prefcenter.xanterra.com Open in urlscan Pro
2606:4700:20::681a:1b Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://links.email3.xanterra.net/ls/click?upn=Cn6Jf7hlyyvYym5hKiaGxZgZ1Lezy3vWYPKZE9YuVn7Tgs3XsOcwsGf6qhzymSKCxDiMREswVitALyOL2bK...
Effective URL:
https://prefcenter.xanterra.com/preferences/?PN_program=XAN_PARKS_NEWSLETTERS&PN_locale=en_US&utm_source=RPI&utm_medium=email&ut...
Submission: On May 16 via api (May 16th 2023, 6:11:33 pm UTC) from US — Scanned from DE

Summary HTTP 53 Redirects Links 18 Behaviour Indicators

Summary

This website contacted 18 IPs in 4 countries across 16 domains to perform 53 HTTP transactions. The main IP is 2606:4700:20::681a:1b, located in United States and belongs to CLOUDFLARENET, US. The main domain is prefcenter.xanterra.com.
TLS certificate: Issued by Cloudflare Inc ECC CA-3 on February 24th 2023. Valid for: a year.

This is the only time prefcenter.xanterra.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1 1	2606:4700:303... 2606:4700:3036::6815:5a47	13335 (CLOUDFLAR...) (CLOUDFLARENET)
7	2606:4700:20:... 2606:4700:20::681a:1b	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	2a00:1450:400... 2a00:1450:4001:831::200a	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:82b::200a	15169 (GOOGLE) (GOOGLE)
3	2606:4700::68... 2606:4700::6811:190e	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	2a00:1450:400... 2a00:1450:4001:831::2008	15169 (GOOGLE) (GOOGLE)
2	65.9.95.10 65.9.95.10	16509 (AMAZON-02) (AMAZON-02)
6	2a00:1450:400... 2a00:1450:4001:82b::2003	15169 (GOOGLE) (GOOGLE)
5	46.21.96.230 46.21.96.230	42708 (PORTLANE ...) (PORTLANE www.portlane.com)
4	2a00:1450:400... 2a00:1450:4001:830::200e	15169 (GOOGLE) (GOOGLE)
1	172.217.16.130 172.217.16.130	15169 (GOOGLE) (GOOGLE)
2	2620:1ec:4f:1... 2620:1ec:4f:1::69	8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
4	2a00:1450:400... 2a00:1450:400c:c00::9d	15169 (GOOGLE) (GOOGLE)
1	2001:4860:480... 2001:4860:4802:32::36	15169 (GOOGLE) (GOOGLE)
5	2a00:1450:400... 2a00:1450:4001:828::2003	15169 (GOOGLE) (GOOGLE)
1 1	2a00:1450:400... 2a00:1450:4001:82b::2002	15169 (GOOGLE) (GOOGLE)
1 4	2a00:1450:400... 2a00:1450:4001:828::2004	15169 (GOOGLE) (GOOGLE)
2	52.54.248.140 52.54.248.140	14618 (AMAZON-AES) (AMAZON-AES)
2	40.118.246.51 40.118.246.51	8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
53	18

1 2606:4700:3036::6815:5a47 (United States) 1 redirects

ASN13335 (CLOUDFLARENET, US)

links.email3.xanterra.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 2606:4700:20::681a:1b (United States)

ASN13335 (CLOUDFLARENET, US)

prefcenter.xanterra.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:831::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:82b::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

ajax.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2606:4700::6811:190e (United States)

ASN13335 (CLOUDFLARENET, US)

cdnjs.cloudflare.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:831::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 65.9.95.10 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-65-9-95-10.prg50.r.cloudfront.net

solutions.invocacdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 2a00:1450:4001:82b::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 46.21.96.230 (Sweden)

ASN42708 (PORTLANE www.portlane.com, SE)
PTR: sto-main.static.vergic.com

us-content.vergic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
us-xanterra.vergic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a00:1450:4001:830::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 172.217.16.130 (United States)

ASN15169 (GOOGLE, US)
PTR: fra15s46-in-f2.1e100.net

www.googleadservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2620:1ec:4f:1::69 (United States)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

cdn.redpointglobal.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a00:1450:400c:c00::9d (Brussels, Belgium)

ASN15169 (GOOGLE, US)

stats.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2001:4860:4802:32::36 (United States)

ASN15169 (GOOGLE, US)

region1.analytics.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2a00:1450:4001:828::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:82b::2002 (Frankfurt am Main, Germany) 1 redirects

ASN15169 (GOOGLE, US)

googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a00:1450:4001:828::2004 (Frankfurt am Main, Germany) 1 redirects

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 52.54.248.140 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-52-54-248-140.compute-1.amazonaws.com

pnapi.invoca.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 40.118.246.51 (San Jose, United States)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

xanwebrpi.rphelios.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
7	xanterra.com prefcenter.xanterra.com	95 KB
6	gstatic.com fonts.gstatic.com	94 KB
5	google.de www.google.de — Cisco Umbrella Rank: 5171	839 B
5	google.com 1 redirects region1.analytics.google.com — Cisco Umbrella Rank: 4217 www.google.com — Cisco Umbrella Rank: 2	2 KB
5	doubleclick.net 1 redirects stats.g.doubleclick.net — Cisco Umbrella Rank: 91 googleads.g.doubleclick.net — Cisco Umbrella Rank: 41	2 KB
5	vergic.com us-content.vergic.com — Cisco Umbrella Rank: 37184 us-xanterra.vergic.com — Cisco Umbrella Rank: 330032	169 KB
4	google-analytics.com www.google-analytics.com — Cisco Umbrella Rank: 39	21 KB
3	cloudflare.com cdnjs.cloudflare.com — Cisco Umbrella Rank: 231	24 KB
3	googleapis.com fonts.googleapis.com — Cisco Umbrella Rank: 50 ajax.googleapis.com — Cisco Umbrella Rank: 385	35 KB
2	rphelios.net xanwebrpi.rphelios.net — Cisco Umbrella Rank: 413024	1 KB
2	invoca.net pnapi.invoca.net — Cisco Umbrella Rank: 7464	551 B
2	redpointglobal.com cdn.redpointglobal.com — Cisco Umbrella Rank: 474452	54 KB
2	invocacdn.com solutions.invocacdn.com — Cisco Umbrella Rank: 6759	39 KB
2	googletagmanager.com www.googletagmanager.com — Cisco Umbrella Rank: 62	178 KB
1	googleadservices.com www.googleadservices.com — Cisco Umbrella Rank: 179	2 KB
1	xanterra.net 1 redirects links.email3.xanterra.net	751 B
53	16

	Domain	Requested by
7	prefcenter.xanterra.com	prefcenter.xanterra.com
6	fonts.gstatic.com	fonts.googleapis.com
5	www.google.de	prefcenter.xanterra.com
4	us-xanterra.vergic.com	us-content.vergic.com
4	www.google.com	1 redirects prefcenter.xanterra.com
4	stats.g.doubleclick.net	www.google-analytics.com www.googletagmanager.com
4	www.google-analytics.com	www.googletagmanager.com prefcenter.xanterra.com www.google-analytics.com
3	cdnjs.cloudflare.com	prefcenter.xanterra.com
2	xanwebrpi.rphelios.net	cdn.redpointglobal.com
2	pnapi.invoca.net	solutions.invocacdn.com
2	cdn.redpointglobal.com	www.googletagmanager.com
2	solutions.invocacdn.com	prefcenter.xanterra.com solutions.invocacdn.com
2	www.googletagmanager.com	prefcenter.xanterra.com www.googletagmanager.com
2	fonts.googleapis.com	prefcenter.xanterra.com
1	googleads.g.doubleclick.net	1 redirects
1	region1.analytics.google.com	www.googletagmanager.com
1	www.googleadservices.com	www.googletagmanager.com
1	us-content.vergic.com	prefcenter.xanterra.com
1	ajax.googleapis.com	prefcenter.xanterra.com
1	links.email3.xanterra.net	1 redirects
53	20

This site contains links to these domains. Also see Links.

Domain
www.xanterra.com
www.craterlakelodges.com
www.oasisatdeathvalley.com
www.glaciernationalparklodges.com
www.grandcanyongrandhotel.com
www.grandcanyonlodges.com
www.mtrushmorenationalmemorial.com
www.trailridgegiftstore.com
www.yellowstonenationalparklodges.com
www.zionlodge.com
www.countrywalkers.com
www.thetrain.com
www.holidayvacations.com
www.vbt.com
www.windstarcruises.com

Subject Issuer	Validity	Valid
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2023-02-24` - `2024-02-24`	a year	crt.sh
upload.video.google.com GTS CA 1C3	`2023-04-24` - `2023-07-17`	3 months	crt.sh
*.google-analytics.com GTS CA 1C3	`2023-04-24` - `2023-07-17`	3 months	crt.sh
invocacdn.com Amazon RSA 2048 M02	`2023-02-28` - `2023-11-22`	9 months	crt.sh
*.gstatic.com GTS CA 1C3	`2023-04-24` - `2023-07-17`	3 months	crt.sh
*.vergic.com Gandi Standard SSL CA 2	`2022-10-06` - `2023-10-14`	a year	crt.sh
www.googleadservices.com GTS CA 1C3	`2023-04-24` - `2023-07-17`	3 months	crt.sh
cdn.redpointglobal.com DigiCert TLS RSA SHA256 2020 CA1	`2023-01-29` - `2024-01-29`	a year	crt.sh
*.g.doubleclick.net GTS CA 1C3	`2023-04-24` - `2023-07-17`	3 months	crt.sh
www.google.de GTS CA 1C3	`2023-04-24` - `2023-07-17`	3 months	crt.sh
www.google.com GTS CA 1C3	`2023-04-24` - `2023-07-17`	3 months	crt.sh
*.google.de GTS CA 1C3	`2023-04-24` - `2023-07-17`	3 months	crt.sh
invoca.net Amazon RSA 2048 M02	`2023-02-22` - `2023-11-22`	9 months	crt.sh
xanwebrpi.rphelios.net GeoTrust Global TLS RSA4096 SHA256 2022 CA1	`2023-03-19` - `2023-09-19`	6 months	crt.sh

This page contains 1 frames:

Primary Page: https://prefcenter.xanterra.com/preferences/?PN_program=XAN_PARKS_NEWSLETTERS&PN_locale=en_US&utm_source=RPI&utm_medium=email&utm_content=Guest&utm_campaign=XAN_230404_TacOffer_Explore-AprilNewsletter_guest_NATL-FNAME-4&PID=61386620&PN_email=6Yf4ob10c8FsxR7UoNAAHgEnHqnwipLHx3CM5Tb4e6wBc1DK1bi4K7%2FF1rjngb2iDKY8woLISDAIOAYREIb9UvPYqyr7GSOv3ZzdCc5tOSQ%3D
Frame ID: 34C4930FC29E3FC02D262708A40496EC
Requests: 53 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Preferences | Xanterra

Page URL History Show full URLs

https://links.email3.xanterra.net/ls/click?upn=Cn6Jf7hlyyvYym5hKiaGxZgZ1Lezy3vWYPKZE9YuVn7Tgs3XsOcwsGf6qhzymSK... HTTP 302
https://prefcenter.xanterra.com/preferences/?PN_program=XAN_PARKS_NEWSLETTERS&PN_locale=en_US&utm_source=RPI... Page URL

Detected technologies

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

google-analytics\.com/(?:ga|urchin|analytics)\.js

Google Font API (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/gtm\.js
googletagmanager\.com/gtag/js

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

/([\d.]+)/jquery(?:\.min)?\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

53
Requests

96 %
HTTPS

74 %
IPv6

16
Domains

20
Subdomains

18
IPs

4
Countries

714 kB
Transfer

2027 kB
Size

17
Cookies

18 Outgoing links

These are links going to different origins than the main page.

