westin.marriott.com Open in urlscan Pro
35.231.127.158 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://email-marriott.com/T/v70000017ed8d78bd88aa6ab6e965fc958/85802f7fe18c463b0000021ef3a0bce0/85802f7f-e18c-463b-9815-f6...
Effective URL:
https://westin.marriott.com/?enrollmentSourceCode=EMEA&nck=125622969&ck=49864193&lk=1000535890
Submission: On February 08 via api (February 8th 2022, 10:43:41 pm UTC) from BE — Scanned from DE

Summary HTTP 108 Redirects Links 56 Behaviour Indicators

Summary

This website contacted 31 IPs in 8 countries across 37 domains to perform 108 HTTP transactions. The main IP is 35.231.127.158, located in North Charleston, United States and belongs to GOOGLE, US. The main domain is westin.marriott.com. The Cisco Umbrella rank of the primary domain is 710830.
TLS certificate: Issued by R3 on December 18th 2021. Valid for: 3 months.

This is the only time westin.marriott.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1 1	159.127.187.250 159.127.187.250	19137 (EPSILON-I...) (EPSILON-INTERACTIVE)
37	35.231.127.158 35.231.127.158	15169 (GOOGLE) (GOOGLE)
7	52.204.27.57 52.204.27.57	14618 (AMAZON-AES) (AMAZON-AES)
8	2a02:26f0:6c0... 2a02:26f0:6c00:299::1e80	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
4	2a00:1450:400... 2a00:1450:4001:80e::200a	15169 (GOOGLE) (GOOGLE)
12	104.90.137.54 104.90.137.54	16625 (AKAMAI-AS) (AKAMAI-AS)
1 14	52.16.52.14 52.16.52.14	16509 (AMAZON-02) (AMAZON-02)
1	2600:9000:215... 2600:9000:2156:c200:1d:cb70:f5c0:21	16509 (AMAZON-02) (AMAZON-02)
1	34.253.74.200 34.253.74.200	16509 (AMAZON-02) (AMAZON-02)
1 1	54.75.68.230 54.75.68.230	16509 (AMAZON-02) (AMAZON-02)
2	2606:4700:10:... 2606:4700:10::6816:3a80	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	54.188.211.236 54.188.211.236	16509 (AMAZON-02) (AMAZON-02)
1	2606:4700:10:... 2606:4700:10::6814:b944	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	13.36.218.177 13.36.218.177	16509 (AMAZON-02) (AMAZON-02)
2 3	37.252.172.45 37.252.172.45	29990 (ASN-APPNEX) (ASN-APPNEX)
2 2	2a00:1450:400... 2a00:1450:4001:800::2002	15169 (GOOGLE) (GOOGLE)
2 2	2a00:1450:400... 2a00:1450:4001:82f::2004	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:80e::2003	15169 (GOOGLE) (GOOGLE)
1	35.244.174.68 35.244.174.68	15169 (GOOGLE) (GOOGLE)
1 2	52.223.40.198 52.223.40.198	16509 (AMAZON-02) (AMAZON-02)
1 2	142.250.185.194 142.250.185.194	15169 (GOOGLE) (GOOGLE)
1 1	2620:1ec:c11:... 2620:1ec:c11::200	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1 1	209.197.3.19 209.197.3.19	20446 (HIGHWINDS3) (HIGHWINDS3)
1	2606:4700::68... 2606:4700::6812:e16	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2a02:fa8:8806... 2a02:fa8:8806:12::1400	41041 (VCLK-EU-SE) (VCLK-EU-SE)
1	52.200.201.220 52.200.201.220	14618 (AMAZON-AES) (AMAZON-AES)
2 2	2606:4700::68... 2606:4700::6812:c05	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2 2	35.186.212.60 35.186.212.60	15169 (GOOGLE) (GOOGLE)
2 2	2a02:2638::1c 2a02:2638::1c	44788 (ASN-CRITE...) (ASN-CRITEO-EUROPE)
1 1	212.82.100.182 212.82.100.182	34010 (YAHOO-IRD) (YAHOO-IRD)
1	34.98.67.61 34.98.67.61	15169 (GOOGLE) (GOOGLE)
1 1	2a05:d01c:1d8... 2a05:d01c:1d8:8102:7312:c82c:fb3:8dc6	16509 (AMAZON-02) (AMAZON-02)
1 1	52.203.14.177 52.203.14.177	14618 (AMAZON-AES) (AMAZON-AES)
1 1	3.94.164.110 3.94.164.110	14618 (AMAZON-AES) (AMAZON-AES)
1	34.251.73.26 34.251.73.26	16509 (AMAZON-02) (AMAZON-02)
8 8	151.101.2.49 151.101.2.49	54113 (FASTLY) (FASTLY)
1	69.173.144.139 69.173.144.139	26667 (RUBICONPR...) (RUBICONPROJECT)
1 2	2.18.234.21 2.18.234.21	16625 (AKAMAI-AS) (AKAMAI-AS)
1	34.98.64.218 34.98.64.218	15169 (GOOGLE) (GOOGLE)
1	185.64.189.110 185.64.189.110	62713 (AS-PUBMATIC) (AS-PUBMATIC)
1 2	185.94.180.125 185.94.180.125	35220 (SPOTX-AMS) (SPOTX-AMS)
1	2a03:2880:f11... 2a03:2880:f11c:8183:face:b00c:0:25de	32934 (FACEBOOK) (FACEBOOK)
1 2	47.93.233.30 47.93.233.30	37963 (CNNIC-ALI...) (CNNIC-ALIBABA-CN-NET-AP Hangzhou Alibaba Advertising Co.)
1	2606:4700:10:... 2606:4700:10::ac43:25d2	() ()
108	31

1 159.127.187.250 (United States) 1 redirects

ASN19137 (EPSILON-INTERACTIVE, US)

email-marriott.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

37 35.231.127.158 (North Charleston, United States)

ASN15169 (GOOGLE, US)
PTR: 158.127.231.35.bc.googleusercontent.com

westin.marriott.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 52.204.27.57 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-52-204-27-57.compute-1.amazonaws.com

pacsys.marriott.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 2a02:26f0:6c00:299::1e80 (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)

assets.adobedtm.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a00:1450:4001:80e::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

maps.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

12 104.90.137.54 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a104-90-137-54.deploy.static.akamaitechnologies.com

cache.marriott.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

14 52.16.52.14 (Dublin, Ireland) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-52-16-52-14.eu-west-1.compute.amazonaws.com

dpm.demdex.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:2156:c200:1d:cb70:f5c0:21 (United States)

ASN16509 (AMAZON-02, US)

d1mqz30n8nowyf.cloudfront.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 34.253.74.200 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-34-253-74-200.eu-west-1.compute.amazonaws.com

marriottinternationa.demdex.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 54.75.68.230 (Dublin, Ireland) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-54-75-68-230.eu-west-1.compute.amazonaws.com

cm.everesttech.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:4700:10::6816:3a80 (United States)

ASN13335 (CLOUDFLARENET, US)

marriott.btttag.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
d1.btttag.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 54.188.211.236 (Boardman, United States)

ASN16509 (AMAZON-02, US)
PTR: ec2-54-188-211-236.us-west-2.compute.amazonaws.com

targeting-azalea.outpace.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:10::6814:b944 (United States)

ASN13335 (CLOUDFLARENET, US)

geolocation.onetrust.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.36.218.177 (Paris, France)

ASN16509 (AMAZON-02, US)
PTR: ec2-13-36-218-177.eu-west-3.compute.amazonaws.com

smetrics.marriott.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 37.252.172.45 (Frankfurt am Main, Germany) 2 redirects

ASN29990 (ASN-APPNEX, US)
PTR: 693.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net

ib.adnxs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:800::2002 (Frankfurt am Main, Germany) 2 redirects

ASN15169 (GOOGLE, US)

googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:82f::2004 (Frankfurt am Main, Germany) 2 redirects

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:80e::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 35.244.174.68 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 68.174.244.35.bc.googleusercontent.com

idsync.rlcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 52.223.40.198 (United States) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: a6370ebea231e0c9a.awsglobalaccelerator.com

insight.adsrvr.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
match.adsrvr.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 142.250.185.194 (United States) 1 redirects

ASN15169 (GOOGLE, US)
PTR: fra16s52-in-f2.1e100.net

cm.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2620:1ec:c11::200 (United States) 1 redirects

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

c.bing.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 209.197.3.19 (United States) 1 redirects

ASN20446 (HIGHWINDS3, US)
PTR: vip0x013.map2.ssl.hwcdn.net

servedby.flashtalking.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6812:e16 (United States)

ASN13335 (CLOUDFLARENET, US)

cdn.glassboxcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a02:fa8:8806:12::1400 (Singapore)

ASN41041 (VCLK-EU-SE, US)

adobe-sync.dotomi.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.200.201.220 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-52-200-201-220.compute-1.amazonaws.com

report.marriott.glassboxdigital.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:4700::6812:c05 (United States) 2 redirects

ASN13335 (CLOUDFLARENET, US)

a.tribalfusion.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
s.tribalfusion.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 35.186.212.60 (Kansas City, United States) 2 redirects

ASN15169 (GOOGLE, US)
PTR: 60.212.186.35.bc.googleusercontent.com

tag.yieldoptimizer.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a02:2638::1c (France) 2 redirects

ASN44788 (ASN-CRITEO-EUROPE, FR)

gum.criteo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 212.82.100.182 (Dublin, Ireland) 1 redirects

ASN34010 (YAHOO-IRD, GB)
PTR: spcms.pbp.vip.ir2.yahoo.com

cms.analytics.yahoo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 34.98.67.61 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 61.67.98.34.bc.googleusercontent.com

odr.mookie1.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a05:d01c:1d8:8102:7312:c82c:fb3:8dc6 (London, United Kingdom) 1 redirects

ASN16509 (AMAZON-02, US)

ag.innovid.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.203.14.177 (Ashburn, United States) 1 redirects

ASN14618 (AMAZON-AES, US)
PTR: ec2-52-203-14-177.compute-1.amazonaws.com

pxl.jivox.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 3.94.164.110 (Ashburn, United States) 1 redirects

ASN14618 (AMAZON-AES, US)
PTR: ec2-3-94-164-110.compute-1.amazonaws.com

usermatch.krxd.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 34.251.73.26 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-34-251-73-26.eu-west-1.compute.amazonaws.com

beacon.krxd.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 151.101.2.49 (United States) 8 redirects

ASN54113 (FASTLY, US)

sync-tm.everesttech.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 69.173.144.139 (Frankfurt am Main, Germany)

ASN26667 (RUBICONPROJECT, US)

pixel.rubiconproject.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2.18.234.21 (Frankfurt am Main, Germany) 1 redirects

ASN16625 (AKAMAI-AS, US)
PTR: a2-18-234-21.deploy.static.akamaitechnologies.com

dsum-sec.casalemedia.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 34.98.64.218 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 218.64.98.34.bc.googleusercontent.com

us-u.openx.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 185.64.189.110 (United Kingdom)

ASN62713 (AS-PUBMATIC, US)

image2.pubmatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 185.94.180.125 (Amsterdam, Netherlands) 1 redirects

ASN35220 (SPOTX-AMS, US)

sync.search.spotxchange.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a03:2880:f11c:8183:face:b00c:0:25de (Frankfurt am Main, Germany)

ASN32934 (FACEBOOK, US)

www.facebook.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 47.93.233.30 (Beijing, China) 1 redirects

ASN37963 (CNNIC-ALIBABA-CN-NET-AP Hangzhou Alibaba Advertising Co.,Ltd., CN)

cm.ipinyou.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:10::ac43:25d2 (None, )

ASN- ()

d1.btttag.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
57	marriott.com westin.marriott.com — Cisco Umbrella Rank: 710830 pacsys.marriott.com — Cisco Umbrella Rank: 332927 cache.marriott.com — Cisco Umbrella Rank: 19731 smetrics.marriott.com — Cisco Umbrella Rank: 23663	3 MB
15	demdex.net 1 redirects dpm.demdex.net — Cisco Umbrella Rank: 205 marriottinternationa.demdex.net — Cisco Umbrella Rank: 24306	18 KB
9	everesttech.net 9 redirects cm.everesttech.net — Cisco Umbrella Rank: 992 sync-tm.everesttech.net — Cisco Umbrella Rank: 560	2 KB
8	adobedtm.com assets.adobedtm.com — Cisco Umbrella Rank: 497	135 KB
4	doubleclick.net 3 redirects googleads.g.doubleclick.net — Cisco Umbrella Rank: 46 cm.g.doubleclick.net — Cisco Umbrella Rank: 197	1 KB
4	googleapis.com maps.googleapis.com — Cisco Umbrella Rank: 380	169 KB
3	adnxs.com 2 redirects ib.adnxs.com — Cisco Umbrella Rank: 241	3 KB
3	btttag.com marriott.btttag.com — Cisco Umbrella Rank: 29555 d1.btttag.com	24 KB
2	ipinyou.com 1 redirects cm.ipinyou.com — Cisco Umbrella Rank: 32690	1 KB
2	spotxchange.com 1 redirects sync.search.spotxchange.com — Cisco Umbrella Rank: 483	1 KB
2	casalemedia.com 1 redirects dsum-sec.casalemedia.com — Cisco Umbrella Rank: 590	2 KB
2	krxd.net 1 redirects usermatch.krxd.net — Cisco Umbrella Rank: 1214 beacon.krxd.net — Cisco Umbrella Rank: 408	529 B
2	criteo.com 2 redirects gum.criteo.com — Cisco Umbrella Rank: 369	789 B
2	yieldoptimizer.com 2 redirects tag.yieldoptimizer.com — Cisco Umbrella Rank: 5621	893 B
2	tribalfusion.com 2 redirects a.tribalfusion.com — Cisco Umbrella Rank: 808 s.tribalfusion.com — Cisco Umbrella Rank: 2305	1015 B
2	adsrvr.org 1 redirects insight.adsrvr.org — Cisco Umbrella Rank: 624 match.adsrvr.org — Cisco Umbrella Rank: 329	947 B
2	google.de www.google.de — Cisco Umbrella Rank: 5557	612 B
2	google.com 2 redirects www.google.com — Cisco Umbrella Rank: 13	634 B
1	facebook.com www.facebook.com — Cisco Umbrella Rank: 98	2 KB
1	pubmatic.com image2.pubmatic.com — Cisco Umbrella Rank: 1032	549 B
1	openx.net us-u.openx.net — Cisco Umbrella Rank: 359	274 B
1	rubiconproject.com pixel.rubiconproject.com — Cisco Umbrella Rank: 312	239 B
1	jivox.com 1 redirects pxl.jivox.com — Cisco Umbrella Rank: 5093	388 B
1	innovid.com 1 redirects ag.innovid.com — Cisco Umbrella Rank: 1541	249 B
1	mookie1.com odr.mookie1.com — Cisco Umbrella Rank: 890	324 B
1	yahoo.com 1 redirects cms.analytics.yahoo.com — Cisco Umbrella Rank: 1023	892 B
1	glassboxdigital.io report.marriott.glassboxdigital.io — Cisco Umbrella Rank: 22826	1 KB
1	dotomi.com adobe-sync.dotomi.com — Cisco Umbrella Rank: 33681	104 B
1	glassboxcdn.com cdn.glassboxcdn.com — Cisco Umbrella Rank: 11994	114 KB
1	flashtalking.com 1 redirects servedby.flashtalking.com — Cisco Umbrella Rank: 652	545 B
1	bing.com 1 redirects c.bing.com — Cisco Umbrella Rank: 273	540 B
1	rlcdn.com idsync.rlcdn.com — Cisco Umbrella Rank: 316	308 B
1	onetrust.com geolocation.onetrust.com — Cisco Umbrella Rank: 743	457 B
1	outpace.com targeting-azalea.outpace.com — Cisco Umbrella Rank: 157692	437 B
1	cloudfront.net d1mqz30n8nowyf.cloudfront.net	6 KB
1	email-marriott.com 1 redirects email-marriott.com — Cisco Umbrella Rank: 90141	204 B
0	rundsp.com Failed match.rundsp.com Failed
108	37

	Domain	Requested by
37	westin.marriott.com	westin.marriott.com
14	dpm.demdex.net	1 redirects assets.adobedtm.com westin.marriott.com
12	cache.marriott.com	westin.marriott.com cache.marriott.com marriott.btttag.com
8	sync-tm.everesttech.net	8 redirects
8	assets.adobedtm.com	westin.marriott.com assets.adobedtm.com
7	pacsys.marriott.com	westin.marriott.com pacsys.marriott.com
4	maps.googleapis.com	westin.marriott.com maps.googleapis.com
3	ib.adnxs.com	2 redirects
2	d1.btttag.com	marriott.btttag.com
2	cm.ipinyou.com	1 redirects
2	sync.search.spotxchange.com	1 redirects
2	dsum-sec.casalemedia.com	1 redirects
2	gum.criteo.com	2 redirects
2	tag.yieldoptimizer.com	2 redirects
2	cm.g.doubleclick.net	1 redirects
2	www.google.de	westin.marriott.com
2	www.google.com	2 redirects
2	googleads.g.doubleclick.net	2 redirects
1	www.facebook.com
1	image2.pubmatic.com
1	us-u.openx.net
1	pixel.rubiconproject.com
1	beacon.krxd.net
1	usermatch.krxd.net	1 redirects
1	pxl.jivox.com	1 redirects
1	ag.innovid.com	1 redirects
1	odr.mookie1.com
1	cms.analytics.yahoo.com	1 redirects
1	s.tribalfusion.com	1 redirects
1	a.tribalfusion.com	1 redirects
1	report.marriott.glassboxdigital.io	marriott.btttag.com
1	adobe-sync.dotomi.com
1	cdn.glassboxcdn.com	westin.marriott.com
1	servedby.flashtalking.com	1 redirects
1	c.bing.com	1 redirects
1	match.adsrvr.org	1 redirects
1	insight.adsrvr.org	westin.marriott.com
1	idsync.rlcdn.com	westin.marriott.com
1	smetrics.marriott.com	assets.adobedtm.com
1	geolocation.onetrust.com	cache.marriott.com
1	targeting-azalea.outpace.com	d1mqz30n8nowyf.cloudfront.net
1	marriott.btttag.com	westin.marriott.com
1	cm.everesttech.net	1 redirects
1	marriottinternationa.demdex.net	assets.adobedtm.com
1	d1mqz30n8nowyf.cloudfront.net	westin.marriott.com
1	email-marriott.com	1 redirects
0	match.rundsp.com Failed
108	47

This site contains links to these domains. Also see Links.

Domain
www.marriott.com
www.westinstore.com
clean.marriott.com
www.westinresidences.com
www.vistana.com
news.marriott.com
www.careers.marriott.com
hotel-development.marriott.com
www.instagram.com
www.facebook.com
twitter.com
mobileapp.marriott.com
c00.adobe.com
www.editionhotels.com
www.ritzcarlton.com
the-luxury-collection.marriott.com
st-regis.marriott.com
w-hotels.marriott.com
jw-marriott.marriott.com
marriott-hotels.marriott.com
sheraton.marriott.com
www.marriottvacationclub.com
delta-hotels.marriott.com
le-meridien.marriott.com
renaissance-hotels.marriott.com
autograph-hotels.marriott.com
tribute-portfolio.marriott.com
design-hotels.marriott.com
courtyard.marriott.com
four-points.marriott.com
springhillsuites.marriott.com
fairfield.marriott.com
protea.marriott.com
ac-hotels.marriott.com
aloft-hotels.marriott.com
moxy-hotels.marriott.com
homes-and-villas.marriott.com
residence-inn.marriott.com
towneplacesuites.marriott.com
element-hotels.marriott.com
www.onetrust.com

Subject Issuer	Validity	Valid
westin.marriott.com R3	`2021-12-18` - `2022-03-18`	3 months	crt.sh
pacsys.marriott.com R3	`2021-12-05` - `2022-03-05`	3 months	crt.sh
assets.adobedtm.com DigiCert TLS RSA SHA256 2020 CA1	`2021-09-10` - `2022-09-10`	a year	crt.sh
upload.video.google.com GTS CA 1C3	`2022-01-10` - `2022-04-04`	3 months	crt.sh
www.marriott.com Entrust Certification Authority - L1K	`2021-12-16` - `2022-12-16`	a year	crt.sh
*.demdex.net DigiCert TLS RSA SHA256 2020 CA1	`2021-10-19` - `2022-11-19`	a year	crt.sh
*.cloudfront.net Amazon	`2021-03-19` - `2022-03-17`	a year	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2021-07-04` - `2022-07-03`	a year	crt.sh
*.outpace.com GeoTrust RSA CA 2018	`2021-10-25` - `2022-11-03`	a year	crt.sh
onetrust.com Cloudflare Inc ECC CA-3	`2022-01-12` - `2023-01-12`	a year	crt.sh
smetrics.marriott.com DigiCert TLS RSA SHA256 2020 CA1	`2021-03-22` - `2022-04-22`	a year	crt.sh
*.rlcdn.com Sectigo RSA Domain Validation Secure Server CA	`2022-02-03` - `2023-02-25`	a year	crt.sh
*.adsrvr.org GlobalSign GCC R3 DV TLS CA 2020	`2021-03-18` - `2022-04-19`	a year	crt.sh
glassboxcdn.com Cloudflare Inc ECC CA-3	`2021-05-02` - `2022-05-01`	a year	crt.sh
*.dotomi.com GlobalSign RSA OV SSL CA 2018	`2021-08-10` - `2022-09-11`	a year	crt.sh
marriott.glassboxdigital.io Amazon	`2021-11-04` - `2022-12-02`	a year	crt.sh
*.mookie1.com DigiCert TLS RSA SHA256 2020 CA1	`2021-02-22` - `2022-03-25`	a year	crt.sh

This page contains 2 frames:

Primary Page: https://westin.marriott.com/?enrollmentSourceCode=EMEA&nck=125622969&ck=49864193&lk=1000535890
Frame ID: 335E0E69FF411A8FA2068EF8F1122D0B
Requests: 86 HTTP requests in this frame

Frame: https://marriottinternationa.demdex.net/dest5.html?d_nsid=0
Frame ID: ED2AB76CA034AA7046C9502F6F23F0F5
Requests: 28 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Premium Luxury Wellness Hotels | Westin Hotels & ResortsNew Window IconNew Window IconNew Window IconNew Window IconNew Window IconNew Window IconNew Window IconMarriott Bonvoy LogoBack ButtonFilter Button

Page URL History Show full URLs

https://email-marriott.com/T/v70000017ed8d78bd88aa6ab6e965fc958/85802f7fe18c463b0000021ef3a0bce0/85802f... HTTP 302
https://westin.marriott.com/?enrollmentSourceCode=EMEA&nck=125622969&ck=49864193&lk=1000535890 Page URL

Detected technologies

WordPress (CMS) Expand

Overall confidence: 100%
Detected patterns

<link rel=["']stylesheet["'] [^>]+/wp-(?:content|includes)/
/wp-(?:content|includes)/
wp-embed\.min\.js\?ver=([\d.]+)

Google Maps (Maps) Expand

Overall confidence: 100%
Detected patterns

//maps\.google(?:apis)?\.com/maps/api/js

AppNexus (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

adnxs\.(?:net|com)

OneTrust (Cookie compliance) Expand

Overall confidence: 100%
Detected patterns

otSDKStub\.js

OpenX (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

https?://[^/]*\.openx\.net

PubMatic (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

https?://[^/]*\.pubmatic\.com

Rubicon Project (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

https?://[^/]*\.rubiconproject\.com

Page Statistics

108
Requests

77 %
HTTPS

36 %
IPv6

37
Domains

47
Subdomains

31
IPs

8
Countries

3954 kB
Transfer

6568 kB
Size

46
Cookies

56 Outgoing links

These are links going to different origins than the main page.

