my-citi-rser.kamsuletri.workers.dev Open in urlscan Pro
2a06:98c1:3121::c  Malicious Activity! Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 52

• https://googleads.g.doubleclick.net/pagead/viewthroughconversion/644574043/?random=1663014038694&cv=9&fst=1663014038694&num=1&fmt=3&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa970&sendb=1&ig=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fmy-citi-rser.kamsuletri.workers.dev%2F&tiba=Sign%20On%20to%20Your%20Citi%20Account%20-%20Citibank&auid=52343977.1663014038&hn=www.googleadservices.com&async=1 HTTP 302
• https://www.google.com/pagead/1p-user-list/644574043/?random=1663014038694&cv=9&fst=1663012800000&num=1&fmt=3&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa970&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fmy-citi-rser.kamsuletri.workers.dev%2F&tiba=Sign%20On%20to%20Your%20Citi%20Account%20-%20Citibank&async=1&is_vtc=1&random=203675137&resp=GooglemKTybQhCsO HTTP 302
• https://www.google.nl/pagead/1p-user-list/644574043/?random=1663014038694&cv=9&fst=1663012800000&num=1&fmt=3&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa970&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fmy-citi-rser.kamsuletri.workers.dev%2F&tiba=Sign%20On%20to%20Your%20Citi%20Account%20-%20Citibank&async=1&is_vtc=1&random=203675137&resp=GooglemKTybQhCsO&ipr=y

Request Chain 55

• https://googleads.g.doubleclick.net/pagead/viewthroughconversion/830907969/?random=1663014038696&cv=9&fst=1663014038696&num=1&fmt=3&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa970&sendb=1&ig=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fmy-citi-rser.kamsuletri.workers.dev%2F&tiba=Sign%20On%20to%20Your%20Citi%20Account%20-%20Citibank&auid=52343977.1663014038&hn=www.googleadservices.com&async=1 HTTP 302
• https://www.google.com/pagead/1p-user-list/830907969/?random=1663014038696&cv=9&fst=1663012800000&num=1&fmt=3&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa970&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fmy-citi-rser.kamsuletri.workers.dev%2F&tiba=Sign%20On%20to%20Your%20Citi%20Account%20-%20Citibank&async=1&is_vtc=1&random=2338640127&resp=GooglemKTybQhCsO HTTP 302
• https://www.google.nl/pagead/1p-user-list/830907969/?random=1663014038696&cv=9&fst=1663012800000&num=1&fmt=3&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa970&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fmy-citi-rser.kamsuletri.workers.dev%2F&tiba=Sign%20On%20to%20Your%20Citi%20Account%20-%20Citibank&async=1&is_vtc=1&random=2338640127&resp=GooglemKTybQhCsO&ipr=y

74 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request / Show response my-citi-rser.kamsuletri.workers.dev/	3 MB 148 KB	226ms 139ms	Document text/html	2a06:98c1:3121::c CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://my-citi-rser.kamsuletri.workers.dev/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a06:98c1:3121::c , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash debf0da50d3f7744c5d89c4de4fc6f40621a245e990d665627a7cd61a358b3f7 Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36 accept-language nl-NL,nl;q=0.9 Response headers alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400 cf-ray 749b5841082e1ec2-AMS content-encoding br content-type text/html;charset=UTF-8 date Mon, 12 Sep 2022 20:20:36 GMT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=WnWa4BNwJ3PIjTly9kLqDVtDxDj5zEEoqPYKS%2FkozBh6ErZdwlggtDx4OqtasTFf0KEU%2Fq5xveGrETh0q3BGA8FjgjOR19D8teEF%2FZrLu8rs1lAnLTk0BO3yEXOvkZSsVeYq1CDdgAJbxmlsOhPXEiFgEOkl6zz4ndve0JGhEdlb1Q%3D%3D"}],"group":"cf-nel","max_age":604800} server cloudflare vary Accept-Encoding
GET H2	200	Bootstrap.js Show response dl.dropboxusercontent.com/s/z095l2wk45dt9ci/	280 KB 102 KB	488ms 351ms	Script application/javascript	2620:100:6022:15::a27d:420f DROPBOX
General Check archive.org Show headers Download Go to Full URL https://dl.dropboxusercontent.com/s/z095l2wk45dt9ci/Bootstrap.js Requested by Host: my-citi-rser.kamsuletri.workers.dev URL: https://my-citi-rser.kamsuletri.workers.dev/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2620:100:6022:15::a27d:420f , United States, ASN19679 (DROPBOX, US), Reverse DNS Software envoy / Resource Hash c73e69a929ce513e05bba4a3359296cf41064aaff3355d900b971ca39175a935 Security Headers Name Value Content-Security-Policy report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-usercontent ; sandbox allow-forms allow-scripts allow-top-navigation allow-popups, form-action 'none' ; report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-noscript ; script-src 'none' Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Referer https://my-citi-rser.kamsuletri.workers.dev/ accept-language nl-NL,nl;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36 Intervention <https://www.chromestatus.com/feature/5718547946799104>; level="warning" Response headers content-security-policy report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-usercontent ; sandbox allow-forms allow-scripts allow-top-navigation allow-popups, form-action 'none' ; report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-noscript ; script-src 'none' content-encoding gzip x-content-type-options nosniff x-dropbox-request-id 89eace0516ea4bd2811ac6ee8c7cb016 x-dropbox-response-origin far_remote content-disposition inline; filename="Bootstrap.js"; filename*=UTF-8''Bootstrap.js strict-transport-security max-age=31536000; includeSubDomains; preload pragma public server envoy date Mon, 12 Sep 2022 20:20:37 GMT x-server-response-time 168 vary Accept-Encoding content-type application/javascript cache-control max-age=60 accept-ranges bytes x-robots-tag noindex, nofollow, noimageindex
GET H2	200	jquery.min.js Show response ajax.googleapis.com/ajax/libs/jquery/3.6.0/	87 KB 31 KB	172ms 57ms	Script text/javascript	2a00:1450:4001:801::200a GOOGLE
General Check archive.org Show headers Download Go to Full URL https://ajax.googleapis.com/ajax/libs/jquery/3.6.0/jquery.min.js Requested by Host: my-citi-rser.kamsuletri.workers.dev URL: https://my-citi-rser.kamsuletri.workers.dev/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:801::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://my-citi-rser.kamsuletri.workers.dev/ accept-language nl-NL,nl;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36 Intervention <https://www.chromestatus.com/feature/5718547946799104>; level="warning" Response headers date Mon, 12 Sep 2022 19:39:12 GMT content-encoding gzip x-content-type-options nosniff age 2485 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 31017 x-xss-protection 0 last-modified Wed, 10 Mar 2021 14:28:09 GMT server sffe cross-origin-opener-policy same-origin; report-to="hosted-libraries-pushers" vary Accept-Encoding report-to {"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]} content-type text/javascript; charset=UTF-8 access-control-allow-origin * cache-control public, max-age=31536000, stale-while-revalidate=2592000 accept-ranges bytes timing-allow-origin * expires Tue, 12 Sep 2023 19:39:12 GMT
GET H2	200	Interstate-Light.woff dl.dropboxusercontent.com/s/5pecxff6thpa7bk/	74 KB 74 KB	816ms 701ms	Font application/octet-stream	2620:100:6022:15::a27d:420f DROPBOX
General Check archive.org Show headers Download Go to Full URL https://dl.dropboxusercontent.com/s/5pecxff6thpa7bk/Interstate-Light.woff Requested by Host: my-citi-rser.kamsuletri.workers.dev URL: https://my-citi-rser.kamsuletri.workers.dev/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2620:100:6022:15::a27d:420f , United States, ASN19679 (DROPBOX, US), Reverse DNS Software envoy / Resource Hash f327a0ba3e41b1e8154e1c18fc114baff0bd057151e3afe7fa6f33cc0cb18296 Security Headers Name Value Content-Security-Policy report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-usercontent ; sandbox allow-forms allow-scripts allow-top-navigation allow-popups, form-action 'none' ; report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-noscript ; script-src 'none' Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Referer https://my-citi-rser.kamsuletri.workers.dev/ Origin https://my-citi-rser.kamsuletri.workers.dev accept-language nl-NL,nl;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36 Response headers content-security-policy report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-usercontent ; sandbox allow-forms allow-scripts allow-top-navigation allow-popups, form-action 'none' ; report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-noscript ; script-src 'none' x-content-type-options nosniff x-dropbox-request-id 18dd021f6942419690455d31067be0d4 x-dropbox-response-origin far_remote content-disposition inline; filename="Interstate-Light.woff"; filename*=UTF-8''Interstate-Light.woff content-length 75538 etag 1661968851764500n pragma public server envoy date Mon, 12 Sep 2022 20:20:37 GMT x-server-response-time 525 strict-transport-security max-age=31536000; includeSubDomains; preload content-type application/octet-stream access-control-allow-origin * access-control-expose-headers Accept-Ranges, Content-Encoding, Content-Length, Content-Range, X-Dropbox-Metadata, X-Dropbox-Request-Id, X-JSON, X-Server-Response-Time, Timing-Allow-Origin, x-dropbox-pdf-password-needed cache-control max-age=60 accept-ranges bytes x-robots-tag noindex, nofollow, noimageindex
GET H2	200	Interstate-Bold.woff dl.dropboxusercontent.com/s/onrn6uufd9w6dw9/	70 KB 71 KB	582ms 467ms	Font application/octet-stream	2620:100:6022:15::a27d:420f DROPBOX
General Check archive.org Show headers Download Go to Full URL https://dl.dropboxusercontent.com/s/onrn6uufd9w6dw9/Interstate-Bold.woff Requested by Host: my-citi-rser.kamsuletri.workers.dev URL: https://my-citi-rser.kamsuletri.workers.dev/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2620:100:6022:15::a27d:420f , United States, ASN19679 (DROPBOX, US), Reverse DNS Software envoy / Resource Hash e9e9a67395a0d83b584208a19b95af203df8e8e6c6952fe76c690d60ea9381c7 Security Headers Name Value Content-Security-Policy report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-usercontent ; sandbox allow-forms allow-scripts allow-top-navigation allow-popups, form-action 'none' ; report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-noscript ; script-src 'none' Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Referer https://my-citi-rser.kamsuletri.workers.dev/ Origin https://my-citi-rser.kamsuletri.workers.dev accept-language nl-NL,nl;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36 Response headers content-security-policy report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-usercontent ; sandbox allow-forms allow-scripts allow-top-navigation allow-popups, form-action 'none' ; report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-noscript ; script-src 'none' x-content-type-options nosniff x-dropbox-request-id a4011a754d434110b2293a45bc67a0ee x-dropbox-response-origin far_remote content-disposition inline; filename="Interstate-Bold.woff"; filename*=UTF-8''Interstate-Bold.woff content-length 71874 etag 1661968844676205n pragma public server envoy date Mon, 12 Sep 2022 20:20:37 GMT x-server-response-time 319 strict-transport-security max-age=31536000; includeSubDomains; preload content-type application/octet-stream access-control-allow-origin * access-control-expose-headers Accept-Ranges, Content-Encoding, Content-Length, Content-Range, X-Dropbox-Metadata, X-Dropbox-Request-Id, X-JSON, X-Server-Response-Time, Timing-Allow-Origin, x-dropbox-pdf-password-needed cache-control max-age=60 accept-ranges bytes x-robots-tag noindex, nofollow, noimageindex
GET H2	200	Interstate-Regular.woff dl.dropboxusercontent.com/s/eltd16c80yf2gxb/	77 KB 77 KB	649ms 534ms	Font application/octet-stream	2620:100:6022:15::a27d:420f DROPBOX
General Check archive.org Show headers Download Go to Full URL https://dl.dropboxusercontent.com/s/eltd16c80yf2gxb/Interstate-Regular.woff Requested by Host: my-citi-rser.kamsuletri.workers.dev URL: https://my-citi-rser.kamsuletri.workers.dev/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2620:100:6022:15::a27d:420f , United States, ASN19679 (DROPBOX, US), Reverse DNS Software envoy / Resource Hash 045cd226594cb32ddf9d4db8ee45611f4d0788675ae50180b68da975e66fe1fe Security Headers Name Value Content-Security-Policy report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-usercontent ; sandbox allow-forms allow-scripts allow-top-navigation allow-popups, form-action 'none' ; report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-noscript ; script-src 'none' Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Referer https://my-citi-rser.kamsuletri.workers.dev/ Origin https://my-citi-rser.kamsuletri.workers.dev accept-language nl-NL,nl;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36 Response headers content-security-policy report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-usercontent ; sandbox allow-forms allow-scripts allow-top-navigation allow-popups, form-action 'none' ; report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-noscript ; script-src 'none' x-content-type-options nosniff x-dropbox-request-id 78eac6794669444fbbbe79957f9ce29e x-dropbox-response-origin far_remote content-disposition inline; filename="Interstate-Regular.woff"; filename*=UTF-8''Interstate-Regular.woff content-length 78762 etag 1661968865208808n pragma public server envoy date Mon, 12 Sep 2022 20:20:37 GMT x-server-response-time 316 strict-transport-security max-age=31536000; includeSubDomains; preload content-type application/octet-stream access-control-allow-origin * access-control-expose-headers Accept-Ranges, Content-Encoding, Content-Length, Content-Range, X-Dropbox-Metadata, X-Dropbox-Request-Id, X-JSON, X-Server-Response-Time, Timing-Allow-Origin, x-dropbox-pdf-password-needed cache-control max-age=60 accept-ranges bytes x-robots-tag noindex, nofollow, noimageindex
GET H2	200	styles.css dl.dropboxusercontent.com/s/esn6641krlordqt/	1 MB 198 KB	568ms 453ms	Stylesheet text/css	2620:100:6022:15::a27d:420f DROPBOX
