get.greatlifebargains2024.com Open in urlscan Pro
108.178.23.115 Public Scan

Software

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://kandima.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Sun, 10 Dec 2023 00:45:04 GMT
content-encoding: br
strict-transport-security: max-age=31536000
last-modified: Fri, 08 Dec 2023 08:26:31 GMT
accept-ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
etag: "6572d337-1139b"
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=3600
timing-allow-origin: *
content-length: 70555
expires: Sun, 10 Dec 2023 01:45:04 GMT

GET
H2 200 fbevents.js
connect.facebook.net/en_US/ 202 KB
54 KB 24ms
8ms Script
application/x-javascript 157.240.252.13
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/fbevents.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-TNTBBDW

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

157.240.252.13 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	default-src facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com data: blob: 'self';script-src .fbcdn.net .facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;connect-src .fbcdn.net .facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;require-trusted-types-for 'script';
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://kandima.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

permissions-policy-report-only: autoplay=(), clipboard-read=(), clipboard-write=(), display-capture=(), document-domain=(), encrypted-media=(), fullscreen=(), gamepad=(), keyboard-map=(), otp-credentials=(), picture-in-picture=(), xr-spatial-tracking=()
content-security-policy: default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;require-trusted-types-for 'script';
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; preload; includeSubDomains
date: Sun, 10 Dec 2023 00:45:04 GMT
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 54273
x-xss-protection: 0
reporting-endpoints
pragma: public
x-fb-debug: 1+LsQw2soV9zQAerBEb3v1ZlDFsSE3a00Acqb8QoSKWvOSf92NmbH6q0UgvlgoQQJMMqmvR6a1SbizBd/dSh0Q==
cross-origin-opener-policy: same-origin-allow-popups
vary: Accept-Encoding
x-frame-options: DENY
content-type: application/x-javascript; charset=utf-8
cache-control: public, max-age=1200
permissions-policy: accelerometer=(), ambient-light-sensor=(), bluetooth=(), camera=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), usb=(), window-management=()
timing-allow-origin: *
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 bat.js
bat.bing.com/ 45 KB
13 KB 48ms
32ms Script
application/javascript 204.79.197.200
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://bat.bing.com/bat.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-TNTBBDW

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

204.79.197.200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

a-0001.a-msedge.net

Software

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://kandima.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
content-encoding: gzip
date: Sun, 10 Dec 2023 00:45:04 GMT
last-modified: Fri, 10 Nov 2023 20:09:55 GMT
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: B2FEB55CE4C74E4A96754BD8A32DFEC1 Ref B: FRA31EDGE0509 Ref C: 2023-12-10T00:45:04Z
etag: "80abcdf1114da1:0"
vary: Accept-Encoding
x-cache: CONFIG_NOCACHE
content-type: application/javascript
cache-control: private,max-age=1800
accept-ranges: bytes
content-length: 13187

GET
H2 200 pixel.js
www.redditstatic.com/ads/ 23 KB
8 KB 22ms
7ms Script
application/javascript 151.101.65.140
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://www.redditstatic.com/ads/pixel.js
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-TNTBBDW
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.65.140 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: snooserv /
Resource Hash

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://kandima.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Sun, 10 Dec 2023 00:45:04 GMT
content-encoding: gzip
via: 1.1 varnish, 1.1 varnish
last-modified: Thu, 15 Jun 2023 20:49:59 GMT
server: snooserv
nel: {"report_to": "w3-reporting-nel", "max_age": 14400, "include_subdomains": false, "success_fraction": 0.02, "failure_fraction": 0.02}
etag: "4a205643a240cb95fa82289d62b5af7e"
x-amz-server-side-encryption: AES256
vary: Accept-Encoding,Origin
report-to: {"group": "w3-reporting-nel", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting-nel.reddit.com/reports" }]}, {"group": "w3-reporting", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting.reddit.com/reports" }]}, {"group": "w3-reporting-csp", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting-csp.reddit.com/reports" }]}
content-type: application/javascript
cache-control: public, max-age=60
accept-ranges: bytes
content-length: 7409

GET
H2 200 hotel_price_widget.js
www.thehotelsnetwork.com/js/ 17 KB
17 KB 116ms
69ms Script
application/javascript 65.9.95.114
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://www.thehotelsnetwork.com/js/hotel_price_widget.js?hotel_id=1366018&property_id=1027560&account_key=EDF4FBE80F15A1C8D8538BEE57F4C6B5

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-TNTBBDW

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

65.9.95.114 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

fra24s11-in-f14.1e100.net

Software

nginx /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://kandima.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Sun, 10 Dec 2023 00:45:04 GMT
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 3544838dca6112dd616da017a568e76a.cloudfront.net (CloudFront)
last-modified: Tue, 05 Dec 2023 11:13:34 GMT
server: nginx
x-amz-cf-pop: PRG50-C1
vary: Accept-Encoding
x-cache: Miss from cloudfront
content-type: application/javascript; charset=utf-8
access-control-allow-origin: https://kandima.com
cache-control: max-age=7200
access-control-allow-credentials: true
x-amz-cf-id: CHuFiKrylkDa_ZqPozjQe5mCwR8CoNEfL9wRjttnJgokLEoIm0ajOg==

GET
H2 200 871cfyxlvm
www.clarity.ms/tag/ 1017 B
1 KB 122ms
98ms Script
application/x-javascript 13.107.213.45
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://www.clarity.ms/tag/871cfyxlvm?ref=gtm2
Requested by: Host: kandima.com
URL: https://kandima.com/index.php/en
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 13.107.213.45 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://kandima.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

expires: -1
date: Sun, 10 Dec 2023 00:45:04 GMT
x-azure-ref: 20231210T004504Z-8yss07tq1954ra1vtqczxugm1g000000033g0000000120pv
x-cache: CONFIG_NOCACHE
content-type: application/x-javascript
cache-control: no-cache, no-store
accept-ranges: bytes
content-length: 1017
request-context: appId=cid-v1:593e4080-f032-4d00-a652-e17f01252a9d

GET
H2 200 ab.js
js.abtesting.ai/ 2 KB
1 KB 67ms
14ms Script
application/javascript 65.9.95.15
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://js.abtesting.ai/ab.js?userid=4465
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-TNTBBDW
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 65.9.95.15 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-65-9-95-15.prg50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://kandima.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Sat, 09 Dec 2023 09:23:28 GMT
content-encoding: gzip
via: 1.1 b031f43146c9801101822eabdc464390.cloudfront.net (CloudFront)
last-modified: Mon, 27 Sep 2021 15:22:24 GMT
server: AmazonS3
x-amz-cf-pop: PRG50-C1
age: 55297
etag: W/"84dc070891ef2853a3be06cf89de6f01"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
x-amz-cf-id: ssJWS6oRrGnqSXMvoK_UArjKA62B0KyIth-bH5lGveJWIPSeDLmxKg==

GET
H3 200 gtm.js
www.googletagmanager.com/ 122 KB
47 KB 19ms
19ms Script
application/javascript 142.250.185.104
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-KTMQ4P9

Requested by

Host: kandima.com
URL: https://kandima.com/index.php/en

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.104 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s49-in-f8.1e100.net

Software

Google Tag Manager /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://kandima.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Sun, 10 Dec 2023 00:45:04 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 48050
x-xss-protection: 0
last-modified: Sun, 10 Dec 2023 00:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Sun, 10 Dec 2023 00:45:04 GMT

GET
H2 200 sjrn_autocx.js
static.sojern.com/utils/ 14 KB
14 KB 28ms
7ms Script
text/javascript 35.244.188.9
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://static.sojern.com/utils/sjrn_autocx.js
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-TNTBBDW
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.188.9 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 9.188.244.35.bc.googleusercontent.com
Software: UploadServer /
Resource Hash

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://kandima.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Sun, 10 Dec 2023 00:37:34 GMT
age: 450
x-guploader-uploadid: ABPtcPr6YzrkzzVCId8bPY7wakPiO1v_v3l3HlbY2xQCETOzInVNIY_malcRzieGOLtTeTtxZwA
x-goog-storage-class: STANDARD
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 14176
last-modified: Wed, 06 Dec 2023 17:58:08 GMT
server: UploadServer
etag: "22af5834ec874fb43bca987d6f67f7a6"
x-goog-generation: 1701885488916529
x-goog-hash: crc32c=9TsksQ==, md5=Iq9YNOyHT7Q7yph9b2f3pg==
content-type: text/javascript
cache-control: public, max-age=3600
x-goog-stored-content-length: 14176
accept-ranges: bytes
expires: Sun, 10 Dec 2023 01:37:34 GMT

GET
H2 200 f04m1cdfo3
www.clarity.ms/tag/ 650 B
1013 B 192ms
191ms Script
application/x-javascript 13.107.213.45
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://www.clarity.ms/tag/f04m1cdfo3
Requested by: Host: kandima.com
URL: https://kandima.com/index.php/en
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 13.107.213.45 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://kandima.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

expires: -1
date: Sun, 10 Dec 2023 00:45:04 GMT
x-azure-ref: 20231210T004504Z-8yss07tq1954ra1vtqczxugm1g000000033g0000000120pw
x-cache: CONFIG_NOCACHE
content-type: application/x-javascript
cache-control: no-cache, no-store
accept-ranges: bytes
content-length: 650
request-context: appId=cid-v1:3f60b293-70d6-4805-b0bb-3484f0a73bf0

GET
H3

200

activityi;dc_pre=CK3ayIbSg4MDFVrLOwId-ZEO8g;src=6974167;type=invmedia;cat=kandi0;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;gdpr=$%7BGDPR%7D;gdpr_consent=$%7BGDPR_CONSENT_755%7D;...
6974167.fls.doubleclick.net/ Frame 9845
Redirect Chain

https://6974167.fls.doubleclick.net/activityi;src=6974167;type=invmedia;cat=kandi0;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;gdpr=$%7BGDPR%7D;gdpr_consent=$%7BGDPR_CONSENT_755%7...
https://6974167.fls.doubleclick.net/activityi;dc_pre=CK3ayIbSg4MDFVrLOwId-ZEO8g;src=6974167;type=invmedia;cat=kandi0;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;gdpr=$%7BGDPR%7D;g...

453 B
282 B

51ms
50ms

Document
text/html

216.58.206.38
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://6974167.fls.doubleclick.net/activityi;dc_pre=CK3ayIbSg4MDFVrLOwId-ZEO8g;src=6974167;type=invmedia;cat=kandi0;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;gdpr=$%7BGDPR%7D;gdpr_consent=$%7BGDPR_CONSENT_755%7D;ord=6010375985533.27?

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-TNTBBDW

Protocol

Security

QUIC, , AES_128_GCM

Server

216.58.206.38 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lhr35s10-in-f6.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=21600
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://kandima.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=0
content-encoding: br
content-length: 257
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sun, 10 Dec 2023 00:45:04 GMT
expires: Sun, 10 Dec 2023 00:45:04 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
strict-transport-security: max-age=21600
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

Redirect headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, must-revalidate
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sun, 10 Dec 2023 00:45:04 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
follow-only-when-prerender-shown: 1
location: https://6974167.fls.doubleclick.net/activityi;dc_pre=CK3ayIbSg4MDFVrLOwId-ZEO8g;src=6974167;type=invmedia;cat=kandi0;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;gdpr=$%7BGDPR%7D;gdpr_consent=$%7BGDPR_CONSENT_755%7D;ord=6010375985533.27?
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
pragma: no-cache
server: cafe
strict-transport-security: max-age=21600
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

POST
H2 200 collect
www.google-analytics.com/j/ 3 B
205 B 14ms
13ms XHR
text/plain 142.250.184.206
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j101&a=1955871195&t=pageview&_s=1&dl=https%3A%2F%2Fkandima.com%2Findex.php%2Fen&ul=en-us&de=UTF-8&dt=Best%20Resorts%20In%20Maldives%20%7C%20Maldives%20Family%20Resort%20%7C%20Maldives%20Holidays&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YGBAgEABAAAAACAAI~&jid=1500686178&gjid=484731817&cid=448115994.1702169104&tid=UA-72502179-1&_gid=466436.1702169104&_slc=1&gtm=45He3bt0n81TNTBBDWv863944072&gcd=11l1l1l1l1&dma_cps=sypham&dma=1&z=714310485

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.184.206 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://kandima.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Sun, 10 Dec 2023 00:45:04 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://kandima.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 3
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 200 collect
stats.g.doubleclick.net/j/ 4 B
346 B 49ms
16ms XHR
text/plain 108.177.15.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j101&tid=UA-72502179-1&cid=448115994.1702169104&jid=1500686178&gjid=484731817&_gid=466436.1702169104&_u=YGBAgEABAAAAAGAAI~&z=1155822082

