urlscan.io logo urlscan.io
SecurityTrails logo

help.nordwindairlines.ru Open in urlscan Pro
193.24.8.15  Public Scan

Go To Rescan Add Verdict Report
Submitted URL: https://refund.nordwindairlines.ru/
Effective URL: https://help.nordwindairlines.ru/forms/involuntary-change-ticket
Submission: On September 19 via automatic, source certstream-suspicious — Scanned from DE
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 8 IPs in 3 countries across 9 domains to perform 29 HTTP transactions. The main IP is 193.24.8.15, located in Russian Federation and belongs to PGSMOW-AS, RU. The main domain is help.nordwindairlines.ru.
TLS certificate: Issued by R3 on September 19th 2021. Valid for: 3 months.
This is the only time help.nordwindairlines.ru was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

17    193.24.8.15 (Russian Federation)

ASN39678 (PGSMOW-AS, RU)
refund.nordwindairlines.ru
help.nordwindairlines.ru
nordwindairlines.ru
1    2a00:1450:4001:808::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.googletagmanager.com
9    2a02:6b8::1:119 (Moscow, Russian Federation)

ASN208722 (YNDX, FI)
mc.yandex.ru
mc.yandex.com
2    2a00:1450:4001:810::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.google-analytics.com
1    2a00:1450:400c:c1b::9c (Brussels, Belgium)

ASN15169 (GOOGLE, US)
stats.g.doubleclick.net
1    2a00:1450:4001:809::2004 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.google.com
1    2a00:1450:4001:80e::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.google.de
1    85.31.120.13 (Russian Federation)

ASN39678 (PGSMOW-AS, RU)
pegast.ru
Domain Requested by
15 help.nordwindairlines.ru help.nordwindairlines.ru
7 mc.yandex.com 2 redirects help.nordwindairlines.ru
mc.yandex.ru
2 www.google-analytics.com www.googletagmanager.com
www.google-analytics.com
2 mc.yandex.ru 1 redirects help.nordwindairlines.ru
1 nordwindairlines.ru help.nordwindairlines.ru
1 pegast.ru help.nordwindairlines.ru
1 www.google.de help.nordwindairlines.ru
1 www.google.com help.nordwindairlines.ru
1 stats.g.doubleclick.net www.google-analytics.com
1 www.googletagmanager.com help.nordwindairlines.ru
1 refund.nordwindairlines.ru 1 redirects
29 11

This site contains links to these domains. Also see Links.

Domain
nordwindairlines.ru
www.facebook.com
vk.com
www.twitter.com
www.instagram.com
Subject Issuer Validity Valid
help.nordwindairlines.ru
R3		 2021-09-19 -
2021-12-18		 3 months crt.sh
*.google-analytics.com
GTS CA 1C3		 2021-08-30 -
2021-11-22		 3 months crt.sh
mc.yandex.ru
Yandex CA		 2021-07-28 -
2022-01-07		 5 months crt.sh
*.g.doubleclick.net
GTS CA 1C3		 2021-08-30 -
2021-11-22		 3 months crt.sh
www.google.com
GTS CA 1C3		 2021-08-30 -
2021-11-22		 3 months crt.sh
www.google.de
GTS CA 1C3		 2021-08-30 -
2021-11-22		 3 months crt.sh
*.pegast.ru
Thawte RSA CA 2018		 2021-07-13 -
2022-08-13		 a year crt.sh
nordwindairlines.ru
GlobalSign Extended Validation CA - SHA256 - G3		 2020-06-18 -
2022-06-19		 2 years crt.sh

This page contains 1 frames:

Primary Page: https://help.nordwindairlines.ru/forms/involuntary-change-ticket
Frame ID: 408ACAE83E1DF5D453AF1FE776680267
Requests: 29 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Центр поддержки пассажиров Nordwind Airlines

Page URL History Show full URLs

  1. https://refund.nordwindairlines.ru/ HTTP 301
    https://help.nordwindairlines.ru/forms/involuntary-change-ticket Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • <[^>]+\sdata-v(?:ue)?-
Overall confidence: 100%
Detected patterns
  • google-analytics\.com/(?:ga|urchin|analytics)\.js
Overall confidence: 100%
Detected patterns
  • googletagmanager\.com/gtag/js
Overall confidence: 100%
Detected patterns
  • mc\.yandex\.ru/metrika/(?:tag|watch)\.js

Page Statistics

29
Requests

100 %
HTTPS

75 %
IPv6

9
Domains

11
Subdomains

8
IPs

3
Countries

809 kB
Transfer

3151 kB
Size

14
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://refund.nordwindairlines.ru/ HTTP 301
    https://help.nordwindairlines.ru/forms/involuntary-change-ticket Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 17
  • https://mc.yandex.com/sync_cookie_image_check HTTP 302
  • https://mc.yandex.ru/sync_cookie_image_start?redirect_domain=mc.yandex.com&token=9401.Mf0jJZK9nlc1DtCKujnUIxgeNh9gMDGF3Xc3Jvlv5xN5ZhmYT86uYAeBXRfYRWIb.vXTp8W-iNTR8m9o0Zetin0wvTbA%2C HTTP 302
  • https://mc.yandex.com/sync_cookie_image_decide?token=9401.99hssRxcUoYVCp0hVFKYJHMG4LAIu6xEVrbNpn0jjz1a8CO9z8nhY2h21tBilY9NthQFnpz6nBaZYG0ZWB25jg%2C%2C.C4FgRiKSPs2rTEvhVOvr4Pp1g6M%2C
Request Chain 25
  • https://mc.yandex.com/watch/43824799?wmode=7&page-url=https%3A%2F%2Fhelp.nordwindairlines.ru%2Fforms%2Finvoluntary-change-ticket&charset=utf-8&browser-info=pv%3A1%3Agdpr%3A14%3Avf%3A25rt5xty9edhsiwjn9%3Afu%3A0%3Aen%3Autf-8%3Ala%3Aen-US%3Av%3A644%3Acn%3A1%3Adp%3A0%3Als%3A286921950926%3Ahid%3A599055778%3Az%3A0%3Ai%3A20210919064653%3Aet%3A1632034014%3Ac%3A1%3Arn%3A542459409%3Arqn%3A1%3Au%3A1632034014408310328%3Aw%3A1600x1200%3As%3A1600x1200x24%3Ask%3A1%3Acpf%3A1%3Ans%3A1632034012842%3Ads%3A0%2C92%2C81%2C12%2C353%2C0%2C%2C379%2C0%2C%2C%2C%2C920%3Adsn%3A0%2C92%2C81%2C12%2C353%2C0%2C%2C380%2C1%2C%2C%2C%2C919%3Awv%3A2%3Aadb%3A2%3Arqnl%3A1%3Ati%3A2%3Ast%3A1632034014%3At%3A%D0%A6%D0%B5%D0%BD%D1%82%D1%80%20%D0%BF%D0%BE%D0%B4%D0%B4%D0%B5%D1%80%D0%B6%D0%BA%D0%B8%20%D0%BF%D0%B0%D1%81%D1%81%D0%B0%D0%B6%D0%B8%D1%80%D0%BE%D0%B2%20Nordwind%20Airlines HTTP 302
  • https://mc.yandex.com/watch/43824799/1?wmode=7&page-url=https%3A%2F%2Fhelp.nordwindairlines.ru%2Fforms%2Finvoluntary-change-ticket&charset=utf-8&browser-info=pv%3A1%3Agdpr%3A14%3Avf%3A25rt5xty9edhsiwjn9%3Afu%3A0%3Aen%3Autf-8%3Ala%3Aen-US%3Av%3A644%3Acn%3A1%3Adp%3A0%3Als%3A286921950926%3Ahid%3A599055778%3Az%3A0%3Ai%3A20210919064653%3Aet%3A1632034014%3Ac%3A1%3Arn%3A542459409%3Arqn%3A1%3Au%3A1632034014408310328%3Aw%3A1600x1200%3As%3A1600x1200x24%3Ask%3A1%3Acpf%3A1%3Ans%3A1632034012842%3Ads%3A0%2C92%2C81%2C12%2C353%2C0%2C%2C379%2C0%2C%2C%2C%2C920%3Adsn%3A0%2C92%2C81%2C12%2C353%2C0%2C%2C380%2C1%2C%2C%2C%2C919%3Awv%3A2%3Aadb%3A2%3Arqnl%3A1%3Ati%3A2%3Ast%3A1632034014%3At%3A%D0%A6%D0%B5%D0%BD%D1%82%D1%80%20%D0%BF%D0%BE%D0%B4%D0%B4%D0%B5%D1%80%D0%B6%D0%BA%D0%B8%20%D0%BF%D0%B0%D1%81%D1%81%D0%B0%D0%B6%D0%B8%D1%80%D0%BE%D0%B2%20Nordwind%20Airlines

