvegas.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date: Tue, 30 May 2023 16:14:51 GMT
strict-transport-security: max-age=31536000; includeSubDomains
content-encoding: gzip
server: ws
access-control-allow-methods: GET, POST, PATCH
content-type: application/javascript
access-control-expose-headers: X-Requested-With, X-HTTP-Method-Override, LP-DOMAIN-REFERER, LP-URL, ETag, ac-revision, X-LP-Last-Modified, If-Match, Authentication-Method, Credit-Card-Ref, Automation-Secret, Email-Token, x-lp-host, Lp-Req-Time, date, x-application-context, strict-transport-security, x-content-type-options, x-download-options, x-xss-protection, x-cache-status, x-amz-id-2, x-amz-request-id, expires, last-modified, set-cookie, content-security-policy, x-frame-options
cache-control: no-store
access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization, X-HTTP-Method-Override, LP-DOMAIN-REFERER, LP-URL, ETag, ac-revision, X-LP-Last-Modified, If-Match, Authentication-Method, Credit-Card-Ref, Automation-Secret, Email-Token

GET
H2

200

c.gif
c.clarity.ms/
Redirect Chain

https://c.clarity.ms/c.gif
https://c.bing.com/c.gif?ctsa=mr&CtsSyncId=3505E55E6F4C46A5A775AADD5DA39E1B&RedC=c.clarity.ms&MXFR=2308A69A6F7B6C440675B5BB6B7B62A9
https://c.clarity.ms/c.gif?ctsa=mr&CtsSyncId=3505E55E6F4C46A5A775AADD5DA39E1B&MUID=3A9A8AC7A1DA69A404CB99E6A07668BA

42 B
444 B

30ms
30ms

Image
image/gif

68.219.88.97
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://c.clarity.ms/c.gif?ctsa=mr&CtsSyncId=3505E55E6F4C46A5A775AADD5DA39E1B&MUID=3A9A8AC7A1DA69A404CB99E6A07668BA
Protocol: H2
Server: 68.219.88.97 Dublin, Ireland, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash: 99c2917ee5b2a01459a923bdd1c676f15ee73b62b87f696e6735312d26f51e12

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://authority.cosmopolitanlasvegas.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 30 May 2023 16:14:51 GMT
last-modified: Thu, 04 May 2023 15:33:28 GMT
server: Microsoft-IIS/10.0
etag: "6de038c69d7ed91:0"
x-powered-by: ASP.NET
content-type: image/gif
p3p: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
cache-control: private, no-cache, proxy-revalidate, no-store
accept-ranges: bytes
content-length: 42

Redirect headers

pragma: no-cache
date: Tue, 30 May 2023 16:14:50 GMT
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: DB750BCF97274C15804763F6791A5DFC Ref B: FRA31EDGE0710 Ref C: 2023-05-30T16:14:51Z
x-powered-by: ASP.NET
x-cache: CONFIG_NOCACHE
p3p: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
location: https://c.clarity.ms/c.gif?ctsa=mr&CtsSyncId=3505E55E6F4C46A5A775AADD5DA39E1B&MUID=3A9A8AC7A1DA69A404CB99E6A07668BA
cache-control: private, no-cache, proxy-revalidate, no-store
content-length: 0

GET
H/1.1 200
OK vt-226.js Show response
vt.myvisualiq.net/2/RCs7mM0Lvog02Tyt9Qd4Uw%3D%3D/ 16 KB
5 KB 59ms
18ms Script
application/x-javascript 18.66.112.57
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://vt.myvisualiq.net/2/RCs7mM0Lvog02Tyt9Qd4Uw%3D%3D/vt-226.js
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-TXCSKP
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 18.66.112.57 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-66-112-57.fra56.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: d1b7a617951177d643abbae142ec04a01f273d9ce1434123035cb44c54fd60db

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://authority.cosmopolitanlasvegas.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

x-amz-version-id: PlbwUm5RtzTUQ3DBcA7nk5S6rBO1Vslg
Content-Encoding: gzip
Via: 1.1 f7d063966b06905209f8790f5fd607e2.cloudfront.net (CloudFront)
Date: Tue, 30 May 2023 00:52:53 GMT
x-amz-request-id: HGCNFNVNHK9JB444
X-Amz-Cf-Pop: FRA56-P5
x-amz-server-side-encryption: AES256
Age: 55319
Transfer-Encoding: chunked
X-Cache: Hit from cloudfront
cross-origin-resource-policy: cross-origin
Connection: keep-alive
x-amz-id-2: qee8L9u2DM0nJHzbqP17lrI2JN0XDnsxgxBhM49ZBFe25gsjhQqmOK9vcUOodbmJtzXNW/+zYXE=
Last-Modified: Mon, 31 Oct 2022 13:02:38 GMT
Server: AmazonS3
ETag: W/"97605ac6dfb9708f58351f703c3b1d8f"
Vary: Accept-Encoding
Content-Type: application/x-javascript
access-control-allow-origin: *
X-Amz-Cf-Id: Llukw-MlKHg2-7POfYphHBEQZ0cyKGz6O7sSXi4MQZA7Dv10NmjI9Q==

GET
H/1.1 200
OK activity_pixel Show response
t.myvisualiq.net/ 0
273 B 8ms
7ms Script
text/javascript 35.157.143.185
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://t.myvisualiq.net/activity_pixel?pt=s&et=a&r=23234765&ago=212&ao=849&px=343&ord=[order_id]&revenue=[revenue]&othercookie_id=false
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-TXCSKP
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.157.143.185 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-35-157-143-185.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://authority.cosmopolitanlasvegas.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

access-control-allow-origin: *
Date: Tue, 30 May 2023 16:14:51 GMT
Cache-Control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
Connection: keep-alive
Content-Length: 0
Content-Type: text/javascript; charset=UTF-8

GET
H/1.1

200
OK

sync
t.myvisualiq.net/
Redirect Chain

https://tapestry.tapad.com/tapestry/1?ta_partner_id=950&ta_redirect=https%3A%2F%2Ft.myvisualiq.net%2Fsync%3Fprid%3D1001%26ao%3D0%26pruuid%3DTAPAD_%24%7BIDS%3Akey%7D
https://t.myvisualiq.net/sync?prid=1001&ao=0&pruuid=TAPAD_4c76a668-a98f-4877-aab5-6cb9e59f8e89

43 B
296 B

7ms
7ms

Image
image/gif

35.157.143.185
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://t.myvisualiq.net/sync?prid=1001&ao=0&pruuid=TAPAD_4c76a668-a98f-4877-aab5-6cb9e59f8e89
Protocol: HTTP/1.1
Server: 35.157.143.185 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-35-157-143-185.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://authority.cosmopolitanlasvegas.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

access-control-allow-origin: *
Date: Tue, 30 May 2023 16:14:51 GMT
Cache-Control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
Connection: keep-alive
Content-Length: 43
Content-Type: image/gif

Redirect headers

location: https://t.myvisualiq.net/sync?prid=1001&ao=0&pruuid=TAPAD_4c76a668-a98f-4877-aab5-6cb9e59f8e89
date: Tue, 30 May 2023 16:14:51 GMT
strict-transport-security: max-age=31536000
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
p3p: policyref="http://tapad-taptags.s3.amazonaws.com/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"

GET
H3

451

420356.gif
idsync.rlcdn.com/
Redirect Chain

https://t.myvisualiq.net/sync?prid=1002&ao=0&red=https://idsync.rlcdn.com/420356.gif?partner_uid=${UUID}
https://idsync.rlcdn.com/420356.gif?partner_uid=9042862c-9508-45ba-abe2-343ff3b7e3c8

0
9 B

16ms
16ms

Image
text/plain

35.244.174.68
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://idsync.rlcdn.com/420356.gif?partner_uid=9042862c-9508-45ba-abe2-343ff3b7e3c8
Protocol: H3
Server: 35.244.174.68 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 68.174.244.35.bc.googleusercontent.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://authority.cosmopolitanlasvegas.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date: Tue, 30 May 2023 16:14:51 GMT
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

Redirect headers

access-control-allow-origin: *
Location: https://idsync.rlcdn.com/420356.gif?partner_uid=9042862c-9508-45ba-abe2-343ff3b7e3c8
Date: Tue, 30 May 2023 16:14:51 GMT
Cache-Control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
Connection: keep-alive
Content-Length: 0

GET
H2

200

21398
tags.bluekai.com/site/
Redirect Chain

https://t.myvisualiq.net/sync?prid=BUKIPNR1&red=https://tags.bluekai.com/site/21398?id=$%7BUUID%7D
https://tags.bluekai.com/site/21398?id=9042862c-9508-45ba-abe2-343ff3b7e3c8

62 B
227 B

172ms
149ms

Image
image/gif

104.111.217.14
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tags.bluekai.com/site/21398?id=9042862c-9508-45ba-abe2-343ff3b7e3c8
Protocol: H2
Server: 104.111.217.14 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-111-217-14.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 0af3aae90b7de9fdceee2ab421378ea2f54c74be81ef43fc6c1790a032755d80

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://authority.cosmopolitanlasvegas.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV", policyref="http://tags.bluekai.com/w3c/p3p.xml"
date: Tue, 30 May 2023 16:14:51 GMT
content-length: 62
content-type: image/gif

Redirect headers

access-control-allow-origin: *
Location: https://tags.bluekai.com/site/21398?id=9042862c-9508-45ba-abe2-343ff3b7e3c8
Date: Tue, 30 May 2023 16:14:51 GMT
Cache-Control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
Connection: keep-alive
Content-Length: 0

GET
H/1.1

200
OK

sync
t.myvisualiq.net/
Redirect Chain

https://t.myvisualiq.net/sync?prid=AOEPNR1&ao=0&red=https%3A%2F%2Fdpm.demdex.net%2Fibs%3Adpid%3D125310%26dpuuid%3D%24%7BUUID%7D%26redir%3Dhttps%253A%252F%252Ft.myvisualiq.net%252Fsync%253Fprid%253D...
https://dpm.demdex.net/ibs:dpid=125310&dpuuid=9042862c-9508-45ba-abe2-343ff3b7e3c8&redir=https%3A%2F%2Ft.myvisualiq.net%2Fsync%3Fprid%3DAOEPNR1%26ao%3D0%26pruuid%3D%24%7BDD_UUID%7D
https://t.myvisualiq.net/sync?prid=AOEPNR1&ao=0&pruuid=28120536432800738234126528738796146679

43 B
296 B

7ms
7ms

Image
image/gif

35.157.143.185
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://t.myvisualiq.net/sync?prid=AOEPNR1&ao=0&pruuid=28120536432800738234126528738796146679
Protocol: HTTP/1.1
Server: 35.157.143.185 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-35-157-143-185.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://authority.cosmopolitanlasvegas.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

access-control-allow-origin: *
Date: Tue, 30 May 2023 16:14:51 GMT
Cache-Control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
Connection: keep-alive
Content-Length: 43
Content-Type: image/gif

Redirect headers

DCS: dcs-prod-irl1-1-v048-0d8a0b8fe.edge-irl1.demdex.com 2 ms
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-TID: LQlbbVskQpo=
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Location: https://t.myvisualiq.net/sync?prid=AOEPNR1&ao=0&pruuid=28120536432800738234126528738796146679
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection: keep-alive
Content-Length: 0
Expires: Thu, 01 Jan 1970 00:00:00 UTC