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

108.177.15.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

wr-in-f155.1e100.net

Software

Golfe2 /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://kandima.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
strict-transport-security: max-age=10886400; includeSubDomains; preload
date: Sun, 10 Dec 2023 00:45:04 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://kandima.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 rp.gif
alb.reddit.com/ 42 B
637 B 20ms
6ms Image
image/gif 151.101.65.140
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://alb.reddit.com/rp.gif?ts=1702169104429&id=t2_4gzvctiqz&event=PageVisit&m.itemCount=undefined&m.value=&m.valueDecimal=undefined&m.currency=undefined&m.transactionId=&m.customEventName=&m.products=&m.conversionId=&uuid=b67922b4-11c4-43f8-b898-f28bec65f82a&aaid=&em=&external_id=&idfa=&integration=gtm&opt_out=0&sh=1600&sw=1200&v=rdt_f5bd31b2
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 151.101.65.140 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: Varnish /
Resource Hash

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://kandima.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Sun, 10 Dec 2023 00:45:04 GMT
via: 1.1 varnish
nel: {"report_to": "w3-reporting-nel", "max_age": 14400, "include_subdomains": false, "success_fraction": 0.3, "failure_fraction": 0.3}
server: Varnish
report-to: {"group": "w3-reporting-nel", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting-nel.reddit.com/reports" }]}, {"group": "w3-reporting", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting.reddit.com/reports" }]}, {"group": "w3-reporting-csp", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting-csp.reddit.com/reports" }]}
content-type: image/gif
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
content-length: 42
retry-after: 0

GET
H2 200 /
www.google.com/pagead/1p-user-list/10855587029/ 42 B
455 B 39ms
20ms Image
image/gif 172.217.18.4
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/10855587029/?random=1702169104383&cv=11&fst=1702166400000&bg=ffffff&guid=ON&async=1&gtm=45He3bt0v863944072&u_w=1600&u_h=1200&url=https%3A%2F%2Fkandima.com%2Findex.php%2Fen&frm=0&tiba=Best%20Resorts%20In%20Maldives%20%7C%20Maldives%20Family%20Resort%20%7C%20Maldives%20Holidays&fmt=3&is_vtc=1&cid=CAQSGwDICaaNmjbrFHRDI9LG6gpcR07v_wTTtQUJ9w&random=1434569856&rmt_tld=0&ipr=y

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.18.4 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra02s19-in-f4.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://kandima.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 10 Dec 2023 00:45:04 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.de/pagead/1p-user-list/10855587029/ 42 B
455 B 36ms
17ms Image
image/gif 142.250.185.131
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/10855587029/?random=1702169104383&cv=11&fst=1702166400000&bg=ffffff&guid=ON&async=1&gtm=45He3bt0v863944072&u_w=1600&u_h=1200&url=https%3A%2F%2Fkandima.com%2Findex.php%2Fen&frm=0&tiba=Best%20Resorts%20In%20Maldives%20%7C%20Maldives%20Family%20Resort%20%7C%20Maldives%20Holidays&fmt=3&is_vtc=1&cid=CAQSGwDICaaNmjbrFHRDI9LG6gpcR07v_wTTtQUJ9w&random=1434569856&rmt_tld=1&ipr=y

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.131 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s50-in-f3.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://kandima.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 10 Dec 2023 00:45:04 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 trackpoint-async.js
s2.adform.net/banners/scripts/st/ 81 KB
31 KB 83ms
20ms Script
application/javascript 37.157.2.248
ADFORM

General

Check archive.org

Show headers Download Go to

Full URL: https://s2.adform.net/banners/scripts/st/trackpoint-async.js
Requested by: Host: kandima.com
URL: https://kandima.com/index.php/en
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 37.157.2.248 , Denmark, ASN198622 (ADFORM, DK),
Reverse DNS
Software: nginx /
Resource Hash

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://kandima.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Sun, 10 Dec 2023 00:45:04 GMT
content-encoding: gzip
last-modified: Tue, 23 May 2023 09:56:34 GMT
server: nginx
x-amz-request-id: tx0000053bcca4dd019c109-00646c8ee1-32950a8f-default
etag: W/"f937ab3eef01c118930b200e5087d00d"
x-cache-status: HIT
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
x-rgw-object-type: Normal
cache-control: public, max-age=604800

GET
H2 200 813705700011592
connect.facebook.net/signals/config/ 133 KB
35 KB 72ms
72ms Script
application/x-javascript 157.240.252.13
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/signals/config/813705700011592?v=2.9.138&r=stable&domain=kandima.com

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

157.240.252.13 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	default-src facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com data: blob: 'self';script-src .fbcdn.net .facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;connect-src .fbcdn.net .facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;require-trusted-types-for 'script';
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://kandima.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

permissions-policy-report-only: autoplay=(), clipboard-read=(), clipboard-write=(), display-capture=(), document-domain=(), encrypted-media=(), fullscreen=(), gamepad=(), keyboard-map=(), otp-credentials=(), picture-in-picture=(), xr-spatial-tracking=()
content-security-policy: default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;require-trusted-types-for 'script';
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; preload; includeSubDomains
date: Sun, 10 Dec 2023 00:45:04 GMT
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
x-xss-protection: 0
reporting-endpoints
pragma: public
x-fb-debug: rwKvSAnRqZ7ubBIxDsEAe13Kn6YKxZDecWfO6X3a0eCZammfxeD+b54EQxoYOJq8f3o5BalBaM/P00RP0WupFQ==
cross-origin-opener-policy: same-origin-allow-popups
vary: Accept-Encoding
x-frame-options: DENY
content-type: application/x-javascript; charset=utf-8
origin-agent-cluster: ?0
cache-control: public, max-age=1200
permissions-policy: accelerometer=(), ambient-light-sensor=(), bluetooth=(), camera=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), usb=(), window-management=()
timing-allow-origin: *
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET collect
tagmanager.kandima.com/g/ 0
0

GET
H2 200 271000633.js
bat.bing.com/p/action/ 4 KB
2 KB 36ms
35ms Script
application/javascript 204.79.197.200
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://bat.bing.com/p/action/271000633.js

Requested by

Host: bat.bing.com
URL: https://bat.bing.com/bat.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

204.79.197.200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

a-0001.a-msedge.net

Software

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://kandima.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
content-encoding: br
date: Sun, 10 Dec 2023 00:45:04 GMT
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 9E63B3233867436C889D8DE7D457C893 Ref B: FRA31EDGE0509 Ref C: 2023-12-10T00:45:04Z
vary: Accept-Encoding
x-cache: CONFIG_NOCACHE
content-type: application/javascript; charset=utf-8
cache-control: private,max-age=60

GET
H2 204 0
bat.bing.com/action/ 0
285 B 31ms
31ms Image
text/plain 204.79.197.200
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://bat.bing.com/action/0?ti=271000633&tm=gtm002&Ver=2&mid=25d5af02-96b1-4ce1-8f1c-d9e7a1ae2fa8&sid=5bb46c6096f511eebe44f383d707919a&vid=5bb45e3096f511eebe56f183f79fb8d4&vids=1&msclkid=N&pi=1200101525&lg=en-US&sw=1600&sh=1200&sc=24&tl=Best%20Resorts%20In%20Maldives%20%7C%20Maldives%20Family%20Resort%20%7C%20Maldives%20Holidays&p=https%3A%2F%2Fkandima.com%2Findex.php%2Fen&r=&evt=pageLoad&sv=1&rn=790565

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

204.79.197.200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

a-0001.a-msedge.net

Software

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://kandima.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

pragma: no-cache
strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Sun, 10 Dec 2023 00:45:04 GMT
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: D24963AD76384F48A4F2B1D431177B0E Ref B: FRA31EDGE0509 Ref C: 2023-12-10T00:45:04Z
x-cache: CONFIG_NOCACHE
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ga-audiences
www.google.com/ads/ 42 B
107 B 18ms
17ms Image
image/gif 172.217.18.4
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j101&tid=UA-72502179-1&cid=448115994.1702169104&jid=1500686178&_u=YGBAgEABAAAAAGAAI~&z=347649433

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.18.4 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra02s19-in-f4.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://kandima.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 10 Dec 2023 00:45:04 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ga-audiences
www.google.de/ads/ 42 B
107 B 17ms
17ms Image
image/gif 142.250.185.131
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j101&tid=UA-72502179-1&cid=448115994.1702169104&jid=1500686178&_u=YGBAgEABAAAAAGAAI~&z=347649433

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.131 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s50-in-f3.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://kandima.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 10 Dec 2023 00:45:04 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 271000633
www.clarity.ms/tag/uet/ 829 B
1 KB 186ms
186ms Script
application/x-javascript 13.107.213.45
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://www.clarity.ms/tag/uet/271000633
Requested by: Host: bat.bing.com
URL: https://bat.bing.com/p/action/271000633.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 13.107.213.45 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://kandima.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

expires: -1
date: Sun, 10 Dec 2023 00:45:04 GMT
x-azure-ref: 20231210T004504Z-8yss07tq1954ra1vtqczxugm1g000000033g0000000120q7
x-cache: CONFIG_NOCACHE
content-type: application/x-javascript
cache-control: no-cache, no-store
accept-ranges: bytes
content-length: 829
request-context: appId=cid-v1:3d284f99-f285-495c-ac33-dedd7ecf1ac8

GET
H2 200 twk-main.js
embed.tawk.to/_s/v4/app/65706adf2ac/js/ 121 B
275 B 16ms
15ms Script
application/javascript 104.22.25.131
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://embed.tawk.to/_s/v4/app/65706adf2ac/js/twk-main.js

Requested by

Host: embed.tawk.to
URL: https://embed.tawk.to/57f61e4e8bab9a1c11333c5f/default

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.22.25.131 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://kandima.com/
Origin: https://kandima.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Sun, 10 Dec 2023 00:45:04 GMT
strict-transport-security: max-age=0; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: br
age: 298068
x-cache-status: HIT
alt-svc: h3=":443"; ma=86400
last-modified: Wed, 06 Dec 2023 12:38:18 GMT
server: cloudflare
etag: W/"da5bb1dc647470204df0e49f5afac2de"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=2592000, immutable
cf-ray: 8331768738341d86-FRA

GET
H2 200 twk-vendor.js
embed.tawk.to/_s/v4/app/65706adf2ac/js/ 81 KB
29 KB 18ms
18ms Script
application/javascript 104.22.25.131
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://embed.tawk.to/_s/v4/app/65706adf2ac/js/twk-vendor.js

Requested by

Host: embed.tawk.to
URL: https://embed.tawk.to/57f61e4e8bab9a1c11333c5f/default

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.22.25.131 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://kandima.com/
Origin: https://kandima.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Sun, 10 Dec 2023 00:45:04 GMT
strict-transport-security: max-age=0; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: br
age: 298068
x-cache-status: HIT
alt-svc: h3=":443"; ma=86400
last-modified: Wed, 06 Dec 2023 12:38:18 GMT
server: cloudflare
etag: W/"ce3014b09c6dfbd6f92bc585fd840580"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=2592000, immutable
cf-ray: 8331768738351d86-FRA

GET
H2 200 twk-chunk-vendors.js
embed.tawk.to/_s/v4/app/65706adf2ac/js/ 212 KB
62 KB 24ms
24ms Script
application/javascript 104.22.25.131
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://embed.tawk.to/_s/v4/app/65706adf2ac/js/twk-chunk-vendors.js

Requested by

Host: embed.tawk.to
URL: https://embed.tawk.to/57f61e4e8bab9a1c11333c5f/default

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.22.25.131 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://kandima.com/
Origin: https://kandima.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Sun, 10 Dec 2023 00:45:04 GMT
strict-transport-security: max-age=0; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: br
age: 298068
x-cache-status: HIT
alt-svc: h3=":443"; ma=86400
last-modified: Wed, 06 Dec 2023 12:38:18 GMT
server: cloudflare
etag: W/"86b32a04921a039ace69980bacd1b639"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=2592000, immutable
cf-ray: 8331768738371d86-FRA

GET
H2 200 twk-chunk-common.js
embed.tawk.to/_s/v4/app/65706adf2ac/js/ 219 KB
43 KB 21ms
21ms Script
application/javascript 104.22.25.131
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://embed.tawk.to/_s/v4/app/65706adf2ac/js/twk-chunk-common.js

Requested by

Host: embed.tawk.to
URL: https://embed.tawk.to/57f61e4e8bab9a1c11333c5f/default

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.22.25.131 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://kandima.com/
Origin: https://kandima.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Sun, 10 Dec 2023 00:45:04 GMT
strict-transport-security: max-age=0; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: br
age: 298068
x-cache-status: HIT
alt-svc: h3=":443"; ma=86400
last-modified: Wed, 06 Dec 2023 12:38:18 GMT
server: cloudflare
etag: W/"38be29de8e673b78fc1bc8782cc309ef"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=2592000, immutable
cf-ray: 8331768738381d86-FRA

