urlscan.io logo urlscan.io
SecurityTrails logo

venta.renfe.com Open in urlscan Pro
213.144.49.57  Public Scan

Go To Rescan Add Verdict Report
URL: https://venta.renfe.com/vol/passbookEmail.do?pkpass=2023-11-28/2CMXKSBCOIKNNCBDBEPIBP.pkpass
Submission: On November 15 via manual from ES — Scanned from ES
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 2 IPs in 1 countries across 2 domains to perform 6 HTTP transactions. The main IP is 213.144.49.57, located in Madrid, Spain and belongs to ADIF, ES. The main domain is venta.renfe.com. The Cisco Umbrella rank of the primary domain is 509310.
TLS certificate: Issued by Entrust Certification Authority - L1K on September 27th 2023. Valid for: a year.
This is the only time venta.renfe.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Downloads These files were downloaded by the website

2CMXKSBCOIKNNCBDBEPIBP.pkpass 24 KB application/zip
MIME: Zip archive data, at least v2.0 to extract
Size: 24 KB (24596 bytes, 100% done)
Downloaded from: https://w4.renfe.es/passbook/2023-11-28/2CMXKSBCOIKNNCBDBEPIBP.pkpass

Domain & IP information

IP Address AS Autonomous System
5 213.144.49.57 15937 (ADIF)
1 213.144.49.61 15937 (ADIF)
6 2
Apex Domain
Subdomains		 Transfer
5 renfe.com
venta.renfe.com — Cisco Umbrella Rank: 509310
135 KB
1 renfe.es
w4.renfe.es
6 2
Domain Requested by
5 venta.renfe.com venta.renfe.com
1 w4.renfe.es venta.renfe.com
6 2

This site contains no links.

Subject Issuer Validity Valid
venta.renfe.com
Entrust Certification Authority - L1K		 2023-09-27 -
2024-10-24		 a year crt.sh
w4.renfe.es
Entrust Certification Authority - L1K		 2023-09-27 -
2024-10-24		 a year crt.sh

This page contains 1 frames:

Frame: https://w4.renfe.es/passbook/2023-11-28/2CMXKSBCOIKNNCBDBEPIBP.pkpass
Frame ID: 2C37A6654B09897FFFD1A29298FAE35F
Requests: 6 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Passbook Download