URL: https://www.marriott.com/sign-in.mi
Title: Sign in or join New Window Icon Opens in a new browser window

Search URL Search Domain Scan URL

URL: https://www.westinstore.com/index.aspx?utm_source=westin-site&utm_medium=main-navigation&utm_term=text-primary&utm_content=evergreen&utm_campaign=evergreen
Title: Store

Search URL Search Domain Scan URL

URL: https://www.marriott.com/offers.mi
Title: Offers

Search URL Search Domain Scan URL

URL: https://clean.marriott.com/
Title: COVID-19 update and extended cancellation policy

Search URL Search Domain Scan URL

URL: https://www.westinstore.com/
Title: Westin Store New Window Icon Opens in a new browser window

Search URL Search Domain Scan URL

URL: https://www.marriott.com/hotels/travel/snawa-the-westin-anaheim-resort/
Title: Learn More New Window Icon Opens in a new browser window

Search URL Search Domain Scan URL

URL: https://www.marriott.com/hotels/travel/mlewi-the-westin-maldives-miriandhoo-resort/
Title: Learn More New Window Icon Opens in a new browser window

Search URL Search Domain Scan URL

URL: https://www.marriott.com/hotels/travel/koawi-the-westin-hapuna-beach-resort/
Title: Learn More New Window Icon Opens in a new browser window

Search URL Search Domain Scan URL

URL: https://www.marriott.com/loyalty/createAccount/createAccountPage1.mi
Title: Join Now New Window Icon Opens in a new browser window

Search URL Search Domain Scan URL

URL: http://www.westinresidences.com/
Title: Westin Residences

Search URL Search Domain Scan URL

URL: https://www.vistana.com/westin-vacation-club
Title: Westin Vacation Club

Search URL Search Domain Scan URL

URL: http://news.marriott.com/
Title: News

Search URL Search Domain Scan URL

URL: http://www.careers.marriott.com/westin-careers/
Title: Employment

Search URL Search Domain Scan URL

URL: http://hotel-development.marriott.com/brands/westin
Title: Developers

Search URL Search Domain Scan URL

URL: https://www.marriott.com/default.mi
Title: MARRIOTT.COM

Search URL Search Domain Scan URL

URL: https://www.marriott.com/about/terms-of-use.mi
Title: Terms & Conditions

Search URL Search Domain Scan URL

URL: https://www.marriott.com/about/privacy.mi
Title: Privacy Statement

Search URL Search Domain Scan URL

URL: https://www.instagram.com/westin/?hl=en

Search URL Search Domain Scan URL

URL: https://www.facebook.com/westin/

Search URL Search Domain Scan URL

URL: https://twitter.com/westin

Search URL Search Domain Scan URL

URL: http://mobileapp.marriott.com/
Title: Learn More

Search URL Search Domain Scan URL

URL: https://c00.adobe.com/v3/83c70054a550c4fe861aa0dcfb666a48af80bf528812cd0d57f206c3baca8cc0/start?a_dl=5c104714b81a43302dfb5718

Search URL Search Domain Scan URL

URL: https://c00.adobe.com/v3/83c70054a550c4fe861aa0dcfb666a48af80bf528812cd0d57f206c3baca8cc0/start?a_dl=5c104758b81a43302dfb571b

Search URL Search Domain Scan URL

URL: https://www.editionhotels.com/
Title: EDITION

Search URL Search Domain Scan URL

URL: https://www.ritzcarlton.com/
Title: The Ritz-Carlton

Search URL Search Domain Scan URL

URL: https://the-luxury-collection.marriott.com/
Title: THE LUXURY COLLECTION

Search URL Search Domain Scan URL

URL: https://st-regis.marriott.com/
Title: ST REGIS

Search URL Search Domain Scan URL

URL: https://w-hotels.marriott.com/
Title: W HOTELS

Search URL Search Domain Scan URL

URL: https://jw-marriott.marriott.com/
Title: JW Marriott

Search URL Search Domain Scan URL

URL: https://marriott-hotels.marriott.com/
Title: Marriott Hotels & Resorts

Search URL Search Domain Scan URL

URL: https://sheraton.marriott.com/
Title: Sheraton

Search URL Search Domain Scan URL

URL: https://www.marriottvacationclub.com/request-information/?loc=IM59*1-2G4AEE&cid=corp-mvc-mi-global-bonvoy-ribbon-logo
Title: Marriott Vacation Club

Search URL Search Domain Scan URL

URL: https://delta-hotels.marriott.com/
Title: Delta Hotels

Search URL Search Domain Scan URL

URL: https://le-meridien.marriott.com/
Title: Le MERIDIEN

Search URL Search Domain Scan URL

URL: https://renaissance-hotels.marriott.com/
Title: Renaissance Hotels

Search URL Search Domain Scan URL

URL: https://autograph-hotels.marriott.com/
Title: Autograph Collection

Search URL Search Domain Scan URL

URL: https://tribute-portfolio.marriott.com/
Title: TRIBUTE PORTFOLIO

Search URL Search Domain Scan URL

URL: https://design-hotels.marriott.com/
Title: DESIGN HOTELS

Search URL Search Domain Scan URL

URL: https://www.marriott.com/gaylord-hotels/travel.mi
Title: Gaylord

Search URL Search Domain Scan URL

URL: https://courtyard.marriott.com/
Title: Courtyard

Search URL Search Domain Scan URL

URL: https://four-points.marriott.com/
Title: FOUR POINTS

Search URL Search Domain Scan URL

URL: https://springhillsuites.marriott.com/
Title: SpringHill Suites

Search URL Search Domain Scan URL

URL: https://fairfield.marriott.com/
Title: Fairfield Inn

Search URL Search Domain Scan URL

URL: https://protea.marriott.com/
Title: Protea

Search URL Search Domain Scan URL

URL: https://ac-hotels.marriott.com/
Title: AC Hotels

Search URL Search Domain Scan URL

URL: https://aloft-hotels.marriott.com/
Title: aloft HOTELS

Search URL Search Domain Scan URL

URL: https://moxy-hotels.marriott.com/
Title: Moxy

Search URL Search Domain Scan URL

URL: https://homes-and-villas.marriott.com/
Title: Homes and Villas by Marriot International

Search URL Search Domain Scan URL

URL: https://residence-inn.marriott.com/
Title: Residence Inn

Search URL Search Domain Scan URL

URL: https://towneplacesuites.marriott.com/
Title: TownePlace Suites by Marriott

Search URL Search Domain Scan URL

URL: https://www.marriott.com/executive-apartments/travel.mi
Title: Marriott Executive Apartments

Search URL Search Domain Scan URL

URL: https://element-hotels.marriott.com/
Title: element

Search URL Search Domain Scan URL

URL: https://www.marriott.com/help/default.mi
Title: Help

Search URL Search Domain Scan URL

URL: https://www.marriott.com/about/ccpa/do-not-sell.mi
Title: Do Not Sell My Personal Information

Search URL Search Domain Scan URL

URL: https://www.instagram.com/%username%

Search URL Search Domain Scan URL

URL: https://www.onetrust.com/products/cookie-consent/

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://email-marriott.com/T/v70000017ed8d78bd88aa6ab6e965fc958/85802f7fe18c463b0000021ef3a0bce0/85802f7f-e18c-463b-9815-f6ef2562f28f?__dU__=v0oQlZ2XmHtXjKKCycNLIk04888UAVMa5S575yBLsoKzM4fwBvfuHkRA==&__F__=v0fUYvjHMDjRPMSh3tviDHXIoXcPxvDgUUCCPvXMWoX_0JoZLAZABQF8V_g0bhdSMKf6Lqait7wAv3kJTxmhkaPz1_MrqWgHeAglVFAfGQ1vPmon4QO-MKHVMq2PnVw3s_FU9r4qDRtyXVu4wZAW5zc57zlNosCX9W2L1POQkiZoVpzsLuXV8nVJJ4lw6wVSKjglM63weTghVc2J4WFUk620OXF_D7WJrWPj21O2eoq-RznmjEYqEUri4FLktZZhOjLmRPCaZGRefGXCvBSWR7IpsblYiiJ3umiZoX-eBIvZy6eXW4KT0jguDHGxqz2YvqLLh2mo6cefqUQubC0L7_yq-ksbkL7_RnvmpmiM5X-sODTiFpzM7OniLJFGBK4c5wSnsz0ZNxvqZ4ExT7Xm-f7Q== HTTP 302
https://westin.marriott.com/?enrollmentSourceCode=EMEA&nck=125622969&ck=49864193&lk=1000535890 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 59

https://cm.everesttech.net/cm/dd?d_uuid=37733966549853964593912821959180323522 HTTP 302
https://dpm.demdex.net/ibs:dpid=411&dpuuid=YgLyFwAAABjWzwQA

Request Chain 70

https://ib.adnxs.com/getuid?https%3A%2F%2Fdpm.demdex.net%2Fibs%3Adpid%3D358%26dpuuid%3D%24UID HTTP 307
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%253A%252F%252Fdpm.demdex.net%252Fibs%253Adpid%253D358%2526dpuuid%253D%2524UID HTTP 302
https://dpm.demdex.net/ibs:dpid=358&dpuuid=7193456728733431786

Request Chain 73

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/924374711/?value=1.00&currency_code=USD&label=dtPPCMa8hZcBELet47gD&guid=ON&script=0 HTTP 302
https://www.google.com/pagead/1p-user-list/924374711/?value=1.00&currency_code=USD&label=dtPPCMa8hZcBELet47gD&guid=ON&script=0&is_vtc=1&random=2329703762 HTTP 302
https://www.google.de/pagead/1p-user-list/924374711/?value=1.00&currency_code=USD&label=dtPPCMa8hZcBELet47gD&guid=ON&script=0&is_vtc=1&random=2329703762&ipr=y

Request Chain 81

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/389211200/?value=1.00&currency_code=USD&label=hCepCJDE-aYCEMDIy7kB&guid=ON&script=0 HTTP 302
https://www.google.com/pagead/1p-user-list/389211200/?value=1.00&currency_code=USD&label=hCepCJDE-aYCEMDIy7kB&guid=ON&script=0&is_vtc=1&random=3339180598 HTTP 302
https://www.google.de/pagead/1p-user-list/389211200/?value=1.00&currency_code=USD&label=hCepCJDE-aYCEMDIy7kB&guid=ON&script=0&is_vtc=1&random=3339180598&ipr=y

Request Chain 83

https://cm.g.doubleclick.net/pixel?google_nid=adobe_dmp&google_cm&gdpr=0&gdpr_consent=&google_hm=Mzc3MzM5NjY1NDk4NTM5NjQ1OTM5MTI4MjE5NTkxODAzMjM1MjI= HTTP 302
https://dpm.demdex.net/ibs:dpid=771&dpuuid=CAESENOy7CNQkgN_tnfKj06s0SE&google_cver=1?gdpr=0&gdpr_consent=

Request Chain 84

https://match.adsrvr.org/track/cmf/generic?ttd_pid=aam&gdpr=0&gdpr_consent=&ttd_tpi=1 HTTP 302
https://dpm.demdex.net/ibs:dpid=903&dpuuid=5f8f0f2d-28d7-42c7-8078-aa36b5256d95

Request Chain 85

https://c.bing.com/c.gif?uid=37733966549853964593912821959180323522&Red3=MSAdobe_pd&gdpr=0&gdpr_consent= HTTP 302
https://dpm.demdex.net/ibs:dpid=1957&dpuuid=0BEA078FF513666619F916CAF4C167C8

Request Chain 86

https://servedby.flashtalking.com/map/?key=a74thHgsfK627J6Ftt8sj5ks52bKe&gdpr=0&gdpr_consent=&url=https://dpm.demdex.net/ibs:dpid=3047&dpuuid=[%FT_GUID%]&gdpr=0&gdpr_consent= HTTP 302
https://dpm.demdex.net/ibs:dpid=3047&dpuuid=51524BA7EF9037&gdpr=0&gdpr_consent=

Request Chain 93

https://a.tribalfusion.com/i.match?p=b13&u=37733966549853964593912821959180323522&redirect=https%3A%2F%2Fdpm.demdex.net%2Fibs%3Adpid=22054&dpuuid=$TF_USER_ID_ENC$ HTTP 302
https://s.tribalfusion.com/z/i.match?p=b13&u=37733966549853964593912821959180323522&redirect=https%3A%2F%2Fdpm.demdex.net%2Fibs%3Adpid=22054&dpuuid=$TF_USER_ID_ENC$ HTTP 302
https://dpm.demdex.net/ibs:dpid=22054

Request Chain 94

https://tag.yieldoptimizer.com/ps/ps?t=i&p=2233 HTTP 302
https://tag.yieldoptimizer.com/ps/ps?tc=346001959&t=i&p=2233 HTTP 302
https://dpm.demdex.net/ibs:dpid=22069&dpuuid=3015533742647

Request Chain 95

https://gum.criteo.com/sync?c=8&r=1&a=1&u=https%3A%2F%2Fdpm.demdex.net%2Fibs%3Adpid%3D28645%26dpuuid%3D%40USERID%40%26gdpr%3D0%26gdpr_consent%3D&gdpr=0&gdpr_consent= HTTP 302
https://gum.criteo.com/sync?s=1&c=8&r=1&a=1&u=https%3A%2F%2Fdpm.demdex.net%2Fibs%3Adpid%3D28645%26dpuuid%3D%40USERID%40%26gdpr%3D0%26gdpr_consent%3D&gdpr=0&gdpr_consent= HTTP 302
https://dpm.demdex.net/ibs:dpid=28645&dpuuid=jeRdeU22JhXrW0Uv0nfBz61JuqDUa7lU&gdpr=0&gdpr_consent=

Request Chain 96

https://cms.analytics.yahoo.com/cms?partner_id=ADOBE&_hosted_id=37733966549853964593912821959180323522&gdpr=0&gdpr_consent= HTTP 302
https://dpm.demdex.net/ibs:dpid=30646?dpuuid=y-qHArJv9E2pGRlwTj_v6jgdf5IFftZOg9V8A-~A

Request Chain 98

https://ag.innovid.com/dv/sync?tid=6 HTTP 302
https://dpm.demdex.net/ibs:dpid=80742&dpuuid=efb62d3f-b8b1-4731-8bd8-5f34eaebffe8

Request Chain 99

https://pxl.jivox.com/tags/sync/usync.php?px=IkovJ4aN HTTP 302
https://dpm.demdex.net/ibs:dpid=96420&dpuuid=sWTlTCOb5Os0&us_privacy=$%7BUS_PRIVACY%7D

Request Chain 100

https://usermatch.krxd.net/um/v2?partner=adobe&id=37733966549853964593912821959180323522 HTTP 302
https://beacon.krxd.net/usermatch.gif?kuid_status=new&partner=adobe&id=37733966549853964593912821959180323522

Request Chain 101

https://sync-tm.everesttech.net/upi/pid/5w3jqr4k?redir=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dg8f47s39e399f3fe%26google_push%26google_sc%26google_hm%3D%24%7BTM_USER_ID_BASE64ENC_URLENC%7D HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=g8f47s39e399f3fe&google_push&google_sc&google_hm=WWdMeUZ3QUFBQmpXendRQQ==

Request Chain 102

https://sync-tm.everesttech.net/upi/pid/btu4jd3a?redir=https%3A%2F%2Fpixel.rubiconproject.com%2Ftap.php%3Fv%3D7941%26nid%3D2243%26put%3D%24%7BUSER_ID%7D%26expires%3D90 HTTP 302
https://pixel.rubiconproject.com/tap.php?v=7941&nid=2243&put=YgLyFwAAABjWzwQA&expires=90

Request Chain 103

https://sync-tm.everesttech.net/upi/pid/ZMAwryCI?redir=https%3A%2F%2Fdsum-sec.casalemedia.com%2Frum%3Fcm_dsp_id%3D88%26external_user_id%3D%24%7BTM_USER_ID%7D HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=88&external_user_id=YgLyFwAAABjWzwQA HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=88&external_user_id=YgLyFwAAABjWzwQA&C=1

Request Chain 104

https://sync-tm.everesttech.net/upi/pid/UH6TUt9n?redir=https%3A%2F%2Fib.adnxs.com%2Fsetuid%3Fentity%3D158%26code%3D%24%7BTM_USER_ID%7D HTTP 302
https://ib.adnxs.com/setuid?entity=158&code=YgLyFwAAABjWzwQA

Request Chain 105

https://sync-tm.everesttech.net/upi/pid/ny75r2x0?redir=https%3A%2F%2Fus-u.openx.net%2Fw%2F1.0%2Fsd%3Fid%3D537148856%26val%3D%24%7BTM_USER_ID%7D HTTP 302
https://us-u.openx.net/w/1.0/sd?id=537148856&val=YgLyFwAAABjWzwQA

Request Chain 106

https://sync-tm.everesttech.net/upi/pid/b9pj45k4?redir=https%3A%2F%2Fimage2.pubmatic.com%2FAdServer%2FPug%3Fvcode%3Dbz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA%3D%26piggybackCookie%3D%24%7BUSER_ID%7D HTTP 302
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA=&piggybackCookie=YgLyFwAAABjWzwQA

Request Chain 107

https://sync-tm.everesttech.net/upi/pid/h0r58thg?redir=https%3A%2F%2Fsync.search.spotxchange.com%2Fpartner%3Fadv_id%3D6409%26uid%3D%24%7BUSER_ID%7D%26img%3D1 HTTP 302
https://sync.search.spotxchange.com/partner?adv_id=6409&uid=YgLyFwAAABjWzwQA&img=1 HTTP 302
https://sync.search.spotxchange.com/partner?adv_id=6409&uid=YgLyFwAAABjWzwQA&img=1&__user_check__=1&sync_id=8e87ba4e-8930-11ec-88d2-1bce7de30306

Request Chain 108

https://sync-tm.everesttech.net/upi/pid/r7ifn0SL?redir=https%3A%2F%2Fwww.facebook.com%2Ffr%2Fb.php%3Fp%3D1531105787105294%26e%3D%24%7BTM_USER_ID%7D%26t%3D2592000%26o%3D0 HTTP 302
https://www.facebook.com/fr/b.php?p=1531105787105294&e=YgLyFwAAABjWzwQA&t=2592000&o=0

Request Chain 109

https://cm.ipinyou.com/xcmr/aam/r.gif HTTP 302
https://dpm.demdex.net/ibs:dpid=134084&dpuuid=M296gbFYzyz&redir=http%3A%2F%2Fcm.ipinyou.com%2Fxcms%2Faam%2Fs.gif%3Ftid%3D$%7BDD_UUID%7D HTTP 302
https://cm.ipinyou.com/xcms/aam/s.gif?tid=37733966549853964593912821959180323522

108 HTTP transactions
7 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

Primary Request / Show response
westin.marriott.com/
Redirect Chain

https://email-marriott.com/T/v70000017ed8d78bd88aa6ab6e965fc958/85802f7fe18c463b0000021ef3a0bce0/85802f7f-e18c-463b-9815-f6ef2562f28f?__dU__=v0oQlZ2XmHtXjKKCycNLIk04888UAVMa5S575yBLsoKzM4fwBvfuHkRA...
https://westin.marriott.com/?enrollmentSourceCode=EMEA&nck=125622969&ck=49864193&lk=1000535890

303 KB
43 KB

465ms
153ms

Document
text/html

35.231.127.158
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://westin.marriott.com/?enrollmentSourceCode=EMEA&nck=125622969&ck=49864193&lk=1000535890
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 35.231.127.158 North Charleston, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 158.127.231.35.bc.googleusercontent.com
Software: nginx / WP Engine
Resource Hash: f81d8c572ed3c6eacd7040a19edfbfc0f19e354d64890b4fab6483166d3428fd

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: de-DE,de;q=0.9

Response headers

server: nginx
date: Tue, 08 Feb 2022 22:43:34 GMT
content-type: text/html; charset=UTF-8
vary: Accept-Encoding Accept-Encoding Accept-Encoding,Cookie
link: <https://westin.marriott.com/wp-json/>; rel="https://api.w.org/" <https://westin.marriott.com/wp-json/wp/v2/pages/5053>; rel="alternate"; type="application/json" <https://westin.marriott.com/>; rel=shortlink
x-powered-by: WP Engine
x-cacheable: SHORT
cache-control: max-age=600, must-revalidate
x-cache: HIT: 1
x-cache-group: normal
content-encoding: br

Redirect headers

location: https://westin.marriott.com/?enrollmentSourceCode=EMEA&nck=125622969&ck=49864193&lk=1000535890
cache-control: no-cache
content-length: 0
date: Tue, 08 Feb 2022 22:43:34 GMT

GET
H2 200 style.min.css
westin.marriott.com/wp-includes/css/dist/block-library/ 79 KB
11 KB 137ms
136ms Stylesheet
text/css 35.231.127.158
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://westin.marriott.com/wp-includes/css/dist/block-library/style.min.css?ver=5.8.3
Requested by: Host: westin.marriott.com
URL: https://westin.marriott.com/?enrollmentSourceCode=EMEA&nck=125622969&ck=49864193&lk=1000535890
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 35.231.127.158 North Charleston, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 158.127.231.35.bc.googleusercontent.com
Software: nginx /
Resource Hash: 9110fc122dda3067c424d9b8ff7747e2030b0bd9298f69a3683d399ad3373a6a

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://westin.marriott.com/?enrollmentSourceCode=EMEA&nck=125622969&ck=49864193&lk=1000535890
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Tue, 08 Feb 2022 22:43:34 GMT
content-encoding: br
last-modified: Wed, 01 Sep 2021 04:05:58 GMT
server: nginx
etag: W/"612efc26-13abe"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 cms-navigation-base.css
westin.marriott.com/wp-content/plugins/wpml-cms-nav/res/css/ 3 KB
1 KB 108ms
105ms Stylesheet
text/css 35.231.127.158
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://westin.marriott.com/wp-content/plugins/wpml-cms-nav/res/css/cms-navigation-base.css?ver=1.5.5
Requested by: Host: westin.marriott.com
URL: https://westin.marriott.com/?enrollmentSourceCode=EMEA&nck=125622969&ck=49864193&lk=1000535890
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 35.231.127.158 North Charleston, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 158.127.231.35.bc.googleusercontent.com
Software: nginx /
Resource Hash: 8577df598f439b9602bfec90eb2c2a654dbb3bd1922ad1d768d6ca3aef58c825

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://westin.marriott.com/?enrollmentSourceCode=EMEA&nck=125622969&ck=49864193&lk=1000535890
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Tue, 08 Feb 2022 22:43:34 GMT
content-encoding: br
last-modified: Fri, 29 Oct 2021 19:38:54 GMT
server: nginx
etag: W/"617c4dce-bbc"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 cms-navigation.css
westin.marriott.com/wp-content/plugins/wpml-cms-nav/res/css/ 2 KB
848 B 105ms
102ms Stylesheet
text/css 35.231.127.158
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://westin.marriott.com/wp-content/plugins/wpml-cms-nav/res/css/cms-navigation.css?ver=1.5.5
Requested by: Host: westin.marriott.com
URL: https://westin.marriott.com/?enrollmentSourceCode=EMEA&nck=125622969&ck=49864193&lk=1000535890
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 35.231.127.158 North Charleston, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 158.127.231.35.bc.googleusercontent.com
Software: nginx /
Resource Hash: cf7391b5c06a56e0f70f64b89ed9d42fd6ccc2efed6ea005237c39dc451ed681

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://westin.marriott.com/?enrollmentSourceCode=EMEA&nck=125622969&ck=49864193&lk=1000535890
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Tue, 08 Feb 2022 22:43:34 GMT
content-encoding: br
last-modified: Fri, 29 Oct 2021 19:38:54 GMT
server: nginx
etag: W/"617c4dce-946"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 style.css
westin.marriott.com/wp-content/themes/westin/ 72 B
277 B 137ms
134ms Stylesheet
text/css 35.231.127.158
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://westin.marriott.com/wp-content/themes/westin/style.css
Requested by: Host: westin.marriott.com
URL: https://westin.marriott.com/?enrollmentSourceCode=EMEA&nck=125622969&ck=49864193&lk=1000535890
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 35.231.127.158 North Charleston, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 158.127.231.35.bc.googleusercontent.com
Software: nginx /
Resource Hash: 82c9979fbd8a50b37d9abd208505eb89b614f8a0f3e721d4e6e6e71caed18a77

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://westin.marriott.com/?enrollmentSourceCode=EMEA&nck=125622969&ck=49864193&lk=1000535890
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Tue, 08 Feb 2022 22:43:34 GMT
content-encoding: br
last-modified: Fri, 29 Oct 2021 19:38:54 GMT
server: nginx
etag: W/"617c4dce-48"
vary: Accept-Encoding, Accept-Encoding
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 style.css
westin.marriott.com/wp-content/themes/westin/assets/css/ 189 KB
29 KB 166ms
164ms Stylesheet
text/css 35.231.127.158
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://westin.marriott.com/wp-content/themes/westin/assets/css/style.css
Requested by: Host: westin.marriott.com
URL: https://westin.marriott.com/?enrollmentSourceCode=EMEA&nck=125622969&ck=49864193&lk=1000535890
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 35.231.127.158 North Charleston, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 158.127.231.35.bc.googleusercontent.com
Software: nginx /
Resource Hash: d16e18bacf12f7a54b9f69262748bd384fb4112a78a8e001be1c8dc082ac28fa