29 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request involuntary-change-ticket
help.nordwindairlines.ru/forms/
Redirect Chain
  • https://refund.nordwindairlines.ru/
  • https://help.nordwindairlines.ru/forms/involuntary-change-ticket
2 KB
1 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://help.nordwindairlines.ru/forms/involuntary-change-ticket
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
193.24.8.15 , Russian Federation, ASN39678 (PGSMOW-AS, RU),
Reverse DNS
Software
nginx /
Resource Hash
257882718344d6d0fd36f8d1c9623a2e8f06f195c4bfcf8c09073c12c02bd4ef

Request headers

:method
GET
:authority
help.nordwindairlines.ru
:scheme
https
:path
/forms/involuntary-change-ticket
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
accept-language
de-DE,de;q=0.9
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
none
sec-fetch-mode
navigate
sec-fetch-user
?1
sec-fetch-dest
document
accept-encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Accept-Language
de-DE,de;q=0.9

Response headers

server
nginx
date
Sun, 19 Sep 2021 06:46:53 GMT
content-type
text/html; charset=UTF-8
vary
Accept-Encoding
cache-control
max-age=0, must-revalidate, private
expires
Sun, 19 Sep 2021 06:46:53 GMT
content-encoding
gzip

Redirect headers

server
nginx
date
Sun, 19 Sep 2021 06:46:53 GMT
content-type
text/html
content-length
162
location
https://help.nordwindairlines.ru/forms/involuntary-change-ticket
js
www.googletagmanager.com/gtag/ 		99 KB
40 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagmanager.com/gtag/js?id=UA-111725868-1
Requested by
Host: help.nordwindairlines.ru
URL: https://help.nordwindairlines.ru/forms/involuntary-change-ticket
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:808::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
d7a42c8860a5f336baa81f03ef68d84fe3214edc3194d9692a542fc2df1de16e
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://help.nordwindairlines.ru/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date
Sun, 19 Sep 2021 06:46:53 GMT
content-encoding
br
vary
Accept-Encoding
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
40342
x-xss-protection
0
last-modified
Sun, 19 Sep 2021 06:00:00 GMT
server
Google Tag Manager
strict-transport-security
max-age=31536000; includeSubDomains
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
access-control-allow-headers
Cache-Control
expires
Sun, 19 Sep 2021 06:46:53 GMT
errors-collector.js
help.nordwindairlines.ru/build/ 		499 B
397 B 		Script
General
Check archive.org
Download Go to
Full URL
https://help.nordwindairlines.ru/build/errors-collector.js
Requested by
Host: help.nordwindairlines.ru
URL: https://help.nordwindairlines.ru/forms/involuntary-change-ticket
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
193.24.8.15 , Russian Federation, ASN39678 (PGSMOW-AS, RU),
Reverse DNS
Software
nginx /
Resource Hash
19d7014b520cbaaab3eb9307788cc9f2c22f9bfb3893607c654eab60432b4143

Request headers

:path
/build/errors-collector.js
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
de-DE,de;q=0.9
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode
no-cors
accept
*/*
cache-control
no-cache
sec-fetch-dest
script
:authority
help.nordwindairlines.ru
referer
https://help.nordwindairlines.ru/forms/involuntary-change-ticket
:scheme
https
sec-fetch-site
same-origin
:method
GET
Accept-Language
de-DE,de;q=0.9
Referer
https://help.nordwindairlines.ru/forms/involuntary-change-ticket
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date
Sun, 19 Sep 2021 06:46:53 GMT
content-encoding
gzip
last-modified
Wed, 15 Sep 2021 11:18:36 GMT
server
nginx
etag
W/"6141d68c-1f3"
vary
Accept-Encoding
content-type
application/javascript
layout.46fdf56c.css
help.nordwindairlines.ru/build/ 		13 KB
3 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://help.nordwindairlines.ru/build/layout.46fdf56c.css
Requested by
Host: help.nordwindairlines.ru
URL: https://help.nordwindairlines.ru/forms/involuntary-change-ticket
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
193.24.8.15 , Russian Federation, ASN39678 (PGSMOW-AS, RU),
Reverse DNS
Software
nginx /
Resource Hash
b784272247b90a8d77245ebc858cf4698416d37cd123e98fcaccee83e3c013e7

Request headers

:path
/build/layout.46fdf56c.css
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
de-DE,de;q=0.9
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode
no-cors
accept
text/css,*/*;q=0.1
cache-control
no-cache
sec-fetch-dest
style
:authority
help.nordwindairlines.ru
referer
https://help.nordwindairlines.ru/forms/involuntary-change-ticket
:scheme
https
sec-fetch-site
same-origin
:method
GET
Accept-Language
de-DE,de;q=0.9
Referer
https://help.nordwindairlines.ru/forms/involuntary-change-ticket
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date
Sun, 19 Sep 2021 06:46:53 GMT
content-encoding
gzip
last-modified
Wed, 15 Sep 2021 11:18:36 GMT
server
nginx
etag
W/"6141d68c-34b6"
vary
Accept-Encoding
content-type
text/css
help-center.f618bfbc.css
help.nordwindairlines.ru/build/ 		77 KB
13 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://help.nordwindairlines.ru/build/help-center.f618bfbc.css
Requested by
Host: help.nordwindairlines.ru
URL: https://help.nordwindairlines.ru/forms/involuntary-change-ticket
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
193.24.8.15 , Russian Federation, ASN39678 (PGSMOW-AS, RU),
Reverse DNS
Software
nginx /
Resource Hash
a5161af8b0e643abce3db648ea0871874dfd98b701198cdcf8a53475e8342159