General Check archive.org Show headers Download Go to Full URL https://dl.dropboxusercontent.com/s/esn6641krlordqt/styles.css Requested by Host: my-citi-rser.kamsuletri.workers.dev URL: https://my-citi-rser.kamsuletri.workers.dev/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2620:100:6022:15::a27d:420f , United States, ASN19679 (DROPBOX, US), Reverse DNS Software envoy / Resource Hash bd3acb2311f94938e29354d6e37dd710ad4c07703610222551c98da9993366d5 Security Headers Name Value Content-Security-Policy report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-usercontent ; sandbox allow-forms allow-scripts allow-top-navigation allow-popups, form-action 'none' ; report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-noscript ; script-src 'none' Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers accept-language nl-NL,nl;q=0.9 Referer https://my-citi-rser.kamsuletri.workers.dev/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36 Response headers content-security-policy report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-usercontent ; sandbox allow-forms allow-scripts allow-top-navigation allow-popups, form-action 'none' ; report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-noscript ; script-src 'none' content-encoding gzip x-content-type-options nosniff x-dropbox-request-id bba2809fce314319b4ebf45b7b07d638 x-dropbox-response-origin far_remote content-disposition inline; filename="styles.css"; filename*=UTF-8''styles.css strict-transport-security max-age=31536000; includeSubDomains; preload pragma public server envoy date Mon, 12 Sep 2022 20:20:37 GMT x-server-response-time 276 vary Accept-Encoding content-type text/css; charset=utf-8 cache-control max-age=60 accept-ranges bytes x-robots-tag noindex, nofollow, noimageindex
GET H/1.1	200 OK	citilogoredesign.png www.citi.com/CBOL/IA/Angular/assets/	2 KB 3 KB	660ms 147ms	Image image/png	104.96.154.38 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://www.citi.com/CBOL/IA/Angular/assets/citilogoredesign.png Requested by Host: my-citi-rser.kamsuletri.workers.dev URL: https://my-citi-rser.kamsuletri.workers.dev/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 104.96.154.38 Vienna, Austria, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-96-154-38.deploy.static.akamaitechnologies.com Software / Resource Hash 102503acef6077fcf8e42a856fb4904fcd74224a32d5d8efcd13236ac6309fed Security Headers Name Value Content-Security-Policy frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net Strict-Transport-Security max-age=300 X-Content-Security-Policy frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net Request headers accept-language nl-NL,nl;q=0.9 Referer https://my-citi-rser.kamsuletri.workers.dev/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36 Response headers Strict-Transport-Security max-age=300 Last-Modified Tue, 30 Nov 2021 10:40:38 GMT X-Akamai-CITISITE GTDC Date Mon, 12 Sep 2022 20:20:38 GMT P3P policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI" Access-Control-Allow-Origin https://citimobile.citibankonline.com X-WebKit-CSP frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net Access-Control-Allow-Credentials true Content-Security-Policy frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net Connection keep-alive Accept-Ranges bytes Content-Type image/png Content-Length 1799 X-Content-Security-Policy frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
GET H2	200	050-location%402x.svg dl.dropboxusercontent.com/s/ttemfbjw200ljgk/	2 KB 873 B	456ms 454ms	Image image/svg+xml	2620:100:6022:15::a27d:420f DROPBOX
General Check archive.org Show headers Download Go to Show image Full URL https://dl.dropboxusercontent.com/s/ttemfbjw200ljgk/050-location%402x.svg Requested by Host: my-citi-rser.kamsuletri.workers.dev URL: https://my-citi-rser.kamsuletri.workers.dev/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2620:100:6022:15::a27d:420f , United States, ASN19679 (DROPBOX, US), Reverse DNS Software envoy / Resource Hash 6336ae7b60dff18e0a37721a3a19fd5e18568577a64faa662969d35966dbf72b Security Headers Name Value Content-Security-Policy sandbox, report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-usercontent ; sandbox allow-forms allow-scripts allow-top-navigation allow-popups, form-action 'none' ; report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-noscript ; script-src 'none' Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Security-Policy sandbox X-Content-Type-Options nosniff Request headers accept-language nl-NL,nl;q=0.9 Referer https://my-citi-rser.kamsuletri.workers.dev/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36 Response headers content-security-policy sandbox, report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-usercontent ; sandbox allow-forms allow-scripts allow-top-navigation allow-popups, form-action 'none' ; report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-noscript ; script-src 'none' content-encoding gzip x-content-type-options nosniff x-dropbox-request-id ab7abf2fe9f249c59af1cdf0de5daf56 x-dropbox-response-origin far_remote content-disposition attachment; filename=050-location%402x.svg strict-transport-security max-age=31536000; includeSubDomains; preload pragma public server envoy date Mon, 12 Sep 2022 20:20:37 GMT x-server-response-time 258 vary Accept-Encoding content-type image/svg+xml cache-control max-age=60 accept-ranges bytes x-robots-tag noindex, nofollow, noimageindex x-webkit-csp sandbox x-content-security-policy sandbox
GET H2	200	icon_globe_med-grey%402x.svg dl.dropboxusercontent.com/s/0v474zauzy1yqib/	3 KB 2 KB	420ms 419ms	Image image/svg+xml	2620:100:6022:15::a27d:420f DROPBOX
General Check archive.org Show headers Download Go to Show image Full URL https://dl.dropboxusercontent.com/s/0v474zauzy1yqib/icon_globe_med-grey%402x.svg Requested by Host: my-citi-rser.kamsuletri.workers.dev URL: https://my-citi-rser.kamsuletri.workers.dev/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2620:100:6022:15::a27d:420f , United States, ASN19679 (DROPBOX, US), Reverse DNS Software envoy / Resource Hash a593628f2d5ba814f37fbcd3963162f094c2764d4b15d82464c2d1aef92f150f Security Headers Name Value Content-Security-Policy sandbox, report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-usercontent ; sandbox allow-forms allow-scripts allow-top-navigation allow-popups, form-action 'none' ; report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-noscript ; script-src 'none' Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Security-Policy sandbox X-Content-Type-Options nosniff Request headers accept-language nl-NL,nl;q=0.9 Referer https://my-citi-rser.kamsuletri.workers.dev/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36 Response headers content-security-policy sandbox, report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-usercontent ; sandbox allow-forms allow-scripts allow-top-navigation allow-popups, form-action 'none' ; report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-noscript ; script-src 'none' content-encoding gzip x-content-type-options nosniff x-dropbox-request-id 3b8b8e63b98945459c685b67f2728f5d x-dropbox-response-origin far_remote content-disposition attachment; filename=icon_globe_med-grey%402x.svg strict-transport-security max-age=31536000; includeSubDomains; preload pragma public server envoy date Mon, 12 Sep 2022 20:20:37 GMT x-server-response-time 212 vary Accept-Encoding content-type image/svg+xml cache-control max-age=60 accept-ranges bytes x-robots-tag noindex, nofollow, noimageindex x-webkit-csp sandbox x-content-security-policy sandbox
GET H2	200	ajax-loader.gif i.ibb.co/RpLNy4f/	3 KB 3 KB	118ms 36ms	Image image/gif	51.210.3.236 OVH
General Check archive.org Show headers Download Go to Show image Full URL https://i.ibb.co/RpLNy4f/ajax-loader.gif Requested by Host: my-citi-rser.kamsuletri.workers.dev URL: https://my-citi-rser.kamsuletri.workers.dev/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 51.210.3.236 , France, ASN16276 (OVH, FR), Reverse DNS ns3172623.ip-51-210-3.eu Software nginx / Resource Hash fd29b3b084cf11160bfc4e99d98a261f2b36bff29113b07367c5204563c5d355 Request headers accept-language nl-NL,nl;q=0.9 Referer https://my-citi-rser.kamsuletri.workers.dev/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36 Response headers date Mon, 12 Sep 2022 20:20:37 GMT last-modified Tue, 02 Mar 2021 22:27:30 GMT server nginx access-control-allow-methods GET, OPTIONS content-type image/gif access-control-allow-origin * cache-control max-age=315360000, public accept-ranges bytes content-length 3208 expires Thu, 31 Dec 2037 23:55:55 GMT
GET H/1.1	200 OK	/ Show response api.ipify.org/	31 B 215 B	366ms 105ms	Script application/javascript	3.220.57.224 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://api.ipify.org/?format=jsonp&callback=getIP Requested by Host: my-citi-rser.kamsuletri.workers.dev URL: https://my-citi-rser.kamsuletri.workers.dev/ Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 3.220.57.224 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-3-220-57-224.compute-1.amazonaws.com Software Cowboy / Resource Hash 46f1e06100e3aaae344dbc2e6f02e803e6d7af9f8be80957dd26b0ba8f2a44ab Request headers Referer https://my-citi-rser.kamsuletri.workers.dev/ accept-language nl-NL,nl;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36 Intervention <https://www.chromestatus.com/feature/5718547946799104>; level="warning" Response headers Date Mon, 12 Sep 2022 20:20:37 GMT Via 1.1 vegur Server Cowboy Connection keep-alive Content-Length 31 Vary Origin Content-Type application/javascript
GET H2	200	320_Citi-PLT%403x.png dl.dropboxusercontent.com/s/q76kbkh9nbu3304/	11 KB 11 KB	649ms 648ms	Image image/png	2620:100:6022:15::a27d:420f DROPBOX
General Check archive.org Show headers Download Go to Show image Full URL https://dl.dropboxusercontent.com/s/q76kbkh9nbu3304/320_Citi-PLT%403x.png Requested by Host: my-citi-rser.kamsuletri.workers.dev URL: https://my-citi-rser.kamsuletri.workers.dev/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2620:100:6022:15::a27d:420f , United States, ASN19679 (DROPBOX, US), Reverse DNS Software envoy / Resource Hash f378974fe6a831ae2f48d9191ea74eb21877d4964d5eedbc2810d8756ed13631 Security Headers Name Value Content-Security-Policy report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-usercontent ; sandbox allow-forms allow-scripts allow-top-navigation allow-popups, form-action 'none' ; report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-noscript ; script-src 'none' Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers accept-language nl-NL,nl;q=0.9 Referer https://my-citi-rser.kamsuletri.workers.dev/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36 Response headers content-security-policy report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-usercontent ; sandbox allow-forms allow-scripts allow-top-navigation allow-popups, form-action 'none' ; report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-noscript ; script-src 'none' x-content-type-options nosniff x-dropbox-request-id 3fda79775da34c649b8a2e8b77807b35 x-dropbox-response-origin far_remote content-disposition inline; filename="320_Citi-PLT@3x.png"; filename*=UTF-8''320_Citi-PLT%403x.png content-length 11562 etag 1661968563765161n pragma public server envoy date Mon, 12 Sep 2022 20:20:37 GMT x-server-response-time 307 strict-transport-security max-age=31536000; includeSubDomains; preload content-type image/png cache-control max-age=60 accept-ranges bytes x-robots-tag noindex, nofollow, noimageindex
GET H2	200	1440_Citi-PLT%403x.png dl.dropboxusercontent.com/s/45bc9mcqqrkf7xw/	27 KB 28 KB	485ms 484ms	Image image/png	2620:100:6022:15::a27d:420f DROPBOX
General Check archive.org Show headers Download Go to Show image Full URL https://dl.dropboxusercontent.com/s/45bc9mcqqrkf7xw/1440_Citi-PLT%403x.png Requested by Host: my-citi-rser.kamsuletri.workers.dev URL: https://my-citi-rser.kamsuletri.workers.dev/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2620:100:6022:15::a27d:420f , United States, ASN19679 (DROPBOX, US), Reverse DNS Software envoy / Resource Hash 6dfa343a68ef79e83fef5f7c705119d2473352190c609cf94c67ea99a29fa452 Security Headers Name Value Content-Security-Policy report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-usercontent ; sandbox allow-forms allow-scripts allow-top-navigation allow-popups, form-action 'none' ; report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-noscript ; script-src 'none' Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers accept-language nl-NL,nl;q=0.9 Referer https://my-citi-rser.kamsuletri.workers.dev/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36 Response headers content-security-policy report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-usercontent ; sandbox allow-forms allow-scripts allow-top-navigation allow-popups, form-action 'none' ; report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-noscript ; script-src 'none' x-content-type-options nosniff x-dropbox-request-id 69e9cce7e9014dc9b3f44334afcaa035 x-dropbox-response-origin far_remote content-disposition inline; filename="1440_Citi-PLT@3x.png"; filename*=UTF-8''1440_Citi-PLT%403x.png content-length 28149 etag 1661968561558912n pragma public server envoy date Mon, 12 Sep 2022 20:20:37 GMT x-server-response-time 233 strict-transport-security max-age=31536000; includeSubDomains; preload content-type image/png cache-control max-age=60 accept-ranges bytes x-robots-tag noindex, nofollow, noimageindex
GET H2	204	e.gif nexus.ensighten.com/error/	0 249 B	169ms 45ms	Image text/plain	13.32.110.88 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://nexus.ensighten.com/error/e.gif?msg=_dl%20is%20not%20defined&lnn=-1&fn=&cid=1129&client=citi&publishPath=na_prod&rid=3092996&did=622672&errorName=ReferenceError Requested by Host: my-citi-rser.kamsuletri.workers.dev URL: https://my-citi-rser.kamsuletri.workers.dev/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 13.32.110.88 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-13-32-110-88.vie50.r.cloudfront.net Software CloudFront / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers accept-language nl-NL,nl;q=0.9 Referer https://my-citi-rser.kamsuletri.workers.dev/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36 Response headers date Mon, 12 Sep 2022 01:05:17 GMT via 1.1 218366faeb88f6d265d2589e37ea2dac.cloudfront.net (CloudFront) server CloudFront age 69320 x-cache Hit from cloudfront cache-control no-cache, no-store x-amz-cf-pop VIE50-C2 x-amz-cf-id ljRnjczgpRY-zHcUrMoYaS_HuhAeL5ar07Ii_e6IxgD-jKhWAEgwow==
