www.booking.com Open in urlscan Pro
18.155.68.14 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://link.sg.booking.com/ss/c/QMN8zmdLvFlNCtm424-T1KfUAy2l2Ko3yzhzlnNpznI-wI0U2_mN6pwrbO_dXO1UiGYy_1ybo83ffX2i_Evm8Zsc8lj...
Effective URL:
https://www.booking.com/attractions/index.fr.html?aid=2256042&emk=TRVYG5VXY1&emkcid=815&checkin=2022-06-23&checkout=2022...
Submission: On June 25 via api (June 25th 2023, 4:32:31 am UTC) from BE — Scanned from SG

Summary HTTP 41 Redirects Links 17 Behaviour Indicators

Summary

This website contacted 6 IPs in 1 countries across 4 domains to perform 41 HTTP transactions. The main IP is 18.155.68.14, located in United States and belongs to AMAZON-02, US. The main domain is www.booking.com. The Cisco Umbrella rank of the primary domain is 6384.
TLS certificate: Issued by DigiCert Global G2 TLS RSA SHA256 202... on June 12th 2023. Valid for: a year.

This is the only time www.booking.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1 1	2600:9000:223... 2600:9000:223b:c600:14:ecff:a140:93a1	16509 (AMAZON-02) (AMAZON-02)
11	18.155.68.14 18.155.68.14	16509 (AMAZON-02) (AMAZON-02)
19	2600:9000:200... 2600:9000:2003:f200:1f:e2ee:200:93a1	16509 (AMAZON-02) (AMAZON-02)
1 6	13.227.254.42 13.227.254.42	16509 (AMAZON-02) (AMAZON-02)
1	2600:9000:20c... 2600:9000:20c7:6a00:15:9f56:b80:93a1	16509 (AMAZON-02) (AMAZON-02)
2	2001:4860:480... 2001:4860:4802:36::178	15169 (GOOGLE) (GOOGLE)
3	2620:1ec:c11:... 2620:1ec:c11::200	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1 1	13.33.33.119 13.33.33.119	16509 (AMAZON-02) (AMAZON-02)
41	6

1 2600:9000:223b:c600:14:ecff:a140:93a1 (United States) 1 redirects

ASN16509 (AMAZON-02, US)

link.sg.booking.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

11 18.155.68.14 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-18-155-68-14.sin52.r.cloudfront.net

www.booking.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

19 2600:9000:2003:f200:1f:e2ee:200:93a1 (United States)

ASN16509 (AMAZON-02, US)

cf.bstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
q-xx.bstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 13.227.254.42 (United States) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: server-13-227-254-42.sin52.r.cloudfront.net

account.booking.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:20c7:6a00:15:9f56:b80:93a1 (United States)

ASN16509 (AMAZON-02, US)

t-cf.bstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2001:4860:4802:36::178 (United States)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2620:1ec:c11::200 (United States)

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

bat.bing.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.33.33.119 (United States) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: server-13-33-33-119.sin2.r.cloudfront.net

secure.booking.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
20	bstatic.com cf.bstatic.com — Cisco Umbrella Rank: 10649 t-cf.bstatic.com — Cisco Umbrella Rank: 19111 q-xx.bstatic.com — Cisco Umbrella Rank: 12820	1006 KB
19	booking.com 3 redirects link.sg.booking.com — Cisco Umbrella Rank: 103362 www.booking.com — Cisco Umbrella Rank: 6384 account.booking.com — Cisco Umbrella Rank: 12741 secure.booking.com — Cisco Umbrella Rank: 14776	119 KB
3	bing.com bat.bing.com — Cisco Umbrella Rank: 389	13 KB
2	google-analytics.com www.google-analytics.com — Cisco Umbrella Rank: 60	21 KB
41	4

	Domain	Requested by
14	cf.bstatic.com	www.booking.com cf.bstatic.com
11	www.booking.com	cf.bstatic.com account.booking.com www.booking.com
6	account.booking.com	1 redirects www.booking.com cf.bstatic.com account.booking.com
5	q-xx.bstatic.com	www.booking.com
3	bat.bing.com	cf.bstatic.com bat.bing.com www.booking.com
2	www.google-analytics.com	cf.bstatic.com www.google-analytics.com
1	secure.booking.com	1 redirects
1	t-cf.bstatic.com	www.booking.com
1	link.sg.booking.com	1 redirects
41	9

This site contains links to these domains. Also see Links.

Domain
experiences.booking.com
booking.com
secure.booking.com
business.booking.com
www.bookingholdings.com
admin.booking.com
partner.booking.com
join.booking.com
www.sustainability.booking.com
news.booking.com
careers.booking.com

Subject Issuer	Validity	Valid
*.booking.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2023-06-12` - `2024-05-18`	a year	crt.sh
*.bstatic.com DigiCert TLS RSA SHA256 2020 CA1	`2022-10-21` - `2023-10-11`	a year	crt.sh
*.google-analytics.com GTS CA 1C3	`2023-05-29` - `2023-08-21`	3 months	crt.sh
www.bing.com Microsoft RSA TLS CA 02	`2023-02-16` - `2023-08-16`	6 months	crt.sh

This page contains 2 frames:

Primary Page: https://www.booking.com/attractions/index.fr.html?aid=2256042&emk=TRVYG5VXY1&emkcid=815&checkin=2022-06-23&checkout=2022-06-24&selected_currency=EUR&label=56202_usp-03_v2-
Frame ID: 9337900D35B8B485B62547A2790CCA7B
Requests: 38 HTTP requests in this frame

Frame: https://www.booking.com/general.fr.html?tmpl=profile%2Flogin_callback_anon_session;aid=2256042;sid=4d5b6628cd255c86bff42f20db502482;label=56202_usp-03_v2-;iframe=1
Frame ID: C01B8D3C7D009DE49C683C03975410E2
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Un large choix de visites et d'activités | Booking.com

Page URL History Show full URLs

https://link.sg.booking.com/ss/c/QMN8zmdLvFlNCtm424-T1KfUAy2l2Ko3yzhzlnNpznI-wI0U2_mN6pwrbO_dXO1UiGYy_1y... HTTP 302
https://www.booking.com/attractions/index.fr.html?aid=2256042&emk=TRVYG5VXY1&emkcid=815&checkin=2022... Page URL

Detected technologies

React (JavaScript Frameworks) Expand

Overall confidence: 100%
Detected patterns

<[^>]+data-react
react(?:-with-addons)?[.-]([\d.]*\d)[^/]*\.js

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

google-analytics\.com/(?:ga|urchin|analytics)\.js

PerimeterX (Security) Expand

Overall confidence: 100%
Detected patterns

Page Statistics

41
Requests

100 %
HTTPS

63 %
IPv6

4
Domains

9
Subdomains

6
IPs

1
Countries

1154 kB
Transfer

4631 kB
Size

17
Cookies

17 Outgoing links

These are links going to different origins than the main page.

URL: https://experiences.booking.com/attractions/index.fr.html?aid=2256042&label=56202_usp-03_v2-&modal=ask-question-form&sid=b3ccf62995dd8e4aae7f0e3d90883ad0&

Search URL Search Domain Scan URL

URL: https://experiences.booking.com/attractions/login.html?aid=2256042&label=56202_usp-03_v2-&prompt=register&sid=b3ccf62995dd8e4aae7f0e3d90883ad0&
Title: S'inscrire

Search URL Search Domain Scan URL

URL: https://experiences.booking.com/attractions/login.html?aid=2256042&label=56202_usp-03_v2-&prompt=signin&redirect_uri=https%3A%2F%2Fwww.booking.com%2Fattractions%2Findex.fr.html%3Faid%3D2256042%26emk%3DTRVYG5VXY1%26emkcid%3D815%26checkin%3D2022-06-23%26checkout%3D2022-06-24%26selected_currency%3DEUR%26label%3D56202_usp-03_v2-&sid=b3ccf62995dd8e4aae7f0e3d90883ad0&
Title: Se connecter

Search URL Search Domain Scan URL

URL: https://booking.com/pxgo?aid=2256042&url=https%3A%2F%2Fbooking.kayak.com%2Fin%3Fsid%3Db3ccf62995dd8e4aae7f0e3d90883ad0%26mc%3DEUR%26bdclc%3Dfr%26p%3Dsearchbox_link%26a%3Dbdc%252Fsearchbox&lang=fr&label=56202_usp-03_v2-&token=UmFuZG9tSVYkc2RlIyh9YWDUtbaQciWiGSaepgbtV2gdxDmeKB3c9E1MlrP4Tk2TX_uTFC_m9gfCUtqxClLkIFxHIFqMLh3B7Ju31p5QJ1v1d3LVjMoHzB0YlYGLtEX6Td3FBs_ajDXjSku_1kh2-65q8lATdqnyuuOH5gr-a70DvZRW_ytrO0hDMkxzGDl25a_-K0dvl6mHBSlimP7YA3ACl2sdmTY70T4j8JCIljNVZ6-JAJq-EXdgwwo91v6xebIqYj2qHp-7Nc24XSXOo70jaSOCdssvUAtkNqW0B_IXb_Mel189kXLj9ivbkHjMTSk7Bbqqzi_UIiPpLmKz8_QwFpQTKpyxFxoOa5t4PFU
Title: Vols

Search URL Search Domain Scan URL

URL: https://booking.com/pxgo?lang=fr&aid=2256042&url=https%3A%2F%2Fwww.agoda.com%2Fc%2Fbooking%2F&token=UmFuZG9tSVYkc2RlIyh9YaAHsRE_5bn3IXqu1TNhJ9OHhIRP7pIdOMXiFO1MTkwGEILM_UYwsJBw7-zfhZ1598O57qR4butGK3CGY8kyq_r3EUIxMBh6YnPaYDTVIYdbiB6grkmOyS7bs3QunlXSYrUrqj38lYpZ4y2HcF6bwtudhUTqYauopy-Fbo_t9ZudXvGvOkaw8E4EZhjBtz0dpSGHx3PAViOdw8ImJtYxr4rKk4jGWgD0f4w4AYrpsjylNuKHo90AaqHGgFav5oWr7I9QvqsVmgwcBQnpLip38yq23UCB867V9eq_Ez8piJEnynKksA32nIk
Title: Vol + hôtel

Search URL Search Domain Scan URL

URL: https://booking.com/attractions/login.html?redirect_uri=https%3A%2F%2Flocalhost%3A3001%2Fattractions%2Findex.fr.html%3Faid%3D2256042%26emk%3DTRVYG5VXY1%26emkcid%3D815%26checkin%3D2022-06-23%26checkout%3D2022-06-24%26selected_currency%3DEUR%26label%3D56202_usp-03_v2-
Title: Se connecter

Search URL Search Domain Scan URL

URL: https://secure.booking.com/content/cs.fr.html?aid=2256042&label=56202_usp-03_v2-&sid=b3ccf62995dd8e4aae7f0e3d90883ad0&
Title: Gérez vos voyages

Search URL Search Domain Scan URL

URL: https://business.booking.com/?aid=2256042&label=56202_usp-03_v2-&sid=b3ccf62995dd8e4aae7f0e3d90883ad0&
Title: Booking.com Business

Search URL Search Domain Scan URL

URL: https://secure.booking.com/content/complaints.fr.html?aid=2256042&label=56202_usp-03_v2-&sid=b3ccf62995dd8e4aae7f0e3d90883ad0&
Title: Réclamation partenaires

Search URL Search Domain Scan URL

URL: https://www.bookingholdings.com/about/compliance-and-ethics/
Title: Charte MSA

Search URL Search Domain Scan URL

URL: https://admin.booking.com/?aid=2256042&label=56202_usp-03_v2-&sid=b3ccf62995dd8e4aae7f0e3d90883ad0&utm_campaign=login_footer_v0&utm_medium=frontend&utm_source=extranet_login_footer&
Title: Accéder à l'extranet

Search URL Search Domain Scan URL

URL: https://partner.booking.com/fr?aid=2256042&label=56202_usp-03_v2-&sid=b3ccf62995dd8e4aae7f0e3d90883ad0&utm_campaign=footer_list&utm_medium=frontend_footer&utm_source=booking.com&
Title: Aide aux partenaires

Search URL Search Domain Scan URL

URL: https://join.booking.com/?aid=2256042&label=56202_usp-03_v2-&lang=fr&sid=b3ccf62995dd8e4aae7f0e3d90883ad0&utm_medium=frontend&utm_source=footer_menu&
Title: Ajoutez votre établissement

Search URL Search Domain Scan URL

URL: https://www.sustainability.booking.com/
Title: Durabilité

Search URL Search Domain Scan URL

URL: https://news.booking.com/en-sg
Title: Centre de presse

Search URL Search Domain Scan URL

URL: https://careers.booking.com/
Title: Recrutement

Search URL Search Domain Scan URL

URL: https://www.bookingholdings.com/
Title: Relations avec les investisseurs

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://link.sg.booking.com/ss/c/QMN8zmdLvFlNCtm424-T1KfUAy2l2Ko3yzhzlnNpznI-wI0U2_mN6pwrbO_dXO1UiGYy_1ybo83ffX2i_Evm8Zsc8ljuTZQWUbULgYGyFULnf7-CD7CYlM5c8rTV9Ux2k_Lx8nM3AQexJ4Bim6IjlnfMoZJA3RH882yF-fG0YbdovNS89O6FXPxQayNWQGCZIK0LQMioqY5zHup6Pz5hJvgRjU4ZgCHPWFb2SDbnxgNUnBaKi5VhGUcSQTJ_EX2M/3n3/TEndMUNySnSTpb2r6hRylw/h20/u5N78RB4gNBpOgWNXUc_TcUT2y5wi1YN3K1grBTGEx0 HTTP 302
https://www.booking.com/attractions/index.fr.html?aid=2256042&emk=TRVYG5VXY1&emkcid=815&checkin=2022-06-23&checkout=2022-06-24&selected_currency=EUR&label=56202_usp-03_v2- Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 26

https://account.booking.com/oauth2/authorize/v2?client_id=vO1Kblk7xX9tUn2cpZLS&redirect_uri=https%3A%2F%2Fsecure.booking.com%2Flogin.html%3Fop%3Doauth_return&response_type=anon_session&prompt=none&iframe=1&dt=1687667546553&state=UssCSD60yCSehgT0YWM_jnMpRXtcduNNsi0OV2U2ZwFuvlE6QSMSB6hQOOr-TohM6duBR_ZxEbkYE1aLILz45IbZW6fLqybixUmjr68hU3i-H554baxYfxBFLuLZF3nWm4zzlGE7IP_l7K215HijHN7nQ6lgPy1mmZb3VEjpLHUZAPOQXP7Ygn2hvmDTAMs4YT9N0OcT09lY4ab6ey-JNkg9nxhjKxjCoN9hsyD_sdBc0cQgSxbQsbWoLU7uoehVKN-pt6klV9P2wSX-pDOqACWTp3A_m2UGbxiv12IcAp9b-psor0rwAnUs-6EcpgFCCXDA1pCIqpWoP-frWmEB2CzARA34hmth9DYSWQuT2yUpy_vj7IbFgdV72HNwYWR6LOlMhWGBdjs4fPr0wl6YtYdl3I0PQQFy-ayTVf_6l1VY518uEBgZULSO4_2cRQ&bkng_referrer=https%3A%2F%2Fwww.booking.com%2Fattractions%2Findex.fr.html HTTP 302
https://secure.booking.com/login.html?lang=en-us&state=UssCSD60yCSehgT0YWM_jnMpRXtcduNNsi0OV2U2ZwFuvlE6QSMSB6hQOOr-TohM6duBR_ZxEbkYE1aLILz45IbZW6fLqybixUmjr68hU3i-H554baxYfxBFLuLZF3nWm4zzlGE7IP_l7K215HijHN7nQ6lgPy1mmZb3VEjpLHUZAPOQXP7Ygn2hvmDTAMs4YT9N0OcT09lY4ab6ey-JNkg9nxhjKxjCoN9hsyD_sdBc0cQgSxbQsbWoLU7uoehVKN-pt6klV9P2wSX-pDOqACWTp3A_m2UGbxiv12IcAp9b-psor0rwAnUs-6EcpgFCCXDA1pCIqpWoP-frWmEB2CzARA34hmth9DYSWQuT2yUpy_vj7IbFgdV72HNwYWR6LOlMhWGBdjs4fPr0wl6YtYdl3I0PQQFy-ayTVf_6l1VY518uEBgZULSO4_2cRQ&aid=304142&op=oauth_return&code=HbwC1sO2PONrWrAr7RGvlddwvV0ihniNnyNrbzJYwDHWMbyQlKYEgA0SpRtKJ9PiD8FdM9jBg9izqYFbKWxRDXZz50zt8Mm5KYcBgRcqQ0CN12FLpI90tVHHOJ5sbJRgPwxVtTpa99Qd4u6tjLtHeLXxz4s79MYyG3hlRJ4DzmspxLCB21Po4TS708Ofw HTTP 302
https://www.booking.com/general.fr.html?tmpl=profile%2Flogin_callback_anon_session;aid=2256042;sid=4d5b6628cd255c86bff42f20db502482;label=56202_usp-03_v2-;iframe=1

41 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

Primary Request index.fr.html Show response
www.booking.com/attractions/
Redirect Chain

https://link.sg.booking.com/ss/c/QMN8zmdLvFlNCtm424-T1KfUAy2l2Ko3yzhzlnNpznI-wI0U2_mN6pwrbO_dXO1UiGYy_1ybo83ffX2i_Evm8Zsc8ljuTZQWUbULgYGyFULnf7-CD7CYlM5c8rTV9Ux2k_Lx8nM3AQexJ4Bim6IjlnfMoZJA3RH882yF...
https://www.booking.com/attractions/index.fr.html?aid=2256042&emk=TRVYG5VXY1&emkcid=815&checkin=2022-06-23&checkout=2022-06-24&selected_currency=EUR&label=56202_usp-03_v2-

118 KB
31 KB

592ms
581ms

Document
text/html

18.155.68.14
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://www.booking.com/attractions/index.fr.html?aid=2256042&emk=TRVYG5VXY1&emkcid=815&checkin=2022-06-23&checkout=2022-06-24&selected_currency=EUR&label=56202_usp-03_v2-

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.155.68.14 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-155-68-14.sin52.r.cloudfront.net

Software

nginx /

Resource Hash

a50df548b428a798d349986ecd3c3a68c8bb6c14d9f015cac8087304b9378488

Security Headers

Name	Value
Strict-Transport-Security	max-age=300; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language: zh-SG,zh;q=0.9

Response headers

cache-control: private
content-encoding: br
content-length: 30740
content-security-policy-report-only: default-src 'self'; connect-src 'self' *.booking.com:* wss://*.booking.com:* cdn.cookielaw.org *.google-analytics.com *.onetrust.com; script-src 'self' 'unsafe-inline' *.booking.com:* *.bstatic.com cdn.cookielaw.org bat.bing.com googleads.g.doubleclick.net *.googletagmanager.com *.google-analytics.com *.googleadservices.com *.googleapis.com *.onetrust.com; img-src * data:; style-src 'self' 'unsafe-inline' *.booking.com *.bstatic.com *.googleapis.com; font-src 'self' *.bstatic.com fonts.gstatic.com; frame-src 'self' *.booking.com; object-src 'none'; report-to default
content-type: text/html; charset=UTF-8
date: Sun, 25 Jun 2023 04:32:26 GMT
nel: {"report_to":"default","max_age":604800}
report-to: {"max_age":604800,"group":"default","endpoints":[{"url":"https://nellie.booking.com/report"}]}
server: nginx
strict-transport-security: max-age=300; includeSubDomains
vary: Accept-Encoding, User-Agent
via: 1.1 4051cd1127320e383387d289cc46a5fc.cloudfront.net (CloudFront)
x-amz-cf-id: T_dIbimp_ugRbd26txtmpzGm_kfCeNBd1vuIkbeYY-g-3y2Oq4ok9A==
x-amz-cf-pop: SIN52-P1
x-cache: Miss from cloudfront
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
x-recruiting: Like HTTP headers? Come write ours: https://careers.booking.com
x-xss-protection: 1; mode=block

Redirect headers

content-length: 218
content-type: text/html; charset=utf-8
date: Sun, 25 Jun 2023 04:32:25 GMT
location: https://www.booking.com/attractions/index.fr.html?aid=2256042&emk=TRVYG5VXY1&emkcid=815&checkin=2022-06-23&checkout=2022-06-24&selected_currency=EUR&label=56202_usp-03_v2-
server: nginx
via: 1.1 31d603b763553e4238110d07f30c186e.cloudfront.net (CloudFront)
x-amz-cf-id: 1u51GM2gvO-3q0qC-Px-ISLVrGJDZjMkA1FYtqkWhl6s-tV6Dkq7Jw==
x-amz-cf-pop: SIN2-P2
x-cache: Miss from cloudfront
x-robots-tag: noindex, nofollow

GET
H2 200 vendors.4a8dbaf5.js Show response
cf.bstatic.com/psb/capla/static/js/ 732 KB
182 KB 19ms
7ms Script
application/javascript 2600:9000:2003:f200:1f:e2ee:200:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://cf.bstatic.com/psb/capla/static/js/vendors.4a8dbaf5.js

Requested by

Host: www.booking.com
URL: https://www.booking.com/attractions/index.fr.html?aid=2256042&emk=TRVYG5VXY1&emkcid=815&checkin=2022-06-23&checkout=2022-06-24&selected_currency=EUR&label=56202_usp-03_v2-

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:2003:f200:1f:e2ee:200:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

95f26ad40c5c5ab4910edff10bebdb59edd490c55c6830ba81a27972046f5547

Security Headers

Name	Value
X-Xss-Protection	1; mode=block

Request headers

accept-language: zh-SG,zh;q=0.9
Referer: https://www.booking.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Thu, 22 Jun 2023 11:15:42 GMT
content-encoding: br
via: 1.1 2a45d2b5ea9ef7dcb9d372459729c164.cloudfront.net (CloudFront)
nel: {"report_to":"default","max_age":600}
x-amz-cf-pop: SIN2-C1
age: 235003
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-xss-protection: 1; mode=block
x-amz-expiration: expiry-date="Fri, 20 Oct 2023 10:39:31 GMT", rule-id=""
last-modified: Thu, 22 Jun 2023 10:39:31 GMT
server: nginx
etag: W/"123c019128bb9480acd1e120dee3cc94"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https://nellie.booking.com/report"}],"max_age":600,"group":"default","failure_fraction":0.05}
x-amz-meta-x-deployment-hash: foo
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=2592000
timing-allow-origin: *
x-amz-cf-id: 0KD5S1Z-cV8VBoNWUnd14Vu77u__5dntSb1tBWjfPv4cNPT61PxTRw==
expires: Sat, 22 Jul 2023 11:15:42 GMT