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://westin.marriott.com/?enrollmentSourceCode=EMEA&nck=125622969&ck=49864193&lk=1000535890
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Tue, 08 Feb 2022 22:43:34 GMT
content-encoding: br
last-modified: Thu, 23 Dec 2021 20:09:07 GMT
server: nginx
etag: W/"61c4d763-2f2bd"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 pacsys.css
pacsys.marriott.com/2.3.1.7/build/ 116 KB
12 KB 391ms
193ms Stylesheet
text/css 52.204.27.57
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://pacsys.marriott.com/2.3.1.7/build/pacsys.css
Requested by: Host: westin.marriott.com
URL: https://westin.marriott.com/?enrollmentSourceCode=EMEA&nck=125622969&ck=49864193&lk=1000535890
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 52.204.27.57 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-204-27-57.compute-1.amazonaws.com
Software: nginx /
Resource Hash: 34db58c825c386db8e25db23fef962a89deb2829ab069ddd2dfcdfb3c9202cad

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://westin.marriott.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Tue, 08 Feb 2022 22:43:35 GMT
content-encoding: br
last-modified: Fri, 14 Jan 2022 20:44:43 GMT
server: nginx
etag: W/"61e1e0bb-1cf91"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 libs.min.js Show response
westin.marriott.com/wp-content/themes/marriott-master/assets/js/ 629 KB
190 KB 166ms
164ms Script
application/javascript 35.231.127.158
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://westin.marriott.com/wp-content/themes/marriott-master/assets/js/libs.min.js
Requested by: Host: westin.marriott.com
URL: https://westin.marriott.com/?enrollmentSourceCode=EMEA&nck=125622969&ck=49864193&lk=1000535890
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 35.231.127.158 North Charleston, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 158.127.231.35.bc.googleusercontent.com
Software: nginx /
Resource Hash: 748e9410d3f0cc597e0cc7f09f130a2a87cae435306bcac7012b5fe71ab88176

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://westin.marriott.com/?enrollmentSourceCode=EMEA&nck=125622969&ck=49864193&lk=1000535890
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Tue, 08 Feb 2022 22:43:34 GMT
content-encoding: br
last-modified: Thu, 23 Dec 2021 20:09:07 GMT
server: nginx
etag: W/"61c4d763-9d3f8"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 master.min.js Show response
westin.marriott.com/wp-content/themes/marriott-master/assets/js/ 138 KB
34 KB 166ms
165ms Script
application/javascript 35.231.127.158
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://westin.marriott.com/wp-content/themes/marriott-master/assets/js/master.min.js
Requested by: Host: westin.marriott.com
URL: https://westin.marriott.com/?enrollmentSourceCode=EMEA&nck=125622969&ck=49864193&lk=1000535890
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 35.231.127.158 North Charleston, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 158.127.231.35.bc.googleusercontent.com
Software: nginx /
Resource Hash: 9821a90ef099a74fa89c7fb6c61eab75f52cdb64c90d3de925f05da7dcbd84bf

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://westin.marriott.com/?enrollmentSourceCode=EMEA&nck=125622969&ck=49864193&lk=1000535890
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Tue, 08 Feb 2022 22:43:34 GMT
content-encoding: br
last-modified: Thu, 23 Dec 2021 20:09:07 GMT
server: nginx
etag: W/"61c4d763-229b7"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 launch-EN3963523be4674e5591a9c4d516697352.min.js Show response
assets.adobedtm.com/ 424 KB
111 KB 31ms
10ms Script
application/x-javascript 2a02:26f0:6c00:299::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/launch-EN3963523be4674e5591a9c4d516697352.min.js?ver=1.0.0
Requested by: Host: westin.marriott.com
URL: https://westin.marriott.com/?enrollmentSourceCode=EMEA&nck=125622969&ck=49864193&lk=1000535890
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:6c00:299::1e80 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: 7e4e5eac0b8b52bbe3deebd18ab2a58d33559bbf6b880f2b2e510d76b2318a69

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://westin.marriott.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Tue, 08 Feb 2022 22:43:35 GMT
content-encoding: gzip
last-modified: Wed, 26 Jan 2022 21:46:47 GMT
server: AkamaiNetStorage
etag: "abdbbc3f5548d353910f1f9a20aee281:1643233607.244996"
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: https://westin.marriott.com
cache-control: max-age=3600
accept-ranges: bytes
timing-allow-origin: *
content-length: 112648
expires: Tue, 08 Feb 2022 23:43:35 GMT

GET
H2 200 westin.svg
westin.marriott.com/wp-content/themes/westin/assets/img/ 18 KB
6 KB 117ms
113ms Image
image/svg+xml 35.231.127.158
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://westin.marriott.com/wp-content/themes/westin/assets/img/westin.svg
Requested by: Host: westin.marriott.com
URL: https://westin.marriott.com/?enrollmentSourceCode=EMEA&nck=125622969&ck=49864193&lk=1000535890
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 35.231.127.158 North Charleston, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 158.127.231.35.bc.googleusercontent.com
Software: nginx /
Resource Hash: 36adc6150d010b325ebd5b63097a6f697f1b0dbc80823a8087b05d01ddac5141

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://westin.marriott.com/?enrollmentSourceCode=EMEA&nck=125622969&ck=49864193&lk=1000535890
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Tue, 08 Feb 2022 22:43:35 GMT
content-encoding: br
last-modified: Fri, 29 Oct 2021 19:38:54 GMT
server: nginx
etag: W/"617c4dce-475f"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 w-274080_pano-1536x614.jpg
westin.marriott.com/wp-content/uploads/2019/05/ 395 KB
396 KB 120ms
117ms Image
image/jpeg 35.231.127.158
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://westin.marriott.com/wp-content/uploads/2019/05/w-274080_pano-1536x614.jpg
Requested by: Host: westin.marriott.com
URL: https://westin.marriott.com/?enrollmentSourceCode=EMEA&nck=125622969&ck=49864193&lk=1000535890
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 35.231.127.158 North Charleston, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 158.127.231.35.bc.googleusercontent.com
Software: nginx /
Resource Hash: 0d74ac9dec4dbb99ceb8597e29b7fb1fa8c897cda530f441c0fd5d6fe08d5d68

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://westin.marriott.com/?enrollmentSourceCode=EMEA&nck=125622969&ck=49864193&lk=1000535890
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Tue, 08 Feb 2022 22:43:35 GMT
last-modified: Tue, 28 Sep 2021 02:29:45 GMT
server: nginx
etag: "61527e19-62c14"
vary: Accept-Encoding
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
content-length: 404500

GET
H2 200 wes_196838_1536x1536-400x400.jpg
westin.marriott.com/wp-content/uploads/2019/07/ 39 KB
39 KB 121ms
117ms Image
image/jpeg 35.231.127.158
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://westin.marriott.com/wp-content/uploads/2019/07/wes_196838_1536x1536-400x400.jpg
Requested by: Host: westin.marriott.com
URL: https://westin.marriott.com/?enrollmentSourceCode=EMEA&nck=125622969&ck=49864193&lk=1000535890
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 35.231.127.158 North Charleston, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 158.127.231.35.bc.googleusercontent.com
Software: nginx /
Resource Hash: 1fb5df0313c436718e1e564c7ae1d277e0c51e44dc192d45de2e955ce3bf35b2

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://westin.marriott.com/?enrollmentSourceCode=EMEA&nck=125622969&ck=49864193&lk=1000535890
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Tue, 08 Feb 2022 22:43:35 GMT
last-modified: Tue, 28 Sep 2021 02:29:45 GMT
server: nginx
etag: "61527e19-9ab6"
vary: Accept-Encoding
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
content-length: 39606

GET
H2 200 grid-6-64x64.png
westin.marriott.com/wp-content/uploads/2018/03/ 6 KB
6 KB 137ms
133ms Image
image/png 35.231.127.158
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://westin.marriott.com/wp-content/uploads/2018/03/grid-6-64x64.png
Requested by: Host: westin.marriott.com
URL: https://westin.marriott.com/?enrollmentSourceCode=EMEA&nck=125622969&ck=49864193&lk=1000535890
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 35.231.127.158 North Charleston, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 158.127.231.35.bc.googleusercontent.com
Software: nginx /
Resource Hash: 6f2a7e571ce1315960b9e81c4a79b1f0139c9a91fa6a27f143db5844d0c49246

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://westin.marriott.com/?enrollmentSourceCode=EMEA&nck=125622969&ck=49864193&lk=1000535890
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Tue, 08 Feb 2022 22:43:35 GMT
last-modified: Tue, 28 Sep 2021 02:29:47 GMT
server: nginx
etag: "61527e1b-165c"
vary: Accept-Encoding
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
content-length: 5724

GET
H2 200 wes_600468_1536x1536-400x400.jpg
westin.marriott.com/wp-content/uploads/2021/06/ 32 KB
33 KB 137ms
134ms Image
image/jpeg 35.231.127.158
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://westin.marriott.com/wp-content/uploads/2021/06/wes_600468_1536x1536-400x400.jpg
Requested by: Host: westin.marriott.com
URL: https://westin.marriott.com/?enrollmentSourceCode=EMEA&nck=125622969&ck=49864193&lk=1000535890
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 35.231.127.158 North Charleston, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 158.127.231.35.bc.googleusercontent.com
Software: nginx /
Resource Hash: 7eb8b522380056eeb4bd4d7dab434040f9098425a802b04ce69f4648d10d3a26

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://westin.marriott.com/?enrollmentSourceCode=EMEA&nck=125622969&ck=49864193&lk=1000535890
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Tue, 08 Feb 2022 22:43:35 GMT
last-modified: Tue, 28 Sep 2021 02:29:45 GMT
server: nginx
etag: "61527e19-81fb"
vary: Accept-Encoding
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
content-length: 33275

GET
H2 200 grid-1-64x64.png
westin.marriott.com/wp-content/uploads/2018/03/ 3 KB
4 KB 137ms
134ms Image
image/png 35.231.127.158
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://westin.marriott.com/wp-content/uploads/2018/03/grid-1-64x64.png
Requested by: Host: westin.marriott.com
URL: https://westin.marriott.com/?enrollmentSourceCode=EMEA&nck=125622969&ck=49864193&lk=1000535890
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 35.231.127.158 North Charleston, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 158.127.231.35.bc.googleusercontent.com
Software: nginx /
Resource Hash: a097184c870bba774ee9b5fdd8f4b39f4216593805cad631319e860c148af62b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://westin.marriott.com/?enrollmentSourceCode=EMEA&nck=125622969&ck=49864193&lk=1000535890
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Tue, 08 Feb 2022 22:43:35 GMT
last-modified: Tue, 28 Sep 2021 02:29:47 GMT
server: nginx
etag: "61527e1b-dec"
vary: Accept-Encoding
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
content-length: 3564

GET
H2 200 wes_297843_1536x1536-400x400.jpg
westin.marriott.com/wp-content/uploads/2019/07/ 51 KB
51 KB 137ms
134ms Image
image/jpeg 35.231.127.158
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://westin.marriott.com/wp-content/uploads/2019/07/wes_297843_1536x1536-400x400.jpg
Requested by: Host: westin.marriott.com
URL: https://westin.marriott.com/?enrollmentSourceCode=EMEA&nck=125622969&ck=49864193&lk=1000535890
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 35.231.127.158 North Charleston, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 158.127.231.35.bc.googleusercontent.com
Software: nginx /
Resource Hash: 684c8e17ea3bd4147c0d28890f6b4e6654234eb4c8f7749e2fa5e1cbc089f7b2

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://westin.marriott.com/?enrollmentSourceCode=EMEA&nck=125622969&ck=49864193&lk=1000535890
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Tue, 08 Feb 2022 22:43:35 GMT
last-modified: Tue, 28 Sep 2021 02:29:45 GMT
server: nginx
etag: "61527e19-cc43"
vary: Accept-Encoding
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
content-length: 52291

GET
H2 200 grid-5-64x64.png
westin.marriott.com/wp-content/uploads/2018/03/ 4 KB
4 KB 137ms
134ms Image
image/png 35.231.127.158
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://westin.marriott.com/wp-content/uploads/2018/03/grid-5-64x64.png
Requested by: Host: westin.marriott.com
URL: https://westin.marriott.com/?enrollmentSourceCode=EMEA&nck=125622969&ck=49864193&lk=1000535890
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 35.231.127.158 North Charleston, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 158.127.231.35.bc.googleusercontent.com
Software: nginx /
Resource Hash: f786e15bbceb1ca8c806e3b42390d74c06ec77d6672aa03ee0302bfb38d125b3

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://westin.marriott.com/?enrollmentSourceCode=EMEA&nck=125622969&ck=49864193&lk=1000535890
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Tue, 08 Feb 2022 22:43:35 GMT
last-modified: Tue, 28 Sep 2021 02:29:47 GMT
server: nginx
etag: "61527e1b-fc6"
vary: Accept-Encoding
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
content-length: 4038

GET
H2 200 w-263035_pano-1536x614.jpg
westin.marriott.com/wp-content/uploads/2019/05/ 138 KB
138 KB 137ms
134ms Image
image/jpeg 35.231.127.158
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://westin.marriott.com/wp-content/uploads/2019/05/w-263035_pano-1536x614.jpg
Requested by: Host: westin.marriott.com
URL: https://westin.marriott.com/?enrollmentSourceCode=EMEA&nck=125622969&ck=49864193&lk=1000535890
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 35.231.127.158 North Charleston, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 158.127.231.35.bc.googleusercontent.com
Software: nginx /
Resource Hash: 7137408ef48007cd2eb01157177f885566185221bc2b402aa83d84a829b5e52e

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://westin.marriott.com/?enrollmentSourceCode=EMEA&nck=125622969&ck=49864193&lk=1000535890
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Tue, 08 Feb 2022 22:43:35 GMT
last-modified: Tue, 28 Sep 2021 02:29:45 GMT
server: nginx
etag: "61527e19-226e2"
vary: Accept-Encoding
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
content-length: 141026

GET
H2 200 WI_266982_2880x1152-1536x614.jpg
westin.marriott.com/wp-content/uploads/2020/03/ 75 KB
75 KB 173ms
170ms Image
image/jpeg 35.231.127.158
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://westin.marriott.com/wp-content/uploads/2020/03/WI_266982_2880x1152-1536x614.jpg
Requested by: Host: westin.marriott.com
URL: https://westin.marriott.com/?enrollmentSourceCode=EMEA&nck=125622969&ck=49864193&lk=1000535890
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 35.231.127.158 North Charleston, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 158.127.231.35.bc.googleusercontent.com
Software: nginx /
Resource Hash: f3683b159670ab681d39b5ae797fd300a478bb904fafce9be6b97e91c955daa3

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://westin.marriott.com/?enrollmentSourceCode=EMEA&nck=125622969&ck=49864193&lk=1000535890
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Tue, 08 Feb 2022 22:43:35 GMT
last-modified: Tue, 28 Sep 2021 02:29:45 GMT
server: nginx
etag: "61527e19-12a09"
vary: Accept-Encoding
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
content-length: 76297

GET
H2 200 w-266054_pano-1536x614.jpg
westin.marriott.com/wp-content/uploads/2019/05/ 152 KB
152 KB 173ms
170ms Image
image/jpeg 35.231.127.158
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://westin.marriott.com/wp-content/uploads/2019/05/w-266054_pano-1536x614.jpg
Requested by: Host: westin.marriott.com
URL: https://westin.marriott.com/?enrollmentSourceCode=EMEA&nck=125622969&ck=49864193&lk=1000535890
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 35.231.127.158 North Charleston, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 158.127.231.35.bc.googleusercontent.com
Software: nginx /
Resource Hash: da5fbe4fa4baffc3907a2e93ddcab15eb638ccd712e4bb85a287c0547ebe1ad8

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://westin.marriott.com/?enrollmentSourceCode=EMEA&nck=125622969&ck=49864193&lk=1000535890
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Tue, 08 Feb 2022 22:43:35 GMT
last-modified: Tue, 28 Sep 2021 02:29:45 GMT
server: nginx
etag: "61527e19-25ffe"
vary: Accept-Encoding
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
content-length: 155646

GET
H2 200 w_197237_sq-400x400.jpg
westin.marriott.com/wp-content/uploads/2019/05/ 43 KB
43 KB 174ms
171ms Image
image/jpeg 35.231.127.158
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://westin.marriott.com/wp-content/uploads/2019/05/w_197237_sq-400x400.jpg
Requested by: Host: westin.marriott.com
URL: https://westin.marriott.com/?enrollmentSourceCode=EMEA&nck=125622969&ck=49864193&lk=1000535890
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 35.231.127.158 North Charleston, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 158.127.231.35.bc.googleusercontent.com
Software: nginx /
Resource Hash: 39fa587b3d332e83853591e4b72dc594d1c08b085fcf84a9236356328c156f6b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://westin.marriott.com/?enrollmentSourceCode=EMEA&nck=125622969&ck=49864193&lk=1000535890
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Tue, 08 Feb 2022 22:43:35 GMT
last-modified: Tue, 28 Sep 2021 02:29:45 GMT
server: nginx
etag: "61527e19-acf8"
vary: Accept-Encoding
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
content-length: 44280

GET
H2 200 grid-4-64x64.png
westin.marriott.com/wp-content/uploads/2018/03/ 6 KB
6 KB 174ms
171ms Image
image/png 35.231.127.158
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://westin.marriott.com/wp-content/uploads/2018/03/grid-4-64x64.png
Requested by: Host: westin.marriott.com
URL: https://westin.marriott.com/?enrollmentSourceCode=EMEA&nck=125622969&ck=49864193&lk=1000535890
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 35.231.127.158 North Charleston, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 158.127.231.35.bc.googleusercontent.com
Software: nginx /
Resource Hash: 0babf4f3f7870c4b8335d1a4e144c7cbbbfa7f24b2bb684498a36a91954716d4

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://westin.marriott.com/?enrollmentSourceCode=EMEA&nck=125622969&ck=49864193&lk=1000535890
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Tue, 08 Feb 2022 22:43:35 GMT
last-modified: Tue, 28 Sep 2021 02:29:47 GMT
server: nginx
etag: "61527e1b-1620"
vary: Accept-Encoding
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
content-length: 5664

GET
H2 200 197229_sq-400x400.jpg
westin.marriott.com/wp-content/uploads/2018/03/ 34 KB
34 KB 174ms
171ms Image
image/jpeg 35.231.127.158
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://westin.marriott.com/wp-content/uploads/2018/03/197229_sq-400x400.jpg
Requested by: Host: westin.marriott.com
URL: https://westin.marriott.com/?enrollmentSourceCode=EMEA&nck=125622969&ck=49864193&lk=1000535890
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 35.231.127.158 North Charleston, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 158.127.231.35.bc.googleusercontent.com
Software: nginx /
Resource Hash: b771771ab4afb10b6f1a5ef56dc3ec9e32709685b92a0e1304d71aeaac1c98c1

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://westin.marriott.com/?enrollmentSourceCode=EMEA&nck=125622969&ck=49864193&lk=1000535890
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Tue, 08 Feb 2022 22:43:35 GMT
last-modified: Tue, 28 Sep 2021 02:29:47 GMT
server: nginx
etag: "61527e1b-86d9"
vary: Accept-Encoding
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
content-length: 34521

GET
H2 200 grid-2-64x64.png
westin.marriott.com/wp-content/uploads/2018/03/ 6 KB
6 KB 174ms
171ms Image
image/png 35.231.127.158
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://westin.marriott.com/wp-content/uploads/2018/03/grid-2-64x64.png
Requested by: Host: westin.marriott.com
URL: https://westin.marriott.com/?enrollmentSourceCode=EMEA&nck=125622969&ck=49864193&lk=1000535890
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 35.231.127.158 North Charleston, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 158.127.231.35.bc.googleusercontent.com
Software: nginx /
Resource Hash: 149b209d9e9185e8b959a735427ac3538d154a86f5911b804e265ae33e679df2

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://westin.marriott.com/?enrollmentSourceCode=EMEA&nck=125622969&ck=49864193&lk=1000535890
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Tue, 08 Feb 2022 22:43:35 GMT
last-modified: Tue, 28 Sep 2021 02:29:47 GMT
server: nginx
etag: "61527e1b-1692"
vary: Accept-Encoding
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
content-length: 5778

GET
H2 200 w_197064_sq-400x400.jpg
westin.marriott.com/wp-content/uploads/2019/05/ 46 KB
47 KB 174ms
171ms Image
image/jpeg 35.231.127.158
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://westin.marriott.com/wp-content/uploads/2019/05/w_197064_sq-400x400.jpg
Requested by: Host: westin.marriott.com
URL: https://westin.marriott.com/?enrollmentSourceCode=EMEA&nck=125622969&ck=49864193&lk=1000535890
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 35.231.127.158 North Charleston, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 158.127.231.35.bc.googleusercontent.com
Software: nginx /
Resource Hash: 29515d1554ad4889d0c20188cf0d113d11f839d1c6ed3cc4b182b9441d1ec962

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://westin.marriott.com/?enrollmentSourceCode=EMEA&nck=125622969&ck=49864193&lk=1000535890
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Tue, 08 Feb 2022 22:43:35 GMT
last-modified: Tue, 28 Sep 2021 02:29:45 GMT
server: nginx
etag: "61527e19-b94d"
vary: Accept-Encoding
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
content-length: 47437

GET
H2 200 grid-3-64x64.png
westin.marriott.com/wp-content/uploads/2018/03/ 5 KB
5 KB 174ms
172ms Image
image/png 35.231.127.158
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://westin.marriott.com/wp-content/uploads/2018/03/grid-3-64x64.png
Requested by: Host: westin.marriott.com
URL: https://westin.marriott.com/?enrollmentSourceCode=EMEA&nck=125622969&ck=49864193&lk=1000535890
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 35.231.127.158 North Charleston, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 158.127.231.35.bc.googleusercontent.com
Software: nginx /
Resource Hash: 89c0f4f40097f31de88ca43cf777c25a2caa5e757a99a628c4482346e285f039

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://westin.marriott.com/?enrollmentSourceCode=EMEA&nck=125622969&ck=49864193&lk=1000535890
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Tue, 08 Feb 2022 22:43:35 GMT
last-modified: Tue, 28 Sep 2021 02:29:47 GMT
server: nginx
etag: "61527e1b-144b"
vary: Accept-Encoding
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
content-length: 5195

GET
H2 200 WI_1038815_1536x1536-768x768.jpg
westin.marriott.com/wp-content/uploads/2021/07/ 95 KB
95 KB 174ms
172ms Image
image/jpeg 35.231.127.158
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://westin.marriott.com/wp-content/uploads/2021/07/WI_1038815_1536x1536-768x768.jpg
Requested by: Host: westin.marriott.com
URL: https://westin.marriott.com/?enrollmentSourceCode=EMEA&nck=125622969&ck=49864193&lk=1000535890
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 35.231.127.158 North Charleston, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 158.127.231.35.bc.googleusercontent.com
Software: nginx /
Resource Hash: 96aa054c7283874ee7e0cc438c03fa1c8342669d4fe5f4dc02e57ff8cf63bd92

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://westin.marriott.com/?enrollmentSourceCode=EMEA&nck=125622969&ck=49864193&lk=1000535890
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Tue, 08 Feb 2022 22:43:35 GMT
last-modified: Tue, 28 Sep 2021 02:29:45 GMT
server: nginx
etag: "61527e19-17b0b"
vary: Accept-Encoding
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
content-length: 97035

GET
H2 200 w_274077_sq-768x768.jpg
westin.marriott.com/wp-content/uploads/2019/05/ 155 KB
155 KB 174ms
172ms Image
image/jpeg 35.231.127.158
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://westin.marriott.com/wp-content/uploads/2019/05/w_274077_sq-768x768.jpg
Requested by: Host: westin.marriott.com
URL: https://westin.marriott.com/?enrollmentSourceCode=EMEA&nck=125622969&ck=49864193&lk=1000535890
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 35.231.127.158 North Charleston, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 158.127.231.35.bc.googleusercontent.com
Software: nginx /
Resource Hash: ed6db2ba224d804acea840f50830b19dfa613e9afc07af3f413136be0e9aa379

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://westin.marriott.com/?enrollmentSourceCode=EMEA&nck=125622969&ck=49864193&lk=1000535890
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Tue, 08 Feb 2022 22:43:35 GMT
last-modified: Tue, 28 Sep 2021 02:29:45 GMT
server: nginx
etag: "61527e19-26a55"
vary: Accept-Encoding
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
content-length: 158293

GET
H2 200 wes4751lo-243016-Entry-High_1536x1536-768x768.jpg
westin.marriott.com/wp-content/uploads/2018/07/ 140 KB
141 KB 174ms
172ms Image
image/jpeg 35.231.127.158
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://westin.marriott.com/wp-content/uploads/2018/07/wes4751lo-243016-Entry-High_1536x1536-768x768.jpg
Requested by: Host: westin.marriott.com
URL: https://westin.marriott.com/?enrollmentSourceCode=EMEA&nck=125622969&ck=49864193&lk=1000535890
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 35.231.127.158 North Charleston, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 158.127.231.35.bc.googleusercontent.com
Software: nginx /
Resource Hash: 8b397f6f5d6f9b3ca3206c0bc305a71f19c4af2f4eaf97cc78b7f89756db4513

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://westin.marriott.com/?enrollmentSourceCode=EMEA&nck=125622969&ck=49864193&lk=1000535890
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Tue, 08 Feb 2022 22:43:35 GMT
last-modified: Tue, 28 Sep 2021 02:29:46 GMT
server: nginx
etag: "61527e1a-230c7"
vary: Accept-Encoding
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
content-length: 143559

GET
H2 200 spg_1320x880-400x267.jpg
westin.marriott.com/wp-content/uploads/2018/03/ 24 KB
24 KB 174ms
172ms Image
image/jpeg 35.231.127.158
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://westin.marriott.com/wp-content/uploads/2018/03/spg_1320x880-400x267.jpg
Requested by: Host: westin.marriott.com
URL: https://westin.marriott.com/?enrollmentSourceCode=EMEA&nck=125622969&ck=49864193&lk=1000535890
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 35.231.127.158 North Charleston, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 158.127.231.35.bc.googleusercontent.com
Software: nginx /
Resource Hash: 59d04f736bbce5134de1fd1cfa31b0c27a2e2d25dd9a67c9661185ebcf0823e9

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://westin.marriott.com/?enrollmentSourceCode=EMEA&nck=125622969&ck=49864193&lk=1000535890
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Tue, 08 Feb 2022 22:43:35 GMT
last-modified: Tue, 28 Sep 2021 02:29:47 GMT
server: nginx
etag: "61527e1b-5fce"
vary: Accept-Encoding
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
content-length: 24526

GET
H2 200 devices.png
westin.marriott.com/wp-content/themes/marriott-master/assets/img/brandbar/ 66 KB
66 KB 174ms
173ms Image
image/png 35.231.127.158
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://westin.marriott.com/wp-content/themes/marriott-master/assets/img/brandbar/devices.png
Requested by: Host: westin.marriott.com
URL: https://westin.marriott.com/?enrollmentSourceCode=EMEA&nck=125622969&ck=49864193&lk=1000535890
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 35.231.127.158 North Charleston, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 158.127.231.35.bc.googleusercontent.com
Software: nginx /
Resource Hash: 1bb0d1951fa294ddb0df709a965a236c516169cc81603f251f4da4e4bb1add5c

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://westin.marriott.com/?enrollmentSourceCode=EMEA&nck=125622969&ck=49864193&lk=1000535890
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Tue, 08 Feb 2022 22:43:35 GMT
last-modified: Fri, 29 Oct 2021 19:38:54 GMT
server: nginx
etag: "617c4dce-106e6"
vary: Accept-Encoding
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
content-length: 67302

GET
H2 200 js Show response
maps.googleapis.com/maps/api/ 149 KB
49 KB 50ms
27ms Script
text/javascript 2a00:1450:4001:80e::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://maps.googleapis.com/maps/api/js?v=3&client=gme-marriottinternational&channel=aloft&callback=window.app.map

Requested by

Host: westin.marriott.com
URL: https://westin.marriott.com/?enrollmentSourceCode=EMEA&nck=125622969&ck=49864193&lk=1000535890

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80e::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

mafe /

Resource Hash

a98196ff46677867c9aab1aa8b72f5dc063d429d70ec36e8ab120cb6085bacdb

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://westin.marriott.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Tue, 08 Feb 2022 22:43:35 GMT
content-encoding: gzip
vary: Accept-Language
server: mafe
x-frame-options: SAMEORIGIN
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1800
cross-origin-resource-policy: cross-origin
server-timing: gfet4t7; dur=12
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 50137
x-xss-protection: 0
expires: Tue, 08 Feb 2022 23:13:35 GMT

GET
H2 200 pacsys.js Show response
pacsys.marriott.com/2.3.1.7/build/ 132 KB
43 KB 102ms
101ms Script
application/javascript 52.204.27.57
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://pacsys.marriott.com/2.3.1.7/build/pacsys.js
Requested by: Host: westin.marriott.com
URL: https://westin.marriott.com/?enrollmentSourceCode=EMEA&nck=125622969&ck=49864193&lk=1000535890
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 52.204.27.57 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-204-27-57.compute-1.amazonaws.com
Software: nginx /
Resource Hash: ddea5597073369631a04058b389fe89c87cdc5d65461166e6a49f0e2c58e22b6

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://westin.marriott.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Tue, 08 Feb 2022 22:43:35 GMT
content-encoding: br
last-modified: Fri, 14 Jan 2022 20:44:43 GMT
server: nginx
etag: W/"61e1e0bb-21078"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 wp-embed.min.js Show response
westin.marriott.com/wp-includes/js/ 1 KB
947 B 104ms
104ms Script
application/javascript 35.231.127.158
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://westin.marriott.com/wp-includes/js/wp-embed.min.js?ver=5.8.3
Requested by: Host: westin.marriott.com
URL: https://westin.marriott.com/?enrollmentSourceCode=EMEA&nck=125622969&ck=49864193&lk=1000535890
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 35.231.127.158 North Charleston, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 158.127.231.35.bc.googleusercontent.com
Software: nginx /
Resource Hash: 5be614bce53f767993a5f5f14a6badd6aae6bf3af7cbdbf4d31520de49e27991

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://westin.marriott.com/?enrollmentSourceCode=EMEA&nck=125622969&ck=49864193&lk=1000535890
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Tue, 08 Feb 2022 22:43:35 GMT
content-encoding: br
last-modified: Wed, 06 Jan 2021 15:29:24 GMT
server: nginx
etag: W/"5ff5d754-592"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
DATA 200
OK truncated
/ 204 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 7ea5c3b6bfe339ba0af64f85334d03a42a6b3bc93868198cc9d5f28a9ca26df6

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Content-Type: image/svg+xml;charset=UTF-8

GET
H2 200 appstore-apple.png
westin.marriott.com/wp-content/themes/marriott-master/assets/img/footer/ 9 KB
9 KB 153ms
151ms Image
image/png 35.231.127.158
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://westin.marriott.com/wp-content/themes/marriott-master/assets/img/footer/appstore-apple.png
Requested by: Host: westin.marriott.com
URL: https://westin.marriott.com/wp-content/themes/westin/assets/css/style.css
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 35.231.127.158 North Charleston, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 158.127.231.35.bc.googleusercontent.com
Software: nginx /
Resource Hash: 7464a6bad3bf49cf76803d1d879feb879ae2221ee5f5b9909b50d5f90fdfe163

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://westin.marriott.com/wp-content/themes/westin/assets/css/style.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Tue, 08 Feb 2022 22:43:35 GMT
last-modified: Fri, 29 Oct 2021 19:38:54 GMT
server: nginx
etag: "617c4dce-234a"
vary: Accept-Encoding
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
content-length: 9034

GET
H2 200 appstore-googleplay.png
westin.marriott.com/wp-content/themes/marriott-master/assets/img/footer/ 12 KB
12 KB 221ms
219ms Image
image/png 35.231.127.158
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://westin.marriott.com/wp-content/themes/marriott-master/assets/img/footer/appstore-googleplay.png
Requested by: Host: westin.marriott.com
URL: https://westin.marriott.com/wp-content/themes/westin/assets/css/style.css
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 35.231.127.158 North Charleston, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 158.127.231.35.bc.googleusercontent.com
Software: nginx /
Resource Hash: 83fa1185397dc0c596c0814a617c919b5feb6b28e620f899234699e4d986a83a

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://westin.marriott.com/wp-content/themes/westin/assets/css/style.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Tue, 08 Feb 2022 22:43:35 GMT
last-modified: Fri, 29 Oct 2021 19:38:54 GMT
server: nginx
etag: "617c4dce-2f5e"
vary: Accept-Encoding
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
content-length: 12126

GET
DATA 200
OK truncated
/ 715 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 5a3f1dd74233f605e511f1b5b244bedf85ac88ba264caf4d6401bc7ec2017dcd

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ 380 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 717f6bb5f6cc69c444f54376a72dee0ca7968b2a12e7c9475247ec85c0e75a53

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
H2 200 icomoon.ttf
westin.marriott.com/wp-content/themes/westin/assets/fonts/ 5 KB
5 KB 215ms
214ms Font
application/octet-stream 35.231.127.158
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://westin.marriott.com/wp-content/themes/westin/assets/fonts/icomoon.ttf?1sp0ne
Requested by: Host: westin.marriott.com
URL: https://westin.marriott.com/wp-content/themes/westin/assets/css/style.css
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 35.231.127.158 North Charleston, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 158.127.231.35.bc.googleusercontent.com
Software: nginx /
Resource Hash: 6424b5f29d19a54d1f51d0e32d97444879ba4ab29cc5ab6c0853243859743f76

Request headers

Referer: https://westin.marriott.com/wp-content/themes/westin/assets/css/style.css
Origin: https://westin.marriott.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Tue, 08 Feb 2022 22:43:35 GMT
last-modified: Fri, 29 Oct 2021 19:38:54 GMT
server: nginx
etag: "617c4dce-1270"
vary: Accept-Encoding
content-type: application/octet-stream
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
content-length: 4720

GET
H2 200 proxima-nova-semibold.ttf
cache.marriott.com/aka-fonts/MarriottDigital/ 148 KB
149 KB 51ms
26ms Font
font/ttf 104.90.137.54
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://cache.marriott.com/aka-fonts/MarriottDigital/proxima-nova-semibold.ttf
Requested by: Host: westin.marriott.com
URL: https://westin.marriott.com/wp-content/themes/westin/assets/css/style.css
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 104.90.137.54 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-90-137-54.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: a9c0dcdf28cab864d690d109eaeb218db07a75ace0da74dd8fb740a7e4a21941

Request headers

Referer: https://westin.marriott.com/
Origin: https://westin.marriott.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Tue, 08 Feb 2022 22:43:35 GMT
last-modified: Wed, 18 Apr 2018 19:17:53 GMT
server: AkamaiNetStorage
etag: "2c1b6eb8de9b37165e55d1e881e32e0c:1524079073"
content-type: font/ttf
access-control-allow-origin: *
cache-control: max-age=535512
accept-ranges: bytes
content-length: 151700
expires: Tue, 15 Feb 2022 03:28:47 GMT

GET
H2 200 brand-logo-icons.ttf
westin.marriott.com/wp-content/themes/marriott-master/assets/fonts/brand-logo/ 68 KB
68 KB 215ms
214ms Font
application/octet-stream 35.231.127.158
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://westin.marriott.com/wp-content/themes/marriott-master/assets/fonts/brand-logo/brand-logo-icons.ttf?zncz48
Requested by: Host: westin.marriott.com
URL: https://westin.marriott.com/wp-content/themes/westin/assets/css/style.css
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 35.231.127.158 North Charleston, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 158.127.231.35.bc.googleusercontent.com
Software: nginx /
Resource Hash: 2562fce72ca9349a2054c884e6df27a815d178da20e29dbe2c530728d074634b

Request headers

Referer: https://westin.marriott.com/wp-content/themes/westin/assets/css/style.css
Origin: https://westin.marriott.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Tue, 08 Feb 2022 22:43:35 GMT
last-modified: Fri, 29 Oct 2021 19:38:54 GMT
server: nginx
etag: "617c4dce-10e00"
vary: Accept-Encoding
content-type: application/octet-stream
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
content-length: 69120

GET
H2 200 proxima-nova-regular.ttf
cache.marriott.com/aka-fonts/MarriottDigital/ 245 KB
246 KB 87ms
62ms Font
font/ttf 104.90.137.54
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://cache.marriott.com/aka-fonts/MarriottDigital/proxima-nova-regular.ttf
Requested by: Host: westin.marriott.com
URL: https://westin.marriott.com/wp-content/themes/westin/assets/css/style.css
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 104.90.137.54 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-90-137-54.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: ef582da6c2d45e3f85044f2f55be1c10d264ac64d42aba9cd1a53d953fd2e6e2

Request headers

Referer: https://westin.marriott.com/
Origin: https://westin.marriott.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Tue, 08 Feb 2022 22:43:35 GMT
last-modified: Wed, 18 Apr 2018 19:18:06 GMT
server: AkamaiNetStorage
etag: "97aa0d1ca1953805f0b7731601370941:1524079086"
content-type: font/ttf
access-control-allow-origin: *
cache-control: max-age=1751703
accept-ranges: bytes
content-length: 251264
expires: Tue, 01 Mar 2022 05:18:38 GMT

GET
H2 200 FreigDisProMed.ttf
cache.marriott.com/aka-fonts/Westin/ 135 KB
136 KB 112ms
88ms Font
font/ttf 104.90.137.54
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://cache.marriott.com/aka-fonts/Westin/FreigDisProMed.ttf
Requested by: Host: westin.marriott.com
URL: https://westin.marriott.com/wp-content/themes/westin/assets/css/style.css
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 104.90.137.54 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-90-137-54.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 98ad55060920689641d662e5bc8f49a96b7ca2b4e890ff85313945ba3e6a06ba

Request headers

Referer: https://westin.marriott.com/
Origin: https://westin.marriott.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Tue, 08 Feb 2022 22:43:35 GMT
last-modified: Fri, 02 Feb 2018 20:58:19 GMT
server: AkamaiNetStorage
etag: "1a1f1c5de52701b517e840e4b0330017:1517605099"
content-type: font/ttf
access-control-allow-origin: *
cache-control: max-age=394938
accept-ranges: bytes
content-length: 138720
expires: Sun, 13 Feb 2022 12:25:53 GMT

GET
H2 200 proxima-nova-medium.ttf
westin.marriott.com/wp-content/themes/marriott-master/assets/fonts/ 245 KB
245 KB 214ms
214ms Font
application/octet-stream 35.231.127.158
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://westin.marriott.com/wp-content/themes/marriott-master/assets/fonts/proxima-nova-medium.ttf?gf1av5
Requested by: Host: westin.marriott.com
URL: https://westin.marriott.com/wp-content/themes/westin/assets/css/style.css
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 35.231.127.158 North Charleston, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 158.127.231.35.bc.googleusercontent.com
Software: nginx /
Resource Hash: 4f63ea126d19024e46e30675c3d769d2ce937474352e06b1364e7e5e0809223e

Request headers

Referer: https://westin.marriott.com/wp-content/themes/westin/assets/css/style.css
Origin: https://westin.marriott.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Tue, 08 Feb 2022 22:43:35 GMT
last-modified: Fri, 29 Oct 2021 19:38:54 GMT
server: nginx
etag: "617c4dce-3d270"
vary: Accept-Encoding
content-type: application/octet-stream
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
content-length: 250480

GET
H2 200 proxima-nova-bold.ttf
cache.marriott.com/aka-fonts/MarriottDigital/ 252 KB
252 KB 113ms
89ms Font
font/ttf 104.90.137.54
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://cache.marriott.com/aka-fonts/MarriottDigital/proxima-nova-bold.ttf
Requested by: Host: westin.marriott.com
URL: https://westin.marriott.com/wp-content/themes/westin/assets/css/style.css
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 104.90.137.54 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-90-137-54.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 596abbd37cc93e22661c95eecf5026ca0184421a0be193f6c7b18620e1a890ba

Request headers

Referer: https://westin.marriott.com/
Origin: https://westin.marriott.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Tue, 08 Feb 2022 22:43:35 GMT
last-modified: Wed, 18 Apr 2018 19:18:22 GMT
server: AkamaiNetStorage
etag: "35c0a35ab1e12d401c942591eeff5dfb:1524079102"
content-type: font/ttf
access-control-allow-origin: *
cache-control: max-age=1386224
accept-ranges: bytes
content-length: 257636
expires: Thu, 24 Feb 2022 23:47:19 GMT

GET
H2 200 Marriott-Brands.ttf
westin.marriott.com/wp-content/themes/marriott-master/assets/fonts/ 69 KB
70 KB 185ms
185ms Font
application/octet-stream 35.231.127.158
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://westin.marriott.com/wp-content/themes/marriott-master/assets/fonts/Marriott-Brands.ttf?zncz48
Requested by: Host: westin.marriott.com
URL: https://westin.marriott.com/wp-content/themes/westin/assets/css/style.css
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 35.231.127.158 North Charleston, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 158.127.231.35.bc.googleusercontent.com
Software: nginx /
Resource Hash: 5cbf6d5c1d4e0b99ae3e6e754a2f8eaae1f05311d0a347bc04722435722407be

Request headers

Referer: https://westin.marriott.com/wp-content/themes/westin/assets/css/style.css
Origin: https://westin.marriott.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Tue, 08 Feb 2022 22:43:35 GMT
last-modified: Fri, 29 Oct 2021 19:38:54 GMT
server: nginx
etag: "617c4dce-11578"
vary: Accept-Encoding
content-type: application/octet-stream
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
content-length: 71032

GET
DATA 200
OK truncated
/ 177 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: d692a67352a3dfa80010c86a62761cfff05c0b1086618106a8576cc45a6a8115

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 351 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 145287b36883dd3061ca7aa9229a8fa9ace2cccd50e0382b4b6201f3916b57c5

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 242 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 1f4513a435d6a3047d20a50c1e7d4263de42146c74be227f774b5e82e6357e75

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
H3 200 gen_204 Show response
maps.googleapis.com/maps/api/mapsjs/ 3 B
45 B 31ms
15ms XHR
application/json 2a00:1450:4001:80e::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://maps.googleapis.com/maps/api/mapsjs/gen_204?csp_test=true

Requested by

Host: maps.googleapis.com
URL: https://maps.googleapis.com/maps/api/js?v=3&client=gme-marriottinternational&channel=aloft&callback=window.app.map

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

scaffolding on HTTPServer2 /

Resource Hash

ca3d163bab055381827226140568f3bef7eaac187cebd76878e0b63e9e442356

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://westin.marriott.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Tue, 08 Feb 2022 22:43:35 GMT
content-encoding: gzip
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
server: scaffolding on HTTPServer2
x-frame-options: SAMEORIGIN
content-type: application/json; charset=UTF-8
access-control-allow-origin: https://westin.marriott.com
access-control-expose-headers: vary,vary,vary,content-encoding,date,server,content-length
cache-control: private
vary: Origin, X-Origin, Referer
content-length: 23
x-xss-protection: 0

GET
H/1.1 200
OK id Show response
dpm.demdex.net/ 5 KB
2 KB 125ms
33ms XHR
application/json 52.16.52.14
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://dpm.demdex.net/id?d_visid_ver=4.3.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_orgid=664516D751E565010A490D4C%40AdobeOrg&d_nsid=0&ts=1644360214702

Requested by

Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN3963523be4674e5591a9c4d516697352.min.js?ver=1.0.0

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.16.52.14 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-52-16-52-14.eu-west-1.compute.amazonaws.com

Software

Resource Hash

194bc8476f1960306d8c6e224ac8fd3d6762f56c24094f1c04fe9603dbbff72b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://westin.marriott.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

DCS: dcs-prod-irl1-2-v027-0e1375e85.edge-irl1.demdex.com UNKNOWN
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
content-encoding: gzip
X-TID: MwUVxVDLTSI=
Vary: Origin
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Access-Control-Allow-Origin: https://westin.marriott.com
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/json;charset=utf-8
Content-Length: 1692
Expires: Thu, 01 Jan 1970 00:00:00 UTC

GET
H2 200 AppMeasurement.min.js Show response
assets.adobedtm.com/extensions/EP971e6ad26efe44ab86e98d3905a44621/ 34 KB
13 KB 11ms
10ms Script
application/x-javascript 2a02:26f0:6c00:299::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/extensions/EP971e6ad26efe44ab86e98d3905a44621/AppMeasurement.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN3963523be4674e5591a9c4d516697352.min.js?ver=1.0.0
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:6c00:299::1e80 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: 089030d8bec22aa48ae59e27516a4e8a1fcec666e9d783c7a1df47220b750dc1

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://westin.marriott.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Tue, 08 Feb 2022 22:43:35 GMT
content-encoding: gzip
last-modified: Mon, 03 Jun 2019 23:03:32 GMT
server: AkamaiNetStorage
etag: "72404253c27255247028f0ba11022cf8:1559603012"
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: https://westin.marriott.com
cache-control: no-cache
accept-ranges: bytes
timing-allow-origin: *
content-length: 12916
expires: Tue, 08 Feb 2022 23:43:35 GMT

GET
H2 200 outpace_marriott_combined.min.js Show response
d1mqz30n8nowyf.cloudfront.net/prod/js/ 31 KB
6 KB 25ms
7ms Script
application/javascript 2600:9000:2156:c200:1d:cb70:f5c0:21
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://d1mqz30n8nowyf.cloudfront.net/prod/js/outpace_marriott_combined.min.js
Requested by: Host: westin.marriott.com
URL: https://westin.marriott.com/?enrollmentSourceCode=EMEA&nck=125622969&ck=49864193&lk=1000535890
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2156:c200:1d:cb70:f5c0:21 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 1c38b38210051706981fb9dba449dfeb4fa1095d6fef33ebb593e55ee3798383

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://westin.marriott.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Tue, 08 Feb 2022 06:22:24 GMT
content-encoding: gzip
last-modified: Wed, 16 Jan 2019 20:49:35 GMT
server: AmazonS3
age: 58872
etag: W/"72fa32db69f86bb2492c06892ac65b51"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
via: 1.1 1b73451818d2dd47a574604c0b84f692.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA50-C1
x-amz-cf-id: J8z99eM0Sd0K_WhtBwbgT-2EqmMY4kJl5mLpeJ5Ide4OqFS3ULQImA==

GET
H2 200 p-3b679bac.system.js Show response
pacsys.marriott.com/2.3.1.7/build/ 43 KB
8 KB 99ms
99ms Script
application/javascript 52.204.27.57
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://pacsys.marriott.com/2.3.1.7/build/p-3b679bac.system.js
Requested by: Host: pacsys.marriott.com
URL: https://pacsys.marriott.com/2.3.1.7/build/pacsys.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 52.204.27.57 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-204-27-57.compute-1.amazonaws.com
Software: nginx /
Resource Hash: af29913f23e3b841ea8ffb1aeac8a255b983973798e89532cc97bea88ac3690c

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://westin.marriott.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Tue, 08 Feb 2022 22:43:35 GMT
content-encoding: br
last-modified: Fri, 14 Jan 2022 20:44:33 GMT
server: nginx
etag: W/"61e1e0b1-ad17"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 RCc01982085bae48b28365b748d7e193b1-source.min.js Show response
assets.adobedtm.com/697d0c070f1e/d405339bb010/2c7a2906f149/ 573 B
605 B 13ms
13ms Script
application/x-javascript 2a02:26f0:6c00:299::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/697d0c070f1e/d405339bb010/2c7a2906f149/RCc01982085bae48b28365b748d7e193b1-source.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN3963523be4674e5591a9c4d516697352.min.js?ver=1.0.0
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:6c00:299::1e80 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: a1762e05ade8f8949d10bf16bc876ac2a1b93e0fd740148e6cf0a3c56123f51b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://westin.marriott.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Tue, 08 Feb 2022 22:43:35 GMT
content-encoding: gzip
last-modified: Wed, 26 Jan 2022 21:46:48 GMT
server: AkamaiNetStorage
etag: "7184d57b82edb357db76e03b5d05ba89:1643233608.176218"
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: https://westin.marriott.com
cache-control: max-age=3600
accept-ranges: bytes
timing-allow-origin: *
content-length: 337
expires: Tue, 08 Feb 2022 23:43:35 GMT

GET
H2 200 RC4d4b95a5eb9344d7b896569435bae087-source.min.js Show response
assets.adobedtm.com/697d0c070f1e/d405339bb010/2c7a2906f149/ 1 KB
860 B 20ms
20ms Script
application/x-javascript 2a02:26f0:6c00:299::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/697d0c070f1e/d405339bb010/2c7a2906f149/RC4d4b95a5eb9344d7b896569435bae087-source.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN3963523be4674e5591a9c4d516697352.min.js?ver=1.0.0
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:6c00:299::1e80 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: 34da945b5b801cb722079acb407a70879e81df72d1400b5a47f9b79f2b9b94d0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://westin.marriott.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Tue, 08 Feb 2022 22:43:35 GMT
content-encoding: gzip
last-modified: Wed, 26 Jan 2022 21:46:48 GMT
server: AkamaiNetStorage
etag: "7184d57b82edb357db76e03b5d05ba89:1643233608.176218"
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: https://westin.marriott.com
cache-control: max-age=3600
accept-ranges: bytes
timing-allow-origin: *
content-length: 592
expires: Tue, 08 Feb 2022 23:43:35 GMT

GET
H2 200 RC63f038db5a1f450dbe1a528f90ec4bd7-source.min.js Show response
assets.adobedtm.com/697d0c070f1e/d405339bb010/2c7a2906f149/ 357 B
494 B 21ms
21ms Script
application/x-javascript 2a02:26f0:6c00:299::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/697d0c070f1e/d405339bb010/2c7a2906f149/RC63f038db5a1f450dbe1a528f90ec4bd7-source.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN3963523be4674e5591a9c4d516697352.min.js?ver=1.0.0
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:6c00:299::1e80 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: 3e9110002eaa7f5c26cccac93aa7d82498c827133450802264a33dabe071b924

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://westin.marriott.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Tue, 08 Feb 2022 22:43:35 GMT
content-encoding: gzip
last-modified: Wed, 26 Jan 2022 21:46:48 GMT
server: AkamaiNetStorage
etag: "7184d57b82edb357db76e03b5d05ba89:1643233608.176218"
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: https://westin.marriott.com
cache-control: max-age=3600
accept-ranges: bytes
timing-allow-origin: *
content-length: 227
expires: Tue, 08 Feb 2022 23:43:35 GMT

GET
H/1.1 200
OK dest5.html Show response
marriottinternationa.demdex.net/ Frame ED2A 7 KB
3 KB 125ms
30ms Document
text/html 34.253.74.200
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://marriottinternationa.demdex.net/dest5.html?d_nsid=0

Requested by

Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN3963523be4674e5591a9c4d516697352.min.js?ver=1.0.0

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

34.253.74.200 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-34-253-74-200.eu-west-1.compute.amazonaws.com

Software

Resource Hash

7bea17a80a61ed0f54248b4ffc4c718f7c8ff2619742577a73591d62ce074da8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: de-DE,de;q=0.9
Referer: https://westin.marriott.com/

Response headers

Accept-Ranges: bytes
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
content-encoding: gzip
Content-Type: text/html;charset=UTF-8
date: Tue, 8 Feb 2022 22:43:35 GMT
DCS: dcs-prod-irl1-1-v027-0612854b5.edge-irl1.demdex.com UNKNOWN
Expires: Thu, 01 Jan 1970 00:00:00 UTC
last-modified: Wed, 19 Jan 2022 13:28:57 GMT
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
vary: accept-encoding
X-TID: Rir4+hhVSdk=
Content-Length: 2791
Connection: keep-alive

GET
H/1.1

200
OK

ibs:dpid=411&dpuuid=YgLyFwAAABjWzwQA
dpm.demdex.net/
Redirect Chain

https://cm.everesttech.net/cm/dd?d_uuid=37733966549853964593912821959180323522
https://dpm.demdex.net/ibs:dpid=411&dpuuid=YgLyFwAAABjWzwQA

42 B
943 B

35ms
35ms

Image
image/gif

52.16.52.14
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dpm.demdex.net/ibs:dpid=411&dpuuid=YgLyFwAAABjWzwQA

Requested by

Host: westin.marriott.com
URL: https://westin.marriott.com/?enrollmentSourceCode=EMEA&nck=125622969&ck=49864193&lk=1000535890

Protocol

HTTP/1.1

Server

52.16.52.14 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-52-16-52-14.eu-west-1.compute.amazonaws.com

Software

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://westin.marriott.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

DCS: dcs-prod-irl1-1-v027-05c52038e.edge-irl1.demdex.com UNKNOWN
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
content-encoding: gzip
X-Content-Type-Options: nosniff
X-TID: bUyfZX9xThM=
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection: keep-alive
Content-Type: image/gif
Content-Length: 59
Expires: Thu, 01 Jan 1970 00:00:00 UTC

Redirect headers

Location: https://dpm.demdex.net/ibs:dpid=411&dpuuid=YgLyFwAAABjWzwQA
Date: Tue, 08 Feb 2022 22:43:35 GMT
Cache-Control: no-cache
Server: AMO-cookiemap/1.1
Connection: keep-alive
Content-Length: 0
P3P: CP="NOI NID DEVa PSAa PSDa OUR IND PUR COM NAV INT DEM"

GET
H2 200 otSDKStub.js Show response
cache.marriott.com/aka-fonts/OneTrust/oneTrust_test/scripttemplates/ 19 KB
6 KB 43ms
21ms Script
application/x-javascript 104.90.137.54
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://cache.marriott.com/aka-fonts/OneTrust/oneTrust_test/scripttemplates/otSDKStub.js?565603160156589.1
Requested by: Host: westin.marriott.com
URL: https://westin.marriott.com/?enrollmentSourceCode=EMEA&nck=125622969&ck=49864193&lk=1000535890
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 104.90.137.54 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-90-137-54.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 134482ec36c8980c2c7a3f2454c76546abcd612c9ae596d011251a7cd1d0fcbb

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://westin.marriott.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Tue, 08 Feb 2022 22:43:35 GMT
content-encoding: gzip
last-modified: Tue, 18 Jan 2022 20:49:57 GMT
server: AkamaiNetStorage
etag: "abf5de4f5f947c8dde09257004988915:1642538997.409299"
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: max-age=842827
accept-ranges: bytes
content-length: 6412
expires: Fri, 18 Feb 2022 16:50:42 GMT

GET
H2 200 btt.js Show response
marriott.btttag.com/ 95 KB
23 KB 105ms
45ms Script
application/javascript 2606:4700:10::6816:3a80
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://marriott.btttag.com/btt.js

Requested by

Host: westin.marriott.com
URL: https://westin.marriott.com/?enrollmentSourceCode=EMEA&nck=125622969&ck=49864193&lk=1000535890

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:10::6816:3a80 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

7a89d721956fe1c879183f26dae3408ef9e0a341c02fd991bda50d5d34af3893

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://westin.marriott.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Tue, 08 Feb 2022 22:43:35 GMT
content-encoding: gzip
cf-cache-status: HIT
age: 13611
cf-ray: 6da860b52f8859a1-MXP
content-length: 23660
x-xss-protection: 1; mode=block
last-modified: Tue, 08 Feb 2022 18:56:44 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=43200
accept-ranges: bytes
timing-allow-origin: *

GET
H2 200 p-c3e1ef1d.system.js Show response
pacsys.marriott.com/2.3.1.7/build/ 21 KB
8 KB 104ms
104ms Script
application/javascript 52.204.27.57
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://pacsys.marriott.com/2.3.1.7/build/p-c3e1ef1d.system.js
Requested by: Host: pacsys.marriott.com
URL: https://pacsys.marriott.com/2.3.1.7/build/pacsys.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 52.204.27.57 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-204-27-57.compute-1.amazonaws.com
Software: nginx /
Resource Hash: dc5f4327fce6aafa25a07d5b20a0d72a5fed1842209b16fa22326f2e42b9165e

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://westin.marriott.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Tue, 08 Feb 2022 22:43:35 GMT
content-encoding: br
last-modified: Fri, 14 Jan 2022 20:44:35 GMT
server: nginx
etag: W/"61e1e0b3-55cd"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 AppMeasurement_Module_AudienceManagement.min.js Show response
assets.adobedtm.com/extensions/EP971e6ad26efe44ab86e98d3905a44621/ 25 KB
9 KB 10ms
9ms Script
application/x-javascript 2a02:26f0:6c00:299::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/extensions/EP971e6ad26efe44ab86e98d3905a44621/AppMeasurement_Module_AudienceManagement.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN3963523be4674e5591a9c4d516697352.min.js?ver=1.0.0
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:6c00:299::1e80 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: 32bc033e13e02d8809b2c8c97ac5a5110c5f375a830ed6cace5ce1202ab5b480

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://westin.marriott.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Tue, 08 Feb 2022 22:43:35 GMT
content-encoding: gzip
last-modified: Mon, 03 Jun 2019 23:03:35 GMT
server: AkamaiNetStorage
etag: "e539ea6425ae55fa9f68995bc5a68886:1559603018"
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: https://westin.marriott.com
cache-control: no-cache
accept-ranges: bytes
timing-allow-origin: *
content-length: 8640
expires: Tue, 08 Feb 2022 23:43:35 GMT

GET
H2 200 brand_com_westin_homepage Show response
targeting-azalea.outpace.com/api/v1/public/target/ 122 B
437 B 521ms
177ms XHR
application/json 54.188.211.236
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://targeting-azalea.outpace.com/api/v1/public/target/brand_com_westin_homepage?user_id=&cookie_id=&authenticate_state=&locales=en_US&cb=1644360215036&enrollmentSourceCode=EMEA&nck=125622969&ck=49864193&lk=1000535890

Requested by

Host: d1mqz30n8nowyf.cloudfront.net
URL: https://d1mqz30n8nowyf.cloudfront.net/prod/js/outpace_marriott_combined.min.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.188.211.236 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-54-188-211-236.us-west-2.compute.amazonaws.com

Software

Jetty(9.2.z-SNAPSHOT) /

Resource Hash

40a32e7d4dd802a21854e518db9346bdf2d5678a66b07540a9caa8c7274aaa7e

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'none'
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://westin.marriott.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Tue, 08 Feb 2022 22:43:36 GMT
referrer-policy: same-origin
server: Jetty(9.2.z-SNAPSHOT)
x-frame-options: DENY
access-control-allow-methods: DELETE, GET, POST, PUT
content-type: application/json; charset=utf-8
access-control-allow-origin: https://westin.marriott.com
access-control-allow-credentials: true
content-security-policy: frame-ancestors 'none'
x-content-type-options: nosniff

GET
H2 200 b9c54897-9a69-45f1-bbe2-55b2ae0ba593-test.json Show response
cache.marriott.com/aka-fonts/OneTrust/oneTrust_test/consent/b9c54897-9a69-45f1-bbe2-55b2ae0ba593-test/ 4 KB
5 KB 41ms
41ms XHR
application/json 104.90.137.54
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://cache.marriott.com/aka-fonts/OneTrust/oneTrust_test/consent/b9c54897-9a69-45f1-bbe2-55b2ae0ba593-test/b9c54897-9a69-45f1-bbe2-55b2ae0ba593-test.json
Requested by: Host: cache.marriott.com
URL: https://cache.marriott.com/aka-fonts/OneTrust/oneTrust_test/scripttemplates/otSDKStub.js?565603160156589.1
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 104.90.137.54 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-90-137-54.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: f77bbe3cfcec8a1f3af6921b8bffdf93b978e73dc752521aa70a8e38173287d0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://westin.marriott.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Tue, 08 Feb 2022 22:43:35 GMT
last-modified: Tue, 18 Jan 2022 20:31:19 GMT
server: AkamaiNetStorage
etag: "f0d248fca3c0b077b3ee54a6f8d33358:1642537879.736947"
content-type: application/json
access-control-allow-origin: *
cache-control: max-age=77814
accept-ranges: bytes
content-length: 3735
expires: Wed, 09 Feb 2022 20:20:29 GMT

GET
H2 200 location Show response
geolocation.onetrust.com/cookieconsentpub/v1/geo/ 182 B
457 B 94ms
50ms XHR
application/json 2606:4700:10::6814:b944
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://geolocation.onetrust.com/cookieconsentpub/v1/geo/location

Requested by

Host: cache.marriott.com
URL: https://cache.marriott.com/aka-fonts/OneTrust/oneTrust_test/scripttemplates/otSDKStub.js?565603160156589.1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:10::6814:b944 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

fd9308db31181fde13aca740757dcb439baf71d731011a87da483a28faae444f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

accept: application/json
Referer: https://westin.marriott.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Tue, 08 Feb 2022 22:43:35 GMT
content-encoding: gzip
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
access-control-allow-methods: GET, OPTIONS
content-type: application/json
access-control-allow-origin: *
strict-transport-security: max-age=31536000; includeSubDomains; preload
cf-ray: 6da860b5ba0e599b-MXP
access-control-allow-headers: Content-Type

GET
H2 200 p-zkkbqibb.system.entry.js Show response
pacsys.marriott.com/2.3.1.7/build/ 25 KB
5 KB 100ms
100ms Script
application/javascript 52.204.27.57
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://pacsys.marriott.com/2.3.1.7/build/p-zkkbqibb.system.entry.js
Requested by: Host: pacsys.marriott.com
URL: https://pacsys.marriott.com/2.3.1.7/build/pacsys.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 52.204.27.57 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-204-27-57.compute-1.amazonaws.com
Software: nginx /
Resource Hash: 773e588befe6e57881b27cef50f5df97ed69d00da161fc756e5385b303e5174a

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://westin.marriott.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Tue, 08 Feb 2022 22:43:35 GMT
content-encoding: br
last-modified: Fri, 14 Jan 2022 20:44:43 GMT
server: nginx
etag: W/"61e1e0bb-6219"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 s5315426183189 Show response
smetrics.marriott.com/b/ss/marriottglobal/10/JS-2.14.0-LBWB/ 6 KB
6 KB 75ms
41ms Script
application/x-javascript 13.36.218.177
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://smetrics.marriott.com/b/ss/marriottglobal/10/JS-2.14.0-LBWB/s5315426183189?AQB=1&ndh=1&pf=1&callback=s_c_il[1].doPostbacks&et=1&t=8%2F1%2F2022%2022%3A43%3A35%202%200&d.&nsid=0&jsonv=1&.d&mid=37636904948071174423903422430063477931&aamlh=6&ce=UTF-8&pageName=westin.marriott.com%2F&g=https%3A%2F%2Fwestin.marriott.com%2F%3FenrollmentSourceCode%3DEMEA%26nck%3D125622969%26ck%3D49864193%26lk%3D1000535890&cc=USD&v0=ck%3D49864193%3Bnck%3D125622969%3Blk%3D1000535890&aamb=6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y&v0=ck%3D49864193%3Bnck%3D125622969%3Blk%3D1000535890&c5=WI&c8=D%3Dv15&v15=Weekday%20%3A%20Tuesday%20%3A%205%3A30PM&c26=Launch&v41=WI&c71=Off-Platform%20Basic&v192=westin.marriott.com%2F&v207=%3FenrollmentSourceCode%3DEMEA%26nck%3D125622969%26ck%3D49864193%26lk%3D1000535890&s=1600x1200&c=24&j=1.6&v=N&k=Y&bw=1600&bh=1200&mcorgid=664516D751E565010A490D4C%40AdobeOrg&AQE=1

Requested by

Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/extensions/EP971e6ad26efe44ab86e98d3905a44621/AppMeasurement.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.36.218.177 Paris, France, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-13-36-218-177.eu-west-3.compute.amazonaws.com

Software

jag /

Resource Hash

82b8188e2bfc560a293bba7cd5504cedeb6a9c1b3776ca874e4976a74cafb834

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://westin.marriott.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

x-aam-tid: tAu1MhJERHc=
date: Tue, 08 Feb 2022 22:43:36 GMT
x-content-type-options: nosniff
x-c: main-1585.I7afc85.M0-540
p3p: CP="This is not a P3P policy"
vary: *
content-length: 5919
x-xss-protection: 1; mode=block
dcs: dcs-prod-irl1-1-v027-07b513162.edge-irl1.demdex.com UNKNOWN
pragma: no-cache
last-modified: Wed, 09 Feb 2022 22:43:36 GMT
server: jag
xserver: anedge-cdfbd77b-scv62
etag: 3531236676964745216-4619390959122495125
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/x-javascript;charset=utf-8
access-control-allow-origin: *
cache-control: no-cache, no-store, max-age=0, no-transform, private
expires: Mon, 07 Feb 2022 22:43:36 GMT

GET
H2 200 otBannerSdk.js Show response
cache.marriott.com/aka-fonts/OneTrust/oneTrust_test/scripttemplates/6.25.0/ 318 KB
76 KB 33ms
33ms Script
application/x-javascript 104.90.137.54
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://cache.marriott.com/aka-fonts/OneTrust/oneTrust_test/scripttemplates/6.25.0/otBannerSdk.js
Requested by: Host: cache.marriott.com
URL: https://cache.marriott.com/aka-fonts/OneTrust/oneTrust_test/scripttemplates/otSDKStub.js?565603160156589.1
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 104.90.137.54 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-90-137-54.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: fe035b6ff2394b9fc9b4dad0acc9050d633269a5efa7cfeac7e6b8fdc12b7065

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://westin.marriott.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Tue, 08 Feb 2022 22:43:36 GMT
content-encoding: gzip
last-modified: Tue, 18 Jan 2022 20:50:24 GMT
server: AkamaiNetStorage
etag: "e9f593c66ca9094327755aefb67fc0e1:1642539024.409236"
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: *
cache-control: max-age=842937
accept-ranges: bytes
expires: Fri, 18 Feb 2022 16:52:33 GMT

GET
H/1.1

200
OK

ibs:dpid=358&dpuuid=7193456728733431786
dpm.demdex.net/ Frame ED2A
Redirect Chain

https://ib.adnxs.com/getuid?https%3A%2F%2Fdpm.demdex.net%2Fibs%3Adpid%3D358%26dpuuid%3D%24UID
https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%253A%252F%252Fdpm.demdex.net%252Fibs%253Adpid%253D358%2526dpuuid%253D%2524UID
https://dpm.demdex.net/ibs:dpid=358&dpuuid=7193456728733431786

42 B
943 B

33ms
33ms

Image
image/gif

52.16.52.14
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dpm.demdex.net/ibs:dpid=358&dpuuid=7193456728733431786

Requested by

Host: westin.marriott.com
URL: https://westin.marriott.com/?enrollmentSourceCode=EMEA&nck=125622969&ck=49864193&lk=1000535890

Protocol

HTTP/1.1

Server

52.16.52.14 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-52-16-52-14.eu-west-1.compute.amazonaws.com

Software

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://marriottinternationa.demdex.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

DCS: dcs-prod-irl1-2-v027-06e9fe3ab.edge-irl1.demdex.com UNKNOWN
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
content-encoding: gzip
X-Content-Type-Options: nosniff
X-TID: o3wTcnH9ROM=
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection: keep-alive
Content-Type: image/gif
Content-Length: 59
Expires: Thu, 01 Jan 1970 00:00:00 UTC

Redirect headers

Pragma: no-cache
Date: Tue, 08 Feb 2022 22:43:36 GMT
X-Proxy-Origin: 193.27.14.24; 193.27.14.24; 693.bm-nginx-loadbalancer.mgmt.fra1; adnxs.com
AN-X-Request-Uuid: bc89da23-afe2-42fe-97c0-37d89db1ce67
Server: nginx/1.17.9
Access-Control-Allow-Origin: *
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://dpm.demdex.net/ibs:dpid=358&dpuuid=7193456728733431786
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2 200 ProximaNovaSemibold.otf
pacsys.marriott.com/2.3.1.7/static/fonts/ 64 KB
65 KB 387ms
193ms Font
application/octet-stream 52.204.27.57
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://pacsys.marriott.com/2.3.1.7/static/fonts/ProximaNovaSemibold.otf
Requested by: Host: pacsys.marriott.com
URL: https://pacsys.marriott.com/2.3.1.7/build/pacsys.css
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 52.204.27.57 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-204-27-57.compute-1.amazonaws.com
Software: nginx /
Resource Hash: ce1de064118c40ce7ab3617f3fe6c8e959f63a624a564e36b91b4c85163eb500

Request headers

Referer: https://pacsys.marriott.com/2.3.1.7/build/pacsys.css
Origin: https://westin.marriott.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Tue, 08 Feb 2022 22:43:36 GMT
last-modified: Fri, 14 Jan 2022 20:44:49 GMT
server: nginx
etag: "61e1e0c1-10118"
vary: Accept-Encoding
content-type: application/octet-stream
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
content-length: 65816

GET
H2 200 portfolio-logo-icons.ttf
pacsys.marriott.com/2.3.1.7/static/fonts/portfolio-logo-icons/ 56 KB
56 KB 487ms
292ms Font
application/octet-stream 52.204.27.57
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://pacsys.marriott.com/2.3.1.7/static/fonts/portfolio-logo-icons/portfolio-logo-icons.ttf?65xkc1
Requested by: Host: pacsys.marriott.com
URL: https://pacsys.marriott.com/2.3.1.7/build/pacsys.css
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 52.204.27.57 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-204-27-57.compute-1.amazonaws.com
Software: nginx /
Resource Hash: 9c87a00efc0ddeb20c2fe8c49fe14caa552edf1a4924e170967237d0db8d1e48

Request headers

Referer: https://pacsys.marriott.com/2.3.1.7/build/pacsys.css
Origin: https://westin.marriott.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Tue, 08 Feb 2022 22:43:36 GMT
last-modified: Fri, 14 Jan 2022 20:44:48 GMT
server: nginx
etag: "61e1e0c0-e040"
vary: Accept-Encoding
content-type: application/octet-stream
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
content-length: 57408

GET
H2

200

/
www.google.de/pagead/1p-user-list/924374711/ Frame ED2A
Redirect Chain

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/924374711/?value=1.00&currency_code=USD&label=dtPPCMa8hZcBELet47gD&guid=ON&script=0
https://www.google.com/pagead/1p-user-list/924374711/?value=1.00&currency_code=USD&label=dtPPCMa8hZcBELet47gD&guid=ON&script=0&is_vtc=1&random=2329703762
https://www.google.de/pagead/1p-user-list/924374711/?value=1.00&currency_code=USD&label=dtPPCMa8hZcBELet47gD&guid=ON&script=0&is_vtc=1&random=2329703762&ipr=y

42 B
548 B

42ms
17ms

Image
image/gif

2a00:1450:4001:80e::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/924374711/?value=1.00&currency_code=USD&label=dtPPCMa8hZcBELet47gD&guid=ON&script=0&is_vtc=1&random=2329703762&ipr=y

Requested by

Host: westin.marriott.com
URL: https://westin.marriott.com/?enrollmentSourceCode=EMEA&nck=125622969&ck=49864193&lk=1000535890

Protocol

Server

2a00:1450:4001:80e::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://marriottinternationa.demdex.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 08 Feb 2022 22:43:36 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Tue, 08 Feb 2022 22:43:36 GMT
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-type: image/gif
location: https://www.google.de/pagead/1p-user-list/924374711/?value=1.00&currency_code=USD&label=dtPPCMa8hZcBELet47gD&guid=ON&script=0&is_vtc=1&random=2329703762&ipr=y
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-security-policy: script-src 'none'; object-src 'none'
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 en-us.json Show response
cache.marriott.com/aka-fonts/OneTrust/oneTrust_test/consent/b9c54897-9a69-45f1-bbe2-55b2ae0ba593-test/674fc3b5-c7a1-4a71-96b6-d7249c8c021f/ 90 KB
91 KB 24ms
23ms Fetch
application/json 104.90.137.54
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://cache.marriott.com/aka-fonts/OneTrust/oneTrust_test/consent/b9c54897-9a69-45f1-bbe2-55b2ae0ba593-test/674fc3b5-c7a1-4a71-96b6-d7249c8c021f/en-us.json
Requested by: Host: marriott.btttag.com
URL: https://marriott.btttag.com/btt.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 104.90.137.54 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-90-137-54.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 949361aabc04491e935da68cb2d89b9104bf60da9beaca3a00209f99276b0849

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://westin.marriott.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Tue, 08 Feb 2022 22:43:36 GMT
last-modified: Tue, 18 Jan 2022 20:40:14 GMT
server: AkamaiNetStorage
etag: "ea91364cd67bd93c77e2fc105853216f:1642538414.99352"
content-type: application/json
access-control-allow-origin: *
cache-control: max-age=162049
accept-ranges: bytes
content-length: 91939
expires: Thu, 10 Feb 2022 19:44:25 GMT

GET
H2 200 365868.gif
idsync.rlcdn.com/ Frame ED2A 42 B
308 B 31ms
15ms Image
image/gif 35.244.174.68
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://idsync.rlcdn.com/365868.gif?partner_uid=37733966549853964593912821959180323522
Requested by: Host: westin.marriott.com
URL: https://westin.marriott.com/?enrollmentSourceCode=EMEA&nck=125622969&ck=49864193&lk=1000535890
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.174.68 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 68.174.244.35.bc.googleusercontent.com
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://marriottinternationa.demdex.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

timing-allow-origin: *
date: Tue, 08 Feb 2022 22:43:36 GMT
via: 1.1 google
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
cache-control: no-cache, no-store
content-type: image/gif
alt-svc: clear
content-length: 42

GET
H2 200 otFloatingRounded.json Show response
cache.marriott.com/aka-fonts/OneTrust/oneTrust_test/scripttemplates/6.25.0/assets/ 10 KB
11 KB 25ms
23ms Fetch
application/json 104.90.137.54
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://cache.marriott.com/aka-fonts/OneTrust/oneTrust_test/scripttemplates/6.25.0/assets/otFloatingRounded.json
Requested by: Host: marriott.btttag.com
URL: https://marriott.btttag.com/btt.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 104.90.137.54 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-90-137-54.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 777ab0cb5c6ffd6b2d455918b8df70fdb4c74ecb18d62f54be1afdaf3733c10d

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://westin.marriott.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Tue, 08 Feb 2022 22:43:36 GMT
last-modified: Tue, 18 Jan 2022 20:52:15 GMT
server: AkamaiNetStorage
etag: "becf963d0b2b5f4544a5ec243252794c:1642539135.754565"
content-type: application/json
access-control-allow-origin: *
cache-control: max-age=78414
accept-ranges: bytes
content-length: 9894
expires: Wed, 09 Feb 2022 20:30:30 GMT

GET
H2 200 otPcTab.json Show response
cache.marriott.com/aka-fonts/OneTrust/oneTrust_test/scripttemplates/6.25.0/assets/v2/ 47 KB
48 KB 39ms
38ms Fetch
application/json 104.90.137.54
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://cache.marriott.com/aka-fonts/OneTrust/oneTrust_test/scripttemplates/6.25.0/assets/v2/otPcTab.json
Requested by: Host: marriott.btttag.com
URL: https://marriott.btttag.com/btt.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 104.90.137.54 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-90-137-54.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 4efca4768dedb757f956b51f3620d1521be4e8f065080515489defc83c2de704

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://westin.marriott.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Tue, 08 Feb 2022 22:43:36 GMT
last-modified: Tue, 18 Jan 2022 20:51:39 GMT
server: AkamaiNetStorage
etag: "398ef3d808c735374c8e1b4d3984d51a:1642539099.753812"
content-type: application/json
access-control-allow-origin: *
cache-control: max-age=96507
accept-ranges: bytes
content-length: 47745
expires: Thu, 10 Feb 2022 01:32:03 GMT

GET
H2 200 otCookieSettingsButton.json Show response
cache.marriott.com/aka-fonts/OneTrust/oneTrust_test/scripttemplates/6.25.0/assets/ 5 KB
6 KB 57ms
56ms Fetch
application/json 104.90.137.54
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://cache.marriott.com/aka-fonts/OneTrust/oneTrust_test/scripttemplates/6.25.0/assets/otCookieSettingsButton.json
Requested by: Host: marriott.btttag.com
URL: https://marriott.btttag.com/btt.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 104.90.137.54 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-90-137-54.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 2c592c34b2e4a372219ac6d33bda6828183ee534a0219d221ece5be22d80e29f

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://westin.marriott.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Tue, 08 Feb 2022 22:43:36 GMT
last-modified: Tue, 18 Jan 2022 20:52:15 GMT
server: AkamaiNetStorage
etag: "b1d328c4f489d129b7f42e25dd246c7f:1642539135.033111"
content-type: application/json
access-control-allow-origin: *
cache-control: max-age=82918
accept-ranges: bytes
content-length: 5094
expires: Wed, 09 Feb 2022 21:45:34 GMT

GET
H2 200 otCommonStyles.css Show response
cache.marriott.com/aka-fonts/OneTrust/oneTrust_test/scripttemplates/6.25.0/assets/ 20 KB
4 KB 73ms
73ms Fetch
text/css 104.90.137.54
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://cache.marriott.com/aka-fonts/OneTrust/oneTrust_test/scripttemplates/6.25.0/assets/otCommonStyles.css
Requested by: Host: marriott.btttag.com
URL: https://marriott.btttag.com/btt.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 104.90.137.54 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-90-137-54.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 2ee6fdf3d0f4d826380054030e5a9fd6fc8c451d9fe28123f1d76e632332e659

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://westin.marriott.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Tue, 08 Feb 2022 22:43:36 GMT
content-encoding: gzip
last-modified: Tue, 18 Jan 2022 20:52:15 GMT
server: AkamaiNetStorage
etag: "61ee8e79970dcae1685a883b098b34d0:1642539135.080735"
vary: Accept-Encoding
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=777583
accept-ranges: bytes
content-length: 4130
expires: Thu, 17 Feb 2022 22:43:19 GMT

GET
H2 200 /
insight.adsrvr.org/track/pxl/ 70 B
463 B 101ms
33ms Image
image/gif 52.223.40.198
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://insight.adsrvr.org/track/pxl/?adv=hbq9bjg&ct=0:1nffnue&fmt=3&td1=22109170&noscript=1
Requested by: Host: westin.marriott.com
URL: https://westin.marriott.com/?enrollmentSourceCode=EMEA&nck=125622969&ck=49864193&lk=1000535890
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.223.40.198 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a6370ebea231e0c9a.awsglobalaccelerator.com
Software: /
Resource Hash: 8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://westin.marriott.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 08 Feb 2022 22:43:36 GMT
cache-control: private,no-cache, must-revalidate
x-aspnet-version: 4.0.30319
content-type: image/gif
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"

GET
H3

200

/
www.google.de/pagead/1p-user-list/389211200/ Frame ED2A
Redirect Chain

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/389211200/?value=1.00&currency_code=USD&label=hCepCJDE-aYCEMDIy7kB&guid=ON&script=0
https://www.google.com/pagead/1p-user-list/389211200/?value=1.00&currency_code=USD&label=hCepCJDE-aYCEMDIy7kB&guid=ON&script=0&is_vtc=1&random=3339180598
https://www.google.de/pagead/1p-user-list/389211200/?value=1.00&currency_code=USD&label=hCepCJDE-aYCEMDIy7kB&guid=ON&script=0&is_vtc=1&random=3339180598&ipr=y

42 B
64 B

35ms
19ms

Image
image/gif

2a00:1450:4001:80e::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/389211200/?value=1.00&currency_code=USD&label=hCepCJDE-aYCEMDIy7kB&guid=ON&script=0&is_vtc=1&random=3339180598&ipr=y

Requested by

Host: westin.marriott.com
URL: https://westin.marriott.com/?enrollmentSourceCode=EMEA&nck=125622969&ck=49864193&lk=1000535890

Protocol

Server

2a00:1450:4001:80e::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://marriottinternationa.demdex.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 08 Feb 2022 22:43:36 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Tue, 08 Feb 2022 22:43:36 GMT
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-type: image/gif
location: https://www.google.de/pagead/1p-user-list/389211200/?value=1.00&currency_code=USD&label=hCepCJDE-aYCEMDIy7kB&guid=ON&script=0&is_vtc=1&random=3339180598&ipr=y
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-security-policy: script-src 'none'; object-src 'none'
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
DATA 200
OK truncated
/ 817 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: db311174b0e3c340727b63c055cfb5b317808e909503e1bda11cc58af444f12b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
H/1.1

200
OK

ibs:dpid=771&dpuuid=CAESENOy7CNQkgN_tnfKj06s0SE&google_cver=1
dpm.demdex.net/ Frame ED2A
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=adobe_dmp&google_cm&gdpr=0&gdpr_consent=&google_hm=Mzc3MzM5NjY1NDk4NTM5NjQ1OTM5MTI4MjE5NTkxODAzMjM1MjI=
https://dpm.demdex.net/ibs:dpid=771&dpuuid=CAESENOy7CNQkgN_tnfKj06s0SE&google_cver=1?gdpr=0&gdpr_consent=

42 B
943 B

33ms
33ms

Image
image/gif

52.16.52.14
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dpm.demdex.net/ibs:dpid=771&dpuuid=CAESENOy7CNQkgN_tnfKj06s0SE&google_cver=1?gdpr=0&gdpr_consent=

Requested by

Host: westin.marriott.com
URL: https://westin.marriott.com/?enrollmentSourceCode=EMEA&nck=125622969&ck=49864193&lk=1000535890

Protocol

HTTP/1.1

Server

52.16.52.14 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-52-16-52-14.eu-west-1.compute.amazonaws.com

Software

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://marriottinternationa.demdex.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

DCS: dcs-prod-irl1-1-v027-0f67ff371.edge-irl1.demdex.com UNKNOWN
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
content-encoding: gzip
X-Content-Type-Options: nosniff
X-TID: YTYCsRCYS+8=
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection: keep-alive
Content-Type: image/gif
Content-Length: 59
Expires: Thu, 01 Jan 1970 00:00:00 UTC

Redirect headers

pragma: no-cache
date: Tue, 08 Feb 2022 22:43:36 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dpm.demdex.net/ibs:dpid=771&dpuuid=CAESENOy7CNQkgN_tnfKj06s0SE&google_cver=1?gdpr=0&gdpr_consent=
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 314
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

ibs:dpid=903&dpuuid=5f8f0f2d-28d7-42c7-8078-aa36b5256d95
dpm.demdex.net/ Frame ED2A
Redirect Chain

https://match.adsrvr.org/track/cmf/generic?ttd_pid=aam&gdpr=0&gdpr_consent=&ttd_tpi=1
https://dpm.demdex.net/ibs:dpid=903&dpuuid=5f8f0f2d-28d7-42c7-8078-aa36b5256d95

42 B
943 B

32ms
32ms

Image
image/gif

52.16.52.14
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dpm.demdex.net/ibs:dpid=903&dpuuid=5f8f0f2d-28d7-42c7-8078-aa36b5256d95

Requested by

Host: westin.marriott.com
URL: https://westin.marriott.com/?enrollmentSourceCode=EMEA&nck=125622969&ck=49864193&lk=1000535890

Protocol

HTTP/1.1

Server

52.16.52.14 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-52-16-52-14.eu-west-1.compute.amazonaws.com

Software

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://marriottinternationa.demdex.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

DCS: dcs-prod-irl1-1-v027-096269d91.edge-irl1.demdex.com UNKNOWN
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
content-encoding: gzip
X-Content-Type-Options: nosniff
X-TID: OzzRZ2mCT0s=
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection: keep-alive
Content-Type: image/gif
Content-Length: 59
Expires: Thu, 01 Jan 1970 00:00:00 UTC

Redirect headers

pragma: no-cache
date: Tue, 08 Feb 2022 22:43:36 GMT
x-aspnet-version: 4.0.30319
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location: https://dpm.demdex.net/ibs:dpid=903&dpuuid=5f8f0f2d-28d7-42c7-8078-aa36b5256d95
cache-control: private,no-cache, must-revalidate
content-type: text/html
content-length: 189

GET
H/1.1

200
OK

ibs:dpid=1957&dpuuid=0BEA078FF513666619F916CAF4C167C8
dpm.demdex.net/ Frame ED2A
Redirect Chain

https://c.bing.com/c.gif?uid=37733966549853964593912821959180323522&Red3=MSAdobe_pd&gdpr=0&gdpr_consent=
https://dpm.demdex.net/ibs:dpid=1957&dpuuid=0BEA078FF513666619F916CAF4C167C8

42 B
943 B

32ms
32ms

Image
image/gif

52.16.52.14
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dpm.demdex.net/ibs:dpid=1957&dpuuid=0BEA078FF513666619F916CAF4C167C8

Requested by

Host: westin.marriott.com
URL: https://westin.marriott.com/?enrollmentSourceCode=EMEA&nck=125622969&ck=49864193&lk=1000535890

Protocol

HTTP/1.1

Server

52.16.52.14 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-52-16-52-14.eu-west-1.compute.amazonaws.com

Software

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://marriottinternationa.demdex.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

DCS: dcs-prod-irl1-2-v027-0eab81db2.edge-irl1.demdex.com UNKNOWN
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
content-encoding: gzip
X-Content-Type-Options: nosniff
X-TID: A94WYqnmQcM=
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection: keep-alive
Content-Type: image/gif
Content-Length: 59
Expires: Thu, 01 Jan 1970 00:00:00 UTC

Redirect headers

pragma: no-cache
date: Tue, 08 Feb 2022 22:43:36 GMT
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 5F9BE32BFD0B43E6BC94714CBF6379CD Ref B: FRAEDGE1209 Ref C: 2022-02-08T22:43:36Z
x-powered-by: ASP.NET
x-cache: CONFIG_NOCACHE
p3p: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
location: https://dpm.demdex.net/ibs:dpid=1957&dpuuid=0BEA078FF513666619F916CAF4C167C8
cache-control: private, no-cache, proxy-revalidate, no-store
content-length: 0

GET
H/1.1

200
OK

ibs:dpid=3047&dpuuid=51524BA7EF9037&gdpr=0&gdpr_consent=
dpm.demdex.net/ Frame ED2A
Redirect Chain

https://servedby.flashtalking.com/map/?key=a74thHgsfK627J6Ftt8sj5ks52bKe&gdpr=0&gdpr_consent=&url=https://dpm.demdex.net/ibs:dpid=3047&dpuuid=[%FT_GUID%]&gdpr=0&gdpr_consent=
https://dpm.demdex.net/ibs:dpid=3047&dpuuid=51524BA7EF9037&gdpr=0&gdpr_consent=

42 B
943 B

33ms
32ms

Image
image/gif

52.16.52.14
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dpm.demdex.net/ibs:dpid=3047&dpuuid=51524BA7EF9037&gdpr=0&gdpr_consent=

Protocol

HTTP/1.1

Server

52.16.52.14 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-52-16-52-14.eu-west-1.compute.amazonaws.com

Software

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://marriottinternationa.demdex.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

DCS: dcs-prod-irl1-1-v027-03d99afdd.edge-irl1.demdex.com UNKNOWN
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
content-encoding: gzip
X-Content-Type-Options: nosniff
X-TID: 0qqenxMVRvI=
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection: keep-alive
Content-Type: image/gif
Content-Length: 59
Expires: Thu, 01 Jan 1970 00:00:00 UTC

Redirect headers

Pragma: no-cache
Date: Tue, 08 Feb 2022 22:43:36 GMT
Server: prod-xre-app14.lhr11
X-HW: 1644360216.dop004.lo4.t,1644360216.cds012.lo4.shn,1644360216.dop004.lo4.t,1644360216.cds208.lo4.sc,1644360216.cds208.lo4.p
Location: https://dpm.demdex.net/ibs:dpid=3047&dpuuid=51524BA7EF9037&gdpr=0&gdpr_consent=
Cache-Control: no-cache, no-store
Connection: Keep-Alive
Content-Length: 0

GET
H2 200 RC13a65ced67c44530b4e082ec22d40a56-source.min.js Show response
assets.adobedtm.com/697d0c070f1e/d405339bb010/2c7a2906f149/ 1 KB
814 B 8ms
7ms Script
application/x-javascript 2a02:26f0:6c00:299::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/697d0c070f1e/d405339bb010/2c7a2906f149/RC13a65ced67c44530b4e082ec22d40a56-source.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN3963523be4674e5591a9c4d516697352.min.js?ver=1.0.0
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:6c00:299::1e80 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: ca315ac2c6693b8f35e0f3a0769557c5d6f93e80a66cb6d8485a820991a069a2

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://westin.marriott.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Tue, 08 Feb 2022 22:43:36 GMT
content-encoding: gzip
last-modified: Wed, 26 Jan 2022 21:46:48 GMT
server: AkamaiNetStorage
etag: "7184d57b82edb357db76e03b5d05ba89:1643233608.176218"
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: https://westin.marriott.com
cache-control: max-age=3600
accept-ranges: bytes
timing-allow-origin: *
content-length: 546
expires: Tue, 08 Feb 2022 23:43:36 GMT

GET
H2 200 RC97c93b255b1f48beb6ebbb11cd1413a4-source.min.js Show response
assets.adobedtm.com/697d0c070f1e/d405339bb010/2c7a2906f149/ 385 B
507 B 10ms
10ms Script
application/x-javascript 2a02:26f0:6c00:299::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/697d0c070f1e/d405339bb010/2c7a2906f149/RC97c93b255b1f48beb6ebbb11cd1413a4-source.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-EN3963523be4674e5591a9c4d516697352.min.js?ver=1.0.0
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:6c00:299::1e80 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: 60c992e3cb92be9650c6dab9f4b1faa824bd07dc87325df4142748cba1ad87a4

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://westin.marriott.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Tue, 08 Feb 2022 22:43:36 GMT
content-encoding: gzip
last-modified: Wed, 26 Jan 2022 21:46:48 GMT
server: AkamaiNetStorage
etag: "7184d57b82edb357db76e03b5d05ba89:1643233608.176218"
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: https://westin.marriott.com
cache-control: max-age=3600
accept-ranges: bytes
timing-allow-origin: *
content-length: 240
expires: Tue, 08 Feb 2022 23:43:36 GMT

GET match.gif
match.rundsp.com/ Frame ED2A 0
0

GET
H2 200 detector-dom.min.js Show response
cdn.glassboxcdn.com/marriott/ 375 KB
114 KB 92ms
38ms Script
application/javascript 2606:4700::6812:e16
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.glassboxcdn.com/marriott/detector-dom.min.js
Requested by: Host: westin.marriott.com
URL: https://westin.marriott.com/?enrollmentSourceCode=EMEA&nck=125622969&ck=49864193&lk=1000535890
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:e16 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 5e2fa42a59d3821d817237739a86a2b54fcb49b8f17e80be73a4e33de9030eb3

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://westin.marriott.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Tue, 08 Feb 2022 22:43:36 GMT
via: 1.1 4b0a29060798a5746cab1da1c9cdac7b.cloudfront.net (CloudFront)
cf-cache-status: HIT
age: 6095
cf-ray: 6da860bad8c65a43-MXP
x-cache: Hit from cloudfront
content-encoding: gzip
last-modified: Mon, 25 Oct 2021 15:40:33 GMT
server: cloudflare
etag: W/"7c02bcd56c4154696ce405ff087d3656"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
x-amz-version-id: sqPsBXaPa.eNL6zFok.vc.iyWi8GijO5
cache-control: public, max-age=14400
x-amz-cf-pop: MXP64-C1
content-type: application/javascript
x-amz-cf-id: u3nxqeiYjK17oovXYEPYir1H2pycQRf0V1Y4o2j8z0JqzD6xNdwK3w==
expires: Wed, 09 Feb 2022 02:43:36 GMT

GET
H2 204 current
adobe-sync.dotomi.com/match/bounce/ Frame ED2A 0
104 B 97ms
65ms Image
text/plain 2a02:fa8:8806:12::1400
VCLK-EU-SE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://adobe-sync.dotomi.com/match/bounce/current?networkId=85983&version=1&nuid=37733966549853964593912821959180323522&rurl=https%3A%2F%2Fdpm.demdex.net%2Fibs%3Adpid%3D19360%26dpuuid%3D
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2a02:fa8:8806:12::1400 , Singapore, ASN41041 (VCLK-EU-SE, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://marriottinternationa.demdex.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 08 Feb 2022 22:43:36 GMT
cache-control: no-cache, private, max-age=0, no-store
server: nginx
expires: 0

GET
H/1.1 200
OK cls_report Show response
report.marriott.glassboxdigital.io/glassbox/reporting/a0db18ee-fb04-4317-9ce8-14ce393df292/ 50 B
1 KB 301ms
98ms XHR
application/json 52.200.201.220
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://report.marriott.glassboxdigital.io/glassbox/reporting/a0db18ee-fb04-4317-9ce8-14ce393df292/cls_report?_cls_s=4aebad1c-6e2d-4ab5-9c58-1a8baa8ba442%3A0&_cls_v=a507f133-0d0d-4cbf-b8f1-7532686a0eb7&pv=2&f_cls_s=true
Requested by: Host: marriott.btttag.com
URL: https://marriott.btttag.com/btt.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.200.201.220 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-200-201-220.compute-1.amazonaws.com
Software: GlassBox Cligate /
Resource Hash: 250e3f540bda52c71b43a27ba5365dd5f5493a1fcadd68f7676e9fd6a6c9de28

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://westin.marriott.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Date: Tue, 08 Feb 2022 22:43:37 GMT
content-encoding: gzip
Server: GlassBox Cligate
vary: origin
Content-Type: application/json; charset=utf-8
access-control-allow-origin: https://westin.marriott.com
access-control-allow-credentials: true
Connection: keep-alive
GB-Server: g5015
X-Robots-Tag: noindex
Content-Length: 74

GET
H/1.1

200
OK

ibs:dpid=22054
dpm.demdex.net/ Frame ED2A
Redirect Chain

https://a.tribalfusion.com/i.match?p=b13&u=37733966549853964593912821959180323522&redirect=https%3A%2F%2Fdpm.demdex.net%2Fibs%3Adpid=22054&dpuuid=$TF_USER_ID_ENC$
https://s.tribalfusion.com/z/i.match?p=b13&u=37733966549853964593912821959180323522&redirect=https%3A%2F%2Fdpm.demdex.net%2Fibs%3Adpid=22054&dpuuid=$TF_USER_ID_ENC$
https://dpm.demdex.net/ibs:dpid=22054

42 B
957 B

31ms
31ms

Image
image/gif

52.16.52.14
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dpm.demdex.net/ibs:dpid=22054

Protocol

HTTP/1.1

Server

52.16.52.14 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-52-16-52-14.eu-west-1.compute.amazonaws.com

Software

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://marriottinternationa.demdex.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

DCS: dcs-prod-irl1-2-v027-096e6021a.edge-irl1.demdex.com UNKNOWN
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
content-encoding: gzip
X-Content-Type-Options: nosniff
X-Error: 300
X-TID: GeDZvw8OROM=
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection: keep-alive
Content-Type: image/gif
Content-Length: 59
Expires: Thu, 01 Jan 1970 00:00:00 UTC

Redirect headers

pragma: no-cache
date: Tue, 08 Feb 2022 22:43:37 GMT
cf-cache-status: DYNAMIC
x-function: 209
server: cloudflare
x-reuse-index: 1367
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
cf-ray: 6da860bdaaa4f91b-MXP
p3p: CP="NOI DEVo TAIa OUR BUS"
location: https://dpm.demdex.net/ibs:dpid=22054
cache-control: no-cache, private
content-type: text/html
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H/1.1

200
OK

ibs:dpid=22069&dpuuid=3015533742647
dpm.demdex.net/ Frame ED2A
Redirect Chain

https://tag.yieldoptimizer.com/ps/ps?t=i&p=2233
https://tag.yieldoptimizer.com/ps/ps?tc=346001959&t=i&p=2233
https://dpm.demdex.net/ibs:dpid=22069&dpuuid=3015533742647

42 B
943 B

40ms
39ms

Image
image/gif

52.16.52.14
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dpm.demdex.net/ibs:dpid=22069&dpuuid=3015533742647

Protocol

HTTP/1.1

Server

52.16.52.14 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-52-16-52-14.eu-west-1.compute.amazonaws.com

Software

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://marriottinternationa.demdex.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

DCS: dcs-prod-irl1-1-v027-0213a5377.edge-irl1.demdex.com UNKNOWN
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
content-encoding: gzip
X-Content-Type-Options: nosniff
X-TID: qKZYpD4gQP4=
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection: keep-alive
Content-Type: image/gif
Content-Length: 59
Expires: Thu, 01 Jan 1970 00:00:00 UTC

Redirect headers

pragma: no-cache
date: Tue, 08 Feb 2022 22:43:36 GMT
via: 1.1 google
server: Apache-Coyote/1.1
p3p: CP="NON DSP COR TAIo PSAo PSDo HISo OUR BUS UNI INT DEM OTC"
location: https://dpm.demdex.net/ibs:dpid=22069&dpuuid=3015533742647
cache-control: no-cache
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H/1.1

200
OK

ibs:dpid=28645&dpuuid=jeRdeU22JhXrW0Uv0nfBz61JuqDUa7lU&gdpr=0&gdpr_consent=
dpm.demdex.net/ Frame ED2A
Redirect Chain

https://gum.criteo.com/sync?c=8&r=1&a=1&u=https%3A%2F%2Fdpm.demdex.net%2Fibs%3Adpid%3D28645%26dpuuid%3D%40USERID%40%26gdpr%3D0%26gdpr_consent%3D&gdpr=0&gdpr_consent=
https://gum.criteo.com/sync?s=1&c=8&r=1&a=1&u=https%3A%2F%2Fdpm.demdex.net%2Fibs%3Adpid%3D28645%26dpuuid%3D%40USERID%40%26gdpr%3D0%26gdpr_consent%3D&gdpr=0&gdpr_consent=
https://dpm.demdex.net/ibs:dpid=28645&dpuuid=jeRdeU22JhXrW0Uv0nfBz61JuqDUa7lU&gdpr=0&gdpr_consent=

42 B
943 B

34ms
34ms

Image
image/gif

52.16.52.14
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dpm.demdex.net/ibs:dpid=28645&dpuuid=jeRdeU22JhXrW0Uv0nfBz61JuqDUa7lU&gdpr=0&gdpr_consent=

Protocol

HTTP/1.1

Server

52.16.52.14 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-52-16-52-14.eu-west-1.compute.amazonaws.com

Software

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://marriottinternationa.demdex.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

DCS: dcs-prod-irl1-1-v027-0a9aa4bb8.edge-irl1.demdex.com UNKNOWN
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
content-encoding: gzip
X-Content-Type-Options: nosniff
X-TID: BXMsruZ1Tpg=
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection: keep-alive
Content-Type: image/gif
Content-Length: 59
Expires: Thu, 01 Jan 1970 00:00:00 UTC

Redirect headers

location: https://dpm.demdex.net/ibs:dpid=28645&dpuuid=jeRdeU22JhXrW0Uv0nfBz61JuqDUa7lU&gdpr=0&gdpr_consent=
date: Tue, 08 Feb 2022 22:43:36 GMT
cache-control: private, max-age=0, no-cache, no-store, must-revalidate
server-processing-duration-in-ticks: 3193
content-length: 227
strict-transport-security: max-age=31536000; preload;
content-type: text/html; charset=utf-8

GET
H/1.1

200
OK

ibs:dpid=30646
dpm.demdex.net/ Frame ED2A
Redirect Chain

https://cms.analytics.yahoo.com/cms?partner_id=ADOBE&_hosted_id=37733966549853964593912821959180323522&gdpr=0&gdpr_consent=
https://dpm.demdex.net/ibs:dpid=30646?dpuuid=y-qHArJv9E2pGRlwTj_v6jgdf5IFftZOg9V8A-~A

42 B
943 B

33ms
32ms

Image
image/gif

52.16.52.14
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dpm.demdex.net/ibs:dpid=30646?dpuuid=y-qHArJv9E2pGRlwTj_v6jgdf5IFftZOg9V8A-~A

Protocol

HTTP/1.1

Server

52.16.52.14 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-52-16-52-14.eu-west-1.compute.amazonaws.com

Software

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://marriottinternationa.demdex.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

DCS: dcs-prod-irl1-1-v027-06abf313b.edge-irl1.demdex.com UNKNOWN
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
content-encoding: gzip
X-Content-Type-Options: nosniff
X-TID: LItzxM9yQhM=
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection: keep-alive
Content-Type: image/gif
Content-Length: 59
Expires: Thu, 01 Jan 1970 00:00:00 UTC

Redirect headers

date: Tue, 08 Feb 2022 22:43:37 GMT
referrer-policy: strict-origin-when-cross-origin
server: ATS
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-frame-options: DENY
content-type: text/html;charset=utf-8
location: https://dpm.demdex.net/ibs:dpid=30646?dpuuid=y-qHArJv9E2pGRlwTj_v6jgdf5IFftZOg9V8A-~A
x-xss-protection: 1; mode=block
strict-transport-security: max-age=31536000
content-length: 0
x-content-type-options: nosniff

GET
H2 200 v2
odr.mookie1.com/t/ Frame ED2A 43 B
324 B 32ms
15ms Image
image/gif 34.98.67.61
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://odr.mookie1.com/t/v2?tagid=V2_676804&src.visitorId=37733966549853964593912821959180323522&gdpr=0&gdpr_consent=
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.98.67.61 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 61.67.98.34.bc.googleusercontent.com
Software: Apache /
Resource Hash: a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://marriottinternationa.demdex.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 08 Feb 2022 22:43:37 GMT
via: 1.1 google
server: Apache
p3p: CP="NON DSP COR NID CURa PSAa PSDa OUR STP UNI COM NAV STA LOC OTC",policyref="/w3c/p3p.xml"
cache-control: no-cache, no-store, must-revalidate
content-type: image/gif;charset=UTF-8
alt-svc: clear
content-length: 43
x-application-context: application
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H/1.1

200
OK

ibs:dpid=80742&dpuuid=efb62d3f-b8b1-4731-8bd8-5f34eaebffe8
dpm.demdex.net/ Frame ED2A
Redirect Chain

https://ag.innovid.com/dv/sync?tid=6
https://dpm.demdex.net/ibs:dpid=80742&dpuuid=efb62d3f-b8b1-4731-8bd8-5f34eaebffe8

42 B
943 B

32ms
32ms

Image
image/gif

52.16.52.14
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dpm.demdex.net/ibs:dpid=80742&dpuuid=efb62d3f-b8b1-4731-8bd8-5f34eaebffe8

Protocol

HTTP/1.1

Server

52.16.52.14 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-52-16-52-14.eu-west-1.compute.amazonaws.com

Software

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://marriottinternationa.demdex.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

DCS: dcs-prod-irl1-2-v027-0faf5f5c7.edge-irl1.demdex.com UNKNOWN
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
content-encoding: gzip
X-Content-Type-Options: nosniff
X-TID: UONxNRtKQFk=
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection: keep-alive
Content-Type: image/gif
Content-Length: 59
Expires: Thu, 01 Jan 1970 00:00:00 UTC

Redirect headers

location: https://dpm.demdex.net/ibs:dpid=80742&dpuuid=efb62d3f-b8b1-4731-8bd8-5f34eaebffe8
date: Tue, 08 Feb 2022 22:43:37 GMT
content-length: 0
request-time: 0

GET
H/1.1

200
OK

ibs:dpid=96420&dpuuid=sWTlTCOb5Os0&us_privacy=$%7BUS_PRIVACY%7D
dpm.demdex.net/ Frame ED2A
Redirect Chain

https://pxl.jivox.com/tags/sync/usync.php?px=IkovJ4aN
https://dpm.demdex.net/ibs:dpid=96420&dpuuid=sWTlTCOb5Os0&us_privacy=$%7BUS_PRIVACY%7D

42 B
943 B

33ms
33ms

Image
image/gif

52.16.52.14
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dpm.demdex.net/ibs:dpid=96420&dpuuid=sWTlTCOb5Os0&us_privacy=$%7BUS_PRIVACY%7D

Protocol

HTTP/1.1

Server

52.16.52.14 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-52-16-52-14.eu-west-1.compute.amazonaws.com

Software

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://marriottinternationa.demdex.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

DCS: dcs-prod-irl1-2-v027-0df6ef339.edge-irl1.demdex.com UNKNOWN
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
content-encoding: gzip
X-Content-Type-Options: nosniff
X-TID: jNpE2vR1TuI=
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection: keep-alive
Content-Type: image/gif
Content-Length: 59
Expires: Thu, 01 Jan 1970 00:00:00 UTC

Redirect headers

location: https://dpm.demdex.net/ibs:dpid=96420&dpuuid=sWTlTCOb5Os0&us_privacy=${US_PRIVACY}
date: Tue, 08 Feb 2022 22:43:37 GMT
server: Jetty(9.4.39.v20210325)
content-length: 0
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2

204

usermatch.gif
beacon.krxd.net/ Frame ED2A
Redirect Chain

https://usermatch.krxd.net/um/v2?partner=adobe&id=37733966549853964593912821959180323522
https://beacon.krxd.net/usermatch.gif?kuid_status=new&partner=adobe&id=37733966549853964593912821959180323522

0
338 B

111ms
32ms

Image
text/plain

34.251.73.26
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://beacon.krxd.net/usermatch.gif?kuid_status=new&partner=adobe&id=37733966549853964593912821959180323522
Protocol: H2
Server: 34.251.73.26 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-34-251-73-26.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://marriottinternationa.demdex.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Tue, 08 Feb 2022 22:43:38 GMT
cache-control: private, no-cache, no-store
x-request-time: D=41 t=1644360218
x-served-by: beacon-n003-dub-prod.krxd.net
p3p: policyref="https://cdn.krxd.net/kruxcontent/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

Redirect headers

location: https://beacon.krxd.net/usermatch.gif?kuid_status=new&partner=adobe&id=37733966549853964593912821959180323522
date: Tue, 08 Feb 2022 22:43:37 GMT
x-cache-hits: 0
x-age: 0
content-length: 0
x-cache: MISS
x-served-by: usermatch-a003-ash-prod.krxd.net

GET
H3

200

pixel
cm.g.doubleclick.net/ Frame ED2A
Redirect Chain

https://sync-tm.everesttech.net/upi/pid/5w3jqr4k?redir=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dg8f47s39e399f3fe%26google_push%26google_sc%26google_hm%3D%24%7BTM_USER_ID_BASE64ENC_...
https://cm.g.doubleclick.net/pixel?google_nid=g8f47s39e399f3fe&google_push&google_sc&google_hm=WWdMeUZ3QUFBQmpXendRQQ==

170 B
188 B

31ms
16ms

Image
image/png

142.250.185.194
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=g8f47s39e399f3fe&google_push&google_sc&google_hm=WWdMeUZ3QUFBQmpXendRQQ==

Protocol

Server

142.250.185.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s52-in-f2.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://marriottinternationa.demdex.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 08 Feb 2022 22:43:37 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Tue, 08 Feb 2022 22:43:37 GMT
via: 1.1 varnish
server: Varnish
x-timer: S1644360218.779787,VS0,VE0
x-served-by: cache-hhn4068-HHN
x-cache: HIT
location: https://cm.g.doubleclick.net/pixel?google_nid=g8f47s39e399f3fe&google_push&google_sc&google_hm=WWdMeUZ3QUFBQmpXendRQQ==
cache-control: no-cache
accept-ranges: bytes
content-length: 0
retry-after: 0
x-cache-hits: 0

GET
H/1.1

204
No Content

tap.php
pixel.rubiconproject.com/ Frame ED2A
Redirect Chain

https://sync-tm.everesttech.net/upi/pid/btu4jd3a?redir=https%3A%2F%2Fpixel.rubiconproject.com%2Ftap.php%3Fv%3D7941%26nid%3D2243%26put%3D%24%7BUSER_ID%7D%26expires%3D90
https://pixel.rubiconproject.com/tap.php?v=7941&nid=2243&put=YgLyFwAAABjWzwQA&expires=90

0
239 B

30ms
7ms

Image
image/gif

69.173.144.139
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.rubiconproject.com/tap.php?v=7941&nid=2243&put=YgLyFwAAABjWzwQA&expires=90
Protocol: HTTP/1.1
Server: 69.173.144.139 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://marriottinternationa.demdex.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost: 611afce88997db6fdd35eb213e662871
Content-Type: image/gif

Redirect headers

pragma: no-cache
date: Tue, 08 Feb 2022 22:43:37 GMT
via: 1.1 varnish
server: Varnish
x-timer: S1644360218.864204,VS0,VE0
x-served-by: cache-hhn4068-HHN
x-cache: HIT
location: https://pixel.rubiconproject.com/tap.php?v=7941&nid=2243&put=YgLyFwAAABjWzwQA&expires=90
cache-control: no-cache
accept-ranges: bytes
content-length: 0
retry-after: 0
x-cache-hits: 0

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame ED2A
Redirect Chain

https://sync-tm.everesttech.net/upi/pid/ZMAwryCI?redir=https%3A%2F%2Fdsum-sec.casalemedia.com%2Frum%3Fcm_dsp_id%3D88%26external_user_id%3D%24%7BTM_USER_ID%7D
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=88&external_user_id=YgLyFwAAABjWzwQA
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=88&external_user_id=YgLyFwAAABjWzwQA&C=1

43 B
1003 B

27ms
27ms

Image
image/gif

2.18.234.21
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=88&external_user_id=YgLyFwAAABjWzwQA&C=1
Protocol: HTTP/1.1
Server: 2.18.234.21 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-234-21.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://marriottinternationa.demdex.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 08 Feb 2022 22:43:38 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Tue, 08 Feb 2022 22:43:38 GMT

Redirect headers

Pragma: no-cache
Date: Tue, 08 Feb 2022 22:43:38 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=88&external_user_id=YgLyFwAAABjWzwQA&C=1
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: text/html; charset=iso-8859-1
Content-Length: 279
Expires: Tue, 08 Feb 2022 22:43:38 GMT

GET
H/1.1

200
OK

setuid
ib.adnxs.com/ Frame ED2A
Redirect Chain

https://sync-tm.everesttech.net/upi/pid/UH6TUt9n?redir=https%3A%2F%2Fib.adnxs.com%2Fsetuid%3Fentity%3D158%26code%3D%24%7BTM_USER_ID%7D
https://ib.adnxs.com/setuid?entity=158&code=YgLyFwAAABjWzwQA

43 B
1012 B

9ms
8ms

Image
image/gif

37.252.172.45
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/setuid?entity=158&code=YgLyFwAAABjWzwQA

Protocol

HTTP/1.1

Server

37.252.172.45 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),

Reverse DNS

693.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net

Software

nginx/1.17.9 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://marriottinternationa.demdex.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 08 Feb 2022 22:43:38 GMT
X-Proxy-Origin: 193.27.14.24; 193.27.14.24; 693.bm-nginx-loadbalancer.mgmt.fra1; adnxs.com
AN-X-Request-Uuid: 637878ab-d5f1-4a6c-befd-5221a9279d2c
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma: no-cache
date: Tue, 08 Feb 2022 22:43:38 GMT
via: 1.1 varnish
server: Varnish
x-timer: S1644360218.076561,VS0,VE0
x-served-by: cache-hhn4068-HHN
x-cache: HIT
location: https://ib.adnxs.com/setuid?entity=158&code=YgLyFwAAABjWzwQA
cache-control: no-cache
accept-ranges: bytes
content-length: 0
retry-after: 0
x-cache-hits: 0

GET
H2

200

sd
us-u.openx.net/w/1.0/ Frame ED2A
Redirect Chain

https://sync-tm.everesttech.net/upi/pid/ny75r2x0?redir=https%3A%2F%2Fus-u.openx.net%2Fw%2F1.0%2Fsd%3Fid%3D537148856%26val%3D%24%7BTM_USER_ID%7D
https://us-u.openx.net/w/1.0/sd?id=537148856&val=YgLyFwAAABjWzwQA

43 B
274 B

32ms
17ms

Image
image/gif

34.98.64.218
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?id=537148856&val=YgLyFwAAABjWzwQA
Protocol: H2
Server: 34.98.64.218 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 218.64.98.34.bc.googleusercontent.com
Software: OXGW/17.1.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://marriottinternationa.demdex.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 08 Feb 2022 22:43:38 GMT
via: 1.1 google
server: OXGW/17.1.0
vary: Accept
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

pragma: no-cache
date: Tue, 08 Feb 2022 22:43:38 GMT
via: 1.1 varnish
server: Varnish
x-timer: S1644360218.177174,VS0,VE0
x-served-by: cache-hhn4068-HHN
x-cache: HIT
location: https://us-u.openx.net/w/1.0/sd?id=537148856&val=YgLyFwAAABjWzwQA
cache-control: no-cache
accept-ranges: bytes
content-length: 0
retry-after: 0
x-cache-hits: 0

GET
H2

200

Pug
image2.pubmatic.com/AdServer/ Frame ED2A
Redirect Chain

https://sync-tm.everesttech.net/upi/pid/b9pj45k4?redir=https%3A%2F%2Fimage2.pubmatic.com%2FAdServer%2FPug%3Fvcode%3Dbz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA%3D%26piggybackCookie%3D%24%7BUSER...
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA=&piggybackCookie=YgLyFwAAABjWzwQA

1 B
549 B

43ms
13ms

Image
text/html

185.64.189.110
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA=&piggybackCookie=YgLyFwAAABjWzwQA
Protocol: H2
Server: 185.64.189.110 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://marriottinternationa.demdex.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Tue, 08 Feb 2022 22:43:37 GMT
cache-control: no-store, no-cache, private
x-lat: amspug013:0:400
server: nginx
content-type: text/html; charset=utf-8
content-length: 1
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

pragma: no-cache
date: Tue, 08 Feb 2022 22:43:38 GMT
via: 1.1 varnish
server: Varnish
x-timer: S1644360218.279298,VS0,VE0
x-served-by: cache-hhn4068-HHN
x-cache: HIT
location: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA=&piggybackCookie=YgLyFwAAABjWzwQA
cache-control: no-cache
accept-ranges: bytes
content-length: 0
retry-after: 0
x-cache-hits: 0

GET
H/1.1

200

partner
sync.search.spotxchange.com/ Frame ED2A
Redirect Chain

https://sync-tm.everesttech.net/upi/pid/h0r58thg?redir=https%3A%2F%2Fsync.search.spotxchange.com%2Fpartner%3Fadv_id%3D6409%26uid%3D%24%7BUSER_ID%7D%26img%3D1
https://sync.search.spotxchange.com/partner?adv_id=6409&uid=YgLyFwAAABjWzwQA&img=1
https://sync.search.spotxchange.com/partner?adv_id=6409&uid=YgLyFwAAABjWzwQA&img=1&__user_check__=1&sync_id=8e87ba4e-8930-11ec-88d2-1bce7de30306

43 B
549 B

17ms
17ms

Image
image/gif

185.94.180.125
SPOTX-AMS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.search.spotxchange.com/partner?adv_id=6409&uid=YgLyFwAAABjWzwQA&img=1&__user_check__=1&sync_id=8e87ba4e-8930-11ec-88d2-1bce7de30306
Protocol: HTTP/1.1
Server: 185.94.180.125 Amsterdam, Netherlands, ASN35220 (SPOTX-AMS, US),
Reverse DNS
Software: nginx /
Resource Hash: e586a84d8523747f42e510d78e141015b6424cf67d612854e892a7bcedc8ec9e

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://marriottinternationa.demdex.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Date: Tue, 08 Feb 2022 22:43:38 GMT
Server: nginx
Access-Control-Allow-Methods: GET, POST, OPTIONS
Content-Type: image/gif
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
Access-Control-Allow-Credentials: false
X-fe: 131
Connection: keep-alive
Content-Length: 43

Redirect headers

Date: Tue, 08 Feb 2022 22:43:38 GMT
Server: nginx
Location: /partner?adv_id=6409&uid=YgLyFwAAABjWzwQA&img=1&__user_check__=1&sync_id=8e87ba4e-8930-11ec-88d2-1bce7de30306
Access-Control-Allow-Methods: GET, POST, OPTIONS
Content-Type: text/plain
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
Access-Control-Allow-Credentials: false
X-fe: 95
Connection: keep-alive
Content-Length: 0

GET
H2

200

b.php
www.facebook.com/fr/ Frame ED2A
Redirect Chain

https://sync-tm.everesttech.net/upi/pid/r7ifn0SL?redir=https%3A%2F%2Fwww.facebook.com%2Ffr%2Fb.php%3Fp%3D1531105787105294%26e%3D%24%7BTM_USER_ID%7D%26t%3D2592000%26o%3D0
https://www.facebook.com/fr/b.php?p=1531105787105294&e=YgLyFwAAABjWzwQA&t=2592000&o=0

43 B
2 KB

67ms
47ms

Image
image/gif

2a03:2880:f11c:8183:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/fr/b.php?p=1531105787105294&e=YgLyFwAAABjWzwQA&t=2592000&o=0

Protocol

Server

2a03:2880:f11c:8183:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://marriottinternationa.demdex.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Tue, 08 Feb 2022 14:43:38 PST
content-encoding: br
x-content-type-options: nosniff
document-policy: force-load-at-top
content-security-policy-report-only: default-src data: blob: 'self' https://*.fbsbx.com 'unsafe-inline' *.facebook.com 'unsafe-eval' *.fbcdn.net;script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self' connect.facebook.net;style-src fonts.googleapis.com *.fbcdn.net data: *.facebook.com 'unsafe-inline';connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d-test.facebook.com/ wss://kaios-d.facebook.com/ v.whatsapp.net *.fbsbx.com *.fb.com;font-src data: *.gstatic.com *.facebook.com *.fbcdn.net *.fbsbx.com;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com *.tenor.co media.tenor.com facebook.com *.cdninstagram.com fbsbx.com fbcdn.net *.giphy.com connect.facebook.net *.carriersignal.info blob: android-webview-video-poster: googleads.g.doubleclick.net www.googleadservices.com *.whatsapp.net *.fb.com *.oculuscdn.com;media-src *.cdninstagram.com blob: *.fbcdn.net *.fbsbx.com www.facebook.com *.facebook.com https://*.giphy.com data:;frame-src *.doubleclick.net *.google.com *.facebook.com www.googleadservices.com *.fbsbx.com fbsbx.com data: www.instagram.com *.fbcdn.net https://paywithmybank.com;worker-src blob: *.facebook.com data:;report-uri https://www.facebook.com/csp/reporting/?minimize=0;
alt-svc: h3=":443"; ma=3600, h3-29=":443"; ma=3600
x-fb-rlafr: 0
pragma: public
x-fb-debug: 6mpzN8gqXfnyEtiDVgEZeIqwOlhWC6aK1zyEV8dFlDOpdDqREPXgmW5lKvMTmkIBvTugkSmbDk3S6r9lpBEP/g==
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
cross-origin-opener-policy: same-origin-allow-popups
strict-transport-security: max-age=15552000; preload
report-to: {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/?minimize=0"}],"group":"coep_report"}
content-type: image/gif
vary: Accept-Encoding
cache-control: public, max-age=0
priority: u=3,i
expires: Tue, 08 Feb 2022 14:43:38 PST

Redirect headers

pragma: no-cache
date: Tue, 08 Feb 2022 22:43:38 GMT
via: 1.1 varnish
server: Varnish
x-timer: S1644360218.482210,VS0,VE0
x-served-by: cache-hhn4068-HHN
x-cache: HIT
location: https://www.facebook.com/fr/b.php?p=1531105787105294&e=YgLyFwAAABjWzwQA&t=2592000&o=0
cache-control: no-cache
accept-ranges: bytes
content-length: 0
retry-after: 0
x-cache-hits: 0

GET
H/1.1

200
OK

s.gif
cm.ipinyou.com/xcms/aam/ Frame ED2A
Redirect Chain

https://cm.ipinyou.com/xcmr/aam/r.gif
https://dpm.demdex.net/ibs:dpid=134084&dpuuid=M296gbFYzyz&redir=http%3A%2F%2Fcm.ipinyou.com%2Fxcms%2Faam%2Fs.gif%3Ftid%3D$%7BDD_UUID%7D
https://cm.ipinyou.com/xcms/aam/s.gif?tid=37733966549853964593912821959180323522

43 B
486 B

176ms
176ms

Image
image/gif

47.93.233.30
CNNIC-ALIBABA-CN-...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cm.ipinyou.com/xcms/aam/s.gif?tid=37733966549853964593912821959180323522
Protocol: HTTP/1.1
Server: 47.93.233.30 Beijing, China, ASN37963 (CNNIC-ALIBABA-CN-NET-AP Hangzhou Alibaba Advertising Co.,Ltd., CN),
Reverse DNS
Software: nginx/1.12.2 /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://marriottinternationa.demdex.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 08 Feb 2022 22:43:39 GMT
Server: nginx/1.12.2
Transfer-Encoding: chunked
P3P: CP="NON DSP COR CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa CONa HISa TELa OTPa OUR UNRa IND UNI COM NAV INT DEM CNT PRE LOC"
Cache-Control: no-cache
Connection: keep-alive
Content-Type: image/gif
Expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

DCS: dcs-prod-irl1-1-v027-0a1e7b08a.edge-irl1.demdex.com UNKNOWN
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-TID: G8f6cvTcRw4=
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Location: https://cm.ipinyou.com/xcms/aam/s.gif?tid=37733966549853964593912821959180323522
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection: keep-alive
Content-Length: 0
Expires: Thu, 01 Jan 1970 00:00:00 UTC

GET
H3 200 common.js Show response
maps.googleapis.com/maps-api-v3/api/js/46/12a/intl/de_ALL/ 77 KB
28 KB 23ms
8ms Script
text/javascript 2a00:1450:4001:80e::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://maps.googleapis.com/maps-api-v3/api/js/46/12a/intl/de_ALL/common.js

Requested by

Host: maps.googleapis.com
URL: https://maps.googleapis.com/maps/api/js?v=3&client=gme-marriottinternational&channel=aloft&callback=window.app.map

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

8182c192d8ed69d7ed042c586a0bb398e158302acebfb4aa34db7510cd02e5c0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://westin.marriott.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Thu, 03 Feb 2022 21:31:01 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 436359
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/maps-api-js
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 28776
x-xss-protection: 0
last-modified: Thu, 04 Nov 2021 18:25:07 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="maps-api-js"
vary: Accept-Encoding, Origin
report-to: {"group":"maps-api-js","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/maps-api-js"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Fri, 03 Feb 2023 21:31:01 GMT

GET
H3 200 util.js Show response
maps.googleapis.com/maps-api-v3/api/js/46/12a/intl/de_ALL/ 298 KB
91 KB 25ms
11ms Script
text/javascript 2a00:1450:4001:80e::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://maps.googleapis.com/maps-api-v3/api/js/46/12a/intl/de_ALL/util.js

Requested by

Host: maps.googleapis.com
URL: https://maps.googleapis.com/maps/api/js?v=3&client=gme-marriottinternational&channel=aloft&callback=window.app.map