Page Statistics

6
Requests

100 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

2
IPs

1
Countries

135 kB
Transfer

348 kB
Size

10
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

6 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request passbookEmail.do
venta.renfe.com/vol/ 		1 KB
5 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://venta.renfe.com/vol/passbookEmail.do?pkpass=2023-11-28/2CMXKSBCOIKNNCBDBEPIBP.pkpass
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
213.144.49.57 Madrid, Spain, ASN15937 (ADIF, ES),
Reverse DNS
w8.renfe.es
Software
/
Resource Hash
bc766e20e73a194daad851c61aeaca9a37a77c8fa0a890667bc40c083bc8a73c
Security Headers
Name Value
Content-Security-Policy default-src 'none'; script-src 'self' *.queue-it.net https://c.paypal.com https://api.pushio.com https://venta.renfe.com https://venta.renfe.com/webpush-service-worker.js https://www.paypalobjects.com *.renfe.com renfe.d3.sc.omtrdc.net cdn.tt.omtrdc.net cdn.cookielaw.org *.serving-sys.com *.bstatic.com *.weborama.fr https://renfe-tracker.airpricing.net google-analytics.com *.gstatic.com https://www.google.com https://www.google.com https://www.googletagmanager.com https://www.googleadservices.com https://www.google-analytics.com tpc.googlesyndication.com https://googleads.g.doubleclick.net assets.adobedtm.com geolocation.onetrust.com https://www.youtube.com https://bat.bing.com *.oracleinfinity.io *.adobe.com *.meili.travel 'unsafe-inline' 'unsafe-eval'; connect-src 'self' *.renfe.com *.booking.com https://api.pushio.com https://venta.renfe.com https://venta.renfe.com/webpush-service-worker.js dpm.demdex.net renfe.d3.sc.omtrdc.net https://renfe-tracker.airpricing.net *.tt.omtrdc.net cdn.cookielaw.org google-analytics.com https://www.google-analytics.com *.meili.travel; img-src 'self' data: https://cm.everesttech.net https://dub.stats.paypal.com/counter2.cgi https://c.paypal.com https://api.pushio.com https://phx.stats.paypal.com https://b.stats.paypal.com https://slc.stats.paypal.com *.renfe.com ssl.renfe.com *.renfe.es renfe.d3.sc.omtrdc.net dpm.demdex.net http://r-ec.bstatic.com *.bstatic.com *.scorecardresearch.com ct-supplierimage.imgix.net ct-images.imgix.net ota-cars.imgix.net d224hgl7orw28t.cloudfront.net https://www.google-analytics.com https://www.google.com https://www.google.es https://googleads.g.doubleclick.net *.googleadservices.com *.2o7.net http://s7g10.scene7.com https://s7g10.scene7.com https://bat.bing.com *.oracleinfinity.io cdn.ociotour.es *.meili.travel; style-src 'self' *.renfe.com *.bstatic.com fonts.googleapis.com d224hgl7orw28t.cloudfront.net *.gstatic.com *.meili.travel 'unsafe-inline'; font-src 'self' *.bstatic.com fonts.gstatic.com fonts.googleapis.com *.meili.travel; frame-src 'self' *.googlesyndication.com https://www.google.com https://c.paypal.com https://api.pushio.com https://venta.renfe.com https://venta.renfe.com/webpush-service-worker.js *.renfe.com *.cartrawler.com *.booking.com *.weborama.fr *.demdex.net sitecatalyst.omniture.com *.sitecatalyst.omniture.com *.adobe.com; object-src 'self'; child-src https://c.paypal.com https://venta.renfe.com https://venta.renfe.com/webpush-service-worker.js;
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36
accept-language
es-ES,es;q=0.9