GET
H2 200 bui-react.7b618af7.js Show response
cf.bstatic.com/psb/capla/static/js/ 336 KB
78 KB 21ms
10ms Script
application/javascript 2600:9000:2003:f200:1f:e2ee:200:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://cf.bstatic.com/psb/capla/static/js/bui-react.7b618af7.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:2003:f200:1f:e2ee:200:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

60779ca6517299653fb72e63848ad4a075baf38b55c8cb8336a201f1db0bd528

Security Headers

Name	Value
X-Xss-Protection	1; mode=block

Request headers

accept-language: zh-SG,zh;q=0.9
Referer: https://www.booking.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Thu, 15 Jun 2023 12:29:32 GMT
content-encoding: br
via: 1.1 2a45d2b5ea9ef7dcb9d372459729c164.cloudfront.net (CloudFront)
nel: {"report_to":"default","max_age":600}
x-amz-cf-pop: SIN2-C1
age: 835374
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-xss-protection: 1; mode=block
x-amz-expiration: expiry-date="Fri, 13 Oct 2023 11:22:12 GMT", rule-id=""
last-modified: Thu, 15 Jun 2023 11:22:12 GMT
server: nginx
etag: W/"c03153ff378d28b3e3379c5e6dc48a51"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https://nellie.booking.com/report"}],"max_age":600,"group":"default","failure_fraction":0.05}
x-amz-meta-x-deployment-hash: foo
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=2592000
timing-allow-origin: *
x-amz-cf-id: Aah8QpHGrOO8G8ikbj26Se4s1PJ0ZrcaitC6ELqRI8h5LLEe9vmN9A==
expires: Sat, 15 Jul 2023 12:29:32 GMT

GET
H2 200 client.403a07b7.js Show response
cf.bstatic.com/psb/capla/static/js/ 272 KB
32 KB 18ms
7ms Script
application/javascript 2600:9000:2003:f200:1f:e2ee:200:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://cf.bstatic.com/psb/capla/static/js/client.403a07b7.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:2003:f200:1f:e2ee:200:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

b0911d38beb67cd527ed8e06779dce9a9cf076f4ccb258e4406010c7899ae87e

Security Headers

Name	Value
X-Xss-Protection	1; mode=block

Request headers

accept-language: zh-SG,zh;q=0.9
Referer: https://www.booking.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Thu, 22 Jun 2023 11:15:42 GMT
content-encoding: br
via: 1.1 2a45d2b5ea9ef7dcb9d372459729c164.cloudfront.net (CloudFront)
nel: {"report_to":"default","max_age":600}
x-amz-cf-pop: SIN2-C1
age: 235003
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-xss-protection: 1; mode=block
x-amz-expiration: expiry-date="Fri, 20 Oct 2023 10:39:31 GMT", rule-id=""
last-modified: Thu, 22 Jun 2023 10:39:31 GMT
server: nginx
etag: W/"eebac0720c08ef334e0e312cca25cb49"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https://nellie.booking.com/report"}],"max_age":600,"group":"default","failure_fraction":0.05}
x-amz-meta-x-deployment-hash: foo
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=2592000
timing-allow-origin: *
x-amz-cf-id: vixIkgXZ9-8nSmFB9uUgAuAJfLBUIrKYwRy33QvgpCTs7Trfph7sng==
expires: Sat, 22 Jul 2023 11:15:42 GMT

GET
H2 200 bui-react.90b17674.css
cf.bstatic.com/psb/capla/static/css/ 240 KB
25 KB 19ms
8ms Stylesheet
text/css 2600:9000:2003:f200:1f:e2ee:200:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://cf.bstatic.com/psb/capla/static/css/bui-react.90b17674.css

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:2003:f200:1f:e2ee:200:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

21ea9b572a39f1f4a112824b07c8ef69f2b8ed995f9c5cccef69da874e169fc4

Security Headers

Name	Value
X-Xss-Protection	1; mode=block

Request headers

accept-language: zh-SG,zh;q=0.9
Referer: https://www.booking.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Fri, 26 May 2023 10:05:53 GMT
content-encoding: br
via: 1.1 2a45d2b5ea9ef7dcb9d372459729c164.cloudfront.net (CloudFront)
nel: {"report_to":"default","max_age":600}
x-amz-cf-pop: SIN2-C1
age: 2571993
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-xss-protection: 1; mode=block
x-amz-expiration: expiry-date="Sat, 23 Sep 2023 07:44:41 GMT", rule-id=""
last-modified: Fri, 26 May 2023 07:44:41 GMT
server: nginx
etag: W/"0cc2202702c12bca4eae4092d7468b20"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https://nellie.booking.com/report"}],"max_age":600,"group":"default","failure_fraction":0.05}
x-amz-meta-x-deployment-hash: foo
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=2592000
timing-allow-origin: *
x-amz-cf-id: 0AKGBqY7eT0qp4bDQVJ67bDwNEcy8naBXjqIX3MzP3N6o7BsK5ANaQ==
expires: Sun, 25 Jun 2023 10:05:53 GMT

GET
H2 200 client.f31b6b16.css
cf.bstatic.com/psb/capla/static/css/ 3 KB
2 KB 17ms
7ms Stylesheet
text/css 2600:9000:2003:f200:1f:e2ee:200:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://cf.bstatic.com/psb/capla/static/css/client.f31b6b16.css

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:2003:f200:1f:e2ee:200:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

a67fc761b81a8d9a1c699095f16a07f98b0df6f0cae235449cf1ce6d0a7c3bad

Security Headers

Name	Value
X-Xss-Protection	1; mode=block

Request headers

accept-language: zh-SG,zh;q=0.9
Referer: https://www.booking.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Tue, 20 Jun 2023 06:50:43 GMT
content-encoding: br
via: 1.1 2a45d2b5ea9ef7dcb9d372459729c164.cloudfront.net (CloudFront)
nel: {"report_to":"default","max_age":600}
x-amz-cf-pop: SIN2-C1
age: 423703
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-xss-protection: 1; mode=block
x-amz-expiration: expiry-date="Tue, 17 Oct 2023 08:12:31 GMT", rule-id=""
last-modified: Mon, 19 Jun 2023 08:12:31 GMT
server: nginx
etag: W/"74ef65313ebd949ed4e7059b0b05bd36"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https://nellie.booking.com/report"}],"max_age":600,"group":"default","failure_fraction":0.05}
x-amz-meta-x-deployment-hash: foo
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=2592000
timing-allow-origin: *
x-amz-cf-id: 1vCR42OT9vjfF4JoEHlofXNwfyKRek2Yhkg0rvoomIs8KjLQz8v0WQ==
expires: Thu, 20 Jul 2023 06:50:43 GMT

GET
H2 200 cookie-banner.min.js Show response
cf.bstatic.com/libs/privacy-consent/releases/2.1.41/customer/ 10 KB
4 KB 16ms
6ms Script
application/javascript 2600:9000:2003:f200:1f:e2ee:200:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://cf.bstatic.com/libs/privacy-consent/releases/2.1.41/customer/cookie-banner.min.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:2003:f200:1f:e2ee:200:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

4328dbde25a0900554795500c23ffdd420df48c5003e78886263f1e6185785b9

Security Headers

Name	Value
X-Xss-Protection	1; mode=block

Request headers

accept-language: zh-SG,zh;q=0.9
Referer: https://www.booking.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Sun, 04 Jun 2023 16:25:09 GMT
content-encoding: br
via: 1.1 2a45d2b5ea9ef7dcb9d372459729c164.cloudfront.net (CloudFront)
nel: {"report_to":"default","max_age":600}
x-amz-cf-pop: SIN2-C1
age: 1771637
x-cache: Hit from cloudfront
x-xss-protection: 1; mode=block
last-modified: Fri, 12 May 2023 14:49:45 GMT
server: nginx
etag: W/"645e5209-261e"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https://nellie.booking.com/report"}],"max_age":600,"group":"default","failure_fraction":0.05}
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=2592000
timing-allow-origin: *
x-amz-cf-id: EiIs8FsuiqJSzpgChi3t5XlipTW_Cx-saMIQLm9Erbv0m6FyodKhYA==
expires: Tue, 04 Jul 2023 16:25:09 GMT

GET
H2 200 705.bbef615e.chunk.js Show response
cf.bstatic.com/psb/capla/static/js/ 102 KB
25 KB 14ms
5ms Script
application/javascript 2600:9000:2003:f200:1f:e2ee:200:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://cf.bstatic.com/psb/capla/static/js/705.bbef615e.chunk.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:2003:f200:1f:e2ee:200:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

03176a742b70ba383776f1f4abeab2c15ae4bfd56ec1cc3cbfbae0a53be2e8c7

Security Headers

Name	Value
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.booking.com/
Origin: https://www.booking.com
accept-language: zh-SG,zh;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Thu, 22 Jun 2023 11:15:46 GMT
content-encoding: br
via: 1.1 b4ef37917b36c601eeeeb55cdda4288c.cloudfront.net (CloudFront)
nel: {"report_to":"default","max_age":600}
x-amz-cf-pop: SIN2-C1
age: 235000
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-xss-protection: 1; mode=block
x-amz-expiration: expiry-date="Fri, 20 Oct 2023 10:13:21 GMT", rule-id=""
last-modified: Thu, 22 Jun 2023 10:13:21 GMT
server: nginx
etag: W/"c3932dfe125185c472a3e50e7bbc2777"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https://nellie.booking.com/report"}],"max_age":600,"group":"default","failure_fraction":0.05}
x-amz-meta-x-deployment-hash: foo
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=2592000
timing-allow-origin: *
x-amz-cf-id: 2s-jMaT9lVVi2jSWz9Eel5Ci5s3iIyGhpY7ZEl22oG9ubnmczYCBqw==
expires: Sat, 22 Jul 2023 11:15:46 GMT

GET
H2 200 booking-sso.v1.js Show response
account.booking.com/static/ 3 KB
4 KB 191ms
180ms Script
application/javascript 13.227.254.42
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://account.booking.com/static/booking-sso.v1.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.227.254.42 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-227-254-42.sin52.r.cloudfront.net

Software

envoy /

Resource Hash

fb0b3aef25c12ebb0a3d15eef6c367e790b1a8ea0660ae5ad4ea5d24b83778f0

Security Headers

Name	Value
Strict-Transport-Security	max-age=300; includeSubDomains
X-Xss-Protection	1; mode=block

Request headers

accept-language: zh-SG,zh;q=0.9
Referer: https://www.booking.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Sun, 25 Jun 2023 04:32:26 GMT
via: 1.1 ce37b125bad795f4918cd50b3f95260a.cloudfront.net (CloudFront)
strict-transport-security: max-age=300; includeSubDomains
last-modified: Thu, 22 Jun 2023 15:27:17 GMT
server: envoy
x-amz-cf-pop: SIN52-C3
etag: "64946855-de7"
x-cache: Miss from cloudfront
content-type: application/javascript
accept-ranges: bytes
content-length: 3559
x-xss-protection: 1; mode=block
x-amz-cf-id: gkqx8pn_2ThJI16DlmfFYvOfXbNPO-eOOzsb_JLS12-yt45HdtBiNg==

GET
H2 200 bui-react.7b618af7.js Show response
cf.bstatic.com/psb/capla/static/js/ 336 KB
78 KB 14ms
9ms Script
application/javascript 2600:9000:2003:f200:1f:e2ee:200:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://cf.bstatic.com/psb/capla/static/js/bui-react.7b618af7.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:2003:f200:1f:e2ee:200:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

60779ca6517299653fb72e63848ad4a075baf38b55c8cb8336a201f1db0bd528

Security Headers

Name	Value
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.booking.com/
Origin: https://www.booking.com
accept-language: zh-SG,zh;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Thu, 15 Jun 2023 12:29:32 GMT
content-encoding: br
via: 1.1 b4ef37917b36c601eeeeb55cdda4288c.cloudfront.net (CloudFront)
nel: {"report_to":"default","max_age":600}
x-amz-cf-pop: SIN2-C1
age: 835374
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-xss-protection: 1; mode=block
x-amz-expiration: expiry-date="Fri, 13 Oct 2023 11:22:12 GMT", rule-id=""
last-modified: Thu, 15 Jun 2023 11:22:12 GMT
server: nginx
etag: W/"c03153ff378d28b3e3379c5e6dc48a51"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https://nellie.booking.com/report"}],"max_age":600,"group":"default","failure_fraction":0.05}
x-amz-meta-x-deployment-hash: foo
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=2592000
timing-allow-origin: *
x-amz-cf-id: 9T8rqYfChwOKNRJ2yVW3hOMT4P4WJ5t94tQDADN3FGeYGCqQA9-dCQ==
expires: Sat, 15 Jul 2023 12:29:32 GMT

GET
H2 200 vendors.4a8dbaf5.js Show response
cf.bstatic.com/psb/capla/static/js/ 732 KB
182 KB 11ms
7ms Script
application/javascript 2600:9000:2003:f200:1f:e2ee:200:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://cf.bstatic.com/psb/capla/static/js/vendors.4a8dbaf5.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:2003:f200:1f:e2ee:200:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

95f26ad40c5c5ab4910edff10bebdb59edd490c55c6830ba81a27972046f5547

Security Headers

Name	Value
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.booking.com/
Origin: https://www.booking.com
accept-language: zh-SG,zh;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Thu, 22 Jun 2023 11:15:42 GMT
content-encoding: br
via: 1.1 b4ef37917b36c601eeeeb55cdda4288c.cloudfront.net (CloudFront)
nel: {"report_to":"default","max_age":600}
x-amz-cf-pop: SIN2-C1
age: 235003
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-xss-protection: 1; mode=block
x-amz-expiration: expiry-date="Fri, 20 Oct 2023 10:39:31 GMT", rule-id=""
last-modified: Thu, 22 Jun 2023 10:39:31 GMT
server: nginx
etag: W/"123c019128bb9480acd1e120dee3cc94"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https://nellie.booking.com/report"}],"max_age":600,"group":"default","failure_fraction":0.05}
x-amz-meta-x-deployment-hash: foo
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=2592000
timing-allow-origin: *
x-amz-cf-id: DnLwQLwZV_dhRfhdheU_bNlbDmpx5yv43NWQC5MVPtI8INnl6Rz7CQ==
expires: Sat, 22 Jul 2023 11:15:42 GMT

GET
H2 200 client.403a07b7.js Show response
cf.bstatic.com/psb/capla/static/js/ 272 KB
32 KB 10ms
6ms Script
application/javascript 2600:9000:2003:f200:1f:e2ee:200:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://cf.bstatic.com/psb/capla/static/js/client.403a07b7.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:2003:f200:1f:e2ee:200:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

b0911d38beb67cd527ed8e06779dce9a9cf076f4ccb258e4406010c7899ae87e

Security Headers

Name	Value
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.booking.com/
Origin: https://www.booking.com
accept-language: zh-SG,zh;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Thu, 22 Jun 2023 11:15:42 GMT
content-encoding: br
via: 1.1 b4ef37917b36c601eeeeb55cdda4288c.cloudfront.net (CloudFront)
nel: {"report_to":"default","max_age":600}
x-amz-cf-pop: SIN2-C1
age: 235003
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-xss-protection: 1; mode=block
x-amz-expiration: expiry-date="Fri, 20 Oct 2023 10:39:31 GMT", rule-id=""
last-modified: Thu, 22 Jun 2023 10:39:31 GMT
server: nginx
etag: W/"eebac0720c08ef334e0e312cca25cb49"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https://nellie.booking.com/report"}],"max_age":600,"group":"default","failure_fraction":0.05}
x-amz-meta-x-deployment-hash: foo
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=2592000
timing-allow-origin: *
x-amz-cf-id: GNrEeM3mzmRiSE_uznXnuGdOh87VsqPRswuCqKSqTlzyO9AZTC5JmA==
expires: Sat, 22 Jul 2023 11:15:42 GMT

GET
H2 200 Fr@3x.png
t-cf.bstatic.com/design-assets/assets/v3.72.0/images-flags/ 181 B
556 B 18ms
4ms Image
image/png 2600:9000:20c7:6a00:15:9f56:b80:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://t-cf.bstatic.com/design-assets/assets/v3.72.0/images-flags/Fr@3x.png
Requested by: Host: www.booking.com
URL: https://www.booking.com/attractions/index.fr.html?aid=2256042&emk=TRVYG5VXY1&emkcid=815&checkin=2022-06-23&checkout=2022-06-24&selected_currency=EUR&label=56202_usp-03_v2-
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:20c7:6a00:15:9f56:b80:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 6f78fae8519403ce4597020e7614536a70eb413001df07c091814f2751c56a29

Request headers

accept-language: zh-SG,zh;q=0.9
Referer: https://www.booking.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Sat, 24 Jun 2023 22:14:01 GMT
via: 1.1 47f0d09d9d5d7d899c2e467cfbfb08e0.cloudfront.net (CloudFront)
last-modified: Thu, 04 May 2023 11:59:16 GMT
server: AmazonS3
x-amz-cf-pop: SIN5-C1
age: 22706
x-amz-server-side-encryption: AES256
etag: "36494102ca4f9f68d0b22ee9266cf5e8"
vary: Accept-Encoding, Origin
x-cache: Hit from cloudfront
content-type: image/png
accept-ranges: bytes
content-length: 181
x-amz-cf-id: FRWnBEUvQFq8lfFAeN6jOtNY9f0Ta43yv_kZCTYT1zgMB9G-msQ5wg==

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 52 KB
21 KB 13ms
3ms Script
text/javascript 2001:4860:4802:36::178
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: cf.bstatic.com
URL: https://cf.bstatic.com/psb/capla/static/js/vendors.4a8dbaf5.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2001:4860:4802:36::178 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: zh-SG,zh;q=0.9
Referer: https://www.booking.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
date: Sun, 25 Jun 2023 03:03:07 GMT
last-modified: Mon, 12 Jun 2023 18:23:07 GMT
server: Golfe2
age: 5359
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 20994
expires: Sun, 25 Jun 2023 05:03:07 GMT

POST
H2 200 track Show response
www.booking.com/c360/v1/ 29 B
927 B 290ms
290ms Fetch
application/json 18.155.68.14
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://www.booking.com/c360/v1/track

Requested by

Host: cf.bstatic.com
URL: https://cf.bstatic.com/psb/capla/static/js/vendors.4a8dbaf5.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.155.68.14 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-155-68-14.sin52.r.cloudfront.net

Software

nginx /

Resource Hash

9e30d10643956b392a79c2b0ac71118408dcd4da64d1443c70475aa3cda758ea

Security Headers

Name	Value
Strict-Transport-Security	max-age=300; includeSubDomains
X-Xss-Protection	1; mode=block

Request headers

X-Booking-Language-Code: fr
X-Booking-CSRF: undefined
accept-language: zh-SG,zh;q=0.9
X-Booking-AID: 2256042
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
X-Booking-Label: undefined
Content-Type: application/json
X-Booking-Pageview-Id: b27b1fec2c7b0031
Referer: https://www.booking.com/attractions/index.fr.html?aid=2256042&emk=TRVYG5VXY1&emkcid=815&checkin=2022-06-23&checkout=2022-06-24&selected_currency=EUR&label=56202_usp-03_v2-
X-Booking-SiteType-Id: undefined
X-Booking-ET-Seed: undefined
X-Booking-Session-Id: undefined
X-Booking-Platform: WWW

Response headers

date: Sun, 25 Jun 2023 04:32:26 GMT
content-encoding: br
via: 1.1 4051cd1127320e383387d289cc46a5fc.cloudfront.net (CloudFront)
strict-transport-security: max-age=300; includeSubDomains
x-content-options: nosniff
x-amz-cf-pop: SIN52-P1
content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=20ce1fedae290139&e=UmFuZG9tSVYkc2RlIyh9YaKT1Ar0s2gSEmakdtrUqssMZiN_GnEmFcfb3Xe3ex8elO9h6Zmh57c
x-cache: Miss from cloudfront
content-length: 33
x-xss-protection: 1; mode=block
server: nginx
vary: User-Agent, Accept-Encoding
content-type: application/json; charset=UTF-8
access-control-allow-origin: https://www.booking.com
access-control-allow-credentials: true
x-amz-cf-id: yTCXyYA9C7VoGfgtmNvw3dXjCy3ypn0uPP-Go_XKJSwXrkc6oZtjGw==

GET
H2 200 bat.js Show response
bat.bing.com/ 40 KB
12 KB 50ms
41ms Script
application/javascript 2620:1ec:c11::200
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://bat.bing.com/bat.js

Requested by

Host: cf.bstatic.com
URL: https://cf.bstatic.com/psb/capla/static/js/client.403a07b7.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

679804e244b4127b7ecd99a513b57d6a4f91866410e16da69ce02f98f534051d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

accept-language: zh-SG,zh;q=0.9
Referer: https://www.booking.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
content-encoding: gzip
date: Sun, 25 Jun 2023 04:32:25 GMT
last-modified: Thu, 11 May 2023 18:08:27 GMT
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 7DCD0731DC52493DA2F67AB80A3F759F Ref B: SIN30EDGE0513 Ref C: 2023-06-25T04:32:26Z
etag: "80df77953384d91:0"
vary: Accept-Encoding
x-cache: CONFIG_NOCACHE
content-type: application/javascript
cache-control: private,max-age=1800
accept-ranges: bytes
content-length: 12183

GET
H2 200 756.6b5ad857.chunk.css
cf.bstatic.com/psb/capla/static/css/ 5 KB
2 KB 6ms
5ms Stylesheet
text/css 2600:9000:2003:f200:1f:e2ee:200:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://cf.bstatic.com/psb/capla/static/css/756.6b5ad857.chunk.css

Requested by

Host: cf.bstatic.com
URL: https://cf.bstatic.com/psb/capla/static/js/client.403a07b7.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:2003:f200:1f:e2ee:200:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

847cb1648fa9a41d494f58fba32452bfc8c69558f738a25f4194a4dde17f16f4

Security Headers

Name	Value
X-Xss-Protection	1; mode=block

Request headers

accept-language: zh-SG,zh;q=0.9
Referer: https://www.booking.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Sun, 18 Jun 2023 21:14:55 GMT
content-encoding: br
via: 1.1 2a45d2b5ea9ef7dcb9d372459729c164.cloudfront.net (CloudFront)
nel: {"report_to":"default","max_age":600}
x-amz-cf-pop: SIN2-C1
age: 544651
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-xss-protection: 1; mode=block
x-amz-expiration: expiry-date="Tue, 19 Sep 2023 08:57:28 GMT", rule-id=""
last-modified: Fri, 09 Jun 2023 15:51:53 GMT
server: nginx
etag: W/"8eeac3788af7206835c4c02aa1066795"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https://nellie.booking.com/report"}],"max_age":600,"group":"default","failure_fraction":0.05}
x-amz-meta-x-deployment-hash: foo
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=2592000
timing-allow-origin: *
x-amz-cf-id: dV_3iJJPXssZiNbgZzT0tAll6hLHhBj2duIWuHC3DUT3WCSMp1FAEg==
expires: Tue, 18 Jul 2023 21:14:55 GMT