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80e::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5fcd48a18ea8c2bc5ca5f58a383cd969aa436af677fe2d6ea8cbecb2f85bd471

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://westin.marriott.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Tue, 08 Feb 2022 00:09:47 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 81233
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/maps-api-js
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 93225
x-xss-protection: 0
last-modified: Thu, 04 Nov 2021 18:25:07 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="maps-api-js"
vary: Accept-Encoding, Origin
report-to: {"group":"maps-api-js","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/maps-api-js"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Wed, 08 Feb 2023 00:09:47 GMT

OPTIONS
H2 200 analytics.rcv
d1.btttag.com/ Frame 0
0 81ms
57ms Preflight
text/html 2606:4700:10::ac43:25d2

General

Check archive.org

Show headers Download Go to

Full URL

https://d1.btttag.com/analytics.rcv?pgNm=westin.marriott.com%2F&trSeg=Prod-Brands&navStart=1644360212996

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:10::ac43:25d2 -, , ASN (),

Reverse DNS

Software

cloudflare /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept: */*
Access-Control-Request-Method: POST
Access-Control-Request-Headers: content-type
Origin: https://westin.marriott.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Sec-Fetch-Mode: cors

Response headers

date: Tue, 08 Feb 2022 22:43:40 GMT
content-type: text/html; charset=UTF-8
access-control-allow-origin: https://westin.marriott.com
access-control-allow-credentials: true
access-control-max-age: 86400
access-control-allow-methods: xhr,GET, POST, OPTIONS
access-control-allow-headers: xhr,content-type,Content-Type, Depth, User-Agent, X-File-Size, X-Requested-With, If-Modified-Since, X-File-Name, Cache-Control
timing-allow-origin: *
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=63072000; includeSubDomains
x-xss-protection: 1; mode=block
cf-cache-status: DYNAMIC
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server: cloudflare
cf-ray: 6da860d39bda5cb0-FRA
content-encoding: gzip

POST
H2 200 analytics.rcv Show response
d1.btttag.com/ 39 B
1 KB 120ms
119ms XHR
text/html 2606:4700:10::6816:3a80
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://d1.btttag.com/analytics.rcv?pgNm=westin.marriott.com%2F&trSeg=Prod-Brands&navStart=1644360212996

Requested by

Host: marriott.btttag.com
URL: https://marriott.btttag.com/btt.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:10::6816:3a80 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

6d979c8b96628510c2162fa81ada8d10c717d2ca14f9298c73c23b285af828f7

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://westin.marriott.com/
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Content-Type: application/json;charset=UTF-8

Response headers

date: Tue, 08 Feb 2022 22:43:40 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
timing-allow-origin: *
age: 180000
strict-transport-security: max-age=63072000; includeSubDomains
vary: Accept-Encoding
x-xss-protection: 1; mode=block
pragma: no-cache
last-modified: Wed, 21 Jan 2004 01:01:30 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
access-control-max-age: 86400
access-control-allow-methods: xhr,GET, POST, OPTIONS
content-type: text/html;charset=UTF-8
access-control-allow-origin: https://westin.marriott.com
cache-control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
access-control-allow-credentials: true
cf-ray: 6da860d41ccd59a1-MXP
access-control-allow-headers: xhr,content-type,Content-Type, Depth, User-Agent, X-File-Size, X-Requested-With, If-Modified-Since, X-File-Name, Cache-Control
expires: Wed, 19 Apr 2013 01:00:00 GMT

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: match.rundsp.com
URL: https://match.rundsp.com/match.gif?id=37733966549853964593912821959180323522&partner=adobe

Verdicts & Comments Add Verdict or Comment

84 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

46 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
report.marriott.glassboxdigital.io/glassbox/reporting/a0db18ee-fb04-4317-9ce8-14ce393df292	1969-12-31 23:59:59	Name: _cls_s Value: 4aebad1c-6e2d-4ab5-9c58-1a8baa8ba442:0
report.marriott.glassboxdigital.io/glassbox/reporting/a0db18ee-fb04-4317-9ce8-14ce393df292	1969-12-31 23:59:59	Name: _cls_v Value: a507f133-0d0d-4cbf-b8f1-7532686a0eb7
.demdex.net/	1970-01-20 05:05:12	Name: demdex Value: 37733966549853964593912821959180323522
.marriott.com/	1969-12-31 23:59:59	Name: AMCVS_664516D751E565010A490D4C%40AdobeOrg Value: 1
.everesttech.net/	1970-01-20 09:31:36	Name: everest_g_v2 Value: g_surferid~YgLyFwAAABjWzwQA
.dpm.demdex.net/	1970-01-20 05:05:12	Name: dpm Value: 37733966549853964593912821959180323522
.marriott.com/	1970-01-20 18:17:12	Name: AMCV_664516D751E565010A490D4C%40AdobeOrg Value: -1712354808%7CMCIDTS%7C19032%7CMCMID%7C37636904948071174423903422430063477931%7CMCAAMLH-1644965014%7C6%7CMCAAMB-1644965014%7C6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y%7CMCOPTOUT-1644367414s%7CNONE%7CMCSYNCSOP%7C411-19039%7CvVersion%7C4.3.0
.marriott.com/	1970-01-20 00:46:02	Name: s_tbm Value: true
.marriott.com/	1969-12-31 23:59:59	Name: s_cc Value: true
.adnxs.com/	1970-01-20 02:55:36	Name: uuid2 Value: 7193456728733431786
.rlcdn.com/	1970-01-20 02:12:24	Name: pxrc Value: CAA=
.doubleclick.net/	1970-01-20 10:07:36	Name: IDE Value: AHWqTUlCrWV_Q6JjTinv84qBaDmWcZ7UEuH-Wwz5eRTjyjTPVr2B0FGxMaNdhkjz
westin.marriott.com/	1970-01-20 09:31:36	Name: OptanonConsent Value: isGpcEnabled=0&datestamp=Tue+Feb+08+2022+22%3A43%3A35+GMT%2B0000+(GMT)&version=6.25.0&isIABGlobal=false&hosts=&consentId=dccb2a49-9812-4b2d-ab1f-d0b30e7b1015&interactionCount=0&landingPath=https%3A%2F%2Fwestin.marriott.com%2F%3FenrollmentSourceCode%3DEMEA%26nck%3D125622969%26ck%3D49864193%26lk%3D1000535890&groups=1%3A1%2C3%3A0%2C4%3A0
.adsrvr.org/	1970-01-20 09:31:36	Name: TDID Value: 5f8f0f2d-28d7-42c7-8078-aa36b5256d95
.adsrvr.org/	1970-01-20 09:31:36	Name: TDCPM Value: CAESEgoDYWFtEgsI9pS2n8_XtToQBRgBIAEoAjILCPaMuczl17U6EAU4AVoDYWFtYAI.
.bing.com/	1970-01-20 10:07:36	Name: MUID Value: 0BEA078FF513666619F916CAF4C167C8
.flashtalking.com/	1970-01-20 18:17:12	Name: flashtalkingad1 Value: "GUID=51524BA7EF9037"
.marriott.com/	1970-01-21 20:34:00	Name: _cls_v Value: a507f133-0d0d-4cbf-b8f1-7532686a0eb7
.marriott.com/	1969-12-31 23:59:59	Name: _cls_s Value: 4aebad1c-6e2d-4ab5-9c58-1a8baa8ba442:0
.yieldoptimizer.com/	1970-01-20 10:07:36	Name: fbh0 Value: %7B%7D
.yieldoptimizer.com/	1970-01-20 10:07:36	Name: gcma Value: %7B%22t%22%3A0%2C%22o%22%3Afalse%7D
.yieldoptimizer.com/	1970-01-20 10:07:36	Name: rmxc Value: %7B%22t%22%3A0%2C%22e%22%3A%22%22%2C%22i%22%3Afalse%7D
.yieldoptimizer.com/	1970-01-20 10:07:36	Name: cktst Value: 346001959
.yieldoptimizer.com/	1970-01-20 10:07:36	Name: ckid Value: 3015533742647
.yieldoptimizer.com/	1970-01-20 10:07:36	Name: dph Value: %7B%22t%22%3A%5B114886%5D%2C%22dp%22%3A%5B2233%5D%7D
.yieldoptimizer.com/	1970-01-20 10:07:36	Name: ph Value: %7B%22p%22%3A%5B1025%5D%2C%22t%22%3A%5B114886%5D%7D
.criteo.com/	1970-01-20 10:07:36	Name: uid Value: 14737145-5fba-419c-a2b0-0f9e9dd48518
report.marriott.glassboxdigital.io/	1970-01-20 00:56:05	Name: AWSALBCORS Value: 92d1qUGNRAwzTEx3FZcIn0aCGXdNZakKcED+LxPeTzsnZNYRHUseVXOvcT3Il1bCB8ivHTDW3yGhQLFgMcI2KWha/fqKd8VfbUX6lxo0q2lk/Rjm9mlp+XK0rRx8
.yahoo.com/	1970-01-20 09:31:57	Name: A3 Value: d=AQABBBnyAmICEOJTAhBgEgkZ8ONVdc-C84w&S=AQAAAldTTIBMPqW2dk9jtQjEvdg
.tribalfusion.com/	1970-01-20 02:55:36	Name: ANON_ID Value: acnr6ir2PKcFuYnRYan0qaoRTZdvJopBZcYQiHlG5HBYjyCvWLp36ZaYupOmDyRWxUyZaImeZbiWc
.innovid.com/	1970-01-20 02:55:36	Name: uuid Value: efb62d3f-b8b1-4731-8bd8-5f34eaebffe8-20220208 17:43:37
.jivox.com/	1970-01-20 02:55:36	Name: jvxsync Value: sWTlTCOb5Os0
.jivox.com/	1970-01-20 01:06:09	Name: jvxadbsync Value: 1644360217802
.krxd.net/	1970-01-20 05:05:12	Name: _kuid_ Value: OpquMMCE
.casalemedia.com/	1970-01-20 09:31:36	Name: CMID Value: YgLyGsPSbbUa8bEIVVitWAAA
.casalemedia.com/	1970-01-20 02:55:36	Name: CMPS Value: 3228
.adnxs.com/	1970-01-20 02:55:36	Name: anj Value: dTM7k!M4.FErk#WF']wIg2GVLe>S6v!]tbPl1MwL(!R7qUY$+r>Wm>.YWJWd@i:ZnXZO@0k$Ll/X%W#.wL5oa9/sZwfzrVL.'PdTWBCu(lOfM!x%H%MN3(
.casalemedia.com/	1970-01-20 02:55:36	Name: CMPRO Value: 1165
.casalemedia.com/	1970-01-20 00:47:26	Name: CMST Value: YgLyGmIC8hoA
.casalemedia.com/	1970-01-20 09:31:36	Name: CMRUM3 Value: 586202f21a2760YgLyFwAAABjWzwQA
.pubmatic.com/	1970-01-20 02:55:36	Name: KRTBCOOKIE_218 Value: 4056-YgLyFwAAABjWzwQA&KRTB&22978-YgLyFwAAABjWzwQA&KRTB&23194-YgLyFwAAABjWzwQA&KRTB&23209-YgLyFwAAABjWzwQA
.pubmatic.com/	1970-01-20 01:29:12	Name: PugT Value: 1644360217
.pubmatic.com/	1970-01-20 02:55:36	Name: PUBMDCID Value: 3
.spotxchange.com/	1970-01-20 09:31:40	Name: audience Value: 8e87ba06-8930-11ec-88d2-1bce7de30306
.demdex.net/	1970-01-20 05:05:12	Name: dextp Value: 358-1-1644360215238\|477-1-1644360215343\|771-1-1644360215491\|903-1-1644360215592\|1957-1-1644360215693\|3047-1-1644360215794\|13870-1-1644360215941\|19360-1-1644360216044\|22054-1-1644360216182\|22069-1-1644360216283\|28645-1-1644360216384\|30646-1-1644360216486\|30862-1-1644360216587\|80742-1-1644360216688\|96420-1-1644360216789\|66757-1-1644360216890\|144230-1-1644360216991\|144231-1-1644360217092\|144232-1-1644360217197\|144233-1-1644360217304\|144234-1-1644360217405\|144235-1-1644360217506\|144236-1-1644360217607\|144237-1-1644360217709\|134084-1-1644360217811
.ipinyou.com/	1970-01-20 18:17:12	Name: PYID Value: M296gbFYzyz

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://match.rundsp.com/match.gif?id=37733966549853964593912821959180323522&partner=adobe Message: Failed to load resource: net::ERR_SSL_PROTOCOL_ERROR

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

a.tribalfusion.com
adobe-sync.dotomi.com
ag.innovid.com
assets.adobedtm.com
beacon.krxd.net
c.bing.com
cache.marriott.com
cdn.glassboxcdn.com
cm.everesttech.net
cm.g.doubleclick.net
cm.ipinyou.com
cms.analytics.yahoo.com
d1.btttag.com
d1mqz30n8nowyf.cloudfront.net
dpm.demdex.net
dsum-sec.casalemedia.com
email-marriott.com
geolocation.onetrust.com
googleads.g.doubleclick.net
gum.criteo.com
ib.adnxs.com
idsync.rlcdn.com
image2.pubmatic.com
insight.adsrvr.org
maps.googleapis.com
marriott.btttag.com
marriottinternationa.demdex.net
match.adsrvr.org
match.rundsp.com
odr.mookie1.com
pacsys.marriott.com
pixel.rubiconproject.com
pxl.jivox.com
report.marriott.glassboxdigital.io
s.tribalfusion.com
servedby.flashtalking.com
smetrics.marriott.com
sync-tm.everesttech.net
sync.search.spotxchange.com
tag.yieldoptimizer.com
targeting-azalea.outpace.com
us-u.openx.net
usermatch.krxd.net
westin.marriott.com
www.facebook.com
www.google.com
www.google.de
match.rundsp.com
104.90.137.54
13.36.218.177
142.250.185.194
151.101.2.49
159.127.187.250
185.64.189.110
185.94.180.125
2.18.234.21
209.197.3.19
212.82.100.182
2600:9000:2156:c200:1d:cb70:f5c0:21
2606:4700:10::6814:b944
2606:4700:10::6816:3a80
2606:4700:10::ac43:25d2
2606:4700::6812:c05
2606:4700::6812:e16
2620:1ec:c11::200
2a00:1450:4001:800::2002
2a00:1450:4001:80e::2003
2a00:1450:4001:80e::200a
2a00:1450:4001:82f::2004
2a02:2638::1c
2a02:26f0:6c00:299::1e80
2a02:fa8:8806:12::1400
2a03:2880:f11c:8183:face:b00c:0:25de
2a05:d01c:1d8:8102:7312:c82c:fb3:8dc6
3.94.164.110
34.251.73.26
34.253.74.200
34.98.64.218
34.98.67.61
35.186.212.60
35.231.127.158
35.244.174.68
37.252.172.45
47.93.233.30
52.16.52.14
52.200.201.220
52.203.14.177
52.204.27.57
52.223.40.198
54.188.211.236
54.75.68.230
69.173.144.139
089030d8bec22aa48ae59e27516a4e8a1fcec666e9d783c7a1df47220b750dc1
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
0babf4f3f7870c4b8335d1a4e144c7cbbbfa7f24b2bb684498a36a91954716d4
0d74ac9dec4dbb99ceb8597e29b7fb1fa8c897cda530f441c0fd5d6fe08d5d68
134482ec36c8980c2c7a3f2454c76546abcd612c9ae596d011251a7cd1d0fcbb
145287b36883dd3061ca7aa9229a8fa9ace2cccd50e0382b4b6201f3916b57c5
149b209d9e9185e8b959a735427ac3538d154a86f5911b804e265ae33e679df2
194bc8476f1960306d8c6e224ac8fd3d6762f56c24094f1c04fe9603dbbff72b
1bb0d1951fa294ddb0df709a965a236c516169cc81603f251f4da4e4bb1add5c
1c38b38210051706981fb9dba449dfeb4fa1095d6fef33ebb593e55ee3798383
1f4513a435d6a3047d20a50c1e7d4263de42146c74be227f774b5e82e6357e75
1fb5df0313c436718e1e564c7ae1d277e0c51e44dc192d45de2e955ce3bf35b2
250e3f540bda52c71b43a27ba5365dd5f5493a1fcadd68f7676e9fd6a6c9de28
2562fce72ca9349a2054c884e6df27a815d178da20e29dbe2c530728d074634b
29515d1554ad4889d0c20188cf0d113d11f839d1c6ed3cc4b182b9441d1ec962
2c592c34b2e4a372219ac6d33bda6828183ee534a0219d221ece5be22d80e29f
2ee6fdf3d0f4d826380054030e5a9fd6fc8c451d9fe28123f1d76e632332e659
32bc033e13e02d8809b2c8c97ac5a5110c5f375a830ed6cace5ce1202ab5b480
34da945b5b801cb722079acb407a70879e81df72d1400b5a47f9b79f2b9b94d0
34db58c825c386db8e25db23fef962a89deb2829ab069ddd2dfcdfb3c9202cad
36adc6150d010b325ebd5b63097a6f697f1b0dbc80823a8087b05d01ddac5141
39fa587b3d332e83853591e4b72dc594d1c08b085fcf84a9236356328c156f6b
3e9110002eaa7f5c26cccac93aa7d82498c827133450802264a33dabe071b924
40a32e7d4dd802a21854e518db9346bdf2d5678a66b07540a9caa8c7274aaa7e
4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49
4efca4768dedb757f956b51f3620d1521be4e8f065080515489defc83c2de704
4f63ea126d19024e46e30675c3d769d2ce937474352e06b1364e7e5e0809223e
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87
596abbd37cc93e22661c95eecf5026ca0184421a0be193f6c7b18620e1a890ba
59d04f736bbce5134de1fd1cfa31b0c27a2e2d25dd9a67c9661185ebcf0823e9
5a3f1dd74233f605e511f1b5b244bedf85ac88ba264caf4d6401bc7ec2017dcd
5be614bce53f767993a5f5f14a6badd6aae6bf3af7cbdbf4d31520de49e27991
5cbf6d5c1d4e0b99ae3e6e754a2f8eaae1f05311d0a347bc04722435722407be
5e2fa42a59d3821d817237739a86a2b54fcb49b8f17e80be73a4e33de9030eb3
5fcd48a18ea8c2bc5ca5f58a383cd969aa436af677fe2d6ea8cbecb2f85bd471
60c992e3cb92be9650c6dab9f4b1faa824bd07dc87325df4142748cba1ad87a4
6424b5f29d19a54d1f51d0e32d97444879ba4ab29cc5ab6c0853243859743f76
684c8e17ea3bd4147c0d28890f6b4e6654234eb4c8f7749e2fa5e1cbc089f7b2
6d979c8b96628510c2162fa81ada8d10c717d2ca14f9298c73c23b285af828f7
6f2a7e571ce1315960b9e81c4a79b1f0139c9a91fa6a27f143db5844d0c49246
7137408ef48007cd2eb01157177f885566185221bc2b402aa83d84a829b5e52e
717f6bb5f6cc69c444f54376a72dee0ca7968b2a12e7c9475247ec85c0e75a53
7464a6bad3bf49cf76803d1d879feb879ae2221ee5f5b9909b50d5f90fdfe163
748e9410d3f0cc597e0cc7f09f130a2a87cae435306bcac7012b5fe71ab88176
773e588befe6e57881b27cef50f5df97ed69d00da161fc756e5385b303e5174a
777ab0cb5c6ffd6b2d455918b8df70fdb4c74ecb18d62f54be1afdaf3733c10d
7a89d721956fe1c879183f26dae3408ef9e0a341c02fd991bda50d5d34af3893
7bea17a80a61ed0f54248b4ffc4c718f7c8ff2619742577a73591d62ce074da8
7e4e5eac0b8b52bbe3deebd18ab2a58d33559bbf6b880f2b2e510d76b2318a69
7ea5c3b6bfe339ba0af64f85334d03a42a6b3bc93868198cc9d5f28a9ca26df6
7eb8b522380056eeb4bd4d7dab434040f9098425a802b04ce69f4648d10d3a26
8182c192d8ed69d7ed042c586a0bb398e158302acebfb4aa34db7510cd02e5c0
82b8188e2bfc560a293bba7cd5504cedeb6a9c1b3776ca874e4976a74cafb834
82c9979fbd8a50b37d9abd208505eb89b614f8a0f3e721d4e6e6e71caed18a77
83fa1185397dc0c596c0814a617c919b5feb6b28e620f899234699e4d986a83a
8577df598f439b9602bfec90eb2c2a654dbb3bd1922ad1d768d6ca3aef58c825
89c0f4f40097f31de88ca43cf777c25a2caa5e757a99a628c4482346e285f039
8b397f6f5d6f9b3ca3206c0bc305a71f19c4af2f4eaf97cc78b7f89756db4513
8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0
9110fc122dda3067c424d9b8ff7747e2030b0bd9298f69a3683d399ad3373a6a
949361aabc04491e935da68cb2d89b9104bf60da9beaca3a00209f99276b0849
96aa054c7283874ee7e0cc438c03fa1c8342669d4fe5f4dc02e57ff8cf63bd92
9821a90ef099a74fa89c7fb6c61eab75f52cdb64c90d3de925f05da7dcbd84bf
98ad55060920689641d662e5bc8f49a96b7ca2b4e890ff85313945ba3e6a06ba
9c87a00efc0ddeb20c2fe8c49fe14caa552edf1a4924e170967237d0db8d1e48
a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7
a097184c870bba774ee9b5fdd8f4b39f4216593805cad631319e860c148af62b
a1762e05ade8f8949d10bf16bc876ac2a1b93e0fd740148e6cf0a3c56123f51b
a98196ff46677867c9aab1aa8b72f5dc063d429d70ec36e8ab120cb6085bacdb
a9c0dcdf28cab864d690d109eaeb218db07a75ace0da74dd8fb740a7e4a21941
af29913f23e3b841ea8ffb1aeac8a255b983973798e89532cc97bea88ac3690c
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
b771771ab4afb10b6f1a5ef56dc3ec9e32709685b92a0e1304d71aeaac1c98c1
ca315ac2c6693b8f35e0f3a0769557c5d6f93e80a66cb6d8485a820991a069a2
ca3d163bab055381827226140568f3bef7eaac187cebd76878e0b63e9e442356
ce1de064118c40ce7ab3617f3fe6c8e959f63a624a564e36b91b4c85163eb500
cf7391b5c06a56e0f70f64b89ed9d42fd6ccc2efed6ea005237c39dc451ed681
d16e18bacf12f7a54b9f69262748bd384fb4112a78a8e001be1c8dc082ac28fa
d692a67352a3dfa80010c86a62761cfff05c0b1086618106a8576cc45a6a8115
da5fbe4fa4baffc3907a2e93ddcab15eb638ccd712e4bb85a287c0547ebe1ad8
db311174b0e3c340727b63c055cfb5b317808e909503e1bda11cc58af444f12b
dc5f4327fce6aafa25a07d5b20a0d72a5fed1842209b16fa22326f2e42b9165e
ddea5597073369631a04058b389fe89c87cdc5d65461166e6a49f0e2c58e22b6
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e586a84d8523747f42e510d78e141015b6424cf67d612854e892a7bcedc8ec9e
ed6db2ba224d804acea840f50830b19dfa613e9afc07af3f413136be0e9aa379
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
ef582da6c2d45e3f85044f2f55be1c10d264ac64d42aba9cd1a53d953fd2e6e2
f3683b159670ab681d39b5ae797fd300a478bb904fafce9be6b97e91c955daa3
f77bbe3cfcec8a1f3af6921b8bffdf93b978e73dc752521aa70a8e38173287d0
f786e15bbceb1ca8c806e3b42390d74c06ec77d6672aa03ee0302bfb38d125b3
f81d8c572ed3c6eacd7040a19edfbfc0f19e354d64890b4fab6483166d3428fd
fd9308db31181fde13aca740757dcb439baf71d731011a87da483a28faae444f
fe035b6ff2394b9fc9b4dad0acc9050d633269a5efa7cfeac7e6b8fdc12b7065

westin.marriott.com Open in urlscan Pro 35.231.127.158 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

108 Requests

77 %HTTPS

36 %IPv6

37 Domains

47 Subdomains

31 IPs

8 Countries

3954 kBTransfer

6568 kBSize

46 Cookies

56 Outgoing links

Page URL History

Redirected requests

108 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 7 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

westin.marriott.com Open in urlscan Pro
35.231.127.158 Public Scan

Screenshot
Live screenshot

Full Image

108
Requests

77 %
HTTPS

36 %
IPv6

37
Domains

47
Subdomains

31
IPs

8
Countries

3954 kB
Transfer

6568 kB
Size

46
Cookies

108 HTTP transactions
7 data transactions