Response headers

Access-Control-Allow-Credentials
true
Access-Control-Allow-Headers
Origin, Accept, X-Requested-With, Content-Type, Access-Control-Request-Method, Access-Control-Request-Headers, Authorization
Access-Control-Allow-Methods
POST, GET, PUT, UPDATE, OPTIONS
Access-Control-Allow-Origin
https://avlorenfe.com
Cache-Control
no-store, no-cache, must-revalidate
Connection
keep-alive
Content-Encoding
gzip
Content-Language
es-ES
Content-Security-Policy
default-src 'none'; script-src 'self' *.queue-it.net https://c.paypal.com https://api.pushio.com https://venta.renfe.com https://venta.renfe.com/webpush-service-worker.js https://www.paypalobjects.com *.renfe.com renfe.d3.sc.omtrdc.net cdn.tt.omtrdc.net cdn.cookielaw.org *.serving-sys.com *.bstatic.com *.weborama.fr https://renfe-tracker.airpricing.net google-analytics.com *.gstatic.com https://www.google.com https://www.google.com https://www.googletagmanager.com https://www.googleadservices.com https://www.google-analytics.com tpc.googlesyndication.com https://googleads.g.doubleclick.net assets.adobedtm.com geolocation.onetrust.com https://www.youtube.com https://bat.bing.com *.oracleinfinity.io *.adobe.com *.meili.travel 'unsafe-inline' 'unsafe-eval'; connect-src 'self' *.renfe.com *.booking.com https://api.pushio.com https://venta.renfe.com https://venta.renfe.com/webpush-service-worker.js dpm.demdex.net renfe.d3.sc.omtrdc.net https://renfe-tracker.airpricing.net *.tt.omtrdc.net cdn.cookielaw.org google-analytics.com https://www.google-analytics.com *.meili.travel; img-src 'self' data: https://cm.everesttech.net https://dub.stats.paypal.com/counter2.cgi https://c.paypal.com https://api.pushio.com https://phx.stats.paypal.com https://b.stats.paypal.com https://slc.stats.paypal.com *.renfe.com ssl.renfe.com *.renfe.es renfe.d3.sc.omtrdc.net dpm.demdex.net http://r-ec.bstatic.com *.bstatic.com *.scorecardresearch.com ct-supplierimage.imgix.net ct-images.imgix.net ota-cars.imgix.net d224hgl7orw28t.cloudfront.net https://www.google-analytics.com https://www.google.com https://www.google.es https://googleads.g.doubleclick.net *.googleadservices.com *.2o7.net http://s7g10.scene7.com https://s7g10.scene7.com https://bat.bing.com *.oracleinfinity.io cdn.ociotour.es *.meili.travel; style-src 'self' *.renfe.com *.bstatic.com fonts.googleapis.com d224hgl7orw28t.cloudfront.net *.gstatic.com *.meili.travel 'unsafe-inline'; font-src 'self' *.bstatic.com fonts.gstatic.com fonts.googleapis.com *.meili.travel; frame-src 'self' *.googlesyndication.com https://www.google.com https://c.paypal.com https://api.pushio.com https://venta.renfe.com https://venta.renfe.com/webpush-service-worker.js *.renfe.com *.cartrawler.com *.booking.com *.weborama.fr *.demdex.net sitecatalyst.omniture.com *.sitecatalyst.omniture.com *.adobe.com; object-src 'self'; child-src https://c.paypal.com https://venta.renfe.com https://venta.renfe.com/webpush-service-worker.js;
Content-Type
text/html; charset=UTF-8
Date
Wed, 15 Nov 2023 13:08:18 GMT
Expires
Thu, 01 Jan 1970 00:00:00 GMT
Pragma
no-cache
Server-Timing
dtSInfo;desc="1"
Strict-Transport-Security
max-age=31536000; includeSubDomains
Transfer-Encoding
chunked
X-CONTENT-TYPE-OPTIONS
nosniff
X-FRAME-OPTIONS
SAMEORIGIN
X-OneAgent-JS-Injection
true
X-XSS-PROTECTION
1; mode=block
X-ruxit-JS-Agent
true
ruxitagentjs_ICA27NQVfjqrux_10277231024135831.js
venta.renfe.com/ 		304 KB
112 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://venta.renfe.com/ruxitagentjs_ICA27NQVfjqrux_10277231024135831.js
Requested by
Host: venta.renfe.com
URL: https://venta.renfe.com/vol/passbookEmail.do?pkpass=2023-11-28/2CMXKSBCOIKNNCBDBEPIBP.pkpass
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
213.144.49.57 Madrid, Spain, ASN15937 (ADIF, ES),
Reverse DNS
w8.renfe.es
Software
/
Resource Hash
649c2e03faea27fe75607c18458a2cd49128b96dfa7d9a339fd838a078273061

Request headers

accept-language
es-ES,es;q=0.9
Referer
https://venta.renfe.com/vol/passbookEmail.do?pkpass=2023-11-28/2CMXKSBCOIKNNCBDBEPIBP.pkpass
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

Date
Wed, 15 Nov 2023 13:08:18 GMT
Content-Encoding
gzip
Last-Modified
Wed, 03 Mar 2010 07:01:40 GMT
Content-Type
text/javascript; charset=utf-8
Cache-Control
public, max-age=31536000, immutable
Connection
keep-alive
Content-Length
114058
Expires
Thu, 14 Nov 2024 13:08:18 GMT
ruxitagentjs_D_10277231024135831.js
venta.renfe.com/ 		42 KB
16 KB 		Other
General
Check archive.org
Download Go to
Full URL
https://venta.renfe.com/ruxitagentjs_D_10277231024135831.js
Requested by
Host: venta.renfe.com
URL: https://venta.renfe.com/vol/passbookEmail.do?pkpass=2023-11-28/2CMXKSBCOIKNNCBDBEPIBP.pkpass
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
213.144.49.57 Madrid, Spain, ASN15937 (ADIF, ES),
Reverse DNS
w8.renfe.es
Software
/
Resource Hash
1b75e52d570198496023f0ab87bbbc9f3f5e21161d9903585fb5f1f8035e69c9