Request headers

:path
/build/help-center.f618bfbc.css
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
de-DE,de;q=0.9
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode
no-cors
accept
text/css,*/*;q=0.1
cache-control
no-cache
sec-fetch-dest
style
:authority
help.nordwindairlines.ru
referer
https://help.nordwindairlines.ru/forms/involuntary-change-ticket
:scheme
https
sec-fetch-site
same-origin
:method
GET
Accept-Language
de-DE,de;q=0.9
Referer
https://help.nordwindairlines.ru/forms/involuntary-change-ticket
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date
Sun, 19 Sep 2021 06:46:53 GMT
content-encoding
gzip
last-modified
Wed, 15 Sep 2021 11:18:36 GMT
server
nginx
etag
W/"6141d68c-13288"
vary
Accept-Encoding
content-type
text/css
runtime.8ff049be.js
help.nordwindairlines.ru/build/ 		16 KB
4 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://help.nordwindairlines.ru/build/runtime.8ff049be.js
Requested by
Host: help.nordwindairlines.ru
URL: https://help.nordwindairlines.ru/forms/involuntary-change-ticket
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
193.24.8.15 , Russian Federation, ASN39678 (PGSMOW-AS, RU),
Reverse DNS
Software
nginx /
Resource Hash
cfff9f11b96ec686086f06cf5089585790fe90d07646f90e9790713f97975124

Request headers

:path
/build/runtime.8ff049be.js
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
de-DE,de;q=0.9
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode
no-cors
accept
*/*
cache-control
no-cache
sec-fetch-dest
script
:authority
help.nordwindairlines.ru
referer
https://help.nordwindairlines.ru/forms/involuntary-change-ticket
:scheme
https
sec-fetch-site
same-origin
:method
GET
Accept-Language
de-DE,de;q=0.9
Referer
https://help.nordwindairlines.ru/forms/involuntary-change-ticket
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date
Sun, 19 Sep 2021 06:46:53 GMT
content-encoding
gzip
last-modified
Wed, 15 Sep 2021 11:18:36 GMT
server
nginx
etag
W/"6141d68c-4047"
vary
Accept-Encoding
content-type
application/javascript
vendor.01141f95.js
help.nordwindairlines.ru/build/ 		153 KB
50 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://help.nordwindairlines.ru/build/vendor.01141f95.js
Requested by
Host: help.nordwindairlines.ru
URL: https://help.nordwindairlines.ru/forms/involuntary-change-ticket
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
193.24.8.15 , Russian Federation, ASN39678 (PGSMOW-AS, RU),
Reverse DNS
Software
nginx /
Resource Hash
fbc4ea4f5aeaeb3ad701d6d0e1512a2d040c7e0213e4d3e786cec8b9a401ecb2

Request headers

:path
/build/vendor.01141f95.js
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
de-DE,de;q=0.9
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode
no-cors
accept
*/*
cache-control
no-cache
sec-fetch-dest
script
:authority
help.nordwindairlines.ru
referer
https://help.nordwindairlines.ru/forms/involuntary-change-ticket
:scheme
https
sec-fetch-site
same-origin
:method
GET
Accept-Language
de-DE,de;q=0.9
Referer
https://help.nordwindairlines.ru/forms/involuntary-change-ticket
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date
Sun, 19 Sep 2021 06:46:53 GMT
content-encoding
gzip
last-modified
Wed, 15 Sep 2021 11:18:36 GMT
server
nginx
etag
W/"6141d68c-262cf"
vary
Accept-Encoding
content-type
application/javascript
layout.0c4418fe.js
help.nordwindairlines.ru/build/ 		4 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://help.nordwindairlines.ru/build/layout.0c4418fe.js
Requested by
Host: help.nordwindairlines.ru
URL: https://help.nordwindairlines.ru/forms/involuntary-change-ticket
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
193.24.8.15 , Russian Federation, ASN39678 (PGSMOW-AS, RU),
Reverse DNS
Software
nginx /
Resource Hash
ec4b3af947c159dff0270b01c45f773199798195817d24ae8b017550cf1e8bb2

Request headers

:path
/build/layout.0c4418fe.js
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
de-DE,de;q=0.9
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode
no-cors
accept
*/*
cache-control
no-cache
sec-fetch-dest
script
:authority
help.nordwindairlines.ru
referer
https://help.nordwindairlines.ru/forms/involuntary-change-ticket
:scheme
https
sec-fetch-site
same-origin
:method
GET
Accept-Language
de-DE,de;q=0.9
Referer
https://help.nordwindairlines.ru/forms/involuntary-change-ticket
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date
Sun, 19 Sep 2021 06:46:53 GMT
content-encoding
gzip
last-modified
Wed, 15 Sep 2021 11:18:36 GMT
server
nginx
etag
W/"6141d68c-e8d"
vary
Accept-Encoding
content-type
application/javascript
help-center.24c3f3e1.js
help.nordwindairlines.ru/build/ 		2 MB
465 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://help.nordwindairlines.ru/build/help-center.24c3f3e1.js
Requested by
Host: help.nordwindairlines.ru
URL: https://help.nordwindairlines.ru/forms/involuntary-change-ticket
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
193.24.8.15 , Russian Federation, ASN39678 (PGSMOW-AS, RU),
Reverse DNS
Software
nginx /
Resource Hash
94e7d8bdb7d164d43b3ccbee2373be17dccc020e9dd472afee452e836711d918

Request headers

:path
/build/help-center.24c3f3e1.js
pragma
no-cache
accept-encoding
gzip, deflate, br
accept-language
de-DE,de;q=0.9
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode
no-cors
accept
*/*
cache-control
no-cache
sec-fetch-dest
script
:authority
help.nordwindairlines.ru
referer
https://help.nordwindairlines.ru/forms/involuntary-change-ticket
:scheme
https
sec-fetch-site
same-origin
:method
GET
Accept-Language
de-DE,de;q=0.9
Referer
https://help.nordwindairlines.ru/forms/involuntary-change-ticket
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date
Sun, 19 Sep 2021 06:46:53 GMT
content-encoding
gzip
last-modified
Wed, 15 Sep 2021 11:18:36 GMT
server
nginx
etag
W/"6141d68c-258511"
vary
Accept-Encoding
content-type
application/javascript
tag.js
mc.yandex.ru/metrika/ 		191 KB
65 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://mc.yandex.ru/metrika/tag.js
Requested by
Host: help.nordwindairlines.ru
URL: https://help.nordwindairlines.ru/forms/involuntary-change-ticket
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:6b8::1:119 Moscow, Russian Federation, ASN208722 (YNDX, FI),
Reverse DNS
Software
/
Resource Hash
8a9820e7a05173822b9285ee2c2815e16b058bd2c40bc7ca8ba5387f7a6840ae
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://help.nordwindairlines.ru/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date
Sun, 19 Sep 2021 06:46:53 GMT
content-encoding
br
last-modified
Thu, 16 Sep 2021 17:17:01 GMT
etag
"614351dd-1031b"
strict-transport-security
max-age=31536000
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=3600
content-length
66331
expires
Sun, 19 Sep 2021 07:46:53 GMT
analytics.js
www.google-analytics.com/ 		48 KB
20 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.google-analytics.com/analytics.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=UA-111725868-1
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:810::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
fd222137f245c06ddb4c4d44db41f12138dad6cf8ef5d4d4a5e500f38f0c8c62
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://help.nordwindairlines.ru/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