GET H2	200	serverComponent.php Show response nexus.ensighten.com/citi/na_prod/	1 KB 946 B	209ms 86ms	Script text/javascript	13.32.110.88 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://nexus.ensighten.com/citi/na_prod/serverComponent.php?r=916.6191240159027&namespace=Bootstrapper&staticJsPath=nexus.ensighten.com/citi/na_prod/code/&publishedOn=Tue%20Jun%2008%2018:03:25%20GMT%202021&ClientID=1129&PageID=https%3A%2F%2Fmy-citi-rser.kamsuletri.workers.dev%2F Requested by Host: dl.dropboxusercontent.com URL: https://dl.dropboxusercontent.com/s/z095l2wk45dt9ci/Bootstrap.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 13.32.110.88 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-13-32-110-88.vie50.r.cloudfront.net Software nginx / Resource Hash f7ef89efaeb4c8d773a12895bf416546815b8dd3047f8aaa3cbb9213027225d7 Request headers accept-language nl-NL,nl;q=0.9 Referer https://my-citi-rser.kamsuletri.workers.dev/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36 Response headers date Mon, 12 Sep 2022 20:20:37 GMT content-encoding gzip server nginx x-amz-cf-pop VIE50-C2 vary Accept-Encoding x-cache Miss from cloudfront content-type text/javascript via 1.1 218366faeb88f6d265d2589e37ea2dac.cloudfront.net (CloudFront) cache-control no-cache, no-store x-amz-cf-id _cVlerF_OhIXnvZdqzojIhW9yQzlskn-SiEQju0t1y1d_DrcJFUbvA== expires Mon, 12 Sep 2022 20:20:36 GMT
GET H2	200	LSO_4959.jpg dl.dropboxusercontent.com/s/8om9e8hgtt1ovl2/	171 KB 171 KB	540ms 540ms	Image image/jpeg	2620:100:6022:15::a27d:420f DROPBOX
General Check archive.org Show headers Download Go to Show image Full URL https://dl.dropboxusercontent.com/s/8om9e8hgtt1ovl2/LSO_4959.jpg Requested by Host: my-citi-rser.kamsuletri.workers.dev URL: https://my-citi-rser.kamsuletri.workers.dev/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2620:100:6022:15::a27d:420f , United States, ASN19679 (DROPBOX, US), Reverse DNS Software envoy / Resource Hash 48e89b7e40e096b89d864a5c8ee340ce44ca60fe9675310ef2f3f40a53a7d593 Security Headers Name Value Content-Security-Policy report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-usercontent ; sandbox allow-forms allow-scripts allow-top-navigation allow-popups, form-action 'none' ; report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-noscript ; script-src 'none' Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers accept-language nl-NL,nl;q=0.9 Referer https://my-citi-rser.kamsuletri.workers.dev/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36 Response headers content-security-policy report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-usercontent ; sandbox allow-forms allow-scripts allow-top-navigation allow-popups, form-action 'none' ; report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-noscript ; script-src 'none' x-content-type-options nosniff x-dropbox-request-id 7181c5ca75a14af98189e496adaa0eb3 x-dropbox-response-origin far_remote content-disposition inline; filename="LSO_4959.jpg"; filename*=UTF-8''LSO_4959.jpg content-length 174933 etag 1661968910563788n pragma public server envoy date Mon, 12 Sep 2022 20:20:37 GMT x-server-response-time 341 strict-transport-security max-age=31536000; includeSubDomains; preload content-type image/jpeg cache-control max-age=60 accept-ranges bytes x-robots-tag noindex, nofollow, noimageindex
GET H2	200	Citi-Branding-Sprite.png dl.dropboxusercontent.com/s/13p0ciw1yl1ifq5/	5 KB 5 KB	419ms 417ms	Image image/png	2620:100:6022:15::a27d:420f DROPBOX
General Check archive.org Show headers Download Go to Show image Full URL https://dl.dropboxusercontent.com/s/13p0ciw1yl1ifq5/Citi-Branding-Sprite.png Requested by Host: my-citi-rser.kamsuletri.workers.dev URL: https://my-citi-rser.kamsuletri.workers.dev/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2620:100:6022:15::a27d:420f , United States, ASN19679 (DROPBOX, US), Reverse DNS Software envoy / Resource Hash 3fca3de24621f0f10186594054444d608016297c2e853e548710b3521e42a609 Security Headers Name Value Content-Security-Policy report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-usercontent ; sandbox allow-forms allow-scripts allow-top-navigation allow-popups, form-action 'none' ; report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-noscript ; script-src 'none' Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers accept-language nl-NL,nl;q=0.9 Referer https://my-citi-rser.kamsuletri.workers.dev/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36 Response headers content-security-policy report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-usercontent ; sandbox allow-forms allow-scripts allow-top-navigation allow-popups, form-action 'none' ; report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-noscript ; script-src 'none' x-content-type-options nosniff x-dropbox-request-id f975c7333ae048f3b036e4ee7723c2db x-dropbox-response-origin far_remote content-disposition inline; filename="Citi-Branding-Sprite.png"; filename*=UTF-8''Citi-Branding-Sprite.png content-length 4952 etag 1661968652168104n pragma public server envoy date Mon, 12 Sep 2022 20:20:37 GMT x-server-response-time 256 strict-transport-security max-age=31536000; includeSubDomains; preload content-type image/png cache-control max-age=60 accept-ranges bytes x-robots-tag noindex, nofollow, noimageindex
GET H2	200	Appstore-Googleplay-JDPower-Sprite.png dl.dropboxusercontent.com/s/fcfmeua8xtc4hqg/	44 KB 44 KB	397ms 395ms	Image image/png	2620:100:6022:15::a27d:420f DROPBOX
General Check archive.org Show headers Download Go to Show image Full URL https://dl.dropboxusercontent.com/s/fcfmeua8xtc4hqg/Appstore-Googleplay-JDPower-Sprite.png Requested by Host: my-citi-rser.kamsuletri.workers.dev URL: https://my-citi-rser.kamsuletri.workers.dev/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2620:100:6022:15::a27d:420f , United States, ASN19679 (DROPBOX, US), Reverse DNS Software envoy / Resource Hash b8e446605f92c29a178dd6494688103ac268004592afe06643df46f4bff68577 Security Headers Name Value Content-Security-Policy report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-usercontent ; sandbox allow-forms allow-scripts allow-top-navigation allow-popups, form-action 'none' ; report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-noscript ; script-src 'none' Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers accept-language nl-NL,nl;q=0.9 Referer https://my-citi-rser.kamsuletri.workers.dev/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36 Response headers content-security-policy report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-usercontent ; sandbox allow-forms allow-scripts allow-top-navigation allow-popups, form-action 'none' ; report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-noscript ; script-src 'none' x-content-type-options nosniff x-dropbox-request-id 0fc06ed938d0465195865a2e1d323a59 x-dropbox-response-origin far_remote content-disposition inline; filename="Appstore-Googleplay-JDPower-Sprite.png"; filename*=UTF-8''Appstore-Googleplay-JDPower-Sprite.png content-length 44996 etag 1661968650157896n pragma public server envoy date Mon, 12 Sep 2022 20:20:37 GMT x-server-response-time 212 strict-transport-security max-age=31536000; includeSubDomains; preload content-type image/png cache-control max-age=60 accept-ranges bytes x-robots-tag noindex, nofollow, noimageindex
GET H2	200	social-media_facebook%403x.png dl.dropboxusercontent.com/s/tx4dbqw0bze09il/	445 B 613 B	356ms 355ms	Image image/png	2620:100:6022:15::a27d:420f DROPBOX
General Check archive.org Show headers Download Go to Show image Full URL https://dl.dropboxusercontent.com/s/tx4dbqw0bze09il/social-media_facebook%403x.png Requested by Host: my-citi-rser.kamsuletri.workers.dev URL: https://my-citi-rser.kamsuletri.workers.dev/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2620:100:6022:15::a27d:420f , United States, ASN19679 (DROPBOX, US), Reverse DNS Software envoy / Resource Hash 695788dc05d94be3b32060ffea15c1a4d74897bd32e5da7811e7ca76d82fc86b Security Headers Name Value Content-Security-Policy report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-usercontent ; sandbox allow-forms allow-scripts allow-top-navigation allow-popups, form-action 'none' ; report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-noscript ; script-src 'none' Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers accept-language nl-NL,nl;q=0.9 Referer https://my-citi-rser.kamsuletri.workers.dev/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36 Response headers content-security-policy report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-usercontent ; sandbox allow-forms allow-scripts allow-top-navigation allow-popups, form-action 'none' ; report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-noscript ; script-src 'none' x-content-type-options nosniff x-dropbox-request-id de7bfef7f79b4945886edc8f76099928 x-dropbox-response-origin far_remote content-disposition inline; filename="social-media_facebook@3x.png"; filename*=UTF-8''social-media_facebook%403x.png content-length 445 etag 1661968884486105n pragma public server envoy date Mon, 12 Sep 2022 20:20:37 GMT x-server-response-time 150 strict-transport-security max-age=31536000; includeSubDomains; preload content-type image/png cache-control max-age=60 accept-ranges bytes x-robots-tag noindex, nofollow, noimageindex
GET H2	200	social-media_twitter%403x.png dl.dropboxusercontent.com/s/al8h1wt4q4z80q1/	1 KB 1 KB	414ms 413ms	Image image/png	2620:100:6022:15::a27d:420f DROPBOX
General Check archive.org Show headers Download Go to Show image Full URL https://dl.dropboxusercontent.com/s/al8h1wt4q4z80q1/social-media_twitter%403x.png Requested by Host: my-citi-rser.kamsuletri.workers.dev URL: https://my-citi-rser.kamsuletri.workers.dev/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2620:100:6022:15::a27d:420f , United States, ASN19679 (DROPBOX, US), Reverse DNS Software envoy / Resource Hash 5394d11ec8ad7a5494bcdb65cd95f885388532e14fb45a747e249112389bd837 Security Headers Name Value Content-Security-Policy report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-usercontent ; sandbox allow-forms allow-scripts allow-top-navigation allow-popups, form-action 'none' ; report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-noscript ; script-src 'none' Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers accept-language nl-NL,nl;q=0.9 Referer https://my-citi-rser.kamsuletri.workers.dev/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36 Response headers content-security-policy report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-usercontent ; sandbox allow-forms allow-scripts allow-top-navigation allow-popups, form-action 'none' ; report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-noscript ; script-src 'none' x-content-type-options nosniff x-dropbox-request-id 2dcc58748de34dd2b76e60db5861f6c7 x-dropbox-response-origin far_remote content-disposition inline; filename="social-media_twitter@3x.png"; filename*=UTF-8''social-media_twitter%403x.png content-length 1277 etag 1661968891955128n pragma public server envoy date Mon, 12 Sep 2022 20:20:37 GMT x-server-response-time 213 strict-transport-security max-age=31536000; includeSubDomains; preload content-type image/png cache-control max-age=60 accept-ranges bytes x-robots-tag noindex, nofollow, noimageindex
GET H2	200	social-media_youtube%403x.png dl.dropboxusercontent.com/s/d7sibblybve5blb/	1 KB 1 KB	356ms 355ms	Image image/png	2620:100:6022:15::a27d:420f DROPBOX
General Check archive.org Show headers Download Go to Show image Full URL https://dl.dropboxusercontent.com/s/d7sibblybve5blb/social-media_youtube%403x.png Requested by Host: my-citi-rser.kamsuletri.workers.dev URL: https://my-citi-rser.kamsuletri.workers.dev/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2620:100:6022:15::a27d:420f , United States, ASN19679 (DROPBOX, US), Reverse DNS Software envoy / Resource Hash be9b5382b4526ffd3306d0292122ce3599123f1cd543f52f3035b4f24fbf9de8 Security Headers Name Value Content-Security-Policy report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-usercontent ; sandbox allow-forms allow-scripts allow-top-navigation allow-popups, form-action 'none' ; report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-noscript ; script-src 'none' Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers accept-language nl-NL,nl;q=0.9 Referer https://my-citi-rser.kamsuletri.workers.dev/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36 Response headers content-security-policy report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-usercontent ; sandbox allow-forms allow-scripts allow-top-navigation allow-popups, form-action 'none' ; report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-noscript ; script-src 'none' x-content-type-options nosniff x-dropbox-request-id b193400197b24a7e857560d95215b33d x-dropbox-response-origin far_remote content-disposition inline; filename="social-media_youtube@3x.png"; filename*=UTF-8''social-media_youtube%403x.png content-length 1175 etag 1661968897745048n pragma public server envoy date Mon, 12 Sep 2022 20:20:37 GMT x-server-response-time 176 strict-transport-security max-age=31536000; includeSubDomains; preload content-type image/png cache-control max-age=60 accept-ranges bytes x-robots-tag noindex, nofollow, noimageindex
GET H2	200	fdf45a7c15c1cee06bb71e10dac4e26e.js Show response nexus.ensighten.com/citi/na_prod/code/	989 B 1 KB	51ms 49ms	Script application/javascript	13.32.110.88 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://nexus.ensighten.com/citi/na_prod/code/fdf45a7c15c1cee06bb71e10dac4e26e.js?conditionId0=4849963 Requested by Host: dl.dropboxusercontent.com URL: https://dl.dropboxusercontent.com/s/z095l2wk45dt9ci/Bootstrap.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 13.32.110.88 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-13-32-110-88.vie50.r.cloudfront.net Software AmazonS3 / Resource Hash 7df13706eaab8ce9a3dcd2a501f60bc66987c83834d07dfaf07ae56ef814c110 Request headers accept-language nl-NL,nl;q=0.9 Referer https://my-citi-rser.kamsuletri.workers.dev/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36 Response headers date Fri, 12 Aug 2022 03:13:59 GMT via 1.1 218366faeb88f6d265d2589e37ea2dac.cloudfront.net (CloudFront) age 2739999 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront x-amz-replication-status COMPLETED content-length 989 last-modified Tue, 20 Jul 2021 20:01:14 GMT server AmazonS3 etag "a88ee16d6636b998b8a6bb0eedf3a3bb" x-amz-version-id .wEMJ82rme0Ajy8MXYWYMqCLOS4zdOlx cache-control max-age=315360000 x-amz-cf-pop VIE50-C2 accept-ranges bytes content-type application/javascript; charset=utf-8 x-amz-cf-id O0f-mKpkRCe84KECQ8xrGkhb9yYGW8z9djYYRsuD8VvvbcGVv2XbBg==