Request headers

accept-language
es-ES,es;q=0.9
Referer
https://venta.renfe.com/vol/passbookEmail.do?pkpass=2023-11-28/2CMXKSBCOIKNNCBDBEPIBP.pkpass
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

Date
Wed, 15 Nov 2023 13:08:18 GMT
Content-Encoding
gzip
Last-Modified
Wed, 03 Mar 2010 07:01:40 GMT
Content-Type
text/javascript; charset=utf-8
Cache-Control
public, max-age=31536000, immutable
Connection
keep-alive
Content-Length
15819
Expires
Thu, 14 Nov 2024 13:08:18 GMT
2CMXKSBCOIKNNCBDBEPIBP.pkpass
w4.renfe.es/passbook/2023-11-28/ 		0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://w4.renfe.es/passbook/2023-11-28/2CMXKSBCOIKNNCBDBEPIBP.pkpass
Requested by
Host: venta.renfe.com
URL: https://venta.renfe.com/vol/passbookEmail.do?pkpass=2023-11-28/2CMXKSBCOIKNNCBDBEPIBP.pkpass
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
213.144.49.61 Madrid, Spain, ASN15937 (ADIF, ES),
Reverse DNS
w4.renfe.es
Software
nginx /
Resource Hash

Request headers

Referer
https://venta.renfe.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36
accept-language
es-ES,es;q=0.9

Response headers

Accept-Ranges
bytes
Cache-Control
no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
Connection
keep-alive
Content-Length
24596
Content-Type
application/vnd.apple.pkpass
Date
Wed, 15 Nov 2023 13:08:18 GMT
ETag
"65548cee-6014"
Last-Modified
Wed, 15 Nov 2023 09:18:38 GMT
Server
nginx
rb_bf01981lqn
venta.renfe.com/ 		121 B
719 B 		Ping
General
Check archive.org
Download Go to
Full URL
https://venta.renfe.com/rb_bf01981lqn?type=js3&sn=v_4_srv_2_sn_4C1B05B12336A1394AF83092CA8C5FAA_perc_100000_ol_0_mul_1_app-3Ac6e9bc7af60ff026_1_rcs-3Acss_0&svrid=2&flavor=post&vi=WPUCPIEMPCAABFKFOFUAAKFMKOLGDPEM-0&modifiedSince=1698954452831&rf=https%3A%2F%2Fventa.renfe.com%2Fvol%2FpassbookEmail.do%3Fpkpass%3D2023-11-28%2F2CMXKSBCOIKNNCBDBEPIBP.pkpass&bp=3&app=c6e9bc7af60ff026&crc=2211792669&en=saji59go&end=1
Requested by
Host: venta.renfe.com
URL: https://venta.renfe.com/ruxitagentjs_ICA27NQVfjqrux_10277231024135831.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
213.144.49.57 Madrid, Spain, ASN15937 (ADIF, ES),
Reverse DNS
w8.renfe.es
Software
/
Resource Hash
61d705e48f175bffa9045e908f0df0e51fd3cc79460fbb9a4fb03d58b44a9b32

Request headers

Referer
https://venta.renfe.com/vol/passbookEmail.do?pkpass=2023-11-28/2CMXKSBCOIKNNCBDBEPIBP.pkpass
accept-language
es-ES,es;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