strict-transport-security
max-age=10886400; includeSubDomains; preload
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Wed, 11 Aug 2021 00:32:57 GMT
server
Golfe2
age
7196
date
Sun, 19 Sep 2021 04:46:57 GMT
vary
Accept-Encoding
content-type
text/javascript
cache-control
public, max-age=7200
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
19747
expires
Sun, 19 Sep 2021 06:46:57 GMT
collect
www.google-analytics.com/j/ 		2 B
213 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://www.google-analytics.com/j/collect?v=1&_v=j93&a=1326540394&t=pageview&_s=1&dl=https%3A%2F%2Fhelp.nordwindairlines.ru%2Fforms%2Finvoluntary-change-ticket&ul=en-us&de=UTF-8&dt=%D0%A6%D0%B5%D0%BD%D1%82%D1%80%20%D0%BF%D0%BE%D0%B4%D0%B4%D0%B5%D1%80%D0%B6%D0%BA%D0%B8%20%D0%BF%D0%B0%D1%81%D1%81%D0%B0%D0%B6%D0%B8%D1%80%D0%BE%D0%B2%20Nordwind%20Airlines&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YEBAAUABAAAAAC~&jid=433988368&gjid=1807671418&cid=748866317.1632034014&tid=UA-111725868-1&_gid=1455932732.1632034014&_r=1&gtm=2ou9f0&z=1070382128
Requested by
Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:810::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
de3246094525b21a870fc7d2a67490d0132535c6fa5993755c549f1a9d1bd8af
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://help.nordwindairlines.ru/
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Sun, 19 Sep 2021 06:46:53 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://help.nordwindairlines.ru
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
2
expires
Fri, 01 Jan 1990 00:00:00 GMT
collect
stats.g.doubleclick.net/j/ 		4 B
469 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j93&tid=UA-111725868-1&cid=748866317.1632034014&jid=433988368&gjid=1807671418&_gid=1455932732.1632034014&_u=YEBAAUAAAAAAAC~&z=818635141
Requested by
Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:400c:c1b::9c Brussels, Belgium, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://help.nordwindairlines.ru/
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
strict-transport-security
max-age=10886400; includeSubDomains; preload
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
date
Sun, 19 Sep 2021 06:46:53 GMT
content-type
text/plain
access-control-allow-origin
https://help.nordwindairlines.ru
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
4
expires
Fri, 01 Jan 1990 00:00:00 GMT
ga-audiences
www.google.com/ads/ 		42 B
522 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.com/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j93&tid=UA-111725868-1&cid=748866317.1632034014&jid=433988368&_u=YEBAAUAAAAAAAC~&z=535070601
Requested by
Host: help.nordwindairlines.ru
URL: https://help.nordwindairlines.ru/forms/involuntary-change-ticket
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:809::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://help.nordwindairlines.ru/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

pragma
no-cache
date
Sun, 19 Sep 2021 06:46:53 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
ga-audiences
www.google.de/ads/ 		42 B
522 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.de/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j93&tid=UA-111725868-1&cid=748866317.1632034014&jid=433988368&_u=YEBAAUAAAAAAAC~&z=535070601
Requested by
Host: help.nordwindairlines.ru
URL: https://help.nordwindairlines.ru/forms/involuntary-change-ticket
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80e::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://help.nordwindairlines.ru/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

pragma
no-cache
date
Sun, 19 Sep 2021 06:46:53 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
Rubik-Regular.aa35cb84.woff2
help.nordwindairlines.ru/build/fonts/ 		56 KB
56 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://help.nordwindairlines.ru/build/fonts/Rubik-Regular.aa35cb84.woff2
Requested by
Host: help.nordwindairlines.ru
URL: https://help.nordwindairlines.ru/build/layout.46fdf56c.css
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
193.24.8.15 , Russian Federation, ASN39678 (PGSMOW-AS, RU),
Reverse DNS
Software
nginx /
Resource Hash
d67dd51b180fe903455c28ee0ec97dbd28180b1dda8dfbfc1f65d2d7986b60ac

Request headers

sec-fetch-mode
cors
origin
https://help.nordwindairlines.ru
accept-encoding
gzip, deflate, br
accept-language
de-DE,de;q=0.9
sec-fetch-dest
font
cookie
_ga=GA1.2.748866317.1632034014; _gid=GA1.2.1455932732.1632034014; _gat_gtag_UA_111725868_1=1
:path
/build/fonts/Rubik-Regular.aa35cb84.woff2
pragma
no-cache
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
accept
*/*
cache-control
no-cache
:authority
help.nordwindairlines.ru
referer
https://help.nordwindairlines.ru/build/layout.46fdf56c.css
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://help.nordwindairlines.ru/build/layout.46fdf56c.css
Origin
https://help.nordwindairlines.ru
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date
Sun, 19 Sep 2021 06:46:53 GMT
last-modified
Wed, 15 Sep 2021 11:18:36 GMT
server
nginx
accept-ranges
bytes
etag
"6141d68c-dffc"
content-length
57340
content-type
font/woff2
symbols.svg
help.nordwindairlines.ru/build/ 		21 KB
22 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://help.nordwindairlines.ru/build/symbols.svg
Requested by
Host: help.nordwindairlines.ru
URL: https://help.nordwindairlines.ru/build/vendor.01141f95.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
193.24.8.15 , Russian Federation, ASN39678 (PGSMOW-AS, RU),
Reverse DNS
Software
nginx /
Resource Hash
7f1d926eef248dcbac8a6a624f8cd1d293df8bb8fc3728727266ec39f02acddb

Request headers

:path
/build/symbols.svg
pragma
no-cache
cookie
_ga=GA1.2.748866317.1632034014; _gid=GA1.2.1455932732.1632034014; _gat_gtag_UA_111725868_1=1
accept-encoding
gzip, deflate, br
accept-language
de-DE,de;q=0.9
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode
cors
accept
*/*
cache-control
no-cache
sec-fetch-dest
empty
:authority
help.nordwindairlines.ru
referer
https://help.nordwindairlines.ru/forms/involuntary-change-ticket
:scheme
https
sec-fetch-site
same-origin
:method
GET
Accept-Language
de-DE,de;q=0.9
Referer
https://help.nordwindairlines.ru/forms/involuntary-change-ticket
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date
Sun, 19 Sep 2021 06:46:53 GMT
last-modified
Wed, 15 Sep 2021 11:18:36 GMT
server
nginx
accept-ranges
bytes
etag
"6141d68c-55c6"
content-length
21958
content-type
image/svg+xml
ru.cd856ce3.js
help.nordwindairlines.ru/build/translations/interface_nordwind/ 		4 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://help.nordwindairlines.ru/build/translations/interface_nordwind/ru.cd856ce3.js
Requested by
Host: help.nordwindairlines.ru
URL: https://help.nordwindairlines.ru/build/runtime.8ff049be.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
193.24.8.15 , Russian Federation, ASN39678 (PGSMOW-AS, RU),
Reverse DNS
Software
nginx /
Resource Hash
7aca6a2d961ed7b69a19ee809e53fb8c42852612515d0ec161cb1b39f918a7fc