GET
H2

200

tr
www.facebook.com/
Redirect Chain

https://t.myvisualiq.net/sync?prid=123&ao=0&red=https%3A%2F%2Fwww.facebook.com%2Ftr%3Fid%3D1626311104111572%26ev%3DPageView%26cd%5Border_id%5D%3D%24%7BUUID%7D%26dpo%3DLDU%26dpoco%3D0%26dpost%3D0
https://www.facebook.com/tr?id=1626311104111572&ev=PageView&cd[order_id]=9042862c-9508-45ba-abe2-343ff3b7e3c8&dpo=LDU&dpoco=0&dpost=0

0
54 B

8ms
6ms

Image
text/plain

2a03:2880:f176:84:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr?id=1626311104111572&ev=PageView&cd[order_id]=9042862c-9508-45ba-abe2-343ff3b7e3c8&dpo=LDU&dpoco=0&dpost=0

Protocol

Server

2a03:2880:f176:84:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://authority.cosmopolitanlasvegas.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
date: Tue, 30 May 2023 16:14:51 GMT
server: proxygen-bolt
content-type: text/plain
access-control-allow-origin
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 0

Redirect headers

access-control-allow-origin: *
Location: https://www.facebook.com/tr?id=1626311104111572&ev=PageView&cd[order_id]=9042862c-9508-45ba-abe2-343ff3b7e3c8&dpo=LDU&dpoco=0&dpost=0
Date: Tue, 30 May 2023 16:14:51 GMT
Cache-Control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
Connection: keep-alive
Content-Length: 0

GET
H/1.1 200
OK sync_pixel
t.myvisualiq.net/ 43 B
296 B 21ms
7ms Image
image/gif 35.157.143.185
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://t.myvisualiq.net/sync_pixel?r=7944249&ago=212&ao=849&p1_eml=|||&p1_uid=
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.157.143.185 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-35-157-143-185.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://authority.cosmopolitanlasvegas.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

access-control-allow-origin: *
Date: Tue, 30 May 2023 16:14:51 GMT
Cache-Control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
Connection: keep-alive
Content-Length: 43
Content-Type: image/gif

POST
H/1.1 204
No Content collect Show response
s.clarity.ms/ 0
314 B 93ms
93ms XHR
text/plain 23.96.124.68
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://s.clarity.ms/collect
Requested by: Host: www.clarity.ms
URL: https://www.clarity.ms/s/0.7.8/clarity.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.96.124.68 Tappahannock, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: nginx/1.18.0 (Ubuntu) /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept: application/x-clarity-gzip
Referer: https://authority.cosmopolitanlasvegas.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

Access-Control-Allow-Origin: https://authority.cosmopolitanlasvegas.com
Date: Tue, 30 May 2023 16:14:51 GMT
Access-Control-Allow-Credentials: true
Server: nginx/1.18.0 (Ubuntu)
Connection: keep-alive
Vary: Origin
Request-Context: appId=cid-v1:b1d896b3-bec7-448b-b764-240152e813e8

GET
H3 200 /
www.facebook.com/tr/ 0
18 B 7ms
7ms Image
text/plain 2a03:2880:f176:84:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=722264932049379&ev=Microdata&dl=https%3A%2F%2Fauthority.cosmopolitanlasvegas.com%2Faccount%2Flogin%3FreturnUrl%3D%252Fconnect%252Fauthorize%252Fcallback%253Fclient_id%253DIdentityOnline%2526redirect_uri%253Dhttps%25253A%25252F%25252Fwww.cosmopolitanlasvegas.com%25252Flogin%25252Fauthorize%2526scope%253Dprofile%252520openid%252520cosmo-api%252520offline_access%252520api-all-readwrite%2526response_type%253Dcode%2526state%253DaAYHNwPWGNJihFRWa6yu33JDtlgL32td0sr1L6al&rl=&if=false&ts=1685463291768&cd[DataLayer]=%5B%5D&cd[Meta]=%7B%22title%22%3A%22Come%20in%20and%20play%20-%20Cosmopolitan.OAuth%22%7D&cd[OpenGraph]=%7B%7D&cd[Schema.org]=%5B%5D&cd[JSON-LD]=%5B%5D&sw=1600&sh=1200&v=2.9.104&r=stable&a=trplsojern&ec=2&o=30&fbp=fb.1.1685463290262.1823599126&it=1685463290083&coo=false&es=automatic&tm=3&rqm=GET

Protocol

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f176:84:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://authority.cosmopolitanlasvegas.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
date: Tue, 30 May 2023 16:14:51 GMT
server: proxygen-bolt
content-type: text/plain
access-control-allow-origin
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 0
priority: u=3,i

GET
H3 200 identity Show response
onboard.triptease.io/ 161 B
846 B 16ms
16ms Fetch
application/json 2606:4700:3033::6815:2773
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://onboard.triptease.io/identity

Requested by

Host: onboard.triptease.io
URL: https://onboard.triptease.io/bootstrap.js?integrationId=01E4X5KNES5SZ07J305WWVJE8C

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:3033::6815:2773 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

a9afcc94bc4ed53a55f665877ac93019dca5a8bb5c547688657f0e7750fee154

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://authority.cosmopolitanlasvegas.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date: Tue, 30 May 2023 16:14:52 GMT
strict-transport-security: max-age=15552000
content-encoding: br
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=7Y0cL%2FRWZuy4yYk%2FWB%2BFazUo6mtvNRbs33nf4%2F7%2F42ikgwkgd%2BBSOkAGsvxZ2C6Fti3U3rr%2FTL5O8RMxQqlh8ZmNMwOAYKsPkoqTGTBkKIJd7sPNVsfdrxmJoQHuzr%2BcB0oIKZQpFI%2FUYgMDWsqARBVKvg%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/json; charset=utf-8
access-control-allow-origin: https://authority.cosmopolitanlasvegas.com
cache-control: no-store, no-cache
access-control-allow-credentials: true
cf-ray: 7cf845ca78abbbc7-FRA
alt-svc: h3=":443"; ma=86400

GET
H3 200 claim Show response
onboard.triptease.io/ 2 B
563 B 198ms
197ms Fetch
application/json 2606:4700:3033::6815:2773
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://onboard.triptease.io/claim?apiKey=b46e2da70190d88425348ffad2967bf112aa252c

Requested by

Host: onboard.triptease.io
URL: https://onboard.triptease.io/bootstrap.js?integrationId=01E4X5KNES5SZ07J305WWVJE8C

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:3033::6815:2773 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://authority.cosmopolitanlasvegas.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date: Tue, 30 May 2023 16:14:52 GMT
strict-transport-security: max-age=15552000
content-encoding: br
cf-cache-status: BYPASS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=whlnXXHlqGZF%2Fp%2FLHCov2LA8znrVHiAP7KSX1ycTKRLb2Wd404w6lilpOYu%2F7ZNQNgv1z9oz1U8UWI%2FM5Pe7URtMckRAv0RIYmXJzCmDVo2X8bETogggxCFPaMoUdAqS3h5JXvH%2FtnaGV03OOsUt6n746Q%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/json; charset=utf-8
access-control-allow-origin: https://authority.cosmopolitanlasvegas.com
cache-control: no-cache, no-store, max-age=0
access-control-allow-credentials: true
cf-ray: 7cf845cac921bbc7-FRA
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept
alt-svc: h3=":443"; ma=86400

GET
H2 200 bootstrap-message-engine.js Show response
targeted-messages.triptease.io/static/ 83 KB
30 KB 77ms
21ms Script
application/javascript 2606:4700:3033::6815:2773
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://targeted-messages.triptease.io/static/bootstrap-message-engine.js

Requested by

Host: onboard.triptease.io
URL: https://onboard.triptease.io/bootstrap.js?integrationId=01E4X5KNES5SZ07J305WWVJE8C

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:3033::6815:2773 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

be709841c3801df4c6f141a7d94e1edc3de54e172f75ed7b72377f8a70baf36c

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

Referer: https://authority.cosmopolitanlasvegas.com/
Origin: https://authority.cosmopolitanlasvegas.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date: Tue, 30 May 2023 16:14:53 GMT
strict-transport-security: max-age=15552000
content-encoding: br
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-goog-meta-goog-reserved-file-mtime: 1685430362
age: 458
x-guploader-uploadid: ADPycdvoVoYbxF2WWROlrTpI76LNPssFofYIra8xli3PLvOAHIYq9p8RKME0SBGpE2yRBJy-lR4vVTLp-CoJCrL6r6XlFAiZB9jj
x-goog-storage-class: STANDARD
x-goog-metageneration: 2
x-goog-stored-content-encoding: identity
alt-svc: h3=":443"; ma=86400
last-modified: Tue, 30 May 2023 07:06:05 GMT
server: cloudflare
etag: W/"97485529e63b7319956e21e6995989a8"
vary: Accept-Encoding
x-goog-generation: 1685430365549711
content-type: application/javascript
access-control-allow-origin: *
x-goog-hash: crc32c=q3LPOg==, md5=l0hVKeY7cxmVbiHmmVmJqA==
access-control-expose-headers: Content-Type
cache-control: public, max-age=600
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=8EXrEM3bgN8pCng2J5t9XxZnumwz3r9BRNJKh9RkXIqWQYO5Kqgjnw27I9NdSw7xrHkmQ4eOn4TWFRf7I1nUArJ%2FVl5fxq2Ca2s9HY%2Fj26OHEWIa0nNKidVhzCJExMOiUHXdmk5tCmTsOpLyBHaA7pcNpLtF81MwQcc3SDw%3D"}],"group":"cf-nel","max_age":604800}
x-goog-stored-content-length: 85501
cf-ray: 7cf845cd7e6dbb44-FRA
expires: Tue, 30 May 2023 16:09:48 GMT

GET
H2 200 main.js Show response
static-meta.triptease.io/client/ 38 KB
13 KB 69ms
6ms Script
text/plain 151.101.65.182
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://static-meta.triptease.io/client/main.js
Requested by: Host: onboard.triptease.io
URL: https://onboard.triptease.io/bootstrap.js?integrationId=01E4X5KNES5SZ07J305WWVJE8C
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.65.182 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: istio-envoy /
Resource Hash: dce848263226d6273638d8874dd306ff6eb2883679618764c35e6f10924217b7

Request headers

Referer: https://authority.cosmopolitanlasvegas.com/
Origin: https://authority.cosmopolitanlasvegas.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date: Tue, 30 May 2023 16:14:53 GMT
via: 1.1 google, 1.1 varnish
content-encoding: gzip
age: 107623
x-cache: HIT
x-envoy-upstream-service-time: 4
content-length: 12678
x-served-by: cache-fra-eddf8230066-FRA
server: istio-envoy
x-timer: S1685463293.040163,VS0,VE0
vary: Accept-Encoding
content-type: text/plain; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=172800,stale-while-revalidate=1800
access-control-allow-credentials: true
accept-ranges: bytes
x-cache-hits: 20

GET
H/1.1 200
OK application.js Show response
b.triptease.io/ 3 KB
3 KB 53ms
9ms Script
application/javascript 151.101.1.62
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://b.triptease.io/application.js