Date
Wed, 15 Nov 2023 13:08:18 GMT
Connection
keep-alive
Content-Length
121
Content-Type
text/plain; charset=utf-8
rb_bf01981lqn
venta.renfe.com/ 		121 B
719 B 		Ping
General
Check archive.org
Download Go to
Full URL
https://venta.renfe.com/rb_bf01981lqn?type=js3&sn=v_4_srv_2_sn_4C1B05B12336A1394AF83092CA8C5FAA_perc_100000_ol_0_mul_1_app-3Ac6e9bc7af60ff026_1_rcs-3Acss_0&svrid=2&flavor=post&vi=WPUCPIEMPCAABFKFOFUAAKFMKOLGDPEM-0&modifiedSince=1698954452831&rf=https%3A%2F%2Fventa.renfe.com%2Fvol%2FpassbookEmail.do%3Fpkpass%3D2023-11-28%2F2CMXKSBCOIKNNCBDBEPIBP.pkpass&bp=3&app=c6e9bc7af60ff026&crc=3083755281&en=saji59go&end=1
Requested by
Host: venta.renfe.com
URL: https://venta.renfe.com/ruxitagentjs_ICA27NQVfjqrux_10277231024135831.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
213.144.49.57 Madrid, Spain, ASN15937 (ADIF, ES),
Reverse DNS
w8.renfe.es
Software
/
Resource Hash
61d705e48f175bffa9045e908f0df0e51fd3cc79460fbb9a4fb03d58b44a9b32

Request headers

Referer
https://venta.renfe.com/vol/passbookEmail.do?pkpass=2023-11-28/2CMXKSBCOIKNNCBDBEPIBP.pkpass
accept-language
es-ES,es;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

Date
Wed, 15 Nov 2023 13:08:20 GMT
Connection
keep-alive
Content-Length
121
Content-Type
text/plain; charset=utf-8

Verdicts & Comments Add Verdict or Comment

5 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| documentPictureInPicture object| dT_ object| dtrum object| dynatrace function| descarga

10 Cookies

Domain/Path Name / Value
venta.renfe.com/vol Name: f5avraaaaaaaaaaaaaaaa_session_
Value: EHBAPPBHMMFLIDGEMGJDNABBONAGLHAPCFNIBEFBKENJIDCGLNGFNLEICBAANNNDCNGDDNPJHCJIAADAKIHAEDNLHMBIFMNHFBIJGEFOLJINHGKKECICJFCHNGPEBEHB
venta.renfe.com/ Name: JSESSIONID
Value: 0000GGZN_5NJosh--oo4BtU2oVKvAauGS3kYwpfI3imsKef4_HdJDUyXr6v4zImcNUpmueu9Pvs0Z8rWJnrA-M2eJmQbkObAlZ4O7QlLad8gsJYX110adSHLAc6quuiJ2nta:17i393oj6
.renfe.com/ Name: dtCookie
Value: v_4_srv_2_sn_4C1B05B12336A1394AF83092CA8C5FAA_perc_100000_ol_0_mul_1_app-3Ac6e9bc7af60ff026_1_rcs-3Acss_0
.venta.renfe.com/ Name: TS018d34ad
Value: 0140223b26b27579c6d68ea18eb444a6efd18db72b4c5733441a9081b2a507f031087a27411fe6c57ec147d8365532aa26eab3370c6e2bdc5eefc2fe1038fb9aa730605b709553a0aaeeae2e34eb6efc557d344200
venta.renfe.com/ Name: f5avraaaaaaaaaaaaaaaa_session_
Value: BGPHAPPBFIEEEDAGCDHMCHCIHGIGJPBBBNAFHAEJDKPJOEKCHHPOGCNPHAJGGBNFMGJDGJLEHCICFLBFPHHALKHNHMBLEPELKHCIKDDBBEEBKKPLFJKBCOGOOHNOMLGP
.renfe.com/ Name: rxVisitor
Value: 1700053698194OM77UDSHIQOBTT5K0KHP7EP68QLNNRK2
.renfe.com/ Name: rxvt
Value: 1700055498217|1700053698195
.renfe.com/ Name: dtPC
Value: 2$253698192_714h4vWPUCPIEMPCAABFKFOFUAAKFMKOLGDPEM-0e0
.renfe.com/ Name: dtSa
Value: false%7C_load_%7C4%7C_onload_%7C-%7C1700053698217%7C253698192_714%7Chttps%3A%2F%2Fventa.renfe.com%2Fvol%2FpassbookEmail.do%3Fpkpass%3D2023-11-28%2F2CMXKSBCOIKNNCBDBEPIBP.pkpass%7C%7C%7C%7C
venta.renfe.com/ Name: TSbaeb093c027
Value: 08a16edb10ab200000441fe2abb82ede1a716e63be301706a83227cb4cf35ff7407e58d909d0d018084a4ecdf71130009bbb9b937a8ea1eab0ef265f6c16fc2a1fbf884a9c3ba45c99435796226d1c4893f2663977d180b69a29d72e3aa5a676