GET
H2 200 twk-runtime.js
embed.tawk.to/_s/v4/app/65706adf2ac/js/ 2 KB
1 KB 17ms
17ms Script
application/javascript 104.22.25.131
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://embed.tawk.to/_s/v4/app/65706adf2ac/js/twk-runtime.js

Requested by

Host: embed.tawk.to
URL: https://embed.tawk.to/57f61e4e8bab9a1c11333c5f/default

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.22.25.131 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://kandima.com/
Origin: https://kandima.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Sun, 10 Dec 2023 00:45:04 GMT
strict-transport-security: max-age=0; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: br
age: 298067
x-cache-status: HIT
alt-svc: h3=":443"; ma=86400
last-modified: Wed, 06 Dec 2023 12:38:18 GMT
server: cloudflare
etag: W/"6ceae9a9b739d629086cf4d74c0bbd2b"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=2592000, immutable
cf-ray: 83317687383b1d86-FRA

GET
H2 200 twk-app.js
embed.tawk.to/_s/v4/app/65706adf2ac/js/ 151 B
207 B 19ms
19ms Script
application/javascript 104.22.25.131
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://embed.tawk.to/_s/v4/app/65706adf2ac/js/twk-app.js

Requested by

Host: embed.tawk.to
URL: https://embed.tawk.to/57f61e4e8bab9a1c11333c5f/default

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.22.25.131 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://kandima.com/
Origin: https://kandima.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Sun, 10 Dec 2023 00:45:04 GMT
strict-transport-security: max-age=0; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: br
age: 298068
x-cache-status: HIT
alt-svc: h3=":443"; ma=86400
last-modified: Wed, 06 Dec 2023 12:38:18 GMT
server: cloudflare
etag: W/"e736e189edb5d0d9d5b8e7f23dd9114a"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=2592000, immutable
cf-ray: 83317687383c1d86-FRA

GET
H2 200 get_loader_data
www.thehotelsnetwork.com/ 17 KB
17 KB 141ms
141ms Fetch
application/json 65.9.95.114
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://www.thehotelsnetwork.com/get_loader_data?hotel_id=1366018&property_id=1027560&account_key=EDF4FBE80F15A1C8D8538BEE57F4C6B5

Requested by

Host: www.thehotelsnetwork.com
URL: https://www.thehotelsnetwork.com/js/hotel_price_widget.js?hotel_id=1366018&property_id=1027560&account_key=EDF4FBE80F15A1C8D8538BEE57F4C6B5

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

65.9.95.114 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://kandima.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Sun, 10 Dec 2023 00:45:04 GMT
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 3544838dca6112dd616da017a568e76a.cloudfront.net (CloudFront)
server: nginx
x-amz-cf-pop: PRG50-C1
vary: Accept-Encoding
x-cache: Miss from cloudfront
content-type: application/json; charset=utf-8
access-control-allow-origin: https://kandima.com
access-control-allow-credentials: true
x-amz-cf-id: IdUW2WwDvbj6AEqLTnx4Gf5xJrNivBxLaXq8BsUrVx2aY9lX5FLwnQ==

GET /
external.abtesting.ai/fetch_ab_test/ 0
0

GET
H2 200 11.html
static.sojern.com/cip/c/ Frame D8B7 10 KB
10 KB 7ms
7ms Document
text/html 35.244.188.9
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://static.sojern.com/cip/c/11.html?f_v=cp_v1_js&p_v=1&version=5&auto_url=https%3A%2F%2Fkandima.com%2Findex.php%2Fen&auto_ccid=qrbqf-bir94-861ar-ziq7g-8bdke&auto_ga=448115994.1702169104&e_eml=null&auto_eml=&auto_eml_count=0&auto_eml_domain=&ws=1600x1200&tz=-60&n=tf%3ANGd8MTB8MHw4fDR8ZW4tVVN8ZW4tVVMsZW58V2luMzJ8ZmFsc2V8fDF8MjR8MjR8MTYwMHwxMjAwfDM3NjAwMDAwMDB8RXVyb3BlL0JlcmxpbnxmYWxzZQ%3D%3D&pt=TRACKING&hpid=38053&pc=%2Findex.php%2Fen&ccid=&md5_eml=&sha1_eml=&sha256_eml=&et=
Requested by: Host: kandima.com
URL: https://kandima.com/index.php/en
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.188.9 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 9.188.244.35.bc.googleusercontent.com
Software: UploadServer /
Resource Hash

Request headers

Referer: https://kandima.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 3043
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: public, max-age=3600
content-length: 10096
content-type: text/html
date: Sat, 09 Dec 2023 23:54:21 GMT
etag: "8f26ead04e20810b6e44ec3bc313260f"
expires: Sun, 10 Dec 2023 00:54:21 GMT
last-modified: Mon, 04 Dec 2023 15:03:26 GMT
server: UploadServer
x-goog-generation: 1701702206328882
x-goog-hash: crc32c=tgny3Q== md5=jybq0E4ggQtuROw7wxMmDw==
x-goog-metageneration: 1
x-goog-storage-class: STANDARD
x-goog-stored-content-encoding: identity
x-goog-stored-content-length: 10096
x-guploader-uploadid: ABPtcPqTNjGbmWnWPMqtBPrmw2vLwQpaL5fiPMQjeR-H6bFAK3HULNvXZKvAgbQA2xqEM0JdIw

GET
H2 200 dc_pre=CL3pxobSg4MDFSrJOwIdTacJyw;src=11770200;type=invmedia;cat=remar0;ord=986162301697;auiddc=*;u1=Kandima%20Maldives;gtm=45He3bt0v863944072;gcd=11l1l1l1l1;dma_cps=sypham;dma=1;uaa=;uab=;uafvl=;u...
adservice.google.com/ddm/fls/z/ Frame F545 42 B
401 B 65ms
44ms Image
image/gif 142.250.186.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://adservice.google.com/ddm/fls/z/dc_pre=CL3pxobSg4MDFSrJOwIdTacJyw;src=11770200;type=invmedia;cat=remar0;ord=986162301697;auiddc=*;u1=Kandima%20Maldives;gtm=45He3bt0v863944072;gcd=11l1l1l1l1;dma_cps=sypham;dma=1;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;epver=2;~oref=https%3A%2F%2Fkandima.com%2Findex.php%2Fen

Requested by

Host: 11770200.fls.doubleclick.net
URL: https://11770200.fls.doubleclick.net/activityi;dc_pre=CL3pxobSg4MDFSrJOwIdTacJyw;src=11770200;type=invmedia;cat=remar0;ord=986162301697;auiddc=1659377937.1702169104;u1=Kandima%20Maldives;gtm=45He3bt0v863944072;gcd=11l1l1l1l1;dma_cps=sypham;dma=1;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;epver=2;~oref=https%3A%2F%2Fkandima.com%2Findex.php%2Fen?

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s08-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://11770200.fls.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 10 Dec 2023 00:45:04 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 hasher.js
static.sojern.com/cip/ Frame D8B7 18 KB
18 KB 7ms
7ms Script
text/javascript 35.244.188.9
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://static.sojern.com/cip/hasher.js
Requested by: Host: static.sojern.com
URL: https://static.sojern.com/cip/c/11.html?f_v=cp_v1_js&p_v=1&version=5&auto_url=https%3A%2F%2Fkandima.com%2Findex.php%2Fen&auto_ccid=qrbqf-bir94-861ar-ziq7g-8bdke&auto_ga=448115994.1702169104&e_eml=null&auto_eml=&auto_eml_count=0&auto_eml_domain=&ws=1600x1200&tz=-60&n=tf%3ANGd8MTB8MHw4fDR8ZW4tVVN8ZW4tVVMsZW58V2luMzJ8ZmFsc2V8fDF8MjR8MjR8MTYwMHwxMjAwfDM3NjAwMDAwMDB8RXVyb3BlL0JlcmxpbnxmYWxzZQ%3D%3D&pt=TRACKING&hpid=38053&pc=%2Findex.php%2Fen&ccid=&md5_eml=&sha1_eml=&sha256_eml=&et=
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.188.9 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 9.188.244.35.bc.googleusercontent.com
Software: UploadServer /
Resource Hash

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://static.sojern.com/cip/c/11.html?f_v=cp_v1_js&p_v=1&version=5&auto_url=https%3A%2F%2Fkandima.com%2Findex.php%2Fen&auto_ccid=qrbqf-bir94-861ar-ziq7g-8bdke&auto_ga=448115994.1702169104&e_eml=null&auto_eml=&auto_eml_count=0&auto_eml_domain=&ws=1600x1200&tz=-60&n=tf%3ANGd8MTB8MHw4fDR8ZW4tVVN8ZW4tVVMsZW58V2luMzJ8ZmFsc2V8fDF8MjR8MjR8MTYwMHwxMjAwfDM3NjAwMDAwMDB8RXVyb3BlL0JlcmxpbnxmYWxzZQ%3D%3D&pt=TRACKING&hpid=38053&pc=%2Findex.php%2Fen&ccid=&md5_eml=&sha1_eml=&sha256_eml=&et=
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Sun, 10 Dec 2023 00:07:48 GMT
age: 2236
x-guploader-uploadid: ABPtcPpC8KbiCU9zXLAtl3MZSMoHCSk18loWPhrb3RnAzSM6CU6YI-d4XEje87GCc1HEACqHBWk
x-goog-storage-class: STANDARD
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 18469
last-modified: Tue, 07 Dec 2021 16:23:19 GMT
server: UploadServer
etag: "676881567863e15eb1b6aa81b384455c"
x-goog-generation: 1638894199335821
x-goog-hash: crc32c=T9fXIw==, md5=Z2iBVnhj4V6xtqqBs4RFXA==
content-type: text/javascript
cache-control: public, max-age=3600
x-goog-stored-content-length: 18469
accept-ranges: bytes
expires: Sun, 10 Dec 2023 01:07:48 GMT

GET
H2 200 create_params.js
static.sojern.com/utils/ Frame D8B7 4 KB
4 KB 9ms
9ms Script
text/javascript 35.244.188.9
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://static.sojern.com/utils/create_params.js
Requested by: Host: static.sojern.com
URL: https://static.sojern.com/cip/c/11.html?f_v=cp_v1_js&p_v=1&version=5&auto_url=https%3A%2F%2Fkandima.com%2Findex.php%2Fen&auto_ccid=qrbqf-bir94-861ar-ziq7g-8bdke&auto_ga=448115994.1702169104&e_eml=null&auto_eml=&auto_eml_count=0&auto_eml_domain=&ws=1600x1200&tz=-60&n=tf%3ANGd8MTB8MHw4fDR8ZW4tVVN8ZW4tVVMsZW58V2luMzJ8ZmFsc2V8fDF8MjR8MjR8MTYwMHwxMjAwfDM3NjAwMDAwMDB8RXVyb3BlL0JlcmxpbnxmYWxzZQ%3D%3D&pt=TRACKING&hpid=38053&pc=%2Findex.php%2Fen&ccid=&md5_eml=&sha1_eml=&sha256_eml=&et=
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.188.9 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 9.188.244.35.bc.googleusercontent.com
Software: UploadServer /
Resource Hash

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://static.sojern.com/cip/c/11.html?f_v=cp_v1_js&p_v=1&version=5&auto_url=https%3A%2F%2Fkandima.com%2Findex.php%2Fen&auto_ccid=qrbqf-bir94-861ar-ziq7g-8bdke&auto_ga=448115994.1702169104&e_eml=null&auto_eml=&auto_eml_count=0&auto_eml_domain=&ws=1600x1200&tz=-60&n=tf%3ANGd8MTB8MHw4fDR8ZW4tVVN8ZW4tVVMsZW58V2luMzJ8ZmFsc2V8fDF8MjR8MjR8MTYwMHwxMjAwfDM3NjAwMDAwMDB8RXVyb3BlL0JlcmxpbnxmYWxzZQ%3D%3D&pt=TRACKING&hpid=38053&pc=%2Findex.php%2Fen&ccid=&md5_eml=&sha1_eml=&sha256_eml=&et=
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Sun, 10 Dec 2023 00:16:24 GMT
age: 1720
x-guploader-uploadid: ABPtcPpsA3crTw_6kkK-zifWmXMef6V53aIU0wgYkO5HbFqbxveE0d3eG_ZUD6DtMQvpCmgj0q9kRnv0Fw
x-goog-storage-class: STANDARD
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4169
last-modified: Mon, 06 Nov 2023 11:24:16 GMT
server: UploadServer
etag: "2b163d716f1c21a97c6c0251b281d84b"
x-goog-generation: 1699269856296451
x-goog-hash: crc32c=/7KU3A==, md5=KxY9cW8cIal8bAJRsoHYSw==
content-type: text/javascript
cache-control: public, max-age=3600
x-goog-stored-content-length: 4169
accept-ranges: bytes
expires: Sun, 10 Dec 2023 01:16:24 GMT