URL: https://www.xanterra.com/

Search URL Search Domain Scan URL

URL: https://www.xanterra.com/privacy-policy/
Title: Privacy Policy

Search URL Search Domain Scan URL

URL: https://www.xanterra.com/terms-of-use/
Title: Terms Of Use

Search URL Search Domain Scan URL

URL: http://www.craterlakelodges.com/
Title: Crater Lake National Park

Search URL Search Domain Scan URL

URL: http://www.oasisatdeathvalley.com/
Title: The Oasis at Death Valley

Search URL Search Domain Scan URL

URL: http://www.glaciernationalparklodges.com/
Title: Glacier National Park

Search URL Search Domain Scan URL

URL: http://www.glaciernationalparklodges.com/lodging/cedar-creek-lodge/
Title: Cedar Creek Lodge - Just Outside Glacier National Park

Search URL Search Domain Scan URL

URL: http://www.grandcanyongrandhotel.com/
Title: The Grand Hotel at the Grand Canyon

Search URL Search Domain Scan URL

URL: http://www.grandcanyonlodges.com/
Title: Grand Canyon National Park – South Rim

Search URL Search Domain Scan URL

URL: http://www.mtrushmorenationalmemorial.com/
Title: Mount Rushmore National Memorial

Search URL Search Domain Scan URL

URL: http://www.trailridgegiftstore.com/
Title: Rocky Mountain National Park

Search URL Search Domain Scan URL

URL: http://www.yellowstonenationalparklodges.com/
Title: Yellowstone National Park

Search URL Search Domain Scan URL

URL: http://www.zionlodge.com/
Title: Zion National Park

Search URL Search Domain Scan URL

URL: https://www.countrywalkers.com/
Title: Country Walkers

Search URL Search Domain Scan URL

URL: https://www.thetrain.com/
Title: Grand Canyon Railway & Hotel

Search URL Search Domain Scan URL

URL: http://www.holidayvacations.com/
Title: Holiday Vacations

Search URL Search Domain Scan URL

URL: https://www.vbt.com/
Title: VBT Bicycling and Walking Vacations

Search URL Search Domain Scan URL

URL: https://www.windstarcruises.com/
Title: Windstar Cruises

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://links.email3.xanterra.net/ls/click?upn=Cn6Jf7hlyyvYym5hKiaGxZgZ1Lezy3vWYPKZE9YuVn7Tgs3XsOcwsGf6qhzymSKCxDiMREswVitALyOL2bKK1qm-2FB6XZCCgbRNanI2fzDwTR5R3BVublTzdPXnD7DbgWFsMLkCgu0gdtTpnBCtWGcECwNNLtoNlvBwtO9ZAYC3vfYw-2BL4K-2BaiNvwK7FSCCv6xm71IojEdpNTrFhFWHNq2Lvo8mJ2-2F0JfuMH-2BRTr6XhaWOaD14pnvwWuAkZjZnzm-2BHqbv-2FgXWHqlF5lfb6Yw5oI0yfh8297vJXEUPvOGGkVH4FcRbIXP4r1soBXTZ-2FcTHRRNIe537-2F3feeCrksO-2Ftb7k-2BiSxsV4Emdny6pelaya6-2F4BGj10rpj4KYoPdJHBwAxt7fEKedB74XV0YHhnoLmaYzTWd0KqssXcO-2BCK6OgdcViKNgXeGiUzWp75HT8GOh-2FDHRrCsCme2BgCU85HES3g2mNQEK4mxANiBEkNv4SeA-3DwpSJ_PxrAigtOMq8GMtJABwZjRmcdygZqOlzCUs0-2FLz-2BLUk2jvasiL3yaGXHr3JAWMmSEW9k-2Bdq84riJ33Xil9qhtAHyRNVrrO3ePhkSA1dFL8qLcGjYA8ktMJkd2uG2QWFJU37STz5BnAgZMU9w9Tg1tXZjGNSihy-2BjJWA4q8cXrRQFGZ847sOL0MmrFcc3I0vzgHq3Pz2xTwgtf8o374DTI7LjL1qCYn34VyKJwVN6ZltRh-2FRNrlEy-2F8B-2FEyIYoMjsrE-2Bl1IvuK31pWSK1n0cYF5P6lVBpT8xhlCraIuF6e2goyEBnVUZoE-2BEScErF-2Fk4I-2BccrBVuIT-2F9JnvIvyccxT-2Bn-2B4-2BrZJt7E7wUgePFGGC-2FXFWFuYgs47Reowix5oQJ1jhDo2GYuIOjOPnC-2F-2BW6H65A-3D-3D HTTP 302
https://prefcenter.xanterra.com/preferences/?PN_program=XAN_PARKS_NEWSLETTERS&PN_locale=en_US&utm_source=RPI&utm_medium=email&utm_content=Guest&utm_campaign=XAN_230404_TacOffer_Explore-AprilNewsletter_guest_NATL-FNAME-4&PID=61386620&PN_email=6Yf4ob10c8FsxR7UoNAAHgEnHqnwipLHx3CM5Tb4e6wBc1DK1bi4K7%2FF1rjngb2iDKY8woLISDAIOAYREIb9UvPYqyr7GSOv3ZzdCc5tOSQ%3D Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 33

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/975854640/?random=557867587&cv=11&fst=1684260688770&bg=ffffff&guid=ON&async=1&gtm=45He35a0&u_w=1600&u_h=1200&url=https%3A%2F%2Fprefcenter.xanterra.com%2Fpreferences%2F%3FPN_program%3DXAN_PARKS_NEWSLETTERS%26PN_locale%3Den_US%26utm_source%3DRPI%26utm_medium%3Demail%26utm_content%3DGuest%26utm_campaign%3DXAN_230404_TacOffer_Explore-AprilNewsletter_guest_NATL-FNAME-4%26PID%3D61386620%26PN_email%3D6Yf4ob10c8FsxR7UoNAAHgEnHqnwipLHx3CM5Tb4e6wBc1DK1bi4K7%252FF1rjngb2iDKY8woLISDAIOAYREIb9UvPYqyr7GSOv3ZzdCc5tOSQ%253D&label=F6qnCPORsYgDELC4qdED&hn=www.googleadservices.com&frm=0&tiba=Preferences%20%7C%20Xanterra&value=0&auid=541956406.1684260689&uamb=0&uaw=0&fmt=3&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&ocp_id=UMdjZLKoMs-VzAaa8pGABA&sscte=1&crd=&eitems=ChAI8NOMowYQ7Yme_4qq3ecgEh0AAVRQQFjcgNv50tKFJqBUBW73G3YRvTWQZCJYSg&pscrd=EkxDaEFJOE5PTW93WVFoclNaaEtpTzlic3NFaVVBbm5PQWwwYVhSbDlwXzB1ZTkwUjVhVE1qYjdENlZ2U09XYXFXYlRWT2ZzZEQxRVpsGlhDaEVJOE5PTW93WVF3X2FpbnNuanZ0TENBUkl0QUQ0bzhqT0JGdDJjTll2Mi11Yy1YYXRYbmRXV0lZOXc0dC1ZVzVEb3llRUtLSVdMM3pEYTlEejVrM0Zz HTTP 302
https://www.google.com/pagead/1p-conversion/975854640/?random=557867587&cv=11&fst=1684260688770&bg=ffffff&guid=ON&async=1&gtm=45He35a0&u_w=1600&u_h=1200&url=https%3A%2F%2Fprefcenter.xanterra.com%2Fpreferences%2F%3FPN_program%3DXAN_PARKS_NEWSLETTERS%26PN_locale%3Den_US%26utm_source%3DRPI%26utm_medium%3Demail%26utm_content%3DGuest%26utm_campaign%3DXAN_230404_TacOffer_Explore-AprilNewsletter_guest_NATL-FNAME-4%26PID%3D61386620%26PN_email%3D6Yf4ob10c8FsxR7UoNAAHgEnHqnwipLHx3CM5Tb4e6wBc1DK1bi4K7%252FF1rjngb2iDKY8woLISDAIOAYREIb9UvPYqyr7GSOv3ZzdCc5tOSQ%253D&label=F6qnCPORsYgDELC4qdED&hn=www.googleadservices.com&frm=0&tiba=Preferences%20%7C%20Xanterra&value=0&auid=541956406.1684260689&uamb=0&uaw=0&fmt=3&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&sscte=1&crd=&pscrd=EkxDaEFJOE5PTW93WVFoclNaaEtpTzlic3NFaVVBbm5PQWwwYVhSbDlwXzB1ZTkwUjVhVE1qYjdENlZ2U09XYXFXYlRWT2ZzZEQxRVpsGlhDaEVJOE5PTW93WVF3X2FpbnNuanZ0TENBUkl0QUQ0bzhqT0JGdDJjTll2Mi11Yy1YYXRYbmRXV0lZOXc0dC1ZVzVEb3llRUtLSVdMM3pEYTlEejVrM0Zz&is_vtc=1&ocp_id=UMdjZLKoMs-VzAaa8pGABA&eitems=ChAI8NOMowYQ7Yme_4qq3ecgEh0AAVRQQNbtjnrao0SEab7NFPLUk6ljONNBR_MzXA&random=3231005381 HTTP 302
https://www.google.de/pagead/1p-conversion/975854640/?random=557867587&cv=11&fst=1684260688770&bg=ffffff&guid=ON&async=1&gtm=45He35a0&u_w=1600&u_h=1200&url=https%3A%2F%2Fprefcenter.xanterra.com%2Fpreferences%2F%3FPN_program%3DXAN_PARKS_NEWSLETTERS%26PN_locale%3Den_US%26utm_source%3DRPI%26utm_medium%3Demail%26utm_content%3DGuest%26utm_campaign%3DXAN_230404_TacOffer_Explore-AprilNewsletter_guest_NATL-FNAME-4%26PID%3D61386620%26PN_email%3D6Yf4ob10c8FsxR7UoNAAHgEnHqnwipLHx3CM5Tb4e6wBc1DK1bi4K7%252FF1rjngb2iDKY8woLISDAIOAYREIb9UvPYqyr7GSOv3ZzdCc5tOSQ%253D&label=F6qnCPORsYgDELC4qdED&hn=www.googleadservices.com&frm=0&tiba=Preferences%20%7C%20Xanterra&value=0&auid=541956406.1684260689&uamb=0&uaw=0&fmt=3&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&sscte=1&crd=&pscrd=EkxDaEFJOE5PTW93WVFoclNaaEtpTzlic3NFaVVBbm5PQWwwYVhSbDlwXzB1ZTkwUjVhVE1qYjdENlZ2U09XYXFXYlRWT2ZzZEQxRVpsGlhDaEVJOE5PTW93WVF3X2FpbnNuanZ0TENBUkl0QUQ0bzhqT0JGdDJjTll2Mi11Yy1YYXRYbmRXV0lZOXc0dC1ZVzVEb3llRUtLSVdMM3pEYTlEejVrM0Zz&is_vtc=1&ocp_id=UMdjZLKoMs-VzAaa8pGABA&eitems=ChAI8NOMowYQ7Yme_4qq3ecgEh0AAVRQQNbtjnrao0SEab7NFPLUk6ljONNBR_MzXA&random=3231005381&ipr=y

53 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

Primary Request / Show response
prefcenter.xanterra.com/preferences/
Redirect Chain

https://links.email3.xanterra.net/ls/click?upn=Cn6Jf7hlyyvYym5hKiaGxZgZ1Lezy3vWYPKZE9YuVn7Tgs3XsOcwsGf6qhzymSKCxDiMREswVitALyOL2bKK1qm-2FB6XZCCgbRNanI2fzDwTR5R3BVublTzdPXnD7DbgWFsMLkCgu0gdtTpnBCtWG...
https://prefcenter.xanterra.com/preferences/?PN_program=XAN_PARKS_NEWSLETTERS&PN_locale=en_US&utm_source=RPI&utm_medium=email&utm_content=Guest&utm_campaign=XAN_230404_TacOffer_Explore-AprilNewslet...