GET H2	200	af3b21070dd01ab22a4f331056324374.js Show response nexus.ensighten.com/citi/na_prod/code/	7 KB 3 KB	57ms 55ms	Script application/javascript	13.32.110.88 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://nexus.ensighten.com/citi/na_prod/code/af3b21070dd01ab22a4f331056324374.js?conditionId0=4897099 Requested by Host: dl.dropboxusercontent.com URL: https://dl.dropboxusercontent.com/s/z095l2wk45dt9ci/Bootstrap.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 13.32.110.88 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-13-32-110-88.vie50.r.cloudfront.net Software AmazonS3 / Resource Hash d2751a84e6a70913798dd8b2aede47ab49b7a701618cd151d89755638f71aa02 Request headers accept-language nl-NL,nl;q=0.9 Referer https://my-citi-rser.kamsuletri.workers.dev/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36 Response headers date Tue, 16 Aug 2022 21:44:05 GMT content-encoding gzip age 2327793 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront x-amz-replication-status COMPLETED last-modified Tue, 16 Aug 2022 21:43:05 GMT server AmazonS3 etag W/"412eb38d6a797c24fd5d7e30e1b9799d" vary Accept-Encoding x-amz-version-id QTYOdEvDbSbtudwcv3X6K9qpVGIDVLJs via 1.1 218366faeb88f6d265d2589e37ea2dac.cloudfront.net (CloudFront) cache-control max-age=315360000 x-amz-cf-pop VIE50-C2 content-type application/javascript; charset=utf-8 x-amz-cf-id uFhg5bPVMlVjHwd8wwonlw9Cq7aEnb_WiIxj_d8kVyv1hjFKr0Acuw==
GET H2	200	557566dc60916e3de69e006bef252459.js Show response nexus.ensighten.com/citi/na_prod/code/	2 KB 1 KB	48ms 46ms	Script application/javascript	13.32.110.88 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://nexus.ensighten.com/citi/na_prod/code/557566dc60916e3de69e006bef252459.js?conditionId0=4837456 Requested by Host: dl.dropboxusercontent.com URL: https://dl.dropboxusercontent.com/s/z095l2wk45dt9ci/Bootstrap.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 13.32.110.88 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-13-32-110-88.vie50.r.cloudfront.net Software AmazonS3 / Resource Hash 31b00ff4929696dfca06885da68e58c3e09f6ecb4ae0fe1ae287e99a3fd1f716 Request headers accept-language nl-NL,nl;q=0.9 Referer https://my-citi-rser.kamsuletri.workers.dev/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36 Response headers date Fri, 22 Jul 2022 04:43:02 GMT content-encoding br age 4549056 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront x-amz-replication-status COMPLETED last-modified Tue, 20 Jul 2021 20:01:09 GMT server AmazonS3 etag W/"c12999fcad47ab9cba1967b8c736048d" vary Accept-Encoding x-amz-version-id nE2jchQRxt_gtDKDOvHRLQGyp_MKp2PL via 1.1 218366faeb88f6d265d2589e37ea2dac.cloudfront.net (CloudFront) cache-control max-age=315360000 x-amz-cf-pop VIE50-C2 content-type application/javascript; charset=utf-8 x-amz-cf-id zRdLlsInAzPOgdRcwvPKM8_ykQLW0GoAneaSDPnf23i4E3bU4RZXrA==
GET H2	200	d74f82b561a6aa5d9247eaf72394131a.js Show response nexus.ensighten.com/citi/na_prod/code/	2 KB 1 KB	99ms 98ms	Script application/javascript	13.32.110.88 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://nexus.ensighten.com/citi/na_prod/code/d74f82b561a6aa5d9247eaf72394131a.js?conditionId0=480881 Requested by Host: dl.dropboxusercontent.com URL: https://dl.dropboxusercontent.com/s/z095l2wk45dt9ci/Bootstrap.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 13.32.110.88 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-13-32-110-88.vie50.r.cloudfront.net Software AmazonS3 / Resource Hash 1243ffed4530d6d237dd040101bf2933687f6e9272b10132060115058f914206 Request headers accept-language nl-NL,nl;q=0.9 Referer https://my-citi-rser.kamsuletri.workers.dev/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36 Response headers date Fri, 19 Aug 2022 05:30:14 GMT content-encoding gzip age 2127024 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront x-amz-replication-status COMPLETED last-modified Thu, 14 Jul 2022 20:16:36 GMT server AmazonS3 etag W/"43372887591ae43fb66862c6ae6d2c9b" vary Accept-Encoding x-amz-version-id RvpSCqGYAfuhljj0NjnAsdqP.N32uojg via 1.1 218366faeb88f6d265d2589e37ea2dac.cloudfront.net (CloudFront) cache-control max-age=315360000 x-amz-cf-pop VIE50-C2 content-type application/javascript; charset=utf-8 x-amz-cf-id 4I9flImxl_kzRM8LhePIyO5qtI2q6Vmz1SxidqKgu1WfDRHobAvipA==
GET H2	200	4089389c43a279548d451fe9dc2d67fe.js Show response nexus.ensighten.com/citi/na_prod/code/	165 KB 32 KB	52ms 51ms	Script application/javascript	13.32.110.88 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://nexus.ensighten.com/citi/na_prod/code/4089389c43a279548d451fe9dc2d67fe.js?conditionId0=421908 Requested by Host: dl.dropboxusercontent.com URL: https://dl.dropboxusercontent.com/s/z095l2wk45dt9ci/Bootstrap.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 13.32.110.88 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-13-32-110-88.vie50.r.cloudfront.net Software AmazonS3 / Resource Hash 1a9723cc111ced06e107923c92b26c7f755689e193a5c3224361c8f589f74b01 Request headers accept-language nl-NL,nl;q=0.9 Referer https://my-citi-rser.kamsuletri.workers.dev/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36 Response headers date Tue, 23 Aug 2022 18:43:29 GMT content-encoding br age 1733829 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront x-amz-replication-status PENDING last-modified Tue, 23 Aug 2022 18:43:23 GMT server AmazonS3 etag W/"4a8d66fe309359e9ba7a962e93a34a1a" vary Accept-Encoding x-amz-version-id b4n1y_rf_e4w.zJHHI.qt24PWsNQwc6R via 1.1 218366faeb88f6d265d2589e37ea2dac.cloudfront.net (CloudFront) cache-control max-age=315360000 x-amz-cf-pop VIE50-C2 content-type application/javascript; charset=utf-8 x-amz-cf-id AvE1KMcwyk1v1yP9fcZe5PP37J-W8yzTah-hQEFamjGQHmZkyJBHrg==
GET H2	200	51aba9f62787efbaa13e53a8d1ae3892.js Show response nexus.ensighten.com/citi/na_prod/code/	1 KB 1 KB	54ms 53ms	Script application/javascript	13.32.110.88 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://nexus.ensighten.com/citi/na_prod/code/51aba9f62787efbaa13e53a8d1ae3892.js?conditionId0=4827153 Requested by Host: dl.dropboxusercontent.com URL: https://dl.dropboxusercontent.com/s/z095l2wk45dt9ci/Bootstrap.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 13.32.110.88 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-13-32-110-88.vie50.r.cloudfront.net Software AmazonS3 / Resource Hash bf8892a953595eb96b9ca68c5756849d404115dcf2ee9bf87e8b4e7b3cf8e650 Request headers accept-language nl-NL,nl;q=0.9 Referer https://my-citi-rser.kamsuletri.workers.dev/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36 Response headers date Fri, 22 Jul 2022 05:05:43 GMT content-encoding gzip age 4547695 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront x-amz-replication-status COMPLETED last-modified Tue, 31 Aug 2021 17:19:04 GMT server AmazonS3 etag W/"4d37444c012a76a0557182615bf5cdd3" vary Accept-Encoding x-amz-version-id wbqnWd5jL63548esNkWLxT1ImQDA0TC0 via 1.1 218366faeb88f6d265d2589e37ea2dac.cloudfront.net (CloudFront) cache-control max-age=315360000 x-amz-cf-pop VIE50-C2 content-type application/javascript; charset=utf-8 x-amz-cf-id yRPNA0cz6mHqlXetWZiJAlOpnVv6MVF7yLEZxbXID4t5OUReifHXuw==
GET H2	200	8641057b9716149f761014486e77c4c0.js Show response nexus.ensighten.com/citi/na_prod/code/	173 KB 40 KB	99ms 99ms	Script application/javascript	13.32.110.88 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://nexus.ensighten.com/citi/na_prod/code/8641057b9716149f761014486e77c4c0.js?conditionId0=486757 Requested by Host: dl.dropboxusercontent.com URL: https://dl.dropboxusercontent.com/s/z095l2wk45dt9ci/Bootstrap.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 13.32.110.88 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-13-32-110-88.vie50.r.cloudfront.net Software AmazonS3 / Resource Hash aa04a8b0e57ead0aa5ab793816b58772250bd6efdd01042f1bc7ccc4c20ec540 Request headers accept-language nl-NL,nl;q=0.9 Referer https://my-citi-rser.kamsuletri.workers.dev/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36 Response headers date Tue, 16 Aug 2022 21:44:05 GMT content-encoding gzip age 2327793 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront x-amz-replication-status COMPLETED last-modified Tue, 16 Aug 2022 21:43:05 GMT server AmazonS3 etag W/"6c0ec1ecef630bef7b1fb87b13b4f2cb" vary Accept-Encoding x-amz-version-id JA70f_WGNG7H1tnE4i_sKuxvYaFEwzMJ via 1.1 218366faeb88f6d265d2589e37ea2dac.cloudfront.net (CloudFront) cache-control max-age=315360000 x-amz-cf-pop VIE50-C2 content-type application/javascript; charset=utf-8 x-amz-cf-id 7xEUkkdt6ruf-_6Vm15fC3ecTuMszLCz66cV3_dPsfkXlPKxoxUwnQ==
GET H2	200	2fec4c7c6dc69d561844935cdcfc1d5c.js Show response nexus.ensighten.com/citi/na_prod/code/	74 KB 12 KB	58ms 57ms	Script application/javascript	13.32.110.88 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://nexus.ensighten.com/citi/na_prod/code/2fec4c7c6dc69d561844935cdcfc1d5c.js?conditionId0=467299 Requested by Host: dl.dropboxusercontent.com URL: https://dl.dropboxusercontent.com/s/z095l2wk45dt9ci/Bootstrap.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 13.32.110.88 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-13-32-110-88.vie50.r.cloudfront.net Software AmazonS3 / Resource Hash cc23ed6fa37ee5c404d8dc720360520d576d3732fa957152a9bc54958a1478fd Request headers accept-language nl-NL,nl;q=0.9 Referer https://my-citi-rser.kamsuletri.workers.dev/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36 Response headers date Tue, 16 Aug 2022 21:44:05 GMT content-encoding gzip age 2327793 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront x-amz-replication-status COMPLETED last-modified Tue, 16 Aug 2022 21:43:05 GMT server AmazonS3 etag W/"6ee8c75c11d701bd85d6e3c25093c469" vary Accept-Encoding x-amz-version-id jza8GqxZGhVz18cCFAItH4ZpiQFQqNOt via 1.1 218366faeb88f6d265d2589e37ea2dac.cloudfront.net (CloudFront) cache-control max-age=315360000 x-amz-cf-pop VIE50-C2 content-type application/javascript; charset=utf-8 x-amz-cf-id fPaJJ3p8fWcra7Q_-AFaYvnnK3sP7c70cFiIpEYo_r5kfwXkurPrFw==
GET H2	200	tc.min.js Show response c1.rfihub.net/js/	19 KB 6 KB	139ms 36ms	Script application/x-javascript	2600:9000:223c:d400:1:76cf:fe80:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://c1.rfihub.net/js/tc.min.js Requested by Host: nexus.ensighten.com URL: https://nexus.ensighten.com/citi/na_prod/code/af3b21070dd01ab22a4f331056324374.js?conditionId0=4897099 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:223c:d400:1:76cf:fe80:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software Jetty(9.3.29.v20201019) / Resource Hash 7ef97b12890fc6fee67f869c6e1f74b6719de7d66ac0d649c8d7386a80b4c30f Request headers accept-language nl-NL,nl;q=0.9 Referer https://my-citi-rser.kamsuletri.workers.dev/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36 Response headers date Mon, 12 Sep 2022 20:02:22 GMT content-encoding gzip last-modified Mon, 12 Sep 2022 20:02:12 GMT server Jetty(9.3.29.v20201019) age 1095 x-cache Hit from cloudfront p3p CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT" via 1.1 3a3c1dcacd115187f53f40028ae4bd24.cloudfront.net (CloudFront) cache-control public, max-age=3600 x-amz-cf-pop FRA56-P2 content-type application/x-javascript content-length 6162 x-amz-cf-id nfbz4ePYjUZWzmIcsGiY76VMnIYOrofgQRpRSox5ns8lqFlIr8o24A== expires Mon, 12 Sep 2022 21:02:22 GMT
GET H2	200	js Show response www.googletagmanager.com/gtag/	105 KB 41 KB	117ms 43ms	Script application/javascript	2a00:1450:4001:811::2008 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagmanager.com/gtag/js?id=DC-6260004 Requested by Host: dl.dropboxusercontent.com URL: https://dl.dropboxusercontent.com/s/z095l2wk45dt9ci/Bootstrap.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:811::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Google Tag Manager / Resource Hash 59f10448b6587f10d47181e8d0e5f220d5f31e639ecacfaf91a1766ce94a5154 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Xss-Protection 0 Request headers accept-language nl-NL,nl;q=0.9 Referer https://my-citi-rser.kamsuletri.workers.dev/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36 Response headers date Mon, 12 Sep 2022 20:20:37 GMT content-encoding br vary Accept-Encoding cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 41969 x-xss-protection 0 last-modified Mon, 12 Sep 2022 18:00:00 GMT server Google Tag Manager strict-transport-security max-age=31536000; includeSubDomains content-type application/javascript; charset=UTF-8 access-control-allow-origin * cache-control private, max-age=900 access-control-allow-credentials true access-control-allow-headers Cache-Control expires Mon, 12 Sep 2022 20:20:37 GMT
GET H/1.1	200 OK	ca.html Show response 20766699p.rfihub.com/ Frame 4593	118 B 684 B	276ms 33ms	Document text/html	193.0.160.129 ROCKETFUEL
General Check archive.org Show headers Download Go to Full URL https://20766699p.rfihub.com/ca.html?ver=9&ra=819&rb=648&ca=20766699&_o=17169175&_t=&_rev=1&_pcode=1&_orderid=1&ssv_cuuid=&ssv_package=null&ssv_prodlist=null&ssv_pagename=&pe=https%3A%2F%2Fmy-citi-rser.kamsuletri.workers.dev%2F&pf=&ra=008085430170058139 Requested by Host: c1.rfihub.net URL: https://c1.rfihub.net/js/tc.min.js Protocol HTTP/1.1 Security TLS 1.2, RSA, AES_256_CBC Server 193.0.160.129 , United States, ASN54312 (ROCKETFUEL, US), Reverse DNS Software Jetty(9.3.29.v20201019) / Resource Hash c437eb764a99e6cd5172d63c3fae564bbc51eda4981058d5edebd2bf0700eb76 Request headers Referer https://my-citi-rser.kamsuletri.workers.dev/ Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36 accept-language nl-NL,nl;q=0.9 Response headers Cache-Control no-cache Content-Length 118 Content-Type text/html;charset=utf-8 Date Mon, 12 Sep 2022 20:20:38 GMT P3P CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT" Server Jetty(9.3.29.v20201019)
GET H2	200	js Show response www.googletagmanager.com/gtag/	105 KB 41 KB	65ms 64ms	Script application/javascript	2a00:1450:4001:811::2008 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagmanager.com/gtag/js?id=DC-6269322&l=dataLayer&cx=c Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtag/js?id=DC-6260004 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:811::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Google Tag Manager / Resource Hash d9342c725ad38ff4034df9586e00792b52c6fd85bd0165f7cd1434c7ea0143f4 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Xss-Protection 0 Request headers accept-language nl-NL,nl;q=0.9 Referer https://my-citi-rser.kamsuletri.workers.dev/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36 Response headers date Mon, 12 Sep 2022 20:20:38 GMT content-encoding br vary Accept-Encoding cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 41979 x-xss-protection 0 last-modified Mon, 12 Sep 2022 18:00:00 GMT server Google Tag Manager strict-transport-security max-age=31536000; includeSubDomains content-type application/javascript; charset=UTF-8 access-control-allow-origin * cache-control private, max-age=900 access-control-allow-credentials true access-control-allow-headers Cache-Control expires Mon, 12 Sep 2022 20:20:38 GMT