Requested by

Host: onboard.triptease.io
URL: https://onboard.triptease.io/bootstrap.js?integrationId=01E4X5KNES5SZ07J305WWVJE8C

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.1.62 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

8466a7644fc5c228e5e7f04a247117d3b426d1d024ae13d6ffd21e9d93771cfb

Security Headers

Name	Value
Strict-Transport-Security	max-age=300

Request headers

Referer: https://authority.cosmopolitanlasvegas.com/
Origin: https://authority.cosmopolitanlasvegas.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

X-Served-By: cache-fra-etou8220032-FRA
Date: Tue, 30 May 2023 16:14:53 GMT
Via: 1.1 google, 1.1 varnish
Strict-Transport-Security: max-age=300
Age: 2882
access-control-allow-methods: GET, POST, PUT, PATCH, DELETE, OPTIONS, HEAD
content-type: application/javascript
access-control-allow-origin: *
X-Cache: HIT
cache-control: max-age=60
Connection: keep-alive
Accept-Ranges: bytes
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, session-token
Content-Length: 2871
X-Cache-Hits: 5

GET
H2 200 b46e2da70190d88425348ffad2967bf112aa252c Show response
static-meta.triptease.io/client/bundle-data/ 400 B
398 B 9ms
7ms Fetch
application/json 151.101.65.182
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://static-meta.triptease.io/client/bundle-data/b46e2da70190d88425348ffad2967bf112aa252c
Requested by: Host: static-meta.triptease.io
URL: https://static-meta.triptease.io/client/main.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.65.182 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: istio-envoy /
Resource Hash: 8bb837cf19bb554caa02740e2f9b4ba881980a96cfd9d5c9a522007643e3460e

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://authority.cosmopolitanlasvegas.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date: Tue, 30 May 2023 16:14:53 GMT
via: 1.1 google, 1.1 varnish
content-encoding: gzip
age: 26391
x-cache: HIT
x-envoy-upstream-service-time: 134
content-length: 299
x-served-by: cache-fra-eddf8230066-FRA
server: istio-envoy
x-timer: S1685463293.057878,VS0,VE1
vary: Accept-Encoding
content-type: application/json; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=172800,stale-while-revalidate=1800
access-control-allow-credentials: true
accept-ranges: bytes
x-cache-hits: 1

GET
H/1.1 200
OK / Show response
b.triptease.io/ Frame BA60 3 KB
3 KB 168ms
153ms Document
text/html 151.101.1.62
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://b.triptease.io/?apikey=b46e2da70190d88425348ffad2967bf112aa252c&bucket=1&conversion=false&clicked=false&searched=false&tripteaseUserId=01H1PQ1PMDJNGR7S442WQ1G58R

Requested by

Host: b.triptease.io
URL: https://b.triptease.io/application.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.1.62 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

6979e6ebd8e0c9b133f9dbe2a28c572b44ee3e3915156cc3e5a6c588e3613773

Security Headers

Name	Value
Strict-Transport-Security	max-age=300

Request headers

Referer: https://authority.cosmopolitanlasvegas.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Accept-Ranges: bytes
Connection: keep-alive
Date: Tue, 30 May 2023 16:14:53 GMT
Strict-Transport-Security: max-age=300
Via: 1.1 google, 1.1 varnish
X-Cache: MISS
X-Cache-Hits: 0
X-Served-By: cache-fra-etou8220118-FRA
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, session-token
access-control-allow-methods: GET, POST, PUT, PATCH, DELETE, OPTIONS, HEAD
access-control-allow-origin: *
cache-control: private, no-store
transfer-encoding: chunked

GET
H2 200 b46e2da70190d88425348ffad2967bf112aa252c Show response
static-meta.triptease.io/client/bundle-data/ 400 B
365 B 7ms
6ms Fetch
application/json 151.101.65.182
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://static-meta.triptease.io/client/bundle-data/b46e2da70190d88425348ffad2967bf112aa252c
Requested by: Host: static-meta.triptease.io
URL: https://static-meta.triptease.io/client/main.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.65.182 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: istio-envoy /
Resource Hash: 8bb837cf19bb554caa02740e2f9b4ba881980a96cfd9d5c9a522007643e3460e

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://authority.cosmopolitanlasvegas.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date: Tue, 30 May 2023 16:14:53 GMT
via: 1.1 google, 1.1 varnish
content-encoding: gzip
age: 26391
x-cache: HIT
x-envoy-upstream-service-time: 134
content-length: 299
x-served-by: cache-fra-eddf8230066-FRA
server: istio-envoy
x-timer: S1685463293.091972,VS0,VE0
vary: Accept-Encoding
content-type: application/json; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=172800,stale-while-revalidate=1800
access-control-allow-credentials: true
accept-ranges: bytes
x-cache-hits: 2

GET
H3 200 storageIframe.html Show response
targeted-messages.triptease.io/static/ Frame 56EA 7 KB
4 KB 40ms
24ms Document
text/html 2606:4700:3033::6815:2773
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://targeted-messages.triptease.io/static/storageIframe.html

Requested by

Host: targeted-messages.triptease.io
URL: https://targeted-messages.triptease.io/static/bootstrap-message-engine.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:3033::6815:2773 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

678497f7b3e9fd06d68022c6ab0b04982decd56ca702594f7b845547f50ae878

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

Referer: https://authority.cosmopolitanlasvegas.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

access-control-allow-origin: *
access-control-expose-headers: Content-Type
age: 251
alt-svc: h3=":443"; ma=86400
cache-control: public, max-age=600
cf-cache-status: HIT
cf-ray: 7cf845cdfed368fe-FRA
content-encoding: br
content-type: text/html
date: Tue, 30 May 2023 16:14:53 GMT
expires: Tue, 30 May 2023 16:10:54 GMT
last-modified: Wed, 17 May 2023 08:50:20 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=WCzgeGFIRSjWHrsRR7q%2Fm034392%2Bkk%2FA41YLcwrX7mKuQf6%2Fi4QG0IyROq8INr%2FJCXOWRCYrUBVg9vGXGDDIp5%2BEF3LYYXvnlIhmA9ZzLuATBuJxTuWpbj9M5N%2BbrD6BYmaHAqKR6AmmMfGi%2FwWL9oBGJYsEOG%2FBrB8hfTM%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
strict-transport-security: max-age=15552000
vary: Accept-Encoding
x-goog-generation: 1684313420580637
x-goog-hash: crc32c=lekBYA== md5=31j0CLd/PYsCtuZMD3dlCg==
x-goog-meta-goog-reserved-file-mtime: 1684313417
x-goog-metageneration: 2
x-goog-storage-class: STANDARD
x-goog-stored-content-encoding: identity
x-goog-stored-content-length: 7275
x-guploader-uploadid: ADPycduxPBenvFd4JU_JNxGehr5fKIRGrun9oyAP85RQXtZC-yhXt02HjgEEZuJx5lo8fn0XNXX58ZpotVWaRrRgwz6l_FCnDbx4

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 137 KB
53 KB 26ms
22ms Script
application/javascript 2a00:1450:4001:80b::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-606547538&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-TXCSKP

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80b::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

1f706ec41bc806a2ff15c0c8ba708e7635562f93fb936a42b1215df896dc1bf2

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://authority.cosmopolitanlasvegas.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date: Tue, 30 May 2023 16:14:53 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 53924
x-xss-protection: 0
last-modified: Tue, 30 May 2023 15:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Tue, 30 May 2023 16:14:53 GMT

POST
H3 204 batch
onboard.triptease.io/message/ 0
477 B 154ms
153ms Ping
text/html 2606:4700:3033::6815:2773
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://onboard.triptease.io/message/batch

Requested by

Host: onboard.triptease.io
URL: https://onboard.triptease.io/bootstrap.js?integrationId=01E4X5KNES5SZ07J305WWVJE8C

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:3033::6815:2773 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

Referer: https://authority.cosmopolitanlasvegas.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

date: Tue, 30 May 2023 16:14:53 GMT
strict-transport-security: max-age=15552000
cf-cache-status: DYNAMIC
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=f3OL2PFBuL1vbbBBdG1dBs%2FSubTPVyf9hjkGxK0G8Q3dd3qoaJjkYNaPSZwFu%2BCb6U30sVAvzfuM3tXWWTix2iNwtT7fShNknTv%2FQP7ey1XN3owLbbQ0jnSmLPgILJoJiHY2bcZgd0z%2BAuXLd%2Fxm7gKZ2w%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type: text/html
access-control-allow-origin: *
x-cloud-trace-context: 25b1ccac09436e7e2c047e2319d4f2da
cf-ray: 7cf845cdfeadbbc7-FRA
alt-svc: h3=":443"; ma=86400

GET
H2 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/606547538/ 4 KB
2 KB 57ms
56ms Script
text/javascript 142.250.184.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/606547538/?random=1685463293151&cv=11&fst=1685463293151&bg=ffffff&guid=ON&async=1&gtm=45be35o0&u_w=1600&u_h=1200&url=https%3A%2F%2Fauthority.cosmopolitanlasvegas.com%2Faccount%2Flogin%3FreturnUrl%3D%252Fconnect%252Fauthorize%252Fcallback%253Fclient_id%253DIdentityOnline%2526redirect_uri%253Dhttps%25253A%25252F%25252Fwww.cosmopolitanlasvegas.com%25252Flogin%25252Fauthorize%2526scope%253Dprofile%252520openid%252520cosmo-api%252520offline_access%252520api-all-readwrite%2526response_type%253Dcode%2526state%253DaAYHNwPWGNJihFRWa6yu33JDtlgL32td0sr1L6al&hn=www.googleadservices.com&frm=0&tiba=Come%20in%20and%20play%20-%20Cosmopolitan.OAuth&auid=1124363491.1685463290&uamb=0&uaw=0&data=event%3Dgtag.config&rfmt=3&fmt=4

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-606547538&l=dataLayer&cx=c

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.184.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s12-in-f2.1e100.net

Software

cafe /

Resource Hash

b6757189f6ff58e100d48587516b1b70b9664277f65fe2523418b248f346266a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://authority.cosmopolitanlasvegas.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 30 May 2023 16:14:53 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1531
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 messages Show response
messages.guest-experience.triptease.io/b46e2da70190d88425348ffad2967bf112aa252c/ 6 KB
7 KB 193ms
153ms Fetch
application/json 151.101.2.133
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://messages.guest-experience.triptease.io/b46e2da70190d88425348ffad2967bf112aa252c/messages?language=en-US
Requested by: Host: targeted-messages.triptease.io
URL: https://targeted-messages.triptease.io/static/bootstrap-message-engine.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.2.133 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: Google Frontend /
Resource Hash: 7cb26cfdbe2cb6314c89913239019dd91859331189d49e0907dda1a10f528129

