mortgage.citi.com Open in urlscan Pro
216.250.52.47 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://www.google.com/aclk?sa=l&ai=DChcSEwjn4eWuv8_nAhUO28AKHXI3AVwYABAGGgJpbQ&sig=AOD64_0ERylWwvBxceJpyexmo6uqpv_qYQ&...
Effective URL:
https://mortgage.citi.com/cmi/PaidSearch/Conforming/Chip/LF2/default.htm?ISN=14814-9&BTST=9032003&btlp=dual&cmp=KNC~05~180...
Submission: On February 13 via api (February 13th 2020, 9:43:11 pm UTC) from CA

Summary HTTP 96 Redirects Links 15 Behaviour Indicators

Summary

This website contacted 31 IPs in 7 countries across 26 domains to perform 96 HTTP transactions. The main IP is 216.250.52.47, located in United States and belongs to SAPIENT-DCO, US. The main domain is mortgage.citi.com.
TLS certificate: Issued by DigiCert SHA2 Extended Validation Ser... on February 12th 2020. Valid for: 2 years.

This is the only time mortgage.citi.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
10 15	2a00:1450:400... 2a00:1450:4001:820::2004	15169 (GOOGLE) (GOOGLE)
1 3	216.58.205.226 216.58.205.226	15169 (GOOGLE) (GOOGLE)
1 1	2a00:1450:400... 2a00:1450:4001:825::200e	15169 (GOOGLE) (GOOGLE)
3 3	172.217.16.134 172.217.16.134	15169 (GOOGLE) (GOOGLE)
2 3	216.250.63.5 216.250.63.5	22758 (SAPIENT-DCO) (SAPIENT-DCO)
1 18	216.250.52.47 216.250.52.47	22758 (SAPIENT-DCO) (SAPIENT-DCO)
12	18.197.253.20 18.197.253.20	16509 (AMAZON-02) (AMAZON-02)
2	2a00:1450:400... 2a00:1450:4001:808::2003	15169 (GOOGLE) (GOOGLE)
1 5	34.252.123.130 34.252.123.130	16509 (AMAZON-02) (AMAZON-02)
3	2.16.123.117 2.16.123.117	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1	2a00:1450:400... 2a00:1450:4001:806::2003	15169 (GOOGLE) (GOOGLE)
1	104.108.41.26 104.108.41.26	16625 (AKAMAI-AS) (AKAMAI-AS)
1	52.30.105.51 52.30.105.51	16509 (AMAZON-02) (AMAZON-02)
2	15.188.105.205 15.188.105.205	16509 (AMAZON-02) (AMAZON-02)
1 1	66.117.28.86 66.117.28.86	15224 (OMNITURE) (OMNITURE)
1	104.124.153.199 104.124.153.199	16625 (AKAMAI-AS) (AKAMAI-AS)
2	185.31.128.129 185.31.128.129	54312 (ROCKETFUEL) (ROCKETFUEL)
1	13.224.185.201 13.224.185.201	16509 (AMAZON-02) (AMAZON-02)
2	151.101.114.133 151.101.114.133	54113 (FASTLY) (FASTLY)
2	13.225.78.34 13.225.78.34	16509 (AMAZON-02) (AMAZON-02)
1	35.190.72.21 35.190.72.21	15169 (GOOGLE) (GOOGLE)
4	2a00:1450:400... 2a00:1450:4001:817::2008	15169 (GOOGLE) (GOOGLE)
3	2620:1ec:c11:... 2620:1ec:c11::200	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1 1	216.200.122.11 216.200.122.11	6461 (ZAYO-6461) (ZAYO-6461)
1	2a00:1450:400... 2a00:1450:4001:808::2002	15169 (GOOGLE) (GOOGLE)
1	172.217.22.2 172.217.22.2	15169 (GOOGLE) (GOOGLE)
1	54.154.55.10 54.154.55.10	16509 (AMAZON-02) (AMAZON-02)
1	23.45.237.36 23.45.237.36	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
2 4	172.217.22.38 172.217.22.38	15169 (GOOGLE) (GOOGLE)
9 14	2a00:1450:400... 2a00:1450:4001:825::2002	15169 (GOOGLE) (GOOGLE)
14	2a00:1450:400... 2a00:1450:4001:820::2003	15169 (GOOGLE) (GOOGLE)
1	54.246.153.43 54.246.153.43	16509 (AMAZON-02) (AMAZON-02)
1	151.101.13.175 151.101.13.175	54113 (FASTLY) (FASTLY)
1	35.241.45.82 35.241.45.82	15169 (GOOGLE) (GOOGLE)
1 2	2a00:1450:400... 2a00:1450:4001:808::2013	15169 (GOOGLE) (GOOGLE)
1 1	35.176.232.241 35.176.232.241	16509 (AMAZON-02) (AMAZON-02)
96	31

15 2a00:1450:4001:820::2004 (Frankfurt am Main, Germany) 10 redirects

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 216.58.205.226 (Mountain View, United States) 1 redirects

ASN15169 (GOOGLE, US)
PTR: fra15s24-in-f2.1e100.net

www.googleadservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:825::200e (Frankfurt am Main, Germany) 1 redirects

ASN15169 (GOOGLE, US)

clickserve.dartsearch.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 172.217.16.134 (United States) 3 redirects

ASN15169 (GOOGLE, US)
PTR: fra15s46-in-f6.1e100.net

ad.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 216.250.63.5 (United States) 2 redirects

ASN22758 (SAPIENT-DCO, US)
PTR: citi.bridgetrack.com

citi.bridgetrack.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

18 216.250.52.47 (United States) 1 redirects

ASN22758 (SAPIENT-DCO, US)
PTR: adp.kaplan.edu

mortgage.citi.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

12 18.197.253.20 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-18-197-253-20.eu-central-1.compute.amazonaws.com

nexus.ensighten.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:808::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 34.252.123.130 (Dublin, Ireland) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-34-252-123-130.eu-west-1.compute.amazonaws.com

dpm.demdex.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2.16.123.117 (Ascension Island)

ASN20940 (AKAMAI-ASN1, US)
PTR: a2-16-123-117.deploy.static.akamaitechnologies.com

sec-citi.bridgetrack.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:806::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.be	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.108.41.26 (Netherlands)

ASN16625 (AKAMAI-AS, US)
PTR: a104-108-41-26.deploy.static.akamaitechnologies.com

tags.bkrtx.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.30.105.51 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-52-30-105-51.eu-west-1.compute.amazonaws.com

citi.demdex.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 15.188.105.205 (Paris, France)

ASN16509 (AMAZON-02, US)
PTR: ec2-15-188-105-205.eu-west-3.compute.amazonaws.com

metrics1.citi.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 66.117.28.86 (United States) 1 redirects

ASN15224 (OMNITURE, US)

cm.everesttech.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.124.153.199 (Netherlands)

ASN16625 (AKAMAI-AS, US)
PTR: a104-124-153-199.deploy.static.akamaitechnologies.com

c1.rfihub.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 185.31.128.129 (Netherlands)

ASN54312 (ROCKETFUEL, US)

a.rfihub.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
20766699p.rfihub.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.224.185.201 (Seattle, United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-224-185-201.fra2.r.cloudfront.net

js.adsrvr.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 151.101.114.133 (Frankfurt am Main, Germany)

ASN54113 (FASTLY, US)

resources.digital-cloud-citi.medallia.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 13.225.78.34 (Seattle, United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-225-78-34.fra2.r.cloudfront.net

cdn.pbbl.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 35.190.72.21 (Mountain View, United States)

ASN15169 (GOOGLE, US)
PTR: 21.72.190.35.bc.googleusercontent.com

sr.rlcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a00:1450:4001:817::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2620:1ec:c11::200 (United States)

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

bat.bing.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 216.200.122.11 (United States) 1 redirects

ASN6461 (ZAYO-6461, US)
PTR: 216.200.122.11.IPYX-141870-ZYO.zip.zayo.com

gwmtracking.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:808::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

adservice.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 172.217.22.2 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s14-in-f2.1e100.net

pubads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 54.154.55.10 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-54-154-55-10.eu-west-1.compute.amazonaws.com

beacon.krxd.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 23.45.237.36 (United States)

ASN20940 (AKAMAI-ASN1, US)
PTR: a23-45-237-36.deploy.static.akamaitechnologies.com

stags.bluekai.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 172.217.22.38 (United States) 2 redirects

ASN15169 (GOOGLE, US)
PTR: fra15s16-in-f38.1e100.net

6256710.fls.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

14 2a00:1450:4001:825::2002 (Frankfurt am Main, Germany) 9 redirects

ASN15169 (GOOGLE, US)

googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

14 2a00:1450:4001:820::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 54.246.153.43 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-54-246-153-43.eu-west-1.compute.amazonaws.com

insight.adsrvr.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 151.101.13.175 (Frankfurt am Main, Germany)

ASN54113 (FASTLY, US)

nebula-cdn.kampyle.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 35.241.45.82 (Ascension Island)

ASN15169 (GOOGLE, US)
PTR: 82.45.241.35.bc.googleusercontent.com

udc-neb.kampyle.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:808::2013 (Frankfurt am Main, Germany) 1 redirects

ASN15169 (GOOGLE, US)

px0.pbbl.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 35.176.232.241 (London, United Kingdom) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-35-176-232-241.eu-west-2.compute.amazonaws.com

aa.agkn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
22	doubleclick.net 14 redirects ad.doubleclick.net pubads.g.doubleclick.net 6256710.fls.doubleclick.net googleads.g.doubleclick.net	17 KB
20	citi.com 1 redirects mortgage.citi.com metrics1.citi.com	150 KB
16	google.com 10 redirects www.google.com adservice.google.com	7 KB
14	google.de www.google.de	2 KB
12	ensighten.com nexus.ensighten.com	176 KB
6	demdex.net 1 redirects dpm.demdex.net citi.demdex.net	4 KB
6	bridgetrack.com 2 redirects citi.bridgetrack.com sec-citi.bridgetrack.com	108 KB
4	googletagmanager.com www.googletagmanager.com	112 KB
4	pbbl.co 1 redirects cdn.pbbl.co px0.pbbl.co	9 KB
3	bing.com bat.bing.com	8 KB
3	googleadservices.com 1 redirects www.googleadservices.com	11 KB
2	kampyle.com nebula-cdn.kampyle.com udc-neb.kampyle.com	6 KB
2	medallia.com resources.digital-cloud-citi.medallia.com	57 KB
2	adsrvr.org js.adsrvr.org insight.adsrvr.org	2 KB
2	rfihub.com a.rfihub.com 20766699p.rfihub.com	684 B
2	gstatic.com www.gstatic.com	13 KB
1	agkn.com 1 redirects aa.agkn.com	394 B
1	bluekai.com stags.bluekai.com
1	krxd.net beacon.krxd.net	320 B
1	gwmtracking.com 1 redirects gwmtracking.com	389 B
1	rlcdn.com sr.rlcdn.com
1	rfihub.net c1.rfihub.net	7 KB
1	everesttech.net 1 redirects cm.everesttech.net	554 B
1	bkrtx.com tags.bkrtx.com	10 KB
1	google.be www.google.be	564 B
1	dartsearch.net 1 redirects clickserve.dartsearch.net	836 B
96	26

	Domain	Requested by
18	mortgage.citi.com	1 redirects mortgage.citi.com
15	www.google.com	10 redirects
14	www.google.de
14	googleads.g.doubleclick.net	9 redirects www.googleadservices.com
12	nexus.ensighten.com	mortgage.citi.com nexus.ensighten.com
5	dpm.demdex.net	1 redirects mortgage.citi.com nexus.ensighten.com
4	6256710.fls.doubleclick.net	2 redirects www.googletagmanager.com nexus.ensighten.com
4	www.googletagmanager.com	nexus.ensighten.com
3	bat.bing.com	nexus.ensighten.com
3	sec-citi.bridgetrack.com	mortgage.citi.com
3	citi.bridgetrack.com	2 redirects mortgage.citi.com
3	ad.doubleclick.net	3 redirects
3	www.googleadservices.com	1 redirects www.gstatic.com www.googletagmanager.com
2	px0.pbbl.co	1 redirects
2	cdn.pbbl.co	nexus.ensighten.com cdn.pbbl.co
2	resources.digital-cloud-citi.medallia.com	nexus.ensighten.com resources.digital-cloud-citi.medallia.com
2	metrics1.citi.com	nexus.ensighten.com
2	www.gstatic.com	mortgage.citi.com www.gstatic.com
1	aa.agkn.com	1 redirects
1	udc-neb.kampyle.com
1	nebula-cdn.kampyle.com	resources.digital-cloud-citi.medallia.com
1	insight.adsrvr.org	js.adsrvr.org
1	stags.bluekai.com	tags.bkrtx.com
1	beacon.krxd.net
1	pubads.g.doubleclick.net
1	adservice.google.com
1	gwmtracking.com	1 redirects
1	sr.rlcdn.com	nexus.ensighten.com
1	js.adsrvr.org	nexus.ensighten.com
1	20766699p.rfihub.com	c1.rfihub.net
1	a.rfihub.com	c1.rfihub.net
1	c1.rfihub.net	nexus.ensighten.com
1	cm.everesttech.net	1 redirects
1	citi.demdex.net	nexus.ensighten.com
1	tags.bkrtx.com	nexus.ensighten.com
1	www.google.be	www.gstatic.com
1	clickserve.dartsearch.net	1 redirects
96	37

This site contains links to these domains. Also see Links.

Domain
online.citi.com
online.citibank.com
citi.bridgetrack.com
careers.citigroup.com
www.citigroup.com

Subject Issuer	Validity	Valid
mortgage.citi.com DigiCert SHA2 Extended Validation Server CA	`2020-02-12` - `2022-02-18`	2 years	crt.sh
nexus.ensighten.com DigiCert SHA2 Secure Server CA	`2019-10-03` - `2020-10-02`	a year	crt.sh
citi.bridgetrack.com Thawte EV RSA CA 2018	`2019-09-11` - `2021-05-10`	2 years	crt.sh
*.google.com GTS CA 1O1	`2020-01-21` - `2020-04-14`	3 months	crt.sh
*.demdex.net DigiCert SHA2 High Assurance Server CA	`2018-01-09` - `2021-02-12`	3 years	crt.sh
*.bridgetrack.com DigiCert SHA2 Secure Server CA	`2020-01-08` - `2021-04-08`	a year	crt.sh
www.googleadservices.com GTS CA 1O1	`2020-01-21` - `2020-04-14`	3 months	crt.sh
*.google.be GTS CA 1O1	`2020-01-29` - `2020-04-22`	3 months	crt.sh
*.bkrtx.com DigiCert SHA2 Secure Server CA	`2018-12-03` - `2020-03-03`	a year	crt.sh
metrics1.citi.com DigiCert SHA2 Extended Validation Server CA	`2018-08-31` - `2020-08-30`	2 years	crt.sh
*.rfihub.net DigiCert SHA2 Secure Server CA	`2019-01-25` - `2020-04-25`	a year	crt.sh
*.rfihub.com DigiCert SHA2 Secure Server CA	`2019-08-27` - `2020-08-31`	a year	crt.sh
*.adsrvr.org Trustwave Organization Validation SHA256 CA, Level 1	`2019-03-07` - `2021-04-19`	2 years	crt.sh
*.digital-cloud-citi.medallia.com SSL.com DV CA	`2018-11-13` - `2020-11-12`	2 years	crt.sh
*.pbbl.co Amazon	`2020-01-01` - `2021-02-01`	a year	crt.sh
*.rlcdn.com Sectigo RSA Domain Validation Secure Server CA	`2019-04-24` - `2020-04-23`	a year	crt.sh
*.google-analytics.com GTS CA 1O1	`2020-01-29` - `2020-04-22`	3 months	crt.sh
www.bing.com Microsoft IT TLS CA 2	`2019-04-30` - `2021-04-30`	2 years	crt.sh
*.g.doubleclick.net GTS CA 1O1	`2020-01-21` - `2020-04-14`	3 months	crt.sh
beacon.krxd.net DigiCert SHA2 Secure Server CA	`2020-01-30` - `2021-01-30`	a year	crt.sh
odc-prod-01.oracle.com DigiCert ECC Secure Server CA	`2018-12-10` - `2020-03-10`	a year	crt.sh
*.doubleclick.net GTS CA 1O1	`2020-01-29` - `2020-04-22`	3 months	crt.sh
www.google.de GTS CA 1O1	`2020-01-29` - `2020-04-22`	3 months	crt.sh
www.google.com GTS CA 1O1	`2020-01-29` - `2020-04-22`	3 months	crt.sh
j.ssl.fastly.net GlobalSign Organization Validation CA - SHA256 - G2	`2020-02-06` - `2020-06-11`	4 months	crt.sh
*.kampyle.com RapidSSL RSA CA 2018	`2019-02-17` - `2020-03-01`	a year	crt.sh
px0.pbbl.co GTS CA 1D2	`2019-12-31` - `2020-03-30`	3 months	crt.sh

This page contains 9 frames:

Primary Page: https://mortgage.citi.com/cmi/PaidSearch/Conforming/Chip/LF2/default.htm?ISN=14814-9&BTST=9032003&btlp=dual&cmp=KNC~05~180105~BNKMORTG~Google&gclid=EAIaIQobChMI5-Hlrr_P5wIVDtvACh1yNwFcEAMYAyAAEgLnmvD_BwE&ProspectID=99395EC4AA874445AAE0B43E4AAA421E
Frame ID: A640C4B35EF8256D9F6917415E115285
Requests: 88 HTTP requests in this frame

Frame: https://citi.demdex.net/dest5.html?d_nsid=0
Frame ID: 4B4D40E5DB7D7C6DD99901B898AA128F
Requests: 1 HTTP requests in this frame

Frame: https://20766699p.rfihub.com/ca.html?rfiidc=1582522692080480092&rfiaid=df04b04b38044e929cadb41e841739a0&ver=9&ra=200&rb=648&ca=20766699&_o=17169175&_t=paidsearchmortgagedualleadlanding&ssv_cuuid=&ssv_pagename=paidsearchmortgagedualleadlanding&pe=https%3A%2F%2Fmortgage.citi.com%2Fcmi%2FPaidSearch%2FConforming%2FChip%2FLF2%2Fdefault.htm%3FISN%3D14814-9%26BTST%3D9032003%26btlp%3Ddual%26cmp%3DKNC%7E05%7E180105%7EBNKMORTG%7EGoogle%26gclid%3DEAIaIQobChMI5-Hlrr_P5wIVDtvACh1yNwFcEAMYAyAAEgLnmvD_BwE%26ProspectID%3D99395EC4AA874445AAE0B43E4AAA421E&pf=&ra=9959123518940551
Frame ID: 762A8FD68C2E6A70DD13FDE9E10521FE
Requests: 1 HTTP requests in this frame

Frame: https://sr.rlcdn.com/425466.html?es=80676&u=da39a3ee5e6b4b0d3255bfef95601890afd80709
Frame ID: D08206F4CD046DE19463EA462BB1004E
Requests: 1 HTTP requests in this frame

Frame: https://stags.bluekai.com/site/63068?ret=html&phint=language%3Denglish&phint=product&phint=event&phint=category%3Dprelogin%20lead%20form&phint=page%3Dpaid%20search%20mortgage%20dual%20lead%20landing&phint=section1%3DSapient&phint=section2%3DACQ&phint=section3%3DMORTGAGE&phint=section4%3DPaidSearch&phint=bankappstatus&phint=productID&phint=__bk_t%3DCitibank&phint=__bk_k%3DMortgage%20calculator%2C%20buy%20a%20home%2C%20real%20estate%2C%20home%20loan%2C%20closing%20costs%2C%20new%20homes&phint=__bk_l%3Dhttps%3A%2F%2Fmortgage.citi.com%2Fcmi%2FPaidSearch%2FConforming%2FChip%2FLF2%2Fdefault.htm%3FISN%3D14814-9%26BTST%3D9032003%26btlp%3Ddual%26cmp%3DKNC~05~180105~BNKMORTG~Google%26gclid%3DEAIaIQobChMI5-Hlrr_P5wIVDtvACh1yNwFcEAMYAyAAEgLnmvD_BwE%26ProspectID%3D99395EC4AA874445AAE0B43E4AAA421E&phint=__bk_v%3D3.1.3&limit=10&r=56595650
Frame ID: 83D4880F7D828C785CEB6253CFC3703A
Requests: 1 HTTP requests in this frame

Frame: https://6256710.fls.doubleclick.net/activityi;dc_pre=CI35gMa_z-cCFVjhuwgdTQABSQ;src=6256710;type=globa0;cat=mortg00l;ord=1;num=7865387505600;gtm=2oa250;gclaw=EAIaIQobChMI5-Hlrr_P5wIVDtvACh1yNwFcEAMYAyAAEgLnmvD_BwE;auiddc=1821467570.1581630175;u3=99395EC4AA874445AAE0B43E4AAA421E;u1=14814-9;~oref=https%3A%2F%2Fmortgage.citi.com%2Fcmi%2FPaidSearch%2FConforming%2FChip%2FLF2%2Fdefault.htm%3FISN%3D14814-9%26BTST%3D9032003%26btlp%3Ddual%26cmp%3DKNC~05~180105~BNKMORTG~Google%26gclid%3DEAIaIQobChMI5-Hlrr_P5wIVDtvACh1yNwFcEAMYAyAAEgLnmvD_BwE%26ProspectID%3D99395EC4AA874445AAE0B43E4AAA421E
Frame ID: 410655F36199883ADFED5CECFECAF823
Requests: 1 HTTP requests in this frame

Frame: https://insight.adsrvr.org/track/up?adv=1jw5cvl&ref=https%3A%2F%2Fmortgage.citi.com%2Fcmi%2FPaidSearch%2FConforming%2FChip%2FLF2%2Fdefault.htm%3FISN%3D14814-9%26BTST%3D9032003%26btlp%3Ddual%26cmp%3DKNC~05~180105~BNKMORTG~Google%26gclid%3DEAIaIQobChMI5-Hlrr_P5wIVDtvACh1yNwFcEAMYAyAAEgLnmvD_BwE%26ProspectID%3D99395EC4AA874445AAE0B43E4AAA421E&upid=t1sl5ty&upv=1.1.0&orderid={orderid}&v={v}&vf={vf}&td1=Sapient_cmi_PaidSearch_Conforming_chip_LF2&td2=undefined&td3=undefined&td4=paid%20search%20mortgage%20dual%20lead%20landing&td5=cmp=KNC~05~180105~BNKMORTG~Google&gclid=EAIaIQobChMI5-Hlrr_P5wIVDtvACh1yNwFcEAMYAyAAEgLnmvD_BwE&ProspectID=99395EC4AA874445AAE0B43E4AAA421E&td6={td6}&td7={td7}&td8={td8}&td9={td9}&td10={td10}
Frame ID: 51039632BBF414E2D04CF3330EFA969B
Requests: 1 HTTP requests in this frame

Frame: https://6256710.fls.doubleclick.net/activityi;dc_pre=CMOAjMa_z-cCFfDCuwgdcvIHZQ;src=6256710;type=sapie0;cat=mortg00l;u1=14814-9;u3=99395EC4AA874445AAE0B43E4AAA421E;dc_lat=;dc_rdid=;tag_for_child_directed_treatment;ord=1874668717.7012622
Frame ID: 98DD1885463EC9E60FD231BD5F1BC512
Requests: 1 HTTP requests in this frame

Frame: https://cdn.pbbl.co/i/pp.html
Frame ID: CC05FD67728280794E190D8087644348
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Buying or Refinancing a home? | Citi.comBuying or Refinancing a home? | Citi.comBuying or Refinancing a home? | Citi.com

Page URL History Show full URLs

https://www.google.com/aclk?sa=l&ai=DChcSEwjn4eWuv8_nAhUO28AKHXI3AVwYABAGGgJpbQ&sig=AOD64_0ERylWwvB... HTTP 302
https://www.googleadservices.com/pagead/aclk?sa=L&ai=C3OvirsJFXufSF462gwby7oTgBeqHhrNbrrmnsZsI6YfsBAgDEAMoA2D... HTTP 302
https://clickserve.dartsearch.net/link/click?lid=43700027039272782&ds_s_kwgid=58700003366153617&ds_a_cid=24331... HTTP 302
https://ad.doubleclick.net/ddm/clk/407053222;207311165;m;u=ds&sv1=27039272782&sv2=3163260343468842&sv3=... HTTP 302
https://citi.bridgetrack.com/_spredir.htm?BTPS_TGT=https://mortgage.citi.com/cmi/PaidSearch/Conforming/Ch... HTTP 302
https://citi.bridgetrack.com/cmi/_spredir.htm?BTPS_TGT=https://mortgage.citi.com/cmi/PaidSearch/Conformin... HTTP 302
https://mortgage.citi.com/cmi/PaidSearch/Conforming/Chip/LF2/default.htm?ISN=14814-9&BTST=9032003&btlp... Page URL

Detected technologies

Windows Server (Operating Systems) Expand

Overall confidence: 100%
Detected patterns

headers server /^(?:Microsoft-)?IIS(?:\/([\d.]+))?/i

Bootstrap (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

script /(?:\/([\d.]+))?(?:\/js)?\/bootstrap(?:\.min)?\.js/i

IIS (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /^(?:Microsoft-)?IIS(?:\/([\d.]+))?/i

Ensighten (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

script /\/\/nexus\.ensighten\.com\//i

Page Statistics

96
Requests

100 %
HTTPS

28 %
IPv6

26
Domains

37
Subdomains

31
IPs

7
Countries

677 kB
Transfer

1777 kB
Size

12
Cookies

15 Outgoing links

These are links going to different origins than the main page.

URL: https://online.citi.com/JRS/CHIP/docs/citi_mort_app_checklist.pdf
Title: View documents checklist

Search URL Search Domain Scan URL

URL: https://online.citibank.com/JRS/portal/template.do?ID=standalone_mortgage_calculator
Title: Calculate Payments >

Search URL Search Domain Scan URL

URL: https://online.citi.com/US/Welcome.c
Title: Citi

Search URL Search Domain Scan URL

URL: https://online.citi.com/US/JRS/portal/template.do?ID=TermsDisclaimer
Title: Terms & Conditions

Search URL Search Domain Scan URL

URL: https://online.citi.com/US/JRS/portal/template.do?ID=Privacy
Title: Privacy

Search URL Search Domain Scan URL

URL: https://citi.bridgetrack.com/track/?TGT=151058
Title: Notice at Collection

Search URL Search Domain Scan URL

URL: https://citi.bridgetrack.com/track/?TGT=151059
Title: CA Privacy Hub

Search URL Search Domain Scan URL

URL: https://online.citi.com/US/JRS/pands/detail.do?ID=SecurityCenter
Title: Security

Search URL Search Domain Scan URL

URL: http://careers.citigroup.com/Careers/
Title: Careers

Search URL Search Domain Scan URL

URL: http://www.citigroup.com/citi/
Title: About Us

Search URL Search Domain Scan URL

URL: https://online.citi.com/US/JRS/portal/contactus.do?ID=ContactUsMortgage
Title: Contact Us

Search URL Search Domain Scan URL

URL: https://online.citi.com/US/JRS/portal/sitemap.do
Title: Site Map

Search URL Search Domain Scan URL

URL: https://online.citi.com/US/JRS/portal/template.do?ID=FacebookSpeedbump
Title: Facebook

Search URL Search Domain Scan URL

URL: https://online.citi.com/US/JRS/portal/template.do?ID=SocialTwitterSpeedbump
Title: Twitter

Search URL Search Domain Scan URL

URL: https://online.citi.com/US/JRS/portal/template.do?ID=SocialYoutubeSpeedbump
Title: YouTube

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://www.google.com/aclk?sa=l&ai=DChcSEwjn4eWuv8_nAhUO28AKHXI3AVwYABAGGgJpbQ&sig=AOD64_0ERylWwvBxceJpyexmo6uqpv_qYQ&q=&ved=2ahUKEwi1wN6uv8_nAhXXZs0KHY1AAXkQ0Qx6BAgPEAE&adurl= HTTP 302
https://www.googleadservices.com/pagead/aclk?sa=L&ai=C3OvirsJFXufSF462gwby7oTgBeqHhrNbrrmnsZsI6YfsBAgDEAMoA2DJnt2GyKP8GqABwcyajAPIAQHIA9ggqgRDT9C0XQKiM4rWABcINKNVw6oXMKyHgbYq-VqTnjU8qvwR-WthD8LgkdwJfMg_B-AKL1w7orohP6c_JfWzUEAuw-2TE8AErd___qoBoAZRgAens-VzkAcDqAemvhuoB_LZG6gH89EbqAfu0huoB8LaG9gHAbAIAdIIBBABIASaCUhodHRwczovL21vcnRnYWdlLmNpdGkuY29tL2NtaS9QYWlkU2VhcmNoL0NvbmZvcm1pbmcvQ2hpcC9MRjIvZGVmYXVsdC5odG2xCbUXgMGZASzEuQk2i-vSkVWMLPgJAaITXQpRCANAAVIICgYSBAgDEANomsq-xUVyMBIuIAIoATgEQOql6McDWAFo_v__________AXABmAEB0AGPveId2AGE3fTWT-ABAoIBCAoCCAoKAggBGggKBmdvb2dsZQ&ved=2ahUKEwi1wN6uv8_nAhXXZs0KHY1AAXkQ0Qx6BAgPEAE&dblrd=1&val=GgiR6zRImUARyCABKAAwsafX3Ib3nZOvATjZhZfyBUDZhZfyBQ&sig=AOD64_2hn8EqmA7FGT6K4rbDw8W_RZe8EQ&adurl=https://clickserve.dartsearch.net/link/click%3Flid%3D43700027039272782%26ds_s_kwgid%3D58700003366153617%26ds_a_cid%3D243318178%26ds_a_caid%3D955912938%26ds_a_agid%3D45900361645%26ds_a_fiid%3D%26ds_a_lid%3Dkwd-10159081%26%26ds_e_adid%3D316447329023%26ds_e_matchtype%3Dsearch%26ds_e_device%3Dc%26ds_e_network%3Dg%26%26ds_url_v%3D2%26ds_dest_url%3Dhttps://citi.bridgetrack.com/_spredir.htm%3FBTPS_TGT%3Dhttps://mortgage.citi.com/cmi/PaidSearch/Conforming/Chip/LF2/default.htm%3FISN%3D14814-9%26BTPS_BU%3DCMI%26BTPS_PUB%3DGOO%26BTPS_DOM%3DDCM.COM%26BTPS_KPROFID%3D10001%26BTPS_MTYPE%3De%26BTPS_AD%3D316447329023%26BTPS_GRP%3D%5BAdgroup%5D%26BTPS_CMP%3D%5BCampaign%5D%26BTPS_KWD%3Dmortgages%26BTST%3D9032003%26btlp%3Ddual%26cmp%3DKNC~05~180105~BNKMORTG~Google%26 HTTP 302
https://clickserve.dartsearch.net/link/click?lid=43700027039272782&ds_s_kwgid=58700003366153617&ds_a_cid=243318178&ds_a_caid=955912938&ds_a_agid=45900361645&ds_a_fiid=&ds_a_lid=kwd-10159081&&ds_e_adid=316447329023&ds_e_matchtype=search&ds_e_device=c&ds_e_network=g&&ds_url_v=2&ds_dest_url=https://citi.bridgetrack.com/_spredir.htm?BTPS_TGT=https://mortgage.citi.com/cmi/PaidSearch/Conforming/Chip/LF2/default.htm?ISN=14814-9&BTPS_BU=CMI&BTPS_PUB=GOO&BTPS_DOM=DCM.COM&BTPS_KPROFID=10001&BTPS_MTYPE=e&BTPS_AD=316447329023&BTPS_GRP=[Adgroup]&BTPS_CMP=[Campaign]&BTPS_KWD=mortgages&BTST=9032003&btlp=dual&cmp=KNC~05~180105~BNKMORTG~Google&&gclid=EAIaIQobChMI5-Hlrr_P5wIVDtvACh1yNwFcEAMYAyAAEgLnmvD_BwE HTTP 302
https://ad.doubleclick.net/ddm/clk/407053222;207311165;m;u=ds&sv1=27039272782&sv2=3163260343468842&sv3=3171283427010645771&gclid=EAIaIQobChMI5-Hlrr_P5wIVDtvACh1yNwFcEAMYAyAAEgLnmvD_BwE;%3fhttps://citi.bridgetrack.com/_spredir.htm?BTPS_TGT=https://mortgage.citi.com/cmi/PaidSearch/Conforming/Chip/LF2/default.htm?ISN=14814-9&BTPS_BU=CMI&BTPS_PUB=GOO&BTPS_DOM=DCM.COM&BTPS_KPROFID=10001&BTPS_MTYPE=e&BTPS_AD=316447329023&BTPS_GRP=[Adgroup]&BTPS_CMP=[Campaign]&BTPS_KWD=mortgages&BTST=9032003&btlp=dual&cmp=KNC~05~180105~BNKMORTG~Google&gclid=EAIaIQobChMI5-Hlrr_P5wIVDtvACh1yNwFcEAMYAyAAEgLnmvD_BwE HTTP 302
https://citi.bridgetrack.com/_spredir.htm?BTPS_TGT=https://mortgage.citi.com/cmi/PaidSearch/Conforming/Chip/LF2/default.htm?ISN=14814-9&BTPS_BU=CMI&BTPS_PUB=GOO&BTPS_DOM=DCM.COM&BTPS_KPROFID=10001&BTPS_MTYPE=e&BTPS_AD=316447329023&BTPS_GRP=[Adgroup]&BTPS_CMP=[Campaign]&BTPS_KWD=mortgages&BTST=9032003&btlp=dual&cmp=KNC~05~180105~BNKMORTG~Google&gclid=EAIaIQobChMI5-Hlrr_P5wIVDtvACh1yNwFcEAMYAyAAEgLnmvD_BwE HTTP 302
https://citi.bridgetrack.com/cmi/_spredir.htm?BTPS_TGT=https://mortgage.citi.com/cmi/PaidSearch/Conforming/Chip/LF2/default.htm?ISN=14814-9&BTPS_BU=CMI&BTPS_PUB=GOO&BTPS_DOM=DCM.COM&BTPS_KPROFID=10001&BTPS_MTYPE=e&BTPS_AD=316447329023&BTPS_GRP=[Adgroup]&BTPS_CMP=[Campaign]&BTPS_KWD=mortgages&BTST=9032003&btlp=dual&cmp=KNC~05~180105~BNKMORTG~Google&gclid=EAIaIQobChMI5-Hlrr_P5wIVDtvACh1yNwFcEAMYAyAAEgLnmvD_BwE HTTP 302
https://mortgage.citi.com/cmi/PaidSearch/Conforming/Chip/LF2/default.htm?ISN=14814-9&BTST=9032003&btlp=dual&cmp=KNC~05~180105~BNKMORTG~Google&gclid=EAIaIQobChMI5-Hlrr_P5wIVDtvACh1yNwFcEAMYAyAAEgLnmvD_BwE&ProspectID=99395EC4AA874445AAE0B43E4AAA421E Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 6

https://mortgage.citi.com/track/?id=57746&random=2.07522494119504E+17 HTTP 302
https://citi.bridgetrack.com/track/Default.asp?id=57746&random=2.07522494119504E+17