Request headers

:path
/build/translations/interface_nordwind/ru.cd856ce3.js
pragma
no-cache
cookie
_ga=GA1.2.748866317.1632034014; _gid=GA1.2.1455932732.1632034014; _gat_gtag_UA_111725868_1=1
accept-encoding
gzip, deflate, br
accept-language
de-DE,de;q=0.9
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode
no-cors
accept
*/*
cache-control
no-cache
sec-fetch-dest
script
:authority
help.nordwindairlines.ru
referer
https://help.nordwindairlines.ru/forms/involuntary-change-ticket
:scheme
https
sec-fetch-site
same-origin
:method
GET
Accept-Language
de-DE,de;q=0.9
Referer
https://help.nordwindairlines.ru/forms/involuntary-change-ticket
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date
Sun, 19 Sep 2021 06:46:53 GMT
content-encoding
gzip
last-modified
Wed, 15 Sep 2021 11:18:36 GMT
server
nginx
etag
W/"6141d68c-edc"
vary
Accept-Encoding
content-type
application/javascript
sync_cookie_image_decide
mc.yandex.com/
Redirect Chain
  • https://mc.yandex.com/sync_cookie_image_check
  • https://mc.yandex.ru/sync_cookie_image_start?redirect_domain=mc.yandex.com&token=9401.Mf0jJZK9nlc1DtCKujnUIxgeNh9gMDGF3Xc3Jvlv5xN5ZhmYT86uYAeBXRfYRWIb.vXTp8W-iNTR8m9o0Zetin0wvTbA%2C
  • https://mc.yandex.com/sync_cookie_image_decide?token=9401.99hssRxcUoYVCp0hVFKYJHMG4LAIu6xEVrbNpn0jjz1a8CO9z8nhY2h21tBilY9NthQFnpz6nBaZYG0ZWB25jg%2C%2C.C4FgRiKSPs2rTEvhVOvr4Pp1g6M%2C
75 B
75 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://mc.yandex.com/sync_cookie_image_decide?token=9401.99hssRxcUoYVCp0hVFKYJHMG4LAIu6xEVrbNpn0jjz1a8CO9z8nhY2h21tBilY9NthQFnpz6nBaZYG0ZWB25jg%2C%2C.C4FgRiKSPs2rTEvhVOvr4Pp1g6M%2C
Requested by
Host: help.nordwindairlines.ru
URL: https://help.nordwindairlines.ru/forms/involuntary-change-ticket
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:6b8::1:119 Moscow, Russian Federation, ASN208722 (YNDX, FI),
Reverse DNS
Software
/
Resource Hash
8398a026313c016324f186d1c9b24a46813109d4bc5477d910a683079cbf1434
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Xss-Protection 1; mode=block

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://help.nordwindairlines.ru/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date
Sun, 19 Sep 2021 06:46:53 GMT
strict-transport-security
max-age=31536000
content-length
75
x-xss-protection
1; mode=block
content-type
text/html; charset=utf-8

Redirect headers

location
https://mc.yandex.com/sync_cookie_image_decide?token=9401.99hssRxcUoYVCp0hVFKYJHMG4LAIu6xEVrbNpn0jjz1a8CO9z8nhY2h21tBilY9NthQFnpz6nBaZYG0ZWB25jg%2C%2C.C4FgRiKSPs2rTEvhVOvr4Pp1g6M%2C
date
Sun, 19 Sep 2021 06:46:53 GMT
strict-transport-security
max-age=31536000
x-xss-protection
1; mode=block
advert.gif
mc.yandex.com/metrika/ 		43 B
112 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://mc.yandex.com/metrika/advert.gif
Requested by
Host: help.nordwindairlines.ru
URL: https://help.nordwindairlines.ru/forms/involuntary-change-ticket
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:6b8::1:119 Moscow, Russian Federation, ASN208722 (YNDX, FI),
Reverse DNS
Software
/
Resource Hash
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://help.nordwindairlines.ru/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date
Sun, 19 Sep 2021 06:46:53 GMT
last-modified
Thu, 16 Sep 2021 17:17:01 GMT
etag
"614349a8-2b"
strict-transport-security
max-age=31536000
content-type
image/gif
access-control-allow-origin
*
cache-control
max-age=3600
accept-ranges
bytes
content-length
43
expires
Sun, 19 Sep 2021 07:46:53 GMT
en.5cf5792c.js
help.nordwindairlines.ru/build/translations/interface_nordwind/ 		178 B
303 B 		Script
General
Check archive.org
Download Go to
Full URL
https://help.nordwindairlines.ru/build/translations/interface_nordwind/en.5cf5792c.js
Requested by
Host: help.nordwindairlines.ru
URL: https://help.nordwindairlines.ru/build/runtime.8ff049be.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
193.24.8.15 , Russian Federation, ASN39678 (PGSMOW-AS, RU),
Reverse DNS
Software
nginx /
Resource Hash
312f78cbf0f17d4e246df361b524dc97d61365a600db3ab0fc22cc5b6887b0e6

Request headers

:path
/build/translations/interface_nordwind/en.5cf5792c.js
pragma
no-cache
cookie
_ga=GA1.2.748866317.1632034014; _gid=GA1.2.1455932732.1632034014; _gat_gtag_UA_111725868_1=1; _ym_uid=1632034014408310328; _ym_d=1632034014
accept-encoding
gzip, deflate, br
accept-language
de-DE,de;q=0.9
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode
no-cors
accept
*/*
cache-control
no-cache
sec-fetch-dest
script
:authority
help.nordwindairlines.ru
referer
https://help.nordwindairlines.ru/forms/involuntary-change-ticket
:scheme
https
sec-fetch-site
same-origin
:method
GET
Accept-Language
de-DE,de;q=0.9
Referer
https://help.nordwindairlines.ru/forms/involuntary-change-ticket
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date
Sun, 19 Sep 2021 06:46:53 GMT
content-encoding
gzip
last-modified
Wed, 15 Sep 2021 11:18:36 GMT
server
nginx
etag
W/"6141d68c-b2"
vary
Accept-Encoding
content-type
application/javascript
NotFound.09d71148.css
help.nordwindairlines.ru/build/ 		217 B
293 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://help.nordwindairlines.ru/build/NotFound.09d71148.css
Requested by
Host: help.nordwindairlines.ru
URL: https://help.nordwindairlines.ru/build/runtime.8ff049be.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
193.24.8.15 , Russian Federation, ASN39678 (PGSMOW-AS, RU),
Reverse DNS
Software
nginx /
Resource Hash
879f894da2b9a70fc4336988cad4ab8a4b42f3523de3fb9ee6fe1b47d3b9642f