GET
H2 200 clarity.js
www.clarity.ms/s/0.7.20/ 60 KB
25 KB 13ms
12ms Script
application/javascript 13.107.213.45
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://www.clarity.ms/s/0.7.20/clarity.js
Requested by: Host: www.clarity.ms
URL: https://www.clarity.ms/tag/871cfyxlvm?ref=gtm2
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 13.107.213.45 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://kandima.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Sun, 10 Dec 2023 00:45:04 GMT
content-encoding: br
last-modified: Mon, 04 Dec 2023 12:08:18 GMT
etag: W/"0x8DBF4C1B3818466"
vary: Accept-Encoding
x-azure-ref: 20231210T004504Z-8yss07tq1954ra1vtqczxugm1g000000033g0000000120qa
content-type: application/javascript;charset=utf-8
access-control-allow-origin: *
x-ms-request-id: a83e7593-d01e-0008-28ad-2634d4000000
cache-control: public, max-age=86400
x-cache: TCP_HIT
x-ms-version: 2018-03-28

GET
H2

200

c.gif
c.clarity.ms/
Redirect Chain

https://c.clarity.ms/c.gif
https://c.bing.com/c.gif?ctsa=mr&CtsSyncId=306DEB08674A4D31A1238163D1A8F070&RedC=c.clarity.ms&MXFR=1EFD208E5A16668423B8336D5E166829
https://c.clarity.ms/c.gif?ctsa=mr&CtsSyncId=306DEB08674A4D31A1238163D1A8F070&MUID=1C0761AA109460B113267249111F6127

42 B
442 B

26ms
26ms

Image
image/gif

68.219.88.97
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://c.clarity.ms/c.gif?ctsa=mr&CtsSyncId=306DEB08674A4D31A1238163D1A8F070&MUID=1C0761AA109460B113267249111F6127
Protocol: H2
Server: 68.219.88.97 Dublin, Ireland, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://kandima.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 10 Dec 2023 00:45:04 GMT
last-modified: Wed, 30 Aug 2023 19:01:41 GMT
server: Microsoft-IIS/10.0
etag: "8d59566974dbd91:0"
x-powered-by: ASP.NET
content-type: image/gif
p3p: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
cache-control: private, no-cache, proxy-revalidate, no-store
accept-ranges: bytes
content-length: 42

Redirect headers

pragma: no-cache
date: Sun, 10 Dec 2023 00:45:04 GMT
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: BC2341CED756458E95996277476A79F6 Ref B: FRA31EDGE0509 Ref C: 2023-12-10T00:45:04Z
x-powered-by: ASP.NET
x-cache: CONFIG_NOCACHE
p3p: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
location: https://c.clarity.ms/c.gif?ctsa=mr&CtsSyncId=306DEB08674A4D31A1238163D1A8F070&MUID=1C0761AA109460B113267249111F6127
cache-control: private, no-cache, proxy-revalidate, no-store
content-length: 0

GET
H3 200 314380142352348
connect.facebook.net/signals/config/ 140 KB
36 KB 68ms
68ms Script
application/x-javascript 157.240.252.13
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/signals/config/314380142352348?v=2.9.138&r=stable&domain=kandima.com

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

Security

QUIC, , AES_128_GCM

Server

157.240.252.13 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	default-src facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com data: blob: 'self';script-src .fbcdn.net .facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;connect-src .fbcdn.net .facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;require-trusted-types-for 'script';
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://kandima.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

permissions-policy-report-only: autoplay=(), clipboard-read=(), clipboard-write=(), display-capture=(), document-domain=(), encrypted-media=(), fullscreen=(), gamepad=(), keyboard-map=(), otp-credentials=(), picture-in-picture=(), xr-spatial-tracking=()
content-security-policy: default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;require-trusted-types-for 'script';
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; preload; includeSubDomains
date: Sun, 10 Dec 2023 00:45:04 GMT
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
x-xss-protection: 0
reporting-endpoints
pragma: public
x-fb-debug: i3zHdYvBo9cUtlgaHSRTMiKzT03KE8IVbzSzWe8LBmhIPynpZiY6hLCtHtQPqi+IkxHuaR5DmYOKSTzim0I44w==
cross-origin-opener-policy: same-origin-allow-popups
vary: Accept-Encoding
x-frame-options: DENY
content-type: application/x-javascript; charset=utf-8
origin-agent-cluster: ?0
cache-control: public, max-age=1200
permissions-policy: accelerometer=(), ambient-light-sensor=(), bluetooth=(), camera=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), usb=(), window-management=()
timing-allow-origin: *
priority: u=3,i
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 /
www.facebook.com/tr/ 0
185 B 20ms
7ms Image
text/plain 157.240.251.35
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=813705700011592&ev=PageView&dl=https%3A%2F%2Fkandima.com%2Findex.php%2Fen&rl=&if=false&ts=1702169104563&sw=1600&sh=1200&v=2.9.138&r=stable&a=tmSimo-GTM-WebTemplate&ec=0&o=4126&fbp=fb.1.1702169104563.360984301&ler=empty&it=1702169104443&coo=false&tm=1&rqm=GET

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

157.240.251.35 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

fra24s11-in-f14.1e100.net

Software

proxygen-bolt /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://kandima.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
date: Sun, 10 Dec 2023 00:45:04 GMT
server: proxygen-bolt
content-type: text/plain
access-control-allow-origin
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 0

GET
H2 200 widget-settings
va.tawk.to/v1/ 3 KB
1 KB 466ms
458ms Fetch
application/json 104.22.25.131
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://va.tawk.to/v1/widget-settings?propertyId=57f61e4e8bab9a1c11333c5f&widgetId=default&sv=null

Requested by

Host: embed.tawk.to
URL: https://embed.tawk.to/_s/v4/app/65706adf2ac/js/twk-chunk-common.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.22.25.131 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://kandima.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Sun, 10 Dec 2023 00:45:05 GMT
strict-transport-security: max-age=0; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: REVALIDATED
content-encoding: br
alt-svc: h3=":443"; ma=86400
x-served-by: visitor-application-preemptive-7plj
server: cloudflare
etag: W/"2-28-0"
vary: Accept-Encoding
access-control-allow-methods: GET,OPTIONS
content-type: application/json
access-control-allow-origin: *
cache-control: public, max-age=7200, s-maxage=1800
cf-ray: 83317687b8751d86-FRA
access-control-allow-headers: content-type,x-tawk-token

GET /
asia.adform.net/Serving/TrackPoint/ 0
0

GET
H2 200 dc_pre=CK3ayIbSg4MDFVrLOwId-ZEO8g;src=6974167;type=invmedia;cat=kandi0;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;gdpr=$%7BGDPR%7D;gdpr_consent=$%7BGDPR_CONSENT_755%7D;ord=601037...
adservice.google.com/ddm/fls/z/ Frame 9845 42 B
107 B 45ms
45ms Image
image/gif 142.250.186.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://adservice.google.com/ddm/fls/z/dc_pre=CK3ayIbSg4MDFVrLOwId-ZEO8g;src=6974167;type=invmedia;cat=kandi0;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;gdpr=$%7BGDPR%7D;gdpr_consent=$%7BGDPR_CONSENT_755%7D;ord=6010375985533.27

Requested by

Host: 6974167.fls.doubleclick.net
URL: https://6974167.fls.doubleclick.net/activityi;dc_pre=CK3ayIbSg4MDFVrLOwId-ZEO8g;src=6974167;type=invmedia;cat=kandi0;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;gdpr=$%7BGDPR%7D;gdpr_consent=$%7BGDPR_CONSENT_755%7D;ord=6010375985533.27?

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s08-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://6974167.fls.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 10 Dec 2023 00:45:04 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST start
va.tawk.to/v1/session/ 0
0

OPTIONS
H2 200 start
va.tawk.to/v1/session/ Frame 0
0 153ms
153ms Preflight 104.22.25.131
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://va.tawk.to/v1/session/start

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.22.25.131 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=0; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://kandima.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: content-type,x-tawk-token
access-control-allow-methods: POST,OPTIONS
access-control-allow-origin: https://kandima.com
alt-svc: h3=":443"; ma=86400
cf-cache-status: DYNAMIC
cf-ray: 83317687b87d1d86-FRA
date: Sun, 10 Dec 2023 00:45:04 GMT
server: cloudflare
strict-transport-security: max-age=0; includeSubDomains; preload
x-content-type-options: nosniff
x-served-by: visitor-application-preemptive-70df

GET
H2 200 11
beacon.sojern.com/pixel/cp/ Frame D8B7 8 KB
3 KB 38ms
17ms Script
application/javascript 107.178.244.119
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://beacon.sojern.com/pixel/cp/11?f_v=cp_v3_js&p_v=4&f_v=cp_v1_js&cid=s%3Dccid_ga%7Cccid_auto%7Cf_v%3Dcp_v1_js%7Cp_v%3D1%7Cversion%3D5%7Cauto_url%3Dhttps%253A%252F%252Fkandima.com%252Findex.php%252Fen%7Cauto_ccid%3Dqrbqf-bir94-861ar-ziq7g-8bdke%7Cauto_ga%3D448115994.1702169104%7Cauto_eml_count%3D0%7Cws%3D1600x1200%7Ctz%3D-60%7Cn%3Dtf%253ANGd8MTB8MHw4fDR8ZW4tVVN8ZW4tVVMsZW58V2luMzJ8ZmFsc2V8fDF8MjR8MjR8MTYwMHwxMjAwfDM3NjAwMDAwMDB8RXVyb3BlL0JlcmxpbnxmYWxzZQ%253D%253D%7Cpt%3DTRACKING%7Chpid%3D38053%7Cpc%3D%252Findex.php%252Fen%7Cccid%3D%7Cmd5_eml%3D%7Csha1_eml%3D%7Csha256_eml%3D%7Cet%3D&p_v=1&version=5&ws=1600x1200&tz=-60&n=tf%3ANGd8MTB8MHw4fDR8ZW4tVVN8ZW4tVVMsZW58V2luMzJ8ZmFsc2V8fDF8MjR8MjR8MTYwMHwxMjAwfDM3NjAwMDAwMDB8RXVyb3BlL0JlcmxpbnxmYWxzZQ%3D%3D&pt=TRACKING&hpid=38053&pc=%2Findex.php%2Fen&ccid=448115994.1702169104%7Cqrbqf-bir94-861ar-ziq7g-8bdke&md5_eml=&sha1_eml=&sha256_eml=&et=&domain=https%3A%2F%2Fkandima.com%2Findex.php%2Fen&s=ccid_ga%7Cccid_auto
Requested by: Host: static.sojern.com
URL: https://static.sojern.com/cip/c/11.html?f_v=cp_v1_js&p_v=1&version=5&auto_url=https%3A%2F%2Fkandima.com%2Findex.php%2Fen&auto_ccid=qrbqf-bir94-861ar-ziq7g-8bdke&auto_ga=448115994.1702169104&e_eml=null&auto_eml=&auto_eml_count=0&auto_eml_domain=&ws=1600x1200&tz=-60&n=tf%3ANGd8MTB8MHw4fDR8ZW4tVVN8ZW4tVVMsZW58V2luMzJ8ZmFsc2V8fDF8MjR8MjR8MTYwMHwxMjAwfDM3NjAwMDAwMDB8RXVyb3BlL0JlcmxpbnxmYWxzZQ%3D%3D&pt=TRACKING&hpid=38053&pc=%2Findex.php%2Fen&ccid=&md5_eml=&sha1_eml=&sha256_eml=&et=
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 107.178.244.119 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 119.244.178.107.bc.googleusercontent.com
Software: /
Resource Hash

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://static.sojern.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Sun, 10 Dec 2023 00:45:04 GMT
content-encoding: gzip
via: 1.1 google
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
access-control-allow-credentials: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000

GET
H3 200 collect
www.google-analytics.com/ 35 B
55 B 6ms
6ms Image
image/gif 142.250.184.206
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j101&a=1955871195&t=event&ni=1&_s=2&dl=https%3A%2F%2Fkandima.com%2Findex.php%2Fen&ul=en-us&de=UTF-8&dt=Best%20Resorts%20In%20Maldives%20%7C%20Maldives%20Family%20Resort%20%7C%20Maldives%20Holidays&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&ec=Clarity&ea=t3xuow&_u=aHBAgEABAAAAAGAAI~&jid=&gjid=&cid=448115994.1702169104&tid=UA-72502179-1&_gid=466436.1702169104&gtm=45He3bt0n81TNTBBDWv863944072&gcd=11l1l1l1l1&dma_cps=sypham&dma=1&cd1=https%3A%2F%2Fclarity.microsoft.com%2Fga%2F871cfyxlvm%2Frhgjuq%2Ft3xuow&z=408555594