Request Chain 8

https://dpm.demdex.net/id?d_visid_ver=3.1.2&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=61834D9B5228A7430A490D45%40AdobeOrg&d_nsid=0&ts=1581630174261 HTTP 302
https://dpm.demdex.net/id/rd?d_visid_ver=3.1.2&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=61834D9B5228A7430A490D45%40AdobeOrg&d_nsid=0&ts=1581630174261

Request Chain 41

https://cm.everesttech.net/cm/dd?d_uuid=82646829199048213381875002600373202871 HTTP 302
https://dpm.demdex.net/ibs:dpid=411&dpuuid=XkXC3gAAAaXJhxTJ

Request Chain 52

https://gwmtracking.com/p/v/1/5cf163aaf870814c0138c6b2/format/img HTTP 302
https://ad.doubleclick.net/ddm/activity/src=8825552;type=invmedia;cat=citi_006;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;ord=1 HTTP 302
https://ad.doubleclick.net/ddm/activity/src=8825552;dc_pre=CPbJs8a_z-cCFYmXdwod8lYLLQ;type=invmedia;cat=citi_006;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;ord=1 HTTP 302
https://adservice.google.com/ddm/fls/z/src=8825552;dc_pre=CPbJs8a_z-cCFYmXdwod8lYLLQ;type=invmedia;cat=citi_006;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;ord=1

Request Chain 59

https://6256710.fls.doubleclick.net/activityi;src=6256710;type=globa0;cat=mortg00l;ord=1;num=7865387505600;gtm=2oa250;gclaw=EAIaIQobChMI5-Hlrr_P5wIVDtvACh1yNwFcEAMYAyAAEgLnmvD_BwE;auiddc=1821467570.1581630175;u3=99395EC4AA874445AAE0B43E4AAA421E;u1=14814-9;~oref=https%3A%2F%2Fmortgage.citi.com%2Fcmi%2FPaidSearch%2FConforming%2FChip%2FLF2%2Fdefault.htm%3FISN%3D14814-9%26BTST%3D9032003%26btlp%3Ddual%26cmp%3DKNC~05~180105~BNKMORTG~Google%26gclid%3DEAIaIQobChMI5-Hlrr_P5wIVDtvACh1yNwFcEAMYAyAAEgLnmvD_BwE%26ProspectID%3D99395EC4AA874445AAE0B43E4AAA421E HTTP 302
https://6256710.fls.doubleclick.net/activityi;dc_pre=CI35gMa_z-cCFVjhuwgdTQABSQ;src=6256710;type=globa0;cat=mortg00l;ord=1;num=7865387505600;gtm=2oa250;gclaw=EAIaIQobChMI5-Hlrr_P5wIVDtvACh1yNwFcEAMYAyAAEgLnmvD_BwE;auiddc=1821467570.1581630175;u3=99395EC4AA874445AAE0B43E4AAA421E;u1=14814-9;~oref=https%3A%2F%2Fmortgage.citi.com%2Fcmi%2FPaidSearch%2FConforming%2FChip%2FLF2%2Fdefault.htm%3FISN%3D14814-9%26BTST%3D9032003%26btlp%3Ddual%26cmp%3DKNC~05~180105~BNKMORTG~Google%26gclid%3DEAIaIQobChMI5-Hlrr_P5wIVDtvACh1yNwFcEAMYAyAAEgLnmvD_BwE%26ProspectID%3D99395EC4AA874445AAE0B43E4AAA421E

Request Chain 69

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/975701947/?random=1581630175041&cv=9&fst=1581630175041&num=1&fmt=3&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa250&sendb=1&ig=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fmortgage.citi.com%2Fcmi%2FPaidSearch%2FConforming%2FChip%2FLF2%2Fdefault.htm%3FISN%3D14814-9%26BTST%3D9032003%26btlp%3Ddual%26cmp%3DKNC~05~180105~BNKMORTG~Google%26gclid%3DEAIaIQobChMI5-Hlrr_P5wIVDtvACh1yNwFcEAMYAyAAEgLnmvD_BwE%26ProspectID%3D99395EC4AA874445AAE0B43E4AAA421E&tiba=Buying%20or%20Refinancing%20a%20home%3F%20%7C%20Citi.com&hn=www.googleadservices.com&async=1 HTTP 302
https://www.google.com/pagead/1p-user-list/975701947/?random=1581630175041&cv=9&fst=1581627600000&num=1&fmt=3&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa250&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fmortgage.citi.com%2Fcmi%2FPaidSearch%2FConforming%2FChip%2FLF2%2Fdefault.htm%3FISN%3D14814-9%26BTST%3D9032003%26btlp%3Ddual%26cmp%3DKNC~05~180105~BNKMORTG~Google%26gclid%3DEAIaIQobChMI5-Hlrr_P5wIVDtvACh1yNwFcEAMYAyAAEgLnmvD_BwE%26ProspectID%3D99395EC4AA874445AAE0B43E4AAA421E&tiba=Buying%20or%20Refinancing%20a%20home%3F%20%7C%20Citi.com&async=1&is_vtc=1&random=1009118526&resp=GooglemKTybQhCsO HTTP 302
https://www.google.de/pagead/1p-user-list/975701947/?random=1581630175041&cv=9&fst=1581627600000&num=1&fmt=3&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa250&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fmortgage.citi.com%2Fcmi%2FPaidSearch%2FConforming%2FChip%2FLF2%2Fdefault.htm%3FISN%3D14814-9%26BTST%3D9032003%26btlp%3Ddual%26cmp%3DKNC~05~180105~BNKMORTG~Google%26gclid%3DEAIaIQobChMI5-Hlrr_P5wIVDtvACh1yNwFcEAMYAyAAEgLnmvD_BwE%26ProspectID%3D99395EC4AA874445AAE0B43E4AAA421E&tiba=Buying%20or%20Refinancing%20a%20home%3F%20%7C%20Citi.com&async=1&is_vtc=1&random=1009118526&resp=GooglemKTybQhCsO&ipr=y

Request Chain 70

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/770961656/?random=1581630175041&cv=9&fst=1581630175041&num=1&fmt=3&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa250&sendb=1&ig=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fmortgage.citi.com%2Fcmi%2FPaidSearch%2FConforming%2FChip%2FLF2%2Fdefault.htm%3FISN%3D14814-9%26BTST%3D9032003%26btlp%3Ddual%26cmp%3DKNC~05~180105~BNKMORTG~Google%26gclid%3DEAIaIQobChMI5-Hlrr_P5wIVDtvACh1yNwFcEAMYAyAAEgLnmvD_BwE%26ProspectID%3D99395EC4AA874445AAE0B43E4AAA421E&tiba=Buying%20or%20Refinancing%20a%20home%3F%20%7C%20Citi.com&hn=www.googleadservices.com&async=1 HTTP 302
https://www.google.com/pagead/1p-user-list/770961656/?random=1581630175041&cv=9&fst=1581627600000&num=1&fmt=3&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa250&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fmortgage.citi.com%2Fcmi%2FPaidSearch%2FConforming%2FChip%2FLF2%2Fdefault.htm%3FISN%3D14814-9%26BTST%3D9032003%26btlp%3Ddual%26cmp%3DKNC~05~180105~BNKMORTG~Google%26gclid%3DEAIaIQobChMI5-Hlrr_P5wIVDtvACh1yNwFcEAMYAyAAEgLnmvD_BwE%26ProspectID%3D99395EC4AA874445AAE0B43E4AAA421E&tiba=Buying%20or%20Refinancing%20a%20home%3F%20%7C%20Citi.com&async=1&is_vtc=1&random=3179792022&resp=GooglemKTybQhCsO HTTP 302
https://www.google.de/pagead/1p-user-list/770961656/?random=1581630175041&cv=9&fst=1581627600000&num=1&fmt=3&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa250&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fmortgage.citi.com%2Fcmi%2FPaidSearch%2FConforming%2FChip%2FLF2%2Fdefault.htm%3FISN%3D14814-9%26BTST%3D9032003%26btlp%3Ddual%26cmp%3DKNC~05~180105~BNKMORTG~Google%26gclid%3DEAIaIQobChMI5-Hlrr_P5wIVDtvACh1yNwFcEAMYAyAAEgLnmvD_BwE%26ProspectID%3D99395EC4AA874445AAE0B43E4AAA421E&tiba=Buying%20or%20Refinancing%20a%20home%3F%20%7C%20Citi.com&async=1&is_vtc=1&random=3179792022&resp=GooglemKTybQhCsO&ipr=y

Request Chain 71

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/819500023/?random=1581630175041&cv=9&fst=1581630175041&num=1&fmt=3&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa250&sendb=1&ig=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fmortgage.citi.com%2Fcmi%2FPaidSearch%2FConforming%2FChip%2FLF2%2Fdefault.htm%3FISN%3D14814-9%26BTST%3D9032003%26btlp%3Ddual%26cmp%3DKNC~05~180105~BNKMORTG~Google%26gclid%3DEAIaIQobChMI5-Hlrr_P5wIVDtvACh1yNwFcEAMYAyAAEgLnmvD_BwE%26ProspectID%3D99395EC4AA874445AAE0B43E4AAA421E&tiba=Buying%20or%20Refinancing%20a%20home%3F%20%7C%20Citi.com&hn=www.googleadservices.com&async=1 HTTP 302
https://www.google.com/pagead/1p-user-list/819500023/?random=1581630175041&cv=9&fst=1581627600000&num=1&fmt=3&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa250&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fmortgage.citi.com%2Fcmi%2FPaidSearch%2FConforming%2FChip%2FLF2%2Fdefault.htm%3FISN%3D14814-9%26BTST%3D9032003%26btlp%3Ddual%26cmp%3DKNC~05~180105~BNKMORTG~Google%26gclid%3DEAIaIQobChMI5-Hlrr_P5wIVDtvACh1yNwFcEAMYAyAAEgLnmvD_BwE%26ProspectID%3D99395EC4AA874445AAE0B43E4AAA421E&tiba=Buying%20or%20Refinancing%20a%20home%3F%20%7C%20Citi.com&async=1&is_vtc=1&random=3547488466&resp=GooglemKTybQhCsO HTTP 302
https://www.google.de/pagead/1p-user-list/819500023/?random=1581630175041&cv=9&fst=1581627600000&num=1&fmt=3&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa250&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fmortgage.citi.com%2Fcmi%2FPaidSearch%2FConforming%2FChip%2FLF2%2Fdefault.htm%3FISN%3D14814-9%26BTST%3D9032003%26btlp%3Ddual%26cmp%3DKNC~05~180105~BNKMORTG~Google%26gclid%3DEAIaIQobChMI5-Hlrr_P5wIVDtvACh1yNwFcEAMYAyAAEgLnmvD_BwE%26ProspectID%3D99395EC4AA874445AAE0B43E4AAA421E&tiba=Buying%20or%20Refinancing%20a%20home%3F%20%7C%20Citi.com&async=1&is_vtc=1&random=3547488466&resp=GooglemKTybQhCsO&ipr=y

Request Chain 72

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/959299794/?random=1581630175042&cv=9&fst=1581630175042&num=1&fmt=3&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa250&sendb=1&ig=1&data=event%3Dconversion&frm=0&url=https%3A%2F%2Fmortgage.citi.com%2Fcmi%2FPaidSearch%2FConforming%2FChip%2FLF2%2Fdefault.htm%3FISN%3D14814-9%26BTST%3D9032003%26btlp%3Ddual%26cmp%3DKNC~05~180105~BNKMORTG~Google%26gclid%3DEAIaIQobChMI5-Hlrr_P5wIVDtvACh1yNwFcEAMYAyAAEgLnmvD_BwE%26ProspectID%3D99395EC4AA874445AAE0B43E4AAA421E&tiba=Buying%20or%20Refinancing%20a%20home%3F%20%7C%20Citi.com&hn=www.googleadservices.com&async=1 HTTP 302
https://www.google.com/pagead/1p-user-list/959299794/?random=1581630175042&cv=9&fst=1581627600000&num=1&fmt=3&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa250&sendb=1&data=event%3Dconversion&frm=0&url=https%3A%2F%2Fmortgage.citi.com%2Fcmi%2FPaidSearch%2FConforming%2FChip%2FLF2%2Fdefault.htm%3FISN%3D14814-9%26BTST%3D9032003%26btlp%3Ddual%26cmp%3DKNC~05~180105~BNKMORTG~Google%26gclid%3DEAIaIQobChMI5-Hlrr_P5wIVDtvACh1yNwFcEAMYAyAAEgLnmvD_BwE%26ProspectID%3D99395EC4AA874445AAE0B43E4AAA421E&tiba=Buying%20or%20Refinancing%20a%20home%3F%20%7C%20Citi.com&async=1&is_vtc=1&random=3285781129&resp=GooglemKTybQhCsO HTTP 302
https://www.google.de/pagead/1p-user-list/959299794/?random=1581630175042&cv=9&fst=1581627600000&num=1&fmt=3&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa250&sendb=1&data=event%3Dconversion&frm=0&url=https%3A%2F%2Fmortgage.citi.com%2Fcmi%2FPaidSearch%2FConforming%2FChip%2FLF2%2Fdefault.htm%3FISN%3D14814-9%26BTST%3D9032003%26btlp%3Ddual%26cmp%3DKNC~05~180105~BNKMORTG~Google%26gclid%3DEAIaIQobChMI5-Hlrr_P5wIVDtvACh1yNwFcEAMYAyAAEgLnmvD_BwE%26ProspectID%3D99395EC4AA874445AAE0B43E4AAA421E&tiba=Buying%20or%20Refinancing%20a%20home%3F%20%7C%20Citi.com&async=1&is_vtc=1&random=3285781129&resp=GooglemKTybQhCsO&ipr=y

Request Chain 73

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/960621875/?random=1581630175042&cv=9&fst=1581630175042&num=1&fmt=3&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa250&sendb=1&ig=1&data=event%3Dconversion&frm=0&url=https%3A%2F%2Fmortgage.citi.com%2Fcmi%2FPaidSearch%2FConforming%2FChip%2FLF2%2Fdefault.htm%3FISN%3D14814-9%26BTST%3D9032003%26btlp%3Ddual%26cmp%3DKNC~05~180105~BNKMORTG~Google%26gclid%3DEAIaIQobChMI5-Hlrr_P5wIVDtvACh1yNwFcEAMYAyAAEgLnmvD_BwE%26ProspectID%3D99395EC4AA874445AAE0B43E4AAA421E&tiba=Buying%20or%20Refinancing%20a%20home%3F%20%7C%20Citi.com&hn=www.googleadservices.com&async=1 HTTP 302
https://www.google.com/pagead/1p-user-list/960621875/?random=1581630175042&cv=9&fst=1581627600000&num=1&fmt=3&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa250&sendb=1&data=event%3Dconversion&frm=0&url=https%3A%2F%2Fmortgage.citi.com%2Fcmi%2FPaidSearch%2FConforming%2FChip%2FLF2%2Fdefault.htm%3FISN%3D14814-9%26BTST%3D9032003%26btlp%3Ddual%26cmp%3DKNC~05~180105~BNKMORTG~Google%26gclid%3DEAIaIQobChMI5-Hlrr_P5wIVDtvACh1yNwFcEAMYAyAAEgLnmvD_BwE%26ProspectID%3D99395EC4AA874445AAE0B43E4AAA421E&tiba=Buying%20or%20Refinancing%20a%20home%3F%20%7C%20Citi.com&async=1&is_vtc=1&random=3270834045&resp=GooglemKTybQhCsO HTTP 302
https://www.google.de/pagead/1p-user-list/960621875/?random=1581630175042&cv=9&fst=1581627600000&num=1&fmt=3&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa250&sendb=1&data=event%3Dconversion&frm=0&url=https%3A%2F%2Fmortgage.citi.com%2Fcmi%2FPaidSearch%2FConforming%2FChip%2FLF2%2Fdefault.htm%3FISN%3D14814-9%26BTST%3D9032003%26btlp%3Ddual%26cmp%3DKNC~05~180105~BNKMORTG~Google%26gclid%3DEAIaIQobChMI5-Hlrr_P5wIVDtvACh1yNwFcEAMYAyAAEgLnmvD_BwE%26ProspectID%3D99395EC4AA874445AAE0B43E4AAA421E&tiba=Buying%20or%20Refinancing%20a%20home%3F%20%7C%20Citi.com&async=1&is_vtc=1&random=3270834045&resp=GooglemKTybQhCsO&ipr=y

Request Chain 74

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/916451471/?random=1581630175042&cv=9&fst=1581630175042&num=1&fmt=3&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa250&sendb=1&ig=1&data=event%3Dconversion&frm=0&url=https%3A%2F%2Fmortgage.citi.com%2Fcmi%2FPaidSearch%2FConforming%2FChip%2FLF2%2Fdefault.htm%3FISN%3D14814-9%26BTST%3D9032003%26btlp%3Ddual%26cmp%3DKNC~05~180105~BNKMORTG~Google%26gclid%3DEAIaIQobChMI5-Hlrr_P5wIVDtvACh1yNwFcEAMYAyAAEgLnmvD_BwE%26ProspectID%3D99395EC4AA874445AAE0B43E4AAA421E&tiba=Buying%20or%20Refinancing%20a%20home%3F%20%7C%20Citi.com&hn=www.googleadservices.com&async=1 HTTP 302
https://www.google.com/pagead/1p-user-list/916451471/?random=1581630175042&cv=9&fst=1581627600000&num=1&fmt=3&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa250&sendb=1&data=event%3Dconversion&frm=0&url=https%3A%2F%2Fmortgage.citi.com%2Fcmi%2FPaidSearch%2FConforming%2FChip%2FLF2%2Fdefault.htm%3FISN%3D14814-9%26BTST%3D9032003%26btlp%3Ddual%26cmp%3DKNC~05~180105~BNKMORTG~Google%26gclid%3DEAIaIQobChMI5-Hlrr_P5wIVDtvACh1yNwFcEAMYAyAAEgLnmvD_BwE%26ProspectID%3D99395EC4AA874445AAE0B43E4AAA421E&tiba=Buying%20or%20Refinancing%20a%20home%3F%20%7C%20Citi.com&async=1&is_vtc=1&random=679352739&resp=GooglemKTybQhCsO HTTP 302
https://www.google.de/pagead/1p-user-list/916451471/?random=1581630175042&cv=9&fst=1581627600000&num=1&fmt=3&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa250&sendb=1&data=event%3Dconversion&frm=0&url=https%3A%2F%2Fmortgage.citi.com%2Fcmi%2FPaidSearch%2FConforming%2FChip%2FLF2%2Fdefault.htm%3FISN%3D14814-9%26BTST%3D9032003%26btlp%3Ddual%26cmp%3DKNC~05~180105~BNKMORTG~Google%26gclid%3DEAIaIQobChMI5-Hlrr_P5wIVDtvACh1yNwFcEAMYAyAAEgLnmvD_BwE%26ProspectID%3D99395EC4AA874445AAE0B43E4AAA421E&tiba=Buying%20or%20Refinancing%20a%20home%3F%20%7C%20Citi.com&async=1&is_vtc=1&random=679352739&resp=GooglemKTybQhCsO&ipr=y

Request Chain 75

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/770961656/?random=1581630175043&cv=9&fst=1581630175043&num=1&fmt=3&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa250&sendb=1&ig=1&data=event%3Dconversion&frm=0&url=https%3A%2F%2Fmortgage.citi.com%2Fcmi%2FPaidSearch%2FConforming%2FChip%2FLF2%2Fdefault.htm%3FISN%3D14814-9%26BTST%3D9032003%26btlp%3Ddual%26cmp%3DKNC~05~180105~BNKMORTG~Google%26gclid%3DEAIaIQobChMI5-Hlrr_P5wIVDtvACh1yNwFcEAMYAyAAEgLnmvD_BwE%26ProspectID%3D99395EC4AA874445AAE0B43E4AAA421E&tiba=Buying%20or%20Refinancing%20a%20home%3F%20%7C%20Citi.com&hn=www.googleadservices.com&async=1 HTTP 302
https://www.google.com/pagead/1p-user-list/770961656/?random=1581630175043&cv=9&fst=1581627600000&num=1&fmt=3&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa250&sendb=1&data=event%3Dconversion&frm=0&url=https%3A%2F%2Fmortgage.citi.com%2Fcmi%2FPaidSearch%2FConforming%2FChip%2FLF2%2Fdefault.htm%3FISN%3D14814-9%26BTST%3D9032003%26btlp%3Ddual%26cmp%3DKNC~05~180105~BNKMORTG~Google%26gclid%3DEAIaIQobChMI5-Hlrr_P5wIVDtvACh1yNwFcEAMYAyAAEgLnmvD_BwE%26ProspectID%3D99395EC4AA874445AAE0B43E4AAA421E&tiba=Buying%20or%20Refinancing%20a%20home%3F%20%7C%20Citi.com&async=1&is_vtc=1&random=3747933915&resp=GooglemKTybQhCsO HTTP 302
https://www.google.de/pagead/1p-user-list/770961656/?random=1581630175043&cv=9&fst=1581627600000&num=1&fmt=3&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa250&sendb=1&data=event%3Dconversion&frm=0&url=https%3A%2F%2Fmortgage.citi.com%2Fcmi%2FPaidSearch%2FConforming%2FChip%2FLF2%2Fdefault.htm%3FISN%3D14814-9%26BTST%3D9032003%26btlp%3Ddual%26cmp%3DKNC~05~180105~BNKMORTG~Google%26gclid%3DEAIaIQobChMI5-Hlrr_P5wIVDtvACh1yNwFcEAMYAyAAEgLnmvD_BwE%26ProspectID%3D99395EC4AA874445AAE0B43E4AAA421E&tiba=Buying%20or%20Refinancing%20a%20home%3F%20%7C%20Citi.com&async=1&is_vtc=1&random=3747933915&resp=GooglemKTybQhCsO&ipr=y

Request Chain 76

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/819500023/?random=1581630175043&cv=9&fst=1581630175043&num=1&fmt=3&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa250&sendb=1&ig=1&data=event%3Dconversion&frm=0&url=https%3A%2F%2Fmortgage.citi.com%2Fcmi%2FPaidSearch%2FConforming%2FChip%2FLF2%2Fdefault.htm%3FISN%3D14814-9%26BTST%3D9032003%26btlp%3Ddual%26cmp%3DKNC~05~180105~BNKMORTG~Google%26gclid%3DEAIaIQobChMI5-Hlrr_P5wIVDtvACh1yNwFcEAMYAyAAEgLnmvD_BwE%26ProspectID%3D99395EC4AA874445AAE0B43E4AAA421E&tiba=Buying%20or%20Refinancing%20a%20home%3F%20%7C%20Citi.com&hn=www.googleadservices.com&async=1 HTTP 302
https://www.google.com/pagead/1p-user-list/819500023/?random=1581630175043&cv=9&fst=1581627600000&num=1&fmt=3&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa250&sendb=1&data=event%3Dconversion&frm=0&url=https%3A%2F%2Fmortgage.citi.com%2Fcmi%2FPaidSearch%2FConforming%2FChip%2FLF2%2Fdefault.htm%3FISN%3D14814-9%26BTST%3D9032003%26btlp%3Ddual%26cmp%3DKNC~05~180105~BNKMORTG~Google%26gclid%3DEAIaIQobChMI5-Hlrr_P5wIVDtvACh1yNwFcEAMYAyAAEgLnmvD_BwE%26ProspectID%3D99395EC4AA874445AAE0B43E4AAA421E&tiba=Buying%20or%20Refinancing%20a%20home%3F%20%7C%20Citi.com&async=1&is_vtc=1&random=2410920752&resp=GooglemKTybQhCsO HTTP 302
https://www.google.de/pagead/1p-user-list/819500023/?random=1581630175043&cv=9&fst=1581627600000&num=1&fmt=3&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa250&sendb=1&data=event%3Dconversion&frm=0&url=https%3A%2F%2Fmortgage.citi.com%2Fcmi%2FPaidSearch%2FConforming%2FChip%2FLF2%2Fdefault.htm%3FISN%3D14814-9%26BTST%3D9032003%26btlp%3Ddual%26cmp%3DKNC~05~180105~BNKMORTG~Google%26gclid%3DEAIaIQobChMI5-Hlrr_P5wIVDtvACh1yNwFcEAMYAyAAEgLnmvD_BwE%26ProspectID%3D99395EC4AA874445AAE0B43E4AAA421E&tiba=Buying%20or%20Refinancing%20a%20home%3F%20%7C%20Citi.com&async=1&is_vtc=1&random=2410920752&resp=GooglemKTybQhCsO&ipr=y

Request Chain 77

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/763960929/?random=1581630175043&cv=9&fst=1581630175043&num=1&fmt=3&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa250&sendb=1&ig=1&data=event%3Dconversion&frm=0&url=https%3A%2F%2Fmortgage.citi.com%2Fcmi%2FPaidSearch%2FConforming%2FChip%2FLF2%2Fdefault.htm%3FISN%3D14814-9%26BTST%3D9032003%26btlp%3Ddual%26cmp%3DKNC~05~180105~BNKMORTG~Google%26gclid%3DEAIaIQobChMI5-Hlrr_P5wIVDtvACh1yNwFcEAMYAyAAEgLnmvD_BwE%26ProspectID%3D99395EC4AA874445AAE0B43E4AAA421E&tiba=Buying%20or%20Refinancing%20a%20home%3F%20%7C%20Citi.com&hn=www.googleadservices.com&async=1 HTTP 302
https://www.google.com/pagead/1p-user-list/763960929/?random=1581630175043&cv=9&fst=1581627600000&num=1&fmt=3&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa250&sendb=1&data=event%3Dconversion&frm=0&url=https%3A%2F%2Fmortgage.citi.com%2Fcmi%2FPaidSearch%2FConforming%2FChip%2FLF2%2Fdefault.htm%3FISN%3D14814-9%26BTST%3D9032003%26btlp%3Ddual%26cmp%3DKNC~05~180105~BNKMORTG~Google%26gclid%3DEAIaIQobChMI5-Hlrr_P5wIVDtvACh1yNwFcEAMYAyAAEgLnmvD_BwE%26ProspectID%3D99395EC4AA874445AAE0B43E4AAA421E&tiba=Buying%20or%20Refinancing%20a%20home%3F%20%7C%20Citi.com&async=1&is_vtc=1&random=1544091145&resp=GooglemKTybQhCsO HTTP 302
https://www.google.de/pagead/1p-user-list/763960929/?random=1581630175043&cv=9&fst=1581627600000&num=1&fmt=3&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa250&sendb=1&data=event%3Dconversion&frm=0&url=https%3A%2F%2Fmortgage.citi.com%2Fcmi%2FPaidSearch%2FConforming%2FChip%2FLF2%2Fdefault.htm%3FISN%3D14814-9%26BTST%3D9032003%26btlp%3Ddual%26cmp%3DKNC~05~180105~BNKMORTG~Google%26gclid%3DEAIaIQobChMI5-Hlrr_P5wIVDtvACh1yNwFcEAMYAyAAEgLnmvD_BwE%26ProspectID%3D99395EC4AA874445AAE0B43E4AAA421E&tiba=Buying%20or%20Refinancing%20a%20home%3F%20%7C%20Citi.com&async=1&is_vtc=1&random=1544091145&resp=GooglemKTybQhCsO&ipr=y

Request Chain 90

https://6256710.fls.doubleclick.net/activityi;src=6256710;type=sapie0;cat=mortg00l;u1=14814-9;u3=99395EC4AA874445AAE0B43E4AAA421E;dc_lat=;dc_rdid=;tag_for_child_directed_treatment;ord=1874668717.7012622 HTTP 302
https://6256710.fls.doubleclick.net/activityi;dc_pre=CMOAjMa_z-cCFfDCuwgdcvIHZQ;src=6256710;type=sapie0;cat=mortg00l;u1=14814-9;u3=99395EC4AA874445AAE0B43E4AAA421E;dc_lat=;dc_rdid=;tag_for_child_directed_treatment;ord=1874668717.7012622

Request Chain 93

https://px0.pbbl.co/ns/__p2.gif?ppid=82eb3de0-0118-4d78-8a76-080aeb822586&chk=false&brid=1560&brcid=&email=&orderId=&orderValue=&productId=&offerCode=&label=&pageUrl=https%3A%2F%2Fmortgage.citi.com%2Fcmi%2FPaidSearch%2FConforming%2FChip%2FLF2%2Fdefault.htm%3FISN%3D14814-9%26BTST%3D9032003%26btlp%3Ddual%26cmp%3DKNC~05~180105~BNKMORTG~Google%26gclid%3DEAIaIQobChMI5-Hlrr_P5wIVDtvACh1yNwFcEAMYAyAAEgLnmvD_BwE%26ProspectID%3D99395EC4AA874445AAE0B43E4AAA421E&referrerUrl=&targetUrl=https%3A%2F%2Fmortgage.citi.com%2Fcmi%2FPaidSearch%2FConforming%2FChip%2FLF2%2Fdefault.htm%3FISN%3D14814-9%26BTST%3D9032003%26btlp%3Ddual%26cmp%3DKNC~05~180105~BNKMORTG~Google%26gclid%3DEAIaIQobChMI5-Hlrr_P5wIVDtvACh1yNwFcEAMYAyAAEgLnmvD_BwE%26ProspectID%3D99395EC4AA874445AAE0B43E4AAA421E&sessionId=&markerType=seg&rand=xpJsmDep9sJVlSAc&iabOptOut=-&jsVer=3.2.1&frVer=1.1&markerId=348192 HTTP 302
https://aa.agkn.com/adscores/g.pixel?sid=9212282598&_ppid=82eb3de0-0118-4d78-8a76-080aeb822586&_segid=99&iid=bf3d2608-a4ec-44ad-860e-9a0bc01af80c HTTP 302
https://px0.pbbl.co/adadvisor.gif?segment=000&_ppid=82eb3de0-0118-4d78-8a76-080aeb822586&_segid=99&_zip=&hk=&iid=bf3d2608-a4ec-44ad-860e-9a0bc01af80c&mt=&bd=

96 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1

200
OK

Primary Request

Cookie set default.htm Show response
mortgage.citi.com/cmi/PaidSearch/Conforming/Chip/LF2/
Redirect Chain

https://www.google.com/aclk?sa=l&ai=DChcSEwjn4eWuv8_nAhUO28AKHXI3AVwYABAGGgJpbQ&sig=AOD64_0ERylWwvBxceJpyexmo6uqpv_qYQ&q=&ved=2ahUKEwi1wN6uv8_nAhXXZs0KHY1AAXkQ0Qx6BAgPEAE&adurl=
https://www.googleadservices.com/pagead/aclk?sa=L&ai=C3OvirsJFXufSF462gwby7oTgBeqHhrNbrrmnsZsI6YfsBAgDEAMoA2DJnt2GyKP8GqABwcyajAPIAQHIA9ggqgRDT9C0XQKiM4rWABcINKNVw6oXMKyHgbYq-VqTnjU8qvwR-WthD8Lgkdw...
https://clickserve.dartsearch.net/link/click?lid=43700027039272782&ds_s_kwgid=58700003366153617&ds_a_cid=243318178&ds_a_caid=955912938&ds_a_agid=45900361645&ds_a_fiid=&ds_a_lid=kwd-10159081&&ds_e_a...
https://ad.doubleclick.net/ddm/clk/407053222;207311165;m;u=ds&sv1=27039272782&sv2=3163260343468842&sv3=3171283427010645771&gclid=EAIaIQobChMI5-Hlrr_P5wIVDtvACh1yNwFcEAMYAyAAEgLnmvD_BwE;%3fhttps://c...
https://citi.bridgetrack.com/_spredir.htm?BTPS_TGT=https://mortgage.citi.com/cmi/PaidSearch/Conforming/Chip/LF2/default.htm?ISN=14814-9&BTPS_BU=CMI&BTPS_PUB=GOO&BTPS_DOM=DCM.COM&BTPS_KPROFID=10001&...
https://citi.bridgetrack.com/cmi/_spredir.htm?BTPS_TGT=https://mortgage.citi.com/cmi/PaidSearch/Conforming/Chip/LF2/default.htm?ISN=14814-9&BTPS_BU=CMI&BTPS_PUB=GOO&BTPS_DOM=DCM.COM&BTPS_KPROFID=10...
https://mortgage.citi.com/cmi/PaidSearch/Conforming/Chip/LF2/default.htm?ISN=14814-9&BTST=9032003&btlp=dual&cmp=KNC~05~180105~BNKMORTG~Google&gclid=EAIaIQobChMI5-Hlrr_P5wIVDtvACh1yNwFcEAMYAyAAEgLnm...