Request headers

:path
/build/NotFound.09d71148.css
pragma
no-cache
cookie
_ga=GA1.2.748866317.1632034014; _gid=GA1.2.1455932732.1632034014; _gat_gtag_UA_111725868_1=1; _ym_uid=1632034014408310328; _ym_d=1632034014
accept-encoding
gzip, deflate, br
accept-language
de-DE,de;q=0.9
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode
no-cors
accept
text/css,*/*;q=0.1
cache-control
no-cache
sec-fetch-dest
style
:authority
help.nordwindairlines.ru
referer
https://help.nordwindairlines.ru/forms/involuntary-change-ticket
:scheme
https
sec-fetch-site
same-origin
:method
GET
Accept-Language
de-DE,de;q=0.9
Referer
https://help.nordwindairlines.ru/forms/involuntary-change-ticket
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date
Sun, 19 Sep 2021 06:46:53 GMT
content-encoding
gzip
last-modified
Wed, 15 Sep 2021 11:18:36 GMT
server
nginx
etag
W/"6141d68c-d9"
vary
Accept-Encoding
content-type
text/css
NotFound.0ba71350.js
help.nordwindairlines.ru/build/ 		1 KB
811 B 		Script
General
Check archive.org
Download Go to
Full URL
https://help.nordwindairlines.ru/build/NotFound.0ba71350.js
Requested by
Host: help.nordwindairlines.ru
URL: https://help.nordwindairlines.ru/build/runtime.8ff049be.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
193.24.8.15 , Russian Federation, ASN39678 (PGSMOW-AS, RU),
Reverse DNS
Software
nginx /
Resource Hash
5d5ce58ea6186ba103c74fcdfcaa6d662c57c272f110783bb304d30da6a0726c

Request headers

:path
/build/NotFound.0ba71350.js
pragma
no-cache
cookie
_ga=GA1.2.748866317.1632034014; _gid=GA1.2.1455932732.1632034014; _gat_gtag_UA_111725868_1=1; _ym_uid=1632034014408310328; _ym_d=1632034014
accept-encoding
gzip, deflate, br
accept-language
de-DE,de;q=0.9
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode
no-cors
accept
*/*
cache-control
no-cache
sec-fetch-dest
script
:authority
help.nordwindairlines.ru
referer
https://help.nordwindairlines.ru/forms/involuntary-change-ticket
:scheme
https
sec-fetch-site
same-origin
:method
GET
Accept-Language
de-DE,de;q=0.9
Referer
https://help.nordwindairlines.ru/forms/involuntary-change-ticket
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date
Sun, 19 Sep 2021 06:46:53 GMT
content-encoding
gzip
last-modified
Wed, 15 Sep 2021 11:18:36 GMT
server
nginx
etag
W/"6141d68c-52d"
vary
Accept-Encoding
content-type
application/javascript
logo-nordwind.png
pegast.ru/static/nordwind/logos/header/ 		4 KB
5 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pegast.ru/static/nordwind/logos/header/logo-nordwind.png
Requested by
Host: help.nordwindairlines.ru
URL: https://help.nordwindairlines.ru/forms/involuntary-change-ticket
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
85.31.120.13 , Russian Federation, ASN39678 (PGSMOW-AS, RU),
Reverse DNS
Software
nginx /
Resource Hash
31c2e7037bac5f31cba6d2269815ca6f63ad678147d707292a35c818d4101a42

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://help.nordwindairlines.ru/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Date
Sun, 19 Sep 2021 06:46:54 GMT
Last-Modified
Fri, 01 Mar 2019 12:11:45 GMT
Server
nginx
ETag
"5c792181-1165"
Content-Type
image/png
Cache-Control
max-age=315360000, public, must-revalidate
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
4453
Expires
Thu, 31 Dec 2037 23:55:55 GMT
logo-iata.svg
nordwindairlines.ru/static/nordwind/logos/ 		2 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://nordwindairlines.ru/static/nordwind/logos/logo-iata.svg
Requested by
Host: help.nordwindairlines.ru
URL: https://help.nordwindairlines.ru/build/help-center.f618bfbc.css
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
193.24.8.15 , Russian Federation, ASN39678 (PGSMOW-AS, RU),
Reverse DNS
Software
nginx /
Resource Hash
7aca715337c5ac63f1ce3d9cbe7569648fab8d926a1f548a603fa2470bacfea9
Security Headers
Name Value
Strict-Transport-Security max-age=31536000;

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://help.nordwindairlines.ru/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date
Sun, 19 Sep 2021 06:46:54 GMT
last-modified
Wed, 03 Oct 2018 13:15:37 GMT
server
nginx
etag
"5bb4c0f9-6d7"
strict-transport-security
max-age=31536000;
content-type
image/svg+xml
access-control-allow-origin
*
accept-ranges
bytes
content-length
1751
Rubik-Medium.47aac389.woff2
help.nordwindairlines.ru/build/fonts/ 		57 KB
57 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://help.nordwindairlines.ru/build/fonts/Rubik-Medium.47aac389.woff2
Requested by
Host: help.nordwindairlines.ru
URL: https://help.nordwindairlines.ru/build/layout.46fdf56c.css
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
193.24.8.15 , Russian Federation, ASN39678 (PGSMOW-AS, RU),
Reverse DNS
Software
nginx /
Resource Hash
da9e337aad4567126172a44368cf7ed12b32154c31a577d4778605bbe2a30848