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://authority.cosmopolitanlasvegas.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date: Tue, 30 May 2023 16:14:53 GMT
via: 1.1 varnish
age: 0
x-cache: MISS
x-city: frankfurt am main
content-length: 6132
x-served-by: cache-fra-etou8220102-FRA
server: Google Frontend
vary: Origin
tt_keys: campaigns-b46e2da70190d88425348ffad2967bf112aa252c campaigns-client-COSMOPOLITANOFLASVEGAS
access-control-allow-origin: https://authority.cosmopolitanlasvegas.com
x-region-code: HE
x-cloud-trace-context: 328dd9b5e210784eac70b1853e58a015
cache-control: public,stale-if-error=600,stale-while-revalidate=10,max-age=600
access-control-allow-credentials: true
content-type: application/json; charset=utf-8
tt_host: messages.guest-experience.triptease.io
access-control-expose-headers: X-Country-Code, X-Region-Code, X-City
accept-ranges: bytes
x-country-code: DE
x-cache-hits: 0

GET
H2 200 /
www.google.com/pagead/1p-user-list/606547538/ 42 B
455 B 77ms
20ms Image
image/gif 2a00:1450:4001:831::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/606547538/?random=1685463293151&cv=11&fst=1685462400000&bg=ffffff&guid=ON&async=1&gtm=45be35o0&u_w=1600&u_h=1200&url=https%3A%2F%2Fauthority.cosmopolitanlasvegas.com%2Faccount%2Flogin%3FreturnUrl%3D%252Fconnect%252Fauthorize%252Fcallback%253Fclient_id%253DIdentityOnline%2526redirect_uri%253Dhttps%25253A%25252F%25252Fwww.cosmopolitanlasvegas.com%25252Flogin%25252Fauthorize%2526scope%253Dprofile%252520openid%252520cosmo-api%252520offline_access%252520api-all-readwrite%2526response_type%253Dcode%2526state%253DaAYHNwPWGNJihFRWa6yu33JDtlgL32td0sr1L6al&frm=0&tiba=Come%20in%20and%20play%20-%20Cosmopolitan.OAuth&data=event%3Dgtag.config&fmt=3&is_vtc=1&random=4022188184&rmt_tld=0&ipr=y

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://authority.cosmopolitanlasvegas.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 30 May 2023 16:14:53 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.de/pagead/1p-user-list/606547538/ 42 B
455 B 78ms
20ms Image
image/gif 2a00:1450:4001:802::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/606547538/?random=1685463293151&cv=11&fst=1685462400000&bg=ffffff&guid=ON&async=1&gtm=45be35o0&u_w=1600&u_h=1200&url=https%3A%2F%2Fauthority.cosmopolitanlasvegas.com%2Faccount%2Flogin%3FreturnUrl%3D%252Fconnect%252Fauthorize%252Fcallback%253Fclient_id%253DIdentityOnline%2526redirect_uri%253Dhttps%25253A%25252F%25252Fwww.cosmopolitanlasvegas.com%25252Flogin%25252Fauthorize%2526scope%253Dprofile%252520openid%252520cosmo-api%252520offline_access%252520api-all-readwrite%2526response_type%253Dcode%2526state%253DaAYHNwPWGNJihFRWa6yu33JDtlgL32td0sr1L6al&frm=0&tiba=Come%20in%20and%20play%20-%20Cosmopolitan.OAuth&data=event%3Dgtag.config&fmt=3&is_vtc=1&random=4022188184&rmt_tld=1&ipr=y

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:802::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://authority.cosmopolitanlasvegas.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 30 May 2023 16:14:53 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

associate-segment
segment.prod.bidr.io/ Frame BA60
Redirect Chain

https://segment.prod.bidr.io/associate-segment?buzz_key=triptease&segment_key=triptease-138&value=
https://segment.prod.bidr.io/associate-segment?buzz_key=triptease&segment_key=triptease-138&value=&_bee_ppp=1

43 B
796 B

31ms
31ms

Image
image/gif

52.31.168.141
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://segment.prod.bidr.io/associate-segment?buzz_key=triptease&segment_key=triptease-138&value=&_bee_ppp=1

Requested by

Host: b.triptease.io
URL: https://b.triptease.io/?apikey=b46e2da70190d88425348ffad2967bf112aa252c&bucket=1&conversion=false&clicked=false&searched=false&tripteaseUserId=01H1PQ1PMDJNGR7S442WQ1G58R

Protocol

HTTP/1.1

Server

52.31.168.141 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-52-31-168-141.eu-west-1.compute.amazonaws.com

Software

gunicorn /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://b.triptease.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

pragma: no-cache
Date: Tue, 30 May 2023 16:14:53 GMT
strict-transport-security: max-age=2592000; includeSubDomains
Server: gunicorn
content-type: image/gif
p3p: CP="This is not a P3P policy! See https://beeswax.com/privacy for more info."
cache-control: no-cache, must-revalidate
Connection: keep-alive
Content-Length: 43
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://segment.prod.bidr.io/associate-segment?buzz_key=triptease&segment_key=triptease-138&value=&_bee_ppp=1
Date: Tue, 30 May 2023 16:14:53 GMT
strict-transport-security: max-age=2592000; includeSubDomains
Server: gunicorn
Connection: keep-alive
Content-Length: 0

GET
H/1.1

200
OK

associate-segment
segment.prod.bidr.io/ Frame BA60
Redirect Chain

https://segment.prod.bidr.io/associate-segment?buzz_key=triptease&segment_key=triptease-139&value=
https://segment.prod.bidr.io/associate-segment?buzz_key=triptease&segment_key=triptease-139&value=&_bee_ppp=1

43 B
796 B

30ms
29ms

Image
image/gif

52.31.168.141
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://segment.prod.bidr.io/associate-segment?buzz_key=triptease&segment_key=triptease-139&value=&_bee_ppp=1

Requested by

Protocol

HTTP/1.1

Server

52.31.168.141 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-52-31-168-141.eu-west-1.compute.amazonaws.com

Software

gunicorn /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://b.triptease.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

pragma: no-cache
Date: Tue, 30 May 2023 16:14:53 GMT
strict-transport-security: max-age=2592000; includeSubDomains
Server: gunicorn
content-type: image/gif
p3p: CP="This is not a P3P policy! See https://beeswax.com/privacy for more info."
cache-control: no-cache, must-revalidate
Connection: keep-alive
Content-Length: 43
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://segment.prod.bidr.io/associate-segment?buzz_key=triptease&segment_key=triptease-139&value=&_bee_ppp=1
Date: Tue, 30 May 2023 16:14:53 GMT
strict-transport-security: max-age=2592000; includeSubDomains
Server: gunicorn
Connection: keep-alive
Content-Length: 0

GET
H/1.1

200
OK

associate-segment
segment.prod.bidr.io/ Frame BA60
Redirect Chain

https://segment.prod.bidr.io/associate-segment?buzz_key=triptease&segment_key=triptease-140&value=
https://segment.prod.bidr.io/associate-segment?buzz_key=triptease&segment_key=triptease-140&value=&_bee_ppp=1

43 B
796 B

38ms
34ms

Image
image/gif

52.31.168.141
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://segment.prod.bidr.io/associate-segment?buzz_key=triptease&segment_key=triptease-140&value=&_bee_ppp=1

Requested by

Protocol

HTTP/1.1

Server

52.31.168.141 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-52-31-168-141.eu-west-1.compute.amazonaws.com

Software

gunicorn /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://b.triptease.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

pragma: no-cache
Date: Tue, 30 May 2023 16:14:53 GMT
strict-transport-security: max-age=2592000; includeSubDomains
Server: gunicorn
content-type: image/gif
p3p: CP="This is not a P3P policy! See https://beeswax.com/privacy for more info."
cache-control: no-cache, must-revalidate
Connection: keep-alive
Content-Length: 43
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://segment.prod.bidr.io/associate-segment?buzz_key=triptease&segment_key=triptease-140&value=&_bee_ppp=1
Date: Tue, 30 May 2023 16:14:53 GMT
strict-transport-security: max-age=2592000; includeSubDomains
Server: gunicorn
Connection: keep-alive
Content-Length: 0

GET
H/1.1

200
OK

associate-segment
segment.prod.bidr.io/ Frame BA60
Redirect Chain

https://segment.prod.bidr.io/associate-segment?buzz_key=triptease&segment_key=triptease-137&value=
https://segment.prod.bidr.io/associate-segment?buzz_key=triptease&segment_key=triptease-137&value=&_bee_ppp=1

43 B
796 B

40ms
33ms

Image
image/gif

52.31.168.141
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://segment.prod.bidr.io/associate-segment?buzz_key=triptease&segment_key=triptease-137&value=&_bee_ppp=1

Requested by

Protocol

HTTP/1.1

Server

52.31.168.141 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-52-31-168-141.eu-west-1.compute.amazonaws.com

Software

gunicorn /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://b.triptease.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

pragma: no-cache
Date: Tue, 30 May 2023 16:14:53 GMT
strict-transport-security: max-age=2592000; includeSubDomains
Server: gunicorn
content-type: image/gif
p3p: CP="This is not a P3P policy! See https://beeswax.com/privacy for more info."
cache-control: no-cache, must-revalidate
Connection: keep-alive
Content-Length: 43
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://segment.prod.bidr.io/associate-segment?buzz_key=triptease&segment_key=triptease-137&value=&_bee_ppp=1
Date: Tue, 30 May 2023 16:14:53 GMT
strict-transport-security: max-age=2592000; includeSubDomains
Server: gunicorn
Connection: keep-alive
Content-Length: 0

GET
H/1.1

200
OK

associate-segment
segment.prod.bidr.io/ Frame BA60
Redirect Chain

https://segment.prod.bidr.io/associate-segment?buzz_key=triptease&segment_key=triptease-18692&value=1
https://segment.prod.bidr.io/associate-segment?buzz_key=triptease&segment_key=triptease-18692&value=1&_bee_ppp=1

43 B
796 B

35ms
28ms

Image
image/gif

52.31.168.141
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://segment.prod.bidr.io/associate-segment?buzz_key=triptease&segment_key=triptease-18692&value=1&_bee_ppp=1

Requested by

Protocol

HTTP/1.1

Server

52.31.168.141 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-52-31-168-141.eu-west-1.compute.amazonaws.com

Software

gunicorn /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://b.triptease.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

pragma: no-cache
Date: Tue, 30 May 2023 16:14:53 GMT
strict-transport-security: max-age=2592000; includeSubDomains
Server: gunicorn
content-type: image/gif
p3p: CP="This is not a P3P policy! See https://beeswax.com/privacy for more info."
cache-control: no-cache, must-revalidate
Connection: keep-alive
Content-Length: 43
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://segment.prod.bidr.io/associate-segment?buzz_key=triptease&segment_key=triptease-18692&value=1&_bee_ppp=1
Date: Tue, 30 May 2023 16:14:53 GMT
strict-transport-security: max-age=2592000; includeSubDomains
Server: gunicorn
Connection: keep-alive
Content-Length: 0

GET
H/1.1

200
OK

associate-segment
segment.prod.bidr.io/ Frame BA60
Redirect Chain

https://segment.prod.bidr.io/associate-segment?buzz_key=triptease&segment_key=triptease-18693&value=
https://segment.prod.bidr.io/associate-segment?buzz_key=triptease&segment_key=triptease-18693&value=&_bee_ppp=1

43 B
796 B

44ms
30ms

Image
image/gif

52.31.168.141
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://segment.prod.bidr.io/associate-segment?buzz_key=triptease&segment_key=triptease-18693&value=&_bee_ppp=1

Requested by

Protocol

HTTP/1.1

Server

52.31.168.141 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-52-31-168-141.eu-west-1.compute.amazonaws.com