23 KB
10 KB

1087ms
652ms

Document
text/html

216.250.52.47
SAPIENT-DCO

General

Check archive.org

Show headers Download Go to

Full URL: https://mortgage.citi.com/cmi/PaidSearch/Conforming/Chip/LF2/default.htm?ISN=14814-9&BTST=9032003&btlp=dual&cmp=KNC~05~180105~BNKMORTG~Google&gclid=EAIaIQobChMI5-Hlrr_P5wIVDtvACh1yNwFcEAMYAyAAEgLnmvD_BwE&ProspectID=99395EC4AA874445AAE0B43E4AAA421E
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 216.250.52.47 , United States, ASN22758 (SAPIENT-DCO, US),
Reverse DNS: adp.kaplan.edu
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash: 3776ff557a90078a0e4d607e386004b49330a6c17563e7362d48abfa5d4ffb51

Request headers

Host: mortgage.citi.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: document
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: none
Sec-Fetch-Mode: navigate
Sec-Fetch-User: ?1
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: document

Response headers

Cache-Control: private
Content-Type: text/html
Content-Encoding: gzip
Expires: Wed, 12 Feb 2020 21:42:53 GMT
Vary: Accept-Encoding
Server: Microsoft-IIS/10.0
P3P: CP="NON DSP COR DEVa PSAa IVAo CONo OUR IND UNI PUR NAV DEM LOC", policyref="http://citi.bridgetrack.com/w3c/p3p.xml" CP="NON DSP COR DEVa PSAa IVAo CONo OUR IND UNI PUR NAV DEM LOC", policyref="http://citi.bridgetrack.com/w3c/p3p.xml"
Set-Cookie: CitiBTSES=SID=F7BA6DFCAEF848559ABA088FC7B0C7E5; path=/
X-Powered-By: ASP.NET
Date: Thu, 13 Feb 2020 21:42:53 GMT
Content-Length: 9607

Redirect headers

Cache-Control: private
Content-Type: text/html
Expires: Wed, 12 Feb 2020 21:42:52 GMT
Location: https://mortgage.citi.com/cmi/PaidSearch/Conforming/Chip/LF2/default.htm?ISN=14814-9&BTST=9032003&btlp=dual&cmp=KNC~05~180105~BNKMORTG~Google&gclid=EAIaIQobChMI5-Hlrr_P5wIVDtvACh1yNwFcEAMYAyAAEgLnmvD_BwE&ProspectID=99395EC4AA874445AAE0B43E4AAA421E
Server: Microsoft-IIS/10.0
P3P: CP="NON DSP COR DEVa PSAa IVAo CONo OUR IND UNI PUR NAV DEM LOC", policyref="http://citi.bridgetrack.com/w3c/p3p.xml"
Set-Cookie: ATC18=21719|S32MN.B.BiABkf.S.BWe.2gF.dCt.kNw.IU*.7.jz.C.E.1xz; expires=Wed, 13-May-2020 20:42:52 GMT; path=/; domain=citi.bridgetrack.com; CitiBT%5F183PTY=DCM%2ECOM%C3%BE10001; expires=Wed, 13-May-2020 04:00:00 GMT; domain=citi.bridgetrack.com; path=/ CitiBT%5F18PSP=223237; expires=Thu, 13-Feb-2020 21:43:22 GMT; domain=citi.bridgetrack.com; path=/ CitiBT=GUID=BEC446121FF34C858CC8BAA6C3DF8A92; expires=Sun, 07-Feb-2021 05:00:00 GMT; domain=citi.bridgetrack.com; path=/ CitiBT%5F18=SID=99395EC4AA874445AAE0B43E4AAA421E; expires=Wed, 13-May-2020 04:00:00 GMT; domain=citi.bridgetrack.com; path=/ referrerHost=; path=/
X-Powered-By: ASP.NET
Date: Thu, 13 Feb 2020 21:42:52 GMT
Content-Length: 0

GET
H/1.1 200
OK _form_utils.js Show response
mortgage.citi.com/_scripts/ 1 KB
794 B 373ms
129ms Script
application/javascript 216.250.52.47
SAPIENT-DCO

General

Check archive.org

Show headers Download Go to

Full URL: https://mortgage.citi.com/_scripts/_form_utils.js
Requested by: Host: mortgage.citi.com
URL: https://mortgage.citi.com/cmi/PaidSearch/Conforming/Chip/LF2/default.htm?ISN=14814-9&BTST=9032003&btlp=dual&cmp=KNC~05~180105~BNKMORTG~Google&gclid=EAIaIQobChMI5-Hlrr_P5wIVDtvACh1yNwFcEAMYAyAAEgLnmvD_BwE&ProspectID=99395EC4AA874445AAE0B43E4AAA421E
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 216.250.52.47 , United States, ASN22758 (SAPIENT-DCO, US),
Reverse DNS: adp.kaplan.edu
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash: 1f0c35be7a01aca711097b2574f2cb8cbcaa692e8e52547762f30241961e1e12

Request headers

Referer: https://mortgage.citi.com/cmi/PaidSearch/Conforming/Chip/LF2/default.htm?ISN=14814-9&BTST=9032003&btlp=dual&cmp=KNC~05~180105~BNKMORTG~Google&gclid=EAIaIQobChMI5-Hlrr_P5wIVDtvACh1yNwFcEAMYAyAAEgLnmvD_BwE&ProspectID=99395EC4AA874445AAE0B43E4AAA421E
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

Date: Thu, 13 Feb 2020 21:42:53 GMT
Content-Encoding: gzip
Last-Modified: Thu, 10 May 2012 18:53:38 GMT
Server: Microsoft-IIS/10.0
X-Powered-By: ASP.NET
ETag: "0259235de2ecd1:0"
Vary: Accept-Encoding
Content-Type: application/javascript
Accept-Ranges: bytes
Content-Length: 487

GET
H/1.1 200
OK main.css
mortgage.citi.com/cmi/paidsearch/conforming/chip/LF2/css/ 30 KB
9 KB 242ms
148ms Stylesheet
text/css 216.250.52.47
SAPIENT-DCO

General

Check archive.org

Show headers Download Go to

Full URL: https://mortgage.citi.com/cmi/paidsearch/conforming/chip/LF2/css/main.css
Requested by: Host: mortgage.citi.com
URL: https://mortgage.citi.com/cmi/PaidSearch/Conforming/Chip/LF2/default.htm?ISN=14814-9&BTST=9032003&btlp=dual&cmp=KNC~05~180105~BNKMORTG~Google&gclid=EAIaIQobChMI5-Hlrr_P5wIVDtvACh1yNwFcEAMYAyAAEgLnmvD_BwE&ProspectID=99395EC4AA874445AAE0B43E4AAA421E
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 216.250.52.47 , United States, ASN22758 (SAPIENT-DCO, US),
Reverse DNS: adp.kaplan.edu
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash: 30910363545fd0abc5f96b5ce9ee3f373152eaa3666bd373284846cf4818ed8d

Request headers

Referer: https://mortgage.citi.com/cmi/PaidSearch/Conforming/Chip/LF2/default.htm?ISN=14814-9&BTST=9032003&btlp=dual&cmp=KNC~05~180105~BNKMORTG~Google&gclid=EAIaIQobChMI5-Hlrr_P5wIVDtvACh1yNwFcEAMYAyAAEgLnmvD_BwE&ProspectID=99395EC4AA874445AAE0B43E4AAA421E
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: style

Response headers

Date: Thu, 13 Feb 2020 21:42:53 GMT
Content-Encoding: gzip
Last-Modified: Fri, 06 Dec 2019 21:36:01 GMT
Server: Microsoft-IIS/10.0
X-Powered-By: ASP.NET
ETag: "807672277dacd51:0"
Vary: Accept-Encoding
Content-Type: text/css
Accept-Ranges: bytes
Content-Length: 8473

GET
H2 200 Bootstrap.js Show response
nexus.ensighten.com/citi/na_prod/ 327 KB
105 KB 72ms
30ms Script
application/javascript 18.197.253.20
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Requested by: Host: mortgage.citi.com
URL: https://mortgage.citi.com/cmi/PaidSearch/Conforming/Chip/LF2/default.htm?ISN=14814-9&BTST=9032003&btlp=dual&cmp=KNC~05~180105~BNKMORTG~Google&gclid=EAIaIQobChMI5-Hlrr_P5wIVDtvACh1yNwFcEAMYAyAAEgLnmvD_BwE&ProspectID=99395EC4AA874445AAE0B43E4AAA421E
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 18.197.253.20 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-197-253-20.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 13e29637ce7868e71a6a655ded74810cd91c92bdcbdd03c1a97cb62ba2e795d5

Request headers

Referer: https://mortgage.citi.com/cmi/PaidSearch/Conforming/Chip/LF2/default.htm?ISN=14814-9&BTST=9032003&btlp=dual&cmp=KNC~05~180105~BNKMORTG~Google&gclid=EAIaIQobChMI5-Hlrr_P5wIVDtvACh1yNwFcEAMYAyAAEgLnmvD_BwE&ProspectID=99395EC4AA874445AAE0B43E4AAA421E
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Thu, 13 Feb 2020 21:42:54 GMT
content-encoding: gzip
last-modified: Thu, 13 Feb 2020 18:13:56 GMT
server: nginx
etag: W/"5e4591e4-51c68"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
status: 200
cache-control: max-age=300

GET
H/1.1 200
OK download.jpg
mortgage.citi.com/cmi/paidsearch/conforming/chip/LF2/images/ 648 B
897 B 397ms
119ms Image
image/jpeg 216.250.52.47
SAPIENT-DCO

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://mortgage.citi.com/cmi/paidsearch/conforming/chip/LF2/images/download.jpg
Requested by: Host: mortgage.citi.com
URL: https://mortgage.citi.com/cmi/PaidSearch/Conforming/Chip/LF2/default.htm?ISN=14814-9&BTST=9032003&btlp=dual&cmp=KNC~05~180105~BNKMORTG~Google&gclid=EAIaIQobChMI5-Hlrr_P5wIVDtvACh1yNwFcEAMYAyAAEgLnmvD_BwE&ProspectID=99395EC4AA874445AAE0B43E4AAA421E
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 216.250.52.47 , United States, ASN22758 (SAPIENT-DCO, US),
Reverse DNS: adp.kaplan.edu
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash: 8af12c5ed7b5ebf6e0dd0ff5cfb3ce321ba13d826dea552187426bc8be1cc960

Request headers

Referer: https://mortgage.citi.com/cmi/PaidSearch/Conforming/Chip/LF2/default.htm?ISN=14814-9&BTST=9032003&btlp=dual&cmp=KNC~05~180105~BNKMORTG~Google&gclid=EAIaIQobChMI5-Hlrr_P5wIVDtvACh1yNwFcEAMYAyAAEgLnmvD_BwE&ProspectID=99395EC4AA874445AAE0B43E4AAA421E
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

Date: Thu, 13 Feb 2020 21:42:53 GMT
Last-Modified: Fri, 27 Apr 2018 21:15:47 GMT
Server: Microsoft-IIS/10.0
X-Powered-By: ASP.NET
ETag: "80c3f3e86cded31:0"
Content-Type: image/jpeg
Accept-Ranges: bytes
Content-Length: 648

GET
H/1.1 200
OK plugins.js Show response
mortgage.citi.com/cmi/paidsearch/conforming/chip/LF2/js/ 125 KB
53 KB 420ms
143ms Script
application/javascript 216.250.52.47
SAPIENT-DCO

General

Check archive.org

Show headers Download Go to

Full URL: https://mortgage.citi.com/cmi/paidsearch/conforming/chip/LF2/js/plugins.js
Requested by: Host: mortgage.citi.com
URL: https://mortgage.citi.com/cmi/PaidSearch/Conforming/Chip/LF2/default.htm?ISN=14814-9&BTST=9032003&btlp=dual&cmp=KNC~05~180105~BNKMORTG~Google&gclid=EAIaIQobChMI5-Hlrr_P5wIVDtvACh1yNwFcEAMYAyAAEgLnmvD_BwE&ProspectID=99395EC4AA874445AAE0B43E4AAA421E
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 216.250.52.47 , United States, ASN22758 (SAPIENT-DCO, US),
Reverse DNS: adp.kaplan.edu
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash: 5b45a44dcff21f02c74d51310ddf747ea1b34aab9b2c7a0b330fdc1fd0b5a543

Request headers

Referer: https://mortgage.citi.com/cmi/PaidSearch/Conforming/Chip/LF2/default.htm?ISN=14814-9&BTST=9032003&btlp=dual&cmp=KNC~05~180105~BNKMORTG~Google&gclid=EAIaIQobChMI5-Hlrr_P5wIVDtvACh1yNwFcEAMYAyAAEgLnmvD_BwE&ProspectID=99395EC4AA874445AAE0B43E4AAA421E
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

Date: Thu, 13 Feb 2020 21:42:53 GMT
Content-Encoding: gzip
Last-Modified: Fri, 27 Apr 2018 21:15:47 GMT
Server: Microsoft-IIS/10.0
X-Powered-By: ASP.NET
ETag: "80c3f3e86cded31:0"
Vary: Accept-Encoding
Content-Type: application/javascript
Accept-Ranges: bytes
Content-Length: 54120

GET
H/1.1 200
OK main.js Show response
mortgage.citi.com/cmi/paidsearch/conforming/chip/LF2/js/ 6 KB
3 KB 132ms
131ms Script
application/javascript 216.250.52.47
SAPIENT-DCO

General

Check archive.org

Show headers Download Go to

Full URL: https://mortgage.citi.com/cmi/paidsearch/conforming/chip/LF2/js/main.js
Requested by: Host: mortgage.citi.com
URL: https://mortgage.citi.com/cmi/PaidSearch/Conforming/Chip/LF2/default.htm?ISN=14814-9&BTST=9032003&btlp=dual&cmp=KNC~05~180105~BNKMORTG~Google&gclid=EAIaIQobChMI5-Hlrr_P5wIVDtvACh1yNwFcEAMYAyAAEgLnmvD_BwE&ProspectID=99395EC4AA874445AAE0B43E4AAA421E
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 216.250.52.47 , United States, ASN22758 (SAPIENT-DCO, US),
Reverse DNS: adp.kaplan.edu
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash: 798dff229bfb1921019076c219e7a314af5647a7e550f7868eb5e9f60c41eefe

Request headers

Referer: https://mortgage.citi.com/cmi/PaidSearch/Conforming/Chip/LF2/default.htm?ISN=14814-9&BTST=9032003&btlp=dual&cmp=KNC~05~180105~BNKMORTG~Google&gclid=EAIaIQobChMI5-Hlrr_P5wIVDtvACh1yNwFcEAMYAyAAEgLnmvD_BwE&ProspectID=99395EC4AA874445AAE0B43E4AAA421E
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

Date: Thu, 13 Feb 2020 21:42:53 GMT
Content-Encoding: gzip
Last-Modified: Tue, 23 Oct 2018 16:34:50 GMT
Server: Microsoft-IIS/10.0
X-Powered-By: ASP.NET
ETag: "0f15651ee6ad41:0"
Vary: Accept-Encoding
Content-Type: application/javascript
Accept-Ranges: bytes
Content-Length: 2511

GET
H/1.1

200
OK

Default.asp
citi.bridgetrack.com/track/
Redirect Chain

https://mortgage.citi.com/track/?id=57746&random=2.07522494119504E+17
https://citi.bridgetrack.com/track/Default.asp?id=57746&random=2.07522494119504E+17

43 B
711 B

167ms
166ms

Image
image/gif

216.250.63.5
SAPIENT-DCO

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://citi.bridgetrack.com/track/Default.asp?id=57746&random=2.07522494119504E+17
Requested by: Host: mortgage.citi.com
URL: https://mortgage.citi.com/cmi/PaidSearch/Conforming/Chip/LF2/default.htm?ISN=14814-9&BTST=9032003&btlp=dual&cmp=KNC~05~180105~BNKMORTG~Google&gclid=EAIaIQobChMI5-Hlrr_P5wIVDtvACh1yNwFcEAMYAyAAEgLnmvD_BwE&ProspectID=99395EC4AA874445AAE0B43E4AAA421E
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 216.250.63.5 , United States, ASN22758 (SAPIENT-DCO, US),
Reverse DNS: citi.bridgetrack.com
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash: 63b98a0c8568c08fd01a6946a147bca65eff26c8085f1ccb5330aafe0f0dcd15

Request headers

Referer: https://mortgage.citi.com/cmi/PaidSearch/Conforming/Chip/LF2/default.htm?ISN=14814-9&BTST=9032003&btlp=dual&cmp=KNC~05~180105~BNKMORTG~Google&gclid=EAIaIQobChMI5-Hlrr_P5wIVDtvACh1yNwFcEAMYAyAAEgLnmvD_BwE&ProspectID=99395EC4AA874445AAE0B43E4AAA421E
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 13 Feb 2020 21:42:53 GMT
Server: Microsoft-IIS/10.0
X-Powered-By: ASP.NET
P3P: CP="NON DSP COR DEVa PSAa IVAo CONo OUR IND UNI PUR NAV DEM LOC", policyref="http://citi.bridgetrack.com/w3c/p3p.xml"
Cache-Control: private
Content-Type: image/GIF
Content-Length: 43
Expires: Wed, 12 Feb 2020 21:42:54 GMT

Redirect headers

Date: Thu, 13 Feb 2020 21:42:53 GMT
Server: Microsoft-IIS/10.0
X-Powered-By: ASP.NET
P3P: CP="NON DSP COR DEVa PSAa IVAo CONo OUR IND UNI PUR NAV DEM LOC", policyref="http://citi.bridgetrack.com/w3c/p3p.xml"
Location: https://citi.bridgetrack.com/track/Default.asp?id=57746&random=2.07522494119504E+17
Cache-Control: private
Content-Type: text/html
Content-Length: 0
Expires: Wed, 12 Feb 2020 21:42:54 GMT

GET
H2 200 loader.js Show response
www.gstatic.com/wcm/ 422 B
416 B 7ms
6ms Script
text/javascript 2a00:1450:4001:808::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/wcm/loader.js

Requested by

Host: mortgage.citi.com
URL: https://mortgage.citi.com/cmi/PaidSearch/Conforming/Chip/LF2/default.htm?ISN=14814-9&BTST=9032003&btlp=dual&cmp=KNC~05~180105~BNKMORTG~Google&gclid=EAIaIQobChMI5-Hlrr_P5wIVDtvACh1yNwFcEAMYAyAAEgLnmvD_BwE&ProspectID=99395EC4AA874445AAE0B43E4AAA421E

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

cbb6560ed1e9e91e2ceb73f50c333bf5fd86d56839161bf5383a1dd44faf5bc2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://mortgage.citi.com/cmi/PaidSearch/Conforming/Chip/LF2/default.htm?ISN=14814-9&BTST=9032003&btlp=dual&cmp=KNC~05~180105~BNKMORTG~Google&gclid=EAIaIQobChMI5-Hlrr_P5wIVDtvACh1yNwFcEAMYAyAAEgLnmvD_BwE&ProspectID=99395EC4AA874445AAE0B43E4AAA421E
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Thu, 13 Feb 2020 20:58:57 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Wed, 02 Oct 2019 19:45:00 GMT
server: sffe
age: 2637
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: public, max-age=3600
accept-ranges: bytes
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 286
x-xss-protection: 0
expires: Thu, 13 Feb 2020 21:58:57 GMT

GET
H/1.1

302
Found

rd Show response
dpm.demdex.net/id/
Redirect Chain

https://dpm.demdex.net/id?d_visid_ver=3.1.2&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=61834D9B5228A7430A490D45%40AdobeOrg&d_nsid=0&ts=1581630174261
https://dpm.demdex.net/id/rd?d_visid_ver=3.1.2&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=61834D9B5228A7430A490D45%40AdobeOrg&d_nsid=0&ts=1581630174261

0
-1 B

155ms
45ms

XHR

34.252.123.130
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://dpm.demdex.net/id/rd?d_visid_ver=3.1.2&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=61834D9B5228A7430A490D45%40AdobeOrg&d_nsid=0&ts=1581630174261

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

34.252.123.130 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-34-252-123-130.eu-west-1.compute.amazonaws.com

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://mortgage.citi.com/cmi/PaidSearch/Conforming/Chip/LF2/default.htm?ISN=14814-9&BTST=9032003&btlp=dual&cmp=KNC~05~180105~BNKMORTG~Google&gclid=EAIaIQobChMI5-Hlrr_P5wIVDtvACh1yNwFcEAMYAyAAEgLnmvD_BwE&ProspectID=99395EC4AA874445AAE0B43E4AAA421E
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
Location: https://dpm.demdex.net/id/rd?d_visid_ver=3.1.2&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=61834D9B5228A7430A490D45%40AdobeOrg&d_nsid=0&ts=1581630174261
X-TID: IqccsvHvQGI=
Vary: Origin
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Access-Control-Allow-Origin: https://mortgage.citi.com
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 0
Expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
Access-Control-Allow-Origin: https://mortgage.citi.com
X-TID: IqccsvHvQGI=
Vary: Origin
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Location: https://dpm.demdex.net/id/rd?d_visid_ver=3.1.2&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=61834D9B5228A7430A490D45%40AdobeOrg&d_nsid=0&ts=1581630174261
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 0
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2 204 e.gif
nexus.ensighten.com/error/ 0
106 B 20ms
19ms Image
text/plain 18.197.253.20
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://nexus.ensighten.com/error/e.gif?msg=_dl%20is%20not%20defined&lnn=-1&fn=&cid=1129&client=citi&publishPath=na_prod&rid=3092996&did=622672&errorName=ReferenceError
Requested by: Host: mortgage.citi.com
URL: https://mortgage.citi.com/cmi/PaidSearch/Conforming/Chip/LF2/default.htm?ISN=14814-9&BTST=9032003&btlp=dual&cmp=KNC~05~180105~BNKMORTG~Google&gclid=EAIaIQobChMI5-Hlrr_P5wIVDtvACh1yNwFcEAMYAyAAEgLnmvD_BwE&ProspectID=99395EC4AA874445AAE0B43E4AAA421E
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 18.197.253.20 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-197-253-20.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://mortgage.citi.com/cmi/PaidSearch/Conforming/Chip/LF2/default.htm?ISN=14814-9&BTST=9032003&btlp=dual&cmp=KNC~05~180105~BNKMORTG~Google&gclid=EAIaIQobChMI5-Hlrr_P5wIVDtvACh1yNwFcEAMYAyAAEgLnmvD_BwE&ProspectID=99395EC4AA874445AAE0B43E4AAA421E
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

status: 204
date: Thu, 13 Feb 2020 21:42:54 GMT
cache-control: no-cache, no-store
server: nginx
expires: Thu, 13 Feb 2020 21:42:53 GMT

GET
H/1.1 200
OK hero-desk-dual.jpg
mortgage.citi.com/cmi/paidsearch/conforming/chip/LF2/images/ 53 KB
53 KB 208ms
127ms Image
image/jpeg 216.250.52.47
SAPIENT-DCO

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://mortgage.citi.com/cmi/paidsearch/conforming/chip/LF2/images/hero-desk-dual.jpg
Requested by: Host: mortgage.citi.com
URL: https://mortgage.citi.com/cmi/PaidSearch/Conforming/Chip/LF2/default.htm?ISN=14814-9&BTST=9032003&btlp=dual&cmp=KNC~05~180105~BNKMORTG~Google&gclid=EAIaIQobChMI5-Hlrr_P5wIVDtvACh1yNwFcEAMYAyAAEgLnmvD_BwE&ProspectID=99395EC4AA874445AAE0B43E4AAA421E
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 216.250.52.47 , United States, ASN22758 (SAPIENT-DCO, US),
Reverse DNS: adp.kaplan.edu
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash: a7072d89e111b350c17067dea8f1c8e973a5c9303efe9669d9a4a3cd91822f4f

Request headers

Referer: https://mortgage.citi.com/cmi/paidsearch/conforming/chip/LF2/css/main.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

Date: Thu, 13 Feb 2020 21:42:54 GMT
Last-Modified: Tue, 01 May 2018 21:59:50 GMT
Server: Microsoft-IIS/10.0
X-Powered-By: ASP.NET
ETag: "08ff4b997e1d31:0"
Content-Type: image/jpeg
Accept-Ranges: bytes
Content-Length: 54220

GET
H/1.1 200
OK interstate-light-webfont.woff
sec-citi.bridgetrack.com/fonts/ 17 KB
17 KB 84ms
21ms Font
application/x-woff 2.16.123.117
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://sec-citi.bridgetrack.com/fonts/interstate-light-webfont.woff
Requested by: Host: mortgage.citi.com
URL: https://mortgage.citi.com/cmi/PaidSearch/Conforming/Chip/LF2/default.htm?ISN=14814-9&BTST=9032003&btlp=dual&cmp=KNC~05~180105~BNKMORTG~Google&gclid=EAIaIQobChMI5-Hlrr_P5wIVDtvACh1yNwFcEAMYAyAAEgLnmvD_BwE&ProspectID=99395EC4AA874445AAE0B43E4AAA421E
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_CBC
Server: 2.16.123.117 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS: a2-16-123-117.deploy.static.akamaitechnologies.com
Software: Microsoft-IIS/7.0 / ASP.NET
Resource Hash: 0a747978746092df6f18fe90ef23b9896959f6a9bb0b58cbab2cbc851793e023

Request headers

Referer: https://mortgage.citi.com/cmi/paidsearch/conforming/chip/LF2/css/main.css
Origin: https://mortgage.citi.com
Sec-Fetch-Dest: font
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Thu, 13 Feb 2020 21:42:54 GMT
ETag: "0a62242b3eed31:0"
Last-Modified: Fri, 18 May 2018 14:19:40 GMT
Server: Microsoft-IIS/7.0
X-Powered-By: ASP.NET
Content-Type: application/x-woff
Access-Control-Allow-Origin: *
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 17596

GET
H/1.1 200
OK unselected.png
mortgage.citi.com/cmi/paidsearch/conforming/chip/LF2/images/ 274 B
522 B 249ms
123ms Image
image/png 216.250.52.47
SAPIENT-DCO

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://mortgage.citi.com/cmi/paidsearch/conforming/chip/LF2/images/unselected.png
Requested by: Host: mortgage.citi.com
URL: https://mortgage.citi.com/cmi/PaidSearch/Conforming/Chip/LF2/default.htm?ISN=14814-9&BTST=9032003&btlp=dual&cmp=KNC~05~180105~BNKMORTG~Google&gclid=EAIaIQobChMI5-Hlrr_P5wIVDtvACh1yNwFcEAMYAyAAEgLnmvD_BwE&ProspectID=99395EC4AA874445AAE0B43E4AAA421E
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 216.250.52.47 , United States, ASN22758 (SAPIENT-DCO, US),
Reverse DNS: adp.kaplan.edu
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash: 36f23b33e598a242a6bfb106e226f149df1f3e5c483e623c85304659f53f18ab

Request headers

Referer: https://mortgage.citi.com/cmi/paidsearch/conforming/chip/LF2/css/main.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

Date: Thu, 13 Feb 2020 21:42:54 GMT
Last-Modified: Fri, 27 Apr 2018 21:15:47 GMT
Server: Microsoft-IIS/10.0
X-Powered-By: ASP.NET
ETag: "80c3f3e86cded31:0"
Content-Type: image/png
Accept-Ranges: bytes
Content-Length: 274

GET
H/1.1 200
OK phone_rounded.png
mortgage.citi.com/cmi/paidsearch/conforming/chip/LF2/images/ 912 B
1 KB 184ms
133ms Image
image/png 216.250.52.47
SAPIENT-DCO

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://mortgage.citi.com/cmi/paidsearch/conforming/chip/LF2/images/phone_rounded.png
Requested by: Host: mortgage.citi.com
URL: https://mortgage.citi.com/cmi/PaidSearch/Conforming/Chip/LF2/default.htm?ISN=14814-9&BTST=9032003&btlp=dual&cmp=KNC~05~180105~BNKMORTG~Google&gclid=EAIaIQobChMI5-Hlrr_P5wIVDtvACh1yNwFcEAMYAyAAEgLnmvD_BwE&ProspectID=99395EC4AA874445AAE0B43E4AAA421E
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 216.250.52.47 , United States, ASN22758 (SAPIENT-DCO, US),
Reverse DNS: adp.kaplan.edu
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash: 6d833cc62c578d49069dbf87839c28f3fdea09aea40e160f80e3c4a3cd2e1939

Request headers

Referer: https://mortgage.citi.com/cmi/paidsearch/conforming/chip/LF2/css/main.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

Date: Thu, 13 Feb 2020 21:42:54 GMT
Last-Modified: Fri, 27 Apr 2018 21:15:47 GMT
Server: Microsoft-IIS/10.0
X-Powered-By: ASP.NET
ETag: "80c3f3e86cded31:0"
Content-Type: image/png
Accept-Ranges: bytes
Content-Length: 912

GET
H/1.1 200
OK interstate-regular-webfont.woff
sec-citi.bridgetrack.com/fonts/ 17 KB
17 KB 80ms
20ms Font
application/x-woff 2.16.123.117
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://sec-citi.bridgetrack.com/fonts/interstate-regular-webfont.woff
Requested by: Host: mortgage.citi.com
URL: https://mortgage.citi.com/cmi/PaidSearch/Conforming/Chip/LF2/default.htm?ISN=14814-9&BTST=9032003&btlp=dual&cmp=KNC~05~180105~BNKMORTG~Google&gclid=EAIaIQobChMI5-Hlrr_P5wIVDtvACh1yNwFcEAMYAyAAEgLnmvD_BwE&ProspectID=99395EC4AA874445AAE0B43E4AAA421E
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_CBC
Server: 2.16.123.117 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS: a2-16-123-117.deploy.static.akamaitechnologies.com
Software: Microsoft-IIS/7.0 / ASP.NET
Resource Hash: 6896c70fd430a1ffe69dc778926e1866ca52a12bd341170522ad6278aafd7bcf

Request headers

Referer: https://mortgage.citi.com/cmi/paidsearch/conforming/chip/LF2/css/main.css
Origin: https://mortgage.citi.com
Sec-Fetch-Dest: font
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Thu, 13 Feb 2020 21:42:54 GMT
ETag: "80439b979b7d31:0"
Last-Modified: Thu, 08 Mar 2018 18:16:35 GMT
Server: Microsoft-IIS/7.0
X-Powered-By: ASP.NET
Content-Type: application/x-woff
Access-Control-Allow-Origin: *
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 17592

GET
H/1.1 200
OK interstate-bold-webfont.woff
sec-citi.bridgetrack.com/fonts/ 70 KB
70 KB 94ms
33ms Font
application/x-woff 2.16.123.117
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://sec-citi.bridgetrack.com/fonts/interstate-bold-webfont.woff
Requested by: Host: mortgage.citi.com
URL: https://mortgage.citi.com/cmi/PaidSearch/Conforming/Chip/LF2/default.htm?ISN=14814-9&BTST=9032003&btlp=dual&cmp=KNC~05~180105~BNKMORTG~Google&gclid=EAIaIQobChMI5-Hlrr_P5wIVDtvACh1yNwFcEAMYAyAAEgLnmvD_BwE&ProspectID=99395EC4AA874445AAE0B43E4AAA421E
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_CBC
Server: 2.16.123.117 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS: a2-16-123-117.deploy.static.akamaitechnologies.com
Software: Microsoft-IIS/7.0 / ASP.NET
Resource Hash: e9e9a67395a0d83b584208a19b95af203df8e8e6c6952fe76c690d60ea9381c7

Request headers

Referer: https://mortgage.citi.com/cmi/paidsearch/conforming/chip/LF2/css/main.css
Origin: https://mortgage.citi.com
Sec-Fetch-Dest: font
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Thu, 13 Feb 2020 21:42:54 GMT
ETag: "80d4ee3aafb1d31:0"
Last-Modified: Thu, 01 Mar 2018 22:47:09 GMT
Server: Microsoft-IIS/7.0
X-Powered-By: ASP.NET
Content-Type: application/x-woff
Access-Control-Allow-Origin: *
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 71874