Request headers

sec-fetch-mode
cors
origin
https://help.nordwindairlines.ru
accept-encoding
gzip, deflate, br
accept-language
de-DE,de;q=0.9
sec-fetch-dest
font
cookie
_ga=GA1.2.748866317.1632034014; _gid=GA1.2.1455932732.1632034014; _gat_gtag_UA_111725868_1=1; _ym_uid=1632034014408310328; _ym_d=1632034014
:path
/build/fonts/Rubik-Medium.47aac389.woff2
pragma
no-cache
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
accept
*/*
cache-control
no-cache
:authority
help.nordwindairlines.ru
referer
https://help.nordwindairlines.ru/build/layout.46fdf56c.css
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://help.nordwindairlines.ru/build/layout.46fdf56c.css
Origin
https://help.nordwindairlines.ru
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date
Sun, 19 Sep 2021 06:46:53 GMT
last-modified
Wed, 15 Sep 2021 11:18:36 GMT
server
nginx
accept-ranges
bytes
etag
"6141d68c-e47c"
content-length
58492
content-type
font/woff2
1
mc.yandex.com/watch/43824799/
Redirect Chain
  • https://mc.yandex.com/watch/43824799?wmode=7&page-url=https%3A%2F%2Fhelp.nordwindairlines.ru%2Fforms%2Finvoluntary-change-ticket&charset=utf-8&browser-info=pv%3A1%3Agdpr%3A14%3Avf%3A25rt5xty9edhsiw...
  • https://mc.yandex.com/watch/43824799/1?wmode=7&page-url=https%3A%2F%2Fhelp.nordwindairlines.ru%2Fforms%2Finvoluntary-change-ticket&charset=utf-8&browser-info=pv%3A1%3Agdpr%3A14%3Avf%3A25rt5xty9edhs...
385 B
467 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://mc.yandex.com/watch/43824799/1?wmode=7&page-url=https%3A%2F%2Fhelp.nordwindairlines.ru%2Fforms%2Finvoluntary-change-ticket&charset=utf-8&browser-info=pv%3A1%3Agdpr%3A14%3Avf%3A25rt5xty9edhsiwjn9%3Afu%3A0%3Aen%3Autf-8%3Ala%3Aen-US%3Av%3A644%3Acn%3A1%3Adp%3A0%3Als%3A286921950926%3Ahid%3A599055778%3Az%3A0%3Ai%3A20210919064653%3Aet%3A1632034014%3Ac%3A1%3Arn%3A542459409%3Arqn%3A1%3Au%3A1632034014408310328%3Aw%3A1600x1200%3As%3A1600x1200x24%3Ask%3A1%3Acpf%3A1%3Ans%3A1632034012842%3Ads%3A0%2C92%2C81%2C12%2C353%2C0%2C%2C379%2C0%2C%2C%2C%2C920%3Adsn%3A0%2C92%2C81%2C12%2C353%2C0%2C%2C380%2C1%2C%2C%2C%2C919%3Awv%3A2%3Aadb%3A2%3Arqnl%3A1%3Ati%3A2%3Ast%3A1632034014%3At%3A%D0%A6%D0%B5%D0%BD%D1%82%D1%80%20%D0%BF%D0%BE%D0%B4%D0%B4%D0%B5%D1%80%D0%B6%D0%BA%D0%B8%20%D0%BF%D0%B0%D1%81%D1%81%D0%B0%D0%B6%D0%B8%D1%80%D0%BE%D0%B2%20Nordwind%20Airlines
Requested by
Host: help.nordwindairlines.ru
URL: https://help.nordwindairlines.ru/forms/involuntary-change-ticket
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:6b8::1:119 Moscow, Russian Federation, ASN208722 (YNDX, FI),
Reverse DNS
Software
/
Resource Hash
eb279457c110d167e143903c82efe947d0f68f2d9e441ad15ad942d7c35ce5ef
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://help.nordwindairlines.ru/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

pragma
no-cache
date
Sun, 19 Sep 2021 06:46:54 GMT
x-content-type-options
nosniff
last-modified
Sun, 19-Sep-2021 06:46:54 GMT
strict-transport-security
max-age=31536000
content-type
application/json; charset=utf-8
access-control-allow-origin
https://help.nordwindairlines.ru
cache-control
private, no-cache, no-store, must-revalidate, max-age=0
access-control-allow-credentials
true
content-length
385
x-xss-protection
1; mode=block
expires
Sun, 19-Sep-2021 06:46:54 GMT

Redirect headers

pragma
no-cache
date
Sun, 19 Sep 2021 06:46:54 GMT
last-modified
Sun, 19-Sep-2021 06:46:54 GMT
location
/watch/43824799/1?wmode=7&page-url=https%3A%2F%2Fhelp.nordwindairlines.ru%2Fforms%2Finvoluntary-change-ticket&charset=utf-8&browser-info=pv%3A1%3Agdpr%3A14%3Avf%3A25rt5xty9edhsiwjn9%3Afu%3A0%3Aen%3Autf-8%3Ala%3Aen-US%3Av%3A644%3Acn%3A1%3Adp%3A0%3Als%3A286921950926%3Ahid%3A599055778%3Az%3A0%3Ai%3A20210919064653%3Aet%3A1632034014%3Ac%3A1%3Arn%3A542459409%3Arqn%3A1%3Au%3A1632034014408310328%3Aw%3A1600x1200%3As%3A1600x1200x24%3Ask%3A1%3Acpf%3A1%3Ans%3A1632034012842%3Ads%3A0%2C92%2C81%2C12%2C353%2C0%2C%2C379%2C0%2C%2C%2C%2C920%3Adsn%3A0%2C92%2C81%2C12%2C353%2C0%2C%2C380%2C1%2C%2C%2C%2C919%3Awv%3A2%3Aadb%3A2%3Arqnl%3A1%3Ati%3A2%3Ast%3A1632034014%3At%3A%D0%A6%D0%B5%D0%BD%D1%82%D1%80%20%D0%BF%D0%BE%D0%B4%D0%B4%D0%B5%D1%80%D0%B6%D0%BA%D0%B8%20%D0%BF%D0%B0%D1%81%D1%81%D0%B0%D0%B6%D0%B8%D1%80%D0%BE%D0%B2%20Nordwind%20Airlines
strict-transport-security
max-age=31536000
access-control-allow-origin
https://help.nordwindairlines.ru
cache-control
private, no-cache, no-store, must-revalidate, max-age=0
access-control-allow-credentials
true
x-xss-protection
1; mode=block
expires
Sun, 19-Sep-2021 06:46:54 GMT
43824799
mc.yandex.com/webvisor/ 		43 B
145 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://mc.yandex.com/webvisor/43824799?wmode=0&wv-part=1&wv-hit=599055778&page-url=https%3A%2F%2Fhelp.nordwindairlines.ru%2Fforms%2Finvoluntary-change-ticket&rn=959711333&wv-type=5&browser-info=gdpr%3A14%3Aet%3A1632034017%3Aw%3A1600x1200%3Av%3A644%3Az%3A0%3Ai%3A20210919064656%3Au%3A1632034014408310328%3Avf%3A25rt5xty9edhsiwjn9%3Awe%3A1%3Ati%3A2%3Ast%3A1632034017
Requested by
Host: mc.yandex.ru
URL: https://mc.yandex.ru/metrika/tag.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:6b8::1:119 Moscow, Russian Federation, ASN208722 (YNDX, FI),
Reverse DNS
Software
/
Resource Hash
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Xss-Protection 1; mode=block

Request headers

Referer
https://help.nordwindairlines.ru/
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Sun, 19 Sep 2021 06:46:56 GMT
last-modified
Sun, 19-Sep-2021 06:46:56 GMT
strict-transport-security
max-age=31536000
content-type
image/gif
access-control-allow-origin
https://help.nordwindairlines.ru
cache-control
private, no-cache, no-store, must-revalidate, max-age=0
access-control-allow-credentials
true
content-length
43
x-xss-protection
1; mode=block
expires
Sun, 19-Sep-2021 06:46:56 GMT
43824799
mc.yandex.com/webvisor/ 		43 B
73 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://mc.yandex.com/webvisor/43824799?wmode=0&wv-part=1&wv-hit=599055778&page-url=https%3A%2F%2Fhelp.nordwindairlines.ru%2Fforms%2Finvoluntary-change-ticket&rn=857685212&wv-type=3&browser-info=bt%3A1%3Agdpr%3A14%3Aet%3A1632034017%3Aw%3A1600x1200%3Av%3A644%3Az%3A0%3Ai%3A20210919064656%3Au%3A1632034014408310328%3Avf%3A25rt5xty9edhsiwjn9%3Awe%3A1%3Ati%3A2%3Ast%3A1632034017
Requested by
Host: mc.yandex.ru
URL: https://mc.yandex.ru/metrika/tag.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:6b8::1:119 Moscow, Russian Federation, ASN208722 (YNDX, FI),
Reverse DNS
Software
/
Resource Hash
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Xss-Protection 1; mode=block