GET
H2 200 756.e9817fe2.chunk.js Show response
cf.bstatic.com/psb/capla/static/js/ 267 KB
64 KB 5ms
5ms Script
application/javascript 2600:9000:2003:f200:1f:e2ee:200:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://cf.bstatic.com/psb/capla/static/js/756.e9817fe2.chunk.js

Requested by

Host: cf.bstatic.com
URL: https://cf.bstatic.com/psb/capla/static/js/client.403a07b7.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:2003:f200:1f:e2ee:200:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

a35fd31b64c765383a086f599925699d3bdba756be1664a8f9c7323c1ac88a78

Security Headers

Name	Value
X-Xss-Protection	1; mode=block

Request headers

accept-language: zh-SG,zh;q=0.9
Referer: https://www.booking.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Thu, 22 Jun 2023 11:15:49 GMT
content-encoding: br
via: 1.1 2a45d2b5ea9ef7dcb9d372459729c164.cloudfront.net (CloudFront)
nel: {"report_to":"default","max_age":600}
x-amz-cf-pop: SIN2-C1
age: 234997
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-xss-protection: 1; mode=block
x-amz-expiration: expiry-date="Fri, 20 Oct 2023 10:13:21 GMT", rule-id=""
last-modified: Thu, 22 Jun 2023 10:13:21 GMT
server: nginx
etag: W/"2ace00ae272e550b5e386c28d0875371"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https://nellie.booking.com/report"}],"max_age":600,"group":"default","failure_fraction":0.05}
x-amz-meta-x-deployment-hash: foo
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=2592000
timing-allow-origin: *
x-amz-cf-id: -aeL7Gfxc2npMJzvvPCmvpP2_o5O7oxKMaJH8Wz5jHIYkRI1wu-lmw==
expires: Sat, 22 Jul 2023 11:15:49 GMT

GET
H2 200 387.634d72e2.chunk.css
cf.bstatic.com/psb/capla/static/css/ 18 KB
4 KB 6ms
6ms Stylesheet
text/css 2600:9000:2003:f200:1f:e2ee:200:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://cf.bstatic.com/psb/capla/static/css/387.634d72e2.chunk.css

Requested by

Host: cf.bstatic.com
URL: https://cf.bstatic.com/psb/capla/static/js/client.403a07b7.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:2003:f200:1f:e2ee:200:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

b4d83c9ca910baca3fe847b627cc4558f206a23a76e51987a241dc2975f314b6

Security Headers

Name	Value
X-Xss-Protection	1; mode=block

Request headers

accept-language: zh-SG,zh;q=0.9
Referer: https://www.booking.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Sun, 18 Jun 2023 21:14:55 GMT
content-encoding: br
via: 1.1 2a45d2b5ea9ef7dcb9d372459729c164.cloudfront.net (CloudFront)
nel: {"report_to":"default","max_age":600}
x-amz-cf-pop: SIN2-C1
age: 544651
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-xss-protection: 1; mode=block
x-amz-expiration: expiry-date="Tue, 19 Sep 2023 08:57:28 GMT", rule-id=""
last-modified: Mon, 22 May 2023 08:57:28 GMT
server: nginx
etag: W/"d32590efe5fdeff1b9b4e1dcf96cf5b1"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https://nellie.booking.com/report"}],"max_age":600,"group":"default","failure_fraction":0.05}
x-amz-meta-x-deployment-hash: foo
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=2592000
timing-allow-origin: *
x-amz-cf-id: W9mL60XGkZrxSWEsSiQOeZOlYqzlKPReLfkXqCz8PsnOm8HGWYCZQg==
expires: Tue, 18 Jul 2023 21:14:55 GMT

GET
H2 200 387.ea44a46b.chunk.js Show response
cf.bstatic.com/psb/capla/static/js/ 622 KB
141 KB 6ms
6ms Script
application/javascript 2600:9000:2003:f200:1f:e2ee:200:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://cf.bstatic.com/psb/capla/static/js/387.ea44a46b.chunk.js

Requested by

Host: cf.bstatic.com
URL: https://cf.bstatic.com/psb/capla/static/js/client.403a07b7.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:2003:f200:1f:e2ee:200:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

00d089bb20fde4f8813892e4705d1a2788a5d1aac5258a1b56b1432c4668a5a9

Security Headers

Name	Value
X-Xss-Protection	1; mode=block

Request headers

accept-language: zh-SG,zh;q=0.9
Referer: https://www.booking.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Thu, 22 Jun 2023 11:15:49 GMT
content-encoding: br
via: 1.1 2a45d2b5ea9ef7dcb9d372459729c164.cloudfront.net (CloudFront)
nel: {"report_to":"default","max_age":600}
x-amz-cf-pop: SIN2-C1
age: 234996
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-xss-protection: 1; mode=block
x-amz-expiration: expiry-date="Fri, 20 Oct 2023 10:39:31 GMT", rule-id=""
last-modified: Thu, 22 Jun 2023 10:39:31 GMT
server: nginx
etag: W/"baa49d0eb1069a9d204446082ee276ed"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https://nellie.booking.com/report"}],"max_age":600,"group":"default","failure_fraction":0.05}
x-amz-meta-x-deployment-hash: foo
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=2592000
timing-allow-origin: *
x-amz-cf-id: GJCoqALdH_wxru6dHG-yHeawbBzl1K9fXOR-1YFQrIWsylj7wxIOOg==
expires: Sat, 22 Jul 2023 11:15:49 GMT

GET
H2 200 chunk-metadata Show response
www.booking.com/orca/ 16 KB
7 KB 324ms
323ms Fetch
application/json 18.155.68.14
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://www.booking.com/orca/chunk-metadata?chunk=756&mfe=b-attractions-product-frontend-capla&lang=fr&namespace=EQdeDRKZ

Requested by

Host: cf.bstatic.com
URL: https://cf.bstatic.com/psb/capla/static/js/vendors.4a8dbaf5.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.155.68.14 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-155-68-14.sin52.r.cloudfront.net

Software

nginx /

Resource Hash

20823da37b07f3fa2d9e96a3d3595a4f740ab8bd1d7684c81c1d470e9eae080a

Security Headers

Name	Value
Strict-Transport-Security	max-age=300; includeSubDomains
X-Xss-Protection	1; mode=block

Request headers

accept: application/json
x-booking-et-serialized-state: EdP1GYNGnWAwMrXUEYm38CMF0pKZxztulorvpluNXHYPSheITT-vfqFov3cXmLSVw
Referer: https://www.booking.com/attractions/index.fr.html?aid=2256042&emk=TRVYG5VXY1&emkcid=815&checkin=2022-06-23&checkout=2022-06-24&selected_currency=EUR&label=56202_usp-03_v2-
accept-language: zh-SG,zh;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Sun, 25 Jun 2023 04:32:26 GMT
content-encoding: br
via: 1.1 4051cd1127320e383387d289cc46a5fc.cloudfront.net (CloudFront)
strict-transport-security: max-age=300; includeSubDomains
x-content-options: nosniff
server: nginx
x-amz-cf-pop: SIN52-P1
vary: User-Agent, Accept-Encoding
content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=27601fed66e10171&e=UmFuZG9tSVYkc2RlIyh9YQyOc33qmp8WHR7A8UUx6hbYomDxizXuNVqQvhwrmpeli4YFs05Do3HtzDogoJKgfKKD1TVwxlhV
content-type: application/json; charset=UTF-8
x-cache: Miss from cloudfront
content-length: 6036
x-xss-protection: 1; mode=block
x-amz-cf-id: GS9ujIm-FsfzFgw1Ys9YUsq4Z16CQjwbvyIP2C4jOnYFBeViIQBcxQ==

GET
H2 200 chunk-metadata Show response
www.booking.com/orca/ 58 KB
17 KB 294ms
293ms Fetch
application/json 18.155.68.14
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://www.booking.com/orca/chunk-metadata?chunk=387&mfe=b-attractions-product-frontend-capla&lang=fr&namespace=EQdeDRKZ

Requested by

Host: cf.bstatic.com
URL: https://cf.bstatic.com/psb/capla/static/js/vendors.4a8dbaf5.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.155.68.14 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-155-68-14.sin52.r.cloudfront.net

Software

nginx /

Resource Hash

87e6ed0fea20b1a11b40b876780a4c6b65f92b937e2ed01540606762ed0f3787

Security Headers

Name	Value
Strict-Transport-Security	max-age=300; includeSubDomains
X-Xss-Protection	1; mode=block

Request headers

accept: application/json
x-booking-et-serialized-state: EdP1GYNGnWAwMrXUEYm38CMF0pKZxztulorvpluNXHYPSheITT-vfqFov3cXmLSVw
Referer: https://www.booking.com/attractions/index.fr.html?aid=2256042&emk=TRVYG5VXY1&emkcid=815&checkin=2022-06-23&checkout=2022-06-24&selected_currency=EUR&label=56202_usp-03_v2-
accept-language: zh-SG,zh;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Sun, 25 Jun 2023 04:32:26 GMT
content-encoding: br
via: 1.1 4051cd1127320e383387d289cc46a5fc.cloudfront.net (CloudFront)
strict-transport-security: max-age=300; includeSubDomains
x-content-options: nosniff
server: nginx
x-amz-cf-pop: SIN52-P1
vary: Accept-Encoding, User-Agent
content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=afdc1feda6d504d8&e=UmFuZG9tSVYkc2RlIyh9YQyOc33qmp8WHR7A8UUx6hbYomDxizXuNVqQvhwrmpelTjTXi6c1ep_A-MhGfV5PrdJM9B8w9DQF
content-type: application/json; charset=UTF-8
x-cache: Miss from cloudfront
content-length: 16617
x-xss-protection: 1; mode=block
x-amz-cf-id: KoUBXocIUyvELP_mhJeML98QVSDPEfhC8ZEDTREAJKIreO1W8mFR1g==

GET
H2 200 js_tracking Show response
www.booking.com/ 12 B
554 B 188ms
187ms XHR
image/gif 18.155.68.14
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://www.booking.com/js_tracking?ref_action=attractions_index&ver=2&stype=1&lang=fr&pid=b27b1fec2c7b0031&ete=&etg=web_shell_ux_header_view,web_shell_ux_header_view_www_non_logged_in,attractions_index_viewed_page&etcg=HWAFYFGeNBLScEXO|2&ets=dDfPJKSCYDTLUeXKbEfPYBBVYYT|1,dDfPJKSCYDTLUeXKbEfPYBBVYYT|3,HWAFYDEZREJWcRXZXe|1,HWAFYDEZREJWcRXZXe|2,HWAFYDEZRdZbVeUZDNPKFTdRNYYdIHSHDaae|1,HWAFYDEZRdZbVeUZDYYOLEbIeIdKC|1,HWAFYDEZRdZbVeUZDNQTbVSGNVBUKcKe|1,HWAFYDEZRdZbVeUZDYXKbOFHe|1,HWAFYDEZREeJIRBcVScbBNLPIHfSbfZALMO|1,HWAFYHIEUXPNMWe|1,HWAFYHIEUXPNMWe|2,HWAFYFGeNBLScEXO|1,HWAFYFGeNBLScEXO|8&etgwv=js_attr_viewed_attractions_index|1&m=UmFuZG9tSVYkc2RlIyh9YRpADH0-bKJ9eItaMTcEWLioMjvUWxfGkSIgdXl_RtsMjvEM4IycfI4cwUAEFiVcunmQ7EpIeUZPX0tiFH1KSmimEvDml2s767pMj8I1R3Ya593svcUrLfIjVhAwKFbsvZ9jPxpeZvdGgtfGFdfR_woUWHum0fOzJt3wIe9j8_v0xtatHR6nsdfVG0idWiVduz03fiMNmFsgdxDuuZ46tW4zV141PUwEC8UdIdssO9p0hzGphIHs0YdVUpRZcbAWug

Requested by

Host: cf.bstatic.com
URL: https://cf.bstatic.com/psb/capla/static/js/vendors.4a8dbaf5.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.155.68.14 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-155-68-14.sin52.r.cloudfront.net

Software

nginx /

Resource Hash

d9a55f7230942e5aa22d40adf36bafd94d3ed6719f5c56b1cbc19ab4f874d83a

Security Headers

Name	Value
Strict-Transport-Security	max-age=300; includeSubDomains
X-Xss-Protection	1; mode=block

Request headers

X-Booking-ET-Serialized-State: EdP1GYNGnWAwMrXUEYm38CMF0pKZxztulorvpluNXHYPSheITT-vfqFov3cXmLSVw
X-Booking-Language-Code: fr
X-Booking-Client-Info: dDfPJKSCYDTLUeXKbEfPYBBVYYT|1,dDfPJKSCYDTLUeXKbEfPYBBVYYT|3,HWAFYDEZREJWcRXZXe|1,HWAFYDEZREJWcRXZXe|2,HWAFYDEZRdZbVeUZDNPKFTdRNYYdIHSHDaae|1,HWAFYDEZRdZbVeUZDYYOLEbIeIdKC|1,HWAFYDEZRdZbVeUZDNQTbVSGNVBUKcKe|1,HWAFYDEZRdZbVeUZDYXKbOFHe|1,HWAFYDEZREeJIRBcVScbBNLPIHfSbfZALMO|1,HWAFYHIEUXPNMWe|1,HWAFYHIEUXPNMWe|2,HWAFYFGeNBLScEXO|1,HWAFYFGeNBLScEXO|8
accept-language: zh-SG,zh;q=0.9
X-Booking-AID: 2256042
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
X-Booking-Pageview-Id: b27b1fec2c7b0031
X-Booking-Info: dDfPJKSCYDTLUeXKbEfPYBBVYYT|1,dDfPJKSCYDTLUeXKbEfPYBBVYYT|3,HWAFYDEZREJWcRXZXe|1,HWAFYDEZREJWcRXZXe|2,HWAFYDEZRdZbVeUZDNPKFTdRNYYdIHSHDaae|1,HWAFYDEZRdZbVeUZDYYOLEbIeIdKC|1,HWAFYDEZRdZbVeUZDNQTbVSGNVBUKcKe|1,HWAFYDEZRdZbVeUZDYXKbOFHe|1,HWAFYDEZREeJIRBcVScbBNLPIHfSbfZALMO|1,HWAFYHIEUXPNMWe|1,HWAFYHIEUXPNMWe|2,HWAFYFGeNBLScEXO|1,HWAFYFGeNBLScEXO|8
Referer: https://www.booking.com/attractions/index.fr.html?aid=2256042&emk=TRVYG5VXY1&emkcid=815&checkin=2022-06-23&checkout=2022-06-24&selected_currency=EUR&label=56202_usp-03_v2-
X-Booking-SiteType-Id: 1
X-Booking-Session-Id: b3ccf62995dd8e4aae7f0e3d90883ad0

Response headers

date: Sun, 25 Jun 2023 04:32:26 GMT
content-encoding: br
via: 1.1 4051cd1127320e383387d289cc46a5fc.cloudfront.net (CloudFront)
strict-transport-security: max-age=300; includeSubDomains
server: nginx
x-amz-cf-pop: SIN52-P1
vary: Accept-Encoding, User-Agent
content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=15c51feda79f001e&e=UmFuZG9tSVYkc2RlIyh9Yea92wm0yRUjnCBymoy8ejIPhve979GpyIOwCddJw3pSJA1SIRZBtKQ
content-type: image/gif
x-cache: Miss from cloudfront
content-length: 35
x-xss-protection: 1; mode=block
x-amz-cf-id: Fjkn-5Ls-RE5MfDrH7Yd0sxNC3WKVO4iaDnwjUUuvtq2FRyb_AN4AA==

POST
H2 200 graphql Show response
www.booking.com/dml/ 241 KB
43 KB 499ms
498ms Fetch
application/json 18.155.68.14
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://www.booking.com/dml/graphql?aid=2256042&emk=TRVYG5VXY1&emkcid=815&checkin=2022-06-23&checkout=2022-06-24&selected_currency=EUR&label=56202_usp-03_v2-&lang=fr

Requested by

Host: cf.bstatic.com
URL: https://cf.bstatic.com/psb/capla/static/js/vendors.4a8dbaf5.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.155.68.14 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-155-68-14.sin52.r.cloudfront.net

Software

nginx /

Resource Hash

2499881d37b287a82f41dd0cbd1df8cfa672db7a03512353c2f509bf6daf2a11

Security Headers

Name	Value
Strict-Transport-Security	max-age=300; includeSubDomains
X-Xss-Protection	1; mode=block

Request headers

x-booking-context-aid: 2256042
x-booking-csrf-token: eyJhbGciOiJIUzUxMiJ9.eyJpc3MiOiJjb250ZXh0LWVucmljaG1lbnQtYXBpIiwic3ViIjoiY3NyZi10b2tlbiIsImlhdCI6MTY4NzY2NzU0NSwiZXhwIjoxNjg3NzUzOTQ1fQ.IBGIj93jJ0VNY7V5plK0voDxq1IObIT3BtU4MvYGpltQVHfduG26yw3qBcXQ3015iopretuY2mwopUgTT8vG2A
x-booking-et-serialized-state: EdP1GYNGnWAwMrXUEYm38CMF0pKZxztulorvpluNXHYPSheITT-vfqFov3cXmLSVw
x-booking-site-type-id: 1
accept-language: zh-SG,zh;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
content-type: application/json
x-booking-pageview-id: b27b1fec2c7b0031
accept: */*
x-booking-topic: capla_browser_b-attractions-product-frontend-capla
Referer: https://www.booking.com/attractions/index.fr.html?aid=2256042&emk=TRVYG5VXY1&emkcid=815&checkin=2022-06-23&checkout=2022-06-24&selected_currency=EUR&label=56202_usp-03_v2-
x-booking-context-action-name: attractions_index

Response headers

date: Sun, 25 Jun 2023 04:32:26 GMT
content-encoding: br
via: 1.1 4051cd1127320e383387d289cc46a5fc.cloudfront.net (CloudFront)
strict-transport-security: max-age=300; includeSubDomains
x-content-options: nosniff
server: nginx
x-amz-cf-pop: SIN52-P1
vary: Accept-Encoding, User-Agent
content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=45f21fed86890017&e=UmFuZG9tSVYkc2RlIyh9YQyOc33qmp8WHR7A8UUx6hbHIfwfMgQDGRlzZa5W_WGlV5uRS2tNEbwNFvLDZiC45w
content-type: application/json; charset=UTF-8
x-cache: Miss from cloudfront
content-length: 42824
x-xss-protection: 1; mode=block
x-amz-cf-id: THspsNpkmZYPGhByFryjj-uT4AwNT7QU3YemJ88wEiKMuFlec6W9eA==

OPTIONS
H2 204 implicit
account.booking.com/privacy-consents/ Frame 0
0 641ms
631ms Preflight 13.227.254.42
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://account.booking.com/privacy-consents/implicit

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.227.254.42 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-227-254-42.sin52.r.cloudfront.net

Software

envoy /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://*.booking.com 'self'; report-uri https://nellie.booking.com/csp-report-uri?type=block&tag=212&pid=10701fed16fc0a91&e=UmFuZG9tSVYkc2RlIyh9YSWKtKO5TxgOpTwVTPfHZKNW3Hcrm1RLgTDT2V-m21UMJ4KxJTAfD3k6vpGGyphNZUfy-f31chCZb8612iO9R_UYhDOKZTX9f9H49t8PnK2N6xuOIDHFf7b5pKFkMgA8SSAtZAcsGKnnSWpxtnpT5uQ
Strict-Transport-Security	max-age=300; includeSubDomains
X-Xss-Protection	1; mode=block

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://www.booking.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: content-type
access-control-allow-methods: POST
access-control-allow-origin: https://www.booking.com
access-control-max-age: 1728000
content-security-policy: frame-ancestors https://*.booking.com 'self'; report-uri https://nellie.booking.com/csp-report-uri?type=block&tag=212&pid=10701fed16fc0a91&e=UmFuZG9tSVYkc2RlIyh9YSWKtKO5TxgOpTwVTPfHZKNW3Hcrm1RLgTDT2V-m21UMJ4KxJTAfD3k6vpGGyphNZUfy-f31chCZb8612iO9R_UYhDOKZTX9f9H49t8PnK2N6xuOIDHFf7b5pKFkMgA8SSAtZAcsGKnnSWpxtnpT5uQ
content-security-policy-report-only: base-uri 'none'; connect-src saa.booking.com secure.booking.com reports.booking.com privacyportal-eu.onetrust.com geolocation.onetrust.com cdn.cookielaw.org www.google-analytics.com *.perimeterx.net *.pxchk.net *.px-cdn.net *.px-client.net *.px-cloud.net 'self' 'report-sample'; default-src *.bstatic.com bstatic.com 'self'; frame-src https://www.youtube.com/embed/Vv4w5SmRkss *.bstatic.com https://www.google.com bstatic.com www.booking.com secure.booking.com paymentcomponent.booking.com 'self'; img-src 'self' data: www.booking.com graph.facebook.com cdn.cookielaw.org account.booking.com *.bstatic.com bstatic.com *.static.booking.cn www.google-analytics.com www.google.com stats.g.doubleclick.net *.px-cloud.net *.perimeterx.net www.gstatic.com; object-src 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=213&pid=10701fed16fc0a91&e=UmFuZG9tSVYkc2RlIyh9YSWKtKO5TxgOpTwVTPfHZKNW3Hcrm1RLgTDT2V-m21UMJ4KxJTAfD3k6vpGGyphNZUfy-f31chCZb8612iO9R_UYhDOKZTX9f9H49t8PnK2N6xuOIDHFf7b5pKFkMgA8SSAtZAcsGKnnSWpxtnpT5uQ; script-src saa.booking.com *.bstatic.com bstatic.com *.static.booking.cn www.google.com www.google-analytics.com cdn.cookielaw.org geolocation.onetrust.com 'self' 'nonce-WtX9mkhUHAERJd1' 'report-sample'; style-src *.bstatic.com bstatic.com *.static.booking.cn 'self' 'unsafe-inline'
date: Sun, 25 Jun 2023 04:32:27 GMT
server: envoy
strict-transport-security: max-age=300; includeSubDomains
via: 1.1 d19f6de4de1eb10d5b27d86de6b4a7d4.cloudfront.net (CloudFront)
x-amz-cf-id: 2_cALNIXhCKAGkIRXRXLoi1xDtfMZ4VLzSPgkfVO2TWvErsAd2oLXQ==
x-amz-cf-pop: SIN52-C3
x-cache: Miss from cloudfront
x-xss-protection: 1; mode=block

POST
H2 200 implicit Show response
account.booking.com/privacy-consents/ 53 B
3 KB 416ms
416ms XHR
application/json 13.227.254.42
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://account.booking.com/privacy-consents/implicit

Requested by

Host: cf.bstatic.com
URL: https://cf.bstatic.com/libs/privacy-consent/releases/2.1.41/customer/cookie-banner.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.227.254.42 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-227-254-42.sin52.r.cloudfront.net

Software

envoy /

Resource Hash

8c8db94c395d3e3dec8930bf08d5e602d9ee082ded38ed77433225b62adb5900

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://*.booking.com 'self'; report-uri https://nellie.booking.com/csp-report-uri?type=block&tag=212&pid=3f611fed1633041e&e=UmFuZG9tSVYkc2RlIyh9YSWKtKO5TxgOpTwVTPfHZKNW3Hcrm1RLgTDT2V-m21UMJ4KxJTAfD3k6vpGGyphNZUfy-f31chCZHPTonodp_KimHZLP-kkm31nZp_X7YOBYWt1U6tx6H7m4pxdCeTguY6EqRaeLKkWKCcvMpdlXff8
Strict-Transport-Security	max-age=300; includeSubDomains
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.booking.com/
accept-language: zh-SG,zh;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-type: application/json;charset=UTF-8

Response headers

date: Sun, 25 Jun 2023 04:32:27 GMT
content-security-policy: frame-ancestors https://*.booking.com 'self'; report-uri https://nellie.booking.com/csp-report-uri?type=block&tag=212&pid=3f611fed1633041e&e=UmFuZG9tSVYkc2RlIyh9YSWKtKO5TxgOpTwVTPfHZKNW3Hcrm1RLgTDT2V-m21UMJ4KxJTAfD3k6vpGGyphNZUfy-f31chCZHPTonodp_KimHZLP-kkm31nZp_X7YOBYWt1U6tx6H7m4pxdCeTguY6EqRaeLKkWKCcvMpdlXff8
via: 1.1 ce37b125bad795f4918cd50b3f95260a.cloudfront.net (CloudFront)
strict-transport-security: max-age=300; includeSubDomains
x-amz-cf-pop: SIN52-C3
content-security-policy-report-only: base-uri 'none'; connect-src saa.booking.com secure.booking.com reports.booking.com privacyportal-eu.onetrust.com geolocation.onetrust.com cdn.cookielaw.org www.google-analytics.com *.perimeterx.net *.pxchk.net *.px-cdn.net *.px-client.net *.px-cloud.net 'self' 'report-sample'; default-src *.bstatic.com bstatic.com 'self'; frame-src https://www.youtube.com/embed/Vv4w5SmRkss *.bstatic.com https://www.google.com bstatic.com www.booking.com secure.booking.com paymentcomponent.booking.com 'self'; img-src 'self' data: www.booking.com graph.facebook.com cdn.cookielaw.org account.booking.com *.bstatic.com bstatic.com *.static.booking.cn www.google-analytics.com www.google.com stats.g.doubleclick.net *.px-cloud.net *.perimeterx.net www.gstatic.com; object-src 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=213&pid=3f611fed1633041e&e=UmFuZG9tSVYkc2RlIyh9YSWKtKO5TxgOpTwVTPfHZKNW3Hcrm1RLgTDT2V-m21UMJ4KxJTAfD3k6vpGGyphNZUfy-f31chCZHPTonodp_KimHZLP-kkm31nZp_X7YOBYWt1U6tx6H7m4pxdCeTguY6EqRaeLKkWKCcvMpdlXff8; script-src saa.booking.com *.bstatic.com bstatic.com *.static.booking.cn www.google.com www.google-analytics.com cdn.cookielaw.org geolocation.onetrust.com 'self' 'nonce-703BWo7SMXb7HxW' 'report-sample'; style-src *.bstatic.com bstatic.com *.static.booking.cn 'self' 'unsafe-inline'
x-cache: Miss from cloudfront
x-xss-protection: 1; mode=block
server: envoy
access-control-max-age: 1728000
access-control-allow-methods: POST
content-type: application/json; charset=UTF-8
access-control-allow-origin: https://www.booking.com
access-control-allow-credentials: true
access-control-allow-headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range
x-amz-cf-id: RFBOnx3g3VDH3J8XkuPRB1_HviWW6pEj8ev9HNF27oEKz8ixl6XW9w==

POST
H2 200 collect Show response
www.google-analytics.com/j/ 3 B
208 B 4ms
4ms XHR
text/plain 2001:4860:4802:36::178
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j101&a=1606286131&t=pageview&_s=1&dl=https%3A%2F%2Fwww.booking.com%2Fattractions%2Findex.fr.html%3Faid%3D2256042%26emk%3DTRVYG5VXY1%26emkcid%3D815%26checkin%3D2022-06-23%26checkout%3D2022-06-24%26selected_currency%3DEUR%26label%3D56202_usp-03_v2-&dp=%2Fattractions%2Findex.fr.html%3Faid%3D2256042%26emk%3DTRVYG5VXY1%26emkcid%3D815%26checkin%3D2022-06-23%26checkout%3D2022-06-24%26selected_currency%3DEUR%26label%3D56202_usp-03_v2-&ul=en-us&de=UTF-8&dt=Un%20large%20choix%20de%20visites%20et%20d%27activit%C3%A9s%C2%A0%7C%20Booking.com&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YEBAAEABAAAAACAAI~&jid=350025876&gjid=804564169&cid=1286877469.1687667547&tid=UA-116109-63&_gid=152291588.1687667547&_r=1&_slc=1&cd1=Attractions&cd2=2256042&cd3=not_logged_in&cd7=&cd8=fr&cd9=EUR&cd11=external&cd12=production&cd26=&z=699604133

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2001:4860:4802:36::178 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

1cffc2b3146584685cd72751d7f28aa030ab9ae2f1bc78f2c27909f8d8287b26

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.booking.com/
accept-language: zh-SG,zh;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Sun, 25 Jun 2023 04:32:26 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://www.booking.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 3
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

general.fr.html Show response
www.booking.com/ Frame C01B
Redirect Chain

https://account.booking.com/oauth2/authorize/v2?client_id=vO1Kblk7xX9tUn2cpZLS&redirect_uri=https%3A%2F%2Fsecure.booking.com%2Flogin.html%3Fop%3Doauth_return&response_type=anon_session&prompt=none&...
https://secure.booking.com/login.html?lang=en-us&state=UssCSD60yCSehgT0YWM_jnMpRXtcduNNsi0OV2U2ZwFuvlE6QSMSB6hQOOr-TohM6duBR_ZxEbkYE1aLILz45IbZW6fLqybixUmjr68hU3i-H554baxYfxBFLuLZF3nWm4zzlGE7IP_l7K...
https://www.booking.com/general.fr.html?tmpl=profile%2Flogin_callback_anon_session;aid=2256042;sid=4d5b6628cd255c86bff42f20db502482;label=56202_usp-03_v2-;iframe=1

327 B
2 KB

406ms
405ms

Document
text/html

18.155.68.14
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://www.booking.com/general.fr.html?tmpl=profile%2Flogin_callback_anon_session;aid=2256042;sid=4d5b6628cd255c86bff42f20db502482;label=56202_usp-03_v2-;iframe=1

Requested by

Host: account.booking.com
URL: https://account.booking.com/static/booking-sso.v1.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.155.68.14 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-155-68-14.sin52.r.cloudfront.net

Software

nginx /

Resource Hash

a18f1d273a36f3738625171b8e1fc7481a78c68185da19b9c5c64e4856e400bc

Security Headers

Name	Value
Strict-Transport-Security	max-age=300; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.booking.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
accept-language: zh-SG,zh;q=0.9

Response headers

cache-control: private
content-encoding: br
content-length: 205
content-security-policy-report-only: frame-ancestors www.booking.com; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=179&pid=a09f1fed7f4a007b&e=UmFuZG9tSVYkc2RlIyh9YUXizIM4n0j9TxK4nd9bo_nF83LVsVfUMWAf79JChYf8
content-type: text/html; charset=UTF-8
date: Sun, 25 Jun 2023 04:32:27 GMT
nel: {"report_to":"default","max_age":604800}
report-to: {"max_age":604800,"group":"default","endpoints":[{"url":"https://nellie.booking.com/report"}]}
server: nginx
strict-transport-security: max-age=300; includeSubDomains
vary: User-Agent, Accept-Encoding
via: 1.1 4051cd1127320e383387d289cc46a5fc.cloudfront.net (CloudFront)
x-amz-cf-id: vAd4YxP4ho9BHmAsqGGAPMmJJKc6m5Y3VgrxApNKnDfj1mI4C13BxQ==
x-amz-cf-pop: SIN52-P1
x-cache: Miss from cloudfront
x-content-type-options: nosniff
x-recruiting: Like HTTP headers? Come write ours: https://careers.booking.com
x-xss-protection: 1; mode=block

Redirect headers

cache-control: no-cache, private, no-store, must-revalidate, max-stale=0, post-check=0, pre-check=0
date: Sun, 25 Jun 2023 04:32:27 GMT
location: https://www.booking.com/general.fr.html?tmpl=profile%2Flogin_callback_anon_session;aid=2256042;sid=4d5b6628cd255c86bff42f20db502482;label=56202_usp-03_v2-;iframe=1
nel: {"report_to":"default","max_age":604800}
report-to: {"max_age":604800,"endpoints":[{"url":"https://nellie.booking.com/report"}],"group":"default"}
server: nginx
strict-transport-security: max-age=300; includeSubDomains
via: 1.1 4d52d2bee89a499a2c7d426aa79a8efa.cloudfront.net (CloudFront)
x-amz-cf-id: fQV0f7RT4BWRQVz6ZHwLHlESIK-T0hNjZT33BJ6EQBZv64u6I1z9xA==
x-amz-cf-pop: SIN2-P1
x-cache: Miss from cloudfront
x-content-type-options: nosniff
x-recruiting: Like HTTP headers? Come write ours: https://careers.booking.com
x-xss-protection: 1; mode=block

GET
H2 204 15005490.js Show response
bat.bing.com/p/action/ 0
118 B 246ms
246ms Script
text/plain 2620:1ec:c11::200
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://bat.bing.com/p/action/15005490.js

Requested by

Host: bat.bing.com
URL: https://bat.bing.com/bat.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

accept-language: zh-SG,zh;q=0.9
Referer: https://www.booking.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: private,max-age=1800
date: Sun, 25 Jun 2023 04:32:26 GMT
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: C11714534EF7464789714356C279F6E7 Ref B: SIN30EDGE0513 Ref C: 2023-06-25T04:32:26Z
x-cache: CONFIG_NOCACHE

GET
H2 204 0
bat.bing.com/action/ 0
361 B 40ms
39ms Image
text/plain 2620:1ec:c11::200
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://bat.bing.com/action/0?ti=15005490&Ver=2&mid=18a59d7b-d6ab-425b-a79e-13af67f5533e&sid=499f70d0131111eeaa09f7ad008dc91b&vid=499f9b50131111ee82bf0be0866b6e7c&vids=1&msclkid=N&pi=1200101525&lg=en-US&sw=1600&sh=1200&sc=24&tl=Un%20large%20choix%20de%20visites%20et%20d%27activit%C3%A9s%C2%A0%7C%20Booking.com&p=https%3A%2F%2Fwww.booking.com%2Fattractions%2Findex.fr.html%3Faid%3D2256042%26emk%3DTRVYG5VXY1%26emkcid%3D815%26checkin%3D2022-06-23%26checkout%3D2022-06-24%26selected_currency%3DEUR%26label%3D56202_usp-03_v2-&r=&lt=1309&evt=pageLoad&sv=1&rn=777516

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

accept-language: zh-SG,zh;q=0.9
Referer: https://www.booking.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

pragma: no-cache
strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Sun, 25 Jun 2023 04:32:25 GMT
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 3A018D595D4E470082C3E5C4C2C48173 Ref B: SIN30EDGE0513 Ref C: 2023-06-25T04:32:26Z
x-cache: CONFIG_NOCACHE
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 200 track Show response
www.booking.com/c360/v1/ 29 B
919 B 595ms
595ms Fetch
application/json 18.155.68.14
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://www.booking.com/c360/v1/track

Requested by

Host: cf.bstatic.com
URL: https://cf.bstatic.com/psb/capla/static/js/vendors.4a8dbaf5.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.155.68.14 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-155-68-14.sin52.r.cloudfront.net

Software

nginx /

Resource Hash

9e30d10643956b392a79c2b0ac71118408dcd4da64d1443c70475aa3cda758ea

Security Headers

Name	Value
Strict-Transport-Security	max-age=300; includeSubDomains
X-Xss-Protection	1; mode=block

Request headers

X-Booking-Language-Code: fr
X-Booking-CSRF: undefined
accept-language: zh-SG,zh;q=0.9
X-Booking-AID: 2256042
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
X-Booking-Label: undefined
Content-Type: application/json
X-Booking-Pageview-Id: b27b1fec2c7b0031
Referer: https://www.booking.com/attractions/index.fr.html?aid=2256042&emk=TRVYG5VXY1&emkcid=815&checkin=2022-06-23&checkout=2022-06-24&selected_currency=EUR&label=56202_usp-03_v2-
X-Booking-SiteType-Id: undefined
X-Booking-ET-Seed: undefined
X-Booking-Session-Id: undefined
X-Booking-Platform: WWW

Response headers

date: Sun, 25 Jun 2023 04:32:27 GMT
content-encoding: br
via: 1.1 4051cd1127320e383387d289cc46a5fc.cloudfront.net (CloudFront)
strict-transport-security: max-age=300; includeSubDomains
x-content-options: nosniff
x-amz-cf-pop: SIN52-P1
content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=c9601feded020120&e=UmFuZG9tSVYkc2RlIyh9YaKT1Ar0s2gSEmakdtrUqstdU0tYGmjcg0RUqB6eR31Z90WnPhaA5fI
x-cache: Miss from cloudfront
content-length: 33
x-xss-protection: 1; mode=block
server: nginx
vary: User-Agent, Accept-Encoding
content-type: application/json; charset=UTF-8
access-control-allow-origin: https://www.booking.com
access-control-allow-credentials: true
x-amz-cf-id: o21wrN52HbsdEu4jk3eEZOZpZm6tD59HSUJnrHs6ZnFIJ08Qa1oIfQ==

POST
H2 200 graphql Show response
www.booking.com/dml/ 151 B
1 KB 600ms
599ms Fetch
application/json 18.155.68.14
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://www.booking.com/dml/graphql?aid=2256042&emk=TRVYG5VXY1&emkcid=815&checkin=2022-06-23&checkout=2022-06-24&selected_currency=EUR&label=56202_usp-03_v2-&lang=fr

Requested by

Host: cf.bstatic.com
URL: https://cf.bstatic.com/psb/capla/static/js/vendors.4a8dbaf5.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.155.68.14 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-155-68-14.sin52.r.cloudfront.net

Software

nginx /

Resource Hash

396585e7f989563e09331013b795e11b2944c91bf9b3bdd03083dd0656027efd

Security Headers

Name	Value
Strict-Transport-Security	max-age=300; includeSubDomains
X-Xss-Protection	1; mode=block

Request headers

x-booking-context-aid: 2256042
x-booking-csrf-token: eyJhbGciOiJIUzUxMiJ9.eyJpc3MiOiJjb250ZXh0LWVucmljaG1lbnQtYXBpIiwic3ViIjoiY3NyZi10b2tlbiIsImlhdCI6MTY4NzY2NzU0NSwiZXhwIjoxNjg3NzUzOTQ1fQ.IBGIj93jJ0VNY7V5plK0voDxq1IObIT3BtU4MvYGpltQVHfduG26yw3qBcXQ3015iopretuY2mwopUgTT8vG2A
x-booking-et-serialized-state: EdP1GYNGnWAwMrXUEYm38CMF0pKZxztulorvpluNXHYPSheITT-vfqFov3cXmLSVw
x-booking-site-type-id: 1
accept-language: zh-SG,zh;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
content-type: application/json
x-booking-pageview-id: b27b1fec2c7b0031
accept: */*
x-booking-topic: capla_browser_b-attractions-product-frontend-capla
Referer: https://www.booking.com/attractions/index.fr.html?aid=2256042&emk=TRVYG5VXY1&emkcid=815&checkin=2022-06-23&checkout=2022-06-24&selected_currency=EUR&label=56202_usp-03_v2-
x-booking-context-action-name: attractions_index

Response headers

date: Sun, 25 Jun 2023 04:32:27 GMT
content-encoding: br
via: 1.1 4051cd1127320e383387d289cc46a5fc.cloudfront.net (CloudFront)
strict-transport-security: max-age=300; includeSubDomains
x-content-options: nosniff
server: nginx
x-amz-cf-pop: SIN52-P1
vary: User-Agent, Accept-Encoding
content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=75fd1fed1f1d011f&e=UmFuZG9tSVYkc2RlIyh9YQyOc33qmp8WHR7A8UUx6hbHIfwfMgQDGfKMvFdhC92D-YpKTVRSuvYJUEAn3hexyA
content-type: application/json; charset=UTF-8
x-cache: Miss from cloudfront
content-length: 92
x-xss-protection: 1; mode=block
x-amz-cf-id: dUQM-XgUiGZco9EIBHTs38qDclkuyC1AHga8btViQUoTkXmINP3KNw==

GET
H2 200 619666.jpg
q-xx.bstatic.com/xdata/images/city/533x300/ 25 KB
25 KB 5ms
4ms Image
image/jpeg 2600:9000:2003:f200:1f:e2ee:200:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://q-xx.bstatic.com/xdata/images/city/533x300/619666.jpg?k=504b97635641d489438feb63780d4ae80ce8a2fd08a1fcb6183485738a87e6ad&o=

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:2003:f200:1f:e2ee:200:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

d01d469b52e318752809aef3a2ba9dae33c250a2d86ae2713fec46a6393b0b17

Security Headers

Name	Value
X-Xss-Protection	1; mode=block

Request headers

accept-language: zh-SG,zh;q=0.9
Referer: https://www.booking.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Sun, 28 May 2023 15:09:27 GMT
via: 1.1 2a45d2b5ea9ef7dcb9d372459729c164.cloudfront.net (CloudFront)
server: nginx
x-amz-cf-pop: SIN2-C1
age: 2380980
etag: "49ef8d4b8e6828833f28e5304cd8502723f2ccff"
x-cache: Hit from cloudfront
content-type: image/jpeg
access-control-allow-origin: *
cache-control: max-age=2592000
timing-allow-origin: *
x-amz-cf-id: Xa2DKRvwn3VXUcnhuf8HCZKP9_tWklO7am1fHNhIA-qLuu1Bq3VKdg==
content-length: 25606
x-xss-protection: 1; mode=block
expires: Tue, 27 Jun 2023 15:09:27 GMT

GET
H2 200 72204269.jpg
q-xx.bstatic.com/xdata/images/xphoto/533x300/ 30 KB
30 KB 8ms
7ms Image
image/jpeg 2600:9000:2003:f200:1f:e2ee:200:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://q-xx.bstatic.com/xdata/images/xphoto/533x300/72204269.jpg?k=dda35f09d4db949aa6786bc25686bddd016cdd12a2603193e90df0d44a51a1ac&o=

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:2003:f200:1f:e2ee:200:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

09c455549d575899a31e2d34f1e7fbebdfdb655c547825c4d8921e883973d641

Security Headers

Name	Value
X-Xss-Protection	1; mode=block

Request headers

accept-language: zh-SG,zh;q=0.9
Referer: https://www.booking.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 31 May 2023 20:07:00 GMT
via: 1.1 2a45d2b5ea9ef7dcb9d372459729c164.cloudfront.net (CloudFront)
server: nginx
x-amz-cf-pop: SIN2-C1
age: 2103927
etag: "5a443d96ca35d643c5804edf3fea0fb1a901b802"
x-cache: Hit from cloudfront
content-type: image/jpeg
access-control-allow-origin: *
cache-control: max-age=2592000
timing-allow-origin: *
x-amz-cf-id: xgurC4ghqaWVaNpHhwBocSqXbnN-bTAc9XA3y3gNFkpxeZ8hmZsVnA==
content-length: 30535
x-xss-protection: 1; mode=block
expires: Fri, 30 Jun 2023 20:07:00 GMT

GET
H2 200 654667.jpg
q-xx.bstatic.com/xdata/images/city/533x300/ 24 KB
25 KB 11ms
10ms Image
image/jpeg 2600:9000:2003:f200:1f:e2ee:200:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://q-xx.bstatic.com/xdata/images/city/533x300/654667.jpg?k=38b7cadbc436ac8f1990d593aeea431bdca024ad7e19136de1a648a741efd1d2&o=

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:2003:f200:1f:e2ee:200:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

5d7b260230514264e88bd54292a596035d6e399c4340e11e942408448a3efd6f

Security Headers

Name	Value
X-Xss-Protection	1; mode=block

Request headers

accept-language: zh-SG,zh;q=0.9
Referer: https://www.booking.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Wed, 31 May 2023 20:07:00 GMT
via: 1.1 2a45d2b5ea9ef7dcb9d372459729c164.cloudfront.net (CloudFront)
server: nginx
x-amz-cf-pop: SIN2-C1
age: 2103927
etag: "71da4f4013f1928d8051e0b5da1e337f966415a4"
x-cache: Hit from cloudfront
content-type: image/jpeg
access-control-allow-origin: *
cache-control: max-age=2592000
timing-allow-origin: *
x-amz-cf-id: Uxjr7X_PczsR3j11hhZNafYsVptT5MrZHnB1NSVaNVR-hojz_FpiMQ==
content-length: 24922
x-xss-protection: 1; mode=block
expires: Fri, 30 Jun 2023 20:07:00 GMT

GET
H2 200 72204347.jpg
q-xx.bstatic.com/xdata/images/xphoto/533x300/ 44 KB
45 KB 7ms
6ms Image
image/jpeg 2600:9000:2003:f200:1f:e2ee:200:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://q-xx.bstatic.com/xdata/images/xphoto/533x300/72204347.jpg?k=2028e72e4ea4eb18da986b8a60fd841f65fe0575db5012d723233b4427939b4a&o=

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:2003:f200:1f:e2ee:200:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

98137c5c7b1900520c609be80bd7147b462a4ba5f8b387471fde4430f1df59ee

Security Headers

Name	Value
X-Xss-Protection	1; mode=block

Request headers

accept-language: zh-SG,zh;q=0.9
Referer: https://www.booking.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Tue, 13 Jun 2023 08:46:43 GMT
via: 1.1 2a45d2b5ea9ef7dcb9d372459729c164.cloudfront.net (CloudFront)
server: nginx
x-amz-cf-pop: SIN2-C1
age: 1021544
etag: "176e00178f5a3323ad9c8175b92194bc88e48779"
x-cache: Hit from cloudfront
content-type: image/jpeg
access-control-allow-origin: *
cache-control: max-age=2592000
timing-allow-origin: *
x-amz-cf-id: jLcizpQE-vpudAROlzIt3-icPh7sMj7jUVqI9VlAjGtEiiSNJmYg5w==
content-length: 45308
x-xss-protection: 1; mode=block
expires: Thu, 13 Jul 2023 08:46:43 GMT

GET
H2 200 977037.jpg
q-xx.bstatic.com/xdata/images/city/533x300/ 29 KB
29 KB 7ms
7ms Image
image/jpeg 2600:9000:2003:f200:1f:e2ee:200:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://q-xx.bstatic.com/xdata/images/city/533x300/977037.jpg?k=d0690d167e3368fd984e6e0f68a5befa8e73ac33e52c64655419dfa6b422ad32&o=

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:2003:f200:1f:e2ee:200:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

aee5c7fe6be2a805d9c9b4b01e4bb527d9759c320d6d7febbe7047c4c4cd7925

Security Headers

Name	Value
X-Xss-Protection	1; mode=block

Request headers

accept-language: zh-SG,zh;q=0.9
Referer: https://www.booking.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

date: Thu, 08 Jun 2023 07:38:22 GMT
via: 1.1 2a45d2b5ea9ef7dcb9d372459729c164.cloudfront.net (CloudFront)
server: nginx
x-amz-cf-pop: SIN2-C1
age: 1457644
etag: "db5e4477d89e21a5b71edea34bf58e1cee7ab952"
x-cache: Hit from cloudfront
content-type: image/jpeg
access-control-allow-origin: *
cache-control: max-age=2592000
timing-allow-origin: *
x-amz-cf-id: OPeYobycnK6Zvz6OCYguLN9oXg1E1lGvlrevpJ4nhXBPkG-lcWShWw==
content-length: 29244
x-xss-protection: 1; mode=block
expires: Sat, 08 Jul 2023 07:38:22 GMT

POST
H2 200 graphql Show response
www.booking.com/dml/ 151 B
1 KB 293ms
292ms Fetch
application/json 18.155.68.14
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://www.booking.com/dml/graphql?aid=2256042&emk=TRVYG5VXY1&emkcid=815&checkin=2022-06-23&checkout=2022-06-24&selected_currency=EUR&label=56202_usp-03_v2-&lang=fr

Requested by

Host: cf.bstatic.com
URL: https://cf.bstatic.com/psb/capla/static/js/vendors.4a8dbaf5.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.155.68.14 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-155-68-14.sin52.r.cloudfront.net

Software

nginx /

Resource Hash

47b2c70e461233162e2c36993c530adbf6c3d82572162d8944eff3a83aa743c3

Security Headers

Name	Value
Strict-Transport-Security	max-age=300; includeSubDomains
X-Xss-Protection	1; mode=block

Request headers

x-booking-context-aid: 2256042
x-booking-csrf-token: eyJhbGciOiJIUzUxMiJ9.eyJpc3MiOiJjb250ZXh0LWVucmljaG1lbnQtYXBpIiwic3ViIjoiY3NyZi10b2tlbiIsImlhdCI6MTY4NzY2NzU0NSwiZXhwIjoxNjg3NzUzOTQ1fQ.IBGIj93jJ0VNY7V5plK0voDxq1IObIT3BtU4MvYGpltQVHfduG26yw3qBcXQ3015iopretuY2mwopUgTT8vG2A
x-booking-et-serialized-state: EdP1GYNGnWAwMrXUEYm38CMF0pKZxztulorvpluNXHYPSheITT-vfqFov3cXmLSVw
x-booking-site-type-id: 1
accept-language: zh-SG,zh;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
content-type: application/json
x-booking-pageview-id: b27b1fec2c7b0031
accept: */*
x-booking-topic: capla_browser_b-attractions-product-frontend-capla
Referer: https://www.booking.com/attractions/index.fr.html?aid=2256042&emk=TRVYG5VXY1&emkcid=815&checkin=2022-06-23&checkout=2022-06-24&selected_currency=EUR&label=56202_usp-03_v2-
x-booking-context-action-name: attractions_index

Response headers

date: Sun, 25 Jun 2023 04:32:27 GMT
content-encoding: br
via: 1.1 4051cd1127320e383387d289cc46a5fc.cloudfront.net (CloudFront)
strict-transport-security: max-age=300; includeSubDomains
x-content-options: nosniff
server: nginx
x-amz-cf-pop: SIN52-P1
vary: Accept-Encoding, User-Agent
content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=72b21fedb21d0094&e=UmFuZG9tSVYkc2RlIyh9YQyOc33qmp8WHR7A8UUx6hbHIfwfMgQDGRI0jgvLXME_ydi53-Eos9A8_JALaUf1Pw
content-type: application/json; charset=UTF-8
x-cache: Miss from cloudfront
content-length: 90
x-xss-protection: 1; mode=block
x-amz-cf-id: Mi0aiEAi8dSdtDLcQJeUwEDyJswzD4reLQ7hQcf6867GIS412YZw_g==

POST
H2 204 anon_session_init Show response
account.booking.com/collector/ 0
2 KB 261ms
260ms XHR
text/plain 13.227.254.42
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://account.booking.com/collector/anon_session_init

Requested by

Host: account.booking.com
URL: https://account.booking.com/static/booking-sso.v1.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.227.254.42 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-227-254-42.sin52.r.cloudfront.net

Software

envoy /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://*.booking.com 'self'; report-uri https://nellie.booking.com/csp-report-uri?type=block&tag=212&pid=0a271fee079c01d0&e=UmFuZG9tSVYkc2RlIyh9YSWKtKO5TxgOpTwVTPfHZKNW3Hcrm1RLgTDT2V-m21UMdbC_b9IesoHYup-AC0nelvqgPHcBnofAqt2SY5ZSxNbVqJQeKAmLH0L5sda2rluvzqrcurLtY0C-a6Q_RRXkYO0_Gfk0RDMFb3G-Vc5ChnA
Strict-Transport-Security	max-age=300; includeSubDomains
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.booking.com/
accept-language: zh-SG,zh;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type: application/json

Response headers

date: Sun, 25 Jun 2023 04:32:28 GMT
content-security-policy: frame-ancestors https://*.booking.com 'self'; report-uri https://nellie.booking.com/csp-report-uri?type=block&tag=212&pid=0a271fee079c01d0&e=UmFuZG9tSVYkc2RlIyh9YSWKtKO5TxgOpTwVTPfHZKNW3Hcrm1RLgTDT2V-m21UMdbC_b9IesoHYup-AC0nelvqgPHcBnofAqt2SY5ZSxNbVqJQeKAmLH0L5sda2rluvzqrcurLtY0C-a6Q_RRXkYO0_Gfk0RDMFb3G-Vc5ChnA
via: 1.1 ce37b125bad795f4918cd50b3f95260a.cloudfront.net (CloudFront)
strict-transport-security: max-age=300; includeSubDomains
server: envoy
x-amz-cf-pop: SIN52-C3
access-control-max-age: 1728000
access-control-allow-methods: POST
x-cache: Miss from cloudfront
access-control-allow-origin: https://www.booking.com
content-security-policy-report-only: base-uri 'none'; connect-src saa.booking.com secure.booking.com reports.booking.com privacyportal-eu.onetrust.com geolocation.onetrust.com cdn.cookielaw.org www.google-analytics.com *.perimeterx.net *.pxchk.net *.px-cdn.net *.px-client.net *.px-cloud.net 'self' 'report-sample'; default-src *.bstatic.com bstatic.com 'self'; frame-src https://www.youtube.com/embed/Vv4w5SmRkss *.bstatic.com https://www.google.com bstatic.com www.booking.com secure.booking.com paymentcomponent.booking.com 'self'; img-src 'self' data: www.booking.com graph.facebook.com cdn.cookielaw.org account.booking.com *.bstatic.com bstatic.com *.static.booking.cn www.google-analytics.com www.google.com stats.g.doubleclick.net *.px-cloud.net *.perimeterx.net www.gstatic.com; object-src 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=213&pid=0a271fee079c01d0&e=UmFuZG9tSVYkc2RlIyh9YSWKtKO5TxgOpTwVTPfHZKNW3Hcrm1RLgTDT2V-m21UMdbC_b9IesoHYup-AC0nelvqgPHcBnofAqt2SY5ZSxNbVqJQeKAmLH0L5sda2rluvzqrcurLtY0C-a6Q_RRXkYO0_Gfk0RDMFb3G-Vc5ChnA; script-src saa.booking.com *.bstatic.com bstatic.com *.static.booking.cn www.google.com www.google-analytics.com cdn.cookielaw.org geolocation.onetrust.com 'self' 'nonce-2nv8jxE5vGu3Zl5' 'report-sample'; style-src *.bstatic.com bstatic.com *.static.booking.cn 'self' 'unsafe-inline'
access-control-allow-credentials: true
access-control-allow-headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range
x-amz-cf-id: BWbKLszuU3M9IIDCPIDxq_3Nkapra7HUWsWzcpM9MDxwE-3E1-DNVw==
x-xss-protection: 1; mode=block

OPTIONS
H2 204 anon_session_init
account.booking.com/collector/ Frame 0
0 235ms
234ms Preflight 13.227.254.42
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://account.booking.com/collector/anon_session_init

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.227.254.42 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-227-254-42.sin52.r.cloudfront.net

Software

envoy /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://*.booking.com 'self'; report-uri https://nellie.booking.com/csp-report-uri?type=block&tag=212&pid=1ec61fed16380c25&e=UmFuZG9tSVYkc2RlIyh9YSWKtKO5TxgOpTwVTPfHZKNW3Hcrm1RLgTDT2V-m21UMdbC_b9IesoHYup-AC0nelpES1qqE6fifR5JViA8Go4CwOe8yYFSeDLiZ1Uua75nNAdVKxHFsDKycMdj0Viywr657cSL-rDfamxuKcnC2-Tw
Strict-Transport-Security	max-age=300; includeSubDomains
X-Xss-Protection	1; mode=block

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://www.booking.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: content-type
access-control-allow-methods: POST
access-control-allow-origin: https://www.booking.com
access-control-max-age: 1728000
content-security-policy: frame-ancestors https://*.booking.com 'self'; report-uri https://nellie.booking.com/csp-report-uri?type=block&tag=212&pid=1ec61fed16380c25&e=UmFuZG9tSVYkc2RlIyh9YSWKtKO5TxgOpTwVTPfHZKNW3Hcrm1RLgTDT2V-m21UMdbC_b9IesoHYup-AC0nelpES1qqE6fifR5JViA8Go4CwOe8yYFSeDLiZ1Uua75nNAdVKxHFsDKycMdj0Viywr657cSL-rDfamxuKcnC2-Tw
content-security-policy-report-only: base-uri 'none'; connect-src saa.booking.com secure.booking.com reports.booking.com privacyportal-eu.onetrust.com geolocation.onetrust.com cdn.cookielaw.org www.google-analytics.com *.perimeterx.net *.pxchk.net *.px-cdn.net *.px-client.net *.px-cloud.net 'self' 'report-sample'; default-src *.bstatic.com bstatic.com 'self'; frame-src https://www.youtube.com/embed/Vv4w5SmRkss *.bstatic.com https://www.google.com bstatic.com www.booking.com secure.booking.com paymentcomponent.booking.com 'self'; img-src 'self' data: www.booking.com graph.facebook.com cdn.cookielaw.org account.booking.com *.bstatic.com bstatic.com *.static.booking.cn www.google-analytics.com www.google.com stats.g.doubleclick.net *.px-cloud.net *.perimeterx.net www.gstatic.com; object-src 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=213&pid=1ec61fed16380c25&e=UmFuZG9tSVYkc2RlIyh9YSWKtKO5TxgOpTwVTPfHZKNW3Hcrm1RLgTDT2V-m21UMdbC_b9IesoHYup-AC0nelpES1qqE6fifR5JViA8Go4CwOe8yYFSeDLiZ1Uua75nNAdVKxHFsDKycMdj0Viywr657cSL-rDfamxuKcnC2-Tw; script-src saa.booking.com *.bstatic.com bstatic.com *.static.booking.cn www.google.com www.google-analytics.com cdn.cookielaw.org geolocation.onetrust.com 'self' 'nonce-Q3qOEhGG7xtyMcD' 'report-sample'; style-src *.bstatic.com bstatic.com *.static.booking.cn 'self' 'unsafe-inline'
date: Sun, 25 Jun 2023 04:32:28 GMT
server: envoy
strict-transport-security: max-age=300; includeSubDomains
via: 1.1 d19f6de4de1eb10d5b27d86de6b4a7d4.cloudfront.net (CloudFront)
x-amz-cf-id: sVZ-6DmGHxBh7LqbIuY-GiVQijH9ss8npyWAJ-SyCCAAszrrzfddOA==
x-amz-cf-pop: SIN52-C3
x-cache: Miss from cloudfront
x-xss-protection: 1; mode=block

POST
H2 202 navigation_times Show response
www.booking.com/ 0
747 B 241ms
241ms XHR
image/jpeg 18.155.68.14
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://www.booking.com/navigation_times?sid=4d5b6628cd255c86bff42f20db502482&pid=b27b1fec2c7b0031&nts=0,0,1687667545225,0,0,0,0,1687667545603,1687667545604,1687667545604,1687667545604,1687667545615,1687667545608,1687667545615,1687667546196,1687667546198,1687667546199,1687667546285,1687667546533,1687667546534,1687667547886,1687667547887,1687667547887,0&first=1&cdn=cf&dc=36&bo=20&lang=fr&ref_action=attractions_index&aid=2256042&stype=1&route=&ua=17&ch=&lt=&css_load=0&wn=1

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.155.68.14 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-155-68-14.sin52.r.cloudfront.net

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=300; includeSubDomains
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.booking.com/attractions/index.fr.html?aid=2256042&emk=TRVYG5VXY1&emkcid=815&checkin=2022-06-23&checkout=2022-06-24&selected_currency=EUR&label=56202_usp-03_v2-
X-Booking-CSRF: mfuXZAAAAAA=GCfY5R1iw3__fSFQS1nyg8odWRWv3HaZIcnWC-PQ9OZ_2aGX6mJaD_o7Z9Sbex44cV9JFqZQpWJVC-EEhhHMWe5xGHADs8fUIsXDjbyaOuTOal_i7PVqD0TS0RyLhJ3MNeMmpkqBDfx0IyhP0Jx0hthRb9V6Inz6LasD7rdC-I2O5vf444DDeYcIKt6twsRL1UAEunOUE7TiOiUU
accept-language: zh-SG,zh;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.133 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

date: Sun, 25 Jun 2023 04:32:29 GMT
strict-transport-security: max-age=300; includeSubDomains
via: 1.1 4051cd1127320e383387d289cc46a5fc.cloudfront.net (CloudFront)
x-content-options: nosniff
server: nginx
x-amz-cf-pop: SIN52-P1
content-security-policy-report-only: frame-ancestors 'none'; report-uri https://nellie.booking.com/csp-report-uri?type=report&tag=112&pid=c3d51fee57460075&e=UmFuZG9tSVYkc2RlIyh9YfnWSDpdIwKzDzbKZoiCiJu6Vf8s9LXvCX874BzMq2G69BZN4EOrDN0
x-cache: Miss from cloudfront
content-type: image/jpeg
content-length: 0
x-xss-protection: 1; mode=block
x-amz-cf-id: BYsO1JfwacIE9hEELAAEGJ_CHAi6jfyneF1r4kbCoEsew1n5OMp5dw==

Verdicts & Comments Add Verdict or Comment

26 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

17 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.booking.com/	1970-01-20 22:23:47	Name: _ga Value: GA1.2.1286877469.1687667547
.booking.com/	1970-01-20 12:49:13	Name: _gid Value: GA1.2.152291588.1687667547
.booking.com/	1970-01-20 12:47:47	Name: _gat Value: 1
.booking.com/	1970-01-20 12:49:13	Name: _uetsid Value: 499f70d0131111eeaa09f7ad008dc91b
.booking.com/	1970-01-20 22:09:23	Name: _uetvid Value: 499f9b50131111ee82bf0be0866b6e7c
.bing.com/	1970-01-20 22:09:23	Name: MUID Value: 114583AE42576EF933FD909543566F4B
.bat.bing.com/	1970-01-20 12:57:52	Name: MR Value: 0
.booking.com/	1970-01-20 22:23:47	Name: bkng_sso_session Value: e30
.booking.com/	1970-01-20 12:57:52	Name: pcm_consent Value: consentedAt%3D2023-06-25T04%3A32%3A26.892Z%26countryCode%3DSG%26expiresAt%3D2023-12-22T04%3A32%3A26.892Z%26implicit%3Dfalse%26regulation%3Dnone%26legacyRegulation%3Dnone%26consentId%3D00000000-0000-0000-0000-000000000000%26analytical%3Dfalse%26marketing%3Dfalse
.booking.com/	1970-01-20 12:57:52	Name: bkng_sso_auth Value: CAIQsOnuTRqEAUaFiQOSht5unqUsB8mJ0p1b3GFF7EUW7iFXod248mncfZbhDxLhyG2gNZ6dEPDLMFHwB3s7Pj62/3MtVF6TKAvwDxJU3RUCBmi3sRp5A82u69sHE9rtUki2fOcJFy/0l+94JI55EtFy8NoPNTmssIoTZ92VKdaVwiuSsvRVeCL00S+gQA==
.booking.com/	1970-01-20 12:57:52	Name: bkng_sso_auth_1687667546 Value: CAIQsOnuTRqEAUaFiQOSht5unqUsB8mJ0p1b3GFF7EUW7iFXod248mncfZbhDxLhyG2gNZ6dEPDLMFHwB3s7Pj62/3MtVF6TKAvwDxJU3RUCBmi3sRp5A82u69sHE9rtUki2fOcJFy/0l+94JI55EtFy8NoPNTmssIoTZ92VKdaVwiuSsvRVeCL00S+gQA==
.www.booking.com/	1970-01-20 21:33:23	Name: OptanonConsent Value: implicitConsentCountry=nonGDPR&implicitConsentDate=1687667547594
.booking.com/	1970-01-20 21:33:23	Name: _pxhd Value: aUztBd%252FrUiFKnQJcW6Q03pVIF8709Lmj0Md2JbUb7MvdbNOBYkysahHXzo1gZrT3tpx9iGFoyATeH3d-VVwFrQ%253D%253D%253AUtc1vqegUDDuKmTVkMNvEejLe8QvlJxjb%252FWChtTNgYBx3l8%252FfjZYrVQAj6pP6dInI8kJzq8bGW%252F3cWeLNt4RAABPHYGP46aMNsQyX-nHw60%253D
.booking.com/	1970-01-20 22:23:47	Name: px_init Value: 100
.account.booking.com/	1970-01-20 22:23:47	Name: bkng_ap_sso_session Value: eyJib29raW5nX2dsb2JhbCI6eyJkYXRhX3N1YmplY3RfaWQiOiJjYWVmNzMxOS1lNjFmLTRiZGUtYjQ5NS1hZTk4ZjcyOTcwZTIiLCJzZXNzaW9ucyI6W3sicmVmcmVzaF90b2tlbiI6IkNBRVNkMUoxRzVPaDVfM0xaTWo4UHh4MHlBNk1HakVHZmkybjItNlQ3dUd3U0JFUnFSZEltUE5HdEY1dnhldFZuRnpqdE1kbEF0MXBLRnhLTmpVb05taG1NYVlfZUw3TDZuelh2Z0lYOThYRk9YOXo5a0hFakxmMnJRYWFUTXlNMC1OUW16NWlvRmNnOFg0T1RCM1hFWk96c2pQWk9LR3o5WEFXIiwic2Vzc2lvbl9yZWZlcmVuY2UiOiJlZTExNDdhNS05ZTM0LTRiY2UtODhiYi03YjVlYmFlYTM0MDUifV19fQ
.booking.com/	1970-01-20 22:23:47	Name: bkng_sso_ses Value: eyJib29raW5nX2dsb2JhbCI6W3siaCI6IkNKUHdSODdaZEUwMmdnOWVreUo4RDJwMmhxU1g1N01VeXE1SlRIRGlNQU0iLCJhIjoxfV19
.booking.com/	1970-01-20 22:23:47	Name: bkng Value: 11UmFuZG9tSVYkc2RlIyh9Yaa29%2F3xUOLbof7CEiNviT92ODqPm%2FRjEITRN6n3xhOPzts%2F%2Fb1tlG%2FIL79V0cO%2FhQCMVccNpGX9aU2b5821GR%2Bsbz47BLkQoDodcWEFA8VJ521QtnVtLavHfw0s52964CKOqEt2rb3DFr6AaJVlEmsxnq5dtDVGpS5LeWwgZ8GcTPwowbCKBtA%3D

227 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
security	error	(Line 6) Message: [Report Only] Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'self' 'unsafe-inline' .booking.com: .bstatic.com cdn.cookielaw.org bat.bing.com googleads.g.doubleclick.net .googletagmanager.com .google-analytics.com .googleadservices.com .googleapis.com .onetrust.com".
security	error	(Line 6) Message: [Report Only] Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'self' 'unsafe-inline' .booking.com: .bstatic.com cdn.cookielaw.org bat.bing.com googleads.g.doubleclick.net .googletagmanager.com .google-analytics.com .googleadservices.com .googleapis.com .onetrust.com".
security	error	(Line 6) Message: [Report Only] Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'self' 'unsafe-inline' .booking.com: .bstatic.com cdn.cookielaw.org bat.bing.com googleads.g.doubleclick.net .googletagmanager.com .google-analytics.com .googleadservices.com .googleapis.com .onetrust.com".
security	error	(Line 6) Message: [Report Only] Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'self' 'unsafe-inline' .booking.com: .bstatic.com cdn.cookielaw.org bat.bing.com googleads.g.doubleclick.net .googletagmanager.com .google-analytics.com .googleadservices.com .googleapis.com .onetrust.com".
security	error	(Line 6) Message: [Report Only] Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'self' 'unsafe-inline' .booking.com: .bstatic.com cdn.cookielaw.org bat.bing.com googleads.g.doubleclick.net .googletagmanager.com .google-analytics.com .googleadservices.com .googleapis.com .onetrust.com".
security	error	(Line 6) Message: [Report Only] Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'self' 'unsafe-inline' .booking.com: .bstatic.com cdn.cookielaw.org bat.bing.com googleads.g.doubleclick.net .googletagmanager.com .google-analytics.com .googleadservices.com .googleapis.com .onetrust.com".
security	error	(Line 6) Message: [Report Only] Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'self' 'unsafe-inline' .booking.com: .bstatic.com cdn.cookielaw.org bat.bing.com googleads.g.doubleclick.net .googletagmanager.com .google-analytics.com .googleadservices.com .googleapis.com .onetrust.com".
security	error	(Line 6) Message: [Report Only] Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'self' 'unsafe-inline' .booking.com: .bstatic.com cdn.cookielaw.org bat.bing.com googleads.g.doubleclick.net .googletagmanager.com .google-analytics.com .googleadservices.com .googleapis.com .onetrust.com".
security	error	(Line 6) Message: [Report Only] Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'self' 'unsafe-inline' .booking.com: .bstatic.com cdn.cookielaw.org bat.bing.com googleads.g.doubleclick.net .googletagmanager.com .google-analytics.com .googleadservices.com .googleapis.com .onetrust.com".
security	error	(Line 6) Message: [Report Only] Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'self' 'unsafe-inline' .booking.com: .bstatic.com cdn.cookielaw.org bat.bing.com googleads.g.doubleclick.net .googletagmanager.com .google-analytics.com .googleadservices.com .googleapis.com .onetrust.com".
security	error	(Line 6) Message: [Report Only] Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'self' 'unsafe-inline' .booking.com: .bstatic.com cdn.cookielaw.org bat.bing.com googleads.g.doubleclick.net .googletagmanager.com .google-analytics.com .googleadservices.com .googleapis.com .onetrust.com".
security	error	(Line 6) Message: [Report Only] Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'self' 'unsafe-inline' .booking.com: .bstatic.com cdn.cookielaw.org bat.bing.com googleads.g.doubleclick.net .googletagmanager.com .google-analytics.com .googleadservices.com .googleapis.com .onetrust.com".
security	error	(Line 6) Message: [Report Only] Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'self' 'unsafe-inline' .booking.com: .bstatic.com cdn.cookielaw.org bat.bing.com googleads.g.doubleclick.net .googletagmanager.com .google-analytics.com .googleadservices.com .googleapis.com .onetrust.com".
security	error	(Line 6) Message: [Report Only] Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'self' 'unsafe-inline' .booking.com: .bstatic.com cdn.cookielaw.org bat.bing.com googleads.g.doubleclick.net .googletagmanager.com .google-analytics.com .googleadservices.com .googleapis.com .onetrust.com".
security	error	(Line 6) Message: [Report Only] Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'self' 'unsafe-inline' .booking.com: .bstatic.com cdn.cookielaw.org bat.bing.com googleads.g.doubleclick.net .googletagmanager.com .google-analytics.com .googleadservices.com .googleapis.com .onetrust.com".
security	error	(Line 6) Message: [Report Only] Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'self' 'unsafe-inline' .booking.com: .bstatic.com cdn.cookielaw.org bat.bing.com googleads.g.doubleclick.net .googletagmanager.com .google-analytics.com .googleadservices.com .googleapis.com .onetrust.com".
security	error	(Line 6) Message: [Report Only] Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'self' 'unsafe-inline' .booking.com: .bstatic.com cdn.cookielaw.org bat.bing.com googleads.g.doubleclick.net .googletagmanager.com .google-analytics.com .googleadservices.com .googleapis.com .onetrust.com".
security	error	(Line 6) Message: [Report Only] Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'self' 'unsafe-inline' .booking.com: .bstatic.com cdn.cookielaw.org bat.bing.com googleads.g.doubleclick.net .googletagmanager.com .google-analytics.com .googleadservices.com .googleapis.com .onetrust.com".
security	error	(Line 6) Message: [Report Only] Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'self' 'unsafe-inline' .booking.com: .bstatic.com cdn.cookielaw.org bat.bing.com googleads.g.doubleclick.net .googletagmanager.com .google-analytics.com .googleadservices.com .googleapis.com .onetrust.com".
security	error	(Line 6) Message: [Report Only] Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'self' 'unsafe-inline' .booking.com: .bstatic.com cdn.cookielaw.org bat.bing.com googleads.g.doubleclick.net .googletagmanager.com .google-analytics.com .googleadservices.com .googleapis.com .onetrust.com".
security	error	(Line 6) Message: [Report Only] Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'self' 'unsafe-inline' .booking.com: .bstatic.com cdn.cookielaw.org bat.bing.com googleads.g.doubleclick.net .googletagmanager.com .google-analytics.com .googleadservices.com .googleapis.com .onetrust.com".
security	error	(Line 6) Message: [Report Only] Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'self' 'unsafe-inline' .booking.com: .bstatic.com cdn.cookielaw.org bat.bing.com googleads.g.doubleclick.net .googletagmanager.com .google-analytics.com .googleadservices.com .googleapis.com .onetrust.com".
security	error	(Line 6) Message: [Report Only] Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'self' 'unsafe-inline' .booking.com: .bstatic.com cdn.cookielaw.org bat.bing.com googleads.g.doubleclick.net .googletagmanager.com .google-analytics.com .googleadservices.com .googleapis.com .onetrust.com".
security	error	(Line 6) Message: [Report Only] Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'self' 'unsafe-inline' .booking.com: .bstatic.com cdn.cookielaw.org bat.bing.com googleads.g.doubleclick.net .googletagmanager.com .google-analytics.com .googleadservices.com .googleapis.com .onetrust.com".
security	error	(Line 6) Message: [Report Only] Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'self' 'unsafe-inline' .booking.com: .bstatic.com cdn.cookielaw.org bat.bing.com googleads.g.doubleclick.net .googletagmanager.com .google-analytics.com .googleadservices.com .googleapis.com .onetrust.com".
security	error	(Line 6) Message: [Report Only] Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'self' 'unsafe-inline' .booking.com: .bstatic.com cdn.cookielaw.org bat.bing.com googleads.g.doubleclick.net .googletagmanager.com .google-analytics.com .googleadservices.com .googleapis.com .onetrust.com".
security	error	(Line 6) Message: [Report Only] Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'self' 'unsafe-inline' .booking.com: .bstatic.com cdn.cookielaw.org bat.bing.com googleads.g.doubleclick.net .googletagmanager.com .google-analytics.com .googleadservices.com .googleapis.com .onetrust.com".
security	error	(Line 6) Message: [Report Only] Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'self' 'unsafe-inline' .booking.com: .bstatic.com cdn.cookielaw.org bat.bing.com googleads.g.doubleclick.net .googletagmanager.com .google-analytics.com .googleadservices.com .googleapis.com .onetrust.com".
security	error	(Line 6) Message: [Report Only] Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'self' 'unsafe-inline' .booking.com: .bstatic.com cdn.cookielaw.org bat.bing.com googleads.g.doubleclick.net .googletagmanager.com .google-analytics.com .googleadservices.com .googleapis.com .onetrust.com".
security	error	(Line 6) Message: [Report Only] Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'self' 'unsafe-inline' .booking.com: .bstatic.com cdn.cookielaw.org bat.bing.com googleads.g.doubleclick.net .googletagmanager.com .google-analytics.com .googleadservices.com .googleapis.com .onetrust.com".
security	error	(Line 6) Message: [Report Only] Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'self' 'unsafe-inline' .booking.com: .bstatic.com cdn.cookielaw.org bat.bing.com googleads.g.doubleclick.net .googletagmanager.com .google-analytics.com .googleadservices.com .googleapis.com .onetrust.com".
security	error	(Line 6) Message: [Report Only] Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'self' 'unsafe-inline' .booking.com: .bstatic.com cdn.cookielaw.org bat.bing.com googleads.g.doubleclick.net .googletagmanager.com .google-analytics.com .googleadservices.com .googleapis.com .onetrust.com".
security	error	(Line 6) Message: [Report Only] Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'self' 'unsafe-inline' .booking.com: .bstatic.com cdn.cookielaw.org bat.bing.com googleads.g.doubleclick.net .googletagmanager.com .google-analytics.com .googleadservices.com .googleapis.com .onetrust.com".
security	error	(Line 6) Message: [Report Only] Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'self' 'unsafe-inline' .booking.com: .bstatic.com cdn.cookielaw.org bat.bing.com googleads.g.doubleclick.net .googletagmanager.com .google-analytics.com .googleadservices.com .googleapis.com .onetrust.com".
security	error	(Line 6) Message: [Report Only] Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'self' 'unsafe-inline' .booking.com: .bstatic.com cdn.cookielaw.org bat.bing.com googleads.g.doubleclick.net .googletagmanager.com .google-analytics.com .googleadservices.com .googleapis.com .onetrust.com".
security	error	(Line 6) Message: [Report Only] Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'self' 'unsafe-inline' .booking.com: .bstatic.com cdn.cookielaw.org bat.bing.com googleads.g.doubleclick.net .googletagmanager.com .google-analytics.com .googleadservices.com .googleapis.com .onetrust.com".
security	error	(Line 6) Message: [Report Only] Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'self' 'unsafe-inline' .booking.com: .bstatic.com cdn.cookielaw.org bat.bing.com googleads.g.doubleclick.net .googletagmanager.com .google-analytics.com .googleadservices.com .googleapis.com .onetrust.com".
security	error	(Line 6) Message: [Report Only] Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'self' 'unsafe-inline' .booking.com: .bstatic.com cdn.cookielaw.org bat.bing.com googleads.g.doubleclick.net .googletagmanager.com .google-analytics.com .googleadservices.com .googleapis.com .onetrust.com".
security	error	(Line 6) Message: [Report Only] Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'self' 'unsafe-inline' .booking.com: .bstatic.com cdn.cookielaw.org bat.bing.com googleads.g.doubleclick.net .googletagmanager.com .google-analytics.com .googleadservices.com .googleapis.com .onetrust.com".
security	error	(Line 6) Message: [Report Only] Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'self' 'unsafe-inline' .booking.com: .bstatic.com cdn.cookielaw.org bat.bing.com googleads.g.doubleclick.net .googletagmanager.com .google-analytics.com .googleadservices.com .googleapis.com .onetrust.com".
security	error	(Line 6) Message: [Report Only] Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'self' 'unsafe-inline' .booking.com: .bstatic.com cdn.cookielaw.org bat.bing.com googleads.g.doubleclick.net .googletagmanager.com .google-analytics.com .googleadservices.com .googleapis.com .onetrust.com".
security	error	(Line 6) Message: [Report Only] Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'self' 'unsafe-inline' .booking.com: .bstatic.com cdn.cookielaw.org bat.bing.com googleads.g.doubleclick.net .googletagmanager.com .google-analytics.com .googleadservices.com .googleapis.com .onetrust.com".
security	error	(Line 6) Message: [Report Only] Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'self' 'unsafe-inline' .booking.com: .bstatic.com cdn.cookielaw.org bat.bing.com googleads.g.doubleclick.net .googletagmanager.com .google-analytics.com .googleadservices.com .googleapis.com .onetrust.com".
security	error	(Line 6) Message: [Report Only] Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'self' 'unsafe-inline' .booking.com: .bstatic.com cdn.cookielaw.org bat.bing.com googleads.g.doubleclick.net .googletagmanager.com .google-analytics.com .googleadservices.com .googleapis.com .onetrust.com".
security	error	(Line 6) Message: [Report Only] Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'self' 'unsafe-inline' .booking.com: .bstatic.com cdn.cookielaw.org bat.bing.com googleads.g.doubleclick.net .googletagmanager.com .google-analytics.com .googleadservices.com .googleapis.com .onetrust.com".
security	error	(Line 6) Message: [Report Only] Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'self' 'unsafe-inline' .booking.com: .bstatic.com cdn.cookielaw.org bat.bing.com googleads.g.doubleclick.net .googletagmanager.com .google-analytics.com .googleadservices.com .googleapis.com .onetrust.com".
security	error	(Line 6) Message: [Report Only] Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'self' 'unsafe-inline' .booking.com: .bstatic.com cdn.cookielaw.org bat.bing.com googleads.g.doubleclick.net .googletagmanager.com .google-analytics.com .googleadservices.com .googleapis.com .onetrust.com".
security	error	(Line 6) Message: [Report Only] Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'self' 'unsafe-inline' .booking.com: .bstatic.com cdn.cookielaw.org bat.bing.com googleads.g.doubleclick.net .googletagmanager.com .google-analytics.com .googleadservices.com .googleapis.com .onetrust.com".
security	error	(Line 6) Message: [Report Only] Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'self' 'unsafe-inline' .booking.com: .bstatic.com cdn.cookielaw.org bat.bing.com googleads.g.doubleclick.net .googletagmanager.com .google-analytics.com .googleadservices.com .googleapis.com .onetrust.com".
security	error	(Line 6) Message: [Report Only] Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'self' 'unsafe-inline' .booking.com: .bstatic.com cdn.cookielaw.org bat.bing.com googleads.g.doubleclick.net .googletagmanager.com .google-analytics.com .googleadservices.com .googleapis.com .onetrust.com".
security	error	(Line 6) Message: [Report Only] Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'self' 'unsafe-inline' .booking.com: .bstatic.com cdn.cookielaw.org bat.bing.com googleads.g.doubleclick.net .googletagmanager.com .google-analytics.com .googleadservices.com .googleapis.com .onetrust.com".
security	error	(Line 6) Message: [Report Only] Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'self' 'unsafe-inline' .booking.com: .bstatic.com cdn.cookielaw.org bat.bing.com googleads.g.doubleclick.net .googletagmanager.com .google-analytics.com .googleadservices.com .googleapis.com .onetrust.com".
security	error	(Line 6) Message: [Report Only] Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'self' 'unsafe-inline' .booking.com: .bstatic.com cdn.cookielaw.org bat.bing.com googleads.g.doubleclick.net .googletagmanager.com .google-analytics.com .googleadservices.com .googleapis.com .onetrust.com".
security	error	(Line 6) Message: [Report Only] Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'self' 'unsafe-inline' .booking.com: .bstatic.com cdn.cookielaw.org bat.bing.com googleads.g.doubleclick.net .googletagmanager.com .google-analytics.com .googleadservices.com .googleapis.com .onetrust.com".
security	error	(Line 6) Message: [Report Only] Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'self' 'unsafe-inline' .booking.com: .bstatic.com cdn.cookielaw.org bat.bing.com googleads.g.doubleclick.net .googletagmanager.com .google-analytics.com .googleadservices.com .googleapis.com .onetrust.com".
security	error	(Line 6) Message: [Report Only] Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'self' 'unsafe-inline' .booking.com: .bstatic.com cdn.cookielaw.org bat.bing.com googleads.g.doubleclick.net .googletagmanager.com .google-analytics.com .googleadservices.com .googleapis.com .onetrust.com".
security	error	(Line 6) Message: [Report Only] Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'self' 'unsafe-inline' .booking.com: .bstatic.com cdn.cookielaw.org bat.bing.com googleads.g.doubleclick.net .googletagmanager.com .google-analytics.com .googleadservices.com .googleapis.com .onetrust.com".
security	error	(Line 6) Message: [Report Only] Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'self' 'unsafe-inline' .booking.com: .bstatic.com cdn.cookielaw.org bat.bing.com googleads.g.doubleclick.net .googletagmanager.com .google-analytics.com .googleadservices.com .googleapis.com .onetrust.com".
security	error	(Line 6) Message: [Report Only] Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'self' 'unsafe-inline' .booking.com: .bstatic.com cdn.cookielaw.org bat.bing.com googleads.g.doubleclick.net .googletagmanager.com .google-analytics.com .googleadservices.com .googleapis.com .onetrust.com".
security	error	(Line 6) Message: [Report Only] Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'self' 'unsafe-inline' .booking.com: .bstatic.com cdn.cookielaw.org bat.bing.com googleads.g.doubleclick.net .googletagmanager.com .google-analytics.com .googleadservices.com .googleapis.com .onetrust.com".
security	error	(Line 6) Message: [Report Only] Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'self' 'unsafe-inline' .booking.com: .bstatic.com cdn.cookielaw.org bat.bing.com googleads.g.doubleclick.net .googletagmanager.com .google-analytics.com .googleadservices.com .googleapis.com .onetrust.com".
security	error	(Line 6) Message: [Report Only] Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'self' 'unsafe-inline' .booking.com: .bstatic.com cdn.cookielaw.org bat.bing.com googleads.g.doubleclick.net .googletagmanager.com .google-analytics.com .googleadservices.com .googleapis.com .onetrust.com".
security	error	(Line 6) Message: [Report Only] Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'self' 'unsafe-inline' .booking.com: .bstatic.com cdn.cookielaw.org bat.bing.com googleads.g.doubleclick.net .googletagmanager.com .google-analytics.com .googleadservices.com .googleapis.com .onetrust.com".
security	error	(Line 6) Message: [Report Only] Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'self' 'unsafe-inline' .booking.com: .bstatic.com cdn.cookielaw.org bat.bing.com googleads.g.doubleclick.net .googletagmanager.com .google-analytics.com .googleadservices.com .googleapis.com .onetrust.com".
security	error	(Line 6) Message: [Report Only] Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'self' 'unsafe-inline' .booking.com: .bstatic.com cdn.cookielaw.org bat.bing.com googleads.g.doubleclick.net .googletagmanager.com .google-analytics.com .googleadservices.com .googleapis.com .onetrust.com".
security	error	(Line 6) Message: [Report Only] Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'self' 'unsafe-inline' .booking.com: .bstatic.com cdn.cookielaw.org bat.bing.com googleads.g.doubleclick.net .googletagmanager.com .google-analytics.com .googleadservices.com .googleapis.com .onetrust.com".
security	error	(Line 6) Message: [Report Only] Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'self' 'unsafe-inline' .booking.com: .bstatic.com cdn.cookielaw.org bat.bing.com googleads.g.doubleclick.net .googletagmanager.com .google-analytics.com .googleadservices.com .googleapis.com .onetrust.com".
security	error	(Line 6) Message: [Report Only] Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'self' 'unsafe-inline' .booking.com: .bstatic.com cdn.cookielaw.org bat.bing.com googleads.g.doubleclick.net .googletagmanager.com .google-analytics.com .googleadservices.com .googleapis.com .onetrust.com".
security	error	(Line 6) Message: [Report Only] Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'self' 'unsafe-inline' .booking.com: .bstatic.com cdn.cookielaw.org bat.bing.com googleads.g.doubleclick.net .googletagmanager.com .google-analytics.com .googleadservices.com .googleapis.com .onetrust.com".
security	error	(Line 6) Message: [Report Only] Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'self' 'unsafe-inline' .booking.com: .bstatic.com cdn.cookielaw.org bat.bing.com googleads.g.doubleclick.net .googletagmanager.com .google-analytics.com .googleadservices.com .googleapis.com .onetrust.com".
security	error	(Line 6) Message: [Report Only] Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'self' 'unsafe-inline' .booking.com: .bstatic.com cdn.cookielaw.org bat.bing.com googleads.g.doubleclick.net .googletagmanager.com .google-analytics.com .googleadservices.com .googleapis.com .onetrust.com".
security	error	(Line 6) Message: [Report Only] Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'self' 'unsafe-inline' .booking.com: .bstatic.com cdn.cookielaw.org bat.bing.com googleads.g.doubleclick.net .googletagmanager.com .google-analytics.com .googleadservices.com .googleapis.com .onetrust.com".
security	error	(Line 6) Message: [Report Only] Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'self' 'unsafe-inline' .booking.com: .bstatic.com cdn.cookielaw.org bat.bing.com googleads.g.doubleclick.net .googletagmanager.com .google-analytics.com .googleadservices.com .googleapis.com .onetrust.com".
security	error	(Line 6) Message: [Report Only] Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'self' 'unsafe-inline' .booking.com: .bstatic.com cdn.cookielaw.org bat.bing.com googleads.g.doubleclick.net .googletagmanager.com .google-analytics.com .googleadservices.com .googleapis.com .onetrust.com".
security	error	(Line 6) Message: [Report Only] Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'self' 'unsafe-inline' .booking.com: .bstatic.com cdn.cookielaw.org bat.bing.com googleads.g.doubleclick.net .googletagmanager.com .google-analytics.com .googleadservices.com .googleapis.com .onetrust.com".
security	error	(Line 6) Message: [Report Only] Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'self' 'unsafe-inline' .booking.com: .bstatic.com cdn.cookielaw.org bat.bing.com googleads.g.doubleclick.net .googletagmanager.com .google-analytics.com .googleadservices.com .googleapis.com .onetrust.com".
security	error	(Line 6) Message: [Report Only] Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'self' 'unsafe-inline' .booking.com: .bstatic.com cdn.cookielaw.org bat.bing.com googleads.g.doubleclick.net .googletagmanager.com .google-analytics.com .googleadservices.com .googleapis.com .onetrust.com".
security	error	(Line 6) Message: [Report Only] Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'self' 'unsafe-inline' .booking.com: .bstatic.com cdn.cookielaw.org bat.bing.com googleads.g.doubleclick.net .googletagmanager.com .google-analytics.com .googleadservices.com .googleapis.com .onetrust.com".
security	error	(Line 6) Message: [Report Only] Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'self' 'unsafe-inline' .booking.com: .bstatic.com cdn.cookielaw.org bat.bing.com googleads.g.doubleclick.net .googletagmanager.com .google-analytics.com .googleadservices.com .googleapis.com .onetrust.com".
security	error	(Line 6) Message: [Report Only] Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'self' 'unsafe-inline' .booking.com: .bstatic.com cdn.cookielaw.org bat.bing.com googleads.g.doubleclick.net .googletagmanager.com .google-analytics.com .googleadservices.com .googleapis.com .onetrust.com".
security	error	(Line 6) Message: [Report Only] Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'self' 'unsafe-inline' .booking.com: .bstatic.com cdn.cookielaw.org bat.bing.com googleads.g.doubleclick.net .googletagmanager.com .google-analytics.com .googleadservices.com .googleapis.com .onetrust.com".
security	error	(Line 6) Message: [Report Only] Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'self' 'unsafe-inline' .booking.com: .bstatic.com cdn.cookielaw.org bat.bing.com googleads.g.doubleclick.net .googletagmanager.com .google-analytics.com .googleadservices.com .googleapis.com .onetrust.com".
security	error	(Line 6) Message: [Report Only] Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'self' 'unsafe-inline' .booking.com: .bstatic.com cdn.cookielaw.org bat.bing.com googleads.g.doubleclick.net .googletagmanager.com .google-analytics.com .googleadservices.com .googleapis.com .onetrust.com".
security	error	(Line 6) Message: [Report Only] Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'self' 'unsafe-inline' .booking.com: .bstatic.com cdn.cookielaw.org bat.bing.com googleads.g.doubleclick.net .googletagmanager.com .google-analytics.com .googleadservices.com .googleapis.com .onetrust.com".
security	error	(Line 6) Message: [Report Only] Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'self' 'unsafe-inline' .booking.com: .bstatic.com cdn.cookielaw.org bat.bing.com googleads.g.doubleclick.net .googletagmanager.com .google-analytics.com .googleadservices.com .googleapis.com .onetrust.com".
security	error	(Line 6) Message: [Report Only] Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'self' 'unsafe-inline' .booking.com: .bstatic.com cdn.cookielaw.org bat.bing.com googleads.g.doubleclick.net .googletagmanager.com .google-analytics.com .googleadservices.com .googleapis.com .onetrust.com".
security	error	(Line 6) Message: [Report Only] Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'self' 'unsafe-inline' .booking.com: .bstatic.com cdn.cookielaw.org bat.bing.com googleads.g.doubleclick.net .googletagmanager.com .google-analytics.com .googleadservices.com .googleapis.com .onetrust.com".
security	error	(Line 6) Message: [Report Only] Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'self' 'unsafe-inline' .booking.com: .bstatic.com cdn.cookielaw.org bat.bing.com googleads.g.doubleclick.net .googletagmanager.com .google-analytics.com .googleadservices.com .googleapis.com .onetrust.com".
security	error	(Line 6) Message: [Report Only] Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'self' 'unsafe-inline' .booking.com: .bstatic.com cdn.cookielaw.org bat.bing.com googleads.g.doubleclick.net .googletagmanager.com .google-analytics.com .googleadservices.com .googleapis.com .onetrust.com".
security	error	(Line 6) Message: [Report Only] Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'self' 'unsafe-inline' .booking.com: .bstatic.com cdn.cookielaw.org bat.bing.com googleads.g.doubleclick.net .googletagmanager.com .google-analytics.com .googleadservices.com .googleapis.com .onetrust.com".
security	error	(Line 6) Message: [Report Only] Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'self' 'unsafe-inline' .booking.com: .bstatic.com cdn.cookielaw.org bat.bing.com googleads.g.doubleclick.net .googletagmanager.com .google-analytics.com .googleadservices.com .googleapis.com .onetrust.com".
security	error	(Line 6) Message: [Report Only] Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'self' 'unsafe-inline' .booking.com: .bstatic.com cdn.cookielaw.org bat.bing.com googleads.g.doubleclick.net .googletagmanager.com .google-analytics.com .googleadservices.com .googleapis.com .onetrust.com".
security	error	(Line 6) Message: [Report Only] Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'self' 'unsafe-inline' .booking.com: .bstatic.com cdn.cookielaw.org bat.bing.com googleads.g.doubleclick.net .googletagmanager.com .google-analytics.com .googleadservices.com .googleapis.com .onetrust.com".
security	error	(Line 6) Message: [Report Only] Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'self' 'unsafe-inline' .booking.com: .bstatic.com cdn.cookielaw.org bat.bing.com googleads.g.doubleclick.net .googletagmanager.com .google-analytics.com .googleadservices.com .googleapis.com .onetrust.com".
security	error	(Line 6) Message: [Report Only] Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'self' 'unsafe-inline' .booking.com: .bstatic.com cdn.cookielaw.org bat.bing.com googleads.g.doubleclick.net .googletagmanager.com .google-analytics.com .googleadservices.com .googleapis.com .onetrust.com".
security	error	(Line 6) Message: [Report Only] Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'self' 'unsafe-inline' .booking.com: .bstatic.com cdn.cookielaw.org bat.bing.com googleads.g.doubleclick.net .googletagmanager.com .google-analytics.com .googleadservices.com .googleapis.com .onetrust.com".
security	error	(Line 6) Message: [Report Only] Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'self' 'unsafe-inline' .booking.com: .bstatic.com cdn.cookielaw.org bat.bing.com googleads.g.doubleclick.net .googletagmanager.com .google-analytics.com .googleadservices.com .googleapis.com .onetrust.com".
security	error	(Line 6) Message: [Report Only] Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'self' 'unsafe-inline' .booking.com: .bstatic.com cdn.cookielaw.org bat.bing.com googleads.g.doubleclick.net .googletagmanager.com .google-analytics.com .googleadservices.com .googleapis.com .onetrust.com".
security	error	(Line 6) Message: [Report Only] Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'self' 'unsafe-inline' .booking.com: .bstatic.com cdn.cookielaw.org bat.bing.com googleads.g.doubleclick.net .googletagmanager.com .google-analytics.com .googleadservices.com .googleapis.com .onetrust.com".
security	error	(Line 6) Message: [Report Only] Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'self' 'unsafe-inline' .booking.com: .bstatic.com cdn.cookielaw.org bat.bing.com googleads.g.doubleclick.net .googletagmanager.com .google-analytics.com .googleadservices.com .googleapis.com .onetrust.com".
security	error	(Line 6) Message: [Report Only] Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'self' 'unsafe-inline' .booking.com: .bstatic.com cdn.cookielaw.org bat.bing.com googleads.g.doubleclick.net .googletagmanager.com .google-analytics.com .googleadservices.com .googleapis.com .onetrust.com".
security	error	(Line 6) Message: [Report Only] Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'self' 'unsafe-inline' .booking.com: .bstatic.com cdn.cookielaw.org bat.bing.com googleads.g.doubleclick.net .googletagmanager.com .google-analytics.com .googleadservices.com .googleapis.com .onetrust.com".
security	error	(Line 6) Message: [Report Only] Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'self' 'unsafe-inline' .booking.com: .bstatic.com cdn.cookielaw.org bat.bing.com googleads.g.doubleclick.net .googletagmanager.com .google-analytics.com .googleadservices.com .googleapis.com .onetrust.com".
security	error	(Line 6) Message: [Report Only] Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'self' 'unsafe-inline' .booking.com: .bstatic.com cdn.cookielaw.org bat.bing.com googleads.g.doubleclick.net .googletagmanager.com .google-analytics.com .googleadservices.com .googleapis.com .onetrust.com".
security	error	(Line 6) Message: [Report Only] Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'self' 'unsafe-inline' .booking.com: .bstatic.com cdn.cookielaw.org bat.bing.com googleads.g.doubleclick.net .googletagmanager.com .google-analytics.com .googleadservices.com .googleapis.com .onetrust.com".
security	error	(Line 6) Message: [Report Only] Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'self' 'unsafe-inline' .booking.com: .bstatic.com cdn.cookielaw.org bat.bing.com googleads.g.doubleclick.net .googletagmanager.com .google-analytics.com .googleadservices.com .googleapis.com .onetrust.com".
security	error	(Line 6) Message: [Report Only] Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'self' 'unsafe-inline' .booking.com: .bstatic.com cdn.cookielaw.org bat.bing.com googleads.g.doubleclick.net .googletagmanager.com .google-analytics.com .googleadservices.com .googleapis.com .onetrust.com".
security	error	(Line 6) Message: [Report Only] Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'self' 'unsafe-inline' .booking.com: .bstatic.com cdn.cookielaw.org bat.bing.com googleads.g.doubleclick.net .googletagmanager.com .google-analytics.com .googleadservices.com .googleapis.com .onetrust.com".
security	error	(Line 6) Message: [Report Only] Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'self' 'unsafe-inline' .booking.com: .bstatic.com cdn.cookielaw.org bat.bing.com googleads.g.doubleclick.net .googletagmanager.com .google-analytics.com .googleadservices.com .googleapis.com .onetrust.com".
security	error	(Line 6) Message: [Report Only] Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'self' 'unsafe-inline' .booking.com: .bstatic.com cdn.cookielaw.org bat.bing.com googleads.g.doubleclick.net .googletagmanager.com .google-analytics.com .googleadservices.com .googleapis.com .onetrust.com".
security	error	(Line 6) Message: [Report Only] Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'self' 'unsafe-inline' .booking.com: .bstatic.com cdn.cookielaw.org bat.bing.com googleads.g.doubleclick.net .googletagmanager.com .google-analytics.com .googleadservices.com .googleapis.com .onetrust.com".
security	error	(Line 6) Message: [Report Only] Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'self' 'unsafe-inline' .booking.com: .bstatic.com cdn.cookielaw.org bat.bing.com googleads.g.doubleclick.net .googletagmanager.com .google-analytics.com .googleadservices.com .googleapis.com .onetrust.com".
security	error	(Line 6) Message: [Report Only] Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'self' 'unsafe-inline' .booking.com: .bstatic.com cdn.cookielaw.org bat.bing.com googleads.g.doubleclick.net .googletagmanager.com .google-analytics.com .googleadservices.com .googleapis.com .onetrust.com".
security	error	(Line 6) Message: [Report Only] Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'self' 'unsafe-inline' .booking.com: .bstatic.com cdn.cookielaw.org bat.bing.com googleads.g.doubleclick.net .googletagmanager.com .google-analytics.com .googleadservices.com .googleapis.com .onetrust.com".