GET
H2 200 serverComponent.php Show response
nexus.ensighten.com/citi/na_prod/ 2 KB
809 B 35ms
35ms Script
text/javascript 18.197.253.20
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://nexus.ensighten.com/citi/na_prod/serverComponent.php?r=68.47010830139011&ClientID=1129&PageID=https%3A%2F%2Fmortgage.citi.com%2Fcmi%2FPaidSearch%2FConforming%2FChip%2FLF2%2Fdefault.htm%3FISN%3D14814-9%26BTST%3D9032003%26btlp%3Ddual%26cmp%3DKNC~05~180105~BNKMORTG~Google%26gclid%3DEAIaIQobChMI5-Hlrr_P5wIVDtvACh1yNwFcEAMYAyAAEgLnmvD_BwE%26ProspectID%3D99395EC4AA874445AAE0B43E4AAA421E
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 18.197.253.20 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-197-253-20.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 1d26ba02f1860f002746011a3d066bc39092d937535cec515f9d7599b60787ea

Request headers

Referer: https://mortgage.citi.com/cmi/PaidSearch/Conforming/Chip/LF2/default.htm?ISN=14814-9&BTST=9032003&btlp=dual&cmp=KNC~05~180105~BNKMORTG~Google&gclid=EAIaIQobChMI5-Hlrr_P5wIVDtvACh1yNwFcEAMYAyAAEgLnmvD_BwE&ProspectID=99395EC4AA874445AAE0B43E4AAA421E
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Thu, 13 Feb 2020 21:42:54 GMT
content-encoding: gzip
server: nginx
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: no-cache, no-store
expires: Thu, 13 Feb 2020 21:42:53 GMT

GET
H2 200 impl-1_32.js Show response
www.gstatic.com/wcm/ 30 KB
12 KB 7ms
6ms Script
text/javascript 2a00:1450:4001:808::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/wcm/impl-1_32.js

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/wcm/loader.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

9cc17f2a29825643f4ab4b92f34c6fe5e9b12f1dd87068a07c4933488fd880f7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://mortgage.citi.com/cmi/PaidSearch/Conforming/Chip/LF2/default.htm?ISN=14814-9&BTST=9032003&btlp=dual&cmp=KNC~05~180105~BNKMORTG~Google&gclid=EAIaIQobChMI5-Hlrr_P5wIVDtvACh1yNwFcEAMYAyAAEgLnmvD_BwE&ProspectID=99395EC4AA874445AAE0B43E4AAA421E
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Mon, 10 Feb 2020 17:47:42 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Mon, 05 Aug 2019 17:45:00 GMT
server: sffe
age: 273312
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: public, max-age=31536000
accept-ranges: bytes
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 12298
x-xss-protection: 0
expires: Tue, 09 Feb 2021 17:47:42 GMT

GET
H/1.1 200
OK icon-1.png
mortgage.citi.com/cmi/paidsearch/conforming/chip/LF2/images/ 2 KB
2 KB 195ms
128ms Image
image/png 216.250.52.47
SAPIENT-DCO

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://mortgage.citi.com/cmi/paidsearch/conforming/chip/LF2/images/icon-1.png
Requested by: Host: mortgage.citi.com
URL: https://mortgage.citi.com/cmi/PaidSearch/Conforming/Chip/LF2/default.htm?ISN=14814-9&BTST=9032003&btlp=dual&cmp=KNC~05~180105~BNKMORTG~Google&gclid=EAIaIQobChMI5-Hlrr_P5wIVDtvACh1yNwFcEAMYAyAAEgLnmvD_BwE&ProspectID=99395EC4AA874445AAE0B43E4AAA421E
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 216.250.52.47 , United States, ASN22758 (SAPIENT-DCO, US),
Reverse DNS: adp.kaplan.edu
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash: 589eb90287eaa9f63149aa57d9425aca161f0784920503279c9d6a6cac2ba059

Request headers

Referer: https://mortgage.citi.com/cmi/paidsearch/conforming/chip/LF2/css/main.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

Date: Thu, 13 Feb 2020 21:42:53 GMT
Last-Modified: Fri, 27 Apr 2018 21:15:47 GMT
Server: Microsoft-IIS/10.0
X-Powered-By: ASP.NET
ETag: "80c3f3e86cded31:0"
Content-Type: image/png
Accept-Ranges: bytes
Content-Length: 1821

GET
H/1.1 200
OK icon-2.png
mortgage.citi.com/cmi/paidsearch/conforming/chip/LF2/images/ 2 KB
2 KB 142ms
133ms Image
image/png 216.250.52.47
SAPIENT-DCO

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://mortgage.citi.com/cmi/paidsearch/conforming/chip/LF2/images/icon-2.png
Requested by: Host: mortgage.citi.com
URL: https://mortgage.citi.com/cmi/PaidSearch/Conforming/Chip/LF2/default.htm?ISN=14814-9&BTST=9032003&btlp=dual&cmp=KNC~05~180105~BNKMORTG~Google&gclid=EAIaIQobChMI5-Hlrr_P5wIVDtvACh1yNwFcEAMYAyAAEgLnmvD_BwE&ProspectID=99395EC4AA874445AAE0B43E4AAA421E
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 216.250.52.47 , United States, ASN22758 (SAPIENT-DCO, US),
Reverse DNS: adp.kaplan.edu
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash: af11d2db618de47c46a86323951d5ac6470bb6dfa8def911459bca00c8fe4b8a

Request headers

Referer: https://mortgage.citi.com/cmi/paidsearch/conforming/chip/LF2/css/main.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

Date: Thu, 13 Feb 2020 21:42:53 GMT
Last-Modified: Fri, 27 Apr 2018 21:15:47 GMT
Server: Microsoft-IIS/10.0
X-Powered-By: ASP.NET
ETag: "80c3f3e86cded31:0"
Content-Type: image/png
Accept-Ranges: bytes
Content-Length: 1807

GET
H/1.1 200
OK icon-3.png
mortgage.citi.com/cmi/paidsearch/conforming/chip/LF2/images/ 2 KB
2 KB 136ms
136ms Image
image/png 216.250.52.47
SAPIENT-DCO

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://mortgage.citi.com/cmi/paidsearch/conforming/chip/LF2/images/icon-3.png
Requested by: Host: mortgage.citi.com
URL: https://mortgage.citi.com/cmi/PaidSearch/Conforming/Chip/LF2/default.htm?ISN=14814-9&BTST=9032003&btlp=dual&cmp=KNC~05~180105~BNKMORTG~Google&gclid=EAIaIQobChMI5-Hlrr_P5wIVDtvACh1yNwFcEAMYAyAAEgLnmvD_BwE&ProspectID=99395EC4AA874445AAE0B43E4AAA421E
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 216.250.52.47 , United States, ASN22758 (SAPIENT-DCO, US),
Reverse DNS: adp.kaplan.edu
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash: 996494e05db870b65ffe1b5d529000ba2fe1259c8ab0ee3ba55651c62af3fe21

Request headers

Referer: https://mortgage.citi.com/cmi/paidsearch/conforming/chip/LF2/css/main.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

Date: Thu, 13 Feb 2020 21:42:53 GMT
Last-Modified: Fri, 27 Apr 2018 21:15:47 GMT
Server: Microsoft-IIS/10.0
X-Powered-By: ASP.NET
ETag: "80c3f3e86cded31:0"
Content-Type: image/png
Accept-Ranges: bytes
Content-Length: 2290

GET
H/1.1 200
OK spritesheet.png
mortgage.citi.com/cmi/paidsearch/conforming/chip/LF2/images/ 6 KB
6 KB 131ms
130ms Image
image/png 216.250.52.47
SAPIENT-DCO

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://mortgage.citi.com/cmi/paidsearch/conforming/chip/LF2/images/spritesheet.png
Requested by: Host: mortgage.citi.com
URL: https://mortgage.citi.com/cmi/PaidSearch/Conforming/Chip/LF2/default.htm?ISN=14814-9&BTST=9032003&btlp=dual&cmp=KNC~05~180105~BNKMORTG~Google&gclid=EAIaIQobChMI5-Hlrr_P5wIVDtvACh1yNwFcEAMYAyAAEgLnmvD_BwE&ProspectID=99395EC4AA874445AAE0B43E4AAA421E
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 216.250.52.47 , United States, ASN22758 (SAPIENT-DCO, US),
Reverse DNS: adp.kaplan.edu
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash: 014b223a7e5669cf2cf6b8ceae3bd11c52339bc946bf3fede9e1ab1647edd9b5

Request headers

Referer: https://mortgage.citi.com/cmi/paidsearch/conforming/chip/LF2/css/main.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

Date: Thu, 13 Feb 2020 21:42:53 GMT
Last-Modified: Fri, 27 Apr 2018 21:15:47 GMT
Server: Microsoft-IIS/10.0
X-Powered-By: ASP.NET
ETag: "80c3f3e86cded31:0"
Content-Type: image/png
Accept-Ranges: bytes
Content-Length: 6323

GET
H/1.1 200
OK icon-fb-sm.png
mortgage.citi.com/cmi/paidsearch/conforming/chip/LF2/images/ 154 B
399 B 126ms
125ms Image
image/png 216.250.52.47
SAPIENT-DCO

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://mortgage.citi.com/cmi/paidsearch/conforming/chip/LF2/images/icon-fb-sm.png
Requested by: Host: mortgage.citi.com
URL: https://mortgage.citi.com/cmi/PaidSearch/Conforming/Chip/LF2/default.htm?ISN=14814-9&BTST=9032003&btlp=dual&cmp=KNC~05~180105~BNKMORTG~Google&gclid=EAIaIQobChMI5-Hlrr_P5wIVDtvACh1yNwFcEAMYAyAAEgLnmvD_BwE&ProspectID=99395EC4AA874445AAE0B43E4AAA421E
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 216.250.52.47 , United States, ASN22758 (SAPIENT-DCO, US),
Reverse DNS: adp.kaplan.edu
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash: ceb2f31869dbddc41f735d9d33e7b186f1580c37ec8a943309127885fae2c0e8

Request headers

Referer: https://mortgage.citi.com/cmi/paidsearch/conforming/chip/LF2/css/main.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

Date: Thu, 13 Feb 2020 21:42:54 GMT
Last-Modified: Tue, 10 Oct 2017 20:28:12 GMT
Server: Microsoft-IIS/10.0
X-Powered-By: ASP.NET
ETag: "01694b642d31:0"
Content-Type: image/png
Accept-Ranges: bytes
Content-Length: 154

GET
H/1.1 200
OK icon-tw-sm.png
mortgage.citi.com/cmi/paidsearch/conforming/chip/LF2/images/ 370 B
615 B 123ms
122ms Image
image/png 216.250.52.47
SAPIENT-DCO

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://mortgage.citi.com/cmi/paidsearch/conforming/chip/LF2/images/icon-tw-sm.png
Requested by: Host: mortgage.citi.com
URL: https://mortgage.citi.com/cmi/PaidSearch/Conforming/Chip/LF2/default.htm?ISN=14814-9&BTST=9032003&btlp=dual&cmp=KNC~05~180105~BNKMORTG~Google&gclid=EAIaIQobChMI5-Hlrr_P5wIVDtvACh1yNwFcEAMYAyAAEgLnmvD_BwE&ProspectID=99395EC4AA874445AAE0B43E4AAA421E
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 216.250.52.47 , United States, ASN22758 (SAPIENT-DCO, US),
Reverse DNS: adp.kaplan.edu
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash: ceb299d79bb2dea5b6695e6f2edcf2e1e5d915318f4848a7333519878e74949d

Request headers

Referer: https://mortgage.citi.com/cmi/paidsearch/conforming/chip/LF2/css/main.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

Date: Thu, 13 Feb 2020 21:42:54 GMT
Last-Modified: Tue, 10 Oct 2017 20:28:12 GMT
Server: Microsoft-IIS/10.0
X-Powered-By: ASP.NET
ETag: "01694b642d31:0"
Content-Type: image/png
Accept-Ranges: bytes
Content-Length: 370

GET
H/1.1 200
OK icon-yt-sm.png
mortgage.citi.com/cmi/paidsearch/conforming/chip/LF2/images/ 168 B
413 B 122ms
120ms Image
image/png 216.250.52.47
SAPIENT-DCO

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://mortgage.citi.com/cmi/paidsearch/conforming/chip/LF2/images/icon-yt-sm.png
Requested by: Host: mortgage.citi.com
URL: https://mortgage.citi.com/cmi/PaidSearch/Conforming/Chip/LF2/default.htm?ISN=14814-9&BTST=9032003&btlp=dual&cmp=KNC~05~180105~BNKMORTG~Google&gclid=EAIaIQobChMI5-Hlrr_P5wIVDtvACh1yNwFcEAMYAyAAEgLnmvD_BwE&ProspectID=99395EC4AA874445AAE0B43E4AAA421E
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 216.250.52.47 , United States, ASN22758 (SAPIENT-DCO, US),
Reverse DNS: adp.kaplan.edu
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash: dba00ef29cbd8ec1750d9d0107d6a2a8822a495c088c881f85c157b9aaa29db5

Request headers

Referer: https://mortgage.citi.com/cmi/paidsearch/conforming/chip/LF2/css/main.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

Date: Thu, 13 Feb 2020 21:42:54 GMT
Last-Modified: Tue, 10 Oct 2017 20:28:12 GMT
Server: Microsoft-IIS/10.0
X-Powered-By: ASP.NET
ETag: "01694b642d31:0"
Content-Type: image/png
Accept-Ranges: bytes
Content-Length: 168

GET
H/1.1 200
OK sprite.png
mortgage.citi.com/cmi/paidsearch/conforming/chip/LF2/images/ 3 KB
3 KB 135ms
134ms Image
image/png 216.250.52.47
SAPIENT-DCO

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://mortgage.citi.com/cmi/paidsearch/conforming/chip/LF2/images/sprite.png
Requested by: Host: mortgage.citi.com
URL: https://mortgage.citi.com/cmi/PaidSearch/Conforming/Chip/LF2/default.htm?ISN=14814-9&BTST=9032003&btlp=dual&cmp=KNC~05~180105~BNKMORTG~Google&gclid=EAIaIQobChMI5-Hlrr_P5wIVDtvACh1yNwFcEAMYAyAAEgLnmvD_BwE&ProspectID=99395EC4AA874445AAE0B43E4AAA421E
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 216.250.52.47 , United States, ASN22758 (SAPIENT-DCO, US),
Reverse DNS: adp.kaplan.edu
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash: 4548078a98441b728d12947eccc2ec785b423843330e3d6bb4d30de9be50f7ba

Request headers

Referer: https://mortgage.citi.com/cmi/paidsearch/conforming/chip/LF2/css/main.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

Date: Thu, 13 Feb 2020 21:42:54 GMT
Last-Modified: Fri, 27 Apr 2018 21:15:47 GMT
Server: Microsoft-IIS/10.0
X-Powered-By: ASP.NET
ETag: "80c3f3e86cded31:0"
Content-Type: image/png
Accept-Ranges: bytes
Content-Length: 2810

GET
H2 200 wcm Show response
www.googleadservices.com/pagead/conversion/830907969/ 39 B
207 B 32ms
31ms XHR
application/json 216.58.205.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googleadservices.com/pagead/conversion/830907969/wcm?cl=HftRCK2TmHkQwcyajAM&fb=8667775258&callback=corscb

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/wcm/impl-1_32.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

216.58.205.226 Mountain View, United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra15s24-in-f2.1e100.net

Software

cafe /

Resource Hash

3252128425e1e7b89d9f1e14192ba6b3b3140348a27a208edb8583401e00334e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://mortgage.citi.com/cmi/PaidSearch/Conforming/Chip/LF2/default.htm?ISN=14814-9&BTST=9032003&btlp=dual&cmp=KNC~05~180105~BNKMORTG~Google&gclid=EAIaIQobChMI5-Hlrr_P5wIVDtvACh1yNwFcEAMYAyAAEgLnmvD_BwE&ProspectID=99395EC4AA874445AAE0B43E4AAA421E
Origin: https://mortgage.citi.com
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 13 Feb 2020 21:42:54 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
content-type: application/json; charset=UTF-8
access-control-allow-origin: https://mortgage.citi.com
cache-control: private
access-control-allow-credentials: true
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 59
x-xss-protection: 0

GET
H2 200 f1c71c10d3e2f87f440821ca1f9e2e65.js Show response
nexus.ensighten.com/citi/na_prod/code/ 2 KB
863 B 22ms
22ms Script
application/javascript 18.197.253.20
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://nexus.ensighten.com/citi/na_prod/code/f1c71c10d3e2f87f440821ca1f9e2e65.js?conditionId0=480881
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 18.197.253.20 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-197-253-20.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: e226935ba96b671378a7552d0669729f2b4733fab20624ed8018e86bad35401e

Request headers

Referer: https://mortgage.citi.com/cmi/PaidSearch/Conforming/Chip/LF2/default.htm?ISN=14814-9&BTST=9032003&btlp=dual&cmp=KNC~05~180105~BNKMORTG~Google&gclid=EAIaIQobChMI5-Hlrr_P5wIVDtvACh1yNwFcEAMYAyAAEgLnmvD_BwE&ProspectID=99395EC4AA874445AAE0B43E4AAA421E
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Thu, 13 Feb 2020 21:42:54 GMT
content-encoding: gzip
last-modified: Tue, 04 Feb 2020 18:16:27 GMT
server: nginx
etag: W/"5e39b4fb-631"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
status: 200
cache-control: max-age=315360000

GET
H2 200 70b8eff5831bcc37c1deb079a596efec.js Show response
nexus.ensighten.com/citi/na_prod/code/ 96 KB
22 KB 23ms
22ms Script
application/javascript 18.197.253.20
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://nexus.ensighten.com/citi/na_prod/code/70b8eff5831bcc37c1deb079a596efec.js?conditionId0=421908
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 18.197.253.20 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-197-253-20.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 9ce12675ed28c7049875858e0830af29719f3d16004541570c3a85e70f637696

Request headers

Referer: https://mortgage.citi.com/cmi/PaidSearch/Conforming/Chip/LF2/default.htm?ISN=14814-9&BTST=9032003&btlp=dual&cmp=KNC~05~180105~BNKMORTG~Google&gclid=EAIaIQobChMI5-Hlrr_P5wIVDtvACh1yNwFcEAMYAyAAEgLnmvD_BwE&ProspectID=99395EC4AA874445AAE0B43E4AAA421E
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Thu, 13 Feb 2020 21:42:54 GMT
content-encoding: gzip
last-modified: Tue, 04 Feb 2020 18:16:27 GMT
server: nginx
etag: W/"5e39b4fb-181a5"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
status: 200
cache-control: max-age=315360000

GET
H2 200 fdf45a7c15c1cee06bb71e10dac4e26e.js Show response
nexus.ensighten.com/citi/na_prod/code/ 989 B
1 KB 23ms
22ms Script
application/javascript 18.197.253.20
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://nexus.ensighten.com/citi/na_prod/code/fdf45a7c15c1cee06bb71e10dac4e26e.js?conditionId0=4849963
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 18.197.253.20 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-197-253-20.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 7df13706eaab8ce9a3dcd2a501f60bc66987c83834d07dfaf07ae56ef814c110

Request headers

Referer: https://mortgage.citi.com/cmi/PaidSearch/Conforming/Chip/LF2/default.htm?ISN=14814-9&BTST=9032003&btlp=dual&cmp=KNC~05~180105~BNKMORTG~Google&gclid=EAIaIQobChMI5-Hlrr_P5wIVDtvACh1yNwFcEAMYAyAAEgLnmvD_BwE&ProspectID=99395EC4AA874445AAE0B43E4AAA421E
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Thu, 13 Feb 2020 21:42:54 GMT
last-modified: Tue, 14 May 2019 17:01:42 GMT
server: nginx
etag: "5cdaf476-3dd"
content-type: application/javascript; charset=utf-8
status: 200
cache-control: max-age=315360000
accept-ranges: bytes
content-length: 989

GET
H2 200 d4ef2cb28df25a03d6ce395df4f7ea59.js Show response
nexus.ensighten.com/citi/na_prod/code/ 125 KB
34 KB 29ms
28ms Script
application/javascript 18.197.253.20
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://nexus.ensighten.com/citi/na_prod/code/d4ef2cb28df25a03d6ce395df4f7ea59.js?conditionId0=486757
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 18.197.253.20 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-197-253-20.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: ebed77e0c92d7876c6329a97771728cc920ce8c3159c14dacd519d1552ee9e71

Request headers

Referer: https://mortgage.citi.com/cmi/PaidSearch/Conforming/Chip/LF2/default.htm?ISN=14814-9&BTST=9032003&btlp=dual&cmp=KNC~05~180105~BNKMORTG~Google&gclid=EAIaIQobChMI5-Hlrr_P5wIVDtvACh1yNwFcEAMYAyAAEgLnmvD_BwE&ProspectID=99395EC4AA874445AAE0B43E4AAA421E
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Thu, 13 Feb 2020 21:42:54 GMT
content-encoding: gzip
last-modified: Tue, 04 Feb 2020 18:16:27 GMT
server: nginx
etag: W/"5e39b4fb-1f511"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
status: 200
cache-control: max-age=315360000

GET
H2 200 2332b821d4e4d232bc6dcfc3863a9959.js Show response
nexus.ensighten.com/citi/na_prod/code/ 29 KB
7 KB 27ms
26ms Script
application/javascript 18.197.253.20
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://nexus.ensighten.com/citi/na_prod/code/2332b821d4e4d232bc6dcfc3863a9959.js?conditionId0=467299
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 18.197.253.20 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-197-253-20.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 3f00323bb3a4bd2a276bec0f27cfa55a94a2b967c3970e68fde57618dff3ddf4

Request headers

Referer: https://mortgage.citi.com/cmi/PaidSearch/Conforming/Chip/LF2/default.htm?ISN=14814-9&BTST=9032003&btlp=dual&cmp=KNC~05~180105~BNKMORTG~Google&gclid=EAIaIQobChMI5-Hlrr_P5wIVDtvACh1yNwFcEAMYAyAAEgLnmvD_BwE&ProspectID=99395EC4AA874445AAE0B43E4AAA421E
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Thu, 13 Feb 2020 21:42:54 GMT
content-encoding: gzip
last-modified: Thu, 13 Feb 2020 18:13:56 GMT
server: nginx
etag: W/"5e4591e4-729b"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
status: 200
cache-control: max-age=315360000

GET
H2 200 8637af7c210f4e79436bc39f71b49bfa.js Show response
nexus.ensighten.com/citi/na_prod/code/ 1 KB
737 B 26ms
25ms Script
application/javascript 18.197.253.20
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://nexus.ensighten.com/citi/na_prod/code/8637af7c210f4e79436bc39f71b49bfa.js?conditionId0=4827153
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 18.197.253.20 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-197-253-20.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 06dfb367edf9bbff810def9f75f8695b3ccfbcb2813306609fc6e18fcacfc17e

Request headers

Referer: https://mortgage.citi.com/cmi/PaidSearch/Conforming/Chip/LF2/default.htm?ISN=14814-9&BTST=9032003&btlp=dual&cmp=KNC~05~180105~BNKMORTG~Google&gclid=EAIaIQobChMI5-Hlrr_P5wIVDtvACh1yNwFcEAMYAyAAEgLnmvD_BwE&ProspectID=99395EC4AA874445AAE0B43E4AAA421E
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Thu, 13 Feb 2020 21:42:54 GMT
content-encoding: gzip
last-modified: Wed, 10 Jul 2019 12:57:13 GMT
server: nginx
etag: W/"5d25e0a9-412"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
status: 200
cache-control: max-age=315360000

GET
H2 200 4623122c9246526b5f745523a3d6bc4c.js Show response
nexus.ensighten.com/citi/na_prod/code/ 482 B
664 B 27ms
26ms Script
application/javascript 18.197.253.20
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://nexus.ensighten.com/citi/na_prod/code/4623122c9246526b5f745523a3d6bc4c.js?conditionId0=759974
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 18.197.253.20 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-197-253-20.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: c064bacdbf16d7bba288c50c45e43b3decc3f7c3aec9d9e0b4c238c83de4c250

Request headers

Referer: https://mortgage.citi.com/cmi/PaidSearch/Conforming/Chip/LF2/default.htm?ISN=14814-9&BTST=9032003&btlp=dual&cmp=KNC~05~180105~BNKMORTG~Google&gclid=EAIaIQobChMI5-Hlrr_P5wIVDtvACh1yNwFcEAMYAyAAEgLnmvD_BwE&ProspectID=99395EC4AA874445AAE0B43E4AAA421E
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Thu, 13 Feb 2020 21:42:54 GMT
last-modified: Tue, 07 May 2019 17:03:33 GMT
server: nginx
etag: "5cd1ba65-1e2"
content-type: application/javascript; charset=utf-8
status: 200
cache-control: max-age=315360000
accept-ranges: bytes
content-length: 482

GET
H2 200 48070ca8866144aeed1d66dda4fe04f2.js Show response
nexus.ensighten.com/citi/na_prod/code/ 2 KB
1 KB 27ms
27ms Script
application/javascript 18.197.253.20
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://nexus.ensighten.com/citi/na_prod/code/48070ca8866144aeed1d66dda4fe04f2.js?conditionId0=4854834
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 18.197.253.20 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-197-253-20.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: a9cebaefb3003c4944d0d59f71afdca3509d3975af5ff213d2750fdf8f719146

Request headers

Referer: https://mortgage.citi.com/cmi/PaidSearch/Conforming/Chip/LF2/default.htm?ISN=14814-9&BTST=9032003&btlp=dual&cmp=KNC~05~180105~BNKMORTG~Google&gclid=EAIaIQobChMI5-Hlrr_P5wIVDtvACh1yNwFcEAMYAyAAEgLnmvD_BwE&ProspectID=99395EC4AA874445AAE0B43E4AAA421E
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Thu, 13 Feb 2020 21:42:54 GMT
content-encoding: gzip
last-modified: Tue, 25 Jun 2019 17:02:14 GMT
server: nginx
etag: W/"5d125396-95c"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
status: 200
cache-control: max-age=315360000

GET
H2 200 6610fb4aae8f009df6c34d43ec0f8b17.js Show response
nexus.ensighten.com/citi/na_prod/code/ 52 KB
3 KB 27ms
27ms Script
application/javascript 18.197.253.20
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://nexus.ensighten.com/citi/na_prod/code/6610fb4aae8f009df6c34d43ec0f8b17.js?conditionId0=750459&conditionId1=750458&conditionId2=754094&conditionId3=754110&conditionId4=750487&conditionId5=750484
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 18.197.253.20 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-197-253-20.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: ecbd02dcce8c6c073a834d4b5c839775b95d23994a6fbe1a110bb8256757e110

Request headers

Referer: https://mortgage.citi.com/cmi/PaidSearch/Conforming/Chip/LF2/default.htm?ISN=14814-9&BTST=9032003&btlp=dual&cmp=KNC~05~180105~BNKMORTG~Google&gclid=EAIaIQobChMI5-Hlrr_P5wIVDtvACh1yNwFcEAMYAyAAEgLnmvD_BwE&ProspectID=99395EC4AA874445AAE0B43E4AAA421E
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Thu, 13 Feb 2020 21:42:54 GMT
content-encoding: gzip
last-modified: Tue, 10 Dec 2019 18:01:14 GMT
server: nginx
etag: W/"5defdd6a-d071"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
status: 200
cache-control: max-age=315360000

GET
H2 200 wcm Show response
www.google.be/pagead/attribution/ 89 B
564 B 34ms
21ms XHR
application/json 2a00:1450:4001:806::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.be/pagead/attribution/wcm?cl=HftRCK2TmHkQwcyajAM&fb=8667775258&use_ssct=1&callback=corscb&gclid=EAIaIQobChMI5-Hlrr_P5wIVDtvACh1yNwFcEAMYAyAAEgLnmvD_BwE

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/wcm/impl-1_32.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:806::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a2f7ab96bf17abca22635e815b9753ab2cd80e3398e4a2ea25e2112051b473eb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://mortgage.citi.com/cmi/PaidSearch/Conforming/Chip/LF2/default.htm?ISN=14814-9&BTST=9032003&btlp=dual&cmp=KNC~05~180105~BNKMORTG~Google&gclid=EAIaIQobChMI5-Hlrr_P5wIVDtvACh1yNwFcEAMYAyAAEgLnmvD_BwE&ProspectID=99395EC4AA874445AAE0B43E4AAA421E
Origin: https://mortgage.citi.com
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 13 Feb 2020 21:42:54 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
content-type: application/json; charset=UTF-8
access-control-allow-origin: https://mortgage.citi.com
cache-control: private
access-control-allow-credentials: true
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 94
x-xss-protection: 0

GET
H/1.1 200
OK bk-coretag.js Show response
tags.bkrtx.com/js/ 27 KB
10 KB 88ms
39ms Script
text/javascript 104.108.41.26
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.bkrtx.com/js/bk-coretag.js
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/code/70b8eff5831bcc37c1deb079a596efec.js?conditionId0=421908
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 104.108.41.26 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-108-41-26.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: 5cc280e965102224e1c7c0bd1df536c524c3a6fc9762205f4d7f7b345382c724

Request headers

Referer: https://mortgage.citi.com/cmi/PaidSearch/Conforming/Chip/LF2/default.htm?ISN=14814-9&BTST=9032003&btlp=dual&cmp=KNC~05~180105~BNKMORTG~Google&gclid=EAIaIQobChMI5-Hlrr_P5wIVDtvACh1yNwFcEAMYAyAAEgLnmvD_BwE&ProspectID=99395EC4AA874445AAE0B43E4AAA421E
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

Date: Thu, 13 Feb 2020 21:42:54 GMT
Content-Encoding: gzip
Last-Modified: Wed, 21 Aug 2019 15:56:57 GMT
Server: Apache
ETag: "31600f9-6afc-590a29f6f4dd4"
Vary: Accept-Encoding
Content-Type: text/javascript
Cache-Control: max-age=604800
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 9603
Expires: Thu, 20 Feb 2020 21:42:54 GMT

GET
H/1.1 200
OK rd Show response
dpm.demdex.net/id/ 363 B
1 KB 39ms
39ms XHR
application/json 34.252.123.130
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://dpm.demdex.net/id/rd?d_visid_ver=3.1.2&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=61834D9B5228A7430A490D45%40AdobeOrg&d_nsid=0&ts=1581630174261

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

34.252.123.130 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-34-252-123-130.eu-west-1.compute.amazonaws.com

Software

Resource Hash

b3cc127d12a9e6e426c9b7993a61c55d2cf0aeeac6aa767a56e3a977b0eb3187

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://mortgage.citi.com/cmi/PaidSearch/Conforming/Chip/LF2/default.htm?ISN=14814-9&BTST=9032003&btlp=dual&cmp=KNC~05~180105~BNKMORTG~Google&gclid=EAIaIQobChMI5-Hlrr_P5wIVDtvACh1yNwFcEAMYAyAAEgLnmvD_BwE&ProspectID=99395EC4AA874445AAE0B43E4AAA421E
Origin: https://mortgage.citi.com
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

DCS: dcs-prod-irl1-v059-07163f880.edge-irl1.demdex.com 5.65.0.20200204084552 2ms (+1ms)
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Encoding: gzip
X-TID: e2QcI9oVQnc=
Vary: Origin, Accept-Encoding, User-Agent
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Access-Control-Allow-Origin: https://mortgage.citi.com
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/json;charset=utf-8
Content-Length: 298
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H/1.1 200
OK Cookie set dest5.html
citi.demdex.net/ Frame 4B4D 0
0 140ms
35ms Document
text/html 52.30.105.51
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://citi.demdex.net/dest5.html?d_nsid=0

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.30.105.51 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-52-30-105-51.eu-west-1.compute.amazonaws.com

Software

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Host: citi.demdex.net
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: iframe
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Referer: https://mortgage.citi.com/cmi/PaidSearch/Conforming/Chip/LF2/default.htm?ISN=14814-9&BTST=9032003&btlp=dual&cmp=KNC~05~180105~BNKMORTG~Google&gclid=EAIaIQobChMI5-Hlrr_P5wIVDtvACh1yNwFcEAMYAyAAEgLnmvD_BwE&ProspectID=99395EC4AA874445AAE0B43E4AAA421E
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Cookie: demdex=82646829199048213381875002600373202871
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: iframe
Referer: https://mortgage.citi.com/cmi/PaidSearch/Conforming/Chip/LF2/default.htm?ISN=14814-9&BTST=9032003&btlp=dual&cmp=KNC~05~180105~BNKMORTG~Google&gclid=EAIaIQobChMI5-Hlrr_P5wIVDtvACh1yNwFcEAMYAyAAEgLnmvD_BwE&ProspectID=99395EC4AA874445AAE0B43E4AAA421E

Response headers

Accept-Ranges: bytes
Cache-Control: max-age=21600
Content-Encoding: gzip
Content-Type: text/html
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Last-Modified: Tue, 04 Feb 2020 13:21:19 GMT
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Pragma: no-cache
Set-Cookie: demdex=82646829199048213381875002600373202871;Path=/;Domain=.demdex.net;Expires=Tue, 11-Aug-2020 21:42:54 GMT;Max-Age=15552000;Secure;SameSite=None
Strict-Transport-Security: max-age=31536000; includeSubDomains
Vary: Accept-Encoding, User-Agent
X-TID: 8akUnBaCREc=
Content-Length: 2785
Connection: keep-alive

GET
H2 200 id Show response
metrics1.citi.com/ 89 B
628 B 111ms
28ms XHR
application/x-javascript 15.188.105.205
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://metrics1.citi.com/id?d_visid_ver=3.1.2&d_fieldgroup=A&mcorgid=61834D9B5228A7430A490D45%40AdobeOrg&mid=88680356247660446651416033365550142996&ts=1581630174461

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

15.188.105.205 Paris, France, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-15-188-105-205.eu-west-3.compute.amazonaws.com

Software

jag /

Resource Hash

b94dfed261413e9ffdb0e6926fb603a879e87865ca8c573c79f8bcbcb0fbe37f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://mortgage.citi.com/cmi/PaidSearch/Conforming/Chip/LF2/default.htm?ISN=14814-9&BTST=9032003&btlp=dual&cmp=KNC~05~180105~BNKMORTG~Google&gclid=EAIaIQobChMI5-Hlrr_P5wIVDtvACh1yNwFcEAMYAyAAEgLnmvD_BwE&ProspectID=99395EC4AA874445AAE0B43E4AAA421E
Origin: https://mortgage.citi.com
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

status: 200
date: Thu, 13 Feb 2020 21:42:54 GMT
x-content-type-options: nosniff
server: jag
xserver: anedge-67ff9d5b4c-tsrdr
vary: Origin
x-c: master-1158.Ib7fada.M0-347
p3p: CP="This is not a P3P policy"
access-control-allow-origin: https://mortgage.citi.com
cache-control: no-cache, no-store, max-age=0, no-transform, private
access-control-allow-credentials: true
content-type: application/x-javascript;charset=utf-8
content-length: 89
x-xss-protection: 1; mode=block

GET
H/1.1

200
OK

ibs:dpid=411&dpuuid=XkXC3gAAAaXJhxTJ
dpm.demdex.net/
Redirect Chain

https://cm.everesttech.net/cm/dd?d_uuid=82646829199048213381875002600373202871
https://dpm.demdex.net/ibs:dpid=411&dpuuid=XkXC3gAAAaXJhxTJ

42 B
915 B

38ms
37ms

Image
image/gif

34.252.123.130
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dpm.demdex.net/ibs:dpid=411&dpuuid=XkXC3gAAAaXJhxTJ

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

34.252.123.130 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-34-252-123-130.eu-west-1.compute.amazonaws.com

Software

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Referer: https://mortgage.citi.com/cmi/PaidSearch/Conforming/Chip/LF2/default.htm?ISN=14814-9&BTST=9032003&btlp=dual&cmp=KNC~05~180105~BNKMORTG~Google&gclid=EAIaIQobChMI5-Hlrr_P5wIVDtvACh1yNwFcEAMYAyAAEgLnmvD_BwE&ProspectID=99395EC4AA874445AAE0B43E4AAA421E
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

DCS: dcs-prod-irl1-v059-0359da5bc.edge-irl1.demdex.com 5.65.0.20200204084552 1ms (+0ms)
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-Content-Type-Options: nosniff
X-TID: /S5S/vtaTYQ=
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection: keep-alive
Content-Type: image/gif
Content-Length: 42
Expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

Date: Thu, 13 Feb 2020 21:42:54 GMT
Server: AMO-cookiemap/1.1
P3P: CP="NOI NID DEVa PSAa PSDa OUR IND PUR COM NAV INT DEM"
Location: https://dpm.demdex.net/ibs:dpid=411&dpuuid=XkXC3gAAAaXJhxTJ
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=15,max=100
Content-Length: 0

GET
H/1.1 200
OK id Show response
dpm.demdex.net/ 363 B
1 KB 39ms
39ms XHR
application/json 34.252.123.130
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://dpm.demdex.net/id?d_visid_ver=3.1.2&d_fieldgroup=AAM&d_rtbd=json&d_ver=2&d_orgid=61834D9B5228A7430A490D45%40AdobeOrg&d_nsid=0&d_mid=88680356247660446651416033365550142996&d_blob=RKhpRz8krg2tLO6pguXWp5olkAcUniQYPHaMWWgdJ3xzPWQmdj0y&d_cid_ic=AVID%012F22E16F0515922D-4000078CE0103C7E&ts=1581630174574

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

34.252.123.130 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-34-252-123-130.eu-west-1.compute.amazonaws.com

Software

Resource Hash

be69c83c90291e8e4325bdaae405e19a031d6472c32daa4a8dda7d55bfe6a529

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://mortgage.citi.com/cmi/PaidSearch/Conforming/Chip/LF2/default.htm?ISN=14814-9&BTST=9032003&btlp=dual&cmp=KNC~05~180105~BNKMORTG~Google&gclid=EAIaIQobChMI5-Hlrr_P5wIVDtvACh1yNwFcEAMYAyAAEgLnmvD_BwE&ProspectID=99395EC4AA874445AAE0B43E4AAA421E
Origin: https://mortgage.citi.com
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

DCS: dcscanary-prod-irl1-v081-0a4897323.edge-irl1.demdex.com 5.65.0.20200212140016 2ms (+0ms)
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Encoding: gzip
X-TID: 18jkK6DzQvo=
Vary: Origin, Accept-Encoding, User-Agent
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Access-Control-Allow-Origin: https://mortgage.citi.com
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/json;charset=utf-8
Content-Length: 299
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H/1.1 200
OK tc.min.js Show response
c1.rfihub.net/js/ 20 KB
7 KB 97ms
26ms Script
application/x-javascript 104.124.153.199
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://c1.rfihub.net/js/tc.min.js
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/code/2332b821d4e4d232bc6dcfc3863a9959.js?conditionId0=467299
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 104.124.153.199 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-124-153-199.deploy.static.akamaitechnologies.com
Software: Jetty(9.0.6.v20130930) /
Resource Hash: cb2bb21705b9cce9781d02c9223f3344a65bd5314027d11c5a8518ad4bd84e84

Request headers

Referer: https://mortgage.citi.com/cmi/PaidSearch/Conforming/Chip/LF2/default.htm?ISN=14814-9&BTST=9032003&btlp=dual&cmp=KNC~05~180105~BNKMORTG~Google&gclid=EAIaIQobChMI5-Hlrr_P5wIVDtvACh1yNwFcEAMYAyAAEgLnmvD_BwE&ProspectID=99395EC4AA874445AAE0B43E4AAA421E
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

Date: Thu, 13 Feb 2020 21:42:54 GMT
Content-Encoding: gzip
Last-Modified: Fri, 24 Jan 2020 08:43:10 GMT
Server: Jetty(9.0.6.v20130930)
Vary: Accept-Encoding
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Cache-Control: public, max-age=3600
Connection: keep-alive
Content-Type: application/x-javascript
Content-Length: 6375
Expires: Thu, 13 Feb 2020 22:42:54 GMT

GET
H/1.1 200
OK idr.js Show response
a.rfihub.com/ 83 B
684 B 112ms
25ms Script
application/javascript 185.31.128.129
ROCKETFUEL

General

Check archive.org

Show headers Download Go to

Full URL: https://a.rfihub.com/idr.js?_callback=window.RocketfuelBCP.jsonpCallbacks.request_cmZpSWRJbkNhY2hl
Requested by: Host: c1.rfihub.net
URL: https://c1.rfihub.net/js/tc.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_256_CBC
Server: 185.31.128.129 , Netherlands, ASN54312 (ROCKETFUEL, US),
Reverse DNS
Software: Jetty(9.0.6.v20130930) /
Resource Hash: 101a5a9629dd40bd6dd9515c9b5ad77750ad8e06339fe57c56b6aa7cbca871aa

Request headers

Referer: https://mortgage.citi.com/cmi/PaidSearch/Conforming/Chip/LF2/default.htm?ISN=14814-9&BTST=9032003&btlp=dual&cmp=KNC~05~180105~BNKMORTG~Google&gclid=EAIaIQobChMI5-Hlrr_P5wIVDtvACh1yNwFcEAMYAyAAEgLnmvD_BwE&ProspectID=99395EC4AA874445AAE0B43E4AAA421E
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

Expires: Tue, 09 Mar 2021 21:42:54 GMT
Cache-Control: public, max-age=33696000
Server: Jetty(9.0.6.v20130930)
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Content-Length: 83
Content-Type: application/javascript

GET
H/1.1 200
OK Cookie set ca.html
20766699p.rfihub.com/ Frame 762A 0
0 97ms
27ms Document
text/html 185.31.128.129
ROCKETFUEL

General

Check archive.org

Show headers Download Go to

Full URL: https://20766699p.rfihub.com/ca.html?rfiidc=1582522692080480092&rfiaid=df04b04b38044e929cadb41e841739a0&ver=9&ra=200&rb=648&ca=20766699&_o=17169175&_t=paidsearchmortgagedualleadlanding&ssv_cuuid=&ssv_pagename=paidsearchmortgagedualleadlanding&pe=https%3A%2F%2Fmortgage.citi.com%2Fcmi%2FPaidSearch%2FConforming%2FChip%2FLF2%2Fdefault.htm%3FISN%3D14814-9%26BTST%3D9032003%26btlp%3Ddual%26cmp%3DKNC%7E05%7E180105%7EBNKMORTG%7EGoogle%26gclid%3DEAIaIQobChMI5-Hlrr_P5wIVDtvACh1yNwFcEAMYAyAAEgLnmvD_BwE%26ProspectID%3D99395EC4AA874445AAE0B43E4AAA421E&pf=&ra=9959123518940551
Requested by: Host: c1.rfihub.net
URL: https://c1.rfihub.net/js/tc.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_256_CBC
Server: 185.31.128.129 , Netherlands, ASN54312 (ROCKETFUEL, US),
Reverse DNS
Software: Jetty(9.0.6.v20130930) /
Resource Hash

Request headers

Host: 20766699p.rfihub.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: iframe
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Referer: https://mortgage.citi.com/cmi/PaidSearch/Conforming/Chip/LF2/default.htm?ISN=14814-9&BTST=9032003&btlp=dual&cmp=KNC~05~180105~BNKMORTG~Google&gclid=EAIaIQobChMI5-Hlrr_P5wIVDtvACh1yNwFcEAMYAyAAEgLnmvD_BwE&ProspectID=99395EC4AA874445AAE0B43E4AAA421E
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Cookie: ruds=H4sIAAAAAAAAAOMSNjS1MDI1MjKzNDKwMDCxMDCwNBLiM9Qtzfb2syz3cA0oMvcAAFGaooclAAAA; rud=H4sIAAAAAAAAAOMSNjS1MDI1MjKzNDKwMDCxMDCwNBLiM9Qtzfb2syz3cA0oMveQ4gUqMjQzNjA0N7EwMQYAOH3cFDQAAAA
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: iframe
Referer: https://mortgage.citi.com/cmi/PaidSearch/Conforming/Chip/LF2/default.htm?ISN=14814-9&BTST=9032003&btlp=dual&cmp=KNC~05~180105~BNKMORTG~Google&gclid=EAIaIQobChMI5-Hlrr_P5wIVDtvACh1yNwFcEAMYAyAAEgLnmvD_BwE&ProspectID=99395EC4AA874445AAE0B43E4AAA421E

Response headers

P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Set-Cookie: ruds=H4sIAAAAAAAAAOMSNjS1MDI1MjKzNDKwMDCxMDCwNBLiM9Qtzfb2syz3cA0oMvcAAFGaooclAAAA; Path=/; Domain=.rfihub.com; Secure; SameSite=None rud=H4sIAAAAAAAAAOMSNjS1MDI1MjKzNDKwMDCxMDCwNBLiM9Qtzfb2syz3cA0oMveQ4gUqMjQzNjA0N7EwMQYAOH3cFDQAAAA; Path=/; Domain=.rfihub.com; Expires=Tue, 9 Mar 2021 21:42:54 GMT; Secure; SameSite=None
Cache-Control: no-cache
Content-Type: text/html
Content-Encoding: gzip
Vary: Accept-Encoding, User-Agent
Transfer-Encoding: chunked
Server: Jetty(9.0.6.v20130930)

GET
H/1.1 200
OK up_loader.1.1.0.js Show response
js.adsrvr.org/ 4 KB
2 KB 79ms
18ms Script
application/x-javascript 13.224.185.201
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://js.adsrvr.org/up_loader.1.1.0.js
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 13.224.185.201 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-224-185-201.fra2.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 0615974c40d602afdbf9759533e352bc17b0458c85aad6694b1a1ad20659625b

Request headers

Referer: https://mortgage.citi.com/cmi/PaidSearch/Conforming/Chip/LF2/default.htm?ISN=14814-9&BTST=9032003&btlp=dual&cmp=KNC~05~180105~BNKMORTG~Google&gclid=EAIaIQobChMI5-Hlrr_P5wIVDtvACh1yNwFcEAMYAyAAEgLnmvD_BwE&ProspectID=99395EC4AA874445AAE0B43E4AAA421E
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

Date: Thu, 13 Feb 2020 03:59:44 GMT
Content-Encoding: gzip
Last-Modified: Mon, 13 Jan 2020 19:16:48 GMT
Server: AmazonS3
Age: 87298
Vary: Accept-Encoding
X-Cache: Hit from cloudfront
Content-Type: application/x-javascript
Via: 1.1 e976f829f2d1c4787d42d0595ae7cf75.cloudfront.net (CloudFront)
Transfer-Encoding: chunked
X-Amz-Cf-Pop: FRA2-C1
Connection: keep-alive
X-Amz-Cf-Id: -jjDgyuejdKsuB6MjQBjkG2Dt81N55xcJ4dK8mqhlEA1OmHHFd4xiw==

GET
H2 200 embed.js Show response
resources.digital-cloud-citi.medallia.com/wdcusciti/50/onsite/ 2 KB
1 KB 69ms
19ms Script
application/javascript 151.101.114.133
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://resources.digital-cloud-citi.medallia.com/wdcusciti/50/onsite/embed.js
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/code/fdf45a7c15c1cee06bb71e10dac4e26e.js?conditionId0=4849963
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.114.133 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 68c3de9cc8c778d500586681addd69c5b4b126a47f06f99df66fba3d013af9df

Request headers

Referer: https://mortgage.citi.com/cmi/PaidSearch/Conforming/Chip/LF2/default.htm?ISN=14814-9&BTST=9032003&btlp=dual&cmp=KNC~05~180105~BNKMORTG~Google&gclid=EAIaIQobChMI5-Hlrr_P5wIVDtvACh1yNwFcEAMYAyAAEgLnmvD_BwE&ProspectID=99395EC4AA874445AAE0B43E4AAA421E
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

x-amz-version-id: ypu20k_RvFpqOtLmNy8K8OqXAlx9RbSG
content-encoding: gzip
age: 27
x-cache: HIT
status: 200
date: Thu, 13 Feb 2020 21:42:55 GMT
content-length: 674
x-amz-id-2: y7zHuk3Kqvptu3luriSClDG/L+DIyt/PwW6FiWL95BhfHXxGvn5tLGihsxjeCKpqh3BmS+mWOJQ=
x-served-by: cache-hhn4067-HHN
access-control-allow-origin: *
last-modified: Mon, 10 Feb 2020 16:23:25 GMT
server: AmazonS3
x-timer: S1581630175.016024,VS0,VE1
etag: "045a1de4acb56dcabede843340127f21"
vary: Accept-Encoding
x-amz-request-id: 8CD14BF092764C11
via: 1.1 varnish
cache-control: max-age=0,must-revalidate
accept-ranges: bytes
content-type: application/javascript
x-cache-hits: 1

GET
H2 200 1560.js Show response
cdn.pbbl.co/r/ 31 KB
9 KB 181ms
113ms Script
application/javascript 13.225.78.34
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.pbbl.co/r/1560.js

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/code/8637af7c210f4e79436bc39f71b49bfa.js?conditionId0=4827153

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

13.225.78.34 Seattle, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-225-78-34.fra2.r.cloudfront.net

Software

nginx/1.10.3 (Ubuntu) /

Resource Hash

0b2184cbf465296763bda66941dad327f1e7d420cbc11fe2a6fd34ab8daccd04

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Xss-Protection	1

Request headers

Referer: https://mortgage.citi.com/cmi/PaidSearch/Conforming/Chip/LF2/default.htm?ISN=14814-9&BTST=9032003&btlp=dual&cmp=KNC~05~180105~BNKMORTG~Google&gclid=EAIaIQobChMI5-Hlrr_P5wIVDtvACh1yNwFcEAMYAyAAEgLnmvD_BwE&ProspectID=99395EC4AA874445AAE0B43E4AAA421E
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Thu, 13 Feb 2020 21:42:55 GMT
content-encoding: gzip
last-modified: Thu, 06 Feb 2020 15:53:14 GMT
server: nginx/1.10.3 (Ubuntu)
x-amz-cf-pop: FRA2-C2
vary: Accept-Encoding
x-cache: Miss from cloudfront
content-type: application/javascript
status: 200
x-xss-protection: 1
cache-control: max-age=1800, public
strict-transport-security: max-age=31536000
x-amz-cf-id: 7uOevhUuJp7XWCwxKSSmfv2gmwTW8j63x7Tjp5d778hPctoP14tHHA==
via: 1.1 4048e3a1e70c8529cbd86f04580a3da4.cloudfront.net (CloudFront)
expires: Thu, 13 Feb 2020 22:12:55 GMT

GET
H2 204 425466.html
sr.rlcdn.com/ Frame D082 0
0 173ms
119ms Document
text/plain 35.190.72.21
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://sr.rlcdn.com/425466.html?es=80676&u=da39a3ee5e6b4b0d3255bfef95601890afd80709
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/code/2332b821d4e4d232bc6dcfc3863a9959.js?conditionId0=467299
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.190.72.21 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 21.72.190.35.bc.googleusercontent.com
Software: /
Resource Hash

Request headers

:method: GET
:authority: sr.rlcdn.com
:scheme: https
:path: /425466.html?es=80676&u=da39a3ee5e6b4b0d3255bfef95601890afd80709
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-dest: iframe
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
referer: https://mortgage.citi.com/cmi/PaidSearch/Conforming/Chip/LF2/default.htm?ISN=14814-9&BTST=9032003&btlp=dual&cmp=KNC~05~180105~BNKMORTG~Google&gclid=EAIaIQobChMI5-Hlrr_P5wIVDtvACh1yNwFcEAMYAyAAEgLnmvD_BwE&ProspectID=99395EC4AA874445AAE0B43E4AAA421E
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: iframe
Referer: https://mortgage.citi.com/cmi/PaidSearch/Conforming/Chip/LF2/default.htm?ISN=14814-9&BTST=9032003&btlp=dual&cmp=KNC~05~180105~BNKMORTG~Google&gclid=EAIaIQobChMI5-Hlrr_P5wIVDtvACh1yNwFcEAMYAyAAEgLnmvD_BwE&ProspectID=99395EC4AA874445AAE0B43E4AAA421E

Response headers

status: 204
date: Thu, 13 Feb 2020 21:42:55 GMT
via: 1.1 google
alt-svc: clear

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 74 KB
28 KB 15ms
15ms Script
application/javascript 2a00:1450:4001:817::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-959299794

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:817::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

48ca6c21dfabf1d560498003b175da4156a064af205feb0c1da118c48cb649fa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Referer: https://mortgage.citi.com/cmi/PaidSearch/Conforming/Chip/LF2/default.htm?ISN=14814-9&BTST=9032003&btlp=dual&cmp=KNC~05~180105~BNKMORTG~Google&gclid=EAIaIQobChMI5-Hlrr_P5wIVDtvACh1yNwFcEAMYAyAAEgLnmvD_BwE&ProspectID=99395EC4AA874445AAE0B43E4AAA421E
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Thu, 13 Feb 2020 21:42:54 GMT
content-encoding: br
status: 200
strict-transport-security: max-age=31536000; includeSubDomains
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 28495
x-xss-protection: 0
last-modified: Thu, 13 Feb 2020 21:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: http://www.googletagmanager.com
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Thu, 13 Feb 2020 21:42:54 GMT

GET
H2 200 bat.js Show response
bat.bing.com/ 23 KB
7 KB 28ms
28ms Script
application/javascript 2620:1ec:c11::200
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://bat.bing.com/bat.js
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: 89b531e78902333807b825faf77cd11cc927fe364ea2ba9307f65365f7e811f7

Request headers

Referer: https://mortgage.citi.com/cmi/PaidSearch/Conforming/Chip/LF2/default.htm?ISN=14814-9&BTST=9032003&btlp=dual&cmp=KNC~05~180105~BNKMORTG~Google&gclid=EAIaIQobChMI5-Hlrr_P5wIVDtvACh1yNwFcEAMYAyAAEgLnmvD_BwE&ProspectID=99395EC4AA874445AAE0B43E4AAA421E
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Thu, 13 Feb 2020 21:42:54 GMT
content-encoding: gzip
last-modified: Fri, 31 Jan 2020 21:01:31 GMT
x-msedge-ref: Ref A: 01AE78A06A67427FBDB746DA67F3EAD4 Ref B: FRAEDGE0314 Ref C: 2020-02-13T21:42:54Z
access-control-allow-origin: *
etag: "8087c39c79d8d51:0"
vary: Accept-Encoding
content-type: application/javascript
status: 200
cache-control: private,max-age=1800
accept-ranges: bytes
content-length: 7295

GET
H2

200

src=8825552;dc_pre=CPbJs8a_z-cCFYmXdwod8lYLLQ;type=invmedia;cat=citi_006;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;ord=1
adservice.google.com/ddm/fls/z/
Redirect Chain

https://gwmtracking.com/p/v/1/5cf163aaf870814c0138c6b2/format/img
https://ad.doubleclick.net/ddm/activity/src=8825552;type=invmedia;cat=citi_006;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;ord=1?
https://ad.doubleclick.net/ddm/activity/src=8825552;dc_pre=CPbJs8a_z-cCFYmXdwod8lYLLQ;type=invmedia;cat=citi_006;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;ord=1?
https://adservice.google.com/ddm/fls/z/src=8825552;dc_pre=CPbJs8a_z-cCFYmXdwod8lYLLQ;type=invmedia;cat=citi_006;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;ord=1

42 B
109 B

40ms
40ms

Image
image/gif

2a00:1450:4001:808::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://adservice.google.com/ddm/fls/z/src=8825552;dc_pre=CPbJs8a_z-cCFYmXdwod8lYLLQ;type=invmedia;cat=citi_006;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;ord=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://mortgage.citi.com/cmi/PaidSearch/Conforming/Chip/LF2/default.htm?ISN=14814-9&BTST=9032003&btlp=dual&cmp=KNC~05~180105~BNKMORTG~Google&gclid=EAIaIQobChMI5-Hlrr_P5wIVDtvACh1yNwFcEAMYAyAAEgLnmvD_BwE&ProspectID=99395EC4AA874445AAE0B43E4AAA421E
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 13 Feb 2020 21:42:55 GMT
x-content-type-options: nosniff
content-type: image/gif
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, must-revalidate
timing-allow-origin: *
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Thu, 13 Feb 2020 21:42:55 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
location: https://adservice.google.com/ddm/fls/z/src=8825552;dc_pre=CPbJs8a_z-cCFYmXdwod8lYLLQ;type=invmedia;cat=citi_006;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;ord=1
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status: 302
cache-control: no-cache, must-revalidate
content-type: text/html; charset=UTF-8
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 DFPAudiencePixel&ord=7837347033.715302&dc_seg=763022796
pubads.g.doubleclick.net/activity;dc_iu=/1019096/ 42 B
611 B 88ms
36ms Image
image/gif 172.217.22.2
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pubads.g.doubleclick.net/activity;dc_iu=/1019096/DFPAudiencePixel&ord=7837347033.715302&dc_seg=763022796

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.22.2 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s14-in-f2.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://mortgage.citi.com/cmi/PaidSearch/Conforming/Chip/LF2/default.htm?ISN=14814-9&BTST=9032003&btlp=dual&cmp=KNC~05~180105~BNKMORTG~Google&gclid=EAIaIQobChMI5-Hlrr_P5wIVDtvACh1yNwFcEAMYAyAAEgLnmvD_BwE&ProspectID=99395EC4AA874445AAE0B43E4AAA421E
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

pragma: no-cache
date: Thu, 13 Feb 2020 21:42:55 GMT
x-content-type-options: nosniff
content-type: image/gif
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status: 200
cache-control: no-cache, must-revalidate
timing-allow-origin: *
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 204 event.gif
beacon.krxd.net/ 0
320 B 108ms
36ms Image
text/plain 54.154.55.10
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://beacon.krxd.net/event.gif?event_id=M8ZHsbsT&event_type=pageview
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.154.55.10 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-154-55-10.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://mortgage.citi.com/cmi/PaidSearch/Conforming/Chip/LF2/default.htm?ISN=14814-9&BTST=9032003&btlp=dual&cmp=KNC~05~180105~BNKMORTG~Google&gclid=EAIaIQobChMI5-Hlrr_P5wIVDtvACh1yNwFcEAMYAyAAEgLnmvD_BwE&ProspectID=99395EC4AA874445AAE0B43E4AAA421E
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

status: 204
date: Thu, 13 Feb 2020 21:42:55 GMT
cache-control: private, no-cache, no-store
x-request-time: D=33 t=1581630175
x-served-by: beacon-n024-dub-prod.krxd.net
p3p: policyref="https://cdn.krxd.net/kruxcontent/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

GET
H/1.1 200
OK 63068
stags.bluekai.com/site/ Frame 83D4 0
0 224ms
183ms Document
text/html 23.45.237.36
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://stags.bluekai.com/site/63068?ret=html&phint=language%3Denglish&phint=product&phint=event&phint=category%3Dprelogin%20lead%20form&phint=page%3Dpaid%20search%20mortgage%20dual%20lead%20landing&phint=section1%3DSapient&phint=section2%3DACQ&phint=section3%3DMORTGAGE&phint=section4%3DPaidSearch&phint=bankappstatus&phint=productID&phint=__bk_t%3DCitibank&phint=__bk_k%3DMortgage%20calculator%2C%20buy%20a%20home%2C%20real%20estate%2C%20home%20loan%2C%20closing%20costs%2C%20new%20homes&phint=__bk_l%3Dhttps%3A%2F%2Fmortgage.citi.com%2Fcmi%2FPaidSearch%2FConforming%2FChip%2FLF2%2Fdefault.htm%3FISN%3D14814-9%26BTST%3D9032003%26btlp%3Ddual%26cmp%3DKNC~05~180105~BNKMORTG~Google%26gclid%3DEAIaIQobChMI5-Hlrr_P5wIVDtvACh1yNwFcEAMYAyAAEgLnmvD_BwE%26ProspectID%3D99395EC4AA874445AAE0B43E4AAA421E&phint=__bk_v%3D3.1.3&limit=10&r=56595650
Requested by: Host: tags.bkrtx.com
URL: https://tags.bkrtx.com/js/bk-coretag.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 23.45.237.36 , United States, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS: a23-45-237-36.deploy.static.akamaitechnologies.com
Software: /
Resource Hash

Request headers

Host: stags.bluekai.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: iframe
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Referer: https://mortgage.citi.com/cmi/PaidSearch/Conforming/Chip/LF2/default.htm?ISN=14814-9&BTST=9032003&btlp=dual&cmp=KNC~05~180105~BNKMORTG~Google&gclid=EAIaIQobChMI5-Hlrr_P5wIVDtvACh1yNwFcEAMYAyAAEgLnmvD_BwE&ProspectID=99395EC4AA874445AAE0B43E4AAA421E
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: iframe
Referer: https://mortgage.citi.com/cmi/PaidSearch/Conforming/Chip/LF2/default.htm?ISN=14814-9&BTST=9032003&btlp=dual&cmp=KNC~05~180105~BNKMORTG~Google&gclid=EAIaIQobChMI5-Hlrr_P5wIVDtvACh1yNwFcEAMYAyAAEgLnmvD_BwE&ProspectID=99395EC4AA874445AAE0B43E4AAA421E

Response headers

Content-Type: text/html
Content-Length: 71
P3P: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV", policyref="http://tags.bluekai.com/w3c/p3p.xml"
BK-Server: 9ab9
Date: Thu, 13 Feb 2020 21:42:55 GMT
Connection: keep-alive
X-N: S

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 74 KB
28 KB 16ms
15ms Script
application/javascript 2a00:1450:4001:817::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=DC-6260004

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:817::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

2c76393466ddb5f37701caae9f50814d732997583094b1a4eff10360e455d853

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Referer: https://mortgage.citi.com/cmi/PaidSearch/Conforming/Chip/LF2/default.htm?ISN=14814-9&BTST=9032003&btlp=dual&cmp=KNC~05~180105~BNKMORTG~Google&gclid=EAIaIQobChMI5-Hlrr_P5wIVDtvACh1yNwFcEAMYAyAAEgLnmvD_BwE&ProspectID=99395EC4AA874445AAE0B43E4AAA421E
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Thu, 13 Feb 2020 21:42:54 GMT
content-encoding: br
status: 200
strict-transport-security: max-age=31536000; includeSubDomains
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 28492
x-xss-protection: 0
last-modified: Thu, 13 Feb 2020 21:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: http://www.googletagmanager.com
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Thu, 13 Feb 2020 21:42:54 GMT

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 74 KB
28 KB 24ms
23ms Script
application/javascript 2a00:1450:4001:817::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=DC-6269322

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:817::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

7b265a879ebfe9cd09a87dba0216d05a137c8a6e6c2c686a9ea0ba0bf2212a4d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Referer: https://mortgage.citi.com/cmi/PaidSearch/Conforming/Chip/LF2/default.htm?ISN=14814-9&BTST=9032003&btlp=dual&cmp=KNC~05~180105~BNKMORTG~Google&gclid=EAIaIQobChMI5-Hlrr_P5wIVDtvACh1yNwFcEAMYAyAAEgLnmvD_BwE&ProspectID=99395EC4AA874445AAE0B43E4AAA421E
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Thu, 13 Feb 2020 21:42:54 GMT
content-encoding: br
status: 200
strict-transport-security: max-age=31536000; includeSubDomains
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 28492
x-xss-protection: 0
last-modified: Thu, 13 Feb 2020 21:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: http://www.googletagmanager.com
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Thu, 13 Feb 2020 21:42:54 GMT

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 74 KB
28 KB 16ms
16ms Script
application/javascript 2a00:1450:4001:817::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=DC-6256710

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:817::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

4c71a7269921a27edf40049926121bff488752f9fb89ff85e1bcc1b62bbc330d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Referer: https://mortgage.citi.com/cmi/PaidSearch/Conforming/Chip/LF2/default.htm?ISN=14814-9&BTST=9032003&btlp=dual&cmp=KNC~05~180105~BNKMORTG~Google&gclid=EAIaIQobChMI5-Hlrr_P5wIVDtvACh1yNwFcEAMYAyAAEgLnmvD_BwE&ProspectID=99395EC4AA874445AAE0B43E4AAA421E
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Thu, 13 Feb 2020 21:42:54 GMT
content-encoding: br
status: 200
strict-transport-security: max-age=31536000; includeSubDomains
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 28492
x-xss-protection: 0
last-modified: Thu, 13 Feb 2020 21:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: http://www.googletagmanager.com
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Thu, 13 Feb 2020 21:42:54 GMT

GET
H2

200

activityi;dc_pre=CI35gMa_z-cCFVjhuwgdTQABSQ;src=6256710;type=globa0;cat=mortg00l;ord=1;num=7865387505600;gtm=2oa250;gclaw=EAIaIQobChMI5-Hlrr_P5wIVDtvACh1yNwFcEAMYAyAAEgLnmvD_BwE;auiddc=1821467570.1...
6256710.fls.doubleclick.net/ Frame 4106
Redirect Chain

https://6256710.fls.doubleclick.net/activityi;src=6256710;type=globa0;cat=mortg00l;ord=1;num=7865387505600;gtm=2oa250;gclaw=EAIaIQobChMI5-Hlrr_P5wIVDtvACh1yNwFcEAMYAyAAEgLnmvD_BwE;auiddc=1821467570...
https://6256710.fls.doubleclick.net/activityi;dc_pre=CI35gMa_z-cCFVjhuwgdTQABSQ;src=6256710;type=globa0;cat=mortg00l;ord=1;num=7865387505600;gtm=2oa250;gclaw=EAIaIQobChMI5-Hlrr_P5wIVDtvACh1yNwFcEAM...

0
0

38ms
38ms

Document
text/html

172.217.22.38
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://6256710.fls.doubleclick.net/activityi;dc_pre=CI35gMa_z-cCFVjhuwgdTQABSQ;src=6256710;type=globa0;cat=mortg00l;ord=1;num=7865387505600;gtm=2oa250;gclaw=EAIaIQobChMI5-Hlrr_P5wIVDtvACh1yNwFcEAMYAyAAEgLnmvD_BwE;auiddc=1821467570.1581630175;u3=99395EC4AA874445AAE0B43E4AAA421E;u1=14814-9;~oref=https%3A%2F%2Fmortgage.citi.com%2Fcmi%2FPaidSearch%2FConforming%2FChip%2FLF2%2Fdefault.htm%3FISN%3D14814-9%26BTST%3D9032003%26btlp%3Ddual%26cmp%3DKNC~05~180105~BNKMORTG~Google%26gclid%3DEAIaIQobChMI5-Hlrr_P5wIVDtvACh1yNwFcEAMYAyAAEgLnmvD_BwE%26ProspectID%3D99395EC4AA874445AAE0B43E4AAA421E?

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-959299794

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.22.38 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra15s16-in-f38.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=21600
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: 6256710.fls.doubleclick.net
:scheme: https
:path: /activityi;dc_pre=CI35gMa_z-cCFVjhuwgdTQABSQ;src=6256710;type=globa0;cat=mortg00l;ord=1;num=7865387505600;gtm=2oa250;gclaw=EAIaIQobChMI5-Hlrr_P5wIVDtvACh1yNwFcEAMYAyAAEgLnmvD_BwE;auiddc=1821467570.1581630175;u3=99395EC4AA874445AAE0B43E4AAA421E;u1=14814-9;~oref=https%3A%2F%2Fmortgage.citi.com%2Fcmi%2FPaidSearch%2FConforming%2FChip%2FLF2%2Fdefault.htm%3FISN%3D14814-9%26BTST%3D9032003%26btlp%3Ddual%26cmp%3DKNC~05~180105~BNKMORTG~Google%26gclid%3DEAIaIQobChMI5-Hlrr_P5wIVDtvACh1yNwFcEAMYAyAAEgLnmvD_BwE%26ProspectID%3D99395EC4AA874445AAE0B43E4AAA421E?
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-dest: iframe
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
referer: https://mortgage.citi.com/cmi/PaidSearch/Conforming/Chip/LF2/default.htm?ISN=14814-9&BTST=9032003&btlp=dual&cmp=KNC~05~180105~BNKMORTG~Google&gclid=EAIaIQobChMI5-Hlrr_P5wIVDtvACh1yNwFcEAMYAyAAEgLnmvD_BwE&ProspectID=99395EC4AA874445AAE0B43E4AAA421E
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: IDE=AHWqTUk-36q1fQ7Oit04RMwptX0ATK7A-48DwJxZkc7pWja50Cg9yaJzjysPtofC; test_cookie=CheckForPermission
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: iframe
Referer: about:blank

Response headers

status: 200
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
date: Thu, 13 Feb 2020 21:42:55 GMT
expires: Thu, 13 Feb 2020 21:42:55 GMT
cache-control: private, max-age=0
strict-transport-security: max-age=21600
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 482
x-xss-protection: 0
set-cookie: test_cookie=; domain=.doubleclick.net; path=/; expires=Mon, 21 Jul 2008 23:59:00 GMT; SameSite=none; Secure
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000

Redirect headers

status: 302
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
date: Thu, 13 Feb 2020 21:42:55 GMT
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
cache-control: no-cache, must-revalidate
follow-only-when-prerender-shown: 1
strict-transport-security: max-age=21600
location: https://6256710.fls.doubleclick.net/activityi;dc_pre=CI35gMa_z-cCFVjhuwgdTQABSQ;src=6256710;type=globa0;cat=mortg00l;ord=1;num=7865387505600;gtm=2oa250;gclaw=EAIaIQobChMI5-Hlrr_P5wIVDtvACh1yNwFcEAMYAyAAEgLnmvD_BwE;auiddc=1821467570.1581630175;u3=99395EC4AA874445AAE0B43E4AAA421E;u1=14814-9;~oref=https%3A%2F%2Fmortgage.citi.com%2Fcmi%2FPaidSearch%2FConforming%2FChip%2FLF2%2Fdefault.htm%3FISN%3D14814-9%26BTST%3D9032003%26btlp%3Ddual%26cmp%3DKNC~05~180105~BNKMORTG~Google%26gclid%3DEAIaIQobChMI5-Hlrr_P5wIVDtvACh1yNwFcEAMYAyAAEgLnmvD_BwE%26ProspectID%3D99395EC4AA874445AAE0B43E4AAA421E?
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
server: cafe
content-length: 0
x-xss-protection: 0
set-cookie: test_cookie=CheckForPermission; expires=Thu, 13-Feb-2020 21:57:55 GMT; path=/; domain=.doubleclick.net; Secure; SameSite=none
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000

GET
H2 200 conversion_async.js Show response
www.googleadservices.com/pagead/ 26 KB
10 KB 33ms
33ms Script
text/javascript 216.58.205.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googleadservices.com/pagead/conversion_async.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-959299794

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

216.58.205.226 Mountain View, United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra15s24-in-f2.1e100.net

Software

cafe /

Resource Hash

ec7024e764e94caa58c7a18f4624dc84c9ee15537ff5418fd44e2f037f8abc30

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://mortgage.citi.com/cmi/PaidSearch/Conforming/Chip/LF2/default.htm?ISN=14814-9&BTST=9032003&btlp=dual&cmp=KNC~05~180105~BNKMORTG~Google&gclid=EAIaIQobChMI5-Hlrr_P5wIVDtvACh1yNwFcEAMYAyAAEgLnmvD_BwE&ProspectID=99395EC4AA874445AAE0B43E4AAA421E
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Thu, 13 Feb 2020 21:42:55 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
content-disposition: attachment; filename="f.txt"
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 9931
x-xss-protection: 0
server: cafe
etag: 8273558640064030436
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600
timing-allow-origin: *
expires: Thu, 13 Feb 2020 21:42:55 GMT

GET
H2 204 0
bat.bing.com/action/ 0
93 B 28ms
28ms Image
text/plain 2620:1ec:c11::200
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://bat.bing.com/action/0?ti=16000203&Ver=2&mid=351e3352-73ad-6e35-0720-2452a48d52b4&pi=0&lg=en-US&sw=1600&sh=1200&sc=24&tl=Buying%20or%20Refinancing%20a%20home%3F%20%7C%20Citi.com&kw=Mortgage%20calculator,%20buy%20a%20home,%20real%20estate,%20home%20loan,%20closing%20costs,%20new%20homes&p=https%3A%2F%2Fmortgage.citi.com%2Fcmi%2FPaidSearch%2FConforming%2FChip%2FLF2%2Fdefault.htm%3FISN%3D14814-9%26BTST%3D9032003%26btlp%3Ddual%26cmp%3DKNC~05~180105~BNKMORTG~Google%26gclid%3DEAIaIQobChMI5-Hlrr_P5wIVDtvACh1yNwFcEAMYAyAAEgLnmvD_BwE%26ProspectID%3D99395EC4AA874445AAE0B43E4AAA421E&r=&lt=5223&evt=pageLoad&msclkid=N&rn=448070
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://mortgage.citi.com/cmi/PaidSearch/Conforming/Chip/LF2/default.htm?ISN=14814-9&BTST=9032003&btlp=dual&cmp=KNC~05~180105~BNKMORTG~Google&gclid=EAIaIQobChMI5-Hlrr_P5wIVDtvACh1yNwFcEAMYAyAAEgLnmvD_BwE&ProspectID=99395EC4AA874445AAE0B43E4AAA421E
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

status: 204
pragma: no-cache
date: Thu, 13 Feb 2020 21:42:54 GMT
cache-control: no-cache, must-revalidate
x-msedge-ref: Ref A: C03E3E299B414493A7DC2899847774AB Ref B: FRAEDGE0314 Ref C: 2020-02-13T21:42:55Z
access-control-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 204 0
bat.bing.com/action/ 0
93 B 28ms
27ms Image
text/plain 2620:1ec:c11::200
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://bat.bing.com/action/0?ti=16005485&Ver=2&mid=4f1c108b-c3c6-bf30-eb27-c64a978bfdb2&pi=0&lg=en-US&sw=1600&sh=1200&sc=24&tl=Buying%20or%20Refinancing%20a%20home%3F%20%7C%20Citi.com&kw=Mortgage%20calculator,%20buy%20a%20home,%20real%20estate,%20home%20loan,%20closing%20costs,%20new%20homes&p=https%3A%2F%2Fmortgage.citi.com%2Fcmi%2FPaidSearch%2FConforming%2FChip%2FLF2%2Fdefault.htm%3FISN%3D14814-9%26BTST%3D9032003%26btlp%3Ddual%26cmp%3DKNC~05~180105~BNKMORTG~Google%26gclid%3DEAIaIQobChMI5-Hlrr_P5wIVDtvACh1yNwFcEAMYAyAAEgLnmvD_BwE%26ProspectID%3D99395EC4AA874445AAE0B43E4AAA421E&r=&lt=5223&evt=pageLoad&msclkid=N&rn=152374
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://mortgage.citi.com/cmi/PaidSearch/Conforming/Chip/LF2/default.htm?ISN=14814-9&BTST=9032003&btlp=dual&cmp=KNC~05~180105~BNKMORTG~Google&gclid=EAIaIQobChMI5-Hlrr_P5wIVDtvACh1yNwFcEAMYAyAAEgLnmvD_BwE&ProspectID=99395EC4AA874445AAE0B43E4AAA421E
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

status: 204
pragma: no-cache
date: Thu, 13 Feb 2020 21:42:54 GMT
cache-control: no-cache, must-revalidate
x-msedge-ref: Ref A: B93FE41C544249DABF024A375B1B268E Ref B: FRAEDGE0314 Ref C: 2020-02-13T21:42:55Z
access-control-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 generic1581351803939.js Show response
resources.digital-cloud-citi.medallia.com/wdcusciti/50/onsite/ 290 KB
56 KB 23ms
23ms Script
application/javascript 151.101.114.133
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://resources.digital-cloud-citi.medallia.com/wdcusciti/50/onsite/generic1581351803939.js
Requested by: Host: resources.digital-cloud-citi.medallia.com
URL: https://resources.digital-cloud-citi.medallia.com/wdcusciti/50/onsite/embed.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.114.133 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 7cd52b3b9ca0f87650c9ea054674ee0eee2a9389967545a7a9cb381983b8bb27

Request headers

Referer: https://mortgage.citi.com/cmi/PaidSearch/Conforming/Chip/LF2/default.htm?ISN=14814-9&BTST=9032003&btlp=dual&cmp=KNC~05~180105~BNKMORTG~Google&gclid=EAIaIQobChMI5-Hlrr_P5wIVDtvACh1yNwFcEAMYAyAAEgLnmvD_BwE&ProspectID=99395EC4AA874445AAE0B43E4AAA421E
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

x-amz-version-id: o7dIdA0KkYgJD9ah70y9zkEKmD0GYAUy
content-encoding: gzip
age: 36
x-cache: HIT
status: 200
date: Thu, 13 Feb 2020 21:42:55 GMT
content-length: 56879
x-amz-id-2: 1IMwl7H/jx15voLa6p4PODKZO0ARkj0sPsFcT7w9VeIMq4XE+qMKzBb0j4M7b56N6TQHuRtr0MU=
x-served-by: cache-hhn4067-HHN
access-control-allow-origin: *
last-modified: Mon, 10 Feb 2020 16:23:25 GMT
server: AmazonS3
x-timer: S1581630175.036380,VS0,VE4
etag: "f7c9edfb12ba635ca085d86d7d290dd8"
vary: Accept-Encoding
x-amz-request-id: 47563904CC6BBDAF
via: 1.1 varnish
cache-control: max-age=0,must-revalidate
accept-ranges: bytes
content-type: application/javascript
x-cache-hits: 1

GET
H2 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/959299794/ 3 KB
1 KB 20ms
20ms Script
text/javascript 2a00:1450:4001:825::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/959299794/?random=1581630175038&cv=9&fst=1581630175038&num=1&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa250&sendb=1&ig=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fmortgage.citi.com%2Fcmi%2FPaidSearch%2FConforming%2FChip%2FLF2%2Fdefault.htm%3FISN%3D14814-9%26BTST%3D9032003%26btlp%3Ddual%26cmp%3DKNC~05~180105~BNKMORTG~Google%26gclid%3DEAIaIQobChMI5-Hlrr_P5wIVDtvACh1yNwFcEAMYAyAAEgLnmvD_BwE%26ProspectID%3D99395EC4AA874445AAE0B43E4AAA421E&tiba=Buying%20or%20Refinancing%20a%20home%3F%20%7C%20Citi.com&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4

Requested by

Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/conversion_async.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:825::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

dd95685cf3a654403daf4d323c3b3c5a51bd92ec1aa453323c857e1f91dc96d0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://mortgage.citi.com/cmi/PaidSearch/Conforming/Chip/LF2/default.htm?ISN=14814-9&BTST=9032003&btlp=dual&cmp=KNC~05~180105~BNKMORTG~Google&gclid=EAIaIQobChMI5-Hlrr_P5wIVDtvACh1yNwFcEAMYAyAAEgLnmvD_BwE&ProspectID=99395EC4AA874445AAE0B43E4AAA421E
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

pragma: no-cache
date: Thu, 13 Feb 2020 21:42:55 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-type: text/javascript; charset=UTF-8
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status: 200
cache-control: no-cache, must-revalidate
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 1233
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/960621875/ 3 KB
1 KB 22ms
21ms Script
text/javascript 2a00:1450:4001:825::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/960621875/?random=1581630175040&cv=9&fst=1581630175040&num=1&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa250&sendb=1&ig=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fmortgage.citi.com%2Fcmi%2FPaidSearch%2FConforming%2FChip%2FLF2%2Fdefault.htm%3FISN%3D14814-9%26BTST%3D9032003%26btlp%3Ddual%26cmp%3DKNC~05~180105~BNKMORTG~Google%26gclid%3DEAIaIQobChMI5-Hlrr_P5wIVDtvACh1yNwFcEAMYAyAAEgLnmvD_BwE%26ProspectID%3D99395EC4AA874445AAE0B43E4AAA421E&tiba=Buying%20or%20Refinancing%20a%20home%3F%20%7C%20Citi.com&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4

Requested by

Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/conversion_async.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:825::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3a90275800d8689729eb72ea269d65381a5a4d6fa62e904b99c7057973dca964

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://mortgage.citi.com/cmi/PaidSearch/Conforming/Chip/LF2/default.htm?ISN=14814-9&BTST=9032003&btlp=dual&cmp=KNC~05~180105~BNKMORTG~Google&gclid=EAIaIQobChMI5-Hlrr_P5wIVDtvACh1yNwFcEAMYAyAAEgLnmvD_BwE&ProspectID=99395EC4AA874445AAE0B43E4AAA421E
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

pragma: no-cache
date: Thu, 13 Feb 2020 21:42:55 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-type: text/javascript; charset=UTF-8
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status: 200
cache-control: no-cache, must-revalidate
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 1235
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/916451471/ 3 KB
1 KB 20ms
20ms Script
text/javascript 2a00:1450:4001:825::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/916451471/?random=1581630175041&cv=9&fst=1581630175041&num=1&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa250&sendb=1&ig=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fmortgage.citi.com%2Fcmi%2FPaidSearch%2FConforming%2FChip%2FLF2%2Fdefault.htm%3FISN%3D14814-9%26BTST%3D9032003%26btlp%3Ddual%26cmp%3DKNC~05~180105~BNKMORTG~Google%26gclid%3DEAIaIQobChMI5-Hlrr_P5wIVDtvACh1yNwFcEAMYAyAAEgLnmvD_BwE%26ProspectID%3D99395EC4AA874445AAE0B43E4AAA421E&tiba=Buying%20or%20Refinancing%20a%20home%3F%20%7C%20Citi.com&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4

Requested by

Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/conversion_async.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:825::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

321491c146111e9660e459b49b71d6c4c5211c598d57bc9b9ad3c7eb5238d77e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://mortgage.citi.com/cmi/PaidSearch/Conforming/Chip/LF2/default.htm?ISN=14814-9&BTST=9032003&btlp=dual&cmp=KNC~05~180105~BNKMORTG~Google&gclid=EAIaIQobChMI5-Hlrr_P5wIVDtvACh1yNwFcEAMYAyAAEgLnmvD_BwE&ProspectID=99395EC4AA874445AAE0B43E4AAA421E
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

pragma: no-cache
date: Thu, 13 Feb 2020 21:42:55 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-type: text/javascript; charset=UTF-8
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status: 200
cache-control: no-cache, must-revalidate
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 1233
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/763960929/ 3 KB
1 KB 21ms
20ms Script
text/javascript 2a00:1450:4001:825::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/763960929/?random=1581630175042&cv=9&fst=1581630175042&num=1&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa250&sendb=1&ig=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fmortgage.citi.com%2Fcmi%2FPaidSearch%2FConforming%2FChip%2FLF2%2Fdefault.htm%3FISN%3D14814-9%26BTST%3D9032003%26btlp%3Ddual%26cmp%3DKNC~05~180105~BNKMORTG~Google%26gclid%3DEAIaIQobChMI5-Hlrr_P5wIVDtvACh1yNwFcEAMYAyAAEgLnmvD_BwE%26ProspectID%3D99395EC4AA874445AAE0B43E4AAA421E&tiba=Buying%20or%20Refinancing%20a%20home%3F%20%7C%20Citi.com&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4

Requested by

Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/conversion_async.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:825::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

5328fdb0a22e3de33487f565ea45bf243d2815dbdeadcbeb48f623aafaf19325

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://mortgage.citi.com/cmi/PaidSearch/Conforming/Chip/LF2/default.htm?ISN=14814-9&BTST=9032003&btlp=dual&cmp=KNC~05~180105~BNKMORTG~Google&gclid=EAIaIQobChMI5-Hlrr_P5wIVDtvACh1yNwFcEAMYAyAAEgLnmvD_BwE&ProspectID=99395EC4AA874445AAE0B43E4AAA421E
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

pragma: no-cache
date: Thu, 13 Feb 2020 21:42:55 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-type: text/javascript; charset=UTF-8
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status: 200
cache-control: no-cache, must-revalidate
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 1234
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/975701947/ 3 KB
1 KB 22ms
22ms Script
text/javascript 2a00:1450:4001:825::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/975701947/?random=1581630175043&cv=9&fst=1581630175043&num=1&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa250&sendb=1&ig=1&data=event%3Dconversion&frm=0&url=https%3A%2F%2Fmortgage.citi.com%2Fcmi%2FPaidSearch%2FConforming%2FChip%2FLF2%2Fdefault.htm%3FISN%3D14814-9%26BTST%3D9032003%26btlp%3Ddual%26cmp%3DKNC~05~180105~BNKMORTG~Google%26gclid%3DEAIaIQobChMI5-Hlrr_P5wIVDtvACh1yNwFcEAMYAyAAEgLnmvD_BwE%26ProspectID%3D99395EC4AA874445AAE0B43E4AAA421E&tiba=Buying%20or%20Refinancing%20a%20home%3F%20%7C%20Citi.com&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4

Requested by

Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/conversion_async.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:825::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

57dd7d830085c93c7ccd6042ed0b4bfb397929766c69c446b9fe3bef78864e49

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://mortgage.citi.com/cmi/PaidSearch/Conforming/Chip/LF2/default.htm?ISN=14814-9&BTST=9032003&btlp=dual&cmp=KNC~05~180105~BNKMORTG~Google&gclid=EAIaIQobChMI5-Hlrr_P5wIVDtvACh1yNwFcEAMYAyAAEgLnmvD_BwE&ProspectID=99395EC4AA874445AAE0B43E4AAA421E
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

pragma: no-cache
date: Thu, 13 Feb 2020 21:42:55 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-type: text/javascript; charset=UTF-8
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status: 200
cache-control: no-cache, must-revalidate
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 1232
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

/
www.google.de/pagead/1p-user-list/975701947/
Redirect Chain

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/975701947/?random=1581630175041&cv=9&fst=1581630175041&num=1&fmt=3&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=12...
https://www.google.com/pagead/1p-user-list/975701947/?random=1581630175041&cv=9&fst=1581627600000&num=1&fmt=3&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=...
https://www.google.de/pagead/1p-user-list/975701947/?random=1581630175041&cv=9&fst=1581627600000&num=1&fmt=3&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=f...

42 B
110 B

28ms
28ms

Image
image/gif

2a00:1450:4001:820::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/975701947/?random=1581630175041&cv=9&fst=1581627600000&num=1&fmt=3&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa250&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fmortgage.citi.com%2Fcmi%2FPaidSearch%2FConforming%2FChip%2FLF2%2Fdefault.htm%3FISN%3D14814-9%26BTST%3D9032003%26btlp%3Ddual%26cmp%3DKNC~05~180105~BNKMORTG~Google%26gclid%3DEAIaIQobChMI5-Hlrr_P5wIVDtvACh1yNwFcEAMYAyAAEgLnmvD_BwE%26ProspectID%3D99395EC4AA874445AAE0B43E4AAA421E&tiba=Buying%20or%20Refinancing%20a%20home%3F%20%7C%20Citi.com&async=1&is_vtc=1&random=1009118526&resp=GooglemKTybQhCsO&ipr=y

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:820::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://mortgage.citi.com/cmi/PaidSearch/Conforming/Chip/LF2/default.htm?ISN=14814-9&BTST=9032003&btlp=dual&cmp=KNC~05~180105~BNKMORTG~Google&gclid=EAIaIQobChMI5-Hlrr_P5wIVDtvACh1yNwFcEAMYAyAAEgLnmvD_BwE&ProspectID=99395EC4AA874445AAE0B43E4AAA421E
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 13 Feb 2020 21:42:55 GMT
x-content-type-options: nosniff
content-type: image/gif
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, no-store, must-revalidate
content-security-policy: script-src 'none'; object-src 'none'
timing-allow-origin: *
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Thu, 13 Feb 2020 21:42:55 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
location: https://www.google.de/pagead/1p-user-list/975701947/?random=1581630175041&cv=9&fst=1581627600000&num=1&fmt=3&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa250&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fmortgage.citi.com%2Fcmi%2FPaidSearch%2FConforming%2FChip%2FLF2%2Fdefault.htm%3FISN%3D14814-9%26BTST%3D9032003%26btlp%3Ddual%26cmp%3DKNC~05~180105~BNKMORTG~Google%26gclid%3DEAIaIQobChMI5-Hlrr_P5wIVDtvACh1yNwFcEAMYAyAAEgLnmvD_BwE%26ProspectID%3D99395EC4AA874445AAE0B43E4AAA421E&tiba=Buying%20or%20Refinancing%20a%20home%3F%20%7C%20Citi.com&async=1&is_vtc=1&random=1009118526&resp=GooglemKTybQhCsO&ipr=y
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 302
cache-control: no-cache, no-store, must-revalidate
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

/
www.google.de/pagead/1p-user-list/770961656/
Redirect Chain

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/770961656/?random=1581630175041&cv=9&fst=1581630175041&num=1&fmt=3&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=12...
https://www.google.com/pagead/1p-user-list/770961656/?random=1581630175041&cv=9&fst=1581627600000&num=1&fmt=3&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=...
https://www.google.de/pagead/1p-user-list/770961656/?random=1581630175041&cv=9&fst=1581627600000&num=1&fmt=3&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=f...

42 B
110 B

27ms
27ms

Image
image/gif

2a00:1450:4001:820::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/770961656/?random=1581630175041&cv=9&fst=1581627600000&num=1&fmt=3&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa250&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fmortgage.citi.com%2Fcmi%2FPaidSearch%2FConforming%2FChip%2FLF2%2Fdefault.htm%3FISN%3D14814-9%26BTST%3D9032003%26btlp%3Ddual%26cmp%3DKNC~05~180105~BNKMORTG~Google%26gclid%3DEAIaIQobChMI5-Hlrr_P5wIVDtvACh1yNwFcEAMYAyAAEgLnmvD_BwE%26ProspectID%3D99395EC4AA874445AAE0B43E4AAA421E&tiba=Buying%20or%20Refinancing%20a%20home%3F%20%7C%20Citi.com&async=1&is_vtc=1&random=3179792022&resp=GooglemKTybQhCsO&ipr=y

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:820::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://mortgage.citi.com/cmi/PaidSearch/Conforming/Chip/LF2/default.htm?ISN=14814-9&BTST=9032003&btlp=dual&cmp=KNC~05~180105~BNKMORTG~Google&gclid=EAIaIQobChMI5-Hlrr_P5wIVDtvACh1yNwFcEAMYAyAAEgLnmvD_BwE&ProspectID=99395EC4AA874445AAE0B43E4AAA421E
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 13 Feb 2020 21:42:55 GMT
x-content-type-options: nosniff
content-type: image/gif
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, no-store, must-revalidate
content-security-policy: script-src 'none'; object-src 'none'
timing-allow-origin: *
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Thu, 13 Feb 2020 21:42:55 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
location: https://www.google.de/pagead/1p-user-list/770961656/?random=1581630175041&cv=9&fst=1581627600000&num=1&fmt=3&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa250&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fmortgage.citi.com%2Fcmi%2FPaidSearch%2FConforming%2FChip%2FLF2%2Fdefault.htm%3FISN%3D14814-9%26BTST%3D9032003%26btlp%3Ddual%26cmp%3DKNC~05~180105~BNKMORTG~Google%26gclid%3DEAIaIQobChMI5-Hlrr_P5wIVDtvACh1yNwFcEAMYAyAAEgLnmvD_BwE%26ProspectID%3D99395EC4AA874445AAE0B43E4AAA421E&tiba=Buying%20or%20Refinancing%20a%20home%3F%20%7C%20Citi.com&async=1&is_vtc=1&random=3179792022&resp=GooglemKTybQhCsO&ipr=y
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 302
cache-control: no-cache, no-store, must-revalidate
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

/
www.google.de/pagead/1p-user-list/819500023/
Redirect Chain

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/819500023/?random=1581630175041&cv=9&fst=1581630175041&num=1&fmt=3&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=12...
https://www.google.com/pagead/1p-user-list/819500023/?random=1581630175041&cv=9&fst=1581627600000&num=1&fmt=3&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=...
https://www.google.de/pagead/1p-user-list/819500023/?random=1581630175041&cv=9&fst=1581627600000&num=1&fmt=3&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=f...

42 B
110 B

26ms
26ms

Image
image/gif

2a00:1450:4001:820::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/819500023/?random=1581630175041&cv=9&fst=1581627600000&num=1&fmt=3&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa250&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fmortgage.citi.com%2Fcmi%2FPaidSearch%2FConforming%2FChip%2FLF2%2Fdefault.htm%3FISN%3D14814-9%26BTST%3D9032003%26btlp%3Ddual%26cmp%3DKNC~05~180105~BNKMORTG~Google%26gclid%3DEAIaIQobChMI5-Hlrr_P5wIVDtvACh1yNwFcEAMYAyAAEgLnmvD_BwE%26ProspectID%3D99395EC4AA874445AAE0B43E4AAA421E&tiba=Buying%20or%20Refinancing%20a%20home%3F%20%7C%20Citi.com&async=1&is_vtc=1&random=3547488466&resp=GooglemKTybQhCsO&ipr=y

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:820::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://mortgage.citi.com/cmi/PaidSearch/Conforming/Chip/LF2/default.htm?ISN=14814-9&BTST=9032003&btlp=dual&cmp=KNC~05~180105~BNKMORTG~Google&gclid=EAIaIQobChMI5-Hlrr_P5wIVDtvACh1yNwFcEAMYAyAAEgLnmvD_BwE&ProspectID=99395EC4AA874445AAE0B43E4AAA421E
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 13 Feb 2020 21:42:55 GMT
x-content-type-options: nosniff
content-type: image/gif
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, no-store, must-revalidate
content-security-policy: script-src 'none'; object-src 'none'
timing-allow-origin: *
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Thu, 13 Feb 2020 21:42:55 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
location: https://www.google.de/pagead/1p-user-list/819500023/?random=1581630175041&cv=9&fst=1581627600000&num=1&fmt=3&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa250&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fmortgage.citi.com%2Fcmi%2FPaidSearch%2FConforming%2FChip%2FLF2%2Fdefault.htm%3FISN%3D14814-9%26BTST%3D9032003%26btlp%3Ddual%26cmp%3DKNC~05~180105~BNKMORTG~Google%26gclid%3DEAIaIQobChMI5-Hlrr_P5wIVDtvACh1yNwFcEAMYAyAAEgLnmvD_BwE%26ProspectID%3D99395EC4AA874445AAE0B43E4AAA421E&tiba=Buying%20or%20Refinancing%20a%20home%3F%20%7C%20Citi.com&async=1&is_vtc=1&random=3547488466&resp=GooglemKTybQhCsO&ipr=y
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 302
cache-control: no-cache, no-store, must-revalidate
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

/
www.google.de/pagead/1p-user-list/959299794/
Redirect Chain

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/959299794/?random=1581630175042&cv=9&fst=1581630175042&num=1&fmt=3&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=12...
https://www.google.com/pagead/1p-user-list/959299794/?random=1581630175042&cv=9&fst=1581627600000&num=1&fmt=3&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=...
https://www.google.de/pagead/1p-user-list/959299794/?random=1581630175042&cv=9&fst=1581627600000&num=1&fmt=3&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=f...

42 B
110 B

24ms
23ms

Image
image/gif

2a00:1450:4001:820::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/959299794/?random=1581630175042&cv=9&fst=1581627600000&num=1&fmt=3&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa250&sendb=1&data=event%3Dconversion&frm=0&url=https%3A%2F%2Fmortgage.citi.com%2Fcmi%2FPaidSearch%2FConforming%2FChip%2FLF2%2Fdefault.htm%3FISN%3D14814-9%26BTST%3D9032003%26btlp%3Ddual%26cmp%3DKNC~05~180105~BNKMORTG~Google%26gclid%3DEAIaIQobChMI5-Hlrr_P5wIVDtvACh1yNwFcEAMYAyAAEgLnmvD_BwE%26ProspectID%3D99395EC4AA874445AAE0B43E4AAA421E&tiba=Buying%20or%20Refinancing%20a%20home%3F%20%7C%20Citi.com&async=1&is_vtc=1&random=3285781129&resp=GooglemKTybQhCsO&ipr=y

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:820::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://mortgage.citi.com/cmi/PaidSearch/Conforming/Chip/LF2/default.htm?ISN=14814-9&BTST=9032003&btlp=dual&cmp=KNC~05~180105~BNKMORTG~Google&gclid=EAIaIQobChMI5-Hlrr_P5wIVDtvACh1yNwFcEAMYAyAAEgLnmvD_BwE&ProspectID=99395EC4AA874445AAE0B43E4AAA421E
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 13 Feb 2020 21:42:55 GMT
x-content-type-options: nosniff
content-type: image/gif
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, no-store, must-revalidate
content-security-policy: script-src 'none'; object-src 'none'
timing-allow-origin: *
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Thu, 13 Feb 2020 21:42:55 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
location: https://www.google.de/pagead/1p-user-list/959299794/?random=1581630175042&cv=9&fst=1581627600000&num=1&fmt=3&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa250&sendb=1&data=event%3Dconversion&frm=0&url=https%3A%2F%2Fmortgage.citi.com%2Fcmi%2FPaidSearch%2FConforming%2FChip%2FLF2%2Fdefault.htm%3FISN%3D14814-9%26BTST%3D9032003%26btlp%3Ddual%26cmp%3DKNC~05~180105~BNKMORTG~Google%26gclid%3DEAIaIQobChMI5-Hlrr_P5wIVDtvACh1yNwFcEAMYAyAAEgLnmvD_BwE%26ProspectID%3D99395EC4AA874445AAE0B43E4AAA421E&tiba=Buying%20or%20Refinancing%20a%20home%3F%20%7C%20Citi.com&async=1&is_vtc=1&random=3285781129&resp=GooglemKTybQhCsO&ipr=y
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 302
cache-control: no-cache, no-store, must-revalidate
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

/
www.google.de/pagead/1p-user-list/960621875/
Redirect Chain

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/960621875/?random=1581630175042&cv=9&fst=1581630175042&num=1&fmt=3&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=12...
https://www.google.com/pagead/1p-user-list/960621875/?random=1581630175042&cv=9&fst=1581627600000&num=1&fmt=3&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=...
https://www.google.de/pagead/1p-user-list/960621875/?random=1581630175042&cv=9&fst=1581627600000&num=1&fmt=3&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=f...

42 B
110 B

28ms
27ms

Image
image/gif

2a00:1450:4001:820::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/960621875/?random=1581630175042&cv=9&fst=1581627600000&num=1&fmt=3&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa250&sendb=1&data=event%3Dconversion&frm=0&url=https%3A%2F%2Fmortgage.citi.com%2Fcmi%2FPaidSearch%2FConforming%2FChip%2FLF2%2Fdefault.htm%3FISN%3D14814-9%26BTST%3D9032003%26btlp%3Ddual%26cmp%3DKNC~05~180105~BNKMORTG~Google%26gclid%3DEAIaIQobChMI5-Hlrr_P5wIVDtvACh1yNwFcEAMYAyAAEgLnmvD_BwE%26ProspectID%3D99395EC4AA874445AAE0B43E4AAA421E&tiba=Buying%20or%20Refinancing%20a%20home%3F%20%7C%20Citi.com&async=1&is_vtc=1&random=3270834045&resp=GooglemKTybQhCsO&ipr=y

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:820::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://mortgage.citi.com/cmi/PaidSearch/Conforming/Chip/LF2/default.htm?ISN=14814-9&BTST=9032003&btlp=dual&cmp=KNC~05~180105~BNKMORTG~Google&gclid=EAIaIQobChMI5-Hlrr_P5wIVDtvACh1yNwFcEAMYAyAAEgLnmvD_BwE&ProspectID=99395EC4AA874445AAE0B43E4AAA421E
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 13 Feb 2020 21:42:55 GMT
x-content-type-options: nosniff
content-type: image/gif
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, no-store, must-revalidate
content-security-policy: script-src 'none'; object-src 'none'
timing-allow-origin: *
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Thu, 13 Feb 2020 21:42:55 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
location: https://www.google.de/pagead/1p-user-list/960621875/?random=1581630175042&cv=9&fst=1581627600000&num=1&fmt=3&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa250&sendb=1&data=event%3Dconversion&frm=0&url=https%3A%2F%2Fmortgage.citi.com%2Fcmi%2FPaidSearch%2FConforming%2FChip%2FLF2%2Fdefault.htm%3FISN%3D14814-9%26BTST%3D9032003%26btlp%3Ddual%26cmp%3DKNC~05~180105~BNKMORTG~Google%26gclid%3DEAIaIQobChMI5-Hlrr_P5wIVDtvACh1yNwFcEAMYAyAAEgLnmvD_BwE%26ProspectID%3D99395EC4AA874445AAE0B43E4AAA421E&tiba=Buying%20or%20Refinancing%20a%20home%3F%20%7C%20Citi.com&async=1&is_vtc=1&random=3270834045&resp=GooglemKTybQhCsO&ipr=y
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 302
cache-control: no-cache, no-store, must-revalidate
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

/
www.google.de/pagead/1p-user-list/916451471/
Redirect Chain

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/916451471/?random=1581630175042&cv=9&fst=1581630175042&num=1&fmt=3&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=12...
https://www.google.com/pagead/1p-user-list/916451471/?random=1581630175042&cv=9&fst=1581627600000&num=1&fmt=3&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=...
https://www.google.de/pagead/1p-user-list/916451471/?random=1581630175042&cv=9&fst=1581627600000&num=1&fmt=3&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=f...