Request headers

Referer
https://help.nordwindairlines.ru/
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Sun, 19 Sep 2021 06:46:56 GMT
last-modified
Sun, 19-Sep-2021 06:46:56 GMT
strict-transport-security
max-age=31536000
content-type
image/gif
access-control-allow-origin
https://help.nordwindairlines.ru
cache-control
private, no-cache, no-store, must-revalidate, max-age=0
access-control-allow-credentials
true
content-length
43
x-xss-protection
1; mode=block
expires
Sun, 19-Sep-2021 06:46:56 GMT

Verdicts & Comments Add Verdict or Comment

29 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onbeforexrselect boolean| originAgentCluster function| gtag object| dataLayer function| ym object| ERRORS_COLLECTOR_STORAGE object| PROMISE_ERRORS_COLLECTOR_STORAGE function| errorsCollectorHandler function| errorsCollectorUnhandledRejectionHandler object| google_tag_manager object| google_tag_data string| GoogleAnalyticsObject function| ga object| gaplugins object| gaGlobal object| gaData object| PAGE_CONFIG object| webpackJsonp object| __core-js_shared__ object| core object| global object| System function| asap function| Observable function| setImmediate function| clearImmediate function| _ object| Ya object| yaCounter43824799

14 Cookies

Domain/Path Name / Value
.nordwindairlines.ru/ Name: _ga
Value: GA1.2.748866317.1632034014
.nordwindairlines.ru/ Name: _gid
Value: GA1.2.1455932732.1632034014
.nordwindairlines.ru/ Name: _gat_gtag_UA_111725868_1
Value: 1
.nordwindairlines.ru/ Name: _ym_uid
Value: 1632034014408310328
.nordwindairlines.ru/ Name: _ym_d
Value: 1632034014
.mc.yandex.com/ Name: sync_cookie_csrf
Value: 2120917001fake
.nordwindairlines.ru/ Name: _ym_isad
Value: 2
.mc.yandex.ru/ Name: sync_cookie_csrf
Value: 1496051635fake
.yandex.com/ Name: yandexuid
Value: 3102826361632034014
.yandex.com/ Name: yuidss
Value: 3102826361632034014
mc.yandex.com/ Name: yabs-sid
Value: 1531758391632034014
.yandex.com/ Name: i
Value: wgFr3Wd96ZQWZ3FSVJyQjaVaFzuYMXu8QEkpnB4gJ69KIBhTnH9HAWN5x+1JSPT4Cp4w480apbAYVMPmTNWqO4U6520=
.yandex.com/ Name: ymex
Value: 1663570014.yrts.1632034014#1663570014.yrtsi.1632034014
.nordwindairlines.ru/ Name: _ym_visorc
Value: w

2 Console Messages

Source Level URL
Text
security warning URL: https://help.nordwindairlines.ru/forms/involuntary-change-ticket
Message:
Mixed Content: The page at 'https://help.nordwindairlines.ru/forms/involuntary-change-ticket' was loaded over HTTPS, but requested an insecure element 'http://nordwindairlines.ru/static/nordwind/logos/logo-iata.svg'. This request was automatically upgraded to HTTPS, For more information see https://blog.chromium.org/2019/10/no-more-mixed-messages-about-https.html
network error URL: https://mc.yandex.com/sync_cookie_image_decide?token=9401.99hssRxcUoYVCp0hVFKYJHMG4LAIu6xEVrbNpn0jjz1a8CO9z8nhY2h21tBilY9NthQFnpz6nBaZYG0ZWB25jg%2C%2C.C4FgRiKSPs2rTEvhVOvr4Pp1g6M%2C
Message:
Failed to load resource: the server responded with a status of 400 ()

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

help.nordwindairlines.ru
mc.yandex.com
mc.yandex.ru
nordwindairlines.ru
pegast.ru
refund.nordwindairlines.ru
stats.g.doubleclick.net
www.google-analytics.com
www.google.com
www.google.de
www.googletagmanager.com
193.24.8.15
2a00:1450:4001:808::2008
2a00:1450:4001:809::2004
2a00:1450:4001:80e::2003
2a00:1450:4001:810::200e
2a00:1450:400c:c1b::9c
2a02:6b8::1:119
85.31.120.13
19d7014b520cbaaab3eb9307788cc9f2c22f9bfb3893607c654eab60432b4143
257882718344d6d0fd36f8d1c9623a2e8f06f195c4bfcf8c09073c12c02bd4ef
312f78cbf0f17d4e246df361b524dc97d61365a600db3ab0fc22cc5b6887b0e6
31c2e7037bac5f31cba6d2269815ca6f63ad678147d707292a35c818d4101a42
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87
5d5ce58ea6186ba103c74fcdfcaa6d662c57c272f110783bb304d30da6a0726c
7aca6a2d961ed7b69a19ee809e53fb8c42852612515d0ec161cb1b39f918a7fc
7aca715337c5ac63f1ce3d9cbe7569648fab8d926a1f548a603fa2470bacfea9
7f1d926eef248dcbac8a6a624f8cd1d293df8bb8fc3728727266ec39f02acddb
8398a026313c016324f186d1c9b24a46813109d4bc5477d910a683079cbf1434
84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80
879f894da2b9a70fc4336988cad4ab8a4b42f3523de3fb9ee6fe1b47d3b9642f
8a9820e7a05173822b9285ee2c2815e16b058bd2c40bc7ca8ba5387f7a6840ae
94e7d8bdb7d164d43b3ccbee2373be17dccc020e9dd472afee452e836711d918
a5161af8b0e643abce3db648ea0871874dfd98b701198cdcf8a53475e8342159
b784272247b90a8d77245ebc858cf4698416d37cd123e98fcaccee83e3c013e7
cfff9f11b96ec686086f06cf5089585790fe90d07646f90e9790713f97975124
d67dd51b180fe903455c28ee0ec97dbd28180b1dda8dfbfc1f65d2d7986b60ac
d7a42c8860a5f336baa81f03ef68d84fe3214edc3194d9692a542fc2df1de16e
da9e337aad4567126172a44368cf7ed12b32154c31a577d4778605bbe2a30848
de3246094525b21a870fc7d2a67490d0132535c6fa5993755c549f1a9d1bd8af
eb279457c110d167e143903c82efe947d0f68f2d9e441ad15ad942d7c35ce5ef
ec4b3af947c159dff0270b01c45f773199798195817d24ae8b017550cf1e8bb2
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
fbc4ea4f5aeaeb3ad701d6d0e1512a2d040c7e0213e4d3e786cec8b9a401ecb2
fd222137f245c06ddb4c4d44db41f12138dad6cf8ef5d4d4a5e500f38f0c8c62