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Content-Security-Policy default-src 'none'; script-src 'self' *.queue-it.net https://c.paypal.com https://api.pushio.com https://venta.renfe.com https://venta.renfe.com/webpush-service-worker.js https://www.paypalobjects.com *.renfe.com renfe.d3.sc.omtrdc.net cdn.tt.omtrdc.net cdn.cookielaw.org *.serving-sys.com *.bstatic.com *.weborama.fr https://renfe-tracker.airpricing.net google-analytics.com *.gstatic.com https://www.google.com https://www.google.com https://www.googletagmanager.com https://www.googleadservices.com https://www.google-analytics.com tpc.googlesyndication.com https://googleads.g.doubleclick.net assets.adobedtm.com geolocation.onetrust.com https://www.youtube.com https://bat.bing.com *.oracleinfinity.io *.adobe.com *.meili.travel 'unsafe-inline' 'unsafe-eval'; connect-src 'self' *.renfe.com *.booking.com https://api.pushio.com https://venta.renfe.com https://venta.renfe.com/webpush-service-worker.js dpm.demdex.net renfe.d3.sc.omtrdc.net https://renfe-tracker.airpricing.net *.tt.omtrdc.net cdn.cookielaw.org google-analytics.com https://www.google-analytics.com *.meili.travel; img-src 'self' data: https://cm.everesttech.net https://dub.stats.paypal.com/counter2.cgi https://c.paypal.com https://api.pushio.com https://phx.stats.paypal.com https://b.stats.paypal.com https://slc.stats.paypal.com *.renfe.com ssl.renfe.com *.renfe.es renfe.d3.sc.omtrdc.net dpm.demdex.net http://r-ec.bstatic.com *.bstatic.com *.scorecardresearch.com ct-supplierimage.imgix.net ct-images.imgix.net ota-cars.imgix.net d224hgl7orw28t.cloudfront.net https://www.google-analytics.com https://www.google.com https://www.google.es https://googleads.g.doubleclick.net *.googleadservices.com *.2o7.net http://s7g10.scene7.com https://s7g10.scene7.com https://bat.bing.com *.oracleinfinity.io cdn.ociotour.es *.meili.travel; style-src 'self' *.renfe.com *.bstatic.com fonts.googleapis.com d224hgl7orw28t.cloudfront.net *.gstatic.com *.meili.travel 'unsafe-inline'; font-src 'self' *.bstatic.com fonts.gstatic.com fonts.googleapis.com *.meili.travel; frame-src 'self' *.googlesyndication.com https://www.google.com https://c.paypal.com https://api.pushio.com https://venta.renfe.com https://venta.renfe.com/webpush-service-worker.js *.renfe.com *.cartrawler.com *.booking.com *.weborama.fr *.demdex.net sitecatalyst.omniture.com *.sitecatalyst.omniture.com *.adobe.com; object-src 'self'; child-src https://c.paypal.com https://venta.renfe.com https://venta.renfe.com/webpush-service-worker.js;
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block