42 B
110 B

26ms
26ms

Image
image/gif

2a00:1450:4001:820::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/916451471/?random=1581630175042&cv=9&fst=1581627600000&num=1&fmt=3&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa250&sendb=1&data=event%3Dconversion&frm=0&url=https%3A%2F%2Fmortgage.citi.com%2Fcmi%2FPaidSearch%2FConforming%2FChip%2FLF2%2Fdefault.htm%3FISN%3D14814-9%26BTST%3D9032003%26btlp%3Ddual%26cmp%3DKNC~05~180105~BNKMORTG~Google%26gclid%3DEAIaIQobChMI5-Hlrr_P5wIVDtvACh1yNwFcEAMYAyAAEgLnmvD_BwE%26ProspectID%3D99395EC4AA874445AAE0B43E4AAA421E&tiba=Buying%20or%20Refinancing%20a%20home%3F%20%7C%20Citi.com&async=1&is_vtc=1&random=679352739&resp=GooglemKTybQhCsO&ipr=y

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:820::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://mortgage.citi.com/cmi/PaidSearch/Conforming/Chip/LF2/default.htm?ISN=14814-9&BTST=9032003&btlp=dual&cmp=KNC~05~180105~BNKMORTG~Google&gclid=EAIaIQobChMI5-Hlrr_P5wIVDtvACh1yNwFcEAMYAyAAEgLnmvD_BwE&ProspectID=99395EC4AA874445AAE0B43E4AAA421E
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 13 Feb 2020 21:42:55 GMT
x-content-type-options: nosniff
content-type: image/gif
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, no-store, must-revalidate
content-security-policy: script-src 'none'; object-src 'none'
timing-allow-origin: *
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Thu, 13 Feb 2020 21:42:55 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
location: https://www.google.de/pagead/1p-user-list/916451471/?random=1581630175042&cv=9&fst=1581627600000&num=1&fmt=3&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa250&sendb=1&data=event%3Dconversion&frm=0&url=https%3A%2F%2Fmortgage.citi.com%2Fcmi%2FPaidSearch%2FConforming%2FChip%2FLF2%2Fdefault.htm%3FISN%3D14814-9%26BTST%3D9032003%26btlp%3Ddual%26cmp%3DKNC~05~180105~BNKMORTG~Google%26gclid%3DEAIaIQobChMI5-Hlrr_P5wIVDtvACh1yNwFcEAMYAyAAEgLnmvD_BwE%26ProspectID%3D99395EC4AA874445AAE0B43E4AAA421E&tiba=Buying%20or%20Refinancing%20a%20home%3F%20%7C%20Citi.com&async=1&is_vtc=1&random=679352739&resp=GooglemKTybQhCsO&ipr=y
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 302
cache-control: no-cache, no-store, must-revalidate
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

/
www.google.de/pagead/1p-user-list/770961656/
Redirect Chain

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/770961656/?random=1581630175043&cv=9&fst=1581630175043&num=1&fmt=3&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=12...
https://www.google.com/pagead/1p-user-list/770961656/?random=1581630175043&cv=9&fst=1581627600000&num=1&fmt=3&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=...
https://www.google.de/pagead/1p-user-list/770961656/?random=1581630175043&cv=9&fst=1581627600000&num=1&fmt=3&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=f...

42 B
110 B

27ms
26ms

Image
image/gif

2a00:1450:4001:820::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/770961656/?random=1581630175043&cv=9&fst=1581627600000&num=1&fmt=3&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa250&sendb=1&data=event%3Dconversion&frm=0&url=https%3A%2F%2Fmortgage.citi.com%2Fcmi%2FPaidSearch%2FConforming%2FChip%2FLF2%2Fdefault.htm%3FISN%3D14814-9%26BTST%3D9032003%26btlp%3Ddual%26cmp%3DKNC~05~180105~BNKMORTG~Google%26gclid%3DEAIaIQobChMI5-Hlrr_P5wIVDtvACh1yNwFcEAMYAyAAEgLnmvD_BwE%26ProspectID%3D99395EC4AA874445AAE0B43E4AAA421E&tiba=Buying%20or%20Refinancing%20a%20home%3F%20%7C%20Citi.com&async=1&is_vtc=1&random=3747933915&resp=GooglemKTybQhCsO&ipr=y

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:820::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://mortgage.citi.com/cmi/PaidSearch/Conforming/Chip/LF2/default.htm?ISN=14814-9&BTST=9032003&btlp=dual&cmp=KNC~05~180105~BNKMORTG~Google&gclid=EAIaIQobChMI5-Hlrr_P5wIVDtvACh1yNwFcEAMYAyAAEgLnmvD_BwE&ProspectID=99395EC4AA874445AAE0B43E4AAA421E
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 13 Feb 2020 21:42:55 GMT
x-content-type-options: nosniff
content-type: image/gif
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, no-store, must-revalidate
content-security-policy: script-src 'none'; object-src 'none'
timing-allow-origin: *
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Thu, 13 Feb 2020 21:42:55 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
location: https://www.google.de/pagead/1p-user-list/770961656/?random=1581630175043&cv=9&fst=1581627600000&num=1&fmt=3&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa250&sendb=1&data=event%3Dconversion&frm=0&url=https%3A%2F%2Fmortgage.citi.com%2Fcmi%2FPaidSearch%2FConforming%2FChip%2FLF2%2Fdefault.htm%3FISN%3D14814-9%26BTST%3D9032003%26btlp%3Ddual%26cmp%3DKNC~05~180105~BNKMORTG~Google%26gclid%3DEAIaIQobChMI5-Hlrr_P5wIVDtvACh1yNwFcEAMYAyAAEgLnmvD_BwE%26ProspectID%3D99395EC4AA874445AAE0B43E4AAA421E&tiba=Buying%20or%20Refinancing%20a%20home%3F%20%7C%20Citi.com&async=1&is_vtc=1&random=3747933915&resp=GooglemKTybQhCsO&ipr=y
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 302
cache-control: no-cache, no-store, must-revalidate
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

/
www.google.de/pagead/1p-user-list/819500023/
Redirect Chain

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/819500023/?random=1581630175043&cv=9&fst=1581630175043&num=1&fmt=3&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=12...
https://www.google.com/pagead/1p-user-list/819500023/?random=1581630175043&cv=9&fst=1581627600000&num=1&fmt=3&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=...
https://www.google.de/pagead/1p-user-list/819500023/?random=1581630175043&cv=9&fst=1581627600000&num=1&fmt=3&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=f...

42 B
110 B

30ms
30ms

Image
image/gif

2a00:1450:4001:820::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/819500023/?random=1581630175043&cv=9&fst=1581627600000&num=1&fmt=3&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa250&sendb=1&data=event%3Dconversion&frm=0&url=https%3A%2F%2Fmortgage.citi.com%2Fcmi%2FPaidSearch%2FConforming%2FChip%2FLF2%2Fdefault.htm%3FISN%3D14814-9%26BTST%3D9032003%26btlp%3Ddual%26cmp%3DKNC~05~180105~BNKMORTG~Google%26gclid%3DEAIaIQobChMI5-Hlrr_P5wIVDtvACh1yNwFcEAMYAyAAEgLnmvD_BwE%26ProspectID%3D99395EC4AA874445AAE0B43E4AAA421E&tiba=Buying%20or%20Refinancing%20a%20home%3F%20%7C%20Citi.com&async=1&is_vtc=1&random=2410920752&resp=GooglemKTybQhCsO&ipr=y

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:820::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://mortgage.citi.com/cmi/PaidSearch/Conforming/Chip/LF2/default.htm?ISN=14814-9&BTST=9032003&btlp=dual&cmp=KNC~05~180105~BNKMORTG~Google&gclid=EAIaIQobChMI5-Hlrr_P5wIVDtvACh1yNwFcEAMYAyAAEgLnmvD_BwE&ProspectID=99395EC4AA874445AAE0B43E4AAA421E
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 13 Feb 2020 21:42:55 GMT
x-content-type-options: nosniff
content-type: image/gif
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, no-store, must-revalidate
content-security-policy: script-src 'none'; object-src 'none'
timing-allow-origin: *
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Thu, 13 Feb 2020 21:42:55 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
location: https://www.google.de/pagead/1p-user-list/819500023/?random=1581630175043&cv=9&fst=1581627600000&num=1&fmt=3&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa250&sendb=1&data=event%3Dconversion&frm=0&url=https%3A%2F%2Fmortgage.citi.com%2Fcmi%2FPaidSearch%2FConforming%2FChip%2FLF2%2Fdefault.htm%3FISN%3D14814-9%26BTST%3D9032003%26btlp%3Ddual%26cmp%3DKNC~05~180105~BNKMORTG~Google%26gclid%3DEAIaIQobChMI5-Hlrr_P5wIVDtvACh1yNwFcEAMYAyAAEgLnmvD_BwE%26ProspectID%3D99395EC4AA874445AAE0B43E4AAA421E&tiba=Buying%20or%20Refinancing%20a%20home%3F%20%7C%20Citi.com&async=1&is_vtc=1&random=2410920752&resp=GooglemKTybQhCsO&ipr=y
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 302
cache-control: no-cache, no-store, must-revalidate
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

/
www.google.de/pagead/1p-user-list/763960929/
Redirect Chain

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/763960929/?random=1581630175043&cv=9&fst=1581630175043&num=1&fmt=3&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=12...
https://www.google.com/pagead/1p-user-list/763960929/?random=1581630175043&cv=9&fst=1581627600000&num=1&fmt=3&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=...
https://www.google.de/pagead/1p-user-list/763960929/?random=1581630175043&cv=9&fst=1581627600000&num=1&fmt=3&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=f...

42 B
110 B

28ms
28ms

Image
image/gif

2a00:1450:4001:820::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/763960929/?random=1581630175043&cv=9&fst=1581627600000&num=1&fmt=3&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa250&sendb=1&data=event%3Dconversion&frm=0&url=https%3A%2F%2Fmortgage.citi.com%2Fcmi%2FPaidSearch%2FConforming%2FChip%2FLF2%2Fdefault.htm%3FISN%3D14814-9%26BTST%3D9032003%26btlp%3Ddual%26cmp%3DKNC~05~180105~BNKMORTG~Google%26gclid%3DEAIaIQobChMI5-Hlrr_P5wIVDtvACh1yNwFcEAMYAyAAEgLnmvD_BwE%26ProspectID%3D99395EC4AA874445AAE0B43E4AAA421E&tiba=Buying%20or%20Refinancing%20a%20home%3F%20%7C%20Citi.com&async=1&is_vtc=1&random=1544091145&resp=GooglemKTybQhCsO&ipr=y

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:820::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://mortgage.citi.com/cmi/PaidSearch/Conforming/Chip/LF2/default.htm?ISN=14814-9&BTST=9032003&btlp=dual&cmp=KNC~05~180105~BNKMORTG~Google&gclid=EAIaIQobChMI5-Hlrr_P5wIVDtvACh1yNwFcEAMYAyAAEgLnmvD_BwE&ProspectID=99395EC4AA874445AAE0B43E4AAA421E
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 13 Feb 2020 21:42:55 GMT
x-content-type-options: nosniff
content-type: image/gif
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, no-store, must-revalidate
content-security-policy: script-src 'none'; object-src 'none'
timing-allow-origin: *
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Thu, 13 Feb 2020 21:42:55 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
location: https://www.google.de/pagead/1p-user-list/763960929/?random=1581630175043&cv=9&fst=1581627600000&num=1&fmt=3&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa250&sendb=1&data=event%3Dconversion&frm=0&url=https%3A%2F%2Fmortgage.citi.com%2Fcmi%2FPaidSearch%2FConforming%2FChip%2FLF2%2Fdefault.htm%3FISN%3D14814-9%26BTST%3D9032003%26btlp%3Ddual%26cmp%3DKNC~05~180105~BNKMORTG~Google%26gclid%3DEAIaIQobChMI5-Hlrr_P5wIVDtvACh1yNwFcEAMYAyAAEgLnmvD_BwE%26ProspectID%3D99395EC4AA874445AAE0B43E4AAA421E&tiba=Buying%20or%20Refinancing%20a%20home%3F%20%7C%20Citi.com&async=1&is_vtc=1&random=1544091145&resp=GooglemKTybQhCsO&ipr=y
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 302
cache-control: no-cache, no-store, must-revalidate
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 up
insight.adsrvr.org/track/ Frame 5103 0
0 108ms
37ms Document
text/html 54.246.153.43
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://insight.adsrvr.org/track/up?adv=1jw5cvl&ref=https%3A%2F%2Fmortgage.citi.com%2Fcmi%2FPaidSearch%2FConforming%2FChip%2FLF2%2Fdefault.htm%3FISN%3D14814-9%26BTST%3D9032003%26btlp%3Ddual%26cmp%3DKNC~05~180105~BNKMORTG~Google%26gclid%3DEAIaIQobChMI5-Hlrr_P5wIVDtvACh1yNwFcEAMYAyAAEgLnmvD_BwE%26ProspectID%3D99395EC4AA874445AAE0B43E4AAA421E&upid=t1sl5ty&upv=1.1.0&orderid={orderid}&v={v}&vf={vf}&td1=Sapient_cmi_PaidSearch_Conforming_chip_LF2&td2=undefined&td3=undefined&td4=paid%20search%20mortgage%20dual%20lead%20landing&td5=cmp=KNC~05~180105~BNKMORTG~Google&gclid=EAIaIQobChMI5-Hlrr_P5wIVDtvACh1yNwFcEAMYAyAAEgLnmvD_BwE&ProspectID=99395EC4AA874445AAE0B43E4AAA421E&td6={td6}&td7={td7}&td8={td8}&td9={td9}&td10={td10}
Requested by: Host: js.adsrvr.org
URL: https://js.adsrvr.org/up_loader.1.1.0.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.246.153.43 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-246-153-43.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash

Request headers

:method: GET
:authority: insight.adsrvr.org
:scheme: https
:path: /track/up?adv=1jw5cvl&ref=https%3A%2F%2Fmortgage.citi.com%2Fcmi%2FPaidSearch%2FConforming%2FChip%2FLF2%2Fdefault.htm%3FISN%3D14814-9%26BTST%3D9032003%26btlp%3Ddual%26cmp%3DKNC~05~180105~BNKMORTG~Google%26gclid%3DEAIaIQobChMI5-Hlrr_P5wIVDtvACh1yNwFcEAMYAyAAEgLnmvD_BwE%26ProspectID%3D99395EC4AA874445AAE0B43E4AAA421E&upid=t1sl5ty&upv=1.1.0&orderid={orderid}&v={v}&vf={vf}&td1=Sapient_cmi_PaidSearch_Conforming_chip_LF2&td2=undefined&td3=undefined&td4=paid%20search%20mortgage%20dual%20lead%20landing&td5=cmp=KNC~05~180105~BNKMORTG~Google&gclid=EAIaIQobChMI5-Hlrr_P5wIVDtvACh1yNwFcEAMYAyAAEgLnmvD_BwE&ProspectID=99395EC4AA874445AAE0B43E4AAA421E&td6={td6}&td7={td7}&td8={td8}&td9={td9}&td10={td10}
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-dest: iframe
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
referer: https://mortgage.citi.com/cmi/PaidSearch/Conforming/Chip/LF2/default.htm?ISN=14814-9&BTST=9032003&btlp=dual&cmp=KNC~05~180105~BNKMORTG~Google&gclid=EAIaIQobChMI5-Hlrr_P5wIVDtvACh1yNwFcEAMYAyAAEgLnmvD_BwE&ProspectID=99395EC4AA874445AAE0B43E4AAA421E
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: iframe
Referer: https://mortgage.citi.com/cmi/PaidSearch/Conforming/Chip/LF2/default.htm?ISN=14814-9&BTST=9032003&btlp=dual&cmp=KNC~05~180105~BNKMORTG~Google&gclid=EAIaIQobChMI5-Hlrr_P5wIVDtvACh1yNwFcEAMYAyAAEgLnmvD_BwE&ProspectID=99395EC4AA874445AAE0B43E4AAA421E

Response headers

status: 200
date: Thu, 13 Feb 2020 21:42:55 GMT
content-type: text/html
cache-control: private,no-cache, must-revalidate
pragma: no-cache
x-aspnet-version: 4.0.30319
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"

GET
H2 200 /
www.google.com/pagead/1p-user-list/959299794/ 42 B
110 B 26ms
25ms Image
image/gif 2a00:1450:4001:820::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/959299794/?random=1581630175038&cv=9&fst=1581627600000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa250&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fmortgage.citi.com%2Fcmi%2FPaidSearch%2FConforming%2FChip%2FLF2%2Fdefault.htm%3FISN%3D14814-9%26BTST%3D9032003%26btlp%3Ddual%26cmp%3DKNC~05~180105~BNKMORTG~Google%26gclid%3DEAIaIQobChMI5-Hlrr_P5wIVDtvACh1yNwFcEAMYAyAAEgLnmvD_BwE%26ProspectID%3D99395EC4AA874445AAE0B43E4AAA421E&tiba=Buying%20or%20Refinancing%20a%20home%3F%20%7C%20Citi.com&async=1&fmt=3&is_vtc=1&random=3508317441&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:820::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://mortgage.citi.com/cmi/PaidSearch/Conforming/Chip/LF2/default.htm?ISN=14814-9&BTST=9032003&btlp=dual&cmp=KNC~05~180105~BNKMORTG~Google&gclid=EAIaIQobChMI5-Hlrr_P5wIVDtvACh1yNwFcEAMYAyAAEgLnmvD_BwE&ProspectID=99395EC4AA874445AAE0B43E4AAA421E
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

pragma: no-cache
date: Thu, 13 Feb 2020 21:42:55 GMT
x-content-type-options: nosniff
content-type: image/gif
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, no-store, must-revalidate
content-security-policy: script-src 'none'; object-src 'none'
timing-allow-origin: *
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.de/pagead/1p-user-list/959299794/ 42 B
110 B 26ms
26ms Image
image/gif 2a00:1450:4001:820::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/959299794/?random=1581630175038&cv=9&fst=1581627600000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa250&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fmortgage.citi.com%2Fcmi%2FPaidSearch%2FConforming%2FChip%2FLF2%2Fdefault.htm%3FISN%3D14814-9%26BTST%3D9032003%26btlp%3Ddual%26cmp%3DKNC~05~180105~BNKMORTG~Google%26gclid%3DEAIaIQobChMI5-Hlrr_P5wIVDtvACh1yNwFcEAMYAyAAEgLnmvD_BwE%26ProspectID%3D99395EC4AA874445AAE0B43E4AAA421E&tiba=Buying%20or%20Refinancing%20a%20home%3F%20%7C%20Citi.com&async=1&fmt=3&is_vtc=1&random=3508317441&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:820::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://mortgage.citi.com/cmi/PaidSearch/Conforming/Chip/LF2/default.htm?ISN=14814-9&BTST=9032003&btlp=dual&cmp=KNC~05~180105~BNKMORTG~Google&gclid=EAIaIQobChMI5-Hlrr_P5wIVDtvACh1yNwFcEAMYAyAAEgLnmvD_BwE&ProspectID=99395EC4AA874445AAE0B43E4AAA421E
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

pragma: no-cache
date: Thu, 13 Feb 2020 21:42:55 GMT
x-content-type-options: nosniff
content-type: image/gif
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, no-store, must-revalidate
content-security-policy: script-src 'none'; object-src 'none'
timing-allow-origin: *
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.com/pagead/1p-user-list/916451471/ 42 B
110 B 29ms
29ms Image
image/gif 2a00:1450:4001:820::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/916451471/?random=1581630175041&cv=9&fst=1581627600000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa250&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fmortgage.citi.com%2Fcmi%2FPaidSearch%2FConforming%2FChip%2FLF2%2Fdefault.htm%3FISN%3D14814-9%26BTST%3D9032003%26btlp%3Ddual%26cmp%3DKNC~05~180105~BNKMORTG~Google%26gclid%3DEAIaIQobChMI5-Hlrr_P5wIVDtvACh1yNwFcEAMYAyAAEgLnmvD_BwE%26ProspectID%3D99395EC4AA874445AAE0B43E4AAA421E&tiba=Buying%20or%20Refinancing%20a%20home%3F%20%7C%20Citi.com&async=1&fmt=3&is_vtc=1&random=927110251&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:820::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://mortgage.citi.com/cmi/PaidSearch/Conforming/Chip/LF2/default.htm?ISN=14814-9&BTST=9032003&btlp=dual&cmp=KNC~05~180105~BNKMORTG~Google&gclid=EAIaIQobChMI5-Hlrr_P5wIVDtvACh1yNwFcEAMYAyAAEgLnmvD_BwE&ProspectID=99395EC4AA874445AAE0B43E4AAA421E
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

pragma: no-cache
date: Thu, 13 Feb 2020 21:42:55 GMT
x-content-type-options: nosniff
content-type: image/gif
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, no-store, must-revalidate
content-security-policy: script-src 'none'; object-src 'none'
timing-allow-origin: *
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.de/pagead/1p-user-list/916451471/ 42 B
110 B 25ms
25ms Image
image/gif 2a00:1450:4001:820::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/916451471/?random=1581630175041&cv=9&fst=1581627600000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa250&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fmortgage.citi.com%2Fcmi%2FPaidSearch%2FConforming%2FChip%2FLF2%2Fdefault.htm%3FISN%3D14814-9%26BTST%3D9032003%26btlp%3Ddual%26cmp%3DKNC~05~180105~BNKMORTG~Google%26gclid%3DEAIaIQobChMI5-Hlrr_P5wIVDtvACh1yNwFcEAMYAyAAEgLnmvD_BwE%26ProspectID%3D99395EC4AA874445AAE0B43E4AAA421E&tiba=Buying%20or%20Refinancing%20a%20home%3F%20%7C%20Citi.com&async=1&fmt=3&is_vtc=1&random=927110251&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:820::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://mortgage.citi.com/cmi/PaidSearch/Conforming/Chip/LF2/default.htm?ISN=14814-9&BTST=9032003&btlp=dual&cmp=KNC~05~180105~BNKMORTG~Google&gclid=EAIaIQobChMI5-Hlrr_P5wIVDtvACh1yNwFcEAMYAyAAEgLnmvD_BwE&ProspectID=99395EC4AA874445AAE0B43E4AAA421E
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

pragma: no-cache
date: Thu, 13 Feb 2020 21:42:55 GMT
x-content-type-options: nosniff
content-type: image/gif
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, no-store, must-revalidate
content-security-policy: script-src 'none'; object-src 'none'
timing-allow-origin: *
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.com/pagead/1p-user-list/960621875/ 42 B
110 B 24ms
24ms Image
image/gif 2a00:1450:4001:820::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/960621875/?random=1581630175040&cv=9&fst=1581627600000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa250&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fmortgage.citi.com%2Fcmi%2FPaidSearch%2FConforming%2FChip%2FLF2%2Fdefault.htm%3FISN%3D14814-9%26BTST%3D9032003%26btlp%3Ddual%26cmp%3DKNC~05~180105~BNKMORTG~Google%26gclid%3DEAIaIQobChMI5-Hlrr_P5wIVDtvACh1yNwFcEAMYAyAAEgLnmvD_BwE%26ProspectID%3D99395EC4AA874445AAE0B43E4AAA421E&tiba=Buying%20or%20Refinancing%20a%20home%3F%20%7C%20Citi.com&async=1&fmt=3&is_vtc=1&random=4078639115&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:820::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://mortgage.citi.com/cmi/PaidSearch/Conforming/Chip/LF2/default.htm?ISN=14814-9&BTST=9032003&btlp=dual&cmp=KNC~05~180105~BNKMORTG~Google&gclid=EAIaIQobChMI5-Hlrr_P5wIVDtvACh1yNwFcEAMYAyAAEgLnmvD_BwE&ProspectID=99395EC4AA874445AAE0B43E4AAA421E
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

pragma: no-cache
date: Thu, 13 Feb 2020 21:42:55 GMT
x-content-type-options: nosniff
content-type: image/gif
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, no-store, must-revalidate
content-security-policy: script-src 'none'; object-src 'none'
timing-allow-origin: *
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.de/pagead/1p-user-list/960621875/ 42 B
110 B 30ms
30ms Image
image/gif 2a00:1450:4001:820::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/960621875/?random=1581630175040&cv=9&fst=1581627600000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa250&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fmortgage.citi.com%2Fcmi%2FPaidSearch%2FConforming%2FChip%2FLF2%2Fdefault.htm%3FISN%3D14814-9%26BTST%3D9032003%26btlp%3Ddual%26cmp%3DKNC~05~180105~BNKMORTG~Google%26gclid%3DEAIaIQobChMI5-Hlrr_P5wIVDtvACh1yNwFcEAMYAyAAEgLnmvD_BwE%26ProspectID%3D99395EC4AA874445AAE0B43E4AAA421E&tiba=Buying%20or%20Refinancing%20a%20home%3F%20%7C%20Citi.com&async=1&fmt=3&is_vtc=1&random=4078639115&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:820::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://mortgage.citi.com/cmi/PaidSearch/Conforming/Chip/LF2/default.htm?ISN=14814-9&BTST=9032003&btlp=dual&cmp=KNC~05~180105~BNKMORTG~Google&gclid=EAIaIQobChMI5-Hlrr_P5wIVDtvACh1yNwFcEAMYAyAAEgLnmvD_BwE&ProspectID=99395EC4AA874445AAE0B43E4AAA421E
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

pragma: no-cache
date: Thu, 13 Feb 2020 21:42:55 GMT
x-content-type-options: nosniff
content-type: image/gif
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, no-store, must-revalidate
content-security-policy: script-src 'none'; object-src 'none'
timing-allow-origin: *
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.com/pagead/1p-user-list/763960929/ 42 B
110 B 27ms
26ms Image
image/gif 2a00:1450:4001:820::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/763960929/?random=1581630175042&cv=9&fst=1581627600000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa250&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fmortgage.citi.com%2Fcmi%2FPaidSearch%2FConforming%2FChip%2FLF2%2Fdefault.htm%3FISN%3D14814-9%26BTST%3D9032003%26btlp%3Ddual%26cmp%3DKNC~05~180105~BNKMORTG~Google%26gclid%3DEAIaIQobChMI5-Hlrr_P5wIVDtvACh1yNwFcEAMYAyAAEgLnmvD_BwE%26ProspectID%3D99395EC4AA874445AAE0B43E4AAA421E&tiba=Buying%20or%20Refinancing%20a%20home%3F%20%7C%20Citi.com&async=1&fmt=3&is_vtc=1&random=2127141506&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:820::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://mortgage.citi.com/cmi/PaidSearch/Conforming/Chip/LF2/default.htm?ISN=14814-9&BTST=9032003&btlp=dual&cmp=KNC~05~180105~BNKMORTG~Google&gclid=EAIaIQobChMI5-Hlrr_P5wIVDtvACh1yNwFcEAMYAyAAEgLnmvD_BwE&ProspectID=99395EC4AA874445AAE0B43E4AAA421E
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

pragma: no-cache
date: Thu, 13 Feb 2020 21:42:55 GMT
x-content-type-options: nosniff
content-type: image/gif
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, no-store, must-revalidate
content-security-policy: script-src 'none'; object-src 'none'
timing-allow-origin: *
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.de/pagead/1p-user-list/763960929/ 42 B
110 B 24ms
23ms Image
image/gif 2a00:1450:4001:820::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/763960929/?random=1581630175042&cv=9&fst=1581627600000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa250&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fmortgage.citi.com%2Fcmi%2FPaidSearch%2FConforming%2FChip%2FLF2%2Fdefault.htm%3FISN%3D14814-9%26BTST%3D9032003%26btlp%3Ddual%26cmp%3DKNC~05~180105~BNKMORTG~Google%26gclid%3DEAIaIQobChMI5-Hlrr_P5wIVDtvACh1yNwFcEAMYAyAAEgLnmvD_BwE%26ProspectID%3D99395EC4AA874445AAE0B43E4AAA421E&tiba=Buying%20or%20Refinancing%20a%20home%3F%20%7C%20Citi.com&async=1&fmt=3&is_vtc=1&random=2127141506&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:820::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://mortgage.citi.com/cmi/PaidSearch/Conforming/Chip/LF2/default.htm?ISN=14814-9&BTST=9032003&btlp=dual&cmp=KNC~05~180105~BNKMORTG~Google&gclid=EAIaIQobChMI5-Hlrr_P5wIVDtvACh1yNwFcEAMYAyAAEgLnmvD_BwE&ProspectID=99395EC4AA874445AAE0B43E4AAA421E
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

pragma: no-cache
date: Thu, 13 Feb 2020 21:42:55 GMT
x-content-type-options: nosniff
content-type: image/gif
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, no-store, must-revalidate
content-security-policy: script-src 'none'; object-src 'none'
timing-allow-origin: *
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.com/pagead/1p-user-list/975701947/ 42 B
110 B 23ms
23ms Image
image/gif 2a00:1450:4001:820::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/975701947/?random=1581630175043&cv=9&fst=1581627600000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa250&sendb=1&data=event%3Dconversion&frm=0&url=https%3A%2F%2Fmortgage.citi.com%2Fcmi%2FPaidSearch%2FConforming%2FChip%2FLF2%2Fdefault.htm%3FISN%3D14814-9%26BTST%3D9032003%26btlp%3Ddual%26cmp%3DKNC~05~180105~BNKMORTG~Google%26gclid%3DEAIaIQobChMI5-Hlrr_P5wIVDtvACh1yNwFcEAMYAyAAEgLnmvD_BwE%26ProspectID%3D99395EC4AA874445AAE0B43E4AAA421E&tiba=Buying%20or%20Refinancing%20a%20home%3F%20%7C%20Citi.com&async=1&fmt=3&is_vtc=1&random=1928451255&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:820::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://mortgage.citi.com/cmi/PaidSearch/Conforming/Chip/LF2/default.htm?ISN=14814-9&BTST=9032003&btlp=dual&cmp=KNC~05~180105~BNKMORTG~Google&gclid=EAIaIQobChMI5-Hlrr_P5wIVDtvACh1yNwFcEAMYAyAAEgLnmvD_BwE&ProspectID=99395EC4AA874445AAE0B43E4AAA421E
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

pragma: no-cache
date: Thu, 13 Feb 2020 21:42:55 GMT
x-content-type-options: nosniff
content-type: image/gif
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, no-store, must-revalidate
content-security-policy: script-src 'none'; object-src 'none'
timing-allow-origin: *
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.de/pagead/1p-user-list/975701947/ 42 B
110 B 26ms
26ms Image
image/gif 2a00:1450:4001:820::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/975701947/?random=1581630175043&cv=9&fst=1581627600000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa250&sendb=1&data=event%3Dconversion&frm=0&url=https%3A%2F%2Fmortgage.citi.com%2Fcmi%2FPaidSearch%2FConforming%2FChip%2FLF2%2Fdefault.htm%3FISN%3D14814-9%26BTST%3D9032003%26btlp%3Ddual%26cmp%3DKNC~05~180105~BNKMORTG~Google%26gclid%3DEAIaIQobChMI5-Hlrr_P5wIVDtvACh1yNwFcEAMYAyAAEgLnmvD_BwE%26ProspectID%3D99395EC4AA874445AAE0B43E4AAA421E&tiba=Buying%20or%20Refinancing%20a%20home%3F%20%7C%20Citi.com&async=1&fmt=3&is_vtc=1&random=1928451255&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:820::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://mortgage.citi.com/cmi/PaidSearch/Conforming/Chip/LF2/default.htm?ISN=14814-9&BTST=9032003&btlp=dual&cmp=KNC~05~180105~BNKMORTG~Google&gclid=EAIaIQobChMI5-Hlrr_P5wIVDtvACh1yNwFcEAMYAyAAEgLnmvD_BwE&ProspectID=99395EC4AA874445AAE0B43E4AAA421E
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

pragma: no-cache
date: Thu, 13 Feb 2020 21:42:55 GMT
x-content-type-options: nosniff
content-type: image/gif
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, no-store, must-revalidate
content-security-policy: script-src 'none'; object-src 'none'
timing-allow-origin: *
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 cool-2.1.15.min.js Show response
nebula-cdn.kampyle.com/resources/onsite/js/ 14 KB
5 KB 69ms
23ms Script
application/javascript 151.101.13.175
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://nebula-cdn.kampyle.com/resources/onsite/js/cool-2.1.15.min.js
Requested by: Host: resources.digital-cloud-citi.medallia.com
URL: https://resources.digital-cloud-citi.medallia.com/wdcusciti/50/onsite/generic1581351803939.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.13.175 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 3e72de5de67d6d80b65a114af684eaf880c53c250155a663cb17d677ff064bc1

Request headers

Referer: https://mortgage.citi.com/cmi/PaidSearch/Conforming/Chip/LF2/default.htm?ISN=14814-9&BTST=9032003&btlp=dual&cmp=KNC~05~180105~BNKMORTG~Google&gclid=EAIaIQobChMI5-Hlrr_P5wIVDtvACh1yNwFcEAMYAyAAEgLnmvD_BwE&ProspectID=99395EC4AA874445AAE0B43E4AAA421E
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Thu, 13 Feb 2020 21:42:55 GMT
content-encoding: gzip
age: 0
via: 1.1 varnish, 1.1 varnish
x-cache: MISS, HIT
status: 200
content-length: 5197
x-amz-request-id: 3A7285A58FF0C32F
x-amz-id-2: WDQ5K9sZKfU9oe0emRVI9UoQ5NZYi7lLzyoCOAkcNfcsbr3Tt5uZZe+VZ77gtsaMTtzkUNPXc7c=
x-served-by: cache-iad2141-IAD, cache-fra19123-FRA
last-modified: Sun, 05 Jan 2020 11:06:02 GMT
server: AmazonS3
x-timer: S1581630175.226482,VS0,VE0
etag: "80dd5e3be5152c5c72d552c6a26ef6ff"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=31536000
accept-ranges: bytes
x-cache-hits: 0, 58295

GET
H2

200

activityi;dc_pre=CMOAjMa_z-cCFfDCuwgdcvIHZQ;src=6256710;type=sapie0;cat=mortg00l;u1=14814-9;u3=99395EC4AA874445AAE0B43E4AAA421E;dc_lat=;dc_rdid=;tag_for_child_directed_treatment;ord=1874668717.7012622
6256710.fls.doubleclick.net/ Frame 98DD
Redirect Chain

https://6256710.fls.doubleclick.net/activityi;src=6256710;type=sapie0;cat=mortg00l;u1=14814-9;u3=99395EC4AA874445AAE0B43E4AAA421E;dc_lat=;dc_rdid=;tag_for_child_directed_treatment;ord=1874668717.70...
https://6256710.fls.doubleclick.net/activityi;dc_pre=CMOAjMa_z-cCFfDCuwgdcvIHZQ;src=6256710;type=sapie0;cat=mortg00l;u1=14814-9;u3=99395EC4AA874445AAE0B43E4AAA421E;dc_lat=;dc_rdid=;tag_for_child_di...