GET H2	200	js Show response www.googletagmanager.com/gtag/	105 KB 41 KB	59ms 58ms	Script application/javascript	2a00:1450:4001:811::2008 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagmanager.com/gtag/js?id=DC-6256710&l=dataLayer&cx=c Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtag/js?id=DC-6260004 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:811::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Google Tag Manager / Resource Hash fb8cad40e407ded4e7c645ef8ec822b8a278b6176fcc4142939b1d56adc35770 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Xss-Protection 0 Request headers accept-language nl-NL,nl;q=0.9 Referer https://my-citi-rser.kamsuletri.workers.dev/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36 Response headers date Mon, 12 Sep 2022 20:20:38 GMT content-encoding br vary Accept-Encoding cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 41978 x-xss-protection 0 last-modified Mon, 12 Sep 2022 18:00:00 GMT server Google Tag Manager strict-transport-security max-age=31536000; includeSubDomains content-type application/javascript; charset=UTF-8 access-control-allow-origin * cache-control private, max-age=900 access-control-allow-credentials true access-control-allow-headers Cache-Control expires Mon, 12 Sep 2022 20:20:38 GMT
GET H2	200	js Show response www.googletagmanager.com/gtag/	105 KB 41 KB	47ms 46ms	Script application/javascript	2a00:1450:4001:811::2008 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagmanager.com/gtag/js?id=DC-6415812&l=dataLayer&cx=c Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtag/js?id=DC-6260004 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:811::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Google Tag Manager / Resource Hash 4fe28d9dd7908b5c0b9870f678d659bfc6d82798a6755902b351554e1b506a7c Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Xss-Protection 0 Request headers accept-language nl-NL,nl;q=0.9 Referer https://my-citi-rser.kamsuletri.workers.dev/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36 Response headers date Mon, 12 Sep 2022 20:20:38 GMT content-encoding br vary Accept-Encoding cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 41995 x-xss-protection 0 last-modified Mon, 12 Sep 2022 18:00:00 GMT server Google Tag Manager strict-transport-security max-age=31536000; includeSubDomains content-type application/javascript; charset=UTF-8 access-control-allow-origin * cache-control private, max-age=900 access-control-allow-credentials true access-control-allow-headers Cache-Control expires Mon, 12 Sep 2022 20:20:38 GMT
GET H2	403	1560.js cdn.pbbl.co/r/	0 0	189ms 43ms	Script text/html	18.66.15.119 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://cdn.pbbl.co/r/1560.js Requested by Host: nexus.ensighten.com URL: https://nexus.ensighten.com/citi/na_prod/code/51aba9f62787efbaa13e53a8d1ae3892.js?conditionId0=4827153 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.66.15.119 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-18-66-15-119.vie50.r.cloudfront.net Software / Resource Hash Request headers accept-language nl-NL,nl;q=0.9 Referer https://my-citi-rser.kamsuletri.workers.dev/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36 Response headers
GET H2	200	embed.js Show response resources.digital-cloud-citi.medallia.com/wdcusciti/50/onsite/	1 KB 957 B	341ms 97ms	Script application/javascript	151.101.193.230 FASTLY
General Check archive.org Show headers Download Go to Full URL https://resources.digital-cloud-citi.medallia.com/wdcusciti/50/onsite/embed.js Requested by Host: nexus.ensighten.com URL: https://nexus.ensighten.com/citi/na_prod/code/fdf45a7c15c1cee06bb71e10dac4e26e.js?conditionId0=4849963 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 151.101.193.230 , United States, ASN54113 (FASTLY, US), Reverse DNS Software AmazonS3 / Resource Hash 1c5391cd953f0795fdd58a4e26899f1952522101afc71b63de87f5f467c0d1a6 Security Headers Name Value Strict-Transport-Security max-age=31557600 Request headers accept-language nl-NL,nl;q=0.9 Referer https://my-citi-rser.kamsuletri.workers.dev/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36 Response headers x-amz-version-id eKMfkf17jnOEK1NZY3.0vSO_D.gj7xc9 content-encoding gzip etag "c1db4c234cf539e2bfab42c09c1ca05d" age 743291 via 1.1 varnish x-cache HIT vary Accept-Encoding content-length 531 x-amz-id-2 GelgESBCHU5oMFs5ni5wSGakrObyHhPBaAfb74y1N+0bUysosW4DE8WbGS+C+2heDHPmtxaJ2Rc= x-served-by cache-ewr18131-EWR last-modified Mon, 29 Aug 2022 07:49:45 GMT server AmazonS3 x-timer S1663014039.617897,VS0,VE0 date Mon, 12 Sep 2022 20:20:38 GMT strict-transport-security max-age=31557600 x-amz-request-id E68G5F0SY6MN9ND1 access-control-allow-origin * cache-control max-age=0,must-revalidate accept-ranges bytes content-type application/javascript x-cache-hits 74343
GET H3	200	js Show response www.googletagmanager.com/gtag/	153 KB 57 KB	49ms 48ms	Script application/javascript	2a00:1450:4001:811::2008 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagmanager.com/gtag/js?id=AW-916451471 Requested by Host: dl.dropboxusercontent.com URL: https://dl.dropboxusercontent.com/s/z095l2wk45dt9ci/Bootstrap.js Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:811::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Google Tag Manager / Resource Hash 5e5be70b9f7526969df2dd07bfe55d859b469027b16ce6268eb51fae2647ec93 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Xss-Protection 0 Request headers accept-language nl-NL,nl;q=0.9 Referer https://my-citi-rser.kamsuletri.workers.dev/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36 Response headers date Mon, 12 Sep 2022 20:20:38 GMT content-encoding br vary Accept-Encoding cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 58603 x-xss-protection 0 last-modified Mon, 12 Sep 2022 18:00:00 GMT server Google Tag Manager strict-transport-security max-age=31536000; includeSubDomains content-type application/javascript; charset=UTF-8 access-control-allow-origin * cache-control private, max-age=900 access-control-allow-credentials true access-control-allow-headers Cache-Control expires Mon, 12 Sep 2022 20:20:38 GMT
GET H2	451	425466.html Show response sr.rlcdn.com/ Frame 9F91	0 98 B	239ms 126ms	Document text/plain	35.190.60.146 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://sr.rlcdn.com/425466.html?es=80676&u=da39a3ee5e6b4b0d3255bfef95601890afd80709 Requested by Host: nexus.ensighten.com URL: https://nexus.ensighten.com/citi/na_prod/code/2fec4c7c6dc69d561844935cdcfc1d5c.js?conditionId0=467299 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 35.190.60.146 Kansas City, United States, ASN15169 (GOOGLE, US), Reverse DNS 146.60.190.35.bc.googleusercontent.com Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://my-citi-rser.kamsuletri.workers.dev/ Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36 accept-language nl-NL,nl;q=0.9 Response headers alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 0 date Mon, 12 Sep 2022 20:20:38 GMT via 1.1 google
GET H2	200	conversion_async.js Show response www.googleadservices.com/pagead/	41 KB 16 KB	189ms 76ms	Script text/javascript	142.250.184.194 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googleadservices.com/pagead/conversion_async.js Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtag/js?id=AW-916451471 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 142.250.184.194 , United States, ASN15169 (GOOGLE, US), Reverse DNS fra24s11-in-f2.1e100.net Software cafe / Resource Hash f6200e00f9bcf9a324c8c1a046c6bc624ebcaf1379faf13e4d76ae56ea0d1a11 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers accept-language nl-NL,nl;q=0.9 Referer https://my-citi-rser.kamsuletri.workers.dev/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36 Response headers date Mon, 12 Sep 2022 20:20:38 GMT content-encoding gzip x-content-type-options nosniff p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cross-origin-resource-policy cross-origin content-disposition attachment; filename="f.txt" alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 15690 x-xss-protection 0 server cafe etag 13194339052015637803 vary Accept-Encoding content-type text/javascript; charset=UTF-8 cache-control private, max-age=3600 timing-allow-origin * expires Mon, 12 Sep 2022 20:20:38 GMT
GET H3	200	js Show response www.googletagmanager.com/gtag/	153 KB 57 KB	45ms 44ms	Script application/javascript	2a00:1450:4001:811::2008 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagmanager.com/gtag/js?id=AW-960621875&l=dataLayer&cx=c Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtag/js?id=DC-6260004 Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:811::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Google Tag Manager / Resource Hash b259902dd95444cd72e3586c9ca8a8c468d82b6d4443fc1c407ca89b8b37d18f Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Xss-Protection 0 Request headers accept-language nl-NL,nl;q=0.9 Referer https://my-citi-rser.kamsuletri.workers.dev/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36 Response headers date Mon, 12 Sep 2022 20:20:38 GMT content-encoding br vary Accept-Encoding cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 58600 x-xss-protection 0 last-modified Mon, 12 Sep 2022 18:00:00 GMT server Google Tag Manager strict-transport-security max-age=31536000; includeSubDomains content-type application/javascript; charset=UTF-8 access-control-allow-origin * cache-control private, max-age=900 access-control-allow-credentials true access-control-allow-headers Cache-Control expires Mon, 12 Sep 2022 20:20:38 GMT
GET H3	200	js Show response www.googletagmanager.com/gtag/	114 KB 45 KB	60ms 60ms	Script application/javascript	2a00:1450:4001:811::2008 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagmanager.com/gtag/js?id=AW-644574043&l=dataLayer&cx=c Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtag/js?id=DC-6260004 Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:811::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Google Tag Manager / Resource Hash 32d4b8a9898c035da29b792b13365661f4b1eacd64c821e968e4a5ec38d62de8 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Xss-Protection 0 Request headers accept-language nl-NL,nl;q=0.9 Referer https://my-citi-rser.kamsuletri.workers.dev/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36 Response headers date Mon, 12 Sep 2022 20:20:38 GMT content-encoding br vary Accept-Encoding cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 46131 x-xss-protection 0 last-modified Mon, 12 Sep 2022 18:00:00 GMT server Google Tag Manager strict-transport-security max-age=31536000; includeSubDomains content-type application/javascript; charset=UTF-8 access-control-allow-origin * cache-control private, max-age=900 access-control-allow-credentials true access-control-allow-headers Cache-Control expires Mon, 12 Sep 2022 20:20:38 GMT
GET H3	200	js Show response www.googletagmanager.com/gtag/	114 KB 45 KB	66ms 66ms	Script application/javascript	2a00:1450:4001:811::2008 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagmanager.com/gtag/js?id=AW-975701947&l=dataLayer&cx=c Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtag/js?id=DC-6260004 Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:811::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Google Tag Manager / Resource Hash daac8c476e3c6a4897d3bfb3931c7bc227e9d6b2fb169995227f28a8c1a2cfff Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Xss-Protection 0 Request headers accept-language nl-NL,nl;q=0.9 Referer https://my-citi-rser.kamsuletri.workers.dev/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36 Response headers date Mon, 12 Sep 2022 20:20:38 GMT content-encoding br vary Accept-Encoding cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 46035 x-xss-protection 0 last-modified Mon, 12 Sep 2022 18:00:00 GMT server Google Tag Manager strict-transport-security max-age=31536000; includeSubDomains content-type application/javascript; charset=UTF-8 access-control-allow-origin * cache-control private, max-age=900 access-control-allow-credentials true access-control-allow-headers Cache-Control expires Mon, 12 Sep 2022 20:20:38 GMT
GET H3	200	js Show response www.googletagmanager.com/gtag/	114 KB 45 KB	53ms 52ms	Script application/javascript	2a00:1450:4001:811::2008 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagmanager.com/gtag/js?id=AW-830907969&l=dataLayer&cx=c Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtag/js?id=DC-6260004 Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:811::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Google Tag Manager / Resource Hash 9b4af431e87e4120fb7433aa3e05b5fe6ee9ccc26b401d61c2bb12ccdcf39a52 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Xss-Protection 0 Request headers accept-language nl-NL,nl;q=0.9 Referer https://my-citi-rser.kamsuletri.workers.dev/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36 Response headers date Mon, 12 Sep 2022 20:20:38 GMT content-encoding br vary Accept-Encoding cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 46139 x-xss-protection 0 last-modified Mon, 12 Sep 2022 18:00:00 GMT server Google Tag Manager strict-transport-security max-age=31536000; includeSubDomains content-type application/javascript; charset=UTF-8 access-control-allow-origin * cache-control private, max-age=900 access-control-allow-credentials true access-control-allow-headers Cache-Control expires Mon, 12 Sep 2022 20:20:38 GMT
GET H3	200	js Show response www.googletagmanager.com/gtag/	114 KB 45 KB	80ms 80ms	Script application/javascript	2a00:1450:4001:811::2008 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagmanager.com/gtag/js?id=AW-695231162&l=dataLayer&cx=c Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtag/js?id=DC-6260004 Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:811::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Google Tag Manager / Resource Hash a57bb00acdfbdacf513d0c05e59c9d4f10d503acded4bebbe2fd9ed44c74c3ef Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Xss-Protection 0 Request headers accept-language nl-NL,nl;q=0.9 Referer https://my-citi-rser.kamsuletri.workers.dev/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36 Response headers date Mon, 12 Sep 2022 20:20:38 GMT content-encoding br vary Accept-Encoding cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 46086 x-xss-protection 0 last-modified Mon, 12 Sep 2022 18:00:00 GMT server Google Tag Manager strict-transport-security max-age=31536000; includeSubDomains content-type application/javascript; charset=UTF-8 access-control-allow-origin * cache-control private, max-age=900 access-control-allow-credentials true access-control-allow-headers Cache-Control expires Mon, 12 Sep 2022 20:20:38 GMT