18 KB
5 KB

636ms
468ms

Document
text/html

2606:4700:20::681a:1b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://prefcenter.xanterra.com/preferences/?PN_program=XAN_PARKS_NEWSLETTERS&PN_locale=en_US&utm_source=RPI&utm_medium=email&utm_content=Guest&utm_campaign=XAN_230404_TacOffer_Explore-AprilNewsletter_guest_NATL-FNAME-4&PID=61386620&PN_email=6Yf4ob10c8FsxR7UoNAAHgEnHqnwipLHx3CM5Tb4e6wBc1DK1bi4K7%2FF1rjngb2iDKY8woLISDAIOAYREIb9UvPYqyr7GSOv3ZzdCc5tOSQ%3D

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::681a:1b , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e337efc20a43e184ddd8d5a05156ed07b3aa8db566f5dcc3c809d1ecdebe5a79

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

cache-control: no-cache, no-store, must-revalidate
cf-cache-status: DYNAMIC
cf-ray: 7c859554dc5d365c-FRA
content-encoding: gzip
content-type: text/html; charset=UTF-8
date: Tue, 16 May 2023 18:11:28 GMT
expires: 0
link: <https://prefcenter.xanterra.com/wp-json/>; rel="https://api.w.org/", <https://prefcenter.xanterra.com/?p=324>; rel=shortlink
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
pragma: no-cache
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=N%2F9mCRFVnRVCGihr%2FIl8uuBU1TvS3y%2FuXaI9bdRhFftb85xZLGyqEKGoaT0AaFrMT4LpXCKQW4k71Q6kE0j6H8mPQjTH%2BKKEK1VbiWtdgPpDp4D2O%2F5CZ6bgW%2BgRKlFEm3URWOivEmhwXQr7EdF3etPsKbGS"}],"group":"cf-nel","max_age":604800}
server: cloudflare
strict-transport-security: max-age=63072000; includeSubDomains
x-frame-options: SAMEORIGIN
x-xss-protection: 1; mode=block

Redirect headers

alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cf-cache-status: DYNAMIC
cf-ray: 7c859552cda7380a-FRA
content-type: text/html; charset=utf-8
date: Tue, 16 May 2023 18:11:27 GMT
location: https://prefcenter.xanterra.com/preferences/?PN_program=XAN_PARKS_NEWSLETTERS&PN_locale=en_US&utm_source=RPI&utm_medium=email&utm_content=Guest&utm_campaign=XAN_230404_TacOffer_Explore-AprilNewsletter_guest_NATL-FNAME-4&PID=61386620&PN_email=6Yf4ob10c8FsxR7UoNAAHgEnHqnwipLHx3CM5Tb4e6wBc1DK1bi4K7%2FF1rjngb2iDKY8woLISDAIOAYREIb9UvPYqyr7GSOv3ZzdCc5tOSQ%3D
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=GG7qhpXi84VQYD5GYf6eJ3cfL%2B4kEheLKMxPKkRM6f04EEkM0pPrtGyeKYKYBl4x7CLr%2Bs61JvfR%2B4ZowZ%2BfzLb9G4b%2BpHUP4Y5ZMZyspi2KMq5Ckdgo5mRDLBVB5NT0LpWjW4iyF3pLTPGsjnHI72iV9T1VUdVq"}],"group":"cf-nel","max_age":604800}
server: cloudflare
x-robots-tag: noindex, nofollow

GET
H2 200 css
fonts.googleapis.com/ 8 KB
823 B 43ms
18ms Stylesheet
text/css 2a00:1450:4001:831::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Roboto:400,500,700,300

Requested by

Host: prefcenter.xanterra.com
URL: https://prefcenter.xanterra.com/preferences/?PN_program=XAN_PARKS_NEWSLETTERS&PN_locale=en_US&utm_source=RPI&utm_medium=email&utm_content=Guest&utm_campaign=XAN_230404_TacOffer_Explore-AprilNewsletter_guest_NATL-FNAME-4&PID=61386620&PN_email=6Yf4ob10c8FsxR7UoNAAHgEnHqnwipLHx3CM5Tb4e6wBc1DK1bi4K7%2FF1rjngb2iDKY8woLISDAIOAYREIb9UvPYqyr7GSOv3ZzdCc5tOSQ%3D

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

98d2e3edd14aa506c4521125c7cdb7bb3030d7caae5803feec6d2613195ee955

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://prefcenter.xanterra.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Tue, 16 May 2023 18:11:28 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Tue, 16 May 2023 17:54:12 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Tue, 16 May 2023 18:11:28 GMT

GET
H2 200 css
fonts.googleapis.com/ 5 KB
1 KB 42ms
17ms Stylesheet
text/css 2a00:1450:4001:831::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Roboto+Condensed:400,700

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

78afccdea6ff2af0662f599b633f0ec56547fdf4a389f33bbb96c66d62ac665e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://prefcenter.xanterra.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Tue, 16 May 2023 18:11:28 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Tue, 16 May 2023 17:22:24 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Tue, 16 May 2023 18:11:28 GMT

GET
H2 200 styles.css
prefcenter.xanterra.com/content/themes/verb-base/css/ 110 KB
15 KB 40ms
39ms Stylesheet
text/css 2606:4700:20::681a:1b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://prefcenter.xanterra.com/content/themes/verb-base/css/styles.css?ver=1.0

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::681a:1b , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e6af8417a10702729c2c562f797475ec6f42fcf2def7726281e420f72ba0157c

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://prefcenter.xanterra.com/preferences/?PN_program=XAN_PARKS_NEWSLETTERS&PN_locale=en_US&utm_source=RPI&utm_medium=email&utm_content=Guest&utm_campaign=XAN_230404_TacOffer_Explore-AprilNewsletter_guest_NATL-FNAME-4&PID=61386620&PN_email=6Yf4ob10c8FsxR7UoNAAHgEnHqnwipLHx3CM5Tb4e6wBc1DK1bi4K7%2FF1rjngb2iDKY8woLISDAIOAYREIb9UvPYqyr7GSOv3ZzdCc5tOSQ%3D
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Tue, 16 May 2023 18:11:28 GMT
strict-transport-security: max-age=63072000; includeSubDomains
content-encoding: gzip
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 172910
cf-polished: origSize=114131
x-xss-protection: 1; mode=block
cf-bgj: minify
last-modified: Thu, 15 Apr 2021 17:17:20 GMT
server: cloudflare
x-frame-options: SAMEORIGIN
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=g%2F0ZwPJugTn%2BYZs7dC85uq2I5oLSZ%2BeHo%2F43Km9L7oBW0qz4cBRVMXS97P5GcETZjAzoPn8euXNqnefc63gBFmb8EjCsfslOjGY%2BquUKBGXBC2T2YRlbcvUTzfimAGMBSRlO%2BjB9ECRbNSuykjJapt8yW2el"}],"group":"cf-nel","max_age":604800}
content-type: text/css
vary: Accept-Encoding
cache-control: max-age=2678400, public
cf-ray: 7c859557d888365c-FRA
expires: Wed, 14 Jun 2023 18:09:38 GMT

GET
H2 200 xan_logo.jpg
prefcenter.xanterra.com/content/uploads/2018/04/ 7 KB
8 KB 21ms
20ms Image
image/webp 2606:4700:20::681a:1b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://prefcenter.xanterra.com/content/uploads/2018/04/xan_logo.jpg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::681a:1b , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

69e1c9b528f8a1fd364602551a40431e8ffe8447d2ff9ccec259abd8c822420d

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://prefcenter.xanterra.com/preferences/?PN_program=XAN_PARKS_NEWSLETTERS&PN_locale=en_US&utm_source=RPI&utm_medium=email&utm_content=Guest&utm_campaign=XAN_230404_TacOffer_Explore-AprilNewsletter_guest_NATL-FNAME-4&PID=61386620&PN_email=6Yf4ob10c8FsxR7UoNAAHgEnHqnwipLHx3CM5Tb4e6wBc1DK1bi4K7%2FF1rjngb2iDKY8woLISDAIOAYREIb9UvPYqyr7GSOv3ZzdCc5tOSQ%3D
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Tue, 16 May 2023 18:11:28 GMT
strict-transport-security: max-age=63072000; includeSubDomains
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 5073
cf-polished: qual=85, origFmt=jpeg, origSize=15936
content-disposition: inline; filename="xan_logo.webp"
content-length: 7386
x-xss-protection: 1; mode=block
cf-bgj: imgq:85,h2pri
last-modified: Thu, 15 Apr 2021 17:17:20 GMT
server: cloudflare
etag: "3e40-5c006093a5273"
vary: Accept
x-frame-options: SAMEORIGIN
content-type: image/webp
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=r5762Bzv4aTfpPJr56qwsXBbeqU6h%2BnTuhWkgZkQPhziRjzYFpBfq3AeZ%2FoPApjW73xDY4R5Q2W%2FVuJZag8Ub%2BGernybBwUYWhBqD%2FnyPkynYcTonNXdTQaKCaSboOlMRTDt96Z%2FyPUvk6I2gSbDX7uXI0fL"}],"group":"cf-nel","max_age":604800}
cache-control: max-age=2678400, public
accept-ranges: bytes
cf-ray: 7c8595582904365c-FRA
expires: Fri, 16 Jun 2023 16:46:55 GMT

GET
H2 200 xanterra-TC.png
prefcenter.xanterra.com/content/themes/verb-base/img/brand-logos/ 59 KB
59 KB 22ms
22ms Image
image/webp 2606:4700:20::681a:1b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://prefcenter.xanterra.com/content/themes/verb-base/img/brand-logos/xanterra-TC.png

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::681a:1b , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

0d3b6e0a7634bbc1fe3e8dc504a06a61924ae88d03e31a7ab54519bfcaca7513

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://prefcenter.xanterra.com/preferences/?PN_program=XAN_PARKS_NEWSLETTERS&PN_locale=en_US&utm_source=RPI&utm_medium=email&utm_content=Guest&utm_campaign=XAN_230404_TacOffer_Explore-AprilNewsletter_guest_NATL-FNAME-4&PID=61386620&PN_email=6Yf4ob10c8FsxR7UoNAAHgEnHqnwipLHx3CM5Tb4e6wBc1DK1bi4K7%2FF1rjngb2iDKY8woLISDAIOAYREIb9UvPYqyr7GSOv3ZzdCc5tOSQ%3D
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Tue, 16 May 2023 18:11:28 GMT
strict-transport-security: max-age=63072000; includeSubDomains
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 172909
cf-polished: origFmt=png, origSize=124806
content-disposition: inline; filename="xanterra-TC.webp"
content-length: 60186
x-xss-protection: 1; mode=block
cf-bgj: imgq:85,h2pri
last-modified: Thu, 15 Apr 2021 17:17:20 GMT
server: cloudflare
etag: "1e786-5c00609396bfb"
vary: Accept
x-frame-options: SAMEORIGIN
content-type: image/webp
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=LdjecIWK8%2Bt6EyFDeuHS5ZKR5jxJl9d9z%2F4c80u866GF5PXzfWYFZ2k0gfDQLjTgzMC8F6DYh0kDE4Q9QJOXFtTJAQuLlWyWxis9VhpjwXvne%2FOZyRi3%2F9FJsucC%2FDPmryNbrrxj8HVuioF7EnmfEDFwhVbi"}],"group":"cf-nel","max_age":604800}
cache-control: max-age=2678400, public
accept-ranges: bytes
cf-ray: 7c8595582906365c-FRA
expires: Wed, 14 Jun 2023 18:09:38 GMT

GET
H2 200 email-decode.min.js Show response
prefcenter.xanterra.com/cdn-cgi/scripts/5c5dd728/cloudflare-static/ 1 KB
1 KB 10ms
10ms Script
application/javascript 2606:4700:20::681a:1b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://prefcenter.xanterra.com/cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::681a:1b , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

2595496fe48df6fcf9b1bc57c29a744c121eb4dd11566466bc13d2e52e6bbcc8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://prefcenter.xanterra.com/preferences/?PN_program=XAN_PARKS_NEWSLETTERS&PN_locale=en_US&utm_source=RPI&utm_medium=email&utm_content=Guest&utm_campaign=XAN_230404_TacOffer_Explore-AprilNewsletter_guest_NATL-FNAME-4&PID=61386620&PN_email=6Yf4ob10c8FsxR7UoNAAHgEnHqnwipLHx3CM5Tb4e6wBc1DK1bi4K7%2FF1rjngb2iDKY8woLISDAIOAYREIb9UvPYqyr7GSOv3ZzdCc5tOSQ%3D
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Tue, 16 May 2023 18:11:28 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Fri, 12 May 2023 12:05:41 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
etag: W/"645e2b95-4d7"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=jsxZqWZdgj3EUDa8%2FgDB7k2xf0b7ae%2F%2BjxLhwBV0zR5wE1gM6PVGKjTwSWLQQjV6DKFMwiFWAQvdQP6vF7hb6lGIMpII1Y0ofknl3yQXOGr8ZbhGllk5wUMJ7IT%2BvWZknCNujHQf8N%2BUjsn0XGyy%2FxeVmjf%2B"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
x-frame-options: DENY
cache-control: max-age=172800, public
cf-ray: 7c8595581900365c-FRA
expires: Thu, 18 May 2023 18:11:28 GMT

GET
H2 200 jquery.min.js Show response
ajax.googleapis.com/ajax/libs/jquery/1.9.1/ 90 KB
33 KB 31ms
8ms Script
text/javascript 2a00:1450:4001:82b::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ajax.googleapis.com/ajax/libs/jquery/1.9.1/jquery.min.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c12f6098e641aaca96c60215800f18f5671039aecf812217fab3c0d152f6adb4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://prefcenter.xanterra.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Thu, 11 May 2023 12:36:30 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 452098
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 33018
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 19:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="hosted-libraries-pushers"
vary: Accept-Encoding
report-to: {"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000, stale-while-revalidate=2592000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 10 May 2024 12:36:30 GMT

GET
H2 200 tether.min.js Show response
cdnjs.cloudflare.com/ajax/libs/tether/1.4.0/js/ 24 KB
7 KB 35ms
15ms Script
application/javascript 2606:4700::6811:190e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/tether/1.4.0/js/tether.min.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6811:190e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

80bd626eb6d57112072a508ee4e5ce3c2fe5673fe0a5d029810033b24aaa5e9f

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://prefcenter.xanterra.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Tue, 16 May 2023 18:11:28 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
age: 4665884
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 6714
last-modified: Mon, 04 May 2020 16:17:00 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "5eb03ffc-619d"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=C3Xsseuf3whr7thjeqpPCmx2kyqka6IRoFbzdOq4LhEPByo6EbPg3%2B0YzkGCefoRkxYhAXLwZpD3ItRnAJv5eYwJonpdYrRbC9QLr3KPyOJbSCfbsBHovpDBC3cIQ3eh6%2BfPyINbcb21%2FjbadY9vPBZS"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=30672000
accept-ranges: bytes
timing-allow-origin: *
cf-ray: 7c8595584b2f0374-FRA
expires: Sun, 05 May 2024 18:11:28 GMT

GET
H2 200 jquery.validate.min.js Show response
cdnjs.cloudflare.com/ajax/libs/jquery-validate/1.17.0/ 23 KB
7 KB 35ms
16ms Script
application/javascript 2606:4700::6811:190e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/jquery-validate/1.17.0/jquery.validate.min.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6811:190e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

17a879e50c3ab3078afaded288e257fb66e94806b76ff7e796b54226f9848f50

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://prefcenter.xanterra.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Tue, 16 May 2023 18:11:28 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
age: 4953716
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 6677
last-modified: Mon, 04 May 2020 16:11:46 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "5eb03ec2-5add"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=E%2BXWRSzA88ZV8qurMxxo6twd41BinlmSzBNHvXPp%2BNKJdobhpW%2FtVx5Gauwb%2FjyKKegb6XMYXBCQFZ0HqI4keIGXXaCveHU%2BH39Mq6x4iEegE76vNzNb%2FSVJaYLiO10DraaaCqAlCMFSDiBv1Ll5vsTU"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=30672000
accept-ranges: bytes
timing-allow-origin: *
cf-ray: 7c8595584b310374-FRA
expires: Sun, 05 May 2024 18:11:28 GMT

GET
H2 200 additional-methods.js Show response
cdnjs.cloudflare.com/ajax/libs/jquery-validate/1.17.0/ 41 KB
10 KB 36ms
16ms Script
application/javascript 2606:4700::6811:190e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/jquery-validate/1.17.0/additional-methods.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6811:190e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

d085d8d1a03d04c647a756b3412826c904c6e3ef0dc1378394a9a3a5062b717b

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://prefcenter.xanterra.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Tue, 16 May 2023 18:11:28 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
age: 5584797
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 9885
last-modified: Mon, 04 May 2020 16:11:46 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "5eb03ec2-a42b"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=iWaP5qpYObh%2BWUqPVi%2BQoj5V32UCqdxs3G7vO7XZAc0g4MlLTGT8UQ1mqSf5tJtjPGIEB%2FULHmTV%2BGUUqD1idNtbWC02QDEZj9ZC2Dl3Rwx1NxsrNh5fHylR2bfzqRzXVEnRbpqdZ%2B9nAkkBWbdiYpWO"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=30672000
accept-ranges: bytes
timing-allow-origin: *
cf-ray: 7c8595584b330374-FRA
expires: Sun, 05 May 2024 18:11:28 GMT

GET
H2 200 main.js Show response
prefcenter.xanterra.com/content/themes/verb-base/js/ 16 KB
5 KB 402ms
401ms Script
application/javascript 2606:4700:20::681a:1b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://prefcenter.xanterra.com/content/themes/verb-base/js/main.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::681a:1b , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

773685736cb801a28737ff92cc4306c5351d0852a3496774fbea62cc7d4f2fa8

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://prefcenter.xanterra.com/preferences/?PN_program=XAN_PARKS_NEWSLETTERS&PN_locale=en_US&utm_source=RPI&utm_medium=email&utm_content=Guest&utm_campaign=XAN_230404_TacOffer_Explore-AprilNewsletter_guest_NATL-FNAME-4&PID=61386620&PN_email=6Yf4ob10c8FsxR7UoNAAHgEnHqnwipLHx3CM5Tb4e6wBc1DK1bi4K7%2FF1rjngb2iDKY8woLISDAIOAYREIb9UvPYqyr7GSOv3ZzdCc5tOSQ%3D
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Tue, 16 May 2023 18:11:29 GMT
strict-transport-security: max-age=63072000; includeSubDomains
content-encoding: gzip
cf-cache-status: BYPASS
last-modified: Thu, 15 Apr 2021 17:17:20 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
x-frame-options: SAMEORIGIN
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Od0LsbLRp1V9%2B1phurzFHXzbrx%2FKnm95iZb6EbENTbLnHYGi89MO%2FLs7HoV6o2sAvS3aAjFf6L13fndUMGRjlLrFFSMhZQDeM8XLydj142zg2XeHIm%2FbaBNurHo18BJGzImyn6zbqxmkBc8IANuFIt89FoIs"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
vary: Accept-Encoding
cache-control: max-age=2678400, private
cf-ray: 7c8595582903365c-FRA
x-xss-protection: 1; mode=block
expires: Fri, 16 Jun 2023 18:11:29 GMT

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 334 KB
100 KB 67ms
43ms Script
application/javascript 2a00:1450:4001:831::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-W7XQQZ

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

f1c1161c571ebdd3434b87bfc9f79750cc91759c9baebb10f521021d7f234fa2

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://prefcenter.xanterra.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Tue, 16 May 2023 18:11:28 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 102410
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Tue, 16 May 2023 18:11:28 GMT

GET
H2 200 pnapi_integration-latest.min.js Show response
solutions.invocacdn.com/js/ 125 KB
38 KB 102ms
13ms Script
text/javascript 65.9.95.10
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://solutions.invocacdn.com/js/pnapi_integration-latest.min.js
Requested by: Host: prefcenter.xanterra.com
URL: https://prefcenter.xanterra.com/preferences/?PN_program=XAN_PARKS_NEWSLETTERS&PN_locale=en_US&utm_source=RPI&utm_medium=email&utm_content=Guest&utm_campaign=XAN_230404_TacOffer_Explore-AprilNewsletter_guest_NATL-FNAME-4&PID=61386620&PN_email=6Yf4ob10c8FsxR7UoNAAHgEnHqnwipLHx3CM5Tb4e6wBc1DK1bi4K7%2FF1rjngb2iDKY8woLISDAIOAYREIb9UvPYqyr7GSOv3ZzdCc5tOSQ%3D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 65.9.95.10 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-65-9-95-10.prg50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 8434cc915532036434c5f525d279f37f70a1bcb438e04fa7a17914ded32e1513

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://prefcenter.xanterra.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Tue, 16 May 2023 17:58:10 GMT
x-amz-version-id: jhn2Q0bynpf5E.pNjW1vPZr2FKqzaDR0
content-encoding: br
via: 1.1 6ec6c63eb2f7ec00507af95b1621674c.cloudfront.net (CloudFront)
x-amz-cf-pop: PRG50-C1
age: 799
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
last-modified: Tue, 16 May 2023 13:58:02 GMT
server: AmazonS3
etag: W/"2b94e9c2ac03e1d7e07cd90366dbb5e6"
vary: Accept-Encoding
content-type: text/javascript; charset=utf-8
cache-control: max-age=3600
x-amz-cf-id: _RysAo2HArA9p3d9Tl5SfclvOMjoCe2mldI3er3WYfjApHvsDuIu-A==

GET
H2 200 email-icon.png
prefcenter.xanterra.com/content/themes/verb-base/img/icons/ 1 KB
2 KB 385ms
385ms Image
image/png 2606:4700:20::681a:1b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://prefcenter.xanterra.com/content/themes/verb-base/img/icons/email-icon.png

Requested by

Host: prefcenter.xanterra.com
URL: https://prefcenter.xanterra.com/content/themes/verb-base/css/styles.css?ver=1.0

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:20::681a:1b , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

12aeb715d447513f7ffbcaeefa63981ebec5f3423ee28c1d83d1429ff8a80b6b

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://prefcenter.xanterra.com/content/themes/verb-base/css/styles.css?ver=1.0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Tue, 16 May 2023 18:11:29 GMT
strict-transport-security: max-age=63072000; includeSubDomains
cf-cache-status: MISS
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-length: 1133
x-xss-protection: 1; mode=block
last-modified: Thu, 15 Apr 2021 17:17:20 GMT
server: cloudflare
etag: "46d-5c00609396fe3"
x-frame-options: SAMEORIGIN
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=VAB28c4e%2BmkV%2FwErgqwntguVHGrpl2624PqNnXB97fHpfMbCwXhzf8V4KHAR60o8O8D2c6p655Mb%2FvyAUOU5b3RulimabEh%2B9QTvf441X747KINtkVQ0A0YjVcufjMe9HcTsF%2BA7BcDenRPN%2FobZxFEJyOqd"}],"group":"cf-nel","max_age":604800}
content-type: image/png
vary: Accept-Encoding
cache-control: max-age=2678400, public
accept-ranges: bytes
cf-ray: 7c8595582907365c-FRA
expires: Fri, 16 Jun 2023 18:11:28 GMT

GET
H2 200 ieVl2ZhZI2eCN5jzbjEETS9weq8-19K7DQ.woff2
fonts.gstatic.com/s/robotocondensed/v25/ 15 KB
15 KB 48ms
22ms Font
font/woff2 2a00:1450:4001:82b::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/robotocondensed/v25/ieVl2ZhZI2eCN5jzbjEETS9weq8-19K7DQ.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto+Condensed:400,700

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

6b4fac99c39b9ee2693d87a2508d0c7d4b4859072966616bd1f6e18c5b2f9d36

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://prefcenter.xanterra.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Sat, 13 May 2023 18:48:29 GMT
x-content-type-options: nosniff
age: 256979
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15700
x-xss-protection: 0
last-modified: Tue, 19 Apr 2022 18:51:55 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 12 May 2024 18:48:29 GMT

GET
H2 200 ieVi2ZhZI2eCN5jzbjEETS9weq8-32meGCQYbw.woff2
fonts.gstatic.com/s/robotocondensed/v25/ 15 KB
16 KB 35ms
9ms Font
font/woff2 2a00:1450:4001:82b::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/robotocondensed/v25/ieVi2ZhZI2eCN5jzbjEETS9weq8-32meGCQYbw.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto+Condensed:400,700

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

e79c1c1a140e6afb861074c70392db54cc65a06050de2a69162ab94eb95b0516

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://prefcenter.xanterra.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Fri, 12 May 2023 03:55:21 GMT
x-content-type-options: nosniff
age: 396967
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15660
x-xss-protection: 0
last-modified: Tue, 19 Apr 2022 18:42:42 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 11 May 2024 03:55:21 GMT

GET
H2 200 KFOlCnqEu92Fr1MmWUlfBBc4.woff2
fonts.gstatic.com/s/roboto/v30/ 15 KB
16 KB 36ms
10ms Font
font/woff2 2a00:1450:4001:82b::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmWUlfBBc4.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto:400,500,700,300

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f5aebdfea35d1e7656ef4acc5db1f243209755ae3300943ef8fc6280f363c860

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://prefcenter.xanterra.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Sat, 13 May 2023 06:22:44 GMT
x-content-type-options: nosniff
age: 301724
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15860
x-xss-protection: 0
last-modified: Wed, 11 May 2022 19:24:42 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 12 May 2024 06:22:44 GMT

GET
H2 200 KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v30/ 15 KB
15 KB 42ms
16ms Font
font/woff2 2a00:1450:4001:82b::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu4mxK.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto:400,500,700,300

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f6734f8177112c0839b961f96d813fcb189d81b60e96c33278c1983b6f419615

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://prefcenter.xanterra.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Sat, 13 May 2023 06:10:15 GMT
x-content-type-options: nosniff
age: 302473
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15744
x-xss-protection: 0
last-modified: Wed, 11 May 2022 19:24:48 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 12 May 2024 06:10:15 GMT

GET
H2 200 KFOlCnqEu92Fr1MmSU5fBBc4.woff2
fonts.gstatic.com/s/roboto/v30/ 15 KB
15 KB 44ms
18ms Font
font/woff2 2a00:1450:4001:82b::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmSU5fBBc4.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto:400,500,700,300

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f75911313e1c7802c23345ab57e754d87801581706780c993fb23ff4e0fe62ef

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://prefcenter.xanterra.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Fri, 12 May 2023 23:14:12 GMT
x-content-type-options: nosniff
age: 327436
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15740
x-xss-protection: 0
last-modified: Wed, 11 May 2022 19:24:56 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 11 May 2024 23:14:12 GMT

GET
H2 200 KFOlCnqEu92Fr1MmEU9fBBc4.woff2
fonts.gstatic.com/s/roboto/v30/ 16 KB
16 KB 46ms
20ms Font
font/woff2 2a00:1450:4001:82b::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmEU9fBBc4.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto:400,500,700,300

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b019538234514166ec7665359d097403358f8a4c991901983922fb4d56989f1e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://prefcenter.xanterra.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Sat, 13 May 2023 18:58:23 GMT
x-content-type-options: nosniff
age: 256385
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15920
x-xss-protection: 0
last-modified: Wed, 11 May 2022 19:24:45 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 12 May 2024 18:58:23 GMT

GET
H/1.1 200
OK engage.js Show response
us-content.vergic.com/966AFF34-10C0-4D5E-975D-4C5C3747A029/ 738 KB
167 KB 180ms
30ms Script
application/javascript 46.21.96.230
PORTLANE www.port...

General

Check archive.org

Show headers Download Go to

Full URL

https://us-content.vergic.com/966AFF34-10C0-4D5E-975D-4C5C3747A029/engage.js

Requested by

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

46.21.96.230 , Sweden, ASN42708 (PORTLANE www.portlane.com, SE),

Reverse DNS

sto-main.static.vergic.com

Software

Resource Hash

758d3729c1e268a24532cd943970fa5147eef854f4d940552271fa54d2ee7bf6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://prefcenter.xanterra.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Tue, 16 May 2023 17:17:53 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 3215
etag: W/"b87f8-cj2xY9U7wI8+gVJ3I3jOxgWG+7c"
vary: Accept-Encoding
x-cache: HIT
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
access-control-allow-methods: GET
cache-control: public, max-age=600
access-control-max-age: 3600
accept-ranges: bytes
content-length: 170434
x-xss-protection: 1; mode=block

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 51 KB
21 KB 33ms
8ms Script
text/javascript 2a00:1450:4001:830::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-W7XQQZ

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

e7b90d32907f89c49e9e2a2ccca95133277f756f13a14187936d9b948ff67b44

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://prefcenter.xanterra.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
date: Tue, 16 May 2023 17:05:00 GMT
last-modified: Mon, 17 Apr 2023 22:36:01 GMT
server: Golfe2
age: 3988
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 20737
expires: Tue, 16 May 2023 19:05:00 GMT

GET
H2 200 / Show response
www.googleadservices.com/pagead/conversion/975854640/ 3 KB
2 KB 63ms
24ms Script
text/javascript 172.217.16.130
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googleadservices.com/pagead/conversion/975854640/?random=1684260688770&cv=11&fst=1684260688770&bg=ffffff&guid=ON&async=1&gtm=45He35a0&u_w=1600&u_h=1200&url=https%3A%2F%2Fprefcenter.xanterra.com%2Fpreferences%2F%3FPN_program%3DXAN_PARKS_NEWSLETTERS%26PN_locale%3Den_US%26utm_source%3DRPI%26utm_medium%3Demail%26utm_content%3DGuest%26utm_campaign%3DXAN_230404_TacOffer_Explore-AprilNewsletter_guest_NATL-FNAME-4%26PID%3D61386620%26PN_email%3D6Yf4ob10c8FsxR7UoNAAHgEnHqnwipLHx3CM5Tb4e6wBc1DK1bi4K7%252FF1rjngb2iDKY8woLISDAIOAYREIb9UvPYqyr7GSOv3ZzdCc5tOSQ%253D&label=F6qnCPORsYgDELC4qdED&hn=www.googleadservices.com&frm=0&tiba=Preferences%20%7C%20Xanterra&value=0&bttype=purchase&auid=541956406.1684260689&uamb=0&uaw=0&rfmt=3&fmt=4

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-W7XQQZ

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.16.130 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra15s46-in-f2.1e100.net

Software

cafe /

Resource Hash

5c857bd5b02e674094d3c25ea27e7141a3ccd6e8c6d4e0cf2de49878b22d9246

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://prefcenter.xanterra.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 16 May 2023 18:11:28 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1837
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 rpiWebClient.config.js Show response
cdn.redpointglobal.com/rpiwebclient/xan/ 512 B
880 B 546ms
407ms Script
application/javascript 2620:1ec:4f:1::69
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.redpointglobal.com/rpiwebclient/xan/rpiWebClient.config.js
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-W7XQQZ
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2620:1ec:4f:1::69 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: 07c28c0d8e516ed8c5cbbf7f9f8cd47a50d4f34adf14bc84d83451b9f8bd5dca

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://prefcenter.xanterra.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

x-ms-lease-status: unlocked
x-ms-blob-type: BlockBlob
date: Tue, 16 May 2023 18:11:28 GMT
last-modified: Mon, 16 Nov 2020 21:03:02 GMT
content-md5: CDDVYSGX8EZ2fl0KQ3yDlg==
etag: 0x8D88A73018E8194
x-azure-ref: 0UMdjZAAAAABjl9b7pjfRRrkPTPhNSHHPRlJBMzFFREdFMDMxMwA1ZTg5MTMwMC1iMjQzLTRmZDMtOGYxMS03ZjhlZjJiMmMwZWQ=
x-cache: CONFIG_NOCACHE
content-type: application/javascript
access-control-allow-origin: *
x-ms-request-id: 5e161cb4-101e-008b-5321-881070000000
x-ms-version: 2009-09-19
content-length: 512

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 220 KB
78 KB 32ms
31ms Script
application/javascript 2a00:1450:4001:831::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-SCQLPVN73T&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-W7XQQZ

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

463333e1a7c98f78a768cbbed49810155e0878cff618646df46d706e8cd62a34

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://prefcenter.xanterra.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

date: Tue, 16 May 2023 18:11:28 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 79478
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Tue, 16 May 2023 18:11:28 GMT

GET
H2 200 tag-live.js Show response
solutions.invocacdn.com/js/networks/1449/2105924663/ 6 KB
2 KB 417ms
417ms Script
text/javascript 65.9.95.10
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://solutions.invocacdn.com/js/networks/1449/2105924663/tag-live.js
Requested by: Host: solutions.invocacdn.com
URL: https://solutions.invocacdn.com/js/pnapi_integration-latest.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 65.9.95.10 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-65-9-95-10.prg50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 189211cd665ce246ce73bcf3d0aff8c0c0e211d49d3ed21954aa47061d5b9e45

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://prefcenter.xanterra.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

x-amz-version-id: JTi6HVQvVleBmWfFygvoLFceiAP_41gB
content-encoding: br
via: 1.1 6ec6c63eb2f7ec00507af95b1621674c.cloudfront.net (CloudFront)
date: Tue, 16 May 2023 18:11:30 GMT
last-modified: Wed, 08 Feb 2023 16:54:00 GMT
server: AmazonS3
x-amz-cf-pop: PRG50-C1
x-amz-server-side-encryption: AES256
etag: W/"7a755eb8405c3c840ac49b42f549f3d5"
vary: Accept-Encoding
x-cache: RefreshHit from cloudfront
content-type: text/javascript
cache-control: max-age=300
x-amz-replication-status: COMPLETED
x-amz-cf-id: E2MWhx0UY85pV200y8sOcvuJ9Er0mo06CAfA9AfFZ7xZckbt4nQ5XA==

POST
H2 200 collect Show response
stats.g.doubleclick.net/j/ 4 B
354 B 59ms
20ms XHR
text/plain 2a00:1450:400c:c00::9d
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j100&tid=UA-1085772-42&cid=1803371105.1684260689&jid=1792441090&gjid=983316714&_gid=1145702150.1684260689&_u=YGBAiEABBAAAAEAAI~&z=739500280

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400c:c00::9d Brussels, Belgium, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://prefcenter.xanterra.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
strict-transport-security: max-age=10886400; includeSubDomains; preload
date: Tue, 16 May 2023 18:11:28 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://prefcenter.xanterra.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 200 collect Show response
stats.g.doubleclick.net/j/ 4 B
70 B 56ms
20ms XHR
text/plain 2a00:1450:400c:c00::9d
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j100&tid=UA-1085772-35&cid=1803371105.1684260689&jid=1998155102&gjid=1190771851&_gid=1145702150.1684260689&_u=YGDAiEABBAAAAEAAI~&z=431071824

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400c:c00::9d Brussels, Belgium, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://prefcenter.xanterra.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
strict-transport-security: max-age=10886400; includeSubDomains; preload
date: Tue, 16 May 2023 18:11:28 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://prefcenter.xanterra.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 collect
www.google-analytics.com/ 35 B
194 B 8ms
8ms Image
image/gif 2a00:1450:4001:830::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j100&a=625742101&t=pageview&_s=1&dl=https%3A%2F%2Fprefcenter.xanterra.com%2Fpreferences%2F%3FPN_program%3DXAN_PARKS_NEWSLETTERS%26PN_locale%3Den_US%26utm_source%3DRPI%26utm_medium%3Demail%26utm_content%3DGuest%26utm_campaign%3DXAN_230404_TacOffer_Explore-AprilNewsletter_guest_NATL-FNAME-4%26PID%3D61386620%26PN_email%3D6Yf4ob10c8FsxR7UoNAAHgEnHqnwipLHx3CM5Tb4e6wBc1DK1bi4K7%252FF1rjngb2iDKY8woLISDAIOAYREIb9UvPYqyr7GSOv3ZzdCc5tOSQ%253D&ul=en-us&de=UTF-8&dt=Preferences%20%7C%20Xanterra&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YGBAiEABBAAAAAAAI~&jid=1792441090&gjid=983316714&cid=1803371105.1684260689&tid=UA-1085772-42&_gid=1145702150.1684260689&gtm=45He35a0n71W7XQQZ&z=974246827

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://prefcenter.xanterra.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 16 May 2023 04:35:31 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 48957
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H2 200 collect
www.google-analytics.com/ 35 B
91 B 8ms
8ms Image
image/gif 2a00:1450:4001:830::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j100&a=625742101&t=pageview&_s=1&dl=https%3A%2F%2Fprefcenter.xanterra.com%2Fpreferences%2F%3FPN_program%3DXAN_PARKS_NEWSLETTERS%26PN_locale%3Den_US%26utm_source%3DRPI%26utm_medium%3Demail%26utm_content%3DGuest%26utm_campaign%3DXAN_230404_TacOffer_Explore-AprilNewsletter_guest_NATL-FNAME-4%26PID%3D61386620%26PN_email%3D6Yf4ob10c8FsxR7UoNAAHgEnHqnwipLHx3CM5Tb4e6wBc1DK1bi4K7%252FF1rjngb2iDKY8woLISDAIOAYREIb9UvPYqyr7GSOv3ZzdCc5tOSQ%253D&ul=en-us&de=UTF-8&dt=Preferences%20%7C%20Xanterra&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YGDAiEABBAAAAEAAI~&jid=1998155102&gjid=1190771851&cid=1803371105.1684260689&tid=UA-1085772-35&_gid=1145702150.1684260689&gtm=45He35a0n71W7XQQZ&z=957302963

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://prefcenter.xanterra.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 16 May 2023 04:35:31 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 48957
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

POST
H2 204 collect
region1.analytics.google.com/g/ 0
259 B 40ms
15ms Ping
text/plain 2001:4860:4802:32::36
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://region1.analytics.google.com/g/collect?v=2&tid=G-SCQLPVN73T&gtm=45je35a0&_p=625742101&_gaz=1&cid=1803371105.1684260689&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&_s=1&sid=1684260688&sct=1&seg=0&dl=https%3A%2F%2Fprefcenter.xanterra.com%2Fpreferences%2F%3FPN_program%3DXAN_PARKS_NEWSLETTERS%26PN_locale%3Den_US%26utm_source%3DRPI%26utm_medium%3Demail%26utm_content%3DGuest%26utm_campaign%3DXAN_230404_TacOffer_Explore-AprilNewsletter_guest_NATL-FNAME-4%26PID%3D61386620%26PN_email%3D6Yf4ob10c8FsxR7UoNAAHgEnHqnwipLHx3CM5Tb4e6wBc1DK1bi4K7%252FF1rjngb2iDKY8woLISDAIOAYREIb9UvPYqyr7GSOv3ZzdCc5tOSQ%253D&dt=Preferences%20%7C%20Xanterra&en=page_view&_fv=1&_ss=1
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-SCQLPVN73T&l=dataLayer&cx=c
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4860:4802:32::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://prefcenter.xanterra.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 16 May 2023 18:11:28 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://prefcenter.xanterra.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 204 collect
stats.g.doubleclick.net/g/ 0
56 B 33ms
20ms Ping
text/plain 2a00:1450:400c:c00::9d
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://stats.g.doubleclick.net/g/collect?v=2&tid=G-SCQLPVN73T&cid=1803371105.1684260689&gtm=45je35a0&aip=1
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-SCQLPVN73T&l=dataLayer&cx=c
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:400c:c00::9d Brussels, Belgium, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://prefcenter.xanterra.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 16 May 2023 18:11:28 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://prefcenter.xanterra.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ga-audiences
www.google.de/ads/ 42 B
408 B 71ms
46ms Image
image/gif 2a00:1450:4001:828::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/ads/ga-audiences?v=1&t=sr&slf_rd=1&_r=4&tid=G-SCQLPVN73T&cid=1803371105.1684260689&gtm=45je35a0&aip=1&z=141883956

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://prefcenter.xanterra.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 16 May 2023 18:11:28 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

/
www.google.de/pagead/1p-conversion/975854640/
Redirect Chain

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/975854640/?random=557867587&cv=11&fst=1684260688770&bg=ffffff&guid=ON&async=1&gtm=45He35a0&u_w=1600&u_h=1200&url=https%3A%2F%2Fprefc...
https://www.google.com/pagead/1p-conversion/975854640/?random=557867587&cv=11&fst=1684260688770&bg=ffffff&guid=ON&async=1&gtm=45He35a0&u_w=1600&u_h=1200&url=https%3A%2F%2Fprefcenter.xanterra.com%2F...
https://www.google.de/pagead/1p-conversion/975854640/?random=557867587&cv=11&fst=1684260688770&bg=ffffff&guid=ON&async=1&gtm=45He35a0&u_w=1600&u_h=1200&url=https%3A%2F%2Fprefcenter.xanterra.com%2Fp...

42 B
154 B

36ms
35ms

Image
image/gif

2a00:1450:4001:828::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-conversion/975854640/?random=557867587&cv=11&fst=1684260688770&bg=ffffff&guid=ON&async=1&gtm=45He35a0&u_w=1600&u_h=1200&url=https%3A%2F%2Fprefcenter.xanterra.com%2Fpreferences%2F%3FPN_program%3DXAN_PARKS_NEWSLETTERS%26PN_locale%3Den_US%26utm_source%3DRPI%26utm_medium%3Demail%26utm_content%3DGuest%26utm_campaign%3DXAN_230404_TacOffer_Explore-AprilNewsletter_guest_NATL-FNAME-4%26PID%3D61386620%26PN_email%3D6Yf4ob10c8FsxR7UoNAAHgEnHqnwipLHx3CM5Tb4e6wBc1DK1bi4K7%252FF1rjngb2iDKY8woLISDAIOAYREIb9UvPYqyr7GSOv3ZzdCc5tOSQ%253D&label=F6qnCPORsYgDELC4qdED&hn=www.googleadservices.com&frm=0&tiba=Preferences%20%7C%20Xanterra&value=0&auid=541956406.1684260689&uamb=0&uaw=0&fmt=3&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&sscte=1&crd=&pscrd=EkxDaEFJOE5PTW93WVFoclNaaEtpTzlic3NFaVVBbm5PQWwwYVhSbDlwXzB1ZTkwUjVhVE1qYjdENlZ2U09XYXFXYlRWT2ZzZEQxRVpsGlhDaEVJOE5PTW93WVF3X2FpbnNuanZ0TENBUkl0QUQ0bzhqT0JGdDJjTll2Mi11Yy1YYXRYbmRXV0lZOXc0dC1ZVzVEb3llRUtLSVdMM3pEYTlEejVrM0Zz&is_vtc=1&ocp_id=UMdjZLKoMs-VzAaa8pGABA&eitems=ChAI8NOMowYQ7Yme_4qq3ecgEh0AAVRQQNbtjnrao0SEab7NFPLUk6ljONNBR_MzXA&random=3231005381&ipr=y

Requested by

Protocol

Server

2a00:1450:4001:828::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://prefcenter.xanterra.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 16 May 2023 18:11:28 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Tue, 16 May 2023 18:11:28 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
location: https://www.google.de/pagead/1p-conversion/975854640/?random=557867587&cv=11&fst=1684260688770&bg=ffffff&guid=ON&async=1&gtm=45He35a0&u_w=1600&u_h=1200&url=https%3A%2F%2Fprefcenter.xanterra.com%2Fpreferences%2F%3FPN_program%3DXAN_PARKS_NEWSLETTERS%26PN_locale%3Den_US%26utm_source%3DRPI%26utm_medium%3Demail%26utm_content%3DGuest%26utm_campaign%3DXAN_230404_TacOffer_Explore-AprilNewsletter_guest_NATL-FNAME-4%26PID%3D61386620%26PN_email%3D6Yf4ob10c8FsxR7UoNAAHgEnHqnwipLHx3CM5Tb4e6wBc1DK1bi4K7%252FF1rjngb2iDKY8woLISDAIOAYREIb9UvPYqyr7GSOv3ZzdCc5tOSQ%253D&label=F6qnCPORsYgDELC4qdED&hn=www.googleadservices.com&frm=0&tiba=Preferences%20%7C%20Xanterra&value=0&auid=541956406.1684260689&uamb=0&uaw=0&fmt=3&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&sscte=1&crd=&pscrd=EkxDaEFJOE5PTW93WVFoclNaaEtpTzlic3NFaVVBbm5PQWwwYVhSbDlwXzB1ZTkwUjVhVE1qYjdENlZ2U09XYXFXYlRWT2ZzZEQxRVpsGlhDaEVJOE5PTW93WVF3X2FpbnNuanZ0TENBUkl0QUQ0bzhqT0JGdDJjTll2Mi11Yy1YYXRYbmRXV0lZOXc0dC1ZVzVEb3llRUtLSVdMM3pEYTlEejVrM0Zz&is_vtc=1&ocp_id=UMdjZLKoMs-VzAaa8pGABA&eitems=ChAI8NOMowYQ7Yme_4qq3ecgEh0AAVRQQNbtjnrao0SEab7NFPLUk6ljONNBR_MzXA&random=3231005381&ipr=y
content-type: image/gif
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ga-audiences
www.google.com/ads/ 42 B
107 B 72ms
47ms Image
image/gif 2a00:1450:4001:828::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j100&tid=UA-1085772-42&cid=1803371105.1684260689&jid=1792441090&_u=YGBAiEABBAAAAEAAI~&z=1952106181

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://prefcenter.xanterra.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 16 May 2023 18:11:28 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ga-audiences
www.google.de/ads/ 42 B
107 B 46ms
46ms Image
image/gif 2a00:1450:4001:828::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j100&tid=UA-1085772-42&cid=1803371105.1684260689&jid=1792441090&_u=YGBAiEABBAAAAEAAI~&z=1952106181

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://prefcenter.xanterra.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 16 May 2023 18:11:28 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ga-audiences
www.google.com/ads/ 42 B
107 B 72ms
47ms Image
image/gif 2a00:1450:4001:828::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j100&tid=UA-1085772-35&cid=1803371105.1684260689&jid=1998155102&_u=YGDAiEABBAAAAEAAI~&z=381044372

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://prefcenter.xanterra.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 16 May 2023 18:11:28 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ga-audiences
www.google.de/ads/ 42 B
107 B 81ms
81ms Image
image/gif 2a00:1450:4001:828::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j100&tid=UA-1085772-35&cid=1803371105.1684260689&jid=1998155102&_u=YGDAiEABBAAAAEAAI~&z=381044372

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://prefcenter.xanterra.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 16 May 2023 18:11:28 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H/1.1 200
OK 966aff34-10c0-4d5e-975d-4c5c3747a029 Show response
us-xanterra.vergic.com/api/v1/register/ 227 B
668 B 96ms
32ms XHR
application/json 46.21.96.230
PORTLANE www.port...

General

Check archive.org

Show headers Download Go to

Full URL

https://us-xanterra.vergic.com/api/v1/register/966aff34-10c0-4d5e-975d-4c5c3747a029?json=true

Requested by

Host: us-content.vergic.com
URL: https://us-content.vergic.com/966AFF34-10C0-4D5E-975D-4C5C3747A029/engage.js

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

46.21.96.230 , Sweden, ASN42708 (PORTLANE www.portlane.com, SE),

Reverse DNS

sto-main.static.vergic.com

Software

Resource Hash

b45dc41842c4d031567bd2556c1ed78d2597dcd11638543b9cdb3100ee48ab8d

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Accept: application/json
Referer: https://prefcenter.xanterra.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type: text/plain; charset=UTF-8

Response headers

date: Tue, 16 May 2023 18:11:28 GMT
x-content-type-options: nosniff
access-control-max-age: 604800
p3p: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
access-control-allow-origin: https://prefcenter.xanterra.com
content-type: application/json; charset=utf-8
access-control-allow-credentials: true
content-length: 227

GET
BLOB 200
OK 6ceac581-0e07-454b-a45f-6462e6d2e5b7
https://prefcenter.xanterra.com/ 671 B
0 Other
application/javascript

General

Check archive.org

Show headers Download Go to

Full URL: blob:https://prefcenter.xanterra.com/6ceac581-0e07-454b-a45f-6462e6d2e5b7
Requested by: Host: prefcenter.xanterra.com
URL: https://prefcenter.xanterra.com/preferences/?PN_program=XAN_PARKS_NEWSLETTERS&PN_locale=en_US&utm_source=RPI&utm_medium=email&utm_content=Guest&utm_campaign=XAN_230404_TacOffer_Explore-AprilNewsletter_guest_NATL-FNAME-4&PID=61386620&PN_email=6Yf4ob10c8FsxR7UoNAAHgEnHqnwipLHx3CM5Tb4e6wBc1DK1bi4K7%2FF1rjngb2iDKY8woLISDAIOAYREIb9UvPYqyr7GSOv3ZzdCc5tOSQ%3D
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: c70908b0fe898ff100fff1ae90804fed2a17b55c4cca052cda9f89b9642f0edc

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Content-Length: 671
Content-Type: application/javascript; charset=utf-8

POST
H3 200 collect Show response
www.google-analytics.com/j/ 4 B
24 B 16ms
16ms XHR
text/plain 2a00:1450:4001:830::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j100&a=625742101&t=event&ni=1&_s=1&dl=https%3A%2F%2Fprefcenter.xanterra.com%2Fpreferences%2F%3FPN_program%3DXAN_PARKS_NEWSLETTERS%26PN_locale%3Den_US%26utm_source%3DRPI%26utm_medium%3Demail%26utm_content%3DGuest%26utm_campaign%3DXAN_230404_TacOffer_Explore-AprilNewsletter_guest_NATL-FNAME-4%26PID%3D61386620%26PN_email%3D6Yf4ob10c8FsxR7UoNAAHgEnHqnwipLHx3CM5Tb4e6wBc1DK1bi4K7%252FF1rjngb2iDKY8woLISDAIOAYREIb9UvPYqyr7GSOv3ZzdCc5tOSQ%253D&ul=en-us&de=UTF-8&dt=Preferences%20%7C%20Xanterra&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&ec=UX&ea=Query%20String%20Tracker&el=XAN_PARKS_NEWSLETTERS%20-%20en_US&_u=aGHACEABBAAAAGAAI~&jid=462215805&gjid=897775291&cid=1803371105.1684260689&tid=UA-1085772-42&_gid=1145702150.1684260689&_r=1&_slc=1&gtm=45He35a0n71W7XQQZ&cd1=XAN_PARKS_NEWSLETTERS&cd2=en_US&z=2014087717

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

aec60bc104db041b1512185839f18f52986df7e569e5445f740dd60f763fbca8

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://prefcenter.xanterra.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Tue, 16 May 2023 18:11:29 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://prefcenter.xanterra.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 200 collect Show response
stats.g.doubleclick.net/j/ 4 B
70 B 21ms
20ms XHR
text/plain 2a00:1450:400c:c00::9d
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j100&tid=UA-1085772-42&cid=1803371105.1684260689&jid=462215805&gjid=897775291&_gid=1145702150.1684260689&_u=aGHACEABBAAAAGAAI~&z=570313504

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400c:c00::9d Brussels, Belgium, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://prefcenter.xanterra.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
strict-transport-security: max-age=10886400; includeSubDomains; preload
date: Tue, 16 May 2023 18:11:29 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://prefcenter.xanterra.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ga-audiences
www.google.com/ads/ 42 B
107 B 46ms
45ms Image
image/gif 2a00:1450:4001:828::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j100&tid=UA-1085772-42&cid=1803371105.1684260689&jid=462215805&_u=aGHACEABBAAAAGAAI~&z=1825961456

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://prefcenter.xanterra.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 16 May 2023 18:11:29 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ga-audiences
www.google.de/ads/ 42 B
63 B 45ms
45ms Image
image/gif 2a00:1450:4001:828::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j100&tid=UA-1085772-42&cid=1803371105.1684260689&jid=462215805&_u=aGHACEABBAAAAGAAI~&z=1825961456

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:828::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://prefcenter.xanterra.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 16 May 2023 18:11:29 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 204
No Content visitor Show response
us-xanterra.vergic.com/api/v1/session/bucket/ 0
409 B 31ms
31ms XHR
text/plain 46.21.96.230
PORTLANE www.port...

General

Check archive.org

Show headers Download Go to

Full URL

https://us-xanterra.vergic.com/api/v1/session/bucket/visitor?json=true&sessionId=479b385b-196a-4162-a74d-662fad7e4128%2BNzMC5GS08rsoa719CpUTxzHtkro8uDWGhRwneZyTeI%3D

Requested by

Host: us-content.vergic.com
URL: https://us-content.vergic.com/966AFF34-10C0-4D5E-975D-4C5C3747A029/engage.js

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

46.21.96.230 , Sweden, ASN42708 (PORTLANE www.portlane.com, SE),

Reverse DNS

sto-main.static.vergic.com

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Accept: application/json
Referer: https://prefcenter.xanterra.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type: text/plain; charset=utf-8

Response headers

date: Tue, 16 May 2023 18:11:29 GMT
content-security-policy: object-src 'none'
referrer-policy: origin
x-content-type-options: nosniff
access-control-max-age: 604800
p3p: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
access-control-allow-origin: https://prefcenter.xanterra.com
access-control-allow-credentials: true
x-xss-protection: 1; mode=block

GET
H/1.1 200
OK na.jsonp Show response
pnapi.invoca.net/1449/ 98 B
276 B 424ms
112ms Script
text/plain 52.54.248.140
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://pnapi.invoca.net/1449/na.jsonp?network_id=1449&js_version=4.30.2&tag_id=1449%2F2105924663&request_data_shared_params=%7B%22pn_program%22%3A%22XAN_PARKS_NEWSLETTERS%22%2C%22pn_locale%22%3A%22en_US%22%2C%22utm_source%22%3A%22RPI%22%2C%22utm_medium%22%3A%22email%22%2C%22utm_content%22%3A%22Guest%22%2C%22utm_campaign%22%3A%22XAN_230404_TacOffer_Explore-AprilNewsletter_guest_NATL-FNAME-4%22%2C%22pid%22%3A%2261386620%22%2C%22pn_email%22%3A%226Yf4ob10c8FsxR7UoNAAHgEnHqnwipLHx3CM5Tb4e6wBc1DK1bi4K7%2FF1rjngb2iDKY8woLISDAIOAYREIb9UvPYqyr7GSOv3ZzdCc5tOSQ%3D%22%2C%22calling_page%22%3A%22https%3A%2F%2Fprefcenter.xanterra.com%2Fpreferences%2F%3FPN_program%3DXAN_PARKS_NEWSLETTERS%26PN_locale%3Den_US%26utm_source%3DRPI%26utm_medium%3Demail%26utm_content%3DGuest%26utm_campaign%3DXAN_230404_TacOffer_Explore-AprilNewsletter_guest_NATL-FNAME-4%26PID%3D61386620%26PN_email%3D6Yf4ob10c8FsxR7UoNAAHgEnHqnwipLHx3CM5Tb4e6wBc1DK1bi4K7%252FF1rjngb2iDKY8woLISDAIOAYREIb9UvPYqyr7GSOv3ZzdCc5tOSQ%253D%22%2C%22landing_page%22%3A%22https%3A%2F%2Fprefcenter.xanterra.com%2Fpreferences%2F%3FPN_program%3DXAN_PARKS_NEWSLETTERS%26PN_locale%3Den_US%26utm_source%3DRPI%26utm_medium%3Demail%26utm_content%3DGuest%26utm_campaign%3DXAN_230404_TacOffer_Explore-AprilNewsletter_guest_NATL-FNAME-4%26PID%3D61386620%26PN_email%3D6Yf4ob10c8FsxR7UoNAAHgEnHqnwipLHx3CM5Tb4e6wBc1DK1bi4K7%252FF1rjngb2iDKY8woLISDAIOAYREIb9UvPYqyr7GSOv3ZzdCc5tOSQ%253D%22%2C%22travel_destination%22%3A%22%E2%80%94%22%2C%22g_cid%22%3A%221803371105.1684260689%22%2C%22url_source%22%3A%22RPI%22%2C%22url_medium%22%3A%22email%22%2C%22invoca_id%22%3A%22i-f76f6c1e-165d-455e-cbcd-b88a511c4c22%22%7D&client_messages=%7B%22allDataReset%22%3Atrue%7D&client_info=%7B%22url%22%3A%22https%3A%2F%2Fprefcenter.xanterra.com%2Fpreferences%2F%3FPN_program%3DXAN_PARKS_NEWSLETTERS%26PN_locale%3Den_US%26utm_source%3DRPI%26utm_medium%3Demail%26utm_content%3DGuest%26utm_campaign%3DXAN_230404_TacOffer_Explore-AprilNewsletter_guest_NATL-FNAME-4%26PID%3D61386620%26PN_email%3D6Yf4ob10c8FsxR7UoNAAHgEnHqnwipLHx3CM5Tb4e6wBc1DK1bi4K7%252FF1rjngb2iDKY8woLISDAIOAYREIb9UvPYqyr7GSOv3ZzdCc5tOSQ%253D%22%2C%22referrer%22%3A%22%22%2C%22cores%22%3A4%2C%22platform%22%3A%22Win32%22%2C%22screenWidth%22%3A1600%2C%22screenHeight%22%3A1200%2C%22language%22%3A%22en-US%22%7D&jsoncallback=json_rr1&
Requested by: Host: solutions.invocacdn.com
URL: https://solutions.invocacdn.com/js/pnapi_integration-latest.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.54.248.140 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-54-248-140.compute-1.amazonaws.com
Software: Goliath /
Resource Hash: 52f7667c910d22fb987eec9a47084cf5ea1c2b636be37edec68d5f1ab431ebc6

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://prefcenter.xanterra.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Access-Control-Allow-Origin: *
Date: Tue, 16 May 2023 18:11:29 GMT
Server: Goliath
Connection: keep-alive
processing_time: 12.15682ms
Content-Length: 98

POST
H/1.1 200
OK Create Show response
us-xanterra.vergic.com/api/v1/Register/TransportToken/ 63 B
429 B 30ms
30ms XHR
application/json 46.21.96.230
PORTLANE www.port...

General

Check archive.org

Show headers Download Go to

Full URL

https://us-xanterra.vergic.com/api/v1/Register/TransportToken/Create?json=true&sessionId=479b385b-196a-4162-a74d-662fad7e4128%2BNzMC5GS08rsoa719CpUTxzHtkro8uDWGhRwneZyTeI%3D

Requested by

Host: us-content.vergic.com
URL: https://us-content.vergic.com/966AFF34-10C0-4D5E-975D-4C5C3747A029/engage.js

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

46.21.96.230 , Sweden, ASN42708 (PORTLANE www.portlane.com, SE),

Reverse DNS

sto-main.static.vergic.com

Software

Resource Hash

81275c883bbfb873573116e57d1483d0250b38e05e17238949f4bc23b0e50063

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Accept: application/json
Referer: https://prefcenter.xanterra.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type: text/plain; charset=utf-8

Response headers

date: Tue, 16 May 2023 18:11:29 GMT
x-content-type-options: nosniff
access-control-max-age: 604800
p3p: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
access-control-allow-origin: https://prefcenter.xanterra.com
content-type: application/json; charset=utf-8
access-control-allow-credentials: true
content-length: 63

GET
H2 200 rpiWebClient-latest.js Show response
cdn.redpointglobal.com/rpiwebclient/xan/ 53 KB
53 KB 104ms
104ms Script
application/javascript 2620:1ec:4f:1::69
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.redpointglobal.com/rpiwebclient/xan/rpiWebClient-latest.js
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-W7XQQZ
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2620:1ec:4f:1::69 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: baf8255e856d17b0bd20f398381ea37ed517c4ab73abcb86684b124c3179cb1a

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://prefcenter.xanterra.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

x-ms-lease-status: unlocked
x-ms-blob-type: BlockBlob
date: Tue, 16 May 2023 18:11:28 GMT
last-modified: Tue, 10 Nov 2020 17:31:10 GMT
content-md5: aT4p35Tb1iLTKQKwNH4ggA==
etag: 0x8D8859E69DEC0A6
x-azure-ref: 0UcdjZAAAAAA384t3NJRkSZIobXKnx2mrRlJBMzFFREdFMDMxMwA1ZTg5MTMwMC1iMjQzLTRmZDMtOGYxMS03ZjhlZjJiMmMwZWQ=
x-cache: CONFIG_NOCACHE
content-type: application/javascript
access-control-allow-origin: *
x-ms-request-id: 5e161cc1-101e-008b-5e21-881070000000
x-ms-version: 2009-09-19
content-length: 54335

POST
H/1.1 200
OK / Show response
us-xanterra.vergic.com/api/v1/Batch/ 83 B
449 B 29ms
29ms XHR
application/json 46.21.96.230
PORTLANE www.port...

General

Check archive.org

Show headers Download Go to

Full URL

https://us-xanterra.vergic.com/api/v1/Batch/?json=true&sessionId=479b385b-196a-4162-a74d-662fad7e4128%2BNzMC5GS08rsoa719CpUTxzHtkro8uDWGhRwneZyTeI%3D

Requested by

Host: us-content.vergic.com
URL: https://us-content.vergic.com/966AFF34-10C0-4D5E-975D-4C5C3747A029/engage.js

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

46.21.96.230 , Sweden, ASN42708 (PORTLANE www.portlane.com, SE),

Reverse DNS

sto-main.static.vergic.com

Software

Resource Hash

3ea83916659a2fdc71b7661ca4f1f847903caf3f98f0543474d7caa0f28d4676

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Accept: application/json
Referer: https://prefcenter.xanterra.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-Type: text/plain; charset=UTF-8

Response headers

date: Tue, 16 May 2023 18:11:29 GMT
x-content-type-options: nosniff
access-control-max-age: 604800
p3p: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
access-control-allow-origin: https://prefcenter.xanterra.com
content-type: application/json; charset=utf-8
access-control-allow-credentials: true
content-length: 83

POST
H/1.1 200
OK Visit Show response
xanwebrpi.rphelios.net/InteractionRealtimeAPI/api/Cache/ 197 B
543 B 588ms
168ms XHR
application/json 40.118.246.51
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://xanwebrpi.rphelios.net/InteractionRealtimeAPI/api/Cache/Visit?updateProfileOnly=false
Requested by: Host: cdn.redpointglobal.com
URL: https://cdn.redpointglobal.com/rpiwebclient/xan/rpiWebClient-latest.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 40.118.246.51 San Jose, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: ab6fd6c44051ab72cbb8a868370b965a7b9ff84b6930dc0860c8e077cccc8ee4

Request headers

Accept: application/json
Referer: https://prefcenter.xanterra.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-type: text/plain

Response headers

Pragma: no-cache
Date: Tue, 16 May 2023 18:11:29 GMT
Content-Encoding: gzip
Vary: Accept-Encoding
Content-Type: application/json; charset=utf-8
Access-Control-Allow-Origin: *
Cache-Control: no-cache
Content-Length: 284
Expires: -1

POST
H/1.1 200
OK Visit Show response
xanwebrpi.rphelios.net/InteractionRealtimeAPI/api/Cache/ 197 B
544 B 507ms
174ms XHR
application/json 40.118.246.51
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://xanwebrpi.rphelios.net/InteractionRealtimeAPI/api/Cache/Visit?updateProfileOnly=false
Requested by: Host: cdn.redpointglobal.com
URL: https://cdn.redpointglobal.com/rpiwebclient/xan/rpiWebClient-latest.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 40.118.246.51 San Jose, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: b30bb103f71e9e94075d7db6a81b8c17df00a076412e9287d337644b41837f70

Request headers

Accept: application/json
Referer: https://prefcenter.xanterra.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36
Content-type: text/plain

Response headers

Pragma: no-cache
Date: Tue, 16 May 2023 18:11:29 GMT
Content-Encoding: gzip
Vary: Accept-Encoding
Content-Type: application/json; charset=utf-8
Access-Control-Allow-Origin: *
Cache-Control: no-cache
Content-Length: 285
Expires: -1

GET
H/1.1 200
OK na.jsonp Show response
pnapi.invoca.net/1449/ 98 B
275 B 105ms
104ms Script
text/plain 52.54.248.140
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://pnapi.invoca.net/1449/na.jsonp?network_id=1449&js_version=4.30.2&tag_id=1449%2F2105924663&request_data_shared_params=%7B%22invoca_id%22%3A%22i-f76f6c1e-165d-455e-cbcd-b88a511c4c22%22%2C%22utm_medium%22%3A%22email%22%2C%22utm_source%22%3A%22RPI%22%2C%22url_source%22%3A%22RPI%22%2C%22url_medium%22%3A%22email%22%2C%22calling_page%22%3A%22https%3A%2F%2Fprefcenter.xanterra.com%2Fpreferences%2F%3FPN_program%3DXAN_PARKS_NEWSLETTERS%26PN_locale%3Den_US%26utm_source%3DRPI%26utm_medium%3Demail%26utm_content%3DGuest%26utm_campaign%3DXAN_230404_TacOffer_Explore-AprilNewsletter_guest_NATL-FNAME-4%26PID%3D61386620%26PN_email%3D6Yf4ob10c8FsxR7UoNAAHgEnHqnwipLHx3CM5Tb4e6wBc1DK1bi4K7%252FF1rjngb2iDKY8woLISDAIOAYREIb9UvPYqyr7GSOv3ZzdCc5tOSQ%253D%22%2C%22dclid%22%3Anull%2C%22ga4_cid%22%3Anull%2C%22gclid%22%3Anull%2C%22g_cid%22%3A%221803371105.1684260689%22%2C%22keyword%22%3Anull%2C%22landing_page%22%3A%22https%3A%2F%2Fprefcenter.xanterra.com%2Fpreferences%2F%3FPN_program%3DXAN_PARKS_NEWSLETTERS%26PN_locale%3Den_US%26utm_source%3DRPI%26utm_medium%3Demail%26utm_content%3DGuest%26utm_campaign%3DXAN_230404_TacOffer_Explore-AprilNewsletter_guest_NATL-FNAME-4%26PID%3D61386620%26PN_email%3D6Yf4ob10c8FsxR7UoNAAHgEnHqnwipLHx3CM5Tb4e6wBc1DK1bi4K7%252FF1rjngb2iDKY8woLISDAIOAYREIb9UvPYqyr7GSOv3ZzdCc5tOSQ%253D%22%2C%22msclkid%22%3Anull%2C%22pkgid%22%3Anull%2C%22referrer%22%3Anull%2C%22travel_destination%22%3A%22%E2%80%94%22%2C%22utm_campaign%22%3A%22XAN_230404_TacOffer_Explore-AprilNewsletter_guest_NATL-FNAME-4%22%2C%22utm_content%22%3A%22Guest%22%2C%22utm_term%22%3Anull%7D&client_messages=%7B%7D&client_info=%7B%22url%22%3A%22https%3A%2F%2Fprefcenter.xanterra.com%2Fpreferences%2F%3FPN_program%3DXAN_PARKS_NEWSLETTERS%26PN_locale%3Den_US%26utm_source%3DRPI%26utm_medium%3Demail%26utm_content%3DGuest%26utm_campaign%3DXAN_230404_TacOffer_Explore-AprilNewsletter_guest_NATL-FNAME-4%26PID%3D61386620%26PN_email%3D6Yf4ob10c8FsxR7UoNAAHgEnHqnwipLHx3CM5Tb4e6wBc1DK1bi4K7%252FF1rjngb2iDKY8woLISDAIOAYREIb9UvPYqyr7GSOv3ZzdCc5tOSQ%253D%22%2C%22referrer%22%3A%22%22%2C%22cores%22%3A4%2C%22platform%22%3A%22Win32%22%2C%22screenWidth%22%3A1600%2C%22screenHeight%22%3A1200%2C%22language%22%3A%22en-US%22%7D&jsoncallback=json_rr2&
Requested by: Host: solutions.invocacdn.com
URL: https://solutions.invocacdn.com/js/pnapi_integration-latest.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.54.248.140 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-54-248-140.compute-1.amazonaws.com
Software: Goliath /
Resource Hash: 845c01f3979f9c7f69567a6a2764970dbc6ada03ed0ae992c2a444735f84fa8f

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://prefcenter.xanterra.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.92 Safari/537.36

Response headers

Access-Control-Allow-Origin: *
Date: Tue, 16 May 2023 18:11:31 GMT
Server: Goliath
Connection: keep-alive
processing_time: 8.81941ms
Content-Length: 98

Verdicts & Comments Add Verdict or Comment

35 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

17 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.xanterra.com/	1970-01-20 14:00:36	Name: _gcl_au Value: 1.1.541956406.1684260689
.xanterra.com/	1970-01-20 11:52:27	Name: _gid Value: GA1.2.1145702150.1684260689
.xanterra.com/	1970-01-20 11:51:00	Name: _dc_gtm_UA-1085772-42 Value: 1
.prefcenter.xanterra.com/	1970-01-20 21:27:00	Name: _ga Value: GA1.3.1803371105.1684260689
.prefcenter.xanterra.com/	1970-01-20 11:52:27	Name: _gid Value: GA1.3.1145702150.1684260689
.prefcenter.xanterra.com/	1970-01-20 11:51:00	Name: _dc_gtm_UA-1085772-35 Value: 1
.xanterra.com/	1970-01-20 21:27:00	Name: _ga_SCQLPVN73T Value: GS1.1.1684260688.1.0.1684260688.60.0.0
.xanterra.com/	1970-01-20 21:27:00	Name: _ga Value: GA1.1.1803371105.1684260689
.doubleclick.net/	1970-01-20 11:51:01	Name: test_cookie Value: CheckForPermission
.prefcenter.xanterra.com/	1970-01-20 11:51:00	Name: _gat_UA-1085772-42 Value: 1
us-xanterra.vergic.com/	1969-12-31 23:59:59	Name: vngage.srvid Value: 96cd13ad651e9690
prefcenter.xanterra.com/	1969-12-31 23:59:59	Name: vngage.id Value: 479b385b-196a-4162-a74d-662fad7e4128+NzMC5GS08rsoa719CpUTxzHtkro8uDWGhRwneZyTeI=
prefcenter.xanterra.com/	1969-12-31 23:59:59	Name: vngage.vid Value: D6265F4F-4EC9-48DE-94EE-036DEB571A51
prefcenter.xanterra.com/	1970-01-20 14:00:36	Name: vngage.lkvt Value: 60ECC54F-B9AD-4EB1-BA91-C67054260CF4
prefcenter.xanterra.com/	1969-12-31 23:59:59	Name: psCurrentState Value: Ready
prefcenter.xanterra.com/	1970-01-20 20:36:36	Name: e596cb96-5e4d-459a-9834-a10116b42d71 Value: %7B%22profile%22%3A%7B%22VisitorID%22%3A%2261386620%22%2C%22DeviceID%22%3A%22a7a207b8-1807-405b-b98c-5b8093200a2d%22%2C%22ImpressionID%22%3A%22372b8759-3ee5-4415-ad3b-44493b1d3a2d%22%2C%22IsMasterKey%22%3Atrue%2C%22HasAlternativeKey%22%3Afalse%2C%22Keys%22%3Anull%2C%22View%22%3Anull%7D%2C%22geolocationExpiry%22%3A0%7D
.xanterra.com/	1970-01-20 21:27:00	Name: invoca_session Value: %7B%22ttl%22%3A%222023-06-15T18%3A11%3A31.390Z%22%2C%22session%22%3A%7B%22invoca_id%22%3A%22i-f76f6c1e-165d-455e-cbcd-b88a511c4c22%22%7D%2C%22config%22%3A%7B%22ce%22%3Atrue%2C%22fv%22%3Afalse%2C%22rn%22%3Afalse%7D%7D

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ajax.googleapis.com
cdn.redpointglobal.com
cdnjs.cloudflare.com
fonts.googleapis.com
fonts.gstatic.com
googleads.g.doubleclick.net
links.email3.xanterra.net
pnapi.invoca.net
prefcenter.xanterra.com
region1.analytics.google.com
solutions.invocacdn.com
stats.g.doubleclick.net
us-content.vergic.com
us-xanterra.vergic.com
www.google-analytics.com
www.google.com
www.google.de
www.googleadservices.com
www.googletagmanager.com
xanwebrpi.rphelios.net
172.217.16.130
2001:4860:4802:32::36
2606:4700:20::681a:1b
2606:4700:3036::6815:5a47
2606:4700::6811:190e
2620:1ec:4f:1::69
2a00:1450:4001:828::2003
2a00:1450:4001:828::2004
2a00:1450:4001:82b::2002
2a00:1450:4001:82b::2003
2a00:1450:4001:82b::200a
2a00:1450:4001:830::200e
2a00:1450:4001:831::2008
2a00:1450:4001:831::200a
2a00:1450:400c:c00::9d
40.118.246.51
46.21.96.230
52.54.248.140
65.9.95.10
07c28c0d8e516ed8c5cbbf7f9f8cd47a50d4f34adf14bc84d83451b9f8bd5dca
0d3b6e0a7634bbc1fe3e8dc504a06a61924ae88d03e31a7ab54519bfcaca7513
12aeb715d447513f7ffbcaeefa63981ebec5f3423ee28c1d83d1429ff8a80b6b
17a879e50c3ab3078afaded288e257fb66e94806b76ff7e796b54226f9848f50
189211cd665ce246ce73bcf3d0aff8c0c0e211d49d3ed21954aa47061d5b9e45
2595496fe48df6fcf9b1bc57c29a744c121eb4dd11566466bc13d2e52e6bbcc8
3ea83916659a2fdc71b7661ca4f1f847903caf3f98f0543474d7caa0f28d4676
463333e1a7c98f78a768cbbed49810155e0878cff618646df46d706e8cd62a34
52f7667c910d22fb987eec9a47084cf5ea1c2b636be37edec68d5f1ab431ebc6
5c857bd5b02e674094d3c25ea27e7141a3ccd6e8c6d4e0cf2de49878b22d9246
69e1c9b528f8a1fd364602551a40431e8ffe8447d2ff9ccec259abd8c822420d
6b4fac99c39b9ee2693d87a2508d0c7d4b4859072966616bd1f6e18c5b2f9d36
758d3729c1e268a24532cd943970fa5147eef854f4d940552271fa54d2ee7bf6
773685736cb801a28737ff92cc4306c5351d0852a3496774fbea62cc7d4f2fa8
78afccdea6ff2af0662f599b633f0ec56547fdf4a389f33bbb96c66d62ac665e
80bd626eb6d57112072a508ee4e5ce3c2fe5673fe0a5d029810033b24aaa5e9f
81275c883bbfb873573116e57d1483d0250b38e05e17238949f4bc23b0e50063
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
8434cc915532036434c5f525d279f37f70a1bcb438e04fa7a17914ded32e1513
845c01f3979f9c7f69567a6a2764970dbc6ada03ed0ae992c2a444735f84fa8f
84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80
98d2e3edd14aa506c4521125c7cdb7bb3030d7caae5803feec6d2613195ee955
ab6fd6c44051ab72cbb8a868370b965a7b9ff84b6930dc0860c8e077cccc8ee4
aec60bc104db041b1512185839f18f52986df7e569e5445f740dd60f763fbca8
b019538234514166ec7665359d097403358f8a4c991901983922fb4d56989f1e
b30bb103f71e9e94075d7db6a81b8c17df00a076412e9287d337644b41837f70
b45dc41842c4d031567bd2556c1ed78d2597dcd11638543b9cdb3100ee48ab8d
baf8255e856d17b0bd20f398381ea37ed517c4ab73abcb86684b124c3179cb1a
c12f6098e641aaca96c60215800f18f5671039aecf812217fab3c0d152f6adb4
c70908b0fe898ff100fff1ae90804fed2a17b55c4cca052cda9f89b9642f0edc
d085d8d1a03d04c647a756b3412826c904c6e3ef0dc1378394a9a3a5062b717b
e337efc20a43e184ddd8d5a05156ed07b3aa8db566f5dcc3c809d1ecdebe5a79
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e6af8417a10702729c2c562f797475ec6f42fcf2def7726281e420f72ba0157c
e79c1c1a140e6afb861074c70392db54cc65a06050de2a69162ab94eb95b0516
e7b90d32907f89c49e9e2a2ccca95133277f756f13a14187936d9b948ff67b44
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f1c1161c571ebdd3434b87bfc9f79750cc91759c9baebb10f521021d7f234fa2
f5aebdfea35d1e7656ef4acc5db1f243209755ae3300943ef8fc6280f363c860
f6734f8177112c0839b961f96d813fcb189d81b60e96c33278c1983b6f419615
f75911313e1c7802c23345ab57e754d87801581706780c993fb23ff4e0fe62ef

prefcenter.xanterra.com Open in urlscan Pro 2606:4700:20::681a:1b Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

53 Requests

96 %HTTPS

74 %IPv6

16 Domains

20 Subdomains

18 IPs

4 Countries

714 kBTransfer

2027 kBSize

17 Cookies

18 Outgoing links

Page URL History

Redirected requests

53 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

prefcenter.xanterra.com Open in urlscan Pro
2606:4700:20::681a:1b Public Scan

Screenshot
Live screenshot

Full Image

53
Requests

96 %
HTTPS

74 %
IPv6

16
Domains

20
Subdomains

18
IPs

4
Countries

714 kB
Transfer

2027 kB
Size

17
Cookies

53 HTTP transactions
0 data transactions