0
0

54ms
54ms

Document
text/html

172.217.22.38
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://6256710.fls.doubleclick.net/activityi;dc_pre=CMOAjMa_z-cCFfDCuwgdcvIHZQ;src=6256710;type=sapie0;cat=mortg00l;u1=14814-9;u3=99395EC4AA874445AAE0B43E4AAA421E;dc_lat=;dc_rdid=;tag_for_child_directed_treatment;ord=1874668717.7012622

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/code/6610fb4aae8f009df6c34d43ec0f8b17.js?conditionId0=750459&conditionId1=750458&conditionId2=754094&conditionId3=754110&conditionId4=750487&conditionId5=750484

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.22.38 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra15s16-in-f38.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=21600
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: 6256710.fls.doubleclick.net
:scheme: https
:path: /activityi;dc_pre=CMOAjMa_z-cCFfDCuwgdcvIHZQ;src=6256710;type=sapie0;cat=mortg00l;u1=14814-9;u3=99395EC4AA874445AAE0B43E4AAA421E;dc_lat=;dc_rdid=;tag_for_child_directed_treatment;ord=1874668717.7012622
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-dest: iframe
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
referer: https://mortgage.citi.com/cmi/PaidSearch/Conforming/Chip/LF2/default.htm?ISN=14814-9&BTST=9032003&btlp=dual&cmp=KNC~05~180105~BNKMORTG~Google&gclid=EAIaIQobChMI5-Hlrr_P5wIVDtvACh1yNwFcEAMYAyAAEgLnmvD_BwE&ProspectID=99395EC4AA874445AAE0B43E4AAA421E
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: IDE=AHWqTUnW56i5z2WH2JE9gNC7x0nrPmY3xcgfCyEqFz_ncFITPVjSzRVgJAkWUdXl
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: iframe
Referer: https://mortgage.citi.com/cmi/PaidSearch/Conforming/Chip/LF2/default.htm?ISN=14814-9&BTST=9032003&btlp=dual&cmp=KNC~05~180105~BNKMORTG~Google&gclid=EAIaIQobChMI5-Hlrr_P5wIVDtvACh1yNwFcEAMYAyAAEgLnmvD_BwE&ProspectID=99395EC4AA874445AAE0B43E4AAA421E

Response headers

status: 200
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
date: Thu, 13 Feb 2020 21:42:55 GMT
expires: Thu, 13 Feb 2020 21:42:55 GMT
cache-control: private, max-age=0
strict-transport-security: max-age=21600
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 361
x-xss-protection: 0
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000

Redirect headers

status: 302
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
date: Thu, 13 Feb 2020 21:42:55 GMT
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
cache-control: no-cache, must-revalidate
follow-only-when-prerender-shown: 1
strict-transport-security: max-age=21600
location: https://6256710.fls.doubleclick.net/activityi;dc_pre=CMOAjMa_z-cCFfDCuwgdcvIHZQ;src=6256710;type=sapie0;cat=mortg00l;u1=14814-9;u3=99395EC4AA874445AAE0B43E4AAA421E;dc_lat=;dc_rdid=;tag_for_child_directed_treatment;ord=1874668717.7012622
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
server: cafe
content-length: 0
x-xss-protection: 0
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000

GET
H2 200 pp.html
cdn.pbbl.co/i/ Frame CC05 0
0 110ms
110ms Document
text/html 13.225.78.34
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.pbbl.co/i/pp.html
Requested by: Host: cdn.pbbl.co
URL: https://cdn.pbbl.co/r/1560.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 13.225.78.34 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-225-78-34.fra2.r.cloudfront.net
Software: nginx/1.10.3 (Ubuntu) /
Resource Hash

Request headers

:method: GET
:authority: cdn.pbbl.co
:scheme: https
:path: /i/pp.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-dest: iframe
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
referer: https://mortgage.citi.com/cmi/PaidSearch/Conforming/Chip/LF2/default.htm?ISN=14814-9&BTST=9032003&btlp=dual&cmp=KNC~05~180105~BNKMORTG~Google&gclid=EAIaIQobChMI5-Hlrr_P5wIVDtvACh1yNwFcEAMYAyAAEgLnmvD_BwE&ProspectID=99395EC4AA874445AAE0B43E4AAA421E
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: iframe
Referer: https://mortgage.citi.com/cmi/PaidSearch/Conforming/Chip/LF2/default.htm?ISN=14814-9&BTST=9032003&btlp=dual&cmp=KNC~05~180105~BNKMORTG~Google&gclid=EAIaIQobChMI5-Hlrr_P5wIVDtvACh1yNwFcEAMYAyAAEgLnmvD_BwE&ProspectID=99395EC4AA874445AAE0B43E4AAA421E

Response headers

status: 200
content-type: text/html
server: nginx/1.10.3 (Ubuntu)
date: Thu, 13 Feb 2020 21:42:55 GMT
last-modified: Thu, 30 Jan 2020 18:07:58 GMT
content-encoding: gzip
vary: Accept-Encoding
x-cache: Miss from cloudfront
via: 1.1 4048e3a1e70c8529cbd86f04580a3da4.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA2-C2
x-amz-cf-id: SH_Cy559CgkbcKH2A8FbvmANo95TcZ0fc1evTqEoTYcv18QEh3is1w==

GET
H2 200 __cool.gif
udc-neb.kampyle.com/egw/5/qceuv8449dzg58ptt1bhda9g8ue19c7s/track/ 0
321 B 137ms
103ms Image
image/gif 35.241.45.82
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://udc-neb.kampyle.com/egw/5/qceuv8449dzg58ptt1bhda9g8ue19c7s/track/__cool.gif?data=eyJldmVudHMiOiBbCiAgICB7InNlc3Npb25fc2NyZWVuX3NpemUiOiAiMTYwMHgxMjAwIiwic2Vzc2lvbl9kdWEiOiAiTW96aWxsYS81LjAgKE1hY2ludG9zaDsgSW50ZWwgTWFjIE9TIFggMTBfMTRfNSkgQXBwbGVXZWJLaXQvNTM3LjM2IChLSFRNTCwgbGlrZSBHZWNrbykgQ2hyb21lLzc0LjAuMzcyOS4xNjkgU2FmYXJpLzUzNy4zNiIsInNlc3Npb25fcGxhdGZvcm0iOiAiTGludXggeDg2XzY0IiwidHJhY2tlcl90eXBlIjogImphdmFzY3JpcHQiLCJ0cmFja2VyX3ZlcnNpb24iOiAiMi4xLjE1IiwiZXZlbnRfbmFtZSI6ICJuZWJ1bGFfcGFnZV92aWV3IiwiZXZlbnRfdGltZXN0YW1wX2Vwb2NoIjogIjE1ODE2MzAxNzUyNDMiLCJldmVudF90aW1lem9uZV9vZmZzZXQiOiAxLCJ1c2VyX2lkIjogIjE3MDQwODEzODA5YmQxLTBjMTIzNGJlOGYzZDk1LTM3NjQ3ZTAzLTFkNGMwMC0xNzA0MDgxMzgwYWQzOCIsImVudmlyb21lbnQiOiAiZGlnaXRhbC1jbG91ZC11cy1jaXRpIiwiYWNjb3VudElkIjogNDksInVybCI6ICJodHRwczovL21vcnRnYWdlLmNpdGkuY29tL2NtaS9QYWlkU2VhcmNoL0NvbmZvcm1pbmcvQ2hpcC9MRjIvZGVmYXVsdC5odG0/SVNOPTE0ODE0LTkmQlRTVD05MDMyMDAzJmJ0bHA9ZHVhbCZjbXA9S05DfjA1fjE4MDEwNX5CTktNT1JUR35Hb29nbGUmZ2NsaWQ9RUFJYUlRb2JDaE1JNS1IbHJyX1A1d0lWRHR2QUNoMXlOd0ZjRUFNWUF5QUFFZ0xubXZEX0J3RSZQcm9zcGVjdElEPTk5Mzk1RUM0QUE4NzQ0NDVBQUUwQjQzRTRBQUE0MjFFIiwid2Vic2l0ZUlkIjogNTAsImZlZWRiYWNrX3V1aWQiOiBudWxsLCJmb3JtSWQiOiBudWxsLCJmb3JtVHJpZ2dlclR5cGUiOiBudWxsLCJrYW1weWxlX2RhdGEiOiB7IkxBU1RfSU5WSVRBVElPTl9WSUVXIjogIiIsIkRFQ0xJTkVEX0RBVEUiOiAiIiwia2FtcHlsZUludml0ZVByZXNlbnRlZCI6ICIiLCJrYW1weWxlX3VzZXJpZCI6ICJlZTJmLWZmOWMtNGY0Yy0xODk5LTQ5ZGEtMWM2Zi1lNTEwLWMwMTMiLCJrYW1weWxlVXNlclNlc3Npb24iOiAiMTU4MTYzMDE3NTA4NyIsImthbXB5bGVVc2VyUGVyY2VudGlsZSI6ICIiLCJTVUJNSVRURURfREFURSI6ICIifSwiY29va2llX3NpemUiOiAxMjk2LCJrYW1weWxlX3ZlcnNpb24iOiAiMC4wLjAuMCIsImhpc3RvcnlfbGVuZ3RoIjogMiwiZXZlbnRfbG9jYWxfdGltZXN0YW1wIjogMTU4MTYzMDE3NTA4OSwicG9zaXRpb24iOiBudWxsLCJpc1VzZXJJZGVudGlmaWVkIjogZmFsc2V9Cl19
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.241.45.82 , Ascension Island, ASN15169 (GOOGLE, US),
Reverse DNS: 82.45.241.35.bc.googleusercontent.com
Software: Jetty(9.2.11.v20150529) /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://mortgage.citi.com/cmi/PaidSearch/Conforming/Chip/LF2/default.htm?ISN=14814-9&BTST=9032003&btlp=dual&cmp=KNC~05~180105~BNKMORTG~Google&gclid=EAIaIQobChMI5-Hlrr_P5wIVDtvACh1yNwFcEAMYAyAAEgLnmvD_BwE&ProspectID=99395EC4AA874445AAE0B43E4AAA421E
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

x-me: prod-instance-gatewayservice-green-bv8r
date: Thu, 13 Feb 2020 21:42:55 GMT
via: 1.1 google
alt-svc: clear
server: Jetty(9.2.11.v20150529)
access-control-allow-origin: *
access-control-max-age: 1800
access-control-allow-methods: GET, POST, PUT, DELETE
content-type: image/gif; charset=UTF-8
status: 200
access-control-allow-credentials: true
access-control-allow-headers: X-Requested-With, Origin, Content-Type, Accept
content-length: 0
x-application-context: application:9090

GET
H2

200

adadvisor.gif
px0.pbbl.co/
Redirect Chain

https://px0.pbbl.co/ns/__p2.gif?ppid=82eb3de0-0118-4d78-8a76-080aeb822586&chk=false&brid=1560&brcid=&email=&orderId=&orderValue=&productId=&offerCode=&label=&pageUrl=https%3A%2F%2Fmortgage.citi.com...
https://aa.agkn.com/adscores/g.pixel?sid=9212282598&_ppid=82eb3de0-0118-4d78-8a76-080aeb822586&_segid=99&iid=bf3d2608-a4ec-44ad-860e-9a0bc01af80c
https://px0.pbbl.co/adadvisor.gif?segment=000&_ppid=82eb3de0-0118-4d78-8a76-080aeb822586&_segid=99&_zip=&hk=&iid=bf3d2608-a4ec-44ad-860e-9a0bc01af80c&mt=&bd=

42 B
135 B

139ms
139ms

Image
image/gif

2a00:1450:4001:808::2013
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://px0.pbbl.co/adadvisor.gif?segment=000&_ppid=82eb3de0-0118-4d78-8a76-080aeb822586&_segid=99&_zip=&hk=&iid=bf3d2608-a4ec-44ad-860e-9a0bc01af80c&mt=&bd=

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::2013 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Frontend /

Resource Hash

99c2917ee5b2a01459a923bdd1c676f15ee73b62b87f696e6735312d26f51e12

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1

Request headers

Referer: https://mortgage.citi.com/cmi/PaidSearch/Conforming/Chip/LF2/default.htm?ISN=14814-9&BTST=9032003&btlp=dual&cmp=KNC~05~180105~BNKMORTG~Google&gclid=EAIaIQobChMI5-Hlrr_P5wIVDtvACh1yNwFcEAMYAyAAEgLnmvD_BwE&ProspectID=99395EC4AA874445AAE0B43E4AAA421E
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 13 Feb 2020 21:42:55 GMT
x-content-type-options: nosniff
server: Google Frontend
content-type: image/gif
status: 200
x-cloud-trace-context: f2173889b5120717f015da6adf4a9d02
cache-control: must-revalidate, no-cache, no-store
content-length: 42
x-xss-protection: 1
expires: 0

Redirect headers

pragma: no-cache
date: Thu, 13 Feb 2020 21:42:55 GMT
server: AAWebServer
location: https://px0.pbbl.co/adadvisor.gif?segment=000&_ppid=82eb3de0-0118-4d78-8a76-080aeb822586&_segid=99&_zip=&hk=&iid=bf3d2608-a4ec-44ad-860e-9a0bc01af80c&mt=&bd=
p3p: policyref="http://www.agkn.com/p3p/p3p.xml",CP="NOI NID"
status: 302
cache-control: no-cache, no-store, must-revalidate
content-length: 0
expires: 0

GET
H2 200 s77107282671086
metrics1.citi.com/b/ss/citinaprod/1/JS-2.0.0/ 43 B
351 B 30ms
29ms Image
image/gif 15.188.105.205
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://metrics1.citi.com/b/ss/citinaprod/1/JS-2.0.0/s77107282671086?AQB=1&ndh=1&pf=1&t=13%2F1%2F2020%2022%3A42%3A55%204%20-60&fid=5C6968BDB71E357C-1480F7F45C06E533&ce=UTF-8&pageName=paid%20search%20mortgage%20dual%20lead%20landing&g=https%3A%2F%2Fmortgage.citi.com%2Fcmi%2FPaidSearch%2FConforming%2FChip%2FLF2%2Fdefault.htm%3FISN%3D14814-9%26BTST%3D9032003%26btlp%3Ddual%26cmp%3DKNC%7E05%7E180105%7EBNKMORTG%7EGoogle%26gclid%3DEAIaIQobChMI5-Hlrr_P5wIVDtvACh1yNwFcEAMYAyAAEgLnmvD_BwE%26ProspectID%3D99395EC4AA874445AAE0B43E4AAA421E&c.&visitStart=1&.c&cc=USD&ch=Mortgage&v0=KNC%7E05%7E180105%7EBNKMORTG%7EGoogle&c1=Sapient&h1=Mortgage%2FSapient%2FACQ%2FMORTGAGE%2FPaidSearch&c2=ACQ&c3=MORTGAGE&c4=PaidSearch&c8=prelogin%20lead%20form&c9=us&v9=no%20call%2C%20no%20cache&c11=english&c22=paid%20search%20mortgage%20dual%20lead%20landing&v22=99395EC4AA874445AAE0B43E4AAA421E&c25=%5BCS%5Dv1%7C2F22E16F0515922D-4000078CE0103C7E%5BCE%5D&c26=no%20value&c37=na_prod&v38=paid%20search%20mortgage%20dual%20lead%20landing&v52=no%20value&c59=Sapient_cmi_PaidSearch_Conforming_chip_LF2&c61=18&c63=https%3A%2F%2Fmortgage.citi.com%2Fcmi%2FPaidSearch%2FConforming%2FChip%2FLF2%2Fdefault.htm%3FISN%3D14814-9%26BTST%3D9032003%26btlp%3Ddual%26cmp%3DKNC%7E05%7E180105%7EBNKMORTG%7EGoogle%26gclid%3DEAIaIQobChMI5-Hlrr_P5wIVDtvACh1yNwFcEAMYAyAAEgLnmvD_BwE%26ProspectID%3D99395EC4AA874445AAE0B43E4AAA421E&c64=4%3A42PM&v64=4%3A42PM&c65=Thursday&v65=Thursday&c66=Thursday%7C4%3A42PM&v67=New&v68=1&c69=not%20logged%20in&c73=552021%2C624610%2C358910%2C354602%2C578278%2C373773%2C490004%2C622672%2C582775%2C593700%2C495376%2C495377%2C584566%2C495374%2C542251%2C495375%2C573017%2C522574%2C588511%2C632449%2C522572%2C490141%2C580663%2C626438%2C515853%2C593103%2C522576%2C562734%2C551962%2C507276%2C600937%2C494437%2C551970%2C571630%2C385436%2C572752%2C583873%2C569456%2C512346%2C578262%2C521100%2C574962%2C578343%2C565689%2C503940%2C531459%2C609396%2C609397%2C388219%2C567637%2C616123%2C606800%2C626240%2C589393%2C538291%2C617684%2C359218%2C528144%2C488122%2C572750%2C359214%2C486892%2C510670%2C369351%2C503589&v73=medium%7C1600&v78=yes&v87=mortgage.citi.com&v96=cl%7Cbos%3Ana%7Cdsa%3Ana%7Cax%3Ano%20call%7Cdsr%3Ana%7Crf%3A-%7Ccms%3A-&s=1600x1200&c=24&j=1.6&v=N&k=Y&bw=1600&bh=1200&AQE=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

15.188.105.205 Paris, France, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-15-188-105-205.eu-west-3.compute.amazonaws.com

Software

jag /

Resource Hash

a1ecbaed793a1f564c49c671f2dd0ce36f858534ef6d26b55783a06b884cc506

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://mortgage.citi.com/cmi/PaidSearch/Conforming/Chip/LF2/default.htm?ISN=14814-9&BTST=9032003&btlp=dual&cmp=KNC~05~180105~BNKMORTG~Google&gclid=EAIaIQobChMI5-Hlrr_P5wIVDtvACh1yNwFcEAMYAyAAEgLnmvD_BwE&ProspectID=99395EC4AA874445AAE0B43E4AAA421E
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

date: Thu, 13 Feb 2020 21:42:55 GMT
x-content-type-options: nosniff
x-c: master-1158.Ib7fada.M0-347
p3p: CP="This is not a P3P policy"
status: 200
content-length: 43
x-xss-protection: 1; mode=block
pragma: no-cache
last-modified: Fri, 14 Feb 2020 21:42:55 GMT
server: jag
xserver: anedge-67ff9d5b4c-sxwlb
etag: 3396524938081173504-4615250486949487783
vary: *
content-type: image/gif;charset=utf-8
access-control-allow-origin: *
cache-control: no-cache, no-store, max-age=0, no-transform, private
expires: Wed, 12 Feb 2020 21:42:55 GMT

Verdicts & Comments Add Verdict or Comment

111 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

12 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.rfihub.com/	1970-01-19 16:42:06	Name: rud Value: H4sIAAAAAAAAAOMSNjS1MDI1MjKzNDKwMDCxMDCwNBLiM9Qtzfb2syz3cA0oMveQ4gUqMjQzNjA0N7EwMQYAOH3cFDQAAAA
.citi.com/	1970-01-20 00:51:42	Name: s_ecid Value: MCMID%7C88680356247660446651416033365550142996
mortgage.citi.com/	1970-01-19 07:20:31	Name: 7018 Value:
.rfihub.com/	1969-12-31 23:59:59	Name: ruds Value: H4sIAAAAAAAAAOMSNjS1MDI1MjKzNDKwMDCxMDCwNBLiM9Qtzfb2syz3cA0oMvcAAFGaooclAAAA
.citi.com/	1970-01-20 00:51:42	Name: s_vi Value: [CS]v1\|2F22E16F0515922D-4000078CE0103C7E[CE]
mortgage.citi.com/	1970-01-19 15:57:54	Name: CitiBT Value: GUID=B125BA27B2DA48F3B5DA7A0909594145
.demdex.net/	1970-01-19 11:39:42	Name: demdex Value: 82646829199048213381875002600373202871
.citi.com/	1970-01-20 00:53:08	Name: AMCV_61834D9B5228A7430A490D45%40AdobeOrg Value: -330454231%7CMCIDTS%7C18306%7CMCMID%7C88680356247660446651416033365550142996%7CMCAAMLH-1582234974%7C6%7CMCAAMB-1582234974%7CRKhpRz8krg2tLO6pguXWp5olkAcUniQYPHaMWWgdJ3xzPWQmdj0y%7CMCOPTOUT-1581637374s%7CNONE%7CMCSYNCSOP%7C411-18313%7CMCAID%7C2F22E16F0515922D-4000078CE0103C7E%7CvVersion%7C3.1.2
mortgage.citi.com/	1970-01-19 09:30:06	Name: gwcc Value: %7B%22expires%22%3A1581635574%2C%22mobile_number%22%3A%22+18884699285%22%2C%22formatted_number%22%3A%22%28888%29%20469-9285%22%2C%22fallback%22%3A%228667775258%22%2C%22clabel%22%3A%22HftRCK2TmHkQwcyajAM%22%7D
mortgage.citi.com/	1970-01-19 07:20:31	Name: 7830 Value: error
.citi.com/	1969-12-31 23:59:59	Name: AMCVS_61834D9B5228A7430A490D45%40AdobeOrg Value: 1
mortgage.citi.com/	1969-12-31 23:59:59	Name: CitiBTSES Value: SID=F7BA6DFCAEF848559ABA088FC7B0C7E5

2 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
console-api	log	URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js(Line 299) Message: addMbox_tnt_cards value is false
console-api	log	(Line 11) Message: test 12

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

20766699p.rfihub.com
6256710.fls.doubleclick.net
a.rfihub.com
aa.agkn.com
ad.doubleclick.net
adservice.google.com
bat.bing.com
beacon.krxd.net
c1.rfihub.net
cdn.pbbl.co
citi.bridgetrack.com
citi.demdex.net
clickserve.dartsearch.net
cm.everesttech.net
dpm.demdex.net
googleads.g.doubleclick.net
gwmtracking.com
insight.adsrvr.org
js.adsrvr.org
metrics1.citi.com
mortgage.citi.com
nebula-cdn.kampyle.com
nexus.ensighten.com
pubads.g.doubleclick.net
px0.pbbl.co
resources.digital-cloud-citi.medallia.com
sec-citi.bridgetrack.com
sr.rlcdn.com
stags.bluekai.com
tags.bkrtx.com
udc-neb.kampyle.com
www.google.be
www.google.com
www.google.de
www.googleadservices.com
www.googletagmanager.com
www.gstatic.com
104.108.41.26
104.124.153.199
13.224.185.201
13.225.78.34
15.188.105.205
151.101.114.133
151.101.13.175
172.217.16.134
172.217.22.2
172.217.22.38
18.197.253.20
185.31.128.129
2.16.123.117
216.200.122.11
216.250.52.47
216.250.63.5
216.58.205.226
23.45.237.36
2620:1ec:c11::200
2a00:1450:4001:806::2003
2a00:1450:4001:808::2002
2a00:1450:4001:808::2003
2a00:1450:4001:808::2013
2a00:1450:4001:817::2008
2a00:1450:4001:820::2003
2a00:1450:4001:820::2004
2a00:1450:4001:825::2002
2a00:1450:4001:825::200e
34.252.123.130
35.176.232.241
35.190.72.21
35.241.45.82
52.30.105.51
54.154.55.10
54.246.153.43
66.117.28.86
014b223a7e5669cf2cf6b8ceae3bd11c52339bc946bf3fede9e1ab1647edd9b5
0615974c40d602afdbf9759533e352bc17b0458c85aad6694b1a1ad20659625b
06dfb367edf9bbff810def9f75f8695b3ccfbcb2813306609fc6e18fcacfc17e
0a747978746092df6f18fe90ef23b9896959f6a9bb0b58cbab2cbc851793e023
0b2184cbf465296763bda66941dad327f1e7d420cbc11fe2a6fd34ab8daccd04
101a5a9629dd40bd6dd9515c9b5ad77750ad8e06339fe57c56b6aa7cbca871aa
13e29637ce7868e71a6a655ded74810cd91c92bdcbdd03c1a97cb62ba2e795d5
1d26ba02f1860f002746011a3d066bc39092d937535cec515f9d7599b60787ea
1f0c35be7a01aca711097b2574f2cb8cbcaa692e8e52547762f30241961e1e12
2c76393466ddb5f37701caae9f50814d732997583094b1a4eff10360e455d853
30910363545fd0abc5f96b5ce9ee3f373152eaa3666bd373284846cf4818ed8d
321491c146111e9660e459b49b71d6c4c5211c598d57bc9b9ad3c7eb5238d77e
3252128425e1e7b89d9f1e14192ba6b3b3140348a27a208edb8583401e00334e
36f23b33e598a242a6bfb106e226f149df1f3e5c483e623c85304659f53f18ab
3776ff557a90078a0e4d607e386004b49330a6c17563e7362d48abfa5d4ffb51
3a90275800d8689729eb72ea269d65381a5a4d6fa62e904b99c7057973dca964
3e72de5de67d6d80b65a114af684eaf880c53c250155a663cb17d677ff064bc1
3f00323bb3a4bd2a276bec0f27cfa55a94a2b967c3970e68fde57618dff3ddf4
4548078a98441b728d12947eccc2ec785b423843330e3d6bb4d30de9be50f7ba
48ca6c21dfabf1d560498003b175da4156a064af205feb0c1da118c48cb649fa
4c71a7269921a27edf40049926121bff488752f9fb89ff85e1bcc1b62bbc330d
5328fdb0a22e3de33487f565ea45bf243d2815dbdeadcbeb48f623aafaf19325
57dd7d830085c93c7ccd6042ed0b4bfb397929766c69c446b9fe3bef78864e49
589eb90287eaa9f63149aa57d9425aca161f0784920503279c9d6a6cac2ba059
5b45a44dcff21f02c74d51310ddf747ea1b34aab9b2c7a0b330fdc1fd0b5a543
5cc280e965102224e1c7c0bd1df536c524c3a6fc9762205f4d7f7b345382c724
63b98a0c8568c08fd01a6946a147bca65eff26c8085f1ccb5330aafe0f0dcd15
6896c70fd430a1ffe69dc778926e1866ca52a12bd341170522ad6278aafd7bcf
68c3de9cc8c778d500586681addd69c5b4b126a47f06f99df66fba3d013af9df
6d833cc62c578d49069dbf87839c28f3fdea09aea40e160f80e3c4a3cd2e1939
798dff229bfb1921019076c219e7a314af5647a7e550f7868eb5e9f60c41eefe
7b265a879ebfe9cd09a87dba0216d05a137c8a6e6c2c686a9ea0ba0bf2212a4d
7cd52b3b9ca0f87650c9ea054674ee0eee2a9389967545a7a9cb381983b8bb27
7df13706eaab8ce9a3dcd2a501f60bc66987c83834d07dfaf07ae56ef814c110
89b531e78902333807b825faf77cd11cc927fe364ea2ba9307f65365f7e811f7
8af12c5ed7b5ebf6e0dd0ff5cfb3ce321ba13d826dea552187426bc8be1cc960
996494e05db870b65ffe1b5d529000ba2fe1259c8ab0ee3ba55651c62af3fe21
99c2917ee5b2a01459a923bdd1c676f15ee73b62b87f696e6735312d26f51e12
9cc17f2a29825643f4ab4b92f34c6fe5e9b12f1dd87068a07c4933488fd880f7
9ce12675ed28c7049875858e0830af29719f3d16004541570c3a85e70f637696
a1ecbaed793a1f564c49c671f2dd0ce36f858534ef6d26b55783a06b884cc506
a2f7ab96bf17abca22635e815b9753ab2cd80e3398e4a2ea25e2112051b473eb
a7072d89e111b350c17067dea8f1c8e973a5c9303efe9669d9a4a3cd91822f4f
a9cebaefb3003c4944d0d59f71afdca3509d3975af5ff213d2750fdf8f719146
af11d2db618de47c46a86323951d5ac6470bb6dfa8def911459bca00c8fe4b8a
b3cc127d12a9e6e426c9b7993a61c55d2cf0aeeac6aa767a56e3a977b0eb3187
b94dfed261413e9ffdb0e6926fb603a879e87865ca8c573c79f8bcbcb0fbe37f
be69c83c90291e8e4325bdaae405e19a031d6472c32daa4a8dda7d55bfe6a529
c064bacdbf16d7bba288c50c45e43b3decc3f7c3aec9d9e0b4c238c83de4c250
cb2bb21705b9cce9781d02c9223f3344a65bd5314027d11c5a8518ad4bd84e84
cbb6560ed1e9e91e2ceb73f50c333bf5fd86d56839161bf5383a1dd44faf5bc2
ceb299d79bb2dea5b6695e6f2edcf2e1e5d915318f4848a7333519878e74949d
ceb2f31869dbddc41f735d9d33e7b186f1580c37ec8a943309127885fae2c0e8
dba00ef29cbd8ec1750d9d0107d6a2a8822a495c088c881f85c157b9aaa29db5
dd95685cf3a654403daf4d323c3b3c5a51bd92ec1aa453323c857e1f91dc96d0
e226935ba96b671378a7552d0669729f2b4733fab20624ed8018e86bad35401e
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e9e9a67395a0d83b584208a19b95af203df8e8e6c6952fe76c690d60ea9381c7
ebed77e0c92d7876c6329a97771728cc920ce8c3159c14dacd519d1552ee9e71
ec7024e764e94caa58c7a18f4624dc84c9ee15537ff5418fd44e2f037f8abc30
ecbd02dcce8c6c073a834d4b5c839775b95d23994a6fbe1a110bb8256757e110
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

mortgage.citi.com Open in urlscan Pro 216.250.52.47 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

96 Requests

100 %HTTPS

28 %IPv6

26 Domains

37 Subdomains

31 IPs

7 Countries

677 kBTransfer

1777 kBSize

12 Cookies

15 Outgoing links

Page URL History

Redirected requests

96 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

mortgage.citi.com Open in urlscan Pro
216.250.52.47 Public Scan

Screenshot
Live screenshot

Full Image

96
Requests

100 %
HTTPS

28 %
IPv6

26
Domains

37
Subdomains

31
IPs

7
Countries

677 kB
Transfer

1777 kB
Size

12
Cookies

96 HTTP transactions
0 data transactions