GET H3	200	js Show response www.googletagmanager.com/gtag/	114 KB 45 KB	72ms 72ms	Script application/javascript	2a00:1450:4001:811::2008 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagmanager.com/gtag/js?id=AW-819500023&l=dataLayer&cx=c Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtag/js?id=DC-6260004 Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:811::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Google Tag Manager / Resource Hash 13efcf02a17df16d45ea37c2bc99c1c1011871f4c30745a3712a9d1cae3e3b47 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Xss-Protection 0 Request headers accept-language nl-NL,nl;q=0.9 Referer https://my-citi-rser.kamsuletri.workers.dev/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36 Response headers date Mon, 12 Sep 2022 20:20:38 GMT content-encoding br vary Accept-Encoding cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 45959 x-xss-protection 0 last-modified Mon, 12 Sep 2022 18:00:00 GMT server Google Tag Manager strict-transport-security max-age=31536000; includeSubDomains content-type application/javascript; charset=UTF-8 access-control-allow-origin * cache-control private, max-age=900 access-control-allow-credentials true access-control-allow-headers Cache-Control expires Mon, 12 Sep 2022 20:20:38 GMT
GET H3	200	js Show response www.googletagmanager.com/gtag/	114 KB 45 KB	85ms 85ms	Script application/javascript	2a00:1450:4001:811::2008 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagmanager.com/gtag/js?id=AW-959299794&l=dataLayer&cx=c Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtag/js?id=DC-6260004 Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:811::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Google Tag Manager / Resource Hash a0cd0fb6791cd27129aeef8616c9207cd25c680dd11aacdaf5419a85214f1a80 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Xss-Protection 0 Request headers accept-language nl-NL,nl;q=0.9 Referer https://my-citi-rser.kamsuletri.workers.dev/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36 Response headers date Mon, 12 Sep 2022 20:20:38 GMT content-encoding br vary Accept-Encoding cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 46006 x-xss-protection 0 last-modified Mon, 12 Sep 2022 18:00:00 GMT server Google Tag Manager strict-transport-security max-age=31536000; includeSubDomains content-type application/javascript; charset=UTF-8 access-control-allow-origin * cache-control private, max-age=900 access-control-allow-credentials true access-control-allow-headers Cache-Control expires Mon, 12 Sep 2022 20:20:38 GMT
GET H3	200	js Show response www.googletagmanager.com/gtag/	153 KB 57 KB	92ms 92ms	Script application/javascript	2a00:1450:4001:811::2008 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagmanager.com/gtag/js?id=AW-10955006959&l=dataLayer&cx=c Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtag/js?id=DC-6260004 Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:811::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Google Tag Manager / Resource Hash 2dac0957ba6466a71e07682103e7ea69431b49b1f237fb837d972daf4b105427 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Xss-Protection 0 Request headers accept-language nl-NL,nl;q=0.9 Referer https://my-citi-rser.kamsuletri.workers.dev/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36 Response headers date Mon, 12 Sep 2022 20:20:38 GMT content-encoding br vary Accept-Encoding cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 58712 x-xss-protection 0 last-modified Mon, 12 Sep 2022 18:00:00 GMT server Google Tag Manager strict-transport-security max-age=31536000; includeSubDomains content-type application/javascript; charset=UTF-8 access-control-allow-origin * cache-control private, max-age=900 access-control-allow-credentials true access-control-allow-headers Cache-Control expires Mon, 12 Sep 2022 20:20:38 GMT
GET H2	200	/ Show response googleads.g.doubleclick.net/pagead/viewthroughconversion/959299794/	2 KB 1 KB	170ms 84ms	Script text/javascript	2a00:1450:4001:80f::2002 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://googleads.g.doubleclick.net/pagead/viewthroughconversion/959299794/?random=1663014038689&cv=9&fst=1663014038689&num=1&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa970&sendb=1&ig=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fmy-citi-rser.kamsuletri.workers.dev%2F&tiba=Sign%20On%20to%20Your%20Citi%20Account%20-%20Citibank&auid=52343977.1663014038&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4 Requested by Host: www.googleadservices.com URL: https://www.googleadservices.com/pagead/conversion_async.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash cd0e2897c53b6785362eca0990b0a61344ec1c30c8e6a35f34666db29db2832a Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers accept-language nl-NL,nl;q=0.9 Referer https://my-citi-rser.kamsuletri.workers.dev/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36 Response headers pragma no-cache date Mon, 12 Sep 2022 20:20:38 GMT content-encoding gzip x-content-type-options nosniff server cafe timing-allow-origin * p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" cache-control no-cache, must-revalidate cross-origin-resource-policy cross-origin content-disposition attachment; filename="f.txt" content-type text/javascript; charset=UTF-8 alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 1064 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	/ Show response googleads.g.doubleclick.net/pagead/viewthroughconversion/819500023/	2 KB 1 KB	173ms 88ms	Script text/javascript	2a00:1450:4001:80f::2002 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://googleads.g.doubleclick.net/pagead/viewthroughconversion/819500023/?random=1663014038692&cv=9&fst=1663014038692&num=1&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa970&sendb=1&ig=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fmy-citi-rser.kamsuletri.workers.dev%2F&tiba=Sign%20On%20to%20Your%20Citi%20Account%20-%20Citibank&auid=52343977.1663014038&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4 Requested by Host: www.googleadservices.com URL: https://www.googleadservices.com/pagead/conversion_async.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash 36560ddf9c0220c6cca35cb5ab556a528d1d3e2b63bd7a33bd4b7581d60a0c9d Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers accept-language nl-NL,nl;q=0.9 Referer https://my-citi-rser.kamsuletri.workers.dev/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36 Response headers pragma no-cache date Mon, 12 Sep 2022 20:20:38 GMT content-encoding gzip x-content-type-options nosniff server cafe timing-allow-origin * p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" cache-control no-cache, must-revalidate cross-origin-resource-policy cross-origin content-disposition attachment; filename="f.txt" content-type text/javascript; charset=UTF-8 alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 1066 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	/ Show response googleads.g.doubleclick.net/pagead/viewthroughconversion/695231162/	2 KB 2 KB	162ms 79ms	Script text/javascript	2a00:1450:4001:80f::2002 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://googleads.g.doubleclick.net/pagead/viewthroughconversion/695231162/?random=1663014038693&cv=9&fst=1663014038693&num=1&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa970&sendb=1&ig=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fmy-citi-rser.kamsuletri.workers.dev%2F&tiba=Sign%20On%20to%20Your%20Citi%20Account%20-%20Citibank&auid=52343977.1663014038&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4 Requested by Host: www.googleadservices.com URL: https://www.googleadservices.com/pagead/conversion_async.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash e44d7efb0b25bc8fdaa4adcd10d6018f535ca95afc2085ccf427531fa5d2201e Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers accept-language nl-NL,nl;q=0.9 Referer https://my-citi-rser.kamsuletri.workers.dev/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36 Response headers pragma no-cache date Mon, 12 Sep 2022 20:20:38 GMT content-encoding gzip x-content-type-options nosniff server cafe timing-allow-origin * p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" cache-control no-cache, must-revalidate cross-origin-resource-policy cross-origin content-disposition attachment; filename="f.txt" content-type text/javascript; charset=UTF-8 alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 1065 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	/ Show response googleads.g.doubleclick.net/pagead/viewthroughconversion/975701947/	2 KB 1 KB	174ms 91ms	Script text/javascript	2a00:1450:4001:80f::2002 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://googleads.g.doubleclick.net/pagead/viewthroughconversion/975701947/?random=1663014038694&cv=9&fst=1663014038694&num=1&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa970&sendb=1&ig=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fmy-citi-rser.kamsuletri.workers.dev%2F&tiba=Sign%20On%20to%20Your%20Citi%20Account%20-%20Citibank&auid=52343977.1663014038&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4 Requested by Host: www.googleadservices.com URL: https://www.googleadservices.com/pagead/conversion_async.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash de23dd2ac92552614020200a59a0ad6555855b2bafb5a1b7a594cc6980a48c11 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers accept-language nl-NL,nl;q=0.9 Referer https://my-citi-rser.kamsuletri.workers.dev/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36 Response headers pragma no-cache date Mon, 12 Sep 2022 20:20:38 GMT content-encoding gzip x-content-type-options nosniff server cafe timing-allow-origin * p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" cache-control no-cache, must-revalidate cross-origin-resource-policy cross-origin content-disposition attachment; filename="f.txt" content-type text/javascript; charset=UTF-8 alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 1065 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	/ www.google.nl/pagead/1p-user-list/644574043/ Redirect Chain https://googleads.g.doubleclick.net/pagead/viewthroughconversion/644574043/?random=1663014038694&cv=9&fst=1663014038694&num=1&fmt=3&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=12... https://www.google.com/pagead/1p-user-list/644574043/?random=1663014038694&cv=9&fst=1663012800000&num=1&fmt=3&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=f... https://www.google.nl/pagead/1p-user-list/644574043/?random=1663014038694&cv=9&fst=1663012800000&num=1&fmt=3&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=fa...	42 B 108 B	46ms 46ms	Image image/gif	2a00:1450:4001:806::2003 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.google.nl/pagead/1p-user-list/644574043/?random=1663014038694&cv=9&fst=1663012800000&num=1&fmt=3&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa970&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fmy-citi-rser.kamsuletri.workers.dev%2F&tiba=Sign%20On%20to%20Your%20Citi%20Account%20-%20Citibank&async=1&is_vtc=1&random=203675137&resp=GooglemKTybQhCsO&ipr=y Protocol H2 Server 2a00:1450:4001:806::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value Content-Security-Policy script-src 'none'; object-src 'none' X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers accept-language nl-NL,nl;q=0.9 Referer https://my-citi-rser.kamsuletri.workers.dev/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36 Response headers pragma no-cache date Mon, 12 Sep 2022 20:20:39 GMT x-content-type-options nosniff server cafe timing-allow-origin * p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cache-control no-cache, no-store, must-revalidate cross-origin-resource-policy cross-origin content-security-policy script-src 'none'; object-src 'none' content-type image/gif alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 42 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT Redirect headers pragma no-cache date Mon, 12 Sep 2022 20:20:38 GMT x-content-type-options nosniff server cafe p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" content-type image/gif location https://www.google.nl/pagead/1p-user-list/644574043/?random=1663014038694&cv=9&fst=1663012800000&num=1&fmt=3&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa970&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fmy-citi-rser.kamsuletri.workers.dev%2F&tiba=Sign%20On%20to%20Your%20Citi%20Account%20-%20Citibank&async=1&is_vtc=1&random=203675137&resp=GooglemKTybQhCsO&ipr=y cache-control no-cache, no-store, must-revalidate cross-origin-resource-policy cross-origin content-security-policy script-src 'none'; object-src 'none' timing-allow-origin * alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 42 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	/ Show response googleads.g.doubleclick.net/pagead/viewthroughconversion/10955006959/	2 KB 1 KB	162ms 80ms	Script text/javascript	2a00:1450:4001:80f::2002 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://googleads.g.doubleclick.net/pagead/viewthroughconversion/10955006959/?random=1663014038695&cv=9&fst=1663014038695&num=1&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa970&sendb=1&ig=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fmy-citi-rser.kamsuletri.workers.dev%2F&tiba=Sign%20On%20to%20Your%20Citi%20Account%20-%20Citibank&auid=52343977.1663014038&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4 Requested by Host: www.googleadservices.com URL: https://www.googleadservices.com/pagead/conversion_async.