Software

gunicorn /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://b.triptease.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

pragma: no-cache
Date: Tue, 30 May 2023 16:14:53 GMT
strict-transport-security: max-age=2592000; includeSubDomains
Server: gunicorn
content-type: image/gif
p3p: CP="This is not a P3P policy! See https://beeswax.com/privacy for more info."
cache-control: no-cache, must-revalidate
Connection: keep-alive
Content-Length: 43
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location: https://segment.prod.bidr.io/associate-segment?buzz_key=triptease&segment_key=triptease-18693&value=&_bee_ppp=1
Date: Tue, 30 May 2023 16:14:53 GMT
strict-transport-security: max-age=2592000; includeSubDomains
Server: gunicorn
Connection: keep-alive
Content-Length: 0

GET
H/1.1 200
OK associate-segment
segment.prod.bidr.io/ Frame BA60 43 B
560 B 31ms
30ms Image
image/gif 52.31.168.141
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://segment.prod.bidr.io/associate-segment?buzz_key=triptease&segment_key=triptease-18694&value=1

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.31.168.141 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-52-31-168-141.eu-west-1.compute.amazonaws.com

Software

gunicorn /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://b.triptease.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

pragma: no-cache
Date: Tue, 30 May 2023 16:14:53 GMT
strict-transport-security: max-age=2592000; includeSubDomains
Server: gunicorn
content-type: image/gif
p3p: CP="This is not a P3P policy! See https://beeswax.com/privacy for more info."
cache-control: no-cache, must-revalidate
Connection: keep-alive
Content-Length: 43
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK associate-segment
segment.prod.bidr.io/ Frame BA60 43 B
560 B 30ms
30ms Image
image/gif 52.31.168.141
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://segment.prod.bidr.io/associate-segment?buzz_key=triptease&segment_key=triptease-18695&value=1

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.31.168.141 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-52-31-168-141.eu-west-1.compute.amazonaws.com

Software

gunicorn /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://b.triptease.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

pragma: no-cache
Date: Tue, 30 May 2023 16:14:53 GMT
strict-transport-security: max-age=2592000; includeSubDomains
Server: gunicorn
content-type: image/gif
p3p: CP="This is not a P3P policy! See https://beeswax.com/privacy for more info."
cache-control: no-cache, must-revalidate
Connection: keep-alive
Content-Length: 43
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK associate-segment
segment.prod.bidr.io/ Frame BA60 43 B
560 B 31ms
31ms Image
image/gif 52.31.168.141
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://segment.prod.bidr.io/associate-segment?buzz_key=triptease&segment_key=triptease-18696&value=1

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.31.168.141 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-52-31-168-141.eu-west-1.compute.amazonaws.com

Software

gunicorn /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://b.triptease.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

pragma: no-cache
Date: Tue, 30 May 2023 16:14:53 GMT
strict-transport-security: max-age=2592000; includeSubDomains
Server: gunicorn
content-type: image/gif
p3p: CP="This is not a P3P policy! See https://beeswax.com/privacy for more info."
cache-control: no-cache, must-revalidate
Connection: keep-alive
Content-Length: 43
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK associate-segment
segment.prod.bidr.io/ Frame BA60 43 B
560 B 33ms
32ms Image
image/gif 52.31.168.141
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://segment.prod.bidr.io/associate-segment?buzz_key=triptease&segment_key=triptease-18697&value=1

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.31.168.141 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-52-31-168-141.eu-west-1.compute.amazonaws.com

Software

gunicorn /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://b.triptease.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

pragma: no-cache
Date: Tue, 30 May 2023 16:14:53 GMT
strict-transport-security: max-age=2592000; includeSubDomains
Server: gunicorn
content-type: image/gif
p3p: CP="This is not a P3P policy! See https://beeswax.com/privacy for more info."
cache-control: no-cache, must-revalidate
Connection: keep-alive
Content-Length: 43
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

cookie-sync
b.triptease.io/ Frame BA60
Redirect Chain

https://match.prod.bidr.io/cookie-sync/triptease?buyer_user_id=01H1PQ1PMDJNGR7S442WQ1G58R|b46e2da70190d88425348ffad2967bf112aa252c
https://match.prod.bidr.io/cookie-sync/triptease?buyer_user_id=01H1PQ1PMDJNGR7S442WQ1G58R%7Cb46e2da70190d88425348ffad2967bf112aa252c&_bee_ppp=1
https://b.triptease.io/cookie-sync?partner=beeswax&beeswax_id=AADvPU7I7EIAACCvuwAmwg&buyer_user_id=01H1PQ1PMDJNGR7S442WQ1G58R%7Cb46e2da70190d88425348ffad2967bf112aa252c

137 B
137 B

117ms
116ms

Image
text/plain

151.101.1.62
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.triptease.io/cookie-sync?partner=beeswax&beeswax_id=AADvPU7I7EIAACCvuwAmwg&buyer_user_id=01H1PQ1PMDJNGR7S442WQ1G58R%7Cb46e2da70190d88425348ffad2967bf112aa252c

Requested by

Protocol

HTTP/1.1

Server

151.101.1.62 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=300

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://b.triptease.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

X-Served-By: cache-fra-etou8220118-FRA
Date: Tue, 30 May 2023 16:14:53 GMT
Via: 1.1 google, 1.1 varnish
Strict-Transport-Security: max-age=300
transfer-encoding: chunked
access-control-allow-methods: GET, POST, PUT, PATCH, DELETE, OPTIONS, HEAD
X-Cache: MISS
access-control-allow-origin: *
cache-control: private, no-store
Connection: keep-alive
Accept-Ranges: bytes
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, session-token
X-Cache-Hits: 0

Redirect headers

location: https://b.triptease.io/cookie-sync?partner=beeswax&beeswax_id=AADvPU7I7EIAACCvuwAmwg&buyer_user_id=01H1PQ1PMDJNGR7S442WQ1G58R%7Cb46e2da70190d88425348ffad2967bf112aa252c
Date: Tue, 30 May 2023 16:14:53 GMT
strict-transport-security: max-age=2592000; includeSubDomains
Server: gunicorn
Connection: keep-alive
Content-Length: 0

GET
H/1.1

200
OK

cookie-msync Show response
match.prod.bidr.io/ Frame 83D3
Redirect Chain

https://segment.prod.bidr.io/associate-segment?buzz_key=triptease&segment_key=triptease-1&value=0.5&forward_to_cookie_sync=1
https://segment.prod.bidr.io/associate-segment?buzz_key=triptease&segment_key=triptease-1&value=0.5&forward_to_cookie_sync=1&_bee_ppp=1
https://match.prod.bidr.io/cookie-msync?buzz_key=triptease

1 KB
2 KB

42ms
32ms

Document
text/html

52.49.138.187
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://match.prod.bidr.io/cookie-msync?buzz_key=triptease

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.49.138.187 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-52-49-138-187.eu-west-1.compute.amazonaws.com

Software

gunicorn /

Resource Hash

e0d7b985983e1bf19b98d1bf1eea81ca2239b0456281f35401554199e1db6cce

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000; includeSubDomains

Request headers

Referer: https://b.triptease.io/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Connection: keep-alive
Content-Length: 1457
Date: Tue, 30 May 2023 16:14:53 GMT
Server: gunicorn
cache-control: no-cache, must-revalidate
content-type: text/html; charset=utf-8
strict-transport-security: max-age=2592000; includeSubDomains

Redirect headers

Connection: keep-alive
Content-Length: 0
Date: Tue, 30 May 2023 16:14:53 GMT
Server: gunicorn
location: https://match.prod.bidr.io/cookie-msync?buzz_key=triptease
strict-transport-security: max-age=2592000; includeSubDomains

POST
H2 200 event
api.triptease.io/zappy/ 0
218 B 172ms
108ms Ping
text/plain 35.186.195.233
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://api.triptease.io/zappy/event?eventName=propensityToConvert&eventAppName=messageEngine
Requested by: Host: targeted-messages.triptease.io
URL: https://targeted-messages.triptease.io/static/bootstrap-message-engine.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.186.195.233 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 233.195.186.35.bc.googleusercontent.com
Software: nginx/1.11.3 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://authority.cosmopolitanlasvegas.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

date: Tue, 30 May 2023 16:14:53 GMT
via: 1.1 google
server: nginx/1.11.3
access-control-max-age: 86400
access-control-allow-methods: GET,PUT,POST,DELETE
content-type: text/plain; charset=utf-8
access-control-allow-origin: https://authority.cosmopolitanlasvegas.com
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

GET
H/1.1 200
OK ibs:dpid=275754&dpuuid=AAC8GU7I7EIAACAzN64rhA
dpm.demdex.net/ Frame 83D3 42 B
942 B 37ms
37ms Image
image/gif 52.16.141.94
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dpm.demdex.net/ibs:dpid=275754&dpuuid=AAC8GU7I7EIAACAzN64rhA

Requested by

Host: match.prod.bidr.io
URL: https://match.prod.bidr.io/cookie-msync?buzz_key=triptease

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.16.141.94 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-52-16-141-94.eu-west-1.compute.amazonaws.com

Software

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://match.prod.bidr.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

DCS: dcs-prod-irl1-1-v048-02089365e.edge-irl1.demdex.com 2 ms
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
content-encoding: gzip
X-Content-Type-Options: nosniff
X-TID: MjpBN4zQQME=
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Content-Type: image/gif
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection: keep-alive
Content-Length: 59
Expires: Thu, 01 Jan 1970 00:00:00 UTC

GET
H2 200 35244
tags.bluekai.com/site/ Frame 83D3 62 B
526 B 334ms
331ms Image
image/gif 104.111.217.14
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tags.bluekai.com/site/35244?id=AAC8GU7I7EIAACAzN64rhA
Requested by: Host: match.prod.bidr.io
URL: https://match.prod.bidr.io/cookie-msync?buzz_key=triptease
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 104.111.217.14 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-111-217-14.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 0af3aae90b7de9fdceee2ab421378ea2f54c74be81ef43fc6c1790a032755d80

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://match.prod.bidr.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV", policyref="http://tags.bluekai.com/w3c/p3p.xml"
date: Tue, 30 May 2023 16:14:53 GMT
content-length: 62
bk-server: 22bc
content-type: image/gif

GET
H/1.1

200
OK

adx
match.prod.bidr.io/cookie-sync/ Frame 83D3
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=beeswaxio&google_sc=&google_hm=QUFDOEdVN0k3RUlBQUNBek42NHJoQQ&bee_sync_partners=&bee_sync_current_partner=adx&bee_sync_hop_count=1
https://match.prod.bidr.io/cookie-sync/adx?bee_sync_partners=&bee_sync_current_partner=adx&bee_sync_hop_count=1

43 B
560 B

33ms
33ms

Image
image/gif

52.49.138.187
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://match.prod.bidr.io/cookie-sync/adx?bee_sync_partners=&bee_sync_current_partner=adx&bee_sync_hop_count=1

Requested by

Host: match.prod.bidr.io
URL: https://match.prod.bidr.io/cookie-msync?buzz_key=triptease

Protocol

HTTP/1.1

Server

52.49.138.187 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-52-49-138-187.eu-west-1.compute.amazonaws.com

Software

gunicorn /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://match.prod.bidr.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

pragma: no-cache
Date: Tue, 30 May 2023 16:14:53 GMT
strict-transport-security: max-age=2592000; includeSubDomains
Server: gunicorn
content-type: image/gif
p3p: CP="This is not a P3P policy! See https://beeswax.com/privacy for more info."
cache-control: no-cache, must-revalidate
Connection: keep-alive
Content-Length: 43
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Tue, 30 May 2023 16:14:53 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://match.prod.bidr.io/cookie-sync/adx?bee_sync_partners=&bee_sync_current_partner=adx&bee_sync_hop_count=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 316
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK user-registering
ads.stickyadstv.com/ Frame 83D3 43 B
642 B 74ms
22ms Image
image/gif 95.101.54.106
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ads.stickyadstv.com/user-registering?dataProviderId=817&userId=AAC8GU7I7EIAACAzN64rhA
Requested by: Host: match.prod.bidr.io
URL: https://match.prod.bidr.io/cookie-msync?buzz_key=triptease
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 95.101.54.106 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a95-101-54-106.deploy.static.akamaitechnologies.com
Software: nginx /
Resource Hash: a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://match.prod.bidr.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 30 May 2023 16:14:53 GMT
Server: nginx
Content-Type: image/gif
Access-Control-Allow-Origin: *
Cache-Control: max-age=0, no-cache, no-store
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 43
x-sticky-vk: 1685463293499079-562
Expires: Tue, 30 May 2023 16:14:53 GMT

GET
H2 200 g.pixel
aa.agkn.com/adscores/ Frame 83D3 43 B
502 B 37ms
35ms Image
image/gif 52.208.135.117
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://aa.agkn.com/adscores/g.pixel?sid=9212314538&puid=AAC8GU7I7EIAACAzN64rhA
Requested by: Host: match.prod.bidr.io
URL: https://match.prod.bidr.io/cookie-msync?buzz_key=triptease
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.208.135.117 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-208-135-117.eu-west-1.compute.amazonaws.com
Software: AAWebServer /
Resource Hash: 98b3d9d20e032f90aca49e9b116225d539ff6fbdb7e42c3c363f63896ac03d2a

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://match.prod.bidr.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 30 May 2023 16:14:53 GMT
server: AAWebServer
access-control-allow-methods: GET, POST, OPTIONS
p3p: policyref="https://www.agkn.com/p3p/p3p.xml",CP="NOI NID"
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
access-control-allow-headers: accept, cache-control, origin, x-requested-with, x-file-name, content-type
content-length: 43
expires: 0

GET
H2 200 Pug
image2.pubmatic.com/AdServer/ Frame 83D3 42 B
280 B 19ms
17ms Image
image/gif 185.64.190.80
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTMyOTcmdGw9MTI5NjAw&piggybackCookie=AAC8GU7I7EIAACAzN64rhA
Requested by: Host: match.prod.bidr.io
URL: https://match.prod.bidr.io/cookie-msync?buzz_key=triptease
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.64.190.80 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://match.prod.bidr.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

content-type: image/gif; charset=utf-8
date: Tue, 30 May 2023 16:14:53 GMT
cache-control: no-store, no-cache, private
server: nginx
content-length: 42
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

GET
H2

204

/
loadus.exelator.com/load/ Frame 83D3
Redirect Chain

https://loadus.exelator.com/load/?BUID=AAC8GU7I7EIAACAzN64rhA&p=204&g=117&j=0
https://loadus.exelator.com/load/?BUID=AAC8GU7I7EIAACAzN64rhA&p=204&g=117&j=0&xl8blockcheck=1

0
767 B

35ms
35ms

Image
text/plain

54.78.254.47
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://loadus.exelator.com/load/?BUID=AAC8GU7I7EIAACAzN64rhA&p=204&g=117&j=0&xl8blockcheck=1
Requested by: Host: match.prod.bidr.io
URL: https://match.prod.bidr.io/cookie-msync?buzz_key=triptease
Protocol: H2
Server: 54.78.254.47 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-78-254-47.eu-west-1.compute.amazonaws.com
Software: nginx / Undertow/1
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://match.prod.bidr.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

date: Tue, 30 May 2023 16:14:53 GMT
cache-control: no-cache
access-control-allow-credentials: true
server: nginx
x-powered-by: Undertow/1
p3p: policyref=/w3c/p3p.xml, CP=NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA, policyref=/w3c/p3p.xml, CP=NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA

Redirect headers

date: Tue, 30 May 2023 16:14:53 GMT
server: nginx
x-powered-by: Undertow/1
p3p: policyref=/w3c/p3p.xml, CP=NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA, policyref=/w3c/p3p.xml, CP=NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA
location: https://loadus.exelator.com/load/?BUID=AAC8GU7I7EIAACAzN64rhA&p=204&g=117&j=0&xl8blockcheck=1
content-type: image/gif
cache-control: no-cache
access-control-allow-credentials: true
content-length: 0

GET
H/1.1 200
OK rum
dsum-sec.casalemedia.com/ Frame 83D3 43 B
632 B 28ms
8ms Image
image/gif 185.80.39.216
CASALE-MEDIA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=130&external_user_id=AAC8GU7I7EIAACAzN64rhA&expiration=1686672893
Requested by: Host: match.prod.bidr.io
URL: https://match.prod.bidr.io/cookie-msync?buzz_key=triptease
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 185.80.39.216 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://match.prod.bidr.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 30 May 2023 16:14:53 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type: image/gif
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=1, max=500
Content-Length: 43
Expires: 0

GET
H/1.1 200
OK setuid
ib.adnxs.com/ Frame 83D3 43 B
1 KB 15ms
13ms Image
image/gif 185.89.210.122
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/setuid?entity=331&seg=6290637&code=AAC8GU7I7EIAACAzN64rhA

Requested by

Host: match.prod.bidr.io
URL: https://match.prod.bidr.io/cookie-msync?buzz_key=triptease

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.89.210.122 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

954.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net

Software

nginx/1.21.3 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://match.prod.bidr.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 30 May 2023 16:14:53 GMT
AN-X-Request-Uuid: 2945d5c9-a39a-49f5-8f8e-9bf6f3cae1a4
Server: nginx/1.21.3
Accept-CH: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type: image/gif
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
X-Proxy-Origin: 138.199.38.134; 138.199.38.134; 954.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
Content-Length: 43
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H/1.1 204
No Content tap.php
pixel.rubiconproject.com/ Frame 83D3 0
239 B 53ms
8ms Image
image/gif 69.173.144.165
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.rubiconproject.com/tap.php?v=183462&nid=4114&put=AAC8GU7I7EIAACAzN64rhA&expires=30
Requested by: Host: match.prod.bidr.io
URL: https://match.prod.bidr.io/cookie-msync?buzz_key=triptease
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_256_GCM
Server: 69.173.144.165 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://match.prod.bidr.io/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

Content-Type: image/gif
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
X-RPHost: 37b22a0c36bd84993dd2cda4a5e04b1d
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

POST
H/1.1 204
No Content collect Show response
s.clarity.ms/ 0
314 B 92ms
91ms XHR
text/plain 23.96.124.68
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://s.clarity.ms/collect
Requested by: Host: www.clarity.ms
URL: https://www.clarity.ms/s/0.7.8/clarity.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.96.124.68 Tappahannock, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: nginx/1.18.0 (Ubuntu) /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept: application/x-clarity-gzip
Referer: https://authority.cosmopolitanlasvegas.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.126 Safari/537.36

Response headers

Access-Control-Allow-Origin: https://authority.cosmopolitanlasvegas.com
Date: Tue, 30 May 2023 16:14:55 GMT
Access-Control-Allow-Credentials: true
Server: nginx/1.18.0 (Ubuntu)
Connection: keep-alive
Vary: Origin
Request-Context: appId=cid-v1:b1d896b3-bec7-448b-b764-240152e813e8

Verdicts & Comments Add Verdict or Comment

82 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

75 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.myvisualiq.net/	1970-01-20 21:47:03	Name: tuuid Value: 9042862c-9508-45ba-abe2-343ff3b7e3c8
.myvisualiq.net/	1970-01-20 21:47:03	Name: c Value: 1685463286
.myvisualiq.net/	1970-01-20 21:47:03	Name: tuuid_lu Value: 1685463286
.cosmopolitan-lv.com/	1970-01-20 21:32:39	Name: AMCV_9ECA57E358A5630D0A495C2E%40AdobeOrg Value: MCMID%7C48931434029519994870547116985981337599
.cosmopolitan-lv.com/	1969-12-31 23:59:59	Name: nlid Value: 13db74a8\|174f3aba
.cosmopolitan-lv.com/	1970-01-20 21:32:39	Name: nllastdelid Value: 174f3aba
.www.cosmopolitanlasvegas.com/	1969-12-31 23:59:59	Name: ARRAffinity Value: c696fe9dc1f66c3b42c31c7e297af19671edc6e6bde7bfd531a840f467b13229
.www.cosmopolitanlasvegas.com/	1969-12-31 23:59:59	Name: ARRAffinitySameSite Value: c696fe9dc1f66c3b42c31c7e297af19671edc6e6bde7bfd531a840f467b13229
www.cosmopolitanlasvegas.com/	1970-01-20 12:11:10	Name: XSRF-TOKEN Value: eyJpdiI6ImVOdENFczNYN0NSVkhvSEQ4U0x5dkE9PSIsInZhbHVlIjoiNjNIXC9GZ2luRUo0VGp2ZjNhUGduZUVKQjZKK05HeGl1NkxrYWNIQmdvQms4Slwva0ZXZUJFcTl2UDJLbFlnN1RKIiwibWFjIjoiNzkwOWUwM2M5YjVlZDk0NzgxMjc3OWIxM2YyMjUxY2RjZDkyNmNmN2M3MzI1OGY2NTIxMWM3ZmI0NGIwNTZiYyJ9
www.cosmopolitanlasvegas.com/	1970-01-20 12:11:10	Name: tcolv_identity_prod2_session Value: eyJpdiI6IlZ6UHFPa2JnT21TMEt4cll4Mjl1a3c9PSIsInZhbHVlIjoieWsxZ25TVW1LSTArUzlvMmVjXC8ydHh5WUV6anJJbnYyV1dsdjJ1djRmZEd2Z3NcL0M1dXBkYkRUNzFWMm4rSjcrIiwibWFjIjoiOTA5OGVhMmM1MjJhYTI3MDExNWFjOTlmODJjOTg2YTVhMjE5OWJmYzEzZDE2ZDFlZTU5ZGQ3OWI5OTNiN2ZlYiJ9
.authority.cosmopolitanlasvegas.com/	1969-12-31 23:59:59	Name: ARRAffinity Value: 3ef195cf5a67ac460b90f11efad550e2a7ea82cb73c3f5805474d7edee0abe98
.authority.cosmopolitanlasvegas.com/	1969-12-31 23:59:59	Name: ARRAffinitySameSite Value: 3ef195cf5a67ac460b90f11efad550e2a7ea82cb73c3f5805474d7edee0abe98
authority.cosmopolitanlasvegas.com/	1969-12-31 23:59:59	Name: .AspNetCore.Antiforgery.9fXoN5jHCXs Value: CfDJ8O1wTWQRJftOiMmnp5lBwQnlSePf7Ys4gz17XcWyDfGF2SN_dqHw8-dJ1HjEeC4BKHMEDayg1H3Jdkqx8n0QdI14Zwxnb1XSnVmwuEshgCYotghyZl_gq7FgI2W3UGLlT97wROKh6y3fHC98xC7xzh0
.cosmopolitanlasvegas.com/	1970-01-20 14:20:39	Name: _gcl_au Value: 1.1.1124363491.1685463290
.cosmopolitanlasvegas.com/	1970-01-20 12:12:29	Name: _uetsid Value: 1a5ba450ff0511edbc3739e09e0d3c29
.cosmopolitanlasvegas.com/	1970-01-20 21:32:39	Name: _uetvid Value: 1a5bc6c0ff0511ed8f64d5f657a7afe7
.bing.com/	1970-01-20 21:32:39	Name: MUID Value: 3A9A8AC7A1DA69A404CB99E6A07668BA
.adnxs.com/	1970-01-20 14:20:39	Name: uuid2 Value: 4137122346784741821
.quantserve.com/	1970-01-20 14:20:39	Name: d Value: ENkBBgGOKQISAa7Fsg2e6bRu
.quantserve.com/	1970-01-20 21:41:17	Name: mc Value: 647620fa-2630e-ea9bf-2fbc1
.cosmopolitanlasvegas.com/	1970-01-20 21:35:32	Name: __qca Value: P0-797795175-1685463290053
.doubleclick.net/	1970-01-20 21:32:39	Name: IDE Value: AHWqTUmbSU4xuurG9MJDMAgUOYDmjlKEiX8Nbk3XpTtHZ8WX0QDIpkxBjnO6PpwfCaM
.rfihub.com/	1970-01-20 21:32:39	Name: rud Value: H4sIAAAAAAAA_-MSNjU0sDA1tTQ3sjAwMDSyNDUwMBLiM9Q183ZOyU_19M60NPYCABpcbHolAAAA
.rfihub.com/	1969-12-31 23:59:59	Name: ruds Value: H4sIAAAAAAAA_-MSNjU0sDA1tTQ3sjAwMDSyNDUwMBLiM9Q183ZOyU_19M60NPYCABpcbHolAAAA
.sojern.com/	1970-01-20 20:56:39	Name: gid Value: CAESEKviiyGxtVIeiuvpG7M7zG0
.sojern.com/	1970-01-20 20:56:39	Name: cid Value: f83bf8f5-415e-8bd2-c671-721daded6654#1685404800000
.sojern.com/	1970-01-20 14:20:39	Name: apnid Value: 4137122346784741821
.casalemedia.com/	1970-01-20 20:56:39	Name: CMID Value: ZHYg.jbeBwrcRwYBsZO.sgAA
.casalemedia.com/	1970-01-20 14:20:39	Name: CMPS Value: 3379
.casalemedia.com/	1970-01-20 14:20:39	Name: CMPRO Value: 3379
.cosmopolitanlasvegas.com/	1970-01-20 14:20:39	Name: _fbp Value: fb.1.1685463290262.1823599126
.pubmatic.com/	1970-01-20 14:20:39	Name: KRTBCOOKIE_18 Value: 22947-5108559728001295002
.media.net/	1970-01-20 20:56:39	Name: visitor-id Value: 3284648900733490000V10
.media.net/	1970-01-20 20:55:12	Name: data-rk Value: 5108559728001295002~~3
.eyeota.net/	1970-01-20 12:11:03	Name: SERVERID Value: 23302~DM
www.clarity.ms/	1970-01-20 20:56:39	Name: CLID Value: 4beef5ce9844453dad95106663505003.20230530.20240529
.bidswitch.net/	1970-01-20 20:56:39	Name: tuuid Value: 20fec9ad-de58-4f59-b96e-36a965fa51e6
.bidswitch.net/	1970-01-20 20:56:39	Name: c Value: 1685463290
.bidswitch.net/	1970-01-20 20:56:39	Name: tuuid_lu Value: 1685463290
.demdex.net/	1970-01-20 16:30:15	Name: demdex Value: 28120536432800738234126528738796146679
.cosmopolitanlasvegas.com/	1970-01-20 20:56:39	Name: _clck Value: 1bytzug\|2\|fc1\|0\|1245
.krxd.net/	1970-01-20 16:30:15	Name: _kuid_ Value: Plevl8Z6
.dpm.demdex.net/	1970-01-20 16:30:15	Name: dpm Value: 28120536432800738234126528738796146679
.everesttech.net/	1970-01-20 20:56:39	Name: everest_g_v2 Value: g_surferid~ZHYg_gAODuEHpQBa
.rezync.com/	1970-01-20 16:30:15	Name: zync-uuid Value: 94d5c9a4-4a71-432c-85ca-0d859ecb1554:1685463290.3829129
live.rezync.com/	1970-01-20 16:30:15	Name: sd-session-id Value: .eJwNzDEOwyAMQNG7eA6VMTixuUxEgQG1oVVIlka5exm_9PQvWL9l32Ir7YBw7GeZIL3rqA7hgl5_W3lBALYozLqQIFpSRiS4J-il9_ppa83DqM-cNHrj42KNd5SMcIoGs7CW9LTMPthZ2M-OFB9OSMcL7j-naiVq.ZHYg-g.EvjpWK2YaIO8VrxpAbuqqGOxwB0
.spotxchange.com/	1970-01-20 12:51:22	Name: audience Value: 1a9c6ba2-ff05-11ed-a2b3-1a377c5d0506
.rfihub.com/	1969-12-31 23:59:59	Name: euds Value: H4sIAAAAAAAA_-OSMXR2dA129TWOKKtKCSspifQNdvSo8PXw9M-1cFzFKBDlEZken-7o71Lq6lEQ6JTYxGKWmmKQZmGQYqSbZJ6Spmtiamqma2FikaKbaJlmaZBqZmpglGxmZWhmYWpiZmxkaaBnbGhmamwBAJL2aIhqAAAA
.rfihub.com/	1970-01-20 21:32:39	Name: eud Value: H4sIAAAAAAAA_-OSMXR2dA129TWOKKtKCSspifQNdvSo8PXw9M-1cAziNTSzMDUxMzayNDCyNJ_FiMQ3NDfdhMbfhcY_hcZ_hcb_hcafxITKn4XGX4TGX4XG34TG34WungWVfwuNv4hVIMojMj0-3dHfpdTVoyDQKXEVK5ISE0uzTaxoVnCjeUHYLDXFIM3CIMVIN8k8JU3XxNTUTNfCxCJFN9EyzdIg1czUwCjZzAqhSc_Y0MzU2GKWMLJFpuaL0PiPhFEtAgDOT6pXuQEAAA
.cosmopolitanlasvegas.com/	1970-01-20 12:12:29	Name: _clsk Value: 1jjggqp\|1685463290773\|1\|1\|s.clarity.ms/collect
ciqtracking.com/	1970-01-20 21:47:03	Name: kwsu Value: 647620fab9334a105cdce168
.cosmopolitanlasvegas.com/	1970-01-20 12:11:09	Name: LPVID Value: I4OWE4NWVjYmVjM2M3MjY3
.cosmopolitanlasvegas.com/	1969-12-31 23:59:59	Name: LPSID-88246722 Value: jxdR5NjORHOEz3HOlCKXBg
.tapad.com/	1970-01-20 13:37:27	Name: TapAd_TS Value: 1685463291269
.tapad.com/	1970-01-20 13:37:27	Name: TapAd_DID Value: 4c76a668-a98f-4877-aab5-6cb9e59f8e89
.c.bing.com/	1970-01-20 12:21:08	Name: MR Value: 0
.c.bing.com/	1970-01-20 21:32:39	Name: SRM_B Value: 3A9A8AC7A1DA69A404CB99E6A07668BA
.c.clarity.ms/	1969-12-31 23:59:59	Name: SM Value: C
.clarity.ms/	1970-01-20 21:32:39	Name: MUID Value: 3A9A8AC7A1DA69A404CB99E6A07668BA
.c.clarity.ms/	1970-01-20 12:21:08	Name: MR Value: 0
.c.clarity.ms/	1970-01-20 12:11:03	Name: ANONCHK Value: 0
.triptease.io/	1970-01-20 20:58:05	Name: triptease-user-id Value: 01H1PQ1PMDJNGR7S442WQ1G58R
.triptease.io/	1970-01-20 12:11:32	Name: triptease-session-id Value: 01H1PQ1PMD5M786EPPX7DNCD65
.bidr.io/	1970-01-20 21:39:36	Name: bitoIsSecure Value: ok
.bidr.io/	1970-01-20 21:39:36	Name: bito Value: AAVVbE7I7EIAAB_Jb_KHdw
.adnxs.com/	1970-01-20 14:20:39	Name: anj Value: dTM7k!M40<D>6NRF']wIg2ImLL2nqh!A#Fk.TOKQ9YfZ8=E'gDcw#YRigQuacvjA@if_N<Hw.=+nREuu%`xZUneFI2CW=6f=.PV]>P<L63Pu@MWS/:5d-jMo+w=*f=kWO]g/wMO'TFe/diE[Oa+EO.bGw#Xsgs>Ig$f
.pubmatic.com/	1970-01-20 14:20:39	Name: KRTBCOOKIE_699 Value: 22727-AAC8GU7I7EIAACAzN64rhA
.pubmatic.com/	1970-01-20 12:54:15	Name: PugT Value: 1685463293
.agkn.com/	1970-01-20 20:56:39	Name: ab Value: 0001%3AnSIr%2B%2BDu8LZwmOTGsDP15LU0PezZIUOR
.triptease.io/	1970-01-20 20:58:05	Name: tt-bee-beeswax-id Value: AADvPU7I7EIAACCvuwAmwg
.exelator.com/	1970-01-20 15:03:51	Name: EE Value: "0dd7a262272297536b76c820d3558af5"
.exelator.com/	1970-01-20 15:03:51	Name: ud Value: "eJxrXxzq6XKLQcEgJcU80cjMyMjcyMjS3NTYLMncLNnCyCDF2NTUIjHNdHFZatGCpaXFqSlJh5ZU5JTkNK0uiw91jHdz9PX0iVzmnFGUn5u6AiwU5hq02NDQeEl%252BUWb6IhfXxUUpaQyLSopPBR8x2wEAYKgpig%253D%253D"
.bluekai.com/	1970-01-20 16:30:15	Name: bkdc Value: phx
.bluekai.com/	1970-01-20 16:30:15	Name: bkpa Value: KJpEnXTLu5DlBMD01qcwEnaN5cutz9XN2pHl2xx0cSFXpW0v1CyO0eTvA9==
.bluekai.com/	1970-01-20 16:30:15	Name: bku Value: g/A99w6Q5ZxSaGzd

4 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://idsync.rlcdn.com/360947.gif?partner_uid=5108559728001295002 Message: Failed to load resource: the server responded with a status of 451 ()
network	error	URL: https://idsync.rlcdn.com/501709.gif?partner_uid=ed0f80d2-b7df-4556-848d-a9f90e6502c6%3A1685463290.316538&_=1685463290.3182983 Message: Failed to load resource: the server responded with a status of 451 ()
network	error	URL: https://idsync.rlcdn.com/501709.gif?partner_uid=94d5c9a4-4a71-432c-85ca-0d859ecb1554%3A1685463290.3829129&_=1685463290.3843358 Message: Failed to load resource: the server responded with a status of 451 ()
network	error	URL: https://idsync.rlcdn.com/420356.gif?partner_uid=9042862c-9508-45ba-abe2-343ff3b7e3c8 Message: Failed to load resource: the server responded with a status of 451 ()

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

20843572p.rfihub.com
a.rfihub.com
aa.agkn.com
accdn.lpsnmedia.net
ad.doubleclick.net
ads.stickyadstv.com
adservice.google.com
ajax.aspnetcdn.com
api.triptease.io
authority.cosmopolitanlasvegas.com
b.triptease.io
bat.bing.com
beacon.krxd.net
beacon.sojern.com
bpi.rtactivate.com
c.bing.com
c.clarity.ms
c1.rfihub.net
ciqtracking.com
cm.g.doubleclick.net
connect.facebook.net
contextual.media.net
dpm.demdex.net
dsum-sec.casalemedia.com
fcmatch.google.com
fcmatch.youtube.com
googleads.g.doubleclick.net
ib.adnxs.com
idsync.rlcdn.com
image2.pubmatic.com
live.rezync.com
loadus.exelator.com
lpcdn-a.lpsnmedia.net
lptag.liveperson.net
match.adsrvr.org
match.prod.bidr.io
messages.guest-experience.triptease.io
onboard.triptease.io
p.rfihub.com
partners.tremorhub.com
pixel.quantserve.com
pixel.rubiconproject.com
pixel.sojern.com
ps.eyeota.net
rules.quantcount.com
s.clarity.ms
secure.adnxs.com
secure.quantserve.com
segment.prod.bidr.io
static-meta.triptease.io
static.triptease.io
sync-tm.everesttech.net
sync.search.spotxchange.com
t.myvisualiq.net
t2.em.cosmopolitan-lv.com
tags.bluekai.com
tapestry.tapad.com
targeted-messages.triptease.io
us-u.openx.net
va.v.liveperson.net
vt.myvisualiq.net
www.clarity.ms
www.cosmopolitanlasvegas.com
www.facebook.com
www.google.com
www.google.de
www.googletagmanager.com
x.bidswitch.net
x.dlx.addthis.com
104.111.217.14
104.42.46.9
107.178.244.119
142.250.184.226
142.250.186.102
151.101.1.62
151.101.129.182
151.101.130.49
151.101.2.133
151.101.65.182
152.199.19.160
178.249.97.23
178.249.97.99
18.66.112.57
185.64.190.80
185.80.39.216
185.89.210.122
185.89.210.20
185.94.180.125
193.0.160.130
208.89.12.87
216.200.122.13
23.52.120.27
23.96.124.68
2600:1f18:612b:4264:d57a:9c78:cd9c:28fc
2600:9000:214f:b600:1:76cf:fe80:93a1
2600:9000:223c:dc00:6:44e3:f8c0:93a1
2606:4700:3033::6815:2773
2620:116:800d:21:ef75:8280:f209:5ba1
2620:1ec:4f:1::44
2620:1ec:c11::200
2a00:1450:4001:802::2003
2a00:1450:4001:80b::2008
2a00:1450:4001:812::200e
2a00:1450:4001:829::200e
2a00:1450:4001:82a::2002
2a00:1450:4001:831::2004
2a03:2880:f083:9:face:b00c:0:3
2a03:2880:f176:84:face:b00c:0:25de
3.121.27.153
3.65.79.246
34.111.113.62
34.149.42.49
34.98.64.218
35.157.143.185
35.186.195.233
35.244.174.68
35.71.131.137
40.80.155.102
52.16.141.94
52.201.114.204
52.208.135.117
52.209.157.144
52.31.168.141
52.49.138.187
54.149.49.17
54.78.254.47
65.9.66.64
68.219.88.97
69.173.144.165
95.101.54.106
021ae3202f13a58edf75fc2fd0a0bb0422e8953f2d3edf65e929b4f8bd663678
03903375e5192415755f63297022c723f882093152a41027d91bd9b612aae403
0af3aae90b7de9fdceee2ab421378ea2f54c74be81ef43fc6c1790a032755d80
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
0ca2d5d4dece21114294a8783944cdd00a4351935831b27f9a83b8eb543c6438
104578954004889160a0a8b698f99f9e446582afb1779182523be8a4bc4f1d02
13243171b1f5976e74f79647f612a1d879bfa606816a204f72a833c0e89f269a
18cf414b2e7746b79dc3d6e1ed267c4da4e24e96183d28fd0353c6e34ed2e0fb
1c6507958246e187149d583ddac48d6b211e7873200c4e82fc4e0ea9b9625ac2
1f706ec41bc806a2ff15c0c8ba708e7635562f93fb936a42b1215df896dc1bf2
287cdbeac6168db5e2e7a1320b41059ca7969631f4b2d048dc8faa37d5e8fb48
2e3e3b2660cbfaac5febf7a50b31d0494159989626a84102b2c3792cffe27d13
2e6286b4ec577f49126e30dd1c328dd278a786a4314fed650663a38e503475dd
3219b89ad1082ed6423e640c95fd68041ea666a600296b392435eb6f7e5531be
3491ef1ca659bccbaec555c73b1c829b05f72373b0a5588d9387b089b8e8983f
3a7da1d234dae0a679724e6e8d6bed0fe395b54d98ddc53e78676a8019ef2db1
3e4f5d07904cf355da7bfbca5d4eee18a4c09fc9e6a79df958d0bb1225572983
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
47043e4823a6c21a8881de789b4185355330b5804629d23f6b43dd93f5265292
4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef
4b8636dfe9ce8004bfba66630b44e7e33626605f3b616d1711d62115b34fa1f1
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49
5074816757bcced52a7851e776f5b784ad2a8b085de80d0d391e7da45bf657f1
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87
55c024cff6e1308cae2ff17839d38e8e3db427881d51a79165fa935ce8df74fc
5624aeb2703037c9b669b4903e1961a38778408edcd3bea47e370e5de9f6c571
57ddc31031e1b05a80132ac388b81ea3055a2393ed6f24564f153a9d8633b5a7
5941d1622373ff4da4a0ec6ae2c474a80f2e65763aca377b069690ed4cc26d02
5e6db8e8290df4a3cc2c84e184c5302d377e10c4619179b71e88e71409bae101
6054d9e523ef631e292b2d961cc669b048d7d7ff69b688810c685437c0781673
678497f7b3e9fd06d68022c6ab0b04982decd56ca702594f7b845547f50ae878
679804e244b4127b7ecd99a513b57d6a4f91866410e16da69ce02f98f534051d
6979e6ebd8e0c9b133f9dbe2a28c572b44ee3e3915156cc3e5a6c588e3613773
716565d1b7a9e63d8f6c12ec21b14a1716eeeba39dd490a673d3f48b59dc8208
7cb26cfdbe2cb6314c89913239019dd91859331189d49e0907dda1a10f528129
7eb70257593da06f682a3ddda54a9d260d4fc514f645237f5ca74b08f8da61a6
7ef97b12890fc6fee67f869c6e1f74b6719de7d66ac0d649c8d7386a80b4c30f
811e57dfa425f18746d554724a44ac1d7fc761c5dda00176fe1a40c0918ebe4c
8466a7644fc5c228e5e7f04a247117d3b426d1d024ae13d6ffd21e9d93771cfb
859bc4211e3119cc7d51b174c5326aabc4eff82eda99e9f7eccfb1796cfdca1b
8689d372d731116268e28c632749193f4bbc95b9d6321cf0891d4973aa88bec9
8bb837cf19bb554caa02740e2f9b4ba881980a96cfd9d5c9a522007643e3460e
8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0
98b3d9d20e032f90aca49e9b116225d539ff6fbdb7e42c3c363f63896ac03d2a
9987dcc652130026523219440b654a3e307d16f186019031ad60a28d6f73aa2a
99c2917ee5b2a01459a923bdd1c676f15ee73b62b87f696e6735312d26f51e12
99c71cdb0e5657877604a19c23958637dc2fb343805eba06e6a454d6b6b3621f
9e763360358cf0ad122e88688a6c116c257dbfe22dd2613f1debf334edfa43a9
a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7
a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8
a6cd4b6c0ed5513f3c190bf21dfbf21d3f6ff633835ada97a64317ea5298e978
a729f36b3c8810b6c5d3de55e61ee4e1737f8e09ccbfc9c6a27a153e8fcf5d48
a9afcc94bc4ed53a55f665877ac93019dca5a8bb5c547688657f0e7750fee154
abb78d31c33ab80d8dce5b86ab97f511b9dd18336b5be9af057bb72314eb0a0a
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
b41b956ae1f0b84d1229027a0fd64f1761755652e40539e04d494b0428cf6ee4
b4f963da9920a6beae0f689b3650b399a8a90b373109ceb91aade27a264e95ea
b6757189f6ff58e100d48587516b1b70b9664277f65fe2523418b248f346266a
be709841c3801df4c6f141a7d94e1edc3de54e172f75ed7b72377f8a70baf36c
c5100cd90a95aa459fe237adc409043e20f8fd06caa5cd3b74d66f79387ae0fb
cc0e716595a20cd577f4cba25c11b4b54d92311f5f4bf22b992af281cabbc0c7
d1b7a617951177d643abbae142ec04a01f273d9ce1434123035cb44c54fd60db
d23cfa254dc9eeb59be2aae9e3fe06e2ac10be703179e50b65588658150dd2ba
d5fa375baaa8c2ae0f8a7a42b0ab21695a9ec04c68166ceb44118a6d27405449
dce848263226d6273638d8874dd306ff6eb2883679618764c35e6f10924217b7
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
def5a8ee75fd584a03109d0d6db139dbe5e962e0a9a4b9a9caf36abd7341f3c4
e0d7b985983e1bf19b98d1bf1eea81ca2239b0456281f35401554199e1db6cce
e23decabee8464b650d1d0241283ba0c469806e14a2199efc5bb41771cb673c1
e307f4d4d2208c8b5e06543d942e1348ea1e1e520518647680e24067365de030
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e586a84d8523747f42e510d78e141015b6424cf67d612854e892a7bcedc8ec9e
ebf9705e21d5bfdf0868b6455e788c3491a59f654ee882c1c5dcfaad7168f62a
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f6a1edd7e817eaba3aa6efc1dbebaf2f9c80b03cc6ded9945a1a70dd27ad8610

authority.cosmopolitanlasvegas.com Open in urlscan Pro 40.80.155.102 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

127 Requests

75 %HTTPS

25 %IPv6

46 Domains

69 Subdomains

53 IPs

6 Countries

1858 kBTransfer

4678 kBSize

75 Cookies

1 Outgoing links

Page URL History

Redirected requests

127 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

authority.cosmopolitanlasvegas.com Open in urlscan Pro
40.80.155.102 Public Scan

Screenshot
Live screenshot

Full Image

127
Requests

75 %
HTTPS

25 %
IPv6

46
Domains

69
Subdomains

53
IPs

6
Countries

1858 kB
Transfer

4678 kB
Size

75
Cookies

127 HTTP transactions
0 data transactions