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.184.206 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://kandima.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 09 Dec 2023 20:50:26 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 14078
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H3 200 fbevents.js
connect.facebook.net/en_US/ Frame D8B7 202 KB
53 KB 7ms
7ms Script
application/x-javascript 157.240.252.13
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/fbevents.js

Requested by

Host: beacon.sojern.com
URL: https://beacon.sojern.com/pixel/cp/11?f_v=cp_v3_js&p_v=4&f_v=cp_v1_js&cid=s%3Dccid_ga%7Cccid_auto%7Cf_v%3Dcp_v1_js%7Cp_v%3D1%7Cversion%3D5%7Cauto_url%3Dhttps%253A%252F%252Fkandima.com%252Findex.php%252Fen%7Cauto_ccid%3Dqrbqf-bir94-861ar-ziq7g-8bdke%7Cauto_ga%3D448115994.1702169104%7Cauto_eml_count%3D0%7Cws%3D1600x1200%7Ctz%3D-60%7Cn%3Dtf%253ANGd8MTB8MHw4fDR8ZW4tVVN8ZW4tVVMsZW58V2luMzJ8ZmFsc2V8fDF8MjR8MjR8MTYwMHwxMjAwfDM3NjAwMDAwMDB8RXVyb3BlL0JlcmxpbnxmYWxzZQ%253D%253D%7Cpt%3DTRACKING%7Chpid%3D38053%7Cpc%3D%252Findex.php%252Fen%7Cccid%3D%7Cmd5_eml%3D%7Csha1_eml%3D%7Csha256_eml%3D%7Cet%3D&p_v=1&version=5&ws=1600x1200&tz=-60&n=tf%3ANGd8MTB8MHw4fDR8ZW4tVVN8ZW4tVVMsZW58V2luMzJ8ZmFsc2V8fDF8MjR8MjR8MTYwMHwxMjAwfDM3NjAwMDAwMDB8RXVyb3BlL0JlcmxpbnxmYWxzZQ%3D%3D&pt=TRACKING&hpid=38053&pc=%2Findex.php%2Fen&ccid=448115994.1702169104%7Cqrbqf-bir94-861ar-ziq7g-8bdke&md5_eml=&sha1_eml=&sha256_eml=&et=&domain=https%3A%2F%2Fkandima.com%2Findex.php%2Fen&s=ccid_ga%7Cccid_auto

Protocol

Security

QUIC, , AES_128_GCM

Server

157.240.252.13 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

fra16s08-in-f206.1e100.net

Software

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	default-src facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com data: blob: 'self';script-src .fbcdn.net .facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;connect-src .fbcdn.net .facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;require-trusted-types-for 'script';
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://static.sojern.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

permissions-policy-report-only: autoplay=(), clipboard-read=(), clipboard-write=(), display-capture=(), document-domain=(), encrypted-media=(), fullscreen=(), gamepad=(), keyboard-map=(), otp-credentials=(), picture-in-picture=(), xr-spatial-tracking=()
content-security-policy: default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;require-trusted-types-for 'script';
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; preload; includeSubDomains
date: Sun, 10 Dec 2023 00:45:04 GMT
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 54273
x-xss-protection: 0
reporting-endpoints
pragma: public
x-fb-debug: 1+LsQw2soV9zQAerBEb3v1ZlDFsSE3a00Acqb8QoSKWvOSf92NmbH6q0UgvlgoQQJMMqmvR6a1SbizBd/dSh0Q==
cross-origin-opener-policy: same-origin-allow-popups
vary: Accept-Encoding
x-frame-options: DENY
content-type: application/x-javascript; charset=utf-8
cache-control: public, max-age=1200
permissions-policy: accelerometer=(), ambient-light-sensor=(), bluetooth=(), camera=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), usb=(), window-management=()
timing-allow-origin: *
priority: u=3,i
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 trackpoint-async.js
s2.adform.net/banners/scripts/st/ Frame D8B7 81 KB
31 KB 27ms
27ms Script
application/javascript 37.157.2.248
ADFORM

General

Check archive.org

Show headers Download Go to

Full URL: https://s2.adform.net/banners/scripts/st/trackpoint-async.js
Requested by: Host: beacon.sojern.com
URL: https://beacon.sojern.com/pixel/cp/11?f_v=cp_v3_js&p_v=4&f_v=cp_v1_js&cid=s%3Dccid_ga%7Cccid_auto%7Cf_v%3Dcp_v1_js%7Cp_v%3D1%7Cversion%3D5%7Cauto_url%3Dhttps%253A%252F%252Fkandima.com%252Findex.php%252Fen%7Cauto_ccid%3Dqrbqf-bir94-861ar-ziq7g-8bdke%7Cauto_ga%3D448115994.1702169104%7Cauto_eml_count%3D0%7Cws%3D1600x1200%7Ctz%3D-60%7Cn%3Dtf%253ANGd8MTB8MHw4fDR8ZW4tVVN8ZW4tVVMsZW58V2luMzJ8ZmFsc2V8fDF8MjR8MjR8MTYwMHwxMjAwfDM3NjAwMDAwMDB8RXVyb3BlL0JlcmxpbnxmYWxzZQ%253D%253D%7Cpt%3DTRACKING%7Chpid%3D38053%7Cpc%3D%252Findex.php%252Fen%7Cccid%3D%7Cmd5_eml%3D%7Csha1_eml%3D%7Csha256_eml%3D%7Cet%3D&p_v=1&version=5&ws=1600x1200&tz=-60&n=tf%3ANGd8MTB8MHw4fDR8ZW4tVVN8ZW4tVVMsZW58V2luMzJ8ZmFsc2V8fDF8MjR8MjR8MTYwMHwxMjAwfDM3NjAwMDAwMDB8RXVyb3BlL0JlcmxpbnxmYWxzZQ%3D%3D&pt=TRACKING&hpid=38053&pc=%2Findex.php%2Fen&ccid=448115994.1702169104%7Cqrbqf-bir94-861ar-ziq7g-8bdke&md5_eml=&sha1_eml=&sha256_eml=&et=&domain=https%3A%2F%2Fkandima.com%2Findex.php%2Fen&s=ccid_ga%7Cccid_auto
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 37.157.2.248 , Denmark, ASN198622 (ADFORM, DK),
Reverse DNS
Software: nginx /
Resource Hash

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://static.sojern.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Sun, 10 Dec 2023 00:45:04 GMT
content-encoding: gzip
last-modified: Tue, 23 May 2023 09:56:34 GMT
server: nginx
x-amz-request-id: tx0000053bcca4dd019c109-00646c8ee1-32950a8f-default
etag: W/"f937ab3eef01c118930b200e5087d00d"
x-cache-status: HIT
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
x-rgw-object-type: Normal
cache-control: public, max-age=604800

GET
H2

200

src=10775858;dc_pre=CP_L1IbSg4MDFRLLOwIdg0INMg;type=track0;cat=kandi0;qty=1;cost=0;u1=s%253Dccid_ga%257Cccid_auto%257Cf_v%253Dcp_v1_js%257Cp_v%253D1%257Cversion%253D5%257Cauto_url%253Dhttps%25253A%...
adservice.google.com/ddm/fls/z/ Frame D8B7
Redirect Chain

https://ad.doubleclick.net/ddm/activity/src=10775858;type=track0;cat=kandi0;qty=1;cost=0;u1=s%253Dccid_ga%257Cccid_auto%257Cf_v%253Dcp_v1_js%257Cp_v%253D1%257Cversion%253D5%257Cauto_url%253Dhttps%2...
https://ad.doubleclick.net/ddm/activity/src=10775858;dc_pre=CP_L1IbSg4MDFRLLOwIdg0INMg;type=track0;cat=kandi0;qty=1;cost=0;u1=s%253Dccid_ga%257Cccid_auto%257Cf_v%253Dcp_v1_js%257Cp_v%253D1%257Cvers...
https://adservice.google.com/ddm/fls/z/src=10775858;dc_pre=CP_L1IbSg4MDFRLLOwIdg0INMg;type=track0;cat=kandi0;qty=1;cost=0;u1=s%253Dccid_ga%257Cccid_auto%257Cf_v%253Dcp_v1_js%257Cp_v%253D1%257Cversi...

42 B
107 B

45ms
45ms

Image
image/gif

142.250.186.162
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://adservice.google.com/ddm/fls/z/src=10775858;dc_pre=CP_L1IbSg4MDFRLLOwIdg0INMg;type=track0;cat=kandi0;qty=1;cost=0;u1=s%253Dccid_ga%257Cccid_auto%257Cf_v%253Dcp_v1_js%257Cp_v%253D1%257Cversion%253D5%257Cauto_url%253Dhttps%25253A%25252F%25252Fkandima.com%25252Findex.php%25252Fen%257Cauto_ccid%253Dqrbqf-bir94-861ar-ziq7g-8bdke%257Cauto_ga%253D448115994.1702169104%257Cauto_eml_count%253D0%257Cws%253D1600x1200%257Ctz%253D-60%257Cn%253Dtf%25253ANGd8MTB8MHw4fDR8ZW4tVVN8ZW4tVVMsZW58V2luMzJ8ZmFsc2V8fDF8MjR8MjR8MTYwMHwxMjAwfDM3NjAwMDAwMDB8RXVyb3BlL0JlcmxpbnxmYWxzZQ%25253D%25253D%257Cpt%253DTRACKING%257Chpid%253D38053%257Cpc%253D%25252Findex.php%25252Fen%257Cccid%253D%257Cmd5_eml%253D%257Csha1_eml%253D%257Csha256_eml%253D%257Cet%253D;u2=;u3=;u4=;u5=;u6=;u8=;u9=;u10=;u11=;u12=;u13=;u14=;u15=;u16=%252Findex.php%252Fen;u17=;u18=;u19=38053;u20=;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;npa=;gdpr=$%7BGDPR%7D;gdpr_consent=$%7BGDPR_CONSENT_755%7D;ord=orderID

Requested by

Host: static.sojern.com
URL: https://static.sojern.com/cip/c/11.html?f_v=cp_v1_js&p_v=1&version=5&auto_url=https%3A%2F%2Fkandima.com%2Findex.php%2Fen&auto_ccid=qrbqf-bir94-861ar-ziq7g-8bdke&auto_ga=448115994.1702169104&e_eml=null&auto_eml=&auto_eml_count=0&auto_eml_domain=&ws=1600x1200&tz=-60&n=tf%3ANGd8MTB8MHw4fDR8ZW4tVVN8ZW4tVVMsZW58V2luMzJ8ZmFsc2V8fDF8MjR8MjR8MTYwMHwxMjAwfDM3NjAwMDAwMDB8RXVyb3BlL0JlcmxpbnxmYWxzZQ%3D%3D&pt=TRACKING&hpid=38053&pc=%2Findex.php%2Fen&ccid=&md5_eml=&sha1_eml=&sha256_eml=&et=

Protocol

Server

142.250.186.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s08-in-f2.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://static.sojern.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 10 Dec 2023 00:45:04 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Sun, 10 Dec 2023 00:45:04 GMT
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://adservice.google.com/ddm/fls/z/src=10775858;dc_pre=CP_L1IbSg4MDFRLLOwIdg0INMg;type=track0;cat=kandi0;qty=1;cost=0;u1=s%253Dccid_ga%257Cccid_auto%257Cf_v%253Dcp_v1_js%257Cp_v%253D1%257Cversion%253D5%257Cauto_url%253Dhttps%25253A%25252F%25252Fkandima.com%25252Findex.php%25252Fen%257Cauto_ccid%253Dqrbqf-bir94-861ar-ziq7g-8bdke%257Cauto_ga%253D448115994.1702169104%257Cauto_eml_count%253D0%257Cws%253D1600x1200%257Ctz%253D-60%257Cn%253Dtf%25253ANGd8MTB8MHw4fDR8ZW4tVVN8ZW4tVVMsZW58V2luMzJ8ZmFsc2V8fDF8MjR8MjR8MTYwMHwxMjAwfDM3NjAwMDAwMDB8RXVyb3BlL0JlcmxpbnxmYWxzZQ%25253D%25253D%257Cpt%253DTRACKING%257Chpid%253D38053%257Cpc%253D%25252Findex.php%25252Fen%257Cccid%253D%257Cmd5_eml%253D%257Csha1_eml%253D%257Csha256_eml%253D%257Cet%253D;u2=;u3=;u4=;u5=;u6=;u8=;u9=;u10=;u11=;u12=;u13=;u14=;u15=;u16=%252Findex.php%252Fen;u17=;u18=;u19=38053;u20=;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;npa=;gdpr=$%7BGDPR%7D;gdpr_consent=$%7BGDPR_CONSENT_755%7D;ord=orderID
content-type: text/html; charset=UTF-8
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

AdX
pixel.sojern.com/idSync/ Frame D8B7
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_cm=true&google_hm=pOtPhufZqDEFg1XvYmhn8g&google_nid=sojern__adx_open_bidder_seat&google_sc=true&sjrn_id=74FRvSUpPntnOF0v9bUVZLEr4BOu1RnloLsxN5gDZIocDe3RSdA...
https://pixel.sojern.com/idSync/AdX?exchangeProfileId=&sjrn_id=74FRvSUpPntnOF0v9bUVZLEr4BOu1RnloLsxN5gDZIocDe3RSdAIwZ6jUjZj-Az6&sjrn_ula=6618214998&google_gid=CAESEDNRfN35lG47DDh17ZnCxnM&google_cver=1

42 B
275 B

15ms
15ms

Image
image/gif

107.178.244.119
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.sojern.com/idSync/AdX?exchangeProfileId=&sjrn_id=74FRvSUpPntnOF0v9bUVZLEr4BOu1RnloLsxN5gDZIocDe3RSdAIwZ6jUjZj-Az6&sjrn_ula=6618214998&google_gid=CAESEDNRfN35lG47DDh17ZnCxnM&google_cver=1
Requested by: Host: static.sojern.com
URL: https://static.sojern.com/cip/c/11.html?f_v=cp_v1_js&p_v=1&version=5&auto_url=https%3A%2F%2Fkandima.com%2Findex.php%2Fen&auto_ccid=qrbqf-bir94-861ar-ziq7g-8bdke&auto_ga=448115994.1702169104&e_eml=null&auto_eml=&auto_eml_count=0&auto_eml_domain=&ws=1600x1200&tz=-60&n=tf%3ANGd8MTB8MHw4fDR8ZW4tVVN8ZW4tVVMsZW58V2luMzJ8ZmFsc2V8fDF8MjR8MjR8MTYwMHwxMjAwfDM3NjAwMDAwMDB8RXVyb3BlL0JlcmxpbnxmYWxzZQ%3D%3D&pt=TRACKING&hpid=38053&pc=%2Findex.php%2Fen&ccid=&md5_eml=&sha1_eml=&sha256_eml=&et=
Protocol: H2
Server: 107.178.244.119 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 119.244.178.107.bc.googleusercontent.com
Software: /
Resource Hash

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://static.sojern.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Sun, 10 Dec 2023 00:45:04 GMT
via: 1.1 google
vary: Accept-Encoding
content-type: image/gif
access-control-allow-origin: *
access-control-allow-credentials: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42

Redirect headers

pragma: no-cache
date: Sun, 10 Dec 2023 00:45:04 GMT
server: HTTP server (unknown)
content-type: text/html; charset=UTF-8
location: https://pixel.sojern.com/idSync/AdX?exchangeProfileId=&sjrn_id=74FRvSUpPntnOF0v9bUVZLEr4BOu1RnloLsxN5gDZIocDe3RSdAIwZ6jUjZj-Az6&sjrn_ula=6618214998&google_gid=CAESEDNRfN35lG47DDh17ZnCxnM&google_cver=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 413
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

pixel
fcmatch.youtube.com/ Frame D8B7
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_hm=pOtPhufZqDEFg1XvYmhn8g&google_nid=sojern_adh
https://fcmatch.google.com/pixel?google_gm=AMnCDoqgv9pSgYL-y6ljo-RvOhCJ8wGIJkGKF4Wm6F5DY9h1LgQb1wWhf5XrGhErHHQjVeaUIKuGjbwmVvJnyiUlcovLDlVkKbOolo2sJ0Zv27YdU_tZ1MY
https://fcmatch.youtube.com/pixel?google_gm=AMnCDoqgv9pSgYL-y6ljo-RvOhCJ8wGIJkGKF4Wm6F5DY9h1LgQb1wWhf5XrGhErHHQjVeaUIKuGjbwmVvJnyiUlcovLDlVkKbOolo2sJ0Zv27YdU_tZ1MY

170 B
432 B

86ms
53ms

Image
image/png

172.217.16.206
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://fcmatch.youtube.com/pixel?google_gm=AMnCDoqgv9pSgYL-y6ljo-RvOhCJ8wGIJkGKF4Wm6F5DY9h1LgQb1wWhf5XrGhErHHQjVeaUIKuGjbwmVvJnyiUlcovLDlVkKbOolo2sJ0Zv27YdU_tZ1MY

Requested by

Protocol

Server

172.217.16.206 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://static.sojern.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 10 Dec 2023 00:45:04 GMT
server: HTTP server (unknown)
x-frame-options: SAMEORIGIN
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Sun, 10 Dec 2023 00:45:04 GMT
server: HTTP server (unknown)
x-frame-options: SAMEORIGIN
content-type: text/html; charset=UTF-8
location: https://fcmatch.youtube.com/pixel?google_gm=AMnCDoqgv9pSgYL-y6ljo-RvOhCJ8wGIJkGKF4Wm6F5DY9h1LgQb1wWhf5XrGhErHHQjVeaUIKuGjbwmVvJnyiUlcovLDlVkKbOolo2sJ0Zv27YdU_tZ1MY
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 360
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 getuidnb
ib.adnxs.com/ Frame D8B7 43 B
576 B 21ms
8ms Image
image/gif 37.252.171.53
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/getuidnb?https://pixel.sojern.com/idsync/apn?id=$UID&sjrn_id=74FRvSUpPntnOF0v9bUVZLEr4BOu1RnloLsxN5gDZIocDe3RSdAIwZ6jUjZj-Az6

Requested by

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

37.252.171.53 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

1003.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net

Software

nginx/1.23.4 /

Resource Hash

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://static.sojern.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 10 Dec 2023 00:45:04 GMT
an-x-request-uuid: 9a9d6c4c-6b42-450b-9110-8be50929fdb8
server: nginx/1.23.4
accept-ch: Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
p3p: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-type: image/gif
access-control-allow-origin: *
cache-control: no-store, no-cache, private
access-control-allow-credentials: true
x-proxy-origin: 138.199.38.133; 138.199.38.133; 1003.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; adnxs.com
content-length: 43
x-xss-protection: 0
expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2 200 generic
match.adsrvr.org/track/cmf/ Frame D8B7 70 B
149 B 90ms
30ms Image
image/gif 52.223.40.198
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://match.adsrvr.org/track/cmf/generic?ttd_pid=ombl9hp&ttd_puid=74FRvSUpPntnOF0v9bUVZLEr4BOu1RnloLsxN5gDZIocDe3RSdAIwZ6jUjZj-Az6&ttd_tpi=1
Requested by: Host: static.sojern.com
URL: https://static.sojern.com/cip/c/11.html?f_v=cp_v1_js&p_v=1&version=5&auto_url=https%3A%2F%2Fkandima.com%2Findex.php%2Fen&auto_ccid=qrbqf-bir94-861ar-ziq7g-8bdke&auto_ga=448115994.1702169104&e_eml=null&auto_eml=&auto_eml_count=0&auto_eml_domain=&ws=1600x1200&tz=-60&n=tf%3ANGd8MTB8MHw4fDR8ZW4tVVN8ZW4tVVMsZW58V2luMzJ8ZmFsc2V8fDF8MjR8MjR8MTYwMHwxMjAwfDM3NjAwMDAwMDB8RXVyb3BlL0JlcmxpbnxmYWxzZQ%3D%3D&pt=TRACKING&hpid=38053&pc=%2Findex.php%2Fen&ccid=&md5_eml=&sha1_eml=&sha256_eml=&et=
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.223.40.198 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a6370ebea231e0c9a.awsglobalaccelerator.com
Software: Kestrel /
Resource Hash

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://static.sojern.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Sun, 10 Dec 2023 00:45:04 GMT
server: Kestrel
content-length: 70
content-type: image/gif

GET
H2

202

adf
pixel.sojern.com/idsync/ Frame D8B7
Redirect Chain

https://c1.adform.net/serving/cookie/match?cid=a4eb4f86-e7d9-a831-0583-55ef626867f2&party=1296
https://c1.adform.net/serving/cookie/match?CC=1&cid=a4eb4f86-e7d9-a831-0583-55ef626867f2&party=1296
https://pixel.sojern.com/idsync/adf?adfid=4241594229422815698&cid=a4eb4f86-e7d9-a831-0583-55ef626867f2

0
209 B

15ms
14ms

Image
text/plain

107.178.244.119
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.sojern.com/idsync/adf?adfid=4241594229422815698&cid=a4eb4f86-e7d9-a831-0583-55ef626867f2
Requested by: Host: static.sojern.com
URL: https://static.sojern.com/cip/c/11.html?f_v=cp_v1_js&p_v=1&version=5&auto_url=https%3A%2F%2Fkandima.com%2Findex.php%2Fen&auto_ccid=qrbqf-bir94-861ar-ziq7g-8bdke&auto_ga=448115994.1702169104&e_eml=null&auto_eml=&auto_eml_count=0&auto_eml_domain=&ws=1600x1200&tz=-60&n=tf%3ANGd8MTB8MHw4fDR8ZW4tVVN8ZW4tVVMsZW58V2luMzJ8ZmFsc2V8fDF8MjR8MjR8MTYwMHwxMjAwfDM3NjAwMDAwMDB8RXVyb3BlL0JlcmxpbnxmYWxzZQ%3D%3D&pt=TRACKING&hpid=38053&pc=%2Findex.php%2Fen&ccid=&md5_eml=&sha1_eml=&sha256_eml=&et=
Protocol: H2
Server: 107.178.244.119 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 119.244.178.107.bc.googleusercontent.com
Software: /
Resource Hash

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://static.sojern.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

access-control-allow-origin: *
date: Sun, 10 Dec 2023 00:45:04 GMT
via: 1.1 google
access-control-allow-credentials: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
vary: Accept-Encoding

Redirect headers

pragma: no-cache
date: Sun, 10 Dec 2023 00:45:04 GMT
strict-transport-security: max-age=31536000; includeSubDomains
server: nginx
accept-ch: Sec-CH-UA,Sec-CH-UA-Arch,Sec-CH-UA-Bitness,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Mobile,Sec-CH-UA-Model,Sec-CH-UA-Platform,Sec-CH-UA-Platform-Version
access-control-max-age: 86400
access-control-allow-methods: GET
location: https://pixel.sojern.com/idsync/adf?adfid=4241594229422815698&cid=a4eb4f86-e7d9-a831-0583-55ef626867f2
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate, no-transform
access-control-allow-credentials: true
access-control-allow-headers: Content-Type,Cache-Control,Accept-Encoding,X-Requested-With
content-length: 0
expires: -1

GET
H2 200 /
www.facebook.com/tr/ 0
31 B 7ms
7ms Image
text/plain 157.240.251.35
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=314380142352348&ev=PageView&dl=https%3A%2F%2Fkandima.com%2Findex.php%2Fen&rl=&if=false&ts=1702169104639&sw=1600&sh=1200&v=2.9.138&r=stable&ec=0&o=4158&fbp=fb.1.1702169104563.360984301&ler=empty&cs_est=true&it=1702169104443&coo=false&tm=1&rqm=GET

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

157.240.251.35 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://kandima.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
date: Sun, 10 Dec 2023 00:45:04 GMT
server: proxygen-bolt
content-type: text/plain
access-control-allow-origin
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 0

GET
H3 200 791801461733103
connect.facebook.net/signals/config/ Frame D8B7 133 KB
35 KB 79ms
79ms Script
application/x-javascript 157.240.252.13
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/signals/config/791801461733103?v=2.9.138&r=stable&domain=kandima.com

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

Security

QUIC, , AES_128_GCM

Server

157.240.252.13 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	default-src facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com data: blob: 'self';script-src .fbcdn.net .facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;connect-src .fbcdn.net .facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;require-trusted-types-for 'script';
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://static.sojern.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

permissions-policy-report-only: autoplay=(), clipboard-read=(), clipboard-write=(), display-capture=(), document-domain=(), encrypted-media=(), fullscreen=(), gamepad=(), keyboard-map=(), otp-credentials=(), picture-in-picture=(), xr-spatial-tracking=()
content-security-policy: default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;require-trusted-types-for 'script';
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; preload; includeSubDomains
date: Sun, 10 Dec 2023 00:45:04 GMT
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
x-xss-protection: 0
reporting-endpoints
pragma: public
x-fb-debug: dGXpgYoHfJvnR1Irt7Y1JkP1Ys8EYDpkQE4szeWPBMSXNI1MftXLB2lI0IgNJgXMtvXdF/a8ZSOCjuXW2F9r3Q==
cross-origin-opener-policy: same-origin-allow-popups
vary: Accept-Encoding
x-frame-options: DENY
content-type: application/x-javascript; charset=utf-8
origin-agent-cluster: ?0
cache-control: public, max-age=1200
permissions-policy: accelerometer=(), ambient-light-sensor=(), bluetooth=(), camera=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), usb=(), window-management=()
timing-allow-origin: *
priority: u=3,i
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2

200

sync_cookie_image_finish
mc.yandex.ru/
Redirect Chain

https://mc.yandex.com/sync_cookie_image_check
https://mc.yandex.ru/sync_cookie_image_start?redirect_domain=mc.yandex.com&token=10212.jaKrPOZxJ_qN_oWWoKcPD7m9iLdLShkR16KM7yUolad0WOxvDYXlhvp_1jprNVWR.8BBMpqHfvTY7W-frwJe2DSK5hmc%2C
https://mc.yandex.com/sync_cookie_image_decide?token=10212.UWTfCYZNcIBetM3WbaPAb6lUz-_o4pHZhY0m_tKNx_cColKlP-jU_ojoEIUxJhYIC1-YKsnUEccc9zK5Lk3idyV1Q4ylRoh8wOPNPYTWtq6M5in1qf_dpVfCMqK7EfY1E44nEyJOXH...
https://mc.yandex.ru/sync_cookie_image_finish?redirect_domain=mc.yandex.com&token=10212.PcBiWxgueV52VDNJ2YTqbtBB34DLliLpdYirMbfMVae3wQjxQqS6uR5gZjbebxmSSdQGCU8QDozFvkVV2Z2oZKX8Y7pNdbZX6zSKNoXp7PTap...

43 B
581 B

53ms
52ms

Image
image/gif

87.250.251.119
TELETECH

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://mc.yandex.ru/sync_cookie_image_finish?redirect_domain=mc.yandex.com&token=10212.PcBiWxgueV52VDNJ2YTqbtBB34DLliLpdYirMbfMVae3wQjxQqS6uR5gZjbebxmSSdQGCU8QDozFvkVV2Z2oZKX8Y7pNdbZX6zSKNoXp7PTapjGHPO1FLncVsSXumJGp3E-6Bjv2yfjXeHSFg76HzTD3cTsb5yWTXUG4P0Rb4J9AMPPSvV-SjfUwXCl3JatfrCMfqck82QJVJomdJCC73w%2C%2C.yysWMrB80wwNEtW2gIU8PoBAaPs%2C

Protocol

Server

87.250.251.119 , Russian Federation, ASN208398 (TELETECH, RS),

Reverse DNS

Software

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://kandima.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Sun, 10 Dec 2023 00:45:04 GMT
strict-transport-security: max-age=31536000
content-length: 43
x-xss-protection: 1; mode=block
content-type: image/gif

Redirect headers

location: https://mc.yandex.ru/sync_cookie_image_finish?redirect_domain=mc.yandex.com&token=10212.PcBiWxgueV52VDNJ2YTqbtBB34DLliLpdYirMbfMVae3wQjxQqS6uR5gZjbebxmSSdQGCU8QDozFvkVV2Z2oZKX8Y7pNdbZX6zSKNoXp7PTapjGHPO1FLncVsSXumJGp3E-6Bjv2yfjXeHSFg76HzTD3cTsb5yWTXUG4P0Rb4J9AMPPSvV-SjfUwXCl3JatfrCMfqck82QJVJomdJCC73w%2C%2C.yysWMrB80wwNEtW2gIU8PoBAaPs%2C
date: Sun, 10 Dec 2023 00:45:04 GMT
strict-transport-security: max-age=31536000
x-xss-protection: 1; mode=block

GET
H2 200 advert.gif
mc.yandex.com/metrika/ 43 B
471 B 95ms
95ms Image
image/gif 87.250.251.119
TELETECH

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://mc.yandex.com/metrika/advert.gif

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

87.250.251.119 , Russian Federation, ASN208398 (TELETECH, RS),

Reverse DNS

Software

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://kandima.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Sun, 10 Dec 2023 00:45:04 GMT
strict-transport-security: max-age=31536000
last-modified: Fri, 08 Dec 2023 08:26:31 GMT
accept-ch: Sec-CH-UA-Bitness, Sec-CH-UA-Arch, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Platform, Sec-CH-UA, UA-Bitness, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform-Version, UA-Platform, UA
etag: "6572d337-2b"
content-type: image/gif
access-control-allow-origin: *
cache-control: max-age=3600
accept-ranges: bytes
timing-allow-origin: *
content-length: 43
expires: Sun, 10 Dec 2023 01:45:04 GMT

GET

/
a2.adform.net/Serving/TrackPoint/ Frame D8B7
Redirect Chain

https://a2.adform.net/Serving/TrackPoint/?pm=3054617&ADFPageName=Kandima%20Maldives%20--%20TRACKING%20299961&ADFdivider=%7C&ord=75506127850&ADFtpmode=2&loc=https%3A%2F%2Fstatic.sojern.com%2Fcip%2Fc...
https://a2.adform.net/Serving/TrackPoint/?CC=1&pm=3054617&ADFPageName=Kandima%20Maldives%20--%20TRACKING%20299961&ADFdivider=%7C&ord=75506127850&ADFtpmode=2&loc=https%3A%2F%2Fstatic.sojern.com%2Fci...

0
0

POST collect
o.clarity.ms/ 0
0

GET
H2 200 index.min.js
www.thehotelsnetwork.com/widget/core/4.0/dist/main/ 320 KB
72 KB 42ms
14ms Script
application/javascript 65.9.95.114
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://www.thehotelsnetwork.com/widget/core/4.0/dist/main/index.min.js?h=0444bc3c

Requested by

Host: www.thehotelsnetwork.com
URL: https://www.thehotelsnetwork.com/js/hotel_price_widget.js?hotel_id=1366018&property_id=1027560&account_key=EDF4FBE80F15A1C8D8538BEE57F4C6B5

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

65.9.95.114 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://kandima.com/
Origin: https://kandima.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Sun, 10 Dec 2023 00:17:21 GMT
strict-transport-security: max-age=31536000; includeSubDomains
content-encoding: br
via: 1.1 3544838dca6112dd616da017a568e76a.cloudfront.net (CloudFront)
x-amz-cf-pop: PRG50-C1
age: 1663
x-cache: Hit from cloudfront
last-modified: Tue, 05 Dec 2023 11:13:34 GMT
server: nginx
etag: W/"656f05de-501b6"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000, public
x-amz-cf-id: 68v-gXQHg_p71Iosh9lb_AQ6EnLdNm77hf1hTLbVos8Uf6Ld5qj4Nw==
expires: Mon, 09 Dec 2024 00:17:21 GMT

GET
H2 200 c.gif
c.clarity.ms/ 42 B
81 B 26ms
26ms Image
image/gif 68.219.88.97
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://c.clarity.ms/c.gif
Requested by: Host: www.clarity.ms
URL: https://www.clarity.ms/tag/uet/271000633
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 68.219.88.97 Dublin, Ireland, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://kandima.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 10 Dec 2023 00:45:04 GMT
last-modified: Wed, 30 Aug 2023 19:01:41 GMT
server: Microsoft-IIS/10.0
etag: "8d59566974dbd91:0"
x-powered-by: ASP.NET
content-type: image/gif
p3p: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
cache-control: private, no-cache, proxy-revalidate, no-store
accept-ranges: bytes
content-length: 42

GET
H3 200 /
www.facebook.com/tr/ Frame D8B7 0
18 B 8ms
7ms Image
text/plain 157.240.251.35
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=791801461733103&ev=PageView&dl=https%3A%2F%2Fstatic.sojern.com%2Fcip%2Fc%2F11.html%3Ff_v%3Dcp_v1_js%26p_v%3D1%26version%3D5%26auto_url%3Dhttps%253A%252F%252Fkandima.com%252Findex.php%252Fen%26auto_ccid%3Dqrbqf-bir94-861ar-ziq7g-8bdke%26auto_ga%3D448115994.1702169104%26e_eml%3Dnull%26auto_eml%3D%26auto_eml_count%3D0%26auto_eml_domain%3D%26ws%3D1600x1200%26tz%3D-60%26n%3Dtf%253ANGd8MTB8MHw4fDR8ZW4tVVN8ZW4tVVMsZW58V2luMzJ8ZmFsc2V8fDF8MjR8MjR8MTYwMHwxMjAwfDM3NjAwMDAwMDB8RXVyb3BlL0JlcmxpbnxmYWxzZQ%253D%253D%26pt%3DTRACKING%26hpid%3D38053%26pc%3D%252Findex.php%252Fen%26ccid%3D%26md5_eml%3D%26sha1_eml%3D%26sha256_eml%3D%26et%3D&rl=https%3A%2F%2Fkandima.com%2F&if=true&ts=1702169104737&sw=1600&sh=1200&v=2.9.138&r=stable&a=trplsojern&ec=0&o=4126&ler=other&it=1702169104650&coo=false&tm=1&rqm=GET

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

157.240.251.35 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://static.sojern.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
date: Sun, 10 Dec 2023 00:45:04 GMT
server: proxygen-bolt
content-type: text/plain
access-control-allow-origin
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 0
priority: u=3,i

GET
H3 200 /
www.facebook.com/tr/ Frame D8B7 0
15 B 8ms
8ms Image
text/plain 157.240.251.35
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=791801461733103&ev=Tracking&dl=https%3A%2F%2Fstatic.sojern.com%2Fcip%2Fc%2F11.html%3Ff_v%3Dcp_v1_js%26p_v%3D1%26version%3D5%26auto_url%3Dhttps%253A%252F%252Fkandima.com%252Findex.php%252Fen%26auto_ccid%3Dqrbqf-bir94-861ar-ziq7g-8bdke%26auto_ga%3D448115994.1702169104%26e_eml%3Dnull%26auto_eml%3D%26auto_eml_count%3D0%26auto_eml_domain%3D%26ws%3D1600x1200%26tz%3D-60%26n%3Dtf%253ANGd8MTB8MHw4fDR8ZW4tVVN8ZW4tVVMsZW58V2luMzJ8ZmFsc2V8fDF8MjR8MjR8MTYwMHwxMjAwfDM3NjAwMDAwMDB8RXVyb3BlL0JlcmxpbnxmYWxzZQ%253D%253D%26pt%3DTRACKING%26hpid%3D38053%26pc%3D%252Findex.php%252Fen%26ccid%3D%26md5_eml%3D%26sha1_eml%3D%26sha256_eml%3D%26et%3D&rl=https%3A%2F%2Fkandima.com%2F&if=true&ts=1702169104737&cd[content_type]=hotel&cd[content_ids]=%5B%2238053%22%5D&cd[value]=0&cd[purchase_value]=0&cd[custom_param10]=%25252Findex.php%25252Fen&sw=1600&sh=1200&v=2.9.138&r=stable&a=trplsojern&ec=1&o=4126&ler=other&it=1702169104650&coo=false&tm=2&rqm=GET

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

157.240.251.35 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://static.sojern.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains
date: Sun, 10 Dec 2023 00:45:04 GMT
server: proxygen-bolt
content-type: text/plain
access-control-allow-origin
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 0
priority: u=3,i

GET
H2 200 f5e567cc.min.js
www.thehotelsnetwork.com/widget/core/4.0/dist/main/ 177 KB
46 KB 14ms
14ms Script
application/javascript 65.9.95.114
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://www.thehotelsnetwork.com/widget/core/4.0/dist/main/f5e567cc.min.js?h=0444bc3c

Requested by

Host: www.thehotelsnetwork.com
URL: https://www.thehotelsnetwork.com/widget/core/4.0/dist/main/index.min.js?h=0444bc3c

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

65.9.95.114 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://kandima.com/
Origin: https://kandima.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Sun, 10 Dec 2023 00:13:05 GMT
strict-transport-security: max-age=31536000; includeSubDomains
content-encoding: br
via: 1.1 3544838dca6112dd616da017a568e76a.cloudfront.net (CloudFront)
x-amz-cf-pop: PRG50-C1
age: 1919
x-cache: Hit from cloudfront
last-modified: Tue, 05 Dec 2023 11:13:34 GMT
server: nginx
etag: W/"656f05de-2c5cb"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000, public
x-amz-cf-id: 0wT-ImH_DO3Gk3r26JEtc-S74JTDsJG7xnVJPVevnKhHyJQgQU23HQ==
expires: Mon, 09 Dec 2024 00:13:05 GMT