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash 3aa228e5dfc4ccc5ae5da1d934e5d9749ba9b4f1ec6f7c59b2300c276dc64464 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers accept-language nl-NL,nl;q=0.9 Referer https://my-citi-rser.kamsuletri.workers.dev/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36 Response headers pragma no-cache date Mon, 12 Sep 2022 20:20:38 GMT content-encoding gzip x-content-type-options nosniff server cafe timing-allow-origin * p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" cache-control no-cache, must-revalidate cross-origin-resource-policy cross-origin content-disposition attachment; filename="f.txt" content-type text/javascript; charset=UTF-8 alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 1065 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H3	200	/ Show response googleads.g.doubleclick.net/pagead/viewthroughconversion/960621875/	2 KB 1 KB	240ms 119ms	Script text/javascript	2a00:1450:4001:80f::2002 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://googleads.g.doubleclick.net/pagead/viewthroughconversion/960621875/?random=1663014038696&cv=9&fst=1663014038696&num=1&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa970&sendb=1&ig=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fmy-citi-rser.kamsuletri.workers.dev%2F&tiba=Sign%20On%20to%20Your%20Citi%20Account%20-%20Citibank&auid=52343977.1663014038&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4 Requested by Host: www.googleadservices.com URL: https://www.googleadservices.com/pagead/conversion_async.js Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash e4b11379fdad56cd5c03c27ad0b26be06947587a5e580cfdc6e650eec4910679 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers accept-language nl-NL,nl;q=0.9 Referer https://my-citi-rser.kamsuletri.workers.dev/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36 Response headers pragma no-cache date Mon, 12 Sep 2022 20:20:39 GMT content-encoding gzip x-content-type-options nosniff server cafe timing-allow-origin * p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" cache-control no-cache, must-revalidate cross-origin-resource-policy cross-origin content-disposition attachment; filename="f.txt" content-type text/javascript; charset=UTF-8 alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 1065 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H3	200	/ www.google.nl/pagead/1p-user-list/830907969/ Redirect Chain https://googleads.g.doubleclick.net/pagead/viewthroughconversion/830907969/?random=1663014038696&cv=9&fst=1663014038696&num=1&fmt=3&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=12... https://www.google.com/pagead/1p-user-list/830907969/?random=1663014038696&cv=9&fst=1663012800000&num=1&fmt=3&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=f... https://www.google.nl/pagead/1p-user-list/830907969/?random=1663014038696&cv=9&fst=1663012800000&num=1&fmt=3&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=fa...	42 B 64 B	45ms 45ms	Image image/gif	2a00:1450:4001:806::2003 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.google.nl/pagead/1p-user-list/830907969/?random=1663014038696&cv=9&fst=1663012800000&num=1&fmt=3&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa970&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fmy-citi-rser.kamsuletri.workers.dev%2F&tiba=Sign%20On%20to%20Your%20Citi%20Account%20-%20Citibank&async=1&is_vtc=1&random=2338640127&resp=GooglemKTybQhCsO&ipr=y Protocol H3 Server 2a00:1450:4001:806::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value Content-Security-Policy script-src 'none'; object-src 'none' X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers accept-language nl-NL,nl;q=0.9 Referer https://my-citi-rser.kamsuletri.workers.dev/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36 Response headers pragma no-cache date Mon, 12 Sep 2022 20:20:39 GMT x-content-type-options nosniff server cafe timing-allow-origin * p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cache-control no-cache, no-store, must-revalidate cross-origin-resource-policy cross-origin content-security-policy script-src 'none'; object-src 'none' content-type image/gif alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 42 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT Redirect headers pragma no-cache date Mon, 12 Sep 2022 20:20:39 GMT x-content-type-options nosniff server cafe p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" content-type image/gif location https://www.google.nl/pagead/1p-user-list/830907969/?random=1663014038696&cv=9&fst=1663012800000&num=1&fmt=3&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa970&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fmy-citi-rser.kamsuletri.workers.dev%2F&tiba=Sign%20On%20to%20Your%20Citi%20Account%20-%20Citibank&async=1&is_vtc=1&random=2338640127&resp=GooglemKTybQhCsO&ipr=y cache-control no-cache, no-store, must-revalidate cross-origin-resource-policy cross-origin content-security-policy script-src 'none'; object-src 'none' timing-allow-origin * alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 42 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H3	200	/ Show response googleads.g.doubleclick.net/pagead/viewthroughconversion/916451471/	2 KB 1 KB	245ms 124ms	Script text/javascript	2a00:1450:4001:80f::2002 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://googleads.g.doubleclick.net/pagead/viewthroughconversion/916451471/?random=1663014038697&cv=9&fst=1663014038697&num=1&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa970&sendb=1&ig=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fmy-citi-rser.kamsuletri.workers.dev%2F&tiba=Sign%20On%20to%20Your%20Citi%20Account%20-%20Citibank&auid=52343977.1663014038&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4 Requested by Host: www.googleadservices.com URL: https://www.googleadservices.com/pagead/conversion_async.js Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash f16e803855ec042119971ebaab0f91e9da06b26bdd86da8c8a1aa8c7d3e7a97e Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers accept-language nl-NL,nl;q=0.9 Referer https://my-citi-rser.kamsuletri.workers.dev/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36 Response headers pragma no-cache date Mon, 12 Sep 2022 20:20:39 GMT content-encoding gzip x-content-type-options nosniff server cafe timing-allow-origin * p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" cache-control no-cache, must-revalidate cross-origin-resource-policy cross-origin content-disposition attachment; filename="f.txt" content-type text/javascript; charset=UTF-8 alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 1064 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	generic1661759384239.js Show response resources.digital-cloud-citi.medallia.com/wdcusciti/50/onsite/	503 KB 84 KB	99ms 99ms	Script application/javascript	151.101.193.230 FASTLY
General Check archive.org Show headers Download Go to Full URL https://resources.digital-cloud-citi.medallia.com/wdcusciti/50/onsite/generic1661759384239.js Requested by Host: resources.digital-cloud-citi.medallia.com URL: https://resources.digital-cloud-citi.medallia.com/wdcusciti/50/onsite/embed.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 151.101.193.230 , United States, ASN54113 (FASTLY, US), Reverse DNS Software AmazonS3 / Resource Hash cc1f329f34c5f9f4c759b787ccc409241a8ffe8d13863a87cc9214e628b43cff Security Headers Name Value Strict-Transport-Security max-age=31557600 Request headers accept-language nl-NL,nl;q=0.9 Referer https://my-citi-rser.kamsuletri.workers.dev/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36 Response headers x-amz-version-id cbf3VAh2wvqiC_RNSd9Tltn6dOvsrine content-encoding gzip etag "31ab1facffb3500494bf6aca3d7e439d" age 743292 via 1.1 varnish x-cache HIT vary Accept-Encoding content-length 85764 x-amz-id-2 HCvXnbu6sokfMHsSIs2lX02x5S3CyJbtopleEYFi7eMoKBzOlbeyRkyBkNpJrHzO0cl5Cr6CVrc= x-served-by cache-ewr18131-EWR last-modified Mon, 29 Aug 2022 07:49:45 GMT server AmazonS3 x-timer S1663014039.752336,VS0,VE0 date Mon, 12 Sep 2022 20:20:38 GMT strict-transport-security max-age=31557600 x-amz-request-id KK79YVVED9V81RMN access-control-allow-origin * cache-control max-age=0,must-revalidate accept-ranges bytes content-type application/javascript x-cache-hits 73970
GET H2	200	/ www.google.com/pagead/1p-user-list/695231162/	42 B 108 B	131ms 48ms	Image image/gif	2a00:1450:4001:811::2004 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.google.com/pagead/1p-user-list/695231162/?random=1663014038693&cv=9&fst=1663012800000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa970&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fmy-citi-rser.kamsuletri.workers.dev%2F&tiba=Sign%20On%20to%20Your%20Citi%20Account%20-%20Citibank&async=1&fmt=3&is_vtc=1&random=3670767293&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:811::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value Content-Security-Policy script-src 'none'; object-src 'none' X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers accept-language nl-NL,nl;q=0.9 Referer https://my-citi-rser.kamsuletri.workers.dev/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36 Response headers pragma no-cache date Mon, 12 Sep 2022 20:20:38 GMT x-content-type-options nosniff server cafe timing-allow-origin * p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cache-control no-cache, no-store, must-revalidate cross-origin-resource-policy cross-origin content-security-policy script-src 'none'; object-src 'none' content-type image/gif alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 42 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	/ www.google.nl/pagead/1p-user-list/695231162/	42 B 108 B	174ms 60ms	Image image/gif	2a00:1450:4001:806::2003 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.google.nl/pagead/1p-user-list/695231162/?random=1663014038693&cv=9&fst=1663012800000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa970&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fmy-citi-rser.kamsuletri.workers.dev%2F&tiba=Sign%20On%20to%20Your%20Citi%20Account%20-%20Citibank&async=1&fmt=3&is_vtc=1&random=3670767293&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:806::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value Content-Security-Policy script-src 'none'; object-src 'none' X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers accept-language nl-NL,nl;q=0.9 Referer https://my-citi-rser.kamsuletri.workers.dev/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36 Response headers pragma no-cache date Mon, 12 Sep 2022 20:20:39 GMT x-content-type-options nosniff server cafe timing-allow-origin * p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cache-control no-cache, no-store, must-revalidate cross-origin-resource-policy cross-origin content-security-policy script-src 'none'; object-src 'none' content-type image/gif alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 42 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	/ www.google.com/pagead/1p-user-list/10955006959/	42 B 548 B	126ms 46ms	Image image/gif	2a00:1450:4001:811::2004 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.google.com/pagead/1p-user-list/10955006959/?random=1663014038695&cv=9&fst=1663012800000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa970&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fmy-citi-rser.kamsuletri.workers.dev%2F&tiba=Sign%20On%20to%20Your%20Citi%20Account%20-%20Citibank&async=1&fmt=3&is_vtc=1&random=2380152631&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:811::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value Content-Security-Policy script-src 'none'; object-src 'none' X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers accept-language nl-NL,nl;q=0.9 Referer https://my-citi-rser.kamsuletri.workers.dev/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36 Response headers pragma no-cache date Mon, 12 Sep 2022 20:20:38 GMT x-content-type-options nosniff server cafe timing-allow-origin * p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cache-control no-cache, no-store, must-revalidate cross-origin-resource-policy cross-origin content-security-policy script-src 'none'; object-src 'none' content-type image/gif alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 42 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	/ www.google.nl/pagead/1p-user-list/10955006959/	42 B 548 B	170ms 59ms	Image image/gif	2a00:1450:4001:806::2003 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.google.nl/pagead/1p-user-list/10955006959/?random=1663014038695&cv=9&fst=1663012800000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa970&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fmy-citi-rser.kamsuletri.workers.dev%2F&tiba=Sign%20On%20to%20Your%20Citi%20Account%20-%20Citibank&async=1&fmt=3&is_vtc=1&random=2380152631&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:806::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value Content-Security-Policy script-src 'none'; object-src 'none' X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers accept-language nl-NL,nl;q=0.9 Referer https://my-citi-rser.kamsuletri.workers.dev/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36 Response headers pragma no-cache date Mon, 12 Sep 2022 20:20:39 GMT x-content-type-options nosniff server cafe timing-allow-origin * p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cache-control no-cache, no-store, must-revalidate cross-origin-resource-policy cross-origin content-security-policy script-src 'none'; object-src 'none' content-type image/gif alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 42 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	/ www.google.com/pagead/1p-user-list/959299794/	42 B 108 B	124ms 47ms	Image image/gif	2a00:1450:4001:811::2004 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.google.com/pagead/1p-user-list/959299794/?random=1663014038689&cv=9&fst=1663012800000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa970&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fmy-citi-rser.kamsuletri.workers.dev%2F&tiba=Sign%20On%20to%20Your%20Citi%20Account%20-%20Citibank&async=1&fmt=3&is_vtc=1&random=1574205853&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:811::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value Content-Security-Policy script-src 'none'; object-src 'none' X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers accept-language nl-NL,nl;q=0.9 Referer https://my-citi-rser.kamsuletri.workers.dev/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36 Response headers pragma no-cache date Mon, 12 Sep 2022 20:20:38 GMT x-content-type-options nosniff server cafe timing-allow-origin * p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cache-control no-cache, no-store, must-revalidate cross-origin-resource-policy cross-origin content-security-policy script-src 'none'; object-src 'none' content-type image/gif alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 42 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	/ www.google.nl/pagead/1p-user-list/959299794/	42 B 108 B	168ms 59ms	Image image/gif	2a00:1450:4001:806::2003 