security	error	(Line 6) Message: [Report Only] Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'self' 'unsafe-inline' .booking.com: .bstatic.com cdn.cookielaw.org bat.bing.com googleads.g.doubleclick.net .googletagmanager.com .google-analytics.com .googleadservices.com .googleapis.com .onetrust.com".
security	error	(Line 6) Message: [Report Only] Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'self' 'unsafe-inline' .booking.com: .bstatic.com cdn.cookielaw.org bat.bing.com googleads.g.doubleclick.net .googletagmanager.com .google-analytics.com .googleadservices.com .googleapis.com .onetrust.com".
security	error	(Line 6) Message: [Report Only] Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'self' 'unsafe-inline' .booking.com: .bstatic.com cdn.cookielaw.org bat.bing.com googleads.g.doubleclick.net .googletagmanager.com .google-analytics.com .googleadservices.com .googleapis.com .onetrust.com".
security	error	(Line 6) Message: [Report Only] Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'self' 'unsafe-inline' .booking.com: .bstatic.com cdn.cookielaw.org bat.bing.com googleads.g.doubleclick.net .googletagmanager.com .google-analytics.com .googleadservices.com .googleapis.com .onetrust.com".
security	error	(Line 6) Message: [Report Only] Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'self' 'unsafe-inline' .booking.com: .bstatic.com cdn.cookielaw.org bat.bing.com googleads.g.doubleclick.net .googletagmanager.com .google-analytics.com .googleadservices.com .googleapis.com .onetrust.com".
security	error	(Line 6) Message: [Report Only] Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'self' 'unsafe-inline' .booking.com: .bstatic.com cdn.cookielaw.org bat.bing.com googleads.g.doubleclick.net .googletagmanager.com .google-analytics.com .googleadservices.com .googleapis.com .onetrust.com".
security	error	(Line 6) Message: [Report Only] Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'self' 'unsafe-inline' .booking.com: .bstatic.com cdn.cookielaw.org bat.bing.com googleads.g.doubleclick.net .googletagmanager.com .google-analytics.com .googleadservices.com .googleapis.com .onetrust.com".
security	error	(Line 6) Message: [Report Only] Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'self' 'unsafe-inline' .booking.com: .bstatic.com cdn.cookielaw.org bat.bing.com googleads.g.doubleclick.net .googletagmanager.com .google-analytics.com .googleadservices.com .googleapis.com .onetrust.com".
security	error	(Line 6) Message: [Report Only] Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'self' 'unsafe-inline' .booking.com: .bstatic.com cdn.cookielaw.org bat.bing.com googleads.g.doubleclick.net .googletagmanager.com .google-analytics.com .googleadservices.com .googleapis.com .onetrust.com".
security	error	(Line 6) Message: [Report Only] Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'self' 'unsafe-inline' .booking.com: .bstatic.com cdn.cookielaw.org bat.bing.com googleads.g.doubleclick.net .googletagmanager.com .google-analytics.com .googleadservices.com .googleapis.com .onetrust.com".
security	error	(Line 6) Message: [Report Only] Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'self' 'unsafe-inline' .booking.com: .bstatic.com cdn.cookielaw.org bat.bing.com googleads.g.doubleclick.net .googletagmanager.com .google-analytics.com .googleadservices.com .googleapis.com .onetrust.com".
security	error	(Line 6) Message: [Report Only] Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'self' 'unsafe-inline' .booking.com: .bstatic.com cdn.cookielaw.org bat.bing.com googleads.g.doubleclick.net .googletagmanager.com .google-analytics.com .googleadservices.com .googleapis.com .onetrust.com".
security	error	(Line 6) Message: [Report Only] Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'self' 'unsafe-inline' .booking.com: .bstatic.com cdn.cookielaw.org bat.bing.com googleads.g.doubleclick.net .googletagmanager.com .google-analytics.com .googleadservices.com .googleapis.com .onetrust.com".
security	error	(Line 6) Message: [Report Only] Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'self' 'unsafe-inline' .booking.com: .bstatic.com cdn.cookielaw.org bat.bing.com googleads.g.doubleclick.net .googletagmanager.com .google-analytics.com .googleadservices.com .googleapis.com .onetrust.com".
security	error	(Line 6) Message: [Report Only] Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'self' 'unsafe-inline' .booking.com: .bstatic.com cdn.cookielaw.org bat.bing.com googleads.g.doubleclick.net .googletagmanager.com .google-analytics.com .googleadservices.com .googleapis.com .onetrust.com".
security	error	(Line 6) Message: [Report Only] Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'self' 'unsafe-inline' .booking.com: .bstatic.com cdn.cookielaw.org bat.bing.com googleads.g.doubleclick.net .googletagmanager.com .google-analytics.com .googleadservices.com .googleapis.com .onetrust.com".
security	error	(Line 6) Message: [Report Only] Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'self' 'unsafe-inline' .booking.com: .bstatic.com cdn.cookielaw.org bat.bing.com googleads.g.doubleclick.net .googletagmanager.com .google-analytics.com .googleadservices.com .googleapis.com .onetrust.com".
security	error	(Line 6) Message: [Report Only] Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'self' 'unsafe-inline' .booking.com: .bstatic.com cdn.cookielaw.org bat.bing.com googleads.g.doubleclick.net .googletagmanager.com .google-analytics.com .googleadservices.com .googleapis.com .onetrust.com".
security	error	(Line 6) Message: [Report Only] Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'self' 'unsafe-inline' .booking.com: .bstatic.com cdn.cookielaw.org bat.bing.com googleads.g.doubleclick.net .googletagmanager.com .google-analytics.com .googleadservices.com .googleapis.com .onetrust.com".
security	error	(Line 6) Message: [Report Only] Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'self' 'unsafe-inline' .booking.com: .bstatic.com cdn.cookielaw.org bat.bing.com googleads.g.doubleclick.net .googletagmanager.com .google-analytics.com .googleadservices.com .googleapis.com .onetrust.com".
security	error	(Line 6) Message: [Report Only] Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'self' 'unsafe-inline' .booking.com: .bstatic.com cdn.cookielaw.org bat.bing.com googleads.g.doubleclick.net .googletagmanager.com .google-analytics.com .googleadservices.com .googleapis.com .onetrust.com".
security	error	(Line 6) Message: [Report Only] Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'self' 'unsafe-inline' .booking.com: .bstatic.com cdn.cookielaw.org bat.bing.com googleads.g.doubleclick.net .googletagmanager.com .google-analytics.com .googleadservices.com .googleapis.com .onetrust.com".
security	error	(Line 6) Message: [Report Only] Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'self' 'unsafe-inline' .booking.com: .bstatic.com cdn.cookielaw.org bat.bing.com googleads.g.doubleclick.net .googletagmanager.com .google-analytics.com .googleadservices.com .googleapis.com .onetrust.com".
security	error	(Line 6) Message: [Report Only] Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'self' 'unsafe-inline' .booking.com: .bstatic.com cdn.cookielaw.org bat.bing.com googleads.g.doubleclick.net .googletagmanager.com .google-analytics.com .googleadservices.com .googleapis.com .onetrust.com".
security	error	(Line 6) Message: [Report Only] Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'self' 'unsafe-inline' .booking.com: .bstatic.com cdn.cookielaw.org bat.bing.com googleads.g.doubleclick.net .googletagmanager.com .google-analytics.com .googleadservices.com .googleapis.com .onetrust.com".
security	error	(Line 6) Message: [Report Only] Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'self' 'unsafe-inline' .booking.com: .bstatic.com cdn.cookielaw.org bat.bing.com googleads.g.doubleclick.net .googletagmanager.com .google-analytics.com .googleadservices.com .googleapis.com .onetrust.com".
security	error	(Line 6) Message: [Report Only] Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'self' 'unsafe-inline' .booking.com: .bstatic.com cdn.cookielaw.org bat.bing.com googleads.g.doubleclick.net .googletagmanager.com .google-analytics.com .googleadservices.com .googleapis.com .onetrust.com".
security	error	(Line 6) Message: [Report Only] Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'self' 'unsafe-inline' .booking.com: .bstatic.com cdn.cookielaw.org bat.bing.com googleads.g.doubleclick.net .googletagmanager.com .google-analytics.com .googleadservices.com .googleapis.com .onetrust.com".
security	error	(Line 6) Message: [Report Only] Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'self' 'unsafe-inline' .booking.com: .bstatic.com cdn.cookielaw.org bat.bing.com googleads.g.doubleclick.net .googletagmanager.com .google-analytics.com .googleadservices.com .googleapis.com .onetrust.com".
security	error	(Line 6) Message: [Report Only] Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'self' 'unsafe-inline' .booking.com: .bstatic.com cdn.cookielaw.org bat.bing.com googleads.g.doubleclick.net .googletagmanager.com .google-analytics.com .googleadservices.com .googleapis.com .onetrust.com".
security	error	(Line 6) Message: [Report Only] Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'self' 'unsafe-inline' .booking.com: .bstatic.com cdn.cookielaw.org bat.bing.com googleads.g.doubleclick.net .googletagmanager.com .google-analytics.com .googleadservices.com .googleapis.com .onetrust.com".
security	error	(Line 6) Message: [Report Only] Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'self' 'unsafe-inline' .booking.com: .bstatic.com cdn.cookielaw.org bat.bing.com googleads.g.doubleclick.net .googletagmanager.com .google-analytics.com .googleadservices.com .googleapis.com .onetrust.com".
security	error	(Line 6) Message: [Report Only] Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'self' 'unsafe-inline' .booking.com: .bstatic.com cdn.cookielaw.org bat.bing.com googleads.g.doubleclick.net .googletagmanager.com .google-analytics.com .googleadservices.com .googleapis.com .onetrust.com".
security	error	(Line 6) Message: [Report Only] Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'self' 'unsafe-inline' .booking.com: .bstatic.com cdn.cookielaw.org bat.bing.com googleads.g.doubleclick.net .googletagmanager.com .google-analytics.com .googleadservices.com .googleapis.com .onetrust.com".
security	error	(Line 6) Message: [Report Only] Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'self' 'unsafe-inline' .booking.com: .bstatic.com cdn.cookielaw.org bat.bing.com googleads.g.doubleclick.net .googletagmanager.com .google-analytics.com .googleadservices.com .googleapis.com .onetrust.com".
security	error	(Line 6) Message: [Report Only] Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'self' 'unsafe-inline' .booking.com: .bstatic.com cdn.cookielaw.org bat.bing.com googleads.g.doubleclick.net .googletagmanager.com .google-analytics.com .googleadservices.com .googleapis.com .onetrust.com".
security	error	(Line 6) Message: [Report Only] Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'self' 'unsafe-inline' .booking.com: .bstatic.com cdn.cookielaw.org bat.bing.com googleads.g.doubleclick.net .googletagmanager.com .google-analytics.com .googleadservices.com .googleapis.com .onetrust.com".
security	error	(Line 6) Message: [Report Only] Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'self' 'unsafe-inline' .booking.com: .bstatic.com cdn.cookielaw.org bat.bing.com googleads.g.doubleclick.net .googletagmanager.com .google-analytics.com .googleadservices.com .googleapis.com .onetrust.com".
security	error	(Line 6) Message: [Report Only] Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'self' 'unsafe-inline' .booking.com: .bstatic.com cdn.cookielaw.org bat.bing.com googleads.g.doubleclick.net .googletagmanager.com .google-analytics.com .googleadservices.com .googleapis.com .onetrust.com".
security	error	(Line 6) Message: [Report Only] Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'self' 'unsafe-inline' .booking.com: .bstatic.com cdn.cookielaw.org bat.bing.com googleads.g.doubleclick.net .googletagmanager.com .google-analytics.com .googleadservices.com .googleapis.com .onetrust.com".
security	error	(Line 6) Message: [Report Only] Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'self' 'unsafe-inline' .booking.com: .bstatic.com cdn.cookielaw.org bat.bing.com googleads.g.doubleclick.net .googletagmanager.com .google-analytics.com .googleadservices.com .googleapis.com .onetrust.com".
security	error	(Line 6) Message: [Report Only] Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'self' 'unsafe-inline' .booking.com: .bstatic.com cdn.cookielaw.org bat.bing.com googleads.g.doubleclick.net .googletagmanager.com .google-analytics.com .googleadservices.com .googleapis.com .onetrust.com".
security	error	(Line 6) Message: [Report Only] Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'self' 'unsafe-inline' .booking.com: .bstatic.com cdn.cookielaw.org bat.bing.com googleads.g.doubleclick.net .googletagmanager.com .google-analytics.com .googleadservices.com .googleapis.com .onetrust.com".
security	error	(Line 6) Message: [Report Only] Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'self' 'unsafe-inline' .booking.com: .bstatic.com cdn.cookielaw.org bat.bing.com googleads.g.doubleclick.net .googletagmanager.com .google-analytics.com .googleadservices.com .googleapis.com .onetrust.com".
security	error	(Line 6) Message: [Report Only] Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'self' 'unsafe-inline' .booking.com: .bstatic.com cdn.cookielaw.org bat.bing.com googleads.g.doubleclick.net .googletagmanager.com .google-analytics.com .googleadservices.com .googleapis.com .onetrust.com".
security	error	(Line 6) Message: [Report Only] Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'self' 'unsafe-inline' .booking.com: .bstatic.com cdn.cookielaw.org bat.bing.com googleads.g.doubleclick.net .googletagmanager.com .google-analytics.com .googleadservices.com .googleapis.com .onetrust.com".
security	error	(Line 6) Message: [Report Only] Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'self' 'unsafe-inline' .booking.com: .bstatic.com cdn.cookielaw.org bat.bing.com googleads.g.doubleclick.net .googletagmanager.com .google-analytics.com .googleadservices.com .googleapis.com .onetrust.com".
security	error	(Line 6) Message: [Report Only] Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'self' 'unsafe-inline' .booking.com: .bstatic.com cdn.cookielaw.org bat.bing.com googleads.g.doubleclick.net .googletagmanager.com .google-analytics.com .googleadservices.com .googleapis.com .onetrust.com".
security	error	(Line 6) Message: [Report Only] Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'self' 'unsafe-inline' .booking.com: .bstatic.com cdn.cookielaw.org bat.bing.com googleads.g.doubleclick.net .googletagmanager.com .google-analytics.com .googleadservices.com .googleapis.com .onetrust.com".
security	error	(Line 6) Message: [Report Only] Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'self' 'unsafe-inline' .booking.com: .bstatic.com cdn.cookielaw.org bat.bing.com googleads.g.doubleclick.net .googletagmanager.com .google-analytics.com .googleadservices.com .googleapis.com .onetrust.com".
security	error	(Line 6) Message: [Report Only] Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'self' 'unsafe-inline' .booking.com: .bstatic.com cdn.cookielaw.org bat.bing.com googleads.g.doubleclick.net .googletagmanager.com .google-analytics.com .googleadservices.com .googleapis.com .onetrust.com".
security	error	(Line 6) Message: [Report Only] Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'self' 'unsafe-inline' .booking.com: .bstatic.com cdn.cookielaw.org bat.bing.com googleads.g.doubleclick.net .googletagmanager.com .google-analytics.com .googleadservices.com .googleapis.com .onetrust.com".
security	error	(Line 6) Message: [Report Only] Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'self' 'unsafe-inline' .booking.com: .bstatic.com cdn.cookielaw.org bat.bing.com googleads.g.doubleclick.net .googletagmanager.com .google-analytics.com .googleadservices.com .googleapis.com .onetrust.com".
security	error	(Line 6) Message: [Report Only] Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'self' 'unsafe-inline' .booking.com: .bstatic.com cdn.cookielaw.org bat.bing.com googleads.g.doubleclick.net .googletagmanager.com .google-analytics.com .googleadservices.com .googleapis.com .onetrust.com".
security	error	(Line 6) Message: [Report Only] Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'self' 'unsafe-inline' .booking.com: .bstatic.com cdn.cookielaw.org bat.bing.com googleads.g.doubleclick.net .googletagmanager.com .google-analytics.com .googleadservices.com .googleapis.com .onetrust.com".
security	error	(Line 6) Message: [Report Only] Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'self' 'unsafe-inline' .booking.com: .bstatic.com cdn.cookielaw.org bat.bing.com googleads.g.doubleclick.net .googletagmanager.com .google-analytics.com .googleadservices.com .googleapis.com .onetrust.com".
security	error	(Line 6) Message: [Report Only] Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'self' 'unsafe-inline' .booking.com: .bstatic.com cdn.cookielaw.org bat.bing.com googleads.g.doubleclick.net .googletagmanager.com .google-analytics.com .googleadservices.com .googleapis.com .onetrust.com".
security	error	(Line 6) Message: [Report Only] Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'self' 'unsafe-inline' .booking.com: .bstatic.com cdn.cookielaw.org bat.bing.com googleads.g.doubleclick.net .googletagmanager.com .google-analytics.com .googleadservices.com .googleapis.com .onetrust.com".
security	error	(Line 6) Message: [Report Only] Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'self' 'unsafe-inline' .booking.com: .bstatic.com cdn.cookielaw.org bat.bing.com googleads.g.doubleclick.net .googletagmanager.com .google-analytics.com .googleadservices.com .googleapis.com .onetrust.com".
security	error	(Line 6) Message: [Report Only] Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'self' 'unsafe-inline' .booking.com: .bstatic.com cdn.cookielaw.org bat.bing.com googleads.g.doubleclick.net .googletagmanager.com .google-analytics.com .googleadservices.com .googleapis.com .onetrust.com".
security	error	(Line 6) Message: [Report Only] Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'self' 'unsafe-inline' .booking.com: .bstatic.com cdn.cookielaw.org bat.bing.com googleads.g.doubleclick.net .googletagmanager.com .google-analytics.com .googleadservices.com .googleapis.com .onetrust.com".
security	error	(Line 6) Message: [Report Only] Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'self' 'unsafe-inline' .booking.com: .bstatic.com cdn.cookielaw.org bat.bing.com googleads.g.doubleclick.net .googletagmanager.com .google-analytics.com .googleadservices.com .googleapis.com .onetrust.com".
security	error	(Line 6) Message: [Report Only] Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'self' 'unsafe-inline' .booking.com: .bstatic.com cdn.cookielaw.org bat.bing.com googleads.g.doubleclick.net .googletagmanager.com .google-analytics.com .googleadservices.com .googleapis.com .onetrust.com".
security	error	(Line 6) Message: [Report Only] Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'self' 'unsafe-inline' .booking.com: .bstatic.com cdn.cookielaw.org bat.bing.com googleads.g.doubleclick.net .googletagmanager.com .google-analytics.com .googleadservices.com .googleapis.com .onetrust.com".
security	error	(Line 6) Message: [Report Only] Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'self' 'unsafe-inline' .booking.com: .bstatic.com cdn.cookielaw.org bat.bing.com googleads.g.doubleclick.net .googletagmanager.com .google-analytics.com .googleadservices.com .googleapis.com .onetrust.com".
security	error	(Line 6) Message: [Report Only] Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'self' 'unsafe-inline' .booking.com: .bstatic.com cdn.cookielaw.org bat.bing.com googleads.g.doubleclick.net .googletagmanager.com .google-analytics.com .googleadservices.com .googleapis.com .onetrust.com".
security	error	(Line 8) Message: [Report Only] Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'self' 'unsafe-inline' .booking.com: .bstatic.com cdn.cookielaw.org bat.bing.com googleads.g.doubleclick.net .googletagmanager.com .google-analytics.com .googleadservices.com .googleapis.com .onetrust.com".
security	error	(Line 8) Message: [Report Only] Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'self' 'unsafe-inline' .booking.com: .bstatic.com cdn.cookielaw.org bat.bing.com googleads.g.doubleclick.net .googletagmanager.com .google-analytics.com .googleadservices.com .googleapis.com .onetrust.com".
security	error	(Line 8) Message: [Report Only] Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'self' 'unsafe-inline' .booking.com: .bstatic.com cdn.cookielaw.org bat.bing.com googleads.g.doubleclick.net .googletagmanager.com .google-analytics.com .googleadservices.com .googleapis.com .onetrust.com".
security	error	(Line 8) Message: [Report Only] Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'self' 'unsafe-inline' .booking.com: .bstatic.com cdn.cookielaw.org bat.bing.com googleads.g.doubleclick.net .googletagmanager.com .google-analytics.com .googleadservices.com .googleapis.com .onetrust.com".
security	error	(Line 6) Message: [Report Only] Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'self' 'unsafe-inline' .booking.com: .bstatic.com cdn.cookielaw.org bat.bing.com googleads.g.doubleclick.net .googletagmanager.com .google-analytics.com .googleadservices.com .googleapis.com .onetrust.com".
security	error	(Line 6) Message: [Report Only] Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'self' 'unsafe-inline' .booking.com: .bstatic.com cdn.cookielaw.org bat.bing.com googleads.g.doubleclick.net .googletagmanager.com .google-analytics.com .googleadservices.com .googleapis.com .onetrust.com".
security	error	(Line 6) Message: [Report Only] Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'self' 'unsafe-inline' .booking.com: .bstatic.com cdn.cookielaw.org bat.bing.com googleads.g.doubleclick.net .googletagmanager.com .google-analytics.com .googleadservices.com .googleapis.com .onetrust.com".
security	error	(Line 6) Message: [Report Only] Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'self' 'unsafe-inline' .booking.com: .bstatic.com cdn.cookielaw.org bat.bing.com googleads.g.doubleclick.net .googletagmanager.com .google-analytics.com .googleadservices.com .googleapis.com .onetrust.com".
security	error	(Line 6) Message: [Report Only] Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'self' 'unsafe-inline' .booking.com: .bstatic.com cdn.cookielaw.org bat.bing.com googleads.g.doubleclick.net .googletagmanager.com .google-analytics.com .googleadservices.com .googleapis.com .onetrust.com".
security	error	(Line 6) Message: [Report Only] Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'self' 'unsafe-inline' .booking.com: .bstatic.com cdn.cookielaw.org bat.bing.com googleads.g.doubleclick.net .googletagmanager.com .google-analytics.com .googleadservices.com .googleapis.com .onetrust.com".
security	error	(Line 6) Message: [Report Only] Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'self' 'unsafe-inline' .booking.com: .bstatic.com cdn.cookielaw.org bat.bing.com googleads.g.doubleclick.net .googletagmanager.com .google-analytics.com .googleadservices.com .googleapis.com .onetrust.com".
security	error	(Line 6) Message: [Report Only] Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'self' 'unsafe-inline' .booking.com: .bstatic.com cdn.cookielaw.org bat.bing.com googleads.g.doubleclick.net .googletagmanager.com .google-analytics.com .googleadservices.com .googleapis.com .onetrust.com".
security	error	(Line 6) Message: [Report Only] Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'self' 'unsafe-inline' .booking.com: .bstatic.com cdn.cookielaw.org bat.bing.com googleads.g.doubleclick.net .googletagmanager.com .google-analytics.com .googleadservices.com .googleapis.com .onetrust.com".
security	error	(Line 6) Message: [Report Only] Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'self' 'unsafe-inline' .booking.com: .bstatic.com cdn.cookielaw.org bat.bing.com googleads.g.doubleclick.net .googletagmanager.com .google-analytics.com .googleadservices.com .googleapis.com .onetrust.com".
security	error	(Line 6) Message: [Report Only] Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'self' 'unsafe-inline' .booking.com: .bstatic.com cdn.cookielaw.org bat.bing.com googleads.g.doubleclick.net .googletagmanager.com .google-analytics.com .googleadservices.com .googleapis.com .onetrust.com".
security	error	(Line 6) Message: [Report Only] Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'self' 'unsafe-inline' .booking.com: .bstatic.com cdn.cookielaw.org bat.bing.com googleads.g.doubleclick.net .googletagmanager.com .google-analytics.com .googleadservices.com .googleapis.com .onetrust.com".
security	error	(Line 6) Message: [Report Only] Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'self' 'unsafe-inline' .booking.com: .bstatic.com cdn.cookielaw.org bat.bing.com googleads.g.doubleclick.net .googletagmanager.com .google-analytics.com .googleadservices.com .googleapis.com .onetrust.com".
security	error	(Line 6) Message: [Report Only] Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'self' 'unsafe-inline' .booking.com: .bstatic.com cdn.cookielaw.org bat.bing.com googleads.g.doubleclick.net .googletagmanager.com .google-analytics.com .googleadservices.com .googleapis.com .onetrust.com".
security	error	(Line 6) Message: [Report Only] Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'self' 'unsafe-inline' .booking.com: .bstatic.com cdn.cookielaw.org bat.bing.com googleads.g.doubleclick.net .googletagmanager.com .google-analytics.com .googleadservices.com .googleapis.com .onetrust.com".
security	error	(Line 6) Message: [Report Only] Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'self' 'unsafe-inline' .booking.com: .bstatic.com cdn.cookielaw.org bat.bing.com googleads.g.doubleclick.net .googletagmanager.com .google-analytics.com .googleadservices.com .googleapis.com .onetrust.com".
security	error	(Line 6) Message: [Report Only] Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'self' 'unsafe-inline' .booking.com: .bstatic.com cdn.cookielaw.org bat.bing.com googleads.g.doubleclick.net .googletagmanager.com .google-analytics.com .googleadservices.com .googleapis.com .onetrust.com".
security	error	(Line 6) Message: [Report Only] Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'self' 'unsafe-inline' .booking.com: .bstatic.com cdn.cookielaw.org bat.bing.com googleads.g.doubleclick.net .googletagmanager.com .google-analytics.com .googleadservices.com .googleapis.com .onetrust.com".
security	error	(Line 6) Message: [Report Only] Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'self' 'unsafe-inline' .booking.com: .bstatic.com cdn.cookielaw.org bat.bing.com googleads.g.doubleclick.net .googletagmanager.com .google-analytics.com .googleadservices.com .googleapis.com .onetrust.com".
security	error	(Line 6) Message: [Report Only] Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'self' 'unsafe-inline' .booking.com: .bstatic.com cdn.cookielaw.org bat.bing.com googleads.g.doubleclick.net .googletagmanager.com .google-analytics.com .googleadservices.com .googleapis.com .onetrust.com".
security	error	(Line 6) Message: [Report Only] Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'self' 'unsafe-inline' .booking.com: .bstatic.com cdn.cookielaw.org bat.bing.com googleads.g.doubleclick.net .googletagmanager.com .google-analytics.com .googleadservices.com .googleapis.com .onetrust.com".
security	error	(Line 6) Message: [Report Only] Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'self' 'unsafe-inline' .booking.com: .bstatic.com cdn.cookielaw.org bat.bing.com googleads.g.doubleclick.net .googletagmanager.com .google-analytics.com .googleadservices.com .googleapis.com .onetrust.com".
security	error	(Line 6) Message: [Report Only] Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'self' 'unsafe-inline' .booking.com: .bstatic.com cdn.cookielaw.org bat.bing.com googleads.g.doubleclick.net .googletagmanager.com .google-analytics.com .googleadservices.com .googleapis.com .onetrust.com".
security	error	(Line 6) Message: [Report Only] Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'self' 'unsafe-inline' .booking.com: .bstatic.com cdn.cookielaw.org bat.bing.com googleads.g.doubleclick.net .googletagmanager.com .google-analytics.com .googleadservices.com .googleapis.com .onetrust.com".
security	error	(Line 6) Message: [Report Only] Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'self' 'unsafe-inline' .booking.com: .bstatic.com cdn.cookielaw.org bat.bing.com googleads.g.doubleclick.net .googletagmanager.com .google-analytics.com .googleadservices.com .googleapis.com .onetrust.com".
security	error	(Line 6) Message: [Report Only] Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'self' 'unsafe-inline' .booking.com: .bstatic.com cdn.cookielaw.org bat.bing.com googleads.g.doubleclick.net .googletagmanager.com .google-analytics.com .googleadservices.com .googleapis.com .onetrust.com".
security	error	(Line 6) Message: [Report Only] Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'self' 'unsafe-inline' .booking.com: .bstatic.com cdn.cookielaw.org bat.bing.com googleads.g.doubleclick.net .googletagmanager.com .google-analytics.com .googleadservices.com .googleapis.com .onetrust.com".
security	error	(Line 6) Message: [Report Only] Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'self' 'unsafe-inline' .booking.com: .bstatic.com cdn.cookielaw.org bat.bing.com googleads.g.doubleclick.net .googletagmanager.com .google-analytics.com .googleadservices.com .googleapis.com .onetrust.com".
security	error	(Line 6) Message: [Report Only] Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'self' 'unsafe-inline' .booking.com: .bstatic.com cdn.cookielaw.org bat.bing.com googleads.g.doubleclick.net .googletagmanager.com .google-analytics.com .googleadservices.com .googleapis.com .onetrust.com".
security	error	(Line 6) Message: [Report Only] Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'self' 'unsafe-inline' .booking.com: .bstatic.com cdn.cookielaw.org bat.bing.com googleads.g.doubleclick.net .googletagmanager.com .google-analytics.com .googleadservices.com .googleapis.com .onetrust.com".
security	error	(Line 6) Message: [Report Only] Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'self' 'unsafe-inline' .booking.com: .bstatic.com cdn.cookielaw.org bat.bing.com googleads.g.doubleclick.net .googletagmanager.com .google-analytics.com .googleadservices.com .googleapis.com .onetrust.com".
security	error	(Line 6) Message: [Report Only] Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'self' 'unsafe-inline' .booking.com: .bstatic.com cdn.cookielaw.org bat.bing.com googleads.g.doubleclick.net .googletagmanager.com .google-analytics.com .googleadservices.com .googleapis.com .onetrust.com".
security	error	(Line 6) Message: [Report Only] Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'self' 'unsafe-inline' .booking.com: .bstatic.com cdn.cookielaw.org bat.bing.com googleads.g.doubleclick.net .googletagmanager.com .google-analytics.com .googleadservices.com .googleapis.com .onetrust.com".
security	error	(Line 6) Message: [Report Only] Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'self' 'unsafe-inline' .booking.com: .bstatic.com cdn.cookielaw.org bat.bing.com googleads.g.doubleclick.net .googletagmanager.com .google-analytics.com .googleadservices.com .googleapis.com .onetrust.com".
security	error	(Line 6) Message: [Report Only] Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'self' 'unsafe-inline' .booking.com: .bstatic.com cdn.cookielaw.org bat.bing.com googleads.g.doubleclick.net .googletagmanager.com .google-analytics.com .googleadservices.com .googleapis.com .onetrust.com".
security	error	(Line 6) Message: [Report Only] Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'self' 'unsafe-inline' .booking.com: .bstatic.com cdn.cookielaw.org bat.bing.com googleads.g.doubleclick.net .googletagmanager.com .google-analytics.com .googleadservices.com .googleapis.com .onetrust.com".
security	error	(Line 6) Message: [Report Only] Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'self' 'unsafe-inline' .booking.com: .bstatic.com cdn.cookielaw.org bat.bing.com googleads.g.doubleclick.net .googletagmanager.com .google-analytics.com .googleadservices.com .googleapis.com .onetrust.com".
security	error	(Line 6) Message: [Report Only] Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'self' 'unsafe-inline' .booking.com: .bstatic.com cdn.cookielaw.org bat.bing.com googleads.g.doubleclick.net .googletagmanager.com .google-analytics.com .googleadservices.com .googleapis.com .onetrust.com".
security	error	(Line 6) Message: [Report Only] Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'self' 'unsafe-inline' .booking.com: .bstatic.com cdn.cookielaw.org bat.bing.com googleads.g.doubleclick.net .googletagmanager.com .google-analytics.com .googleadservices.com .googleapis.com .onetrust.com".
security	error	(Line 6) Message: [Report Only] Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'self' 'unsafe-inline' .booking.com: .bstatic.com cdn.cookielaw.org bat.bing.com googleads.g.doubleclick.net .googletagmanager.com .google-analytics.com .googleadservices.com .googleapis.com .onetrust.com".
other	warning	URL: https://www.booking.com/attractions/index.fr.html?aid=2256042&emk=TRVYG5VXY1&emkcid=815&checkin=2022-06-23&checkout=2022-06-24&selected_currency=EUR&label=56202_usp-03_v2- Message: A preload for 'https://cf.bstatic.com/psb/capla/static/js/bui-react.7b618af7.js' is found, but is not used because the request credentials mode does not match. Consider taking a look at crossorigin attribute.
other	warning	URL: https://www.booking.com/attractions/index.fr.html?aid=2256042&emk=TRVYG5VXY1&emkcid=815&checkin=2022-06-23&checkout=2022-06-24&selected_currency=EUR&label=56202_usp-03_v2- Message: A preload for 'https://cf.bstatic.com/psb/capla/static/js/vendors.4a8dbaf5.js' is found, but is not used because the request credentials mode does not match. Consider taking a look at crossorigin attribute.
other	warning	URL: https://www.booking.com/attractions/index.fr.html?aid=2256042&emk=TRVYG5VXY1&emkcid=815&checkin=2022-06-23&checkout=2022-06-24&selected_currency=EUR&label=56202_usp-03_v2- Message: A preload for 'https://cf.bstatic.com/psb/capla/static/js/client.403a07b7.js' is found, but is not used because the request credentials mode does not match. Consider taking a look at crossorigin attribute.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=300; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

account.booking.com
bat.bing.com
cf.bstatic.com
link.sg.booking.com
q-xx.bstatic.com
secure.booking.com
t-cf.bstatic.com
www.booking.com
www.google-analytics.com
13.227.254.42
13.33.33.119
18.155.68.14
2001:4860:4802:36::178
2600:9000:2003:f200:1f:e2ee:200:93a1
2600:9000:20c7:6a00:15:9f56:b80:93a1
2600:9000:223b:c600:14:ecff:a140:93a1
2620:1ec:c11::200
00d089bb20fde4f8813892e4705d1a2788a5d1aac5258a1b56b1432c4668a5a9
03176a742b70ba383776f1f4abeab2c15ae4bfd56ec1cc3cbfbae0a53be2e8c7
09c455549d575899a31e2d34f1e7fbebdfdb655c547825c4d8921e883973d641
1cffc2b3146584685cd72751d7f28aa030ab9ae2f1bc78f2c27909f8d8287b26
20823da37b07f3fa2d9e96a3d3595a4f740ab8bd1d7684c81c1d470e9eae080a
21ea9b572a39f1f4a112824b07c8ef69f2b8ed995f9c5cccef69da874e169fc4
2499881d37b287a82f41dd0cbd1df8cfa672db7a03512353c2f509bf6daf2a11
396585e7f989563e09331013b795e11b2944c91bf9b3bdd03083dd0656027efd
4328dbde25a0900554795500c23ffdd420df48c5003e78886263f1e6185785b9
47b2c70e461233162e2c36993c530adbf6c3d82572162d8944eff3a83aa743c3
5d7b260230514264e88bd54292a596035d6e399c4340e11e942408448a3efd6f
60779ca6517299653fb72e63848ad4a075baf38b55c8cb8336a201f1db0bd528
679804e244b4127b7ecd99a513b57d6a4f91866410e16da69ce02f98f534051d
6f78fae8519403ce4597020e7614536a70eb413001df07c091814f2751c56a29
847cb1648fa9a41d494f58fba32452bfc8c69558f738a25f4194a4dde17f16f4
87e6ed0fea20b1a11b40b876780a4c6b65f92b937e2ed01540606762ed0f3787
8c8db94c395d3e3dec8930bf08d5e602d9ee082ded38ed77433225b62adb5900
95f26ad40c5c5ab4910edff10bebdb59edd490c55c6830ba81a27972046f5547
98137c5c7b1900520c609be80bd7147b462a4ba5f8b387471fde4430f1df59ee
9e30d10643956b392a79c2b0ac71118408dcd4da64d1443c70475aa3cda758ea
a18f1d273a36f3738625171b8e1fc7481a78c68185da19b9c5c64e4856e400bc
a35fd31b64c765383a086f599925699d3bdba756be1664a8f9c7323c1ac88a78
a50df548b428a798d349986ecd3c3a68c8bb6c14d9f015cac8087304b9378488
a67fc761b81a8d9a1c699095f16a07f98b0df6f0cae235449cf1ce6d0a7c3bad
aee5c7fe6be2a805d9c9b4b01e4bb527d9759c320d6d7febbe7047c4c4cd7925
b0911d38beb67cd527ed8e06779dce9a9cf076f4ccb258e4406010c7899ae87e
b4d83c9ca910baca3fe847b627cc4558f206a23a76e51987a241dc2975f314b6
d01d469b52e318752809aef3a2ba9dae33c250a2d86ae2713fec46a6393b0b17
d9a55f7230942e5aa22d40adf36bafd94d3ed6719f5c56b1cbc19ab4f874d83a
de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
fb0b3aef25c12ebb0a3d15eef6c367e790b1a8ea0660ae5ad4ea5d24b83778f0

www.booking.com Open in urlscan Pro 18.155.68.14 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

41 Requests

100 %HTTPS

63 %IPv6

4 Domains

9 Subdomains

6 IPs

1 Countries

1154 kBTransfer

4631 kBSize

17 Cookies

17 Outgoing links

Page URL History

Redirected requests

41 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

www.booking.com Open in urlscan Pro
18.155.68.14 Public Scan

Screenshot
Live screenshot

Full Image

41
Requests

100 %
HTTPS

63 %
IPv6

4
Domains

9
Subdomains

6
IPs

1
Countries

1154 kB
Transfer

4631 kB
Size

17
Cookies

41 HTTP transactions
0 data transactions