GET
H2 200 9d9ebd22.min.js
www.thehotelsnetwork.com/widget/core/4.0/dist/main/ 12 KB
5 KB 13ms
13ms Script
application/javascript 65.9.95.114
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://www.thehotelsnetwork.com/widget/core/4.0/dist/main/9d9ebd22.min.js?h=0444bc3c

Requested by

Host: www.thehotelsnetwork.com
URL: https://www.thehotelsnetwork.com/widget/core/4.0/dist/main/index.min.js?h=0444bc3c

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

65.9.95.114 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://kandima.com/
Origin: https://kandima.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Sun, 10 Dec 2023 00:17:59 GMT
strict-transport-security: max-age=31536000; includeSubDomains
content-encoding: br
via: 1.1 3544838dca6112dd616da017a568e76a.cloudfront.net (CloudFront)
x-amz-cf-pop: PRG50-C1
age: 1625
x-cache: Hit from cloudfront
last-modified: Tue, 05 Dec 2023 11:13:34 GMT
server: nginx
etag: W/"656f05de-310f"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000, public
x-amz-cf-id: Huy-09ZusBqoGl22jqZDsEAkjYgOJIwgcCTj7ng0a0w4AJje-ohXTg==
expires: Mon, 09 Dec 2024 00:17:59 GMT

GET
H2 200 56cf54d6.min.js
www.thehotelsnetwork.com/widget/core/4.0/dist/main/ 1 KB
1 KB 14ms
14ms Script
application/javascript 65.9.95.114
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://www.thehotelsnetwork.com/widget/core/4.0/dist/main/56cf54d6.min.js?h=0444bc3c

Requested by

Host: www.thehotelsnetwork.com
URL: https://www.thehotelsnetwork.com/widget/core/4.0/dist/main/index.min.js?h=0444bc3c

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

65.9.95.114 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://kandima.com/
Origin: https://kandima.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Sat, 09 Dec 2023 23:57:24 GMT
strict-transport-security: max-age=31536000; includeSubDomains
content-encoding: br
via: 1.1 3544838dca6112dd616da017a568e76a.cloudfront.net (CloudFront)
x-amz-cf-pop: PRG50-C1
age: 2860
x-cache: Hit from cloudfront
last-modified: Tue, 05 Dec 2023 11:13:34 GMT
server: nginx
etag: W/"656f05de-468"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000, public
x-amz-cf-id: jx-XO4ZjpznjH4hL5IGDz_iE6ey-8Ff7EHXRp-i74V6nIzqNIhlIRA==
expires: Sun, 08 Dec 2024 23:57:24 GMT

GET
H2 200 8c365a89.min.js
www.thehotelsnetwork.com/widget/core/4.0/dist/main/ 45 KB
14 KB 60ms
60ms Script
application/javascript 65.9.95.114
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://www.thehotelsnetwork.com/widget/core/4.0/dist/main/8c365a89.min.js?h=0444bc3c

Requested by

Host: www.thehotelsnetwork.com
URL: https://www.thehotelsnetwork.com/widget/core/4.0/dist/main/index.min.js?h=0444bc3c

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

65.9.95.114 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://kandima.com/
Origin: https://kandima.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Sun, 10 Dec 2023 00:20:25 GMT
strict-transport-security: max-age=31536000; includeSubDomains
content-encoding: br
via: 1.1 3544838dca6112dd616da017a568e76a.cloudfront.net (CloudFront)
x-amz-cf-pop: PRG50-C1
age: 1479
x-cache: Hit from cloudfront
last-modified: Tue, 05 Dec 2023 11:13:34 GMT
server: nginx
etag: W/"656f05de-b531"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000, public
x-amz-cf-id: Q9ocSbuQKxJXziegi3v1yNhbywXDaCkBm2z8erivYIF0A6srvI0QGg==
expires: Mon, 09 Dec 2024 00:20:25 GMT

GET
H2 200 /
www.thehotelsnetwork.com/widget/core/latest/hub/ Frame 23C9 5 KB
2 KB 13ms
13ms Document
text/html 65.9.95.114
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://www.thehotelsnetwork.com/widget/core/latest/hub/

Requested by

Host: www.thehotelsnetwork.com
URL: https://www.thehotelsnetwork.com/widget/core/4.0/dist/main/f5e567cc.min.js?h=0444bc3c

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

65.9.95.114 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://kandima.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 1664
cache-control: max-age=7200 public
content-encoding: br
content-type: text/html; charset=utf-8
date: Sun, 10 Dec 2023 00:17:20 GMT
etag: W/"656f06a2-12b5"
expires: Sun, 10 Dec 2023 02:17:20 GMT
last-modified: Tue, 05 Dec 2023 11:16:50 GMT
server: nginx
strict-transport-security: max-age=31536000; includeSubDomains
vary: Accept-Encoding
via: 1.1 3544838dca6112dd616da017a568e76a.cloudfront.net (CloudFront)
x-amz-cf-id: hwuhoTfRxOyJ-fB-jefatHlrk1iK0sTPzHBgJlExLnRtWJmFQjBvWA==
x-amz-cf-pop: PRG50-C1
x-cache: Hit from cloudfront

GET
H2 200 ec6c1c5195eb457d8b2cba6b15191d30.min.js
js.sentry-cdn.com// 2 KB
2 KB 21ms
7ms Script
text/javascript 151.101.194.217
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://js.sentry-cdn.com//ec6c1c5195eb457d8b2cba6b15191d30.min.js

Requested by

Host: www.thehotelsnetwork.com
URL: https://www.thehotelsnetwork.com/widget/core/4.0/dist/main/f5e567cc.min.js?h=0444bc3c

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.194.217 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	base-uri 'none'; frame-ancestors 'self' .sentry.io; script-src 'self' 'unsafe-inline' 'report-sample' 'unsafe-eval' s1.sentry-cdn.com js.sentry-cdn.com browser.sentry-cdn.com statuspage-production.s3.amazonaws.com static.zdassets.com aui-cdn.atlassian.com connect-cdn.atl-paas.net js.stripe.com 'strict-dynamic' cdn.pendo.io data.pendo.io pendo-io-static.storage.googleapis.com pendo-static-5634074999128064.storage.googleapis.com; default-src 'none'; object-src 'self'; img-src blob: data: ; font-src * data:; connect-src 'self' .algolia.net .algolianet.com .algolia.io sentry.io .sentry.io s1.sentry-cdn.com o1.ingest.sentry.io api2.amplitude.com app.pendo.io data.pendo.io reload.getsentry.net t687h3m0nh65.statuspage.io sentry.zendesk.com ekr.zdassets.com maps.googleapis.com; frame-src app.pendo.io demo.arcade.software js.stripe.com sentry.io; style-src 'unsafe-inline' ; media-src ; report-uri https://o1.ingest.sentry.io/api/54785/security/?sentry_key=f724a8a027db45f5b21507e7142ff78e&sentry_release=8234b25ded239101c165922bdd9ce127f2f35544
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	deny
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://kandima.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

content-security-policy: base-uri 'none'; frame-ancestors 'self' *.sentry.io; script-src 'self' 'unsafe-inline' 'report-sample' 'unsafe-eval' s1.sentry-cdn.com js.sentry-cdn.com browser.sentry-cdn.com statuspage-production.s3.amazonaws.com static.zdassets.com aui-cdn.atlassian.com connect-cdn.atl-paas.net js.stripe.com 'strict-dynamic' cdn.pendo.io data.pendo.io pendo-io-static.storage.googleapis.com pendo-static-5634074999128064.storage.googleapis.com; default-src 'none'; object-src 'self'; img-src blob: data: *; font-src * data:; connect-src 'self' *.algolia.net *.algolianet.com *.algolia.io sentry.io *.sentry.io s1.sentry-cdn.com o1.ingest.sentry.io api2.amplitude.com app.pendo.io data.pendo.io reload.getsentry.net t687h3m0nh65.statuspage.io sentry.zendesk.com ekr.zdassets.com maps.googleapis.com; frame-src app.pendo.io demo.arcade.software js.stripe.com sentry.io; style-src 'unsafe-inline' *; media-src *; report-uri https://o1.ingest.sentry.io/api/54785/security/?sentry_key=f724a8a027db45f5b21507e7142ff78e&sentry_release=8234b25ded239101c165922bdd9ce127f2f35544
content-encoding: gzip
x-content-type-options: nosniff
date: Sun, 10 Dec 2023 00:45:04 GMT
strict-transport-security: max-age=31536000; includeSubDomains
age: 15
x-envoy-upstream-service-time: 18
content-length: 1212
x-xss-protection: 1; mode=block
x-served-by: getsentry-web-default-common-production-6d75ffdb45-vbshq, cache-chi-kigq8000060-CHI, cache-fra-eddf8230023-FRA
x-frame-options: deny
vary: Accept-Encoding
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=3600, s-maxage=60, stale-while-revalidate=315360000, stale-if-error=315360000
x-envoy-attempt-count: 1
accept-ranges: bytes
timing-allow-origin: *

GET
H2 200 99268eb3.min.js
www.thehotelsnetwork.com/widget/core/4.0/dist/main/ 91 KB
26 KB 13ms
13ms Script
application/javascript 65.9.95.114
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://www.thehotelsnetwork.com/widget/core/4.0/dist/main/99268eb3.min.js?h=0444bc3c

Requested by

Host: www.thehotelsnetwork.com
URL: https://www.thehotelsnetwork.com/widget/core/4.0/dist/main/index.min.js?h=0444bc3c

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

65.9.95.114 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://kandima.com/
Origin: https://kandima.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.71 Safari/537.36

Response headers

date: Sun, 10 Dec 2023 00:15:29 GMT
strict-transport-security: max-age=31536000; includeSubDomains
content-encoding: br
via: 1.1 3544838dca6112dd616da017a568e76a.cloudfront.net (CloudFront)
x-amz-cf-pop: PRG50-C1
age: 1775
x-cache: Hit from cloudfront
last-modified: Tue, 05 Dec 2023 11:13:34 GMT
server: nginx
etag: W/"656f05de-16dec"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31536000, public
x-amz-cf-id: zsdbSdzTClKF3j2Xn5S3Qdjd93UtKp-dGwU95roXpkekZm-ppFxU_g==
expires: Mon, 09 Dec 2024 00:15:29 GMT

GET
H2

200

1
mc.yandex.com/watch/89261857/
Redirect Chain

https://mc.yandex.com/watch/89261857?wmode=7&page-url=https%3A%2F%2Fkandima.com%2Findex.php%2Fen&charset=utf-8&uah=chm%0A%3F0&browser-info=pv%3A1%3Avf%3Atuwae7cfavzq29du94ga6zf%3Afp%3A3288%3Afu%3A0...
https://mc.yandex.com/watch/89261857/1?wmode=7&page-url=https%3A%2F%2Fkandima.com%2Findex.php%2Fen&charset=utf-8&uah=chm%0A%3F0&browser-info=pv%3A1%3Avf%3Atuwae7cfavzq29du94ga6zf%3Afp%3A3288%3Afu%3...

427 B
519 B

56ms
56ms

Fetch
application/json

87.250.251.119
TELETECH

General

Check archive.org

Show headers Download Go to

Full URL

https://mc.yandex.com/watch/89261857/1?wmode=7&page-url=https%3A%2F%2Fkandima.com%2Findex.php%2Fen&charset=utf-8&uah=chm%0A%3F0&browser-info=pv%3A1%3Avf%3Atuwae7cfavzq29du94ga6zf%3Afp%3A3288%3Afu%3A0%3Aen%3Autf-8%3Ala%3Aen-US%3Av%3A1180%3Acn%3A1%3Adp%3A0%3Als%3A246145487513%3Ahid%3A118693861%3Az%3A60%3Ai%3A20231210014504%3Aet%3A1702169105%3Ac%3A1%3Arn%3A584476848%3Arqn%3A1%3Au%3A1702169105640586024%3Aw%3A1600x1200%3As%3A1600x1200x24%3Ask%3A1%3Awv%3A2%3Ads%3A0%2C17%2C2480%2C155%2C34%2C0%2C%2C%2C%2C3355%2C%2C%2C%3Aco%3A0%3Acpf%3A1%3Ans%3A1702169101002%3Agi%3AR0ExLjEuNDQ4MTE1OTk0LjE3MDIxNjkxMDQ%3D%3Aadb%3A2%3Arqnl%3A1%3Ast%3A1702169105%3At%3ABest%20Resorts%20In%20Maldives%20%7C%20Maldives%20Family%20Resort%20%7C%20Maldives%20Holidays&t=gdpr%2814%29clc%280-0-0%29rqnt%281%29aw%281%29ecs%280%29ti%281%29

Protocol

Server

87.250.251.119 , Russian Federation, ASN208398 (TELETECH, RS),

Reverse DNS