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.google.nl/pagead/1p-user-list/959299794/?random=1663014038689&cv=9&fst=1663012800000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa970&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fmy-citi-rser.kamsuletri.workers.dev%2F&tiba=Sign%20On%20to%20Your%20Citi%20Account%20-%20Citibank&async=1&fmt=3&is_vtc=1&random=1574205853&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:806::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value Content-Security-Policy script-src 'none'; object-src 'none' X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers accept-language nl-NL,nl;q=0.9 Referer https://my-citi-rser.kamsuletri.workers.dev/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36 Response headers pragma no-cache date Mon, 12 Sep 2022 20:20:39 GMT x-content-type-options nosniff server cafe timing-allow-origin * p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cache-control no-cache, no-store, must-revalidate cross-origin-resource-policy cross-origin content-security-policy script-src 'none'; object-src 'none' content-type image/gif alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 42 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	/ www.google.com/pagead/1p-user-list/819500023/	42 B 108 B	122ms 48ms	Image image/gif	2a00:1450:4001:811::2004 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.google.com/pagead/1p-user-list/819500023/?random=1663014038692&cv=9&fst=1663012800000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa970&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fmy-citi-rser.kamsuletri.workers.dev%2F&tiba=Sign%20On%20to%20Your%20Citi%20Account%20-%20Citibank&async=1&fmt=3&is_vtc=1&random=2545627838&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:811::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value Content-Security-Policy script-src 'none'; object-src 'none' X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers accept-language nl-NL,nl;q=0.9 Referer https://my-citi-rser.kamsuletri.workers.dev/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36 Response headers pragma no-cache date Mon, 12 Sep 2022 20:20:38 GMT x-content-type-options nosniff server cafe timing-allow-origin * p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cache-control no-cache, no-store, must-revalidate cross-origin-resource-policy cross-origin content-security-policy script-src 'none'; object-src 'none' content-type image/gif alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 42 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	/ www.google.nl/pagead/1p-user-list/819500023/	42 B 108 B	165ms 60ms	Image image/gif	2a00:1450:4001:806::2003 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.google.nl/pagead/1p-user-list/819500023/?random=1663014038692&cv=9&fst=1663012800000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa970&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fmy-citi-rser.kamsuletri.workers.dev%2F&tiba=Sign%20On%20to%20Your%20Citi%20Account%20-%20Citibank&async=1&fmt=3&is_vtc=1&random=2545627838&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:806::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value Content-Security-Policy script-src 'none'; object-src 'none' X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers accept-language nl-NL,nl;q=0.9 Referer https://my-citi-rser.kamsuletri.workers.dev/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36 Response headers pragma no-cache date Mon, 12 Sep 2022 20:20:39 GMT x-content-type-options nosniff server cafe timing-allow-origin * p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cache-control no-cache, no-store, must-revalidate cross-origin-resource-policy cross-origin content-security-policy script-src 'none'; object-src 'none' content-type image/gif alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 42 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	/ www.google.com/pagead/1p-user-list/975701947/	42 B 108 B	118ms 49ms	Image image/gif	2a00:1450:4001:811::2004 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.google.com/pagead/1p-user-list/975701947/?random=1663014038694&cv=9&fst=1663012800000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa970&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fmy-citi-rser.kamsuletri.workers.dev%2F&tiba=Sign%20On%20to%20Your%20Citi%20Account%20-%20Citibank&async=1&fmt=3&is_vtc=1&random=2416593041&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:811::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value Content-Security-Policy script-src 'none'; object-src 'none' X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers accept-language nl-NL,nl;q=0.9 Referer https://my-citi-rser.kamsuletri.workers.dev/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36 Response headers pragma no-cache date Mon, 12 Sep 2022 20:20:38 GMT x-content-type-options nosniff server cafe timing-allow-origin * p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cache-control no-cache, no-store, must-revalidate cross-origin-resource-policy cross-origin content-security-policy script-src 'none'; object-src 'none' content-type image/gif alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 42 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	/ www.google.nl/pagead/1p-user-list/975701947/	42 B 108 B	47ms 44ms	Image image/gif	2a00:1450:4001:806::2003 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.google.nl/pagead/1p-user-list/975701947/?random=1663014038694&cv=9&fst=1663012800000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa970&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fmy-citi-rser.kamsuletri.workers.dev%2F&tiba=Sign%20On%20to%20Your%20Citi%20Account%20-%20Citibank&async=1&fmt=3&is_vtc=1&random=2416593041&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:806::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value Content-Security-Policy script-src 'none'; object-src 'none' X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers accept-language nl-NL,nl;q=0.9 Referer https://my-citi-rser.kamsuletri.workers.dev/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36 Response headers pragma no-cache date Mon, 12 Sep 2022 20:20:39 GMT x-content-type-options nosniff server cafe timing-allow-origin * p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cache-control no-cache, no-store, must-revalidate cross-origin-resource-policy cross-origin content-security-policy script-src 'none'; object-src 'none' content-type image/gif alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 42 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	__cool.gif udc-neb.kampyle.com/egw/5/qceuv8449dzg58ptt1bhda9g8ue19c7s/track/	0 317 B	195ms 115ms	Image image/gif	35.241.45.82 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://udc-neb.kampyle.com/egw/5/qceuv8449dzg58ptt1bhda9g8ue19c7s/track/__cool.gif?data=eyJldmVudHMiOiBbCiAgICB7InNlc3Npb25fc2NyZWVuX3NpemUiOiAiMTYwMHgxMjAwIiwic2Vzc2lvbl9kdWEiOiAiTW96aWxsYS81LjAgKFdpbmRvd3MgTlQgMTAuMDsgV2luNjQ7IHg2NCkgQXBwbGVXZWJLaXQvNTM3LjM2IChLSFRNTCwgbGlrZSBHZWNrbykgQ2hyb21lLzEwNS4wLjUxOTUuMTAyIFNhZmFyaS81MzcuMzYiLCJzZXNzaW9uX3BsYXRmb3JtIjogIldpbjMyIiwicGFnZV90aXRsZSI6ICJTaWduIE9uIHRvIFlvdXIgQ2l0aSBBY2NvdW50IC0gQ2l0aWJhbmsiLCJwYWdlX3VybCI6ICJodHRwczovL215LWNpdGktcnNlci5rYW1zdWxldHJpLndvcmtlcnMuZGV2LyIsInRyYWNrZXJfdHlwZSI6ICJqYXZhc2NyaXB0IiwidHJhY2tlcl92ZXJzaW9uIjogIjIuMi4yMyIsImV2ZW50X25hbWUiOiAibmVidWxhX3BhZ2VfdmlldyIsImV2ZW50X3RpbWVzdGFtcF9lcG9jaCI6ICIxNjYzMDE0MDM4OTkwIiwiZXZlbnRfdGltZXpvbmVfb2Zmc2V0IjogMCwidXNlcl9pZCI6ICIxODMzMzVjNmRjNDUzMy0wMTVjOGUyZDU3OGE3LTY5Mzg1MTUyLTFkNGMwMC0xODMzMzVjNmRjNTZlZiIsImVudmlyb21lbnQiOiAiZGlnaXRhbC1jbG91ZC11cy1jaXRpIiwiYWNjb3VudElkIjogNDksInVybCI6ICJodHRwczovL215LWNpdGktcnNlci5rYW1zdWxldHJpLndvcmtlcnMuZGV2LyIsIndlYnNpdGVJZCI6IDUwLCJmb3JtSWQiOiBudWxsLCJmb3JtVHJpZ2dlclR5cGUiOiBudWxsLCJrYW1weWxlX2RhdGEiOiB7Im1kX2lzU3VydmV5U3VibWl0dGVkSW5TZXNzaW9uIjogIiIsIkxBU1RfSU5WSVRBVElPTl9WSUVXIjogIiIsIkRFQ0xJTkVEX0RBVEUiOiAiIiwia2FtcHlsZUludml0ZVByZXNlbnRlZCI6ICIiLCJrYW1weWxlX3VzZXJpZCI6ICI1ZmZlLTFjYzItNmNlMS01NDlhLTEwODAtZmRjMy0xNTVjLTZhMjgiLCJrYW1weWxlVXNlclNlc3Npb24iOiAiMTY2MzAxNDAzODk4OCIsImthbXB5bGVVc2VyUGVyY2VudGlsZSI6ICIiLCJTVUJNSVRURURfREFURSI6ICIifSwiY29va2llX3NpemUiOiAyODgsImthbXB5bGVfdmVyc2lvbiI6ICIyLjQ3LjMiLCJvbnNpdGVfdmVyc2lvbiI6ICIyLjQ3LjMiLCJoaXN0b3J5X2xlbmd0aCI6IDIsImV2ZW50X2xvY2FsX3RpbWVzdGFtcCI6IDE2NjMwMTQwMzg5OTAsInBvc2l0aW9uIjogbnVsbCwiaXNVc2VySWRlbnRpZmllZCI6IGZhbHNlLCJmZWVkYmFja19jb3JyZWxhdGlvbl91dWlkIjogbnVsbH0KXX0= Protocol H2 Security TLS 1.3, , AES_128_GCM Server 35.241.45.82 Kansas City, United States, ASN15169 (GOOGLE, US), Reverse DNS 82.45.241.35.bc.googleusercontent.com Software Jetty(9.2.11.v20150529) / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers accept-language nl-NL,nl;q=0.9 Referer https://my-citi-rser.kamsuletri.workers.dev/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36 Response headers x-me prod-instance-gatewayservice-blue-s69h date Mon, 12 Sep 2022 20:20:39 GMT via 1.1 google server Jetty(9.2.11.v20150529) access-control-allow-headers X-Requested-With, Origin, Content-Type, Accept access-control-max-age 1800 access-control-allow-methods GET, POST, PUT, DELETE content-type image/gif; charset=UTF-8 access-control-allow-origin * access-control-allow-credentials true alt-svc clear content-length 0 x-application-context application:9090
GET H3	200	/ www.google.com/pagead/1p-user-list/960621875/	42 B 64 B	160ms 46ms	Image image/gif	2a00:1450:4001:811::2004 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.google.com/pagead/1p-user-list/960621875/?random=1663014038696&cv=9&fst=1663012800000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa970&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fmy-citi-rser.kamsuletri.workers.dev%2F&tiba=Sign%20On%20to%20Your%20Citi%20Account%20-%20Citibank&async=1&fmt=3&is_vtc=1&random=3303514221&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:811::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value Content-Security-Policy script-src 'none'; object-src 'none' X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers accept-language nl-NL,nl;q=0.9 Referer https://my-citi-rser.kamsuletri.workers.dev/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36 Response headers pragma no-cache date Mon, 12 Sep 2022 20:20:39 GMT x-content-type-options nosniff server cafe timing-allow-origin * p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cache-control no-cache, no-store, must-revalidate cross-origin-resource-policy cross-origin content-security-policy script-src 'none'; object-src 'none' content-type image/gif alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 42 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H3	200	/ www.google.nl/pagead/1p-user-list/960621875/	42 B 64 B	112ms 46ms	Image image/gif	2a00:1450:4001:806::2003 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.google.nl/pagead/1p-user-list/960621875/?random=1663014038696&cv=9&fst=1663012800000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa970&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fmy-citi-rser.kamsuletri.workers.dev%2F&tiba=Sign%20On%20to%20Your%20Citi%20Account%20-%20Citibank&async=1&fmt=3&is_vtc=1&random=3303514221&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:806::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value Content-Security-Policy script-src 'none'; object-src 'none' X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers accept-language nl-NL,nl;q=0.9 Referer https://my-citi-rser.kamsuletri.workers.dev/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36 Response headers pragma no-cache date Mon, 12 Sep 2022 20:20:39 GMT x-content-type-options nosniff server cafe timing-allow-origin * p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cache-control no-cache, no-store, must-revalidate cross-origin-resource-policy cross-origin content-security-policy script-src 'none'; object-src 'none' content-type image/gif alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 42 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H3	200	/ www.google.com/pagead/1p-user-list/916451471/	42 B 64 B	153ms 45ms	Image image/gif	2a00:1450:4001:811::2004 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.google.com/pagead/1p-user-list/916451471/?random=1663014038697&cv=9&fst=1663012800000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa970&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fmy-citi-rser.kamsuletri.workers.dev%2F&tiba=Sign%20On%20to%20Your%20Citi%20Account%20-%20Citibank&async=1&fmt=3&is_vtc=1&random=624846256&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:811::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value Content-Security-Policy script-src 'none'; object-src 'none' X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers accept-language nl-NL,nl;q=0.9 Referer https://my-citi-rser.kamsuletri.workers.dev/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36 Response headers pragma no-cache date Mon, 12 Sep 2022 20:20:39 GMT x-content-type-options nosniff server cafe timing-allow-origin * p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cache-control no-cache, no-store, must-revalidate cross-origin-resource-policy cross-origin content-security-policy script-src 'none'; object-src 'none' content-type image/gif alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 42 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H3	200	/ www.google.nl/pagead/1p-user-list/916451471/	42 B 64 B	105ms 44ms	Image image/gif	2a00:1450:4001:806::2003 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.google.nl/pagead/1p-user-list/916451471/?random=1663014038697&cv=9&fst=1663012800000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa970&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fmy-citi-rser.kamsuletri.workers.dev%2F&tiba=Sign%20On%20to%20Your%20Citi%20Account%20-%20Citibank&async=1&fmt=3&is_vtc=1&random=624846256&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:806::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value Content-Security-Policy script-src 'none'; object-src 'none' X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers accept-language nl-NL,nl;q=0.9 Referer https://my-citi-rser.kamsuletri.workers.dev/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36 Response headers pragma no-cache date Mon, 12 Sep 2022 20:20:39 GMT x-content-type-options nosniff server cafe timing-allow-origin * p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cache-control no-cache, no-store, must-revalidate cross-origin-resource-policy cross-origin content-security-policy script-src 'none'; object-src 'none' content-type image/gif alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 42 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT