www.citi-securedauth.dnset.com Open in urlscan Pro
129.146.137.235  Malicious Activity! Public Scan

Submitted URL: https://www.citi-securedauth.dnset.com/
Effective URL: https://www.citi-securedauth.dnset.com/login.php?online_id=2f9283adc38be4c9014bbf632&country=France&iso=FR
Submission: On April 14 via automatic, source certstream-suspicious

Summary

This website contacted 28 IPs in 6 countries across 27 domains to perform 86 HTTP transactions. The main IP is 129.146.137.235, located in Phoenix, United States and belongs to ORACLE-BMC-31898, US. The main domain is www.citi-securedauth.dnset.com.
TLS certificate: Issued by cPanel, Inc. Certification Authority on April 14th 2021. Valid for: 3 months.
This is the only time www.citi-securedauth.dnset.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Citizens Bank (Banking)

Domain & IP information

IP Address AS Autonomous System
1 11 129.146.137.235 31898 (ORACLE-BM...)
3 18.197.253.20 16509 (AMAZON-02)
22 104.109.73.152 16625 (AKAMAI-AS)
3 12 18.200.157.96 16509 (AMAZON-02)
2 178.249.97.23 11054 (LIVEPERSON)
1 52.208.123.229 16509 (AMAZON-02)
1 15.237.76.117 16509 (AMAZON-02)
1 1 34.253.145.149 16509 (AMAZON-02)
2 99.84.156.70 16509 (AMAZON-02)
2 2 35.244.174.68 15169 (GOOGLE)
1 1 23.79.152.128 16625 (AKAMAI-AS)
3 5 142.250.186.162 15169 (GOOGLE)
1 1 193.0.160.129 54312 (ROCKETFUEL)
1 1 3.125.70.222 16509 (AMAZON-02)
4 4 52.48.137.92 16509 (AMAZON-02)
19 20 151.101.114.49 54113 (FASTLY)
2 69.173.144.138 26667 (RUBICONPR...)
1 2 104.80.29.8 16625 (AKAMAI-AS)
1 3 185.33.221.89 29990 (ASN-APPNEX)
1 3 35.244.159.8 15169 (GOOGLE)
2 185.64.190.80 62713 (AS-PUBMATIC)
1 2 185.94.180.126 35220 (SPOTX-AMS)
2 2a03:2880:f11... 32934 (FACEBOOK)
1 52.22.122.247 14618 (AMAZON-AES)
3 178.249.97.99 11054 (LIVEPERSON)
3 151.101.113.175 54113 (FASTLY)
1 2606:4700:10:... 13335 (CLOUDFLAR...)
3 18.233.247.251 14618 (AMAZON-AES)
1 35.241.45.82 15169 (GOOGLE)
2 178.249.97.98 11054 (LIVEPERSON)
1 52.88.99.210 16509 (AMAZON-02)
2 208.89.15.170 11054 (LIVEPERSON)
3 208.89.12.87 11054 (LIVEPERSON)
86 28
Apex Domain
Subdomains
Transfer
22 citizensbankonline.com
www3.citizensbankonline.com
www4.citizensbankonline.com
270 KB
21 everesttech.net
cm.everesttech.net
sync-tm.everesttech.net
4 KB
13 demdex.net
dpm.demdex.net
citizensbank.demdex.net
15 KB
11 dnset.com
www.citi-securedauth.dnset.com
27 KB
7 liveperson.net
lptag.liveperson.net
va.idp.liveperson.net
va.v.liveperson.net
116 KB
5 lpsnmedia.net
accdn.lpsnmedia.net
lpcdn.lpsnmedia.net
33 KB
5 doubleclick.net
cm.g.doubleclick.net
2 KB
4 kampyle.com
nebula-cdn.kampyle.com
udc-neb.kampyle.com
92 KB
4 crwdcntrl.net
sync.crwdcntrl.net
2 KB
3 glassboxdigital.io
report.citizen.glassboxdigital.io
3 KB
3 openx.net
us-u.openx.net
575 B
3 adnxs.com
ib.adnxs.com
3 KB
3 ensighten.com
nexus.ensighten.com
94 KB
2 facebook.com
www.facebook.com
780 B
2 spotxchange.com
sync.search.spotxchange.com
1 KB
2 pubmatic.com
image2.pubmatic.com
2 KB
2 casalemedia.com
dsum-sec.casalemedia.com
1010 B
2 rubiconproject.com
pixel.rubiconproject.com
478 B
2 rlcdn.com
idsync.rlcdn.com
804 B
2 appdynamics.com
cdn.appdynamics.com
57 KB
1 eum-appdynamics.com
pdx-col.eum-appdynamics.com
439 B
1 glassboxcdn.com
cdn.glassboxcdn.com
109 KB
1 rkdms.com
mid.rkdms.com
47 B
1 eyeota.net
ps.eyeota.net
418 B
1 rfihub.com
p.rfihub.com
749 B
1 addthis.com
x.dlx.addthis.com
175 B
1 citizensbank.com
smetrics.citizensbank.com
521 B
86 27
Domain Requested by
21 www3.citizensbankonline.com www.citi-securedauth.dnset.com
www3.citizensbankonline.com
20 sync-tm.everesttech.net 19 redirects
12 dpm.demdex.net 3 redirects www.citi-securedauth.dnset.com
11 www.citi-securedauth.dnset.com 1 redirects www.citi-securedauth.dnset.com
www3.citizensbankonline.com
5 cm.g.doubleclick.net 3 redirects www.citi-securedauth.dnset.com
4 sync.crwdcntrl.net 4 redirects
3 va.v.liveperson.net cdn.appdynamics.com
3 report.citizen.glassboxdigital.io cdn.appdynamics.com
3 nebula-cdn.kampyle.com cdn.appdynamics.com
3 accdn.lpsnmedia.net lptag.liveperson.net
lpcdn.lpsnmedia.net
3 us-u.openx.net 1 redirects www.citi-securedauth.dnset.com
3 ib.adnxs.com 1 redirects www.citi-securedauth.dnset.com
3 nexus.ensighten.com www.citi-securedauth.dnset.com
nexus.ensighten.com
2 va.idp.liveperson.net cdn.appdynamics.com
va.idp.liveperson.net
2 lpcdn.lpsnmedia.net cdn.appdynamics.com
2 www.facebook.com www.citi-securedauth.dnset.com
2 sync.search.spotxchange.com 1 redirects
2 image2.pubmatic.com www.citi-securedauth.dnset.com
2 dsum-sec.casalemedia.com 1 redirects www.citi-securedauth.dnset.com
2 pixel.rubiconproject.com www.citi-securedauth.dnset.com
2 idsync.rlcdn.com 2 redirects
2 cdn.appdynamics.com nexus.ensighten.com
cdn.appdynamics.com
2 lptag.liveperson.net www.citi-securedauth.dnset.com
1 pdx-col.eum-appdynamics.com cdn.appdynamics.com
1 udc-neb.kampyle.com
1 cdn.glassboxcdn.com cdn.appdynamics.com
1 mid.rkdms.com www.citi-securedauth.dnset.com
1 ps.eyeota.net 1 redirects
1 p.rfihub.com 1 redirects
1 x.dlx.addthis.com 1 redirects
1 cm.everesttech.net 1 redirects
1 smetrics.citizensbank.com nexus.ensighten.com
1 citizensbank.demdex.net nexus.ensighten.com
1 www4.citizensbankonline.com www.citi-securedauth.dnset.com
86 34

This site contains links to these domains. Also see Links.

Domain
www.citizensbank.com
Subject Issuer Validity Valid
www.citi-securedauth.dnset.com
cPanel, Inc. Certification Authority
2021-04-14 -
2021-07-13
3 months crt.sh
nexus.ensighten.com
DigiCert SHA2 Secure Server CA
2020-09-09 -
2021-10-11
a year crt.sh
citizensbankonline.com
DigiCert EV RSA CA G2
2020-07-09 -
2021-07-04
a year crt.sh
*.demdex.net
DigiCert TLS RSA SHA256 2020 CA1
2020-12-02 -
2022-01-02
a year crt.sh
*.liveperson.net
Sectigo RSA Organization Validation Secure Server CA
2020-05-30 -
2022-05-30
2 years crt.sh
smetrics.citizensbank.com
DigiCert SHA2 High Assurance Server CA
2020-04-19 -
2021-07-22
a year crt.sh
*.appdynamics.com
DigiCert SHA2 Secure Server CA
2020-05-17 -
2021-07-22
a year crt.sh
*.g.doubleclick.net
GTS CA 1O1
2021-03-16 -
2021-06-08
3 months crt.sh
*.rubiconproject.com
DigiCert TLS RSA SHA256 2020 CA1
2020-12-18 -
2022-01-18
a year crt.sh
san.casalemedia.com
GeoTrust RSA CA 2018
2021-02-05 -
2022-02-09
a year crt.sh
*.adnxs.com
GeoTrust ECC CA 2018
2021-03-05 -
2022-02-19
a year crt.sh
*.openx.net
GeoTrust RSA CA 2018
2020-06-18 -
2021-08-17
a year crt.sh
*.pubmatic.com
DigiCert Baltimore TLS RSA SHA256 2020 CA1
2020-12-07 -
2021-12-14
a year crt.sh
*.search.spotxchange.com
GeoTrust RSA CA 2018
2021-04-08 -
2022-05-09
a year crt.sh
*.facebook.com
DigiCert SHA2 High Assurance Server CA
2021-02-10 -
2021-05-10
3 months crt.sh
*.rkdms.com
Entrust Certification Authority - L1K
2020-10-08 -
2021-10-30
a year crt.sh
*.lpsnmedia.net
Sectigo RSA Organization Validation Secure Server CA
2021-02-21 -
2022-02-21
a year crt.sh
*.everesttech.net
GlobalSign Atlas R3 DV TLS CA 2020
2021-03-22 -
2022-04-23
a year crt.sh
*.kampyle.com
GlobalSign Atlas R3 DV TLS CA 2020
2021-03-22 -
2022-04-23
a year crt.sh
glassboxcdn.com
Cloudflare Inc ECC CA-3
2020-06-01 -
2021-06-01
a year crt.sh
citizen.glassboxdigital.io
Amazon
2020-12-19 -
2022-01-17
a year crt.sh
*.eum-appdynamics.com
DigiCert SHA2 Secure Server CA
2020-05-10 -
2021-07-15
a year crt.sh
*.idp.liveperson.net
COMODO RSA Organization Validation Secure Server CA
2020-07-09 -
2022-07-09
2 years crt.sh
*.v.liveperson.net
Sectigo RSA Organization Validation Secure Server CA
2020-04-13 -
2022-04-13
2 years crt.sh

This page contains 4 frames:

Primary Page: https://www.citi-securedauth.dnset.com/login.php?online_id=2f9283adc38be4c9014bbf632&country=France&iso=FR
Frame ID: A899C22A4692CFB3F27348C50AFAECCC
Requests: 58 HTTP requests in this frame

Frame: https://citizensbank.demdex.net/dest5.html?d_nsid=0
Frame ID: BC17B83F4540238F809CB42DFC8AD53C
Requests: 24 HTTP requests in this frame

Frame: https://lpcdn.lpsnmedia.net/le_secure_storage/3.12.0.0-release_5037/storage.secure.min.html?loc=https%3A%2F%2Fwww.citi-securedauth.dnset.com&site=89632304&env=prod&isCrossDomain=true
Frame ID: B8153C2B588100D0C43E7587FEF8EA1D
Requests: 2 HTTP requests in this frame

Frame: https://va.idp.liveperson.net/postmessage/postmessage.min.html?bust=1618427583124&loc=https%3A%2F%2Fwww.citi-securedauth.dnset.com
Frame ID: 0F8F4C2FF8783D8B42FBAC7AEEBD7AE7
Requests: 2 HTTP requests in this frame

Screenshot


Page URL History Show full URLs

  1. https://www.citi-securedauth.dnset.com/ HTTP 302
    https://www.citi-securedauth.dnset.com/login.php?online_id=2f9283adc38be4c9014bbf632&country=France&iso=FR Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • headers server /(?:Apache(?:$|\/([\d.]+)|[^/-])|(?:^|\b)HTTPD)/i

Page Statistics

86
Requests

99 %
HTTPS

6 %
IPv6

27
Domains

34
Subdomains

28
IPs

6
Countries

821 kB
Transfer

2627 kB
Size

4
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://www.citi-securedauth.dnset.com/ HTTP 302
    https://www.citi-securedauth.dnset.com/login.php?online_id=2f9283adc38be4c9014bbf632&country=France&iso=FR Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 17
  • https://dpm.demdex.net/id?d_visid_ver=2.1.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=4C3B0C3755C3822E7F000101%40AdobeOrg&d_nsid=0&ts=1618427578907 HTTP 302
  • https://dpm.demdex.net/id/rd?d_visid_ver=2.1.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=4C3B0C3755C3822E7F000101%40AdobeOrg&d_nsid=0&ts=1618427578907
Request Chain 35
  • https://cm.everesttech.net/cm/dd?d_uuid=70559885886796118184228049582252341031 HTTP 302
  • https://dpm.demdex.net/ibs:dpid=411&dpuuid=YHc_uwAAAGDBhxNg
Request Chain 38
  • https://idsync.rlcdn.com/365868.gif?partner_uid=70559885886796118184228049582252341031 HTTP 307
  • https://idsync.rlcdn.com/1000.gif?memo=CKyqFhIxCi0IARCYEhomNzA1NTk4ODU4ODY3OTYxMTgxODQyMjgwNDk1ODIyNTIzNDEwMzEQABoNCLv93IMGEgUI6AcQAEIASgA HTTP 307
  • https://dpm.demdex.net/ibs:dpid=477&dpuuid=efe47e617fb115ee8f6475ad3984fd4b110c159d9a625256e0c206089a075f04b0da87c991749652
Request Chain 39
  • https://x.dlx.addthis.com/e/demdex_sync?na_exid=70559885886796118184228049582252341031&ru=https%3A%2F%2Fdpm.demdex.net%2Fibs%3Adpid%3D134096%26dpuuid%3D%3Cna_id%3E%20 HTTP 301
  • https://dpm.demdex.net/ibs:dpid=134096&dpuuid=2021041419125900012764515229
Request Chain 40
  • https://cm.g.doubleclick.net/pixel?google_nid=adobe_dmp&google_cm&gdpr=0&gdpr_consent=&google_hm=NzA1NTk4ODU4ODY3OTYxMTgxODQyMjgwNDk1ODIyNTIzNDEwMzE= HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=adobe_dmp&google_cm=&gdpr=0&gdpr_consent=&google_hm=NzA1NTk4ODU4ODY3OTYxMTgxODQyMjgwNDk1ODIyNTIzNDEwMzE=&google_tc= HTTP 302
  • https://dpm.demdex.net/ibs:dpid=771&dpuuid=CAESEDnq9QiSEcUznZ3ZHYZDSew&google_cver=1?gdpr=0&gdpr_consent=
Request Chain 41
  • https://p.rfihub.com/cm?in=1&pub=7085 HTTP 302
  • https://dpm.demdex.net/ibs:dpid=1121&dpuuid=1871316019206206694 HTTP 302
  • https://dpm.demdex.net/demconf.jpg?et:ibs%7cdata:dpid=1121&dpuuid=1871316019206206694
Request Chain 42
  • https://ps.eyeota.net/match?bid=6j5b2cv&uid=70559885886796118184228049582252341031&r=https%3A%2F%2Fdpm.demdex.net%2Fibs%3Adpid%3D30064%26dpuuid%3D%7BUUID_6j5b2cv%7D HTTP 302
  • https://dpm.demdex.net/ibs:dpid=30064&dpuuid=%7BUUID_6j5b2cv%7D
Request Chain 43
  • https://sync.crwdcntrl.net/map/c=9828/tp=ADBE/tpid=70559885886796118184228049582252341031?https%3A%2F%2Fdpm.demdex.net%2Fibs%3Adpid%3D121998%26dpuuid%3D${profile_id} HTTP 302
  • https://sync.crwdcntrl.net/map/ct=y/c=9828/tp=ADBE/tpid=70559885886796118184228049582252341031?https%3A%2F%2Fdpm.demdex.net%2Fibs%3Adpid%3D121998%26dpuuid%3D${profile_id} HTTP 302
  • https://dpm.demdex.net/ibs:dpid=121998&dpuuid=860528c32a0d7cfed1f7e0f8f5826ef5
Request Chain 44
  • https://sync-tm.everesttech.net/upi/pid/5w3jqr4k?redir=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dg8f47s39e399f3fe%26google_push%26google_sc%26google_hm%3D%24%7BTM_USER_ID_BASE64ENC_URLENC%7D HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=g8f47s39e399f3fe&google_push&google_sc&google_hm=WUhjX3V3QUFBR0RCaHhOZw==
Request Chain 45
  • https://sync-tm.everesttech.net/upi/pid/btu4jd3a?redir=https%3A%2F%2Fpixel.rubiconproject.com%2Ftap.php%3Fv%3D7941%26nid%3D2243%26put%3D%24%7BUSER_ID%7D%26expires%3D90 HTTP 302
  • https://pixel.rubiconproject.com/tap.php?v=7941&nid=2243&put=YHc_uwAAAGDBhxNg&expires=90
Request Chain 47
  • https://sync-tm.everesttech.net/upi/pid/ZMAwryCI?redir=https%3A%2F%2Fdsum-sec.casalemedia.com%2Frum%3Fcm_dsp_id%3D88%26external_user_id%3D%24%7BTM_USER_ID%7D HTTP 302
  • https://dsum-sec.casalemedia.com/rum?cm_dsp_id=88&external_user_id=YHc_uwAAAGDBhxNg HTTP 302
  • https://dsum-sec.casalemedia.com/rum?cm_dsp_id=88&external_user_id=YHc_uwAAAGDBhxNg&C=1
Request Chain 49
  • https://sync-tm.everesttech.net/upi/pid/UH6TUt9n?redir=https%3A%2F%2Fib.adnxs.com%2Fsetuid%3Fentity%3D158%26code%3D%24%7BTM_USER_ID%7D HTTP 302
  • https://ib.adnxs.com/setuid?entity=158&code=YHc_uwAAAGDBhxNg HTTP 307
  • https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D158%26code%3DYHc_uwAAAGDBhxNg
Request Chain 50
  • https://sync-tm.everesttech.net/upi/pid/ny75r2x0?redir=https%3A%2F%2Fus-u.openx.net%2Fw%2F1.0%2Fsd%3Fid%3D537148856%26val%3D%24%7BTM_USER_ID%7D HTTP 302
  • https://us-u.openx.net/w/1.0/sd?id=537148856&val=YHc_uwAAAGDBhxNg HTTP 302
  • https://us-u.openx.net/w/1.0/sd?cc=1&id=537148856&val=YHc_uwAAAGDBhxNg
Request Chain 51
  • https://sync-tm.everesttech.net/upi/pid/b9pj45k4?redir=https%3A%2F%2Fimage2.pubmatic.com%2FAdServer%2FPug%3Fvcode%3Dbz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA%3D%26piggybackCookie%3D%24%7BUSER_ID%7D HTTP 302
  • https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA=&piggybackCookie=YHc_uwAAAGDBhxNg
Request Chain 52
  • https://sync-tm.everesttech.net/upi/pid/h0r58thg?redir=https%3A%2F%2Fsync.search.spotxchange.com%2Fpartner%3Fadv_id%3D6409%26uid%3D%24%7BUSER_ID%7D%26img%3D1 HTTP 302
  • https://sync.search.spotxchange.com/partner?adv_id=6409&uid=YHc_uwAAAGDBhxNg&img=1 HTTP 302
  • https://sync.search.spotxchange.com/partner?adv_id=6409&uid=YHc_uwAAAGDBhxNg&img=1&__user_check__=1&sync_id=6d8ac2d5-9d55-11eb-861c-1ef5e1e54d06
Request Chain 53
  • https://sync-tm.everesttech.net/upi/pid/r7ifn0SL?redir=https%3A%2F%2Fwww.facebook.com%2Ffr%2Fb.php%3Fp%3D1531105787105294%26e%3D%24%7BTM_USER_ID%7D%26t%3D2592000%26o%3D0 HTTP 302
  • https://www.facebook.com/fr/b.php?p=1531105787105294&e=YHc_uwAAAGDBhxNg&t=2592000&o=0
Request Chain 58
  • https://sync.crwdcntrl.net/map/c=9828/tp=ADBE/tpid=70559885886796118184228049582252341031?https%3A%2F%2Fdpm.demdex.net%2Fibs%3Adpid%3D121998%26dpuuid%3D${profile_id} HTTP 302
  • https://sync.crwdcntrl.net/map/ct=y/c=9828/tp=ADBE/tpid=70559885886796118184228049582252341031?https%3A%2F%2Fdpm.demdex.net%2Fibs%3Adpid%3D121998%26dpuuid%3D${profile_id} HTTP 302
  • https://dpm.demdex.net/ibs:dpid=121998&dpuuid=860528c32a0d7cfed1f7e0f8f5826ef5 HTTP 302
  • https://dpm.demdex.net/demconf.jpg?et:ibs%7cdata:dpid=121998&dpuuid=860528c32a0d7cfed1f7e0f8f5826ef5
Request Chain 59
  • https://sync-tm.everesttech.net/upi/pid/5w3jqr4k?redir=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dg8f47s39e399f3fe%26google_push%26google_sc%26google_hm%3D%24%7BTM_USER_ID_BASE64ENC_URLENC%7D HTTP 302
  • https://sync-tm.everesttech.net/ct/upi/pid/5w3jqr4k?redir=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dg8f47s39e399f3fe%26google_push%26google_sc%26google_hm%3D%24%7BTM_USER_ID_BASE64ENC_URLENC%7D&_test=YHc_vAAAFiNf2AAC HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=g8f47s39e399f3fe&google_push&google_sc&google_hm=WUhjX3ZBQUFGaU5mMkFBQw==&_test=YHc_vAAAFiNf2AAC HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=g8f47s39e399f3fe&google_push=&google_sc=&google_hm=WUhjX3ZBQUFGaU5mMkFBQw==&_test=YHc_vAAAFiNf2AAC&google_tc=
Request Chain 60
  • https://sync-tm.everesttech.net/upi/pid/btu4jd3a?redir=https%3A%2F%2Fpixel.rubiconproject.com%2Ftap.php%3Fv%3D7941%26nid%3D2243%26put%3D%24%7BUSER_ID%7D%26expires%3D90 HTTP 302
  • https://sync-tm.everesttech.net/ct/upi/pid/btu4jd3a?redir=https%3A%2F%2Fpixel.rubiconproject.com%2Ftap.php%3Fv%3D7941%26nid%3D2243%26put%3D%24%7BUSER_ID%7D%26expires%3D90&_test=YHc_vAAAFXZgJQAC HTTP 302
  • https://pixel.rubiconproject.com/tap.php?v=7941&nid=2243&put=YHc_vAAAFXZgJQAC&expires=90&_test=YHc_vAAAFXZgJQAC
Request Chain 61
  • https://sync-tm.everesttech.net/upi/pid/ZMAwryCI?redir=https%3A%2F%2Fdsum-sec.casalemedia.com%2Frum%3Fcm_dsp_id%3D88%26external_user_id%3D%24%7BTM_USER_ID%7D HTTP 302
  • https://sync-tm.everesttech.net/ct/upi/pid/ZMAwryCI?redir=https%3A%2F%2Fdsum-sec.casalemedia.com%2Frum%3Fcm_dsp_id%3D88%26external_user_id%3D%24%7BTM_USER_ID%7D&_test=YHc_vAAAF3kfdwA4
Request Chain 62
  • https://sync-tm.everesttech.net/upi/pid/UH6TUt9n?redir=https%3A%2F%2Fib.adnxs.com%2Fsetuid%3Fentity%3D158%26code%3D%24%7BTM_USER_ID%7D HTTP 302
  • https://sync-tm.everesttech.net/ct/upi/pid/UH6TUt9n?redir=https%3A%2F%2Fib.adnxs.com%2Fsetuid%3Fentity%3D158%26code%3D%24%7BTM_USER_ID%7D&_test=YHc_vAAAFgJgqgAC HTTP 302
  • https://ib.adnxs.com/setuid?entity=158&code=YHc_vAAAFgJgqgAC&_test=YHc_vAAAFgJgqgAC
Request Chain 66
  • https://sync-tm.everesttech.net/upi/pid/ny75r2x0?redir=https%3A%2F%2Fus-u.openx.net%2Fw%2F1.0%2Fsd%3Fid%3D537148856%26val%3D%24%7BTM_USER_ID%7D HTTP 302
  • https://sync-tm.everesttech.net/ct/upi/pid/ny75r2x0?redir=https%3A%2F%2Fus-u.openx.net%2Fw%2F1.0%2Fsd%3Fid%3D537148856%26val%3D%24%7BTM_USER_ID%7D&_test=YHc_vAAAFpZNRQBg HTTP 302
  • https://us-u.openx.net/w/1.0/sd?id=537148856&val=YHc_vAAAFpZNRQBg&_test=YHc_vAAAFpZNRQBg
Request Chain 67
  • https://sync-tm.everesttech.net/upi/pid/b9pj45k4?redir=https%3A%2F%2Fimage2.pubmatic.com%2FAdServer%2FPug%3Fvcode%3Dbz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA%3D%26piggybackCookie%3D%24%7BUSER_ID%7D HTTP 302
  • https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA=&piggybackCookie=YHc_vAAAFpZNRQBg
Request Chain 68
  • https://sync-tm.everesttech.net/upi/pid/r7ifn0SL?redir=https%3A%2F%2Fwww.facebook.com%2Ffr%2Fb.php%3Fp%3D1531105787105294%26e%3D%24%7BTM_USER_ID%7D%26t%3D2592000%26o%3D0 HTTP 302
  • https://www.facebook.com/fr/b.php?p=1531105787105294&e=YHc_vAAAFpZNRQBg&t=2592000&o=0

86 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request login.php
www.citi-securedauth.dnset.com/
Redirect Chain
  • https://www.citi-securedauth.dnset.com/
  • https://www.citi-securedauth.dnset.com/login.php?online_id=2f9283adc38be4c9014bbf632&country=France&iso=FR
26 KB
26 KB
Document
General
Full URL
https://www.citi-securedauth.dnset.com/login.php?online_id=2f9283adc38be4c9014bbf632&country=France&iso=FR
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
129.146.137.235 Phoenix, United States, ASN31898 (ORACLE-BMC-31898, US),
Reverse DNS
Software
Apache /
Resource Hash
bacfd23af9c90b604030b1fde7b8b7ca90f47c6902724d666a99e02ea36d682c

Request headers

Host
www.citi-securedauth.dnset.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site
none
Sec-Fetch-Mode
navigate
Sec-Fetch-User
?1
Sec-Fetch-Dest
document
Accept-Encoding
gzip, deflate, br
Accept-Language
en-US
Cookie
PHPSESSID=6f6a4dd48137d2bf99381fe4a7209be0
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Wed, 14 Apr 2021 19:12:58 GMT
Server
Apache
Keep-Alive
timeout=5, max=99
Connection
Keep-Alive
Transfer-Encoding
chunked
Content-Type
text/html; charset=UTF-8

Redirect headers

Date
Wed, 14 Apr 2021 19:12:57 GMT
Server
Apache
Expires
Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control
no-store, no-cache, must-revalidate
Pragma
no-cache
Set-Cookie
PHPSESSID=6f6a4dd48137d2bf99381fe4a7209be0; path=/
Location
login.php?online_id=2f9283adc38be4c9014bbf632&country=France&iso=FR
Keep-Alive
timeout=5, max=100
Connection
Keep-Alive
Transfer-Encoding
chunked
Content-Type
text/html; charset=UTF-8
Bootstrap.js
nexus.ensighten.com/citizensbank/olbprod/
86 KB
28 KB
Script
General
Full URL
https://nexus.ensighten.com/citizensbank/olbprod/Bootstrap.js
Requested by
Host: www.citi-securedauth.dnset.com
URL: https://www.citi-securedauth.dnset.com/login.php?online_id=2f9283adc38be4c9014bbf632&country=France&iso=FR
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
18.197.253.20 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-18-197-253-20.eu-central-1.compute.amazonaws.com
Software
nginx /
Resource Hash
3c1833f23523e4b36106538cf009a443e93fbb009bf44c2237a3ae7889d5cd77

Request headers

Referer
https://www.citi-securedauth.dnset.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Wed, 14 Apr 2021 19:12:58 GMT
content-encoding
gzip
last-modified
Wed, 07 Apr 2021 18:28:30 GMT
server
nginx
etag
W/"606df9ce-15797"
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
cache-control
max-age=300
pm_fp.js
www.citi-securedauth.dnset.com/efs/efs/jsp-ns/
0
0
Script
General
Full URL
https://www.citi-securedauth.dnset.com/efs/efs/jsp-ns/pm_fp.js
Requested by
Host: www.citi-securedauth.dnset.com
URL: https://www.citi-securedauth.dnset.com/login.php?online_id=2f9283adc38be4c9014bbf632&country=France&iso=FR
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
129.146.137.235 Phoenix, United States, ASN31898 (ORACLE-BMC-31898, US),
Reverse DNS
Software
Apache /
Resource Hash

Request headers

Referer
https://www.citi-securedauth.dnset.com/login.php?online_id=2f9283adc38be4c9014bbf632&country=France&iso=FR
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Wed, 14 Apr 2021 19:12:58 GMT
Server
Apache
Connection
Keep-Alive
Keep-Alive
timeout=5, max=100
Content-Length
315
Content-Type
text/html; charset=iso-8859-1
jquery-ui-1.10.3.custom.min.css
www3.citizensbankonline.com/efs/efs/jsp-ns/inc/css/
19 KB
4 KB
Stylesheet
General
Full URL
https://www3.citizensbankonline.com/efs/efs/jsp-ns/inc/css/jquery-ui-1.10.3.custom.min.css
Requested by
Host: www.citi-securedauth.dnset.com
URL: https://www.citi-securedauth.dnset.com/login.php?online_id=2f9283adc38be4c9014bbf632&country=France&iso=FR
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.109.73.152 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-109-73-152.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
7aaf6df215bb7018439342fe6bcd1058de3e7dfa2c7b4e1176c842b1a8e529ac
Security Headers
Name Value
Strict-Transport-Security max-age=15768000
X-Frame-Options SAMEORIGIN

Request headers

Referer
https://www.citi-securedauth.dnset.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Wed, 14 Apr 2021 19:12:58 GMT
content-encoding
gzip
server-timing
cdn-cache; desc=HIT, edge; dur=1
content-length
3780
x-olb-req-received
t=1618132338216761
last-modified
Fri, 19 Mar 2021 01:07:14 GMT
x-frame-options
SAMEORIGIN
etag
"420ebf-4a56-5bdd9562e3b1a"
vary
Accept-Encoding
strict-transport-security
max-age=15768000
content-type
text/css
access-control-allow-origin
*
expires
Thu, 15 Apr 2021 02:01:14 GMT
cache-control
max-age=24496
accept-ranges
bytes
lb-action
None
x-olb-req-duration
D=1780
normalize.css
www3.citizensbankonline.com/efs/efs/jsp-ns/inc/css/
10 KB
3 KB
Stylesheet
General
Full URL
https://www3.citizensbankonline.com/efs/efs/jsp-ns/inc/css/normalize.css
Requested by
Host: www.citi-securedauth.dnset.com
URL: https://www.citi-securedauth.dnset.com/login.php?online_id=2f9283adc38be4c9014bbf632&country=France&iso=FR
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.109.73.152 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-109-73-152.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
91afb84bded857517d6a7e43932e3d4a43eaf42d1e4d0b77a8bc9c07973e21d2
Security Headers
Name Value
Strict-Transport-Security max-age=15768000
X-Frame-Options SAMEORIGIN

Request headers

Referer
https://www.citi-securedauth.dnset.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Wed, 14 Apr 2021 19:12:58 GMT
content-encoding
gzip
server-timing
cdn-cache; desc=HIT, edge; dur=1
content-length
2766
x-olb-req-received
t=1618210128004844
last-modified
Fri, 19 Mar 2021 01:07:15 GMT
x-frame-options
SAMEORIGIN
etag
"420ee9-26c2-5bdd9562f0253"
vary
Accept-Encoding
strict-transport-security
max-age=15768000
content-type
text/css
access-control-allow-origin
*
expires
Thu, 15 Apr 2021 02:02:00 GMT
cache-control
max-age=24542
accept-ranges
bytes
lb-action
None
x-olb-req-duration
D=1445
main.css
www3.citizensbankonline.com/efs/efs/jsp-ns/inc/css/
61 KB
12 KB
Stylesheet
General
Full URL
https://www3.citizensbankonline.com/efs/efs/jsp-ns/inc/css/main.css
Requested by
Host: www.citi-securedauth.dnset.com
URL: https://www.citi-securedauth.dnset.com/login.php?online_id=2f9283adc38be4c9014bbf632&country=France&iso=FR
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.109.73.152 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-109-73-152.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
66a13cad6c244da4061da65fd2fbf027bf1bb49e21c42f5e7c943a9379f1e7c4
Security Headers
Name Value
Strict-Transport-Security max-age=15768000
X-Frame-Options SAMEORIGIN

Request headers

Referer
https://www.citi-securedauth.dnset.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Wed, 14 Apr 2021 19:12:58 GMT
content-encoding
gzip
server-timing
cdn-cache; desc=HIT, edge; dur=1
content-length
12357
x-olb-req-received
t=1618132346190071
last-modified
Fri, 19 Mar 2021 01:07:14 GMT
x-frame-options
SAMEORIGIN
etag
"420eba-f405-5bdd9562e2792"
vary
Accept-Encoding
strict-transport-security
max-age=15768000
content-type
text/css
access-control-allow-origin
*
expires
Thu, 15 Apr 2021 02:00:44 GMT
cache-control
max-age=24466
accept-ranges
bytes
lb-action
None
x-olb-req-duration
D=4566
flows.css
www3.citizensbankonline.com/efs/efs/jsp-ns/inc/css/
8 KB
3 KB
Stylesheet
General
Full URL
https://www3.citizensbankonline.com/efs/efs/jsp-ns/inc/css/flows.css
Requested by
Host: www.citi-securedauth.dnset.com
URL: https://www.citi-securedauth.dnset.com/login.php?online_id=2f9283adc38be4c9014bbf632&country=France&iso=FR
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.109.73.152 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-109-73-152.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
99373341554ceaade5ea6c81725f1cd4d05e906621a15797d99d01343ae551f8
Security Headers
Name Value
Strict-Transport-Security max-age=15768000
X-Frame-Options SAMEORIGIN

Request headers

Referer
https://www.citi-securedauth.dnset.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Wed, 14 Apr 2021 19:12:58 GMT
content-encoding
gzip
server-timing
cdn-cache; desc=HIT, edge; dur=1
content-length
2391
x-olb-req-received
t=1618365688339708
last-modified
Fri, 19 Mar 2021 01:07:14 GMT
x-frame-options
SAMEORIGIN
etag
"420ebe-21ce-5bdd9562e3732"
vary
Accept-Encoding
strict-transport-security
max-age=15768000
content-type
text/css
access-control-allow-origin
*
expires
Thu, 15 Apr 2021 02:02:28 GMT
cache-control
max-age=24570
accept-ranges
bytes
lb-action
None
x-olb-req-duration
D=2433
ad-containers.css
www3.citizensbankonline.com/efs/efs/jsp-ns/inc/css/
8 KB
2 KB
Stylesheet
General
Full URL
https://www3.citizensbankonline.com/efs/efs/jsp-ns/inc/css/ad-containers.css
Requested by
Host: www.citi-securedauth.dnset.com
URL: https://www.citi-securedauth.dnset.com/login.php?online_id=2f9283adc38be4c9014bbf632&country=France&iso=FR
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.109.73.152 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-109-73-152.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
c8a977fd23fc151d7944387ad07220eb673de84b4343d6304efe5a8e1c061b02
Security Headers
Name Value
Strict-Transport-Security max-age=15768000
X-Frame-Options SAMEORIGIN

Request headers

Referer
https://www.citi-securedauth.dnset.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Wed, 14 Apr 2021 19:12:58 GMT
content-encoding
gzip
server-timing
cdn-cache; desc=HIT, edge; dur=1
content-length
1521
x-olb-req-received
t=1618210205164811
last-modified
Fri, 19 Mar 2021 01:07:15 GMT
x-frame-options
SAMEORIGIN
etag
"420eec-1f31-5bdd9562f0e0b"
vary
Accept-Encoding
strict-transport-security
max-age=15768000
content-type
text/css
access-control-allow-origin
*
expires
Thu, 15 Apr 2021 02:00:32 GMT
cache-control
max-age=24454
accept-ranges
bytes
lb-action
None
x-olb-req-duration
D=1880
modernizr-2.6.2.min.js
www3.citizensbankonline.com/efs/efs/jsp-ns/scripts/
15 KB
6 KB
Script
General
Full URL
https://www3.citizensbankonline.com/efs/efs/jsp-ns/scripts/modernizr-2.6.2.min.js
Requested by
Host: www.citi-securedauth.dnset.com
URL: https://www.citi-securedauth.dnset.com/login.php?online_id=2f9283adc38be4c9014bbf632&country=France&iso=FR
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.109.73.152 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-109-73-152.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
cf25ec18f223f4c51ce1128a42e644cdc2244d88f89d1a51440d9dbe51f4efe8
Security Headers
Name Value
Strict-Transport-Security max-age=15768000
X-Frame-Options SAMEORIGIN

Request headers

Referer
https://www.citi-securedauth.dnset.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Wed, 14 Apr 2021 19:12:58 GMT
content-encoding
gzip
server-timing
cdn-cache; desc=HIT, edge; dur=1
content-length
6246
x-olb-req-received
t=1618132326861323
last-modified
Fri, 19 Mar 2021 01:02:43 GMT
x-frame-options
SAMEORIGIN
etag
"420409-3c36-5bdd945fd7ee0"
vary
Accept-Encoding
strict-transport-security
max-age=15768000
content-type
application/x-javascript
access-control-allow-origin
*
expires
Thu, 15 Apr 2021 02:02:34 GMT
cache-control
max-age=24576
accept-ranges
bytes
lb-action
None
x-olb-req-duration
D=1700
plugins.js
www3.citizensbankonline.com/efs/efs/jsp-ns/scripts/
199 KB
45 KB
Script
General
Full URL
https://www3.citizensbankonline.com/efs/efs/jsp-ns/scripts/plugins.js
Requested by
Host: www.citi-securedauth.dnset.com
URL: https://www.citi-securedauth.dnset.com/login.php?online_id=2f9283adc38be4c9014bbf632&country=France&iso=FR
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.109.73.152 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-109-73-152.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
b769305d18e59ddd6f13c3fb6db4f90a15770b3717aaddbadb6e543918178bc8
Security Headers
Name Value
Strict-Transport-Security max-age=15768000
X-Frame-Options SAMEORIGIN

Request headers

Referer
https://www.citi-securedauth.dnset.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Wed, 14 Apr 2021 19:12:58 GMT
content-encoding
gzip
server-timing
cdn-cache; desc=HIT, edge; dur=1
content-length
46041
x-olb-req-received
t=1618132338641829
last-modified
Fri, 19 Mar 2021 01:07:15 GMT
x-frame-options
SAMEORIGIN
etag
"420f11-31d24-5bdd9562fb604"
vary
Accept-Encoding
strict-transport-security
max-age=15768000
content-type
application/x-javascript
access-control-allow-origin
*
expires
Thu, 15 Apr 2021 02:01:04 GMT
cache-control
max-age=24486
accept-ranges
bytes
lb-action
None
x-olb-req-duration
D=13812
main.js
www3.citizensbankonline.com/efs/efs/jsp-ns/scripts/
19 KB
5 KB
Script
General
Full URL
https://www3.citizensbankonline.com/efs/efs/jsp-ns/scripts/main.js
Requested by
Host: www.citi-securedauth.dnset.com
URL: https://www.citi-securedauth.dnset.com/login.php?online_id=2f9283adc38be4c9014bbf632&country=France&iso=FR
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.109.73.152 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-109-73-152.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
57a2dc0af7db36023b2b6c53e01dbd8e716d96174486ad20d68b2549589c5441
Security Headers
Name Value
Strict-Transport-Security max-age=15768000
X-Frame-Options SAMEORIGIN

Request headers

Referer
https://www.citi-securedauth.dnset.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Wed, 14 Apr 2021 19:12:58 GMT
content-encoding
gzip
server-timing
cdn-cache; desc=HIT, edge; dur=1
content-length
4818
x-olb-req-received
t=1618210111310803
last-modified
Fri, 19 Mar 2021 01:07:15 GMT
x-frame-options
SAMEORIGIN
etag
"420ef7-4c03-5bdd9562f3cec"
vary
Accept-Encoding
strict-transport-security
max-age=15768000
content-type
application/x-javascript
access-control-allow-origin
*
expires
Thu, 15 Apr 2021 02:00:55 GMT
cache-control
max-age=24477
accept-ranges
bytes
lb-action
None
x-olb-req-duration
D=2353
placeholders.min.js
www3.citizensbankonline.com/efs/efs/jsp-ns/scripts/
4 KB
2 KB
Script
General
Full URL
https://www3.citizensbankonline.com/efs/efs/jsp-ns/scripts/placeholders.min.js
Requested by
Host: www.citi-securedauth.dnset.com
URL: https://www.citi-securedauth.dnset.com/login.php?online_id=2f9283adc38be4c9014bbf632&country=France&iso=FR
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.109.73.152 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-109-73-152.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
babf6fd29c079790cc4d522f66f21af7c099e981080ddf11b5344b12b904e8a5
Security Headers
Name Value
Strict-Transport-Security max-age=15768000
X-Frame-Options SAMEORIGIN

Request headers

Referer
https://www.citi-securedauth.dnset.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Wed, 14 Apr 2021 19:12:58 GMT
content-encoding
gzip
server-timing
cdn-cache; desc=HIT, edge; dur=1
content-length
1633
x-olb-req-received
t=1618287922135691
last-modified
Fri, 19 Mar 2021 01:07:15 GMT
x-frame-options
SAMEORIGIN
etag
"420ef0-10aa-5bdd9562f1dab"
vary
Accept-Encoding
strict-transport-security
max-age=15768000
content-type
application/x-javascript
access-control-allow-origin
*
expires
Thu, 15 Apr 2021 02:02:36 GMT
cache-control
max-age=24578
accept-ranges
bytes
lb-action
None
x-olb-req-duration
D=1728
7c3ed55c
www4.citizensbankonline.com/akam/11/
0
0
Script
General
Full URL
https://www4.citizensbankonline.com/akam/11/7c3ed55c
Requested by
Host: www.citi-securedauth.dnset.com
URL: https://www.citi-securedauth.dnset.com/login.php?online_id=2f9283adc38be4c9014bbf632&country=France&iso=FR
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.109.73.152 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-109-73-152.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=15768000

Request headers

Referer
https://www.citi-securedauth.dnset.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Wed, 14 Apr 2021 19:12:59 GMT
strict-transport-security
max-age=15768000
content-type
text/html
expires
Wed, 14 Apr 2021 19:12:59 GMT
cache-control
max-age=0
server-timing
cdn-cache; desc=HIT, edge; dur=1
content-length
9
lb-action
None
tealeaf.js
www3.citizensbankonline.com/efs/efs/js/
142 KB
46 KB
Script
General
Full URL
https://www3.citizensbankonline.com/efs/efs/js/tealeaf.js
Requested by
Host: www.citi-securedauth.dnset.com
URL: https://www.citi-securedauth.dnset.com/login.php?online_id=2f9283adc38be4c9014bbf632&country=France&iso=FR
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.109.73.152 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-109-73-152.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
17fe7608976bd36c4a3a135a8e922bd5bfb776cddc29246984ce6dd2978ef384
Security Headers
Name Value
Strict-Transport-Security max-age=15768000
X-Frame-Options SAMEORIGIN

Request headers

Referer
https://www.citi-securedauth.dnset.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Wed, 14 Apr 2021 19:12:58 GMT
content-encoding
gzip
server-timing
cdn-cache; desc=HIT, edge; dur=1
content-length
46248
x-olb-req-received
t=1618132337745789
last-modified
Fri, 19 Mar 2021 01:07:14 GMT
x-frame-options
SAMEORIGIN
etag
"42109a-237a8-5bdd9562decfa"
vary
Accept-Encoding
strict-transport-security
max-age=15768000
content-type
application/x-javascript
access-control-allow-origin
*
expires
Thu, 15 Apr 2021 02:00:26 GMT
cache-control
max-age=24448
accept-ranges
bytes
lb-action
None
x-olb-req-duration
D=11409
CTZ_Green-01.png
www3.citizensbankonline.com/efs/hhf/img/
4 KB
4 KB
Image
General
Full URL
https://www3.citizensbankonline.com/efs/hhf/img/CTZ_Green-01.png
Requested by
Host: www.citi-securedauth.dnset.com
URL: https://www.citi-securedauth.dnset.com/login.php?online_id=2f9283adc38be4c9014bbf632&country=France&iso=FR
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.109.73.152 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-109-73-152.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
c401ce328e0383e71cd811709055aa8671cee50e355c6588bd567c1320b4e4ab
Security Headers
Name Value
Strict-Transport-Security max-age=15768000
X-Frame-Options SAMEORIGIN

Request headers

Referer
https://www.citi-securedauth.dnset.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Wed, 14 Apr 2021 19:12:59 GMT
x-olb-req-received
t=1618132337705551
last-modified
Sat, 09 May 2020 03:12:34 GMT
etag
"42040f-106e-5a52e7c3bf25f"
x-frame-options
SAMEORIGIN
content-type
image/png
access-control-allow-origin
*
cache-control
max-age=309534
x-olb-req-duration
D=767
server-timing
cdn-cache; desc=HIT, edge; dur=1
content-length
4206
strict-transport-security
max-age=15768000
accept-ranges
bytes
lb-action
None
expires
Sun, 18 Apr 2021 09:11:53 GMT
citizensHeaderFooter-citizensns42588.js
www.citi-securedauth.dnset.com/efs/hhf/js/
0
0
Script
General
Full URL
https://www.citi-securedauth.dnset.com/efs/hhf/js/citizensHeaderFooter-citizensns42588.js
Requested by
Host: www.citi-securedauth.dnset.com
URL: https://www.citi-securedauth.dnset.com/login.php?online_id=2f9283adc38be4c9014bbf632&country=France&iso=FR
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
129.146.137.235 Phoenix, United States, ASN31898 (ORACLE-BMC-31898, US),
Reverse DNS
Software
Apache /
Resource Hash

Request headers

Referer
https://www.citi-securedauth.dnset.com/login.php?online_id=2f9283adc38be4c9014bbf632&country=France&iso=FR
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Wed, 14 Apr 2021 19:12:58 GMT
Server
Apache
Connection
Keep-Alive
Keep-Alive
timeout=5, max=98
Content-Length
315
Content-Type
text/html; charset=iso-8859-1
930e113327rn2365aa3b7b98b0447e8d
www.citi-securedauth.dnset.com/content/
0
0
Script
General
Full URL
https://www.citi-securedauth.dnset.com/content/930e113327rn2365aa3b7b98b0447e8d
Requested by
Host: www.citi-securedauth.dnset.com
URL: https://www.citi-securedauth.dnset.com/login.php?online_id=2f9283adc38be4c9014bbf632&country=France&iso=FR
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
129.146.137.235 Phoenix, United States, ASN31898 (ORACLE-BMC-31898, US),
Reverse DNS
Software
Apache /
Resource Hash

Request headers

Referer
https://www.citi-securedauth.dnset.com/login.php?online_id=2f9283adc38be4c9014bbf632&country=France&iso=FR
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Wed, 14 Apr 2021 19:12:58 GMT
Server
Apache
Connection
Keep-Alive
Keep-Alive
timeout=5, max=99
Content-Length
315
Content-Type
text/html; charset=iso-8859-1
common.js
www.citi-securedauth.dnset.com/efs/efs/jsp-ns/scripts/
0
0
Script
General
Full URL
https://www.citi-securedauth.dnset.com/efs/efs/jsp-ns/scripts/common.js
Requested by
Host: www.citi-securedauth.dnset.com
URL: https://www.citi-securedauth.dnset.com/login.php?online_id=2f9283adc38be4c9014bbf632&country=France&iso=FR
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
129.146.137.235 Phoenix, United States, ASN31898 (ORACLE-BMC-31898, US),
Reverse DNS
Software
Apache /
Resource Hash

Request headers

Referer
https://www.citi-securedauth.dnset.com/login.php?online_id=2f9283adc38be4c9014bbf632&country=France&iso=FR
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Wed, 14 Apr 2021 19:12:59 GMT
Server
Apache
Connection
Keep-Alive
Keep-Alive
timeout=5, max=96
Content-Length
315
Content-Type
text/html; charset=iso-8859-1
rd
dpm.demdex.net/id/
Redirect Chain
  • https://dpm.demdex.net/id?d_visid_ver=2.1.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=4C3B0C3755C3822E7F000101%40AdobeOrg&d_nsid=0&ts=1618427578907
  • https://dpm.demdex.net/id/rd?d_visid_ver=2.1.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=4C3B0C3755C3822E7F000101%40AdobeOrg&d_nsid=0&ts=1618427578907
4 KB
2 KB
XHR
General
Full URL
https://dpm.demdex.net/id/rd?d_visid_ver=2.1.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=4C3B0C3755C3822E7F000101%40AdobeOrg&d_nsid=0&ts=1618427578907
Requested by
Host: www.citi-securedauth.dnset.com
URL: https://www.citi-securedauth.dnset.com/login.php?online_id=2f9283adc38be4c9014bbf632&country=France&iso=FR
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
18.200.157.96 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-18-200-157-96.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash
a34a2cc88b5ee938fdebdd26a120fcd6ef25d687936fd361d41d803288f39aa2
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Referer
https://www.citi-securedauth.dnset.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

DCS
dcs-prod-irl1-v090-05d9d235b.edge-irl1.demdex.com 5.80.7.20210304103356 3ms (+1ms)
Pragma
no-cache
Strict-Transport-Security
max-age=31536000; includeSubDomains
Content-Encoding
gzip
X-TID
xlZgEOE2RNE=
Vary
Origin, Accept-Encoding, User-Agent
P3P
policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Access-Control-Allow-Origin
https://www.citi-securedauth.dnset.com
Cache-Control
no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
application/json;charset=utf-8
Content-Length
1307
Expires
Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

Pragma
no-cache
Strict-Transport-Security
max-age=31536000; includeSubDomains
Access-Control-Allow-Origin
https://www.citi-securedauth.dnset.com
X-TID
W1KoUWMdSac=
Vary
Origin
P3P
policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Location
https://dpm.demdex.net/id/rd?d_visid_ver=2.1.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=4C3B0C3755C3822E7F000101%40AdobeOrg&d_nsid=0&ts=1618427578907
Cache-Control
no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Length
0
Expires
Thu, 01 Jan 1970 00:00:00 GMT
pm_fp.js
www.citi-securedauth.dnset.com/efs/efs/jsp-ns/
0
0
Script
General
Full URL
https://www.citi-securedauth.dnset.com/efs/efs/jsp-ns/pm_fp.js
Requested by
Host: www.citi-securedauth.dnset.com
URL: https://www.citi-securedauth.dnset.com/login.php?online_id=2f9283adc38be4c9014bbf632&country=France&iso=FR
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
129.146.137.235 Phoenix, United States, ASN31898 (ORACLE-BMC-31898, US),
Reverse DNS
Software
Apache /
Resource Hash

Request headers

Referer
https://www.citi-securedauth.dnset.com/login.php?online_id=2f9283adc38be4c9014bbf632&country=France&iso=FR
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Wed, 14 Apr 2021 19:12:59 GMT
Server
Apache
Connection
Keep-Alive
Keep-Alive
timeout=5, max=97
Content-Length
315
Content-Type
text/html; charset=iso-8859-1
serverComponent.php
nexus.ensighten.com/citizensbank/olbprod/
281 B
423 B
Script
General
Full URL
https://nexus.ensighten.com/citizensbank/olbprod/serverComponent.php?r=62.41405491025378&namespace=Bootstrapper&staticJsPath=nexus.ensighten.com/citizensbank/olbprod/code/&publishedOn=Wed%20Apr%2007%2018:28:30%20GMT%202021&ClientID=397&PageID=https%3A%2F%2Fwww.citi-securedauth.dnset.com%2Flogin.php%3Fonline_id%3D2f9283adc38be4c9014bbf632%26country%3DFrance%26iso%3DFR
Requested by
Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citizensbank/olbprod/Bootstrap.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
18.197.253.20 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-18-197-253-20.eu-central-1.compute.amazonaws.com
Software
nginx /
Resource Hash
355dbaa7ae4da51b32cb42cc087e033d82758b4f6fa173d3c62529d8f70c3b26

Request headers

Referer
https://www.citi-securedauth.dnset.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Wed, 14 Apr 2021 19:12:59 GMT
cache-control
no-cache, no-store
server
nginx
content-type
text/javascript
content-length
281
expires
Wed, 14 Apr 2021 19:12:58 GMT
tag.js
lptag.liveperson.net/tag/
21 KB
8 KB
Script
General
Full URL
https://lptag.liveperson.net/tag/tag.js?site=89632304
Requested by
Host: www.citi-securedauth.dnset.com
URL: https://www.citi-securedauth.dnset.com/login.php?online_id=2f9283adc38be4c9014bbf632&country=France&iso=FR
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
178.249.97.23 , United Kingdom, ASN11054 (LIVEPERSON, US),
Reverse DNS
Software
ws /
Resource Hash
145d14bb73e5b03cc73062c2a78c392125b891c62b1cc9d542e5adba762f04e7

Request headers

Referer
https://www.citi-securedauth.dnset.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Wed, 14 Apr 2021 19:12:59 GMT
content-encoding
gzip
last-modified
Thu, 03 Sep 2020 08:27:49 GMT
server
ws
etag
"5f50a905-1d8f"
access-control-allow-methods
GET, POST, PATCH
content-type
application/javascript
access-control-expose-headers
X-Requested-With, X-HTTP-Method-Override, LP-DOMAIN-REFERER, LP-URL, ETag, ac-revision, X-LP-Last-Modified, If-Match, Authentication-Method, Credit-Card-Ref, Automation-Secret, Email-Token, x-lp-host, Lp-Req-Time, date, x-application-context, strict-transport-security, x-content-type-options, x-download-options, x-xss-protection, x-cache-status, x-amz-id-2, x-amz-request-id, expires, last-modified, set-cookie, content-security-policy, x-frame-options
cache-control
public, max-age=630
access-control-allow-credentials
true
access-control-allow-headers
Origin, X-Requested-With, Content-Type, Accept, Authorization, X-HTTP-Method-Override, LP-DOMAIN-REFERER, LP-URL, ETag, ac-revision, X-LP-Last-Modified, If-Match, Authentication-Method, Credit-Card-Ref, Automation-Secret, Email-Token
content-length
7567
citizen_roman.woff
www3.citizensbankonline.com/efs/efs/jsp-ns/inc/css/font/
31 KB
32 KB
Font
General
Full URL
https://www3.citizensbankonline.com/efs/efs/jsp-ns/inc/css/font/citizen_roman.woff
Requested by
Host: www3.citizensbankonline.com
URL: https://www3.citizensbankonline.com/efs/efs/jsp-ns/inc/css/main.css
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.109.73.152 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-109-73-152.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
c8b1f6c22756521c86a5b0053b8565b49436f7fa19d1bb7cdf00a7808df28d42
Security Headers
Name Value
Strict-Transport-Security max-age=15768000
X-Frame-Options SAMEORIGIN

Request headers

Origin
https://www.citi-securedauth.dnset.com
Referer
https://www3.citizensbankonline.com/efs/efs/jsp-ns/inc/css/main.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Wed, 14 Apr 2021 19:12:59 GMT
content-encoding
gzip
vary
Accept-Encoding
server-timing
cdn-cache; desc=HIT, edge; dur=1
content-length
31552
x-olb-req-received
t=1618132328734633
last-modified
Fri, 19 Mar 2021 01:02:43 GMT
etag
"4203dd-7ce0-5bdd945fcb7a7"
x-frame-options
SAMEORIGIN
strict-transport-security
max-age=15768000
content-type
text/plain
access-control-allow-origin
*
expires
Sun, 18 Apr 2021 09:14:00 GMT
cache-control
max-age=309661
accept-ranges
bytes
lb-action
None
x-olb-req-duration
D=899
jquery-1.9.1.min.js
www3.citizensbankonline.com/efs/efs/jsp-ns/scripts/
90 KB
32 KB
Script
General
Full URL
https://www3.citizensbankonline.com/efs/efs/jsp-ns/scripts/jquery-1.9.1.min.js
Requested by
Host: www.citi-securedauth.dnset.com
URL: https://www.citi-securedauth.dnset.com/login.php?online_id=2f9283adc38be4c9014bbf632&country=France&iso=FR
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.109.73.152 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-109-73-152.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
aa084d3968ab19898ebbed807ebc134b622fab78a888e7b36ae8386841636801
Security Headers
Name Value
Strict-Transport-Security max-age=15768000
X-Frame-Options SAMEORIGIN

Request headers

Referer
https://www.citi-securedauth.dnset.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Intervention
<https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

date
Wed, 14 Apr 2021 19:12:59 GMT
content-encoding
gzip
server-timing
cdn-cache; desc=HIT, edge; dur=1
content-length
32776
x-olb-req-received
t=1618210182242321
last-modified
Fri, 19 Mar 2021 01:07:15 GMT
x-frame-options
SAMEORIGIN
etag
"420ef2-169d6-5bdd9562f2963"
vary
Accept-Encoding
strict-transport-security
max-age=15768000
content-type
application/x-javascript
access-control-allow-origin
*
expires
Thu, 15 Apr 2021 02:02:01 GMT
cache-control
max-age=24542
accept-ranges
bytes
lb-action
None
x-olb-req-duration
D=8015
icon-secure.png
www3.citizensbankonline.com/efs/efs/grafx/
292 B
608 B
Image
General
Full URL
https://www3.citizensbankonline.com/efs/efs/grafx/icon-secure.png
Requested by
Host: www3.citizensbankonline.com
URL: https://www3.citizensbankonline.com/efs/efs/jsp-ns/inc/css/flows.css
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.109.73.152 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-109-73-152.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
c8d87d770112e188f7b1482e9a416ffc441a9a6e08e2fc38a886fa2986efdb46
Security Headers
Name Value
Strict-Transport-Security max-age=15768000
X-Frame-Options SAMEORIGIN

Request headers

Referer
https://www3.citizensbankonline.com/efs/efs/jsp-ns/inc/css/flows.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Wed, 14 Apr 2021 19:12:59 GMT
x-olb-req-received
t=1618132338723673
last-modified
Thu, 28 Jan 2021 03:56:01 GMT
etag
"20223-124-5b9edddb0eb46"
x-frame-options
SAMEORIGIN
content-type
image/png
access-control-allow-origin
*
cache-control
max-age=309526
x-olb-req-duration
D=478
server-timing
cdn-cache; desc=HIT, edge; dur=1
content-length
292
strict-transport-security
max-age=15768000
accept-ranges
bytes
lb-action
None
expires
Sun, 18 Apr 2021 09:11:45 GMT
flows-tooltip.png
www3.citizensbankonline.com/efs/efs/grafx/
364 B
681 B
Image
General
Full URL
https://www3.citizensbankonline.com/efs/efs/grafx/flows-tooltip.png
Requested by
Host: www3.citizensbankonline.com
URL: https://www3.citizensbankonline.com/efs/efs/jsp-ns/inc/css/flows.css
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.109.73.152 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-109-73-152.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
dfc042f7ff75f3c2f916bcfbff48c82834bab07b698a2c564906ca073f8286b2
Security Headers
Name Value
Strict-Transport-Security max-age=15768000
X-Frame-Options SAMEORIGIN

Request headers

Referer
https://www3.citizensbankonline.com/efs/efs/jsp-ns/inc/css/flows.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Wed, 14 Apr 2021 19:12:59 GMT
x-olb-req-received
t=1618132363081402
last-modified
Thu, 28 Jan 2021 03:56:06 GMT
etag
"20f9a-16c-5b9edddff0158"
x-frame-options
SAMEORIGIN
content-type
image/png
access-control-allow-origin
*
cache-control
max-age=309518
x-olb-req-duration
D=702
server-timing
cdn-cache; desc=HIT, edge; dur=1
content-length
364
strict-transport-security
max-age=15768000
accept-ranges
bytes
lb-action
None
expires
Sun, 18 Apr 2021 09:11:37 GMT
arrow-button-white.png
www3.citizensbankonline.com/efs/efs/grafx/
1017 B
1 KB
Image
General
Full URL
https://www3.citizensbankonline.com/efs/efs/grafx/arrow-button-white.png
Requested by
Host: www3.citizensbankonline.com
URL: https://www3.citizensbankonline.com/efs/efs/jsp-ns/inc/css/flows.css
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.109.73.152 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-109-73-152.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
ff327ec2a6dbd3fc76ceecf59e472d5d2f43c94dce851ced740abe5f75bb832e
Security Headers
Name Value
Strict-Transport-Security max-age=15768000
X-Frame-Options SAMEORIGIN

Request headers

Referer
https://www3.citizensbankonline.com/efs/efs/jsp-ns/inc/css/flows.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Wed, 14 Apr 2021 19:12:59 GMT
x-olb-req-received
t=1618132363120840
last-modified
Thu, 28 Jan 2021 03:56:06 GMT
etag
"20fc6-3f9-5b9edddffdc19"
x-frame-options
SAMEORIGIN
content-type
image/png
access-control-allow-origin
*
cache-control
max-age=309626
x-olb-req-duration
D=681
server-timing
cdn-cache; desc=HIT, edge; dur=1
content-length
1017
strict-transport-security
max-age=15768000
accept-ranges
bytes
lb-action
None
expires
Sun, 18 Apr 2021 09:13:25 GMT
arrow-down-blue.png
www3.citizensbankonline.com/efs/efs/grafx/
1 KB
1 KB
Image
General
Full URL
https://www3.citizensbankonline.com/efs/efs/grafx/arrow-down-blue.png
Requested by
Host: www3.citizensbankonline.com
URL: https://www3.citizensbankonline.com/efs/efs/jsp-ns/inc/css/main.css
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.109.73.152 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-109-73-152.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
56a8532b2a60ca2ae39c213f7e1e65e47834af927e6365444457f22ed12ed79c
Security Headers
Name Value
Strict-Transport-Security max-age=15768000
X-Frame-Options SAMEORIGIN

Request headers

Referer
https://www3.citizensbankonline.com/efs/efs/jsp-ns/inc/css/main.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Wed, 14 Apr 2021 19:12:59 GMT
x-olb-req-received
t=1618132372038160
last-modified
Thu, 28 Jan 2021 03:56:06 GMT
etag
"20f63-41e-5b9edddfdefe6"
x-frame-options
SAMEORIGIN
content-type
image/png
access-control-allow-origin
*
cache-control
max-age=309491
x-olb-req-duration
D=675
server-timing
cdn-cache; desc=HIT, edge; dur=1
content-length
1054
strict-transport-security
max-age=15768000
accept-ranges
bytes
lb-action
None
expires
Sun, 18 Apr 2021 09:11:10 GMT
arrow-right-orange.png
www3.citizensbankonline.com/efs/efs/grafx/
165 B
482 B
Image
General
Full URL
https://www3.citizensbankonline.com/efs/efs/grafx/arrow-right-orange.png
Requested by
Host: www3.citizensbankonline.com
URL: https://www3.citizensbankonline.com/efs/efs/jsp-ns/inc/css/main.css
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.109.73.152 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-109-73-152.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
bbb90a8f240e6dbbda1d3da534f8848f256e623ed470d045e1d86a465e424d69
Security Headers
Name Value
Strict-Transport-Security max-age=15768000
X-Frame-Options SAMEORIGIN

Request headers

Referer
https://www3.citizensbankonline.com/efs/efs/jsp-ns/inc/css/main.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Wed, 14 Apr 2021 19:12:59 GMT
x-olb-req-received
t=1618132329178463
last-modified
Thu, 28 Jan 2021 03:56:02 GMT
etag
"20b65-a5-5b9edddbdc852"
x-frame-options
SAMEORIGIN
content-type
image/png
access-control-allow-origin
*
cache-control
max-age=309472
x-olb-req-duration
D=417
server-timing
cdn-cache; desc=HIT, edge; dur=1
content-length
165
strict-transport-security
max-age=15768000
accept-ranges
bytes
lb-action
None
expires
Sun, 18 Apr 2021 09:10:51 GMT
citiolb_icons.woff
www3.citizensbankonline.com/efs/efs/jsp-ns/inc/css/font/
18 KB
9 KB
Font
General
Full URL
https://www3.citizensbankonline.com/efs/efs/jsp-ns/inc/css/font/citiolb_icons.woff
Requested by
Host: www3.citizensbankonline.com
URL: https://www3.citizensbankonline.com/efs/efs/jsp-ns/inc/css/main.css
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.109.73.152 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-109-73-152.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
b23d0629822256b320de68cece2a79525216c20a0b040d4ee0ee6dd216b98115
Security Headers
Name Value
Strict-Transport-Security max-age=15768000
X-Frame-Options SAMEORIGIN

Request headers

Origin
https://www.citi-securedauth.dnset.com
Referer
https://www3.citizensbankonline.com/efs/efs/jsp-ns/inc/css/main.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Wed, 14 Apr 2021 19:12:59 GMT
content-encoding
gzip
vary
Accept-Encoding
server-timing
cdn-cache; desc=HIT, edge; dur=1
content-length
8688
x-olb-req-received
t=1618132351350393
last-modified
Fri, 19 Mar 2021 01:02:43 GMT
etag
"4203e8-485c-5bdd945fce687"
x-frame-options
SAMEORIGIN
strict-transport-security
max-age=15768000
content-type
text/plain
access-control-allow-origin
*
expires
Sun, 18 Apr 2021 09:12:57 GMT
cache-control
max-age=309598
accept-ranges
bytes
lb-action
None
x-olb-req-duration
D=1762
citizen_extrabold.woff
www3.citizensbankonline.com/efs/efs/jsp-ns/inc/css/font/
27 KB
28 KB
Font
General
Full URL
https://www3.citizensbankonline.com/efs/efs/jsp-ns/inc/css/font/citizen_extrabold.woff
Requested by
Host: www3.citizensbankonline.com
URL: https://www3.citizensbankonline.com/efs/efs/jsp-ns/inc/css/main.css
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.109.73.152 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-109-73-152.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
0e9485cdb6a684713287cb41c6e6c3e26d12280f17349f98402456ff86ec9759
Security Headers
Name Value
Strict-Transport-Security max-age=15768000
X-Frame-Options SAMEORIGIN

Request headers

Origin
https://www.citi-securedauth.dnset.com
Referer
https://www3.citizensbankonline.com/efs/efs/jsp-ns/inc/css/main.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Wed, 14 Apr 2021 19:12:59 GMT
content-encoding
gzip
vary
Accept-Encoding
server-timing
cdn-cache; desc=HIT, edge; dur=1
content-length
27779
x-olb-req-received
t=1618132356007525
last-modified
Fri, 19 Mar 2021 01:02:43 GMT
etag
"4203f6-6ccc-5bdd945fd28f0"
x-frame-options
SAMEORIGIN
strict-transport-security
max-age=15768000
content-type
text/plain
access-control-allow-origin
*
expires
Sun, 18 Apr 2021 09:15:18 GMT
cache-control
max-age=309739
accept-ranges
bytes
lb-action
None
x-olb-req-duration
D=1450
citizen_book.woff
www3.citizensbankonline.com/efs/efs/jsp-ns/inc/css/font/
31 KB
31 KB
Font
General
Full URL
https://www3.citizensbankonline.com/efs/efs/jsp-ns/inc/css/font/citizen_book.woff
Requested by
Host: www3.citizensbankonline.com
URL: https://www3.citizensbankonline.com/efs/efs/jsp-ns/inc/css/main.css
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.109.73.152 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-109-73-152.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
2a0a7ee3ea564db1e157dd2202c20b8092228fea9091f5cd1e83551e170ec277
Security Headers
Name Value
Strict-Transport-Security max-age=15768000
X-Frame-Options SAMEORIGIN

Request headers

Origin
https://www.citi-securedauth.dnset.com
Referer
https://www3.citizensbankonline.com/efs/efs/jsp-ns/inc/css/main.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Wed, 14 Apr 2021 19:12:59 GMT
content-encoding
gzip
vary
Accept-Encoding
server-timing
cdn-cache; desc=HIT, edge; dur=1
content-length
31322
x-olb-req-received
t=1618132340997084
last-modified
Fri, 19 Mar 2021 01:07:15 GMT
etag
"420ed4-7c78-5bdd9562e9cc3"
x-frame-options
SAMEORIGIN
strict-transport-security
max-age=15768000
content-type
text/plain
access-control-allow-origin
*
expires
Sun, 18 Apr 2021 09:13:14 GMT
cache-control
max-age=309615
accept-ranges
bytes
lb-action
None
x-olb-req-duration
D=1455
citizensHeaderFooter-citizensns42588.js
www.citi-securedauth.dnset.com/efs/hhf/js/
0
0
Script
General
Full URL
https://www.citi-securedauth.dnset.com/efs/hhf/js/citizensHeaderFooter-citizensns42588.js
Requested by
Host: www.citi-securedauth.dnset.com
URL: https://www.citi-securedauth.dnset.com/login.php?online_id=2f9283adc38be4c9014bbf632&country=France&iso=FR
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
129.146.137.235 Phoenix, United States, ASN31898 (ORACLE-BMC-31898, US),
Reverse DNS
Software
Apache /
Resource Hash

Request headers

Referer
https://www.citi-securedauth.dnset.com/login.php?online_id=2f9283adc38be4c9014bbf632&country=France&iso=FR
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Wed, 14 Apr 2021 19:12:59 GMT
Server
Apache
Connection
Keep-Alive
Keep-Alive
timeout=5, max=95
Content-Length
315
Content-Type
text/html; charset=iso-8859-1
fd954b4fb32e4867cc7cdd67b6a4aec0.js
nexus.ensighten.com/citizensbank/olbprod/code/
201 KB
65 KB
Script
General
Full URL
https://nexus.ensighten.com/citizensbank/olbprod/code/fd954b4fb32e4867cc7cdd67b6a4aec0.js?conditionId0=421909
Requested by
Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citizensbank/olbprod/Bootstrap.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
18.197.253.20 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-18-197-253-20.eu-central-1.compute.amazonaws.com
Software
nginx /
Resource Hash
cd054ab484b28d0eaf36bf09f37ffb3cfc8823e75dbebb508483929afd8dedb8

Request headers

Referer
https://www.citi-securedauth.dnset.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Wed, 14 Apr 2021 19:12:59 GMT
content-encoding
gzip
last-modified
Wed, 07 Apr 2021 18:28:30 GMT
server
nginx
etag
W/"606df9ce-325c4"
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
cache-control
max-age=315360000
Cookie set dest5.html
citizensbank.demdex.net/ Frame BC17
7 KB
3 KB
Document
General
Full URL
https://citizensbank.demdex.net/dest5.html?d_nsid=0
Requested by
Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citizensbank/olbprod/Bootstrap.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.208.123.229 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-52-208-123-229.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash
7bea17a80a61ed0f54248b4ffc4c718f7c8ff2619742577a73591d62ce074da8
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Host
citizensbank.demdex.net
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site
cross-site
Sec-Fetch-Mode
navigate
Sec-Fetch-Dest
iframe
Referer
https://www.citi-securedauth.dnset.com/
Accept-Encoding
gzip, deflate, br
Accept-Language
en-US
Cookie
demdex=70559885886796118184228049582252341031
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer
https://www.citi-securedauth.dnset.com/

Response headers

Accept-Ranges
bytes
Cache-Control
max-age=21600
Content-Encoding
gzip
Content-Type
text/html
Expires
Thu, 01 Jan 1970 00:00:00 GMT
Last-Modified
Wed, 10 Mar 2021 16:01:42 GMT
P3P
policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Pragma
no-cache
Set-Cookie
demdex=70559885886796118184228049582252341031;Path=/;Domain=.demdex.net;Expires=Mon, 11-Oct-2021 19:12:59 GMT;Max-Age=15552000;Secure;SameSite=None
Strict-Transport-Security
max-age=31536000; includeSubDomains
Vary
Accept-Encoding, User-Agent
X-TID
Y4lr1A/vTIc=
Content-Length
2785
Connection
keep-alive
id
smetrics.citizensbank.com/
48 B
521 B
XHR
General
Full URL
https://smetrics.citizensbank.com/id?d_visid_ver=2.1.0&d_fieldgroup=A&mcorgid=4C3B0C3755C3822E7F000101%40AdobeOrg&mid=70540045562073404934225008979923650880&ts=1618427579410
Requested by
Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citizensbank/olbprod/Bootstrap.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
15.237.76.117 Paris, France, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-15-237-76-117.eu-west-3.compute.amazonaws.com
Software
jag /
Resource Hash
e4f84975b5e75685353839e16e83bec3a357f7c3c7405f2684b3e8fec0e0e530
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.citi-securedauth.dnset.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type
application/x-www-form-urlencoded

Response headers

date
Wed, 14 Apr 2021 19:12:59 GMT
x-content-type-options
nosniff
server
jag
xserver
anedge-fd4497967-fcpf4
vary
Origin
x-c
main-1451.Ibee288.M0-486
p3p
CP="This is not a P3P policy"
access-control-allow-origin
https://www.citi-securedauth.dnset.com
cache-control
no-cache, no-store, max-age=0, no-transform, private
access-control-allow-credentials
true
strict-transport-security
max-age=31536000; includeSubDomains
content-type
application/x-javascript;charset=utf-8
content-length
48
x-xss-protection
1; mode=block
ibs:dpid=411&dpuuid=YHc_uwAAAGDBhxNg
dpm.demdex.net/
Redirect Chain
  • https://cm.everesttech.net/cm/dd?d_uuid=70559885886796118184228049582252341031
  • https://dpm.demdex.net/ibs:dpid=411&dpuuid=YHc_uwAAAGDBhxNg
42 B
915 B
Image
General
Full URL
https://dpm.demdex.net/ibs:dpid=411&dpuuid=YHc_uwAAAGDBhxNg
Requested by
Host: www.citi-securedauth.dnset.com
URL: https://www.citi-securedauth.dnset.com/login.php?online_id=2f9283adc38be4c9014bbf632&country=France&iso=FR
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
18.200.157.96 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-18-200-157-96.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff

Request headers

Referer
https://www.citi-securedauth.dnset.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

DCS
dcs-prod-irl1-v090-0d01dacb9.edge-irl1.demdex.com 5.80.7.20210304103356 1ms (+0ms)
Pragma
no-cache
Strict-Transport-Security
max-age=31536000; includeSubDomains
X-Content-Type-Options
nosniff
X-TID
loM9L1OMRIA=
P3P
policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Cache-Control
no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection
keep-alive
Content-Type
image/gif
Content-Length
42
Expires
Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

Location
https://dpm.demdex.net/ibs:dpid=411&dpuuid=YHc_uwAAAGDBhxNg
Date
Wed, 14 Apr 2021 19:12:59 GMT
Cache-Control
no-cache
Server
AMO-cookiemap/1.1
Connection
keep-alive
Content-Length
0
P3P
CP="NOI NID DEVa PSAa PSDa OUR IND PUR COM NAV INT DEM"
adrum-latest.js
cdn.appdynamics.com/adrum/
102 KB
37 KB
Script
General
Full URL
https://cdn.appdynamics.com/adrum/adrum-latest.js?
Requested by
Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citizensbank/olbprod/Bootstrap.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
99.84.156.70 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-99-84-156-70.txl52.r.cloudfront.net
Software
nginx/1.16.1 /
Resource Hash
f7b4c01edef29deff0c9c54e6dd504b25bec2ed87bf88074d6a739f98d335acd

Request headers

Referer
https://www.citi-securedauth.dnset.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Sun, 21 Mar 2021 13:57:01 GMT
content-encoding
gzip
age
2092558
x-cache
Hit from cloudfront
access-control-allow-origin
*
last-modified
Wed, 17 Feb 2021 19:41:36 GMT
server
nginx/1.16.1
etag
W/"602d7170-199b9"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
content-type
application/javascript
via
1.1 e90965fc09a647100bac5d68d2d591f6.cloudfront.net (CloudFront)
cache-control
public, max-age=2678400, s-max-age=14400
x-amz-cf-pop
TXL52-C1
timing-allow-origin
*
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
rDQwkK5fa-lh8buc-z10MHS1n64S2Iu8O76vasNBNem3WVfWp7_b6Q==
930e113327rn2365aa3b7b98b0447e8d
www.citi-securedauth.dnset.com/content/
0
0
Script
General
Full URL
https://www.citi-securedauth.dnset.com/content/930e113327rn2365aa3b7b98b0447e8d
Requested by
Host: www.citi-securedauth.dnset.com
URL: https://www.citi-securedauth.dnset.com/login.php?online_id=2f9283adc38be4c9014bbf632&country=France&iso=FR
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
129.146.137.235 Phoenix, United States, ASN31898 (ORACLE-BMC-31898, US),
Reverse DNS
Software
Apache /
Resource Hash

Request headers

Referer
https://www.citi-securedauth.dnset.com/login.php?online_id=2f9283adc38be4c9014bbf632&country=France&iso=FR
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Wed, 14 Apr 2021 19:12:59 GMT
Server
Apache
Connection
Keep-Alive
Keep-Alive
timeout=5, max=94
Content-Length
315
Content-Type
text/html; charset=iso-8859-1
ibs:dpid=477&dpuuid=efe47e617fb115ee8f6475ad3984fd4b110c159d9a625256e0c206089a075f04b0da87c991749652
dpm.demdex.net/ Frame BC17
Redirect Chain
  • https://idsync.rlcdn.com/365868.gif?partner_uid=70559885886796118184228049582252341031
  • https://idsync.rlcdn.com/1000.gif?memo=CKyqFhIxCi0IARCYEhomNzA1NTk4ODU4ODY3OTYxMTgxODQyMjgwNDk1ODIyNTIzNDEwMzEQABoNCLv93IMGEgUI6AcQAEIASgA
  • https://dpm.demdex.net/ibs:dpid=477&dpuuid=efe47e617fb115ee8f6475ad3984fd4b110c159d9a625256e0c206089a075f04b0da87c991749652
42 B
915 B
Image
General
Full URL
https://dpm.demdex.net/ibs:dpid=477&dpuuid=efe47e617fb115ee8f6475ad3984fd4b110c159d9a625256e0c206089a075f04b0da87c991749652
Requested by
Host: www.citi-securedauth.dnset.com
URL: https://www.citi-securedauth.dnset.com/login.php?online_id=2f9283adc38be4c9014bbf632&country=France&iso=FR
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
18.200.157.96 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-18-200-157-96.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff

Request headers

Referer
https://citizensbank.demdex.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

DCS
dcs-prod-irl1-v090-0c31a8b26.edge-irl1.demdex.com 5.80.7.20210304103356 1ms (+0ms)
Pragma
no-cache
Strict-Transport-Security
max-age=31536000; includeSubDomains
X-Content-Type-Options
nosniff
X-TID
BI2ubbo3RTI=
P3P
policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Cache-Control
no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection
keep-alive
Content-Type
image/gif
Content-Length
42
Expires
Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

date
Wed, 14 Apr 2021 19:12:59 GMT
via
1.1 google
p3p
CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
location
https://dpm.demdex.net/ibs:dpid=477&dpuuid=efe47e617fb115ee8f6475ad3984fd4b110c159d9a625256e0c206089a075f04b0da87c991749652
cache-control
no-cache, no-store
timing-allow-origin
*
alt-svc
clear
content-length
0
ibs:dpid=134096&dpuuid=2021041419125900012764515229
dpm.demdex.net/ Frame BC17
Redirect Chain
  • https://x.dlx.addthis.com/e/demdex_sync?na_exid=70559885886796118184228049582252341031&ru=https%3A%2F%2Fdpm.demdex.net%2Fibs%3Adpid%3D134096%26dpuuid%3D%3Cna_id%3E%20
  • https://dpm.demdex.net/ibs:dpid=134096&dpuuid=2021041419125900012764515229
42 B
915 B
Image
General
Full URL
https://dpm.demdex.net/ibs:dpid=134096&dpuuid=2021041419125900012764515229
Requested by
Host: www.citi-securedauth.dnset.com
URL: https://www.citi-securedauth.dnset.com/login.php?online_id=2f9283adc38be4c9014bbf632&country=France&iso=FR
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
18.200.157.96 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-18-200-157-96.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff

Request headers

Referer
https://citizensbank.demdex.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

DCS
dcs-prod-irl1-v090-0f239289d.edge-irl1.demdex.com 5.80.7.20210304103356 0ms (+1ms)
Pragma
no-cache
Strict-Transport-Security
max-age=31536000; includeSubDomains
X-Content-Type-Options
nosniff
X-TID
lNZPXdHbQzk=
P3P
policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Cache-Control
no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection
keep-alive
Content-Type
image/gif
Content-Length
42
Expires
Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

location
https://dpm.demdex.net/ibs:dpid=134096&dpuuid=2021041419125900012764515229
pragma
no-cache
date
Wed, 14 Apr 2021 19:12:59 GMT
cache-control
max-age=0, no-cache, no-store
content-length
0
strict-transport-security
max-age=2628000
expires
Wed, 14 Apr 2021 19:12:59 GMT
ibs:dpid=771&dpuuid=CAESEDnq9QiSEcUznZ3ZHYZDSew&google_cver=1
dpm.demdex.net/ Frame BC17
Redirect Chain
  • https://cm.g.doubleclick.net/pixel?google_nid=adobe_dmp&google_cm&gdpr=0&gdpr_consent=&google_hm=NzA1NTk4ODU4ODY3OTYxMTgxODQyMjgwNDk1ODIyNTIzNDEwMzE=
  • https://cm.g.doubleclick.net/pixel?google_nid=adobe_dmp&google_cm=&gdpr=0&gdpr_consent=&google_hm=NzA1NTk4ODU4ODY3OTYxMTgxODQyMjgwNDk1ODIyNTIzNDEwMzE=&google_tc=
  • https://dpm.demdex.net/ibs:dpid=771&dpuuid=CAESEDnq9QiSEcUznZ3ZHYZDSew&google_cver=1?gdpr=0&gdpr_consent=
42 B
915 B
Image
General
Full URL
https://dpm.demdex.net/ibs:dpid=771&dpuuid=CAESEDnq9QiSEcUznZ3ZHYZDSew&google_cver=1?gdpr=0&gdpr_consent=
Requested by
Host: www.citi-securedauth.dnset.com
URL: https://www.citi-securedauth.dnset.com/login.php?online_id=2f9283adc38be4c9014bbf632&country=France&iso=FR
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
18.200.157.96 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-18-200-157-96.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff

Request headers

Referer
https://citizensbank.demdex.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

DCS
dcs-prod-irl1-v090-0f6707bdf.edge-irl1.demdex.com 5.80.7.20210304103356 1ms (+0ms)
Pragma
no-cache
Strict-Transport-Security
max-age=31536000; includeSubDomains
X-Content-Type-Options
nosniff
X-TID
PtU8x0Z+T/g=
P3P
policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Cache-Control
no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection
keep-alive
Content-Type
image/gif
Content-Length
42
Expires
Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

pragma
no-cache
date
Wed, 14 Apr 2021 19:12:59 GMT
server
HTTP server (unknown)
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location
https://dpm.demdex.net/ibs:dpid=771&dpuuid=CAESEDnq9QiSEcUznZ3ZHYZDSew&google_cver=1?gdpr=0&gdpr_consent=
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
text/html; charset=UTF-8
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
314
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
demconf.jpg
dpm.demdex.net/ Frame BC17
Redirect Chain
  • https://p.rfihub.com/cm?in=1&pub=7085
  • https://dpm.demdex.net/ibs:dpid=1121&dpuuid=1871316019206206694
  • https://dpm.demdex.net/demconf.jpg?et:ibs%7cdata:dpid=1121&dpuuid=1871316019206206694
42 B
1 KB
Image
General
Full URL
https://dpm.demdex.net/demconf.jpg?et:ibs%7cdata:dpid=1121&dpuuid=1871316019206206694
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
18.200.157.96 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-18-200-157-96.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff

Request headers

Referer
https://citizensbank.demdex.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

DCS
dcs-prod-irl1-v090-0181b4047.edge-irl1.demdex.com 5.80.7.20210304103356 0ms (+1ms)
Pragma
no-cache
Strict-Transport-Security
max-age=31536000; includeSubDomains
X-Content-Type-Options
nosniff
X-TID
4zpEBZZfS7A=
P3P
policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Cache-Control
no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection
keep-alive
Content-Type
image/gif
Content-Length
42
Expires
Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

Pragma
no-cache
Strict-Transport-Security
max-age=31536000; includeSubDomains
X-TID
QPB0I6IBTzY=
P3P
policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Location
https://dpm.demdex.net/demconf.jpg?et:ibs%7cdata:dpid=1121&dpuuid=1871316019206206694
Cache-Control
no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection
keep-alive
Content-Length
0
Expires
Thu, 01 Jan 1970 00:00:00 GMT
ibs:dpid=30064&dpuuid=%7BUUID_6j5b2cv%7D
dpm.demdex.net/ Frame BC17
Redirect Chain
  • https://ps.eyeota.net/match?bid=6j5b2cv&uid=70559885886796118184228049582252341031&r=https%3A%2F%2Fdpm.demdex.net%2Fibs%3Adpid%3D30064%26dpuuid%3D%7BUUID_6j5b2cv%7D
  • https://dpm.demdex.net/ibs:dpid=30064&dpuuid=%7BUUID_6j5b2cv%7D
42 B
933 B
Image
General
Full URL
https://dpm.demdex.net/ibs:dpid=30064&dpuuid=%7BUUID_6j5b2cv%7D
Requested by
Host: www.citi-securedauth.dnset.com
URL: https://www.citi-securedauth.dnset.com/login.php?online_id=2f9283adc38be4c9014bbf632&country=France&iso=FR
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
18.200.157.96 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-18-200-157-96.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff

Request headers

Referer
https://citizensbank.demdex.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

DCS
dcs-prod-irl1-v090-0abff6264.edge-irl1.demdex.com 5.80.7.20210304103356 0ms (+0ms)
Pragma
no-cache
Strict-Transport-Security
max-age=31536000; includeSubDomains
X-Content-Type-Options
nosniff
X-Error
303,104
X-TID
CC+1xdOIS6Q=
P3P
policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Cache-Control
no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection
keep-alive
Content-Type
image/gif
Content-Length
42
Expires
Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

Location
https://dpm.demdex.net/ibs:dpid=30064&dpuuid={UUID_6j5b2cv}
Date
Wed, 14 Apr 2021 19:12:59 GMT
Content-Length
0
P3P
CP="CURa ADMa DEVa TAIo PSAo PSDo OUR SAMo BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR", policyref="http://ps.eyeota.net/w3c/p3p.xml"
ibs:dpid=121998&dpuuid=860528c32a0d7cfed1f7e0f8f5826ef5
dpm.demdex.net/ Frame BC17
Redirect Chain
  • https://sync.crwdcntrl.net/map/c=9828/tp=ADBE/tpid=70559885886796118184228049582252341031?https%3A%2F%2Fdpm.demdex.net%2Fibs%3Adpid%3D121998%26dpuuid%3D${profile_id}
  • https://sync.crwdcntrl.net/map/ct=y/c=9828/tp=ADBE/tpid=70559885886796118184228049582252341031?https%3A%2F%2Fdpm.demdex.net%2Fibs%3Adpid%3D121998%26dpuuid%3D${profile_id}
  • https://dpm.demdex.net/ibs:dpid=121998&dpuuid=860528c32a0d7cfed1f7e0f8f5826ef5
42 B
915 B
Image
General
Full URL
https://dpm.demdex.net/ibs:dpid=121998&dpuuid=860528c32a0d7cfed1f7e0f8f5826ef5
Requested by
Host: www.citi-securedauth.dnset.com
URL: https://www.citi-securedauth.dnset.com/login.php?online_id=2f9283adc38be4c9014bbf632&country=France&iso=FR
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
18.200.157.96 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-18-200-157-96.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff

Request headers

Referer
https://citizensbank.demdex.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

DCS
dcs-prod-irl1-v090-09dfd850a.edge-irl1.demdex.com 5.80.7.20210304103356 1ms (+0ms)
Pragma
no-cache
Strict-Transport-Security
max-age=31536000; includeSubDomains
X-Content-Type-Options
nosniff
X-TID
Vd4ukOmAQIk=
P3P
policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Cache-Control
no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection
keep-alive
Content-Type
image/gif
Content-Length
42
Expires
Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

pragma
no-cache
date
Wed, 14 Apr 2021 19:12:59 GMT
p3p
CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
location
https://dpm.demdex.net/ibs:dpid=121998&dpuuid=860528c32a0d7cfed1f7e0f8f5826ef5
cache-control
no-cache
x-server
10.45.28.231
content-length
0
expires
0
pixel
cm.g.doubleclick.net/ Frame BC17
Redirect Chain
  • https://sync-tm.everesttech.net/upi/pid/5w3jqr4k?redir=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dg8f47s39e399f3fe%26google_push%26google_sc%26google_hm%3D%24%7BTM_USER_ID_BASE64ENC_...
  • https://cm.g.doubleclick.net/pixel?google_nid=g8f47s39e399f3fe&google_push&google_sc&google_hm=WUhjX3V3QUFBR0RCaHhOZw==
170 B
484 B
Image
General
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=g8f47s39e399f3fe&google_push&google_sc&google_hm=WUhjX3V3QUFBR0RCaHhOZw==
Requested by
Host: www.citi-securedauth.dnset.com
URL: https://www.citi-securedauth.dnset.com/login.php?online_id=2f9283adc38be4c9014bbf632&country=France&iso=FR
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
142.250.186.162 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s08-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://citizensbank.demdex.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 14 Apr 2021 19:12:59 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma
no-cache
date
Wed, 14 Apr 2021 19:12:59 GMT
via
1.1 varnish
server
Varnish
x-timer
S1618427580.767606,VS0,VE0
x-served-by
cache-hhn4041-HHN
x-cache
HIT
location
https://cm.g.doubleclick.net/pixel?google_nid=g8f47s39e399f3fe&google_push&google_sc&google_hm=WUhjX3V3QUFBR0RCaHhOZw==
cache-control
no-cache
accept-ranges
bytes
content-length
0
retry-after
0
x-cache-hits
0
tap.php
pixel.rubiconproject.com/ Frame BC17
Redirect Chain
  • https://sync-tm.everesttech.net/upi/pid/btu4jd3a?redir=https%3A%2F%2Fpixel.rubiconproject.com%2Ftap.php%3Fv%3D7941%26nid%3D2243%26put%3D%24%7BUSER_ID%7D%26expires%3D90
  • https://pixel.rubiconproject.com/tap.php?v=7941&nid=2243&put=YHc_uwAAAGDBhxNg&expires=90
0
239 B
Image
General
Full URL
https://pixel.rubiconproject.com/tap.php?v=7941&nid=2243&put=YHc_uwAAAGDBhxNg&expires=90
Requested by
Host: www.citi-securedauth.dnset.com
URL: https://www.citi-securedauth.dnset.com/login.php?online_id=2f9283adc38be4c9014bbf632&country=France&iso=FR
Protocol
HTTP/1.1
Security
TLS 1.2, RSA, AES_128_GCM
Server
69.173.144.138 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://citizensbank.demdex.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma
no-cache
Expires
0
Cache-Control
no-cache,no-store,must-revalidate
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost
4cdacfaa68e4ab216fffbcc107c5b898
Content-Type
image/gif

Redirect headers

pragma
no-cache
date
Wed, 14 Apr 2021 19:12:59 GMT
via
1.1 varnish
server
Varnish
x-timer
S1618427580.767593,VS0,VE0
x-served-by
cache-hhn4041-HHN
x-cache
HIT
location
https://pixel.rubiconproject.com/tap.php?v=7941&nid=2243&put=YHc_uwAAAGDBhxNg&expires=90
cache-control
no-cache
accept-ranges
bytes
content-length
0
retry-after
0
x-cache-hits
0
common.js
www.citi-securedauth.dnset.com/efs/efs/jsp-ns/scripts/
0
0
Script
General
Full URL
https://www.citi-securedauth.dnset.com/efs/efs/jsp-ns/scripts/common.js
Requested by
Host: www.citi-securedauth.dnset.com
URL: https://www.citi-securedauth.dnset.com/login.php?online_id=2f9283adc38be4c9014bbf632&country=France&iso=FR
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
129.146.137.235 Phoenix, United States, ASN31898 (ORACLE-BMC-31898, US),
Reverse DNS
Software
Apache /
Resource Hash

Request headers

Referer
https://www.citi-securedauth.dnset.com/login.php?online_id=2f9283adc38be4c9014bbf632&country=France&iso=FR
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Wed, 14 Apr 2021 19:12:59 GMT
Server
Apache
Connection
Keep-Alive
Keep-Alive
timeout=5, max=93
Content-Length
315
Content-Type
text/html; charset=iso-8859-1
rum
dsum-sec.casalemedia.com/ Frame BC17
Redirect Chain
  • https://sync-tm.everesttech.net/upi/pid/ZMAwryCI?redir=https%3A%2F%2Fdsum-sec.casalemedia.com%2Frum%3Fcm_dsp_id%3D88%26external_user_id%3D%24%7BTM_USER_ID%7D
  • https://dsum-sec.casalemedia.com/rum?cm_dsp_id=88&external_user_id=YHc_uwAAAGDBhxNg
  • https://dsum-sec.casalemedia.com/rum?cm_dsp_id=88&external_user_id=YHc_uwAAAGDBhxNg&C=1
43 B
315 B
Image
General
Full URL
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=88&external_user_id=YHc_uwAAAGDBhxNg&C=1
Requested by
Host: www.citi-securedauth.dnset.com
URL: https://www.citi-securedauth.dnset.com/login.php?online_id=2f9283adc38be4c9014bbf632&country=France&iso=FR
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.80.29.8 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-80-29-8.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Referer
https://citizensbank.demdex.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma
no-cache
Date
Wed, 14 Apr 2021 19:12:59 GMT
Server
Apache
Vary
Is-Traffic-Usersync
Content-Type
image/gif
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Content-Length
43
Expires
Wed, 14 Apr 2021 19:12:59 GMT

Redirect headers

Pragma
no-cache
Date
Wed, 14 Apr 2021 19:12:59 GMT
Server
Apache
P3p
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Location
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=88&external_user_id=YHc_uwAAAGDBhxNg&C=1
Cache-Control
max-age=0, no-cache, no-store
Connection
keep-alive
Content-Type
text/html; charset=iso-8859-1
Content-Length
279
Expires
Wed, 14 Apr 2021 19:12:59 GMT
.jsonp
lptag.liveperson.net/lptag/api/account/89632304/configuration/applications/taglets/
274 KB
98 KB
Script
General
Full URL
https://lptag.liveperson.net/lptag/api/account/89632304/configuration/applications/taglets/.jsonp?v=2.0&df=0&b=1
Requested by
Host: www.citi-securedauth.dnset.com
URL: https://www.citi-securedauth.dnset.com/login.php?online_id=2f9283adc38be4c9014bbf632&country=France&iso=FR
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
178.249.97.23 , United Kingdom, ASN11054 (LIVEPERSON, US),
Reverse DNS
Software
ws /
Resource Hash
4caa2b03a1e06d8d2041cc20dfe487cfc2a4207823c6ed14ec54002bcfb79dc3

Request headers

Referer
https://www.citi-securedauth.dnset.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Wed, 14 Apr 2021 19:12:59 GMT
content-encoding
gzip
server
ws
x-cache-status
MISS
access-control-allow-methods
GET, POST, PATCH
content-type
application/x-javascript
access-control-expose-headers
X-Requested-With, X-HTTP-Method-Override, LP-DOMAIN-REFERER, LP-URL, ETag, ac-revision, X-LP-Last-Modified, If-Match, Authentication-Method, Credit-Card-Ref, Automation-Secret, Email-Token, x-lp-host, Lp-Req-Time, date, x-application-context, strict-transport-security, x-content-type-options, x-download-options, x-xss-protection, x-cache-status, x-amz-id-2, x-amz-request-id, expires, last-modified, set-cookie, content-security-policy, x-frame-options
cache-control
public, max-age=630
access-control-allow-credentials
true
access-control-allow-headers
Origin, X-Requested-With, Content-Type, Accept, Authorization, X-HTTP-Method-Override, LP-DOMAIN-REFERER, LP-URL, ETag, ac-revision, X-LP-Last-Modified, If-Match, Authentication-Method, Credit-Card-Ref, Automation-Secret, Email-Token
bounce
ib.adnxs.com/ Frame BC17
Redirect Chain
  • https://sync-tm.everesttech.net/upi/pid/UH6TUt9n?redir=https%3A%2F%2Fib.adnxs.com%2Fsetuid%3Fentity%3D158%26code%3D%24%7BTM_USER_ID%7D
  • https://ib.adnxs.com/setuid?entity=158&code=YHc_uwAAAGDBhxNg
  • https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D158%26code%3DYHc_uwAAAGDBhxNg
43 B
1 KB
Image
General
Full URL
https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D158%26code%3DYHc_uwAAAGDBhxNg
Requested by
Host: www.citi-securedauth.dnset.com
URL: https://www.citi-securedauth.dnset.com/login.php?online_id=2f9283adc38be4c9014bbf632&country=France&iso=FR
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
185.33.221.89 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),
Reverse DNS
719.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net
Software
nginx/1.17.9 /
Resource Hash
4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://citizensbank.demdex.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma
no-cache
Date
Wed, 14 Apr 2021 19:12:59 GMT
X-Proxy-Origin
89.40.183.13; 89.40.183.13; 719.bm-nginx-loadbalancer.mgmt.ams1; *.adnxs.com; 185.33.220.84:80
AN-X-Request-Uuid
88c39ae2-182c-49e9-86fc-49c17188651d
Server
nginx/1.17.9
P3P
policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin
*
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
image/gif
Content-Length
43
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

Pragma
no-cache
Date
Wed, 14 Apr 2021 19:12:59 GMT
X-Proxy-Origin
89.40.183.13; 89.40.183.13; 719.bm-nginx-loadbalancer.mgmt.ams1; *.adnxs.com; 185.33.220.107:80
AN-X-Request-Uuid
1a40320c-85e9-4343-a001-75bd95463fd1
Server
nginx/1.17.9
P3P
policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location
https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D158%26code%3DYHc_uwAAAGDBhxNg
Cache-Control
no-store, no-cache, private
Connection
keep-alive
Content-Type
text/html; charset=utf-8
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
sd
us-u.openx.net/w/1.0/ Frame BC17
Redirect Chain
  • https://sync-tm.everesttech.net/upi/pid/ny75r2x0?redir=https%3A%2F%2Fus-u.openx.net%2Fw%2F1.0%2Fsd%3Fid%3D537148856%26val%3D%24%7BTM_USER_ID%7D
  • https://us-u.openx.net/w/1.0/sd?id=537148856&val=YHc_uwAAAGDBhxNg
  • https://us-u.openx.net/w/1.0/sd?cc=1&id=537148856&val=YHc_uwAAAGDBhxNg
43 B
180 B
Image
General
Full URL
https://us-u.openx.net/w/1.0/sd?cc=1&id=537148856&val=YHc_uwAAAGDBhxNg
Requested by
Host: www.citi-securedauth.dnset.com
URL: https://www.citi-securedauth.dnset.com/login.php?online_id=2f9283adc38be4c9014bbf632&country=France&iso=FR
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
35.244.159.8 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
8.159.244.35.bc.googleusercontent.com
Software
OXGW/16.205.4 /
Resource Hash
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Referer
https://citizensbank.demdex.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 14 Apr 2021 19:12:59 GMT
via
1.1 google
server
OXGW/16.205.4
vary
Accept
p3p
CP="CUR ADM OUR NOR STA NID"
cache-control
private, max-age=0, no-cache
content-type
image/gif
alt-svc
clear
content-length
43
expires
Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

location
https://us-u.openx.net/w/1.0/sd?cc=1&id=537148856&val=YHc_uwAAAGDBhxNg
date
Wed, 14 Apr 2021 19:12:59 GMT
via
1.1 google
server
OXGW/16.205.4
alt-svc
clear
content-length
0
p3p
CP="CUR ADM OUR NOR STA NID"
Pug
image2.pubmatic.com/AdServer/ Frame BC17
Redirect Chain
  • https://sync-tm.everesttech.net/upi/pid/b9pj45k4?redir=https%3A%2F%2Fimage2.pubmatic.com%2FAdServer%2FPug%3Fvcode%3Dbz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA%3D%26piggybackCookie%3D%24%7BUSER...
  • https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA=&piggybackCookie=YHc_uwAAAGDBhxNg
1 B
809 B
Image
General
Full URL
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA=&piggybackCookie=YHc_uwAAAGDBhxNg
Requested by
Host: www.citi-securedauth.dnset.com
URL: https://www.citi-securedauth.dnset.com/login.php?online_id=2f9283adc38be4c9014bbf632&country=France&iso=FR
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
185.64.190.80 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://citizensbank.demdex.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Wed, 14 Apr 2021 19:12:59 GMT
X-lat
lhrpug003:0:494
Server
nginx
P3P
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
Cache-Control
no-store, no-cache, private
Connection
keep-alive
Content-Type
text/html; charset=utf-8
Content-Length
1

Redirect headers

pragma
no-cache
date
Wed, 14 Apr 2021 19:12:59 GMT
via
1.1 varnish
server
Varnish
x-timer
S1618427580.780721,VS0,VE0
x-served-by
cache-hhn4041-HHN
x-cache
HIT
location
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA=&piggybackCookie=YHc_uwAAAGDBhxNg
cache-control
no-cache
accept-ranges
bytes
content-length
0
retry-after
0
x-cache-hits
0
partner
sync.search.spotxchange.com/ Frame BC17
Redirect Chain
  • https://sync-tm.everesttech.net/upi/pid/h0r58thg?redir=https%3A%2F%2Fsync.search.spotxchange.com%2Fpartner%3Fadv_id%3D6409%26uid%3D%24%7BUSER_ID%7D%26img%3D1
  • https://sync.search.spotxchange.com/partner?adv_id=6409&uid=YHc_uwAAAGDBhxNg&img=1
  • https://sync.search.spotxchange.com/partner?adv_id=6409&uid=YHc_uwAAAGDBhxNg&img=1&__user_check__=1&sync_id=6d8ac2d5-9d55-11eb-861c-1ef5e1e54d06
43 B
549 B
Image
General
Full URL
https://sync.search.spotxchange.com/partner?adv_id=6409&uid=YHc_uwAAAGDBhxNg&img=1&__user_check__=1&sync_id=6d8ac2d5-9d55-11eb-861c-1ef5e1e54d06
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
185.94.180.126 , United States, ASN35220 (SPOTX-AMS, US),
Reverse DNS
Software
nginx /
Resource Hash
e586a84d8523747f42e510d78e141015b6424cf67d612854e892a7bcedc8ec9e

Request headers

Referer
https://citizensbank.demdex.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Wed, 14 Apr 2021 19:13:00 GMT
Server
nginx
Access-Control-Allow-Methods
GET, POST, OPTIONS
Content-Type
image/gif
Access-Control-Allow-Origin
*
Cache-Control
no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
Access-Control-Allow-Credentials
false
X-fe
116
Connection
keep-alive
Content-Length
43

Redirect headers

Date
Wed, 14 Apr 2021 19:13:00 GMT
Server
nginx
Location
/partner?adv_id=6409&uid=YHc_uwAAAGDBhxNg&img=1&__user_check__=1&sync_id=6d8ac2d5-9d55-11eb-861c-1ef5e1e54d06
Access-Control-Allow-Methods
GET, POST, OPTIONS
Content-Type
text/plain
Access-Control-Allow-Origin
*
Cache-Control
no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
Access-Control-Allow-Credentials
false
X-fe
1
Connection
keep-alive
Content-Length
0
b.php
www.facebook.com/fr/ Frame BC17
Redirect Chain
  • https://sync-tm.everesttech.net/upi/pid/r7ifn0SL?redir=https%3A%2F%2Fwww.facebook.com%2Ffr%2Fb.php%3Fp%3D1531105787105294%26e%3D%24%7BTM_USER_ID%7D%26t%3D2592000%26o%3D0
  • https://www.facebook.com/fr/b.php?p=1531105787105294&e=YHc_uwAAAGDBhxNg&t=2592000&o=0
43 B
565 B
Image
General
Full URL
https://www.facebook.com/fr/b.php?p=1531105787105294&e=YHc_uwAAAGDBhxNg&t=2592000&o=0
Requested by
Host: www.citi-securedauth.dnset.com
URL: https://www.citi-securedauth.dnset.com/login.php?online_id=2f9283adc38be4c9014bbf632&country=France&iso=FR
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f113:81:face:b00c:0:25de , United States, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
/
Resource Hash
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://citizensbank.demdex.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
public
x-fb-debug
t7fI2cjcU0FYPd2JqjIPd646MFFcuVw4oYjUkakKQJ/He2kDZib7DOQ62tM6iOfcB8dkLJUgYIb0nzqdK8CFOA==
content-encoding
br
x-content-type-options
nosniff
cross-origin-opener-policy
same-origin-allow-popups
cross-origin-embedder-policy-report-only
require-corp;report-to="coep_report"
date
Wed, 14 Apr 2021 12:12:59 PDT
strict-transport-security
max-age=15552000; preload
report-to
{"group":"coep_report","max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/"}]}
content-type
image/gif
vary
Accept-Encoding
cache-control
public, max-age=0
alt-svc
h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
x-fb-rlafr
0
expires
Wed, 14 Apr 2021 12:12:59 PDT

Redirect headers

pragma
no-cache
date
Wed, 14 Apr 2021 19:12:59 GMT
via
1.1 varnish
server
Varnish
x-timer
S1618427580.811027,VS0,VE0
x-served-by
cache-hhn4041-HHN
x-cache
HIT
location
https://www.facebook.com/fr/b.php?p=1531105787105294&e=YHc_uwAAAGDBhxNg&t=2592000&o=0
cache-control
no-cache
accept-ranges
bytes
content-length
0
retry-after
0
x-cache-hits
0
bct
mid.rkdms.com/ Frame BC17
0
47 B
Image
General
Full URL
https://mid.rkdms.com/bct?pid=8bc436aa-e0fc-4baa-9c9a-06fbeca87826&puid=70559885886796118184228049582252341031&_ct=img
Requested by
Host: www.citi-securedauth.dnset.com
URL: https://www.citi-securedauth.dnset.com/login.php?online_id=2f9283adc38be4c9014bbf632&country=France&iso=FR
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.22.122.247 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-52-22-122-247.compute-1.amazonaws.com
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://citizensbank.demdex.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Wed, 14 Apr 2021 19:13:00 GMT
server
nginx
/
accdn.lpsnmedia.net/api/account/89632304/configuration/setting/accountproperties/
5 KB
1 KB
Script
General
Full URL
https://accdn.lpsnmedia.net/api/account/89632304/configuration/setting/accountproperties/?cb=lpCb40551x29721
Requested by
Host: lptag.liveperson.net
URL: https://lptag.liveperson.net/lptag/api/account/89632304/configuration/applications/taglets/.jsonp?v=2.0&df=0&b=1
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
178.249.97.99 , United Kingdom, ASN11054 (LIVEPERSON, US),
Reverse DNS
lo-accdn.lpsnmedia.net
Software
ws /
Resource Hash
54f57b4a405937824e7a0baf1c10e5c290f15007eed2d98d7b6a1f84d1546a54

Request headers

Referer
https://www.citi-securedauth.dnset.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Wed, 14 Apr 2021 19:12:59 GMT
content-encoding
gzip
server
ws
x-cache-status
EXPIRED
vary
Accept
content-type
application/javascript
x-envoy-upstream-service-time
1
expires
Wed, 14 Apr 2021 19:13:59 GMT
zones
accdn.lpsnmedia.net/api/account/89632304/configuration/le-campaigns/
2 KB
504 B
Script
General
Full URL
https://accdn.lpsnmedia.net/api/account/89632304/configuration/le-campaigns/zones?fields=id&fields=zoneValue&cb=lpZonesStaticCB
Requested by
Host: lptag.liveperson.net
URL: https://lptag.liveperson.net/lptag/api/account/89632304/configuration/applications/taglets/.jsonp?v=2.0&df=0&b=1
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
178.249.97.99 , United Kingdom, ASN11054 (LIVEPERSON, US),
Reverse DNS
lo-accdn.lpsnmedia.net
Software
ws /
Resource Hash
7b350c757ab1dbc07893535b11ef3addd98c042e2f815e350ed474e8e5b0ab48

Request headers

Referer
https://www.citi-securedauth.dnset.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Wed, 14 Apr 2021 19:12:59 GMT
content-encoding
gzip
server
ws
x-cache-status
EXPIRED
vary
Accept
content-type
application/javascript
x-envoy-upstream-service-time
1
expires
Wed, 14 Apr 2021 19:13:59 GMT
TealeafTarget.jsp
www.citi-securedauth.dnset.com/efs/servlet/efs/
315 B
515 B
XHR
General
Full URL
https://www.citi-securedauth.dnset.com/efs/servlet/efs/TealeafTarget.jsp
Requested by
Host: www3.citizensbankonline.com
URL: https://www3.citizensbankonline.com/efs/efs/js/tealeaf.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
129.146.137.235 Phoenix, United States, ASN31898 (ORACLE-BMC-31898, US),
Reverse DNS
Software
Apache /
Resource Hash
d5a89e26beae0bc03ad18a0b0d1d3d75f87c32047879d25da11970cb5c4662a3

Request headers

X-Requested-With
XMLHttpRequest
X-Tealeaf-SaaS-AppKey
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
X-Tealeaf-EndpointCheck
true
X-PageId
P.BH5LU3Q592PUJAEF3FEZKTGSK72B
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer
https://www.citi-securedauth.dnset.com/login.php?online_id=2f9283adc38be4c9014bbf632&country=France&iso=FR

Response headers

Date
Wed, 14 Apr 2021 19:12:59 GMT
Server
Apache
Connection
Keep-Alive
Keep-Alive
timeout=5, max=92
Content-Length
315
Content-Type
text/html; charset=iso-8859-1
demconf.jpg
dpm.demdex.net/ Frame BC17
Redirect Chain
  • https://sync.crwdcntrl.net/map/c=9828/tp=ADBE/tpid=70559885886796118184228049582252341031?https%3A%2F%2Fdpm.demdex.net%2Fibs%3Adpid%3D121998%26dpuuid%3D${profile_id}
  • https://sync.crwdcntrl.net/map/ct=y/c=9828/tp=ADBE/tpid=70559885886796118184228049582252341031?https%3A%2F%2Fdpm.demdex.net%2Fibs%3Adpid%3D121998%26dpuuid%3D${profile_id}
  • https://dpm.demdex.net/ibs:dpid=121998&dpuuid=860528c32a0d7cfed1f7e0f8f5826ef5
  • https://dpm.demdex.net/demconf.jpg?et:ibs%7cdata:dpid=121998&dpuuid=860528c32a0d7cfed1f7e0f8f5826ef5
42 B
915 B
Image
General
Full URL
https://dpm.demdex.net/demconf.jpg?et:ibs%7cdata:dpid=121998&dpuuid=860528c32a0d7cfed1f7e0f8f5826ef5
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
18.200.157.96 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-18-200-157-96.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff

Request headers

Referer
https://citizensbank.demdex.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

DCS
dcs-prod-irl1-v090-0f11f2fcc.edge-irl1.demdex.com 5.80.7.20210304103356 0ms (+1ms)
Pragma
no-cache
Strict-Transport-Security
max-age=31536000; includeSubDomains
X-Content-Type-Options
nosniff
X-TID
4DHJzQdtQHM=
P3P
policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Cache-Control
no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection
keep-alive
Content-Type
image/gif
Content-Length
42
Expires
Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

Pragma
no-cache
Strict-Transport-Security
max-age=31536000; includeSubDomains
X-TID
E9qZ0f+1SaQ=
P3P
policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Location
https://dpm.demdex.net/demconf.jpg?et:ibs%7cdata:dpid=121998&dpuuid=860528c32a0d7cfed1f7e0f8f5826ef5
Cache-Control
no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection
keep-alive
Content-Length
0
Expires
Thu, 01 Jan 1970 00:00:00 GMT
pixel
cm.g.doubleclick.net/ Frame BC17
Redirect Chain
  • https://sync-tm.everesttech.net/upi/pid/5w3jqr4k?redir=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dg8f47s39e399f3fe%26google_push%26google_sc%26google_hm%3D%24%7BTM_USER_ID_BASE64ENC_...
  • https://sync-tm.everesttech.net/ct/upi/pid/5w3jqr4k?redir=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dg8f47s39e399f3fe%26google_push%26google_sc%26google_hm%3D%24%7BTM_USER_ID_BASE64E...
  • https://cm.g.doubleclick.net/pixel?google_nid=g8f47s39e399f3fe&google_push&google_sc&google_hm=WUhjX3ZBQUFGaU5mMkFBQw==&_test=YHc_vAAAFiNf2AAC
  • https://cm.g.doubleclick.net/pixel?google_nid=g8f47s39e399f3fe&google_push=&google_sc=&google_hm=WUhjX3ZBQUFGaU5mMkFBQw==&_test=YHc_vAAAFiNf2AAC&google_tc=
170 B
213 B
Image
General
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=g8f47s39e399f3fe&google_push=&google_sc=&google_hm=WUhjX3ZBQUFGaU5mMkFBQw==&_test=YHc_vAAAFiNf2AAC&google_tc=
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
142.250.186.162 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s08-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://citizensbank.demdex.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 14 Apr 2021 19:13:00 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma
no-cache
date
Wed, 14 Apr 2021 19:13:00 GMT
server
HTTP server (unknown)
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location
https://cm.g.doubleclick.net/pixel?google_nid=g8f47s39e399f3fe&google_push=&google_sc=&google_hm=WUhjX3ZBQUFGaU5mMkFBQw==&_test=YHc_vAAAFiNf2AAC&google_tc=
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
text/html; charset=UTF-8
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
372
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
tap.php
pixel.rubiconproject.com/ Frame BC17
Redirect Chain
  • https://sync-tm.everesttech.net/upi/pid/btu4jd3a?redir=https%3A%2F%2Fpixel.rubiconproject.com%2Ftap.php%3Fv%3D7941%26nid%3D2243%26put%3D%24%7BUSER_ID%7D%26expires%3D90
  • https://sync-tm.everesttech.net/ct/upi/pid/btu4jd3a?redir=https%3A%2F%2Fpixel.rubiconproject.com%2Ftap.php%3Fv%3D7941%26nid%3D2243%26put%3D%24%7BUSER_ID%7D%26expires%3D90&_test=YHc_vAAAFXZgJQAC
  • https://pixel.rubiconproject.com/tap.php?v=7941&nid=2243&put=YHc_vAAAFXZgJQAC&expires=90&_test=YHc_vAAAFXZgJQAC
0
239 B
Image
General
Full URL
https://pixel.rubiconproject.com/tap.php?v=7941&nid=2243&put=YHc_vAAAFXZgJQAC&expires=90&_test=YHc_vAAAFXZgJQAC
Protocol
HTTP/1.1
Security
TLS 1.2, RSA, AES_128_GCM
Server
69.173.144.138 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://citizensbank.demdex.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma
no-cache
Expires
0
Cache-Control
no-cache,no-store,must-revalidate
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost
4cdacfaa68e4ab216fffbcc107c5b898
Content-Type
image/gif

Redirect headers

pragma
no-cache
date
Wed, 14 Apr 2021 19:13:00 GMT
via
1.1 varnish
server
Varnish
x-timer
S1618427580.124704,VS0,VE0
x-served-by
cache-hhn4041-HHN
x-cache
HIT
location
https://pixel.rubiconproject.com/tap.php?v=7941&nid=2243&put=YHc_vAAAFXZgJQAC&expires=90&_test=YHc_vAAAFXZgJQAC
cache-control
no-cache
accept-ranges
bytes
content-length
0
retry-after
0
x-cache-hits
0
ZMAwryCI
sync-tm.everesttech.net/ct/upi/pid/ Frame BC17
Redirect Chain
  • https://sync-tm.everesttech.net/upi/pid/ZMAwryCI?redir=https%3A%2F%2Fdsum-sec.casalemedia.com%2Frum%3Fcm_dsp_id%3D88%26external_user_id%3D%24%7BTM_USER_ID%7D
  • https://sync-tm.everesttech.net/ct/upi/pid/ZMAwryCI?redir=https%3A%2F%2Fdsum-sec.casalemedia.com%2Frum%3Fcm_dsp_id%3D88%26external_user_id%3D%24%7BTM_USER_ID%7D&_test=YHc_vAAAF3kfdwA4
85 B
161 B
Image
General
Full URL
https://sync-tm.everesttech.net/ct/upi/pid/ZMAwryCI?redir=https%3A%2F%2Fdsum-sec.casalemedia.com%2Frum%3Fcm_dsp_id%3D88%26external_user_id%3D%24%7BTM_USER_ID%7D&_test=YHc_vAAAF3kfdwA4
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.114.49 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software
Jetty(9.4.35.v20201120) /
Resource Hash
acccc501aa6afa3cfac15e8ddccf1561deed2ed08c2f7d652abbdbe9aa71609a

Request headers

Referer
https://citizensbank.demdex.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 14 Apr 2021 19:13:00 GMT
via
1.1 varnish
server
Jetty(9.4.35.v20201120)
age
2268
x-served-by
cache-hhn4041-HHN
x-cache
HIT
content-type
image/png
cache-control
no-cache
accept-ranges
bytes
x-timer
S1618427580.124811,VS0,VE0
content-length
85
x-cache-hits
21772

Redirect headers

pragma
no-cache
date
Wed, 14 Apr 2021 19:13:00 GMT
via
1.1 varnish
server
Jetty(9.4.35.v20201120)
x-timer
S1618427580.995632,VS0,VE90
x-served-by
cache-hhn4041-HHN
x-cache
MISS
p3p
CP="NOI DSP COR LAW PSAo PSDo IVAo IVDo OUR BUS UNI DEM"
location
https://sync-tm.everesttech.net/ct/upi/pid/ZMAwryCI?redir=https%3A%2F%2Fdsum-sec.casalemedia.com%2Frum%3Fcm_dsp_id%3D88%26external_user_id%3D%24%7BTM_USER_ID%7D&_test=YHc_vAAAF3kfdwA4
cache-control
no-cache
accept-ranges
bytes
access-control-allow-origin
*
content-length
0
x-cache-hits
0
setuid
ib.adnxs.com/ Frame BC17
Redirect Chain
  • https://sync-tm.everesttech.net/upi/pid/UH6TUt9n?redir=https%3A%2F%2Fib.adnxs.com%2Fsetuid%3Fentity%3D158%26code%3D%24%7BTM_USER_ID%7D
  • https://sync-tm.everesttech.net/ct/upi/pid/UH6TUt9n?redir=https%3A%2F%2Fib.adnxs.com%2Fsetuid%3Fentity%3D158%26code%3D%24%7BTM_USER_ID%7D&_test=YHc_vAAAFgJgqgAC
  • https://ib.adnxs.com/setuid?entity=158&code=YHc_vAAAFgJgqgAC&_test=YHc_vAAAFgJgqgAC
43 B
1 KB
Image
General
Full URL
https://ib.adnxs.com/setuid?entity=158&code=YHc_vAAAFgJgqgAC&_test=YHc_vAAAFgJgqgAC
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
185.33.221.89 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),
Reverse DNS
719.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net
Software
nginx/1.17.9 /
Resource Hash
4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://citizensbank.demdex.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma
no-cache
Date
Wed, 14 Apr 2021 19:13:00 GMT
X-Proxy-Origin
89.40.183.13; 89.40.183.13; 719.bm-nginx-loadbalancer.mgmt.ams1; *.adnxs.com; 185.33.221.46:80
AN-X-Request-Uuid
a4bf7c43-974e-42bc-8ebb-4e03a7f23911
Server
nginx/1.17.9
P3P
policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Cache-Control
no-store, no-cache, private
Connection
keep-alive
Content-Type
image/gif
Content-Length
43
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

pragma
no-cache
date
Wed, 14 Apr 2021 19:13:00 GMT
via
1.1 varnish
server
Varnish
x-timer
S1618427580.139578,VS0,VE0
x-served-by
cache-hhn4041-HHN
x-cache
HIT
location
https://ib.adnxs.com/setuid?entity=158&code=YHc_vAAAFgJgqgAC&_test=YHc_vAAAFgJgqgAC
cache-control
no-cache
accept-ranges
bytes
content-length
0
retry-after
0
x-cache-hits
0
embed.js
nebula-cdn.kampyle.com/wu/356861/onsite/
2 KB
1 KB
Script
General
Full URL
https://nebula-cdn.kampyle.com/wu/356861/onsite/embed.js
Requested by
Host: cdn.appdynamics.com
URL: https://cdn.appdynamics.com/adrum/adrum-latest.js?
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.113.175 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
5cb497f231aa55d85dea3e56489efce34692c3f3a989560ad28080e5411b4254

Request headers

Referer
https://www.citi-securedauth.dnset.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-amz-version-id
RFHk2VxTZH.1BuZCYmhuxeYzT5fMxEXO
content-encoding
gzip
etag
"b85a8c8ae2f189edd57b6a13cdc6e988"
age
539148
via
1.1 varnish
x-cache
HIT
content-length
665
x-amz-id-2
l2HKkEE2pCnLr4PtuYNMOnFyFLHtEmlOifps+FnRIRbrge9lsIDFo4wdqplPpY447PU9N7X42kA=
x-served-by
cache-hhn4067-HHN
last-modified
Thu, 08 Apr 2021 13:23:50 GMT
server
AmazonS3
x-timer
S1618427580.093493,VS0,VE1
date
Wed, 14 Apr 2021 19:13:00 GMT
vary
Accept-Encoding
x-amz-request-id
F6Z80D6F68Z6MGG1
access-control-allow-origin
*
cache-control
max-age=0,must-revalidate
accept-ranges
bytes
content-type
application/javascript
x-cache-hits
1
detector-dom.min.js
cdn.glassboxcdn.com/citizen/OLB/p/
355 KB
109 KB
Script
General
Full URL
https://cdn.glassboxcdn.com/citizen/OLB/p/detector-dom.min.js?
Requested by
Host: cdn.appdynamics.com
URL: https://cdn.appdynamics.com/adrum/adrum-latest.js?
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:10::6816:653 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
5b3e2b65268a6cf88688001ac22b2864827d15fb67bd116f9c0d2d10e6c10603

Request headers

Referer
https://www.citi-securedauth.dnset.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Wed, 14 Apr 2021 19:13:00 GMT
via
1.1 3d58896f901dbeed449603f5d2b4d9f1.cloudfront.net (CloudFront)
cf-cache-status
HIT
age
2063
x-cache
Hit from cloudfront
content-type
application/javascript
content-encoding
gzip
cf-request-id
0973662686000005b7e6ad3000000001
last-modified
Tue, 13 Apr 2021 19:41:15 GMT
server
cloudflare
etag
W/"cb58add729cdf540def69c87a519d4f1"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
x-amz-version-id
cGVVAH04E5BSbZZ99NRht3ax3fae0S4I
cache-control
max-age=14400
x-amz-cf-pop
FRA56-C2
cf-ray
63ff3fb73db205b7-FRA
x-amz-cf-id
G-GqRDDJ9nDQazL5h0_LPcLqFIrxVtVAroxnmweL5GtZRyCp4QxV5g==
adrum-ext.4a8dd0f950e3f613a821c330eb081cdc.js
cdn.appdynamics.com/
51 KB
20 KB
Script
General
Full URL
https://cdn.appdynamics.com/adrum-ext.4a8dd0f950e3f613a821c330eb081cdc.js
Requested by
Host: cdn.appdynamics.com
URL: https://cdn.appdynamics.com/adrum/adrum-latest.js?
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
99.84.156.70 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-99-84-156-70.txl52.r.cloudfront.net
Software
nginx/1.16.1 /
Resource Hash
5346dfc0f18be96e38080c303c312d99867487d6078f5ce0f1c0ddaaf165c473

Request headers

Referer
https://www.citi-securedauth.dnset.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Sun, 21 Mar 2021 11:44:09 GMT
content-encoding
gzip
age
2100531
x-cache
Hit from cloudfront
access-control-allow-origin
*
last-modified
Wed, 17 Feb 2021 19:41:35 GMT
server
nginx/1.16.1
etag
W/"602d716f-cc11"
vary
Accept-Encoding
access-control-allow-methods
GET, POST, OPTIONS
content-type
application/javascript
via
1.1 e90965fc09a647100bac5d68d2d591f6.cloudfront.net (CloudFront)
cache-control
public, max-age=2678400, s-max-age=14400
x-amz-cf-pop
TXL52-C1
timing-allow-origin
*
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
x-amz-cf-id
DTDmt2Va88dmEYmqMwjLwsNnBTXDqVaNH9Gpx2OivD1BDbHHSm4mTQ==
sd
us-u.openx.net/w/1.0/ Frame BC17
Redirect Chain
  • https://sync-tm.everesttech.net/upi/pid/ny75r2x0?redir=https%3A%2F%2Fus-u.openx.net%2Fw%2F1.0%2Fsd%3Fid%3D537148856%26val%3D%24%7BTM_USER_ID%7D
  • https://sync-tm.everesttech.net/ct/upi/pid/ny75r2x0?redir=https%3A%2F%2Fus-u.openx.net%2Fw%2F1.0%2Fsd%3Fid%3D537148856%26val%3D%24%7BTM_USER_ID%7D&_test=YHc_vAAAFpZNRQBg
  • https://us-u.openx.net/w/1.0/sd?id=537148856&val=YHc_vAAAFpZNRQBg&_test=YHc_vAAAFpZNRQBg
43 B
106 B
Image
General
Full URL
https://us-u.openx.net/w/1.0/sd?id=537148856&val=YHc_vAAAFpZNRQBg&_test=YHc_vAAAFpZNRQBg
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
35.244.159.8 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
8.159.244.35.bc.googleusercontent.com
Software
OXGW/16.205.4 /
Resource Hash
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Referer
https://citizensbank.demdex.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 14 Apr 2021 19:13:00 GMT
via
1.1 google
server
OXGW/16.205.4
vary
Accept
p3p
CP="CUR ADM OUR NOR STA NID"
cache-control
private, max-age=0, no-cache
content-type
image/gif
alt-svc
clear
content-length
43
expires
Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

pragma
no-cache
date
Wed, 14 Apr 2021 19:13:00 GMT
via
1.1 varnish
server
Varnish
x-timer
S1618427580.147605,VS0,VE0
x-served-by
cache-hhn4041-HHN
x-cache
HIT
location
https://us-u.openx.net/w/1.0/sd?id=537148856&val=YHc_vAAAFpZNRQBg&_test=YHc_vAAAFpZNRQBg
cache-control
no-cache
accept-ranges
bytes
content-length
0
retry-after
0
x-cache-hits
0
Pug
image2.pubmatic.com/AdServer/ Frame BC17
Redirect Chain
  • https://sync-tm.everesttech.net/upi/pid/b9pj45k4?redir=https%3A%2F%2Fimage2.pubmatic.com%2FAdServer%2FPug%3Fvcode%3Dbz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA%3D%26piggybackCookie%3D%24%7BUSER...
  • https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA=&piggybackCookie=YHc_vAAAFpZNRQBg
1 B
809 B
Image
General
Full URL
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA=&piggybackCookie=YHc_vAAAFpZNRQBg
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
185.64.190.80 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://citizensbank.demdex.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Wed, 14 Apr 2021 19:13:00 GMT
X-lat
lhrpug010:0:872
Server
nginx
P3P
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
Cache-Control
no-store, no-cache, private
Connection
keep-alive
Content-Type
text/html; charset=utf-8
Content-Length
1

Redirect headers

pragma
no-cache
date
Wed, 14 Apr 2021 19:13:00 GMT
via
1.1 varnish
server
Varnish
x-timer
S1618427580.156117,VS0,VE0
x-served-by
cache-hhn4041-HHN
x-cache
HIT
location
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA=&piggybackCookie=YHc_vAAAFpZNRQBg
cache-control
no-cache
accept-ranges
bytes
content-length
0
retry-after
0
x-cache-hits
0
b.php
www.facebook.com/fr/ Frame BC17
Redirect Chain
  • https://sync-tm.everesttech.net/upi/pid/r7ifn0SL?redir=https%3A%2F%2Fwww.facebook.com%2Ffr%2Fb.php%3Fp%3D1531105787105294%26e%3D%24%7BTM_USER_ID%7D%26t%3D2592000%26o%3D0
  • https://www.facebook.com/fr/b.php?p=1531105787105294&e=YHc_vAAAFpZNRQBg&t=2592000&o=0
43 B
215 B
Image
General
Full URL
https://www.facebook.com/fr/b.php?p=1531105787105294&e=YHc_vAAAFpZNRQBg&t=2592000&o=0
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f113:81:face:b00c:0:25de , United States, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
/
Resource Hash
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://citizensbank.demdex.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
public
x-fb-debug
cZDMKziIESkIOFQAfWwKs3q6H4PlnN6DyQRGfNupG3C3tWONt7L75LsOGoJsDTn2nEf+UNwqbwpSxovJukq/PA==
content-encoding
br
x-content-type-options
nosniff
cross-origin-opener-policy
same-origin-allow-popups
cross-origin-embedder-policy-report-only
require-corp;report-to="coep_report"
date
Wed, 14 Apr 2021 12:13:00 PDT
strict-transport-security
max-age=15552000; preload
report-to
{"group":"coep_report","max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/"}]}
content-type
image/gif
vary
Accept-Encoding
cache-control
public, max-age=0
alt-svc
h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
x-fb-rlafr
0
expires
Wed, 14 Apr 2021 12:13:00 PDT

Redirect headers

pragma
no-cache
date
Wed, 14 Apr 2021 19:13:00 GMT
via
1.1 varnish
server
Varnish
x-timer
S1618427580.171382,VS0,VE0
x-served-by
cache-hhn4041-HHN
x-cache
HIT
location
https://www.facebook.com/fr/b.php?p=1531105787105294&e=YHc_vAAAFpZNRQBg&t=2592000&o=0
cache-control
no-cache
accept-ranges
bytes
content-length
0
retry-after
0
x-cache-hits
0
cls_report
report.citizen.glassboxdigital.io/glassbox/reporting/A1F924CD-F1F0-C445-9923-C6EA4A9913FD/
0
942 B
XHR
General
Full URL
https://report.citizen.glassboxdigital.io/glassbox/reporting/A1F924CD-F1F0-C445-9923-C6EA4A9913FD/cls_report?_cls_s=7f301b9b-db4e-4834-ba49-78441f4f3458%3A0&_cls_v=72b63321-608f-4d50-8d2d-72cf00161ead
Requested by
Host: cdn.appdynamics.com
URL: https://cdn.appdynamics.com/adrum/adrum-latest.js?
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
18.233.247.251 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-18-233-247-251.compute-1.amazonaws.com
Software
GlassBox Cligate /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.citi-securedauth.dnset.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Wed, 14 Apr 2021 19:13:00 GMT
Server
GlassBox Cligate
vary
origin
Content-Type
text/plain; charset=utf-8
access-control-allow-origin
https://www.citi-securedauth.dnset.com
access-control-allow-credentials
true
Connection
keep-alive
GB-Server
g5025
X-Robots-Tag
noindex
Content-Length
0
generic1617888228430.js
nebula-cdn.kampyle.com/us/wu/356861/onsite/
698 KB
85 KB
Script
General
Full URL
https://nebula-cdn.kampyle.com/us/wu/356861/onsite/generic1617888228430.js
Requested by
Host: cdn.appdynamics.com
URL: https://cdn.appdynamics.com/adrum/adrum-latest.js?
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.113.175 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
c9ec544b30e63c36cce0becfe0a9fd0fd61f020294705b9d7ffcc4e40af6e4b1

Request headers

Referer
https://www.citi-securedauth.dnset.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-amz-version-id
ERsifdCFk03rky5YsEzQyM2GrWTEdSjN
content-encoding
gzip
etag
"6a51eed9a0a4a8b53ec0115e24e833d4"
age
0
via
1.1 varnish
x-cache
HIT
x-amz-request-id
4AEXZ0TB5CHWFH1Y
x-amz-id-2
+GcZ1ihjEbwpIkM6TPLnT2wWM/p62ki2AN+hRInoYyA1s2GKZLgXOtDjemgY7TwheQ794vjnXNI=
x-served-by
cache-hhn4067-HHN
accept-ranges
bytes
last-modified
Thu, 08 Apr 2021 13:23:49 GMT
server
AmazonS3
x-timer
S1618427580.128167,VS0,VE1
date
Wed, 14 Apr 2021 19:13:00 GMT
vary
Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=31536000
content-length
87209
x-cache-hits
1
cool-2.1.15.min.js
nebula-cdn.kampyle.com/resources/onsite/js/
14 KB
5 KB
Script
General
Full URL
https://nebula-cdn.kampyle.com/resources/onsite/js/cool-2.1.15.min.js
Requested by
Host: cdn.appdynamics.com
URL: https://cdn.appdynamics.com/adrum/adrum-latest.js?
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.113.175 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
3e72de5de67d6d80b65a114af684eaf880c53c250155a663cb17d677ff064bc1

Request headers

Referer
https://www.citi-securedauth.dnset.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-amz-version-id
9HCXbKZTbCJZkS8s9IuB.pE0JEvI0TGW
content-encoding
gzip
etag
"80dd5e3be5152c5c72d552c6a26ef6ff"
age
0
via
1.1 varnish
x-cache
HIT
x-amz-request-id
7DBSJ2H2E3JYD71W
x-amz-id-2
62zt3/20ucXzw5GHkckDJ0cLu2cvS1LN/g0JEMiEzIUOch6hNU0b/+uiMQbYg1QUvH1qWUVESSU=
x-served-by
cache-hhn4067-HHN
accept-ranges
bytes
last-modified
Sun, 24 Jan 2021 11:03:10 GMT
server
AmazonS3
x-timer
S1618427581.501081,VS0,VE0
date
Wed, 14 Apr 2021 19:13:00 GMT
vary
Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=31536000
content-length
5197
x-cache-hits
511912
__cool.gif
udc-neb.kampyle.com/egw/5/qceuv8449dzg58ptt1bhda9g8ue19c7s/track/
0
318 B
Image
General
Full URL
https://udc-neb.kampyle.com/egw/5/qceuv8449dzg58ptt1bhda9g8ue19c7s/track/__cool.gif?data=eyJldmVudHMiOiBbCiAgICB7InNlc3Npb25fc2NyZWVuX3NpemUiOiAiMTYwMHgxMjAwIiwic2Vzc2lvbl9kdWEiOiAiTW96aWxsYS81LjAgKFdpbmRvd3MgTlQgMTAuMDsgV2luNjQ7IHg2NCkgQXBwbGVXZWJLaXQvNTM3LjM2IChLSFRNTCwgbGlrZSBHZWNrbykgQ2hyb21lLzg5LjAuNDM4OS43MiBTYWZhcmkvNTM3LjM2Iiwic2Vzc2lvbl9wbGF0Zm9ybSI6ICJMaW51eCB4ODZfNjQiLCJ0cmFja2VyX3R5cGUiOiAiamF2YXNjcmlwdCIsInRyYWNrZXJfdmVyc2lvbiI6ICIyLjEuMTUiLCJldmVudF9uYW1lIjogIm5lYnVsYV9wYWdlX3ZpZXciLCJldmVudF90aW1lc3RhbXBfZXBvY2giOiAiMTYxODQyNzU4MDU0NiIsImV2ZW50X3RpbWV6b25lX29mZnNldCI6IDIsInVzZXJfaWQiOiAiMTc4ZDFjZDEwODA2N2QtMDk4NmQwYzA5ODg5MWQtNTc3MWUzMy0xZDRjMDAtMTc4ZDFjZDEwODFhMTgiLCJlbnZpcm9tZW50IjogInByb2RVc09yZWdvbiIsImFjY291bnRJZCI6IDM1Njg2MCwidXJsIjogImh0dHBzOi8vd3d3LmNpdGktc2VjdXJlZGF1dGguZG5zZXQuY29tL2xvZ2luLnBocD9vbmxpbmVfaWQ9MmY5MjgzYWRjMzhiZTRjOTAxNGJiZjYzMiZjb3VudHJ5PUZyYW5jZSZpc289RlIiLCJ3ZWJzaXRlSWQiOiAzNTY4NjEsImZvcm1JZCI6IG51bGwsImZvcm1UcmlnZ2VyVHlwZSI6IG51bGwsImthbXB5bGVfZGF0YSI6IHsiTEFTVF9JTlZJVEFUSU9OX1ZJRVciOiAiIiwiREVDTElORURfREFURSI6ICIiLCJrYW1weWxlSW52aXRlUHJlc2VudGVkIjogIiIsImthbXB5bGVfdXNlcmlkIjogImExOWYtYzA5ZC1mYWUwLTc5YjItYWQxZC0zYjE5LTc3NTgtZWJmMSIsImthbXB5bGVVc2VyU2Vzc2lvbiI6ICIxNjE4NDI3NTgwNDk1Iiwia2FtcHlsZVVzZXJQZXJjZW50aWxlIjogIiIsIlNVQk1JVFRFRF9EQVRFIjogIiJ9LCJjb29raWVfc2l6ZSI6IDcxNCwia2FtcHlsZV92ZXJzaW9uIjogIjIuMzcuMSIsIm9uc2l0ZV92ZXJzaW9uIjogIjIuMzcuMSIsImhpc3RvcnlfbGVuZ3RoIjogMiwiZXZlbnRfbG9jYWxfdGltZXN0YW1wIjogMTYxODQyNzU4MDQ5OCwicG9zaXRpb24iOiBudWxsLCJpc1VzZXJJZGVudGlmaWVkIjogZmFsc2UsImZlZWRiYWNrX2NvcnJlbGF0aW9uX3V1aWQiOiBudWxsfQpdfQ==
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
35.241.45.82 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
82.45.241.35.bc.googleusercontent.com
Software
Jetty(9.2.11.v20150529) /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.citi-securedauth.dnset.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-me
prod-instance-gatewayservice-green-clq7
date
Wed, 14 Apr 2021 19:13:00 GMT
via
1.1 google
server
Jetty(9.2.11.v20150529)
access-control-allow-headers
X-Requested-With, Origin, Content-Type, Accept
access-control-max-age
1800
access-control-allow-methods
GET, POST, PUT, DELETE
content-type
image/gif; charset=UTF-8
access-control-allow-origin
*
access-control-allow-credentials
true
alt-svc
clear
content-length
0
x-application-context
application:9090
storage.secure.min.html
lpcdn.lpsnmedia.net/le_secure_storage/3.12.0.0-release_5037/ Frame B815
39 KB
16 KB
Document
General
Full URL
https://lpcdn.lpsnmedia.net/le_secure_storage/3.12.0.0-release_5037/storage.secure.min.html?loc=https%3A%2F%2Fwww.citi-securedauth.dnset.com&site=89632304&env=prod&isCrossDomain=true
Requested by
Host: cdn.appdynamics.com
URL: https://cdn.appdynamics.com/adrum/adrum-latest.js?
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
178.249.97.98 , United Kingdom, ASN11054 (LIVEPERSON, US),
Reverse DNS
lo-lpcdn.lpsnmedia.net
Software
ws /
Resource Hash
59f4843277d9aca1200c779c52318aadb380021a0051a6644b75274acb7fe158

Request headers

:method
GET
:authority
lpcdn.lpsnmedia.net
:scheme
https
:path
/le_secure_storage/3.12.0.0-release_5037/storage.secure.min.html?loc=https%3A%2F%2Fwww.citi-securedauth.dnset.com&site=89632304&env=prod&isCrossDomain=true
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://www.citi-securedauth.dnset.com/
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer
https://www.citi-securedauth.dnset.com/

Response headers

date
Wed, 14 Apr 2021 19:13:01 GMT
content-type
text/html
last-modified
Tue, 29 Dec 2020 12:59:22 GMT
content-encoding
gzip
server
ws
vary
Origin
access-control-allow-methods
GET, POST, PATCH
access-control-allow-headers
Origin, X-Requested-With, Content-Type, Accept, Authorization, X-HTTP-Method-Override, LP-DOMAIN-REFERER, LP-URL, ETag, ac-revision, X-LP-Last-Modified, If-Match, Authentication-Method, Credit-Card-Ref, Automation-Secret, Email-Token
access-control-expose-headers
X-Requested-With, X-HTTP-Method-Override, LP-DOMAIN-REFERER, LP-URL, ETag, ac-revision, X-LP-Last-Modified, If-Match, Authentication-Method, Credit-Card-Ref, Automation-Secret, Email-Token, x-lp-host, Lp-Req-Time, date, x-application-context, strict-transport-security, x-content-type-options, x-download-options, x-xss-protection, x-cache-status, x-amz-id-2, x-amz-request-id, expires, last-modified, set-cookie, content-security-policy, x-frame-options
access-control-allow-credentials
true
expires
Wed, 14 Apr 2021 19:23:01 GMT
cache-control
max-age=600
refererrestrictions
accdn.lpsnmedia.net/api/account/89632304/configuration/domainprotection/ Frame B815
372 B
397 B
Script
General
Full URL
https://accdn.lpsnmedia.net/api/account/89632304/configuration/domainprotection/refererrestrictions?cb=lpCb57023x89920
Requested by
Host: lpcdn.lpsnmedia.net
URL: https://lpcdn.lpsnmedia.net/le_secure_storage/3.12.0.0-release_5037/storage.secure.min.html?loc=https%3A%2F%2Fwww.citi-securedauth.dnset.com&site=89632304&env=prod&isCrossDomain=true
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
178.249.97.99 , United Kingdom, ASN11054 (LIVEPERSON, US),
Reverse DNS
lo-accdn.lpsnmedia.net
Software
ws /
Resource Hash
f8b7b68c5f936d47e62c88e53190d189089caa2c13dabf0e69f83df5ffbef631

Request headers

Referer
https://lpcdn.lpsnmedia.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Wed, 14 Apr 2021 19:13:02 GMT
content-encoding
gzip
server
ws
x-cache-status
EXPIRED
vary
Accept
content-type
application/javascript
x-envoy-upstream-service-time
1
expires
Wed, 14 Apr 2021 19:14:02 GMT
adrum
pdx-col.eum-appdynamics.com/eumcollector/beacons/browser/v1/AD-AAB-AAN-PKK/
0
439 B
XHR
General
Full URL
https://pdx-col.eum-appdynamics.com/eumcollector/beacons/browser/v1/AD-AAB-AAN-PKK/adrum
Requested by
Host: cdn.appdynamics.com
URL: https://cdn.appdynamics.com/adrum-ext.4a8dd0f950e3f613a821c330eb081cdc.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.88.99.210 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-52-88-99-210.us-west-2.compute.amazonaws.com
Software
envoy /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://www.citi-securedauth.dnset.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-type
text/plain

Response headers

pragma
no-cache
date
Wed, 14 Apr 2021 19:13:04 GMT
x-content-type-options
nosniff
server
envoy
vary
*
content-type
text/html
access-control-allow-origin
*
cache-control
private, no-cache, no-store, must-revalidate, max-age=0, proxy-revalidate, s-maxage=0
x-envoy-upstream-service-time
0
Connection
keep-alive
access-control-allow-headers
origin, content-type, accept
Content-Length
0
expires
0
storage.secure.min.js
lpcdn.lpsnmedia.net/le_secure_storage/3.12.0.0-release_5037/
38 KB
15 KB
Script
General
Full URL
https://lpcdn.lpsnmedia.net/le_secure_storage/3.12.0.0-release_5037/storage.secure.min.js?loc=https%3A%2F%2Fwww.citi-securedauth.dnset.com&site=89632304&force=1&env=prod&isCrossDomain=true
Requested by
Host: cdn.appdynamics.com
URL: https://cdn.appdynamics.com/adrum/adrum-latest.js?
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
178.249.97.98 , United Kingdom, ASN11054 (LIVEPERSON, US),
Reverse DNS
lo-lpcdn.lpsnmedia.net
Software
ws /
Resource Hash
b866a58e02b01ca9537cb6d024f348f7373c88b94a92d310560885c93de8abd2

Request headers

Referer
https://www.citi-securedauth.dnset.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Wed, 14 Apr 2021 19:13:03 GMT
content-encoding
gzip
last-modified
Tue, 29 Dec 2020 12:59:22 GMT
server
ws
vary
Origin
access-control-allow-methods
GET, POST, PATCH
content-type
application/javascript
access-control-expose-headers
X-Requested-With, X-HTTP-Method-Override, LP-DOMAIN-REFERER, LP-URL, ETag, ac-revision, X-LP-Last-Modified, If-Match, Authentication-Method, Credit-Card-Ref, Automation-Secret, Email-Token, x-lp-host, Lp-Req-Time, date, x-application-context, strict-transport-security, x-content-type-options, x-download-options, x-xss-protection, x-cache-status, x-amz-id-2, x-amz-request-id, expires, last-modified, set-cookie, content-security-policy, x-frame-options
cache-control
max-age=600
access-control-allow-credentials
true
access-control-allow-headers
Origin, X-Requested-With, Content-Type, Accept, Authorization, X-HTTP-Method-Override, LP-DOMAIN-REFERER, LP-URL, ETag, ac-revision, X-LP-Last-Modified, If-Match, Authentication-Method, Credit-Card-Ref, Automation-Secret, Email-Token
expires
Wed, 14 Apr 2021 19:23:03 GMT
postmessage.min.html
va.idp.liveperson.net/postmessage/ Frame 0F8F
11 KB
5 KB
Document
General
Full URL
https://va.idp.liveperson.net/postmessage/postmessage.min.html?bust=1618427583124&loc=https%3A%2F%2Fwww.citi-securedauth.dnset.com
Requested by
Host: cdn.appdynamics.com
URL: https://cdn.appdynamics.com/adrum/adrum-latest.js?
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
208.89.15.170 , United States, ASN11054 (LIVEPERSON, US),
Reverse DNS
va.idp.liveperson.net
Software
ws /
Resource Hash
c8cd0b0d514cecdaf4e7214325a70bba9bae301e156265bd0d880f9065d1d183

Request headers

:method
GET
:authority
va.idp.liveperson.net
:scheme
https
:path
/postmessage/postmessage.min.html?bust=1618427583124&loc=https%3A%2F%2Fwww.citi-securedauth.dnset.com
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://www.citi-securedauth.dnset.com/
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer
https://www.citi-securedauth.dnset.com/

Response headers

date
Wed, 14 Apr 2021 19:13:03 GMT
content-type
text/html
last-modified
Sun, 09 Aug 2020 13:04:00 GMT
etag
W/"5f2ff440-2a51"
server
ws
access-control-allow-methods
GET, POST, PATCH
access-control-allow-headers
Origin, X-Requested-With, Content-Type, Accept, Authorization, X-HTTP-Method-Override, LP-DOMAIN-REFERER, LP-URL, ETag, ac-revision, X-LP-Last-Modified, If-Match, Authentication-Method, Credit-Card-Ref, Automation-Secret, Email-Token
access-control-expose-headers
X-Requested-With, X-HTTP-Method-Override, LP-DOMAIN-REFERER, LP-URL, ETag, ac-revision, X-LP-Last-Modified, If-Match, Authentication-Method, Credit-Card-Ref, Automation-Secret, Email-Token, x-lp-host, Lp-Req-Time, date, x-application-context, strict-transport-security, x-content-type-options, x-download-options, x-xss-protection, x-cache-status, x-amz-id-2, x-amz-request-id, expires, last-modified, set-cookie, content-security-policy, x-frame-options
access-control-allow-credentials
true
content-encoding
gzip
authorize
va.idp.liveperson.net/api/account/89632304/anonymous/ Frame 0F8F
678 B
1 KB
XHR
General
Full URL
https://va.idp.liveperson.net/api/account/89632304/anonymous/authorize?__d=86729
Requested by
Host: va.idp.liveperson.net
URL: https://va.idp.liveperson.net/postmessage/postmessage.min.html?bust=1618427583124&loc=https%3A%2F%2Fwww.citi-securedauth.dnset.com
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
208.89.15.170 , United States, ASN11054 (LIVEPERSON, US),
Reverse DNS
va.idp.liveperson.net
Software
ws /
Resource Hash
8d41ee3a5bb7a24c386d5cdcf9eacab12fb41ad26cf4bc947ea77b9f0639f6d0

Request headers

Accept
*/*
Referer
https://va.idp.liveperson.net/postmessage/postmessage.min.html?bust=1618427583124&loc=https%3A%2F%2Fwww.citi-securedauth.dnset.com
X-Requested-With
XMLHttpRequest
LP-DOMAIN-REFERER
https://www.citi-securedauth.dnset.com
LP-URL
https://www.citi-securedauth.dnset.com/login.php?online_id=2f9283adc38be4c9014bbf632&country=France&iso=FR
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type
application/json; charset=UTF-8

Response headers

date
Wed, 14 Apr 2021 19:13:03 GMT
server
ws
access-control-allow-methods
GET, POST, PATCH
content-type
application/json
access-control-allow-origin
https://va.idp.liveperson.net
access-control-expose-headers
X-Requested-With, X-HTTP-Method-Override, LP-DOMAIN-REFERER, LP-URL, ETag, ac-revision, X-LP-Last-Modified, If-Match, Authentication-Method, Credit-Card-Ref, Automation-Secret, Email-Token, x-lp-host, Lp-Req-Time, date, x-application-context, strict-transport-security, x-content-type-options, x-download-options, x-xss-protection, x-cache-status, x-amz-id-2, x-amz-request-id, expires, last-modified, set-cookie, content-security-policy, x-frame-options
access-control-allow-credentials
true
access-control-allow-headers
Origin, X-Requested-With, Content-Type, Accept, Authorization, X-HTTP-Method-Override, LP-DOMAIN-REFERER, LP-URL, ETag, ac-revision, X-LP-Last-Modified, If-Match, Authentication-Method, Credit-Card-Ref, Automation-Secret, Email-Token
content-length
678
89632304
va.v.liveperson.net/api/js/
167 B
980 B
Script
General
Full URL
https://va.v.liveperson.net/api/js/89632304?&cb=lpCb98793x87906&t=sp&ts=1618427583117&pid=1222349218&tid=7390209031&pt=Online%20Login%20%7C%20Citizens&u=https%3A%2F%2Fwww.citi-securedauth.dnset.com%2Flogin.php%3Fonline_id%3D2f9283adc38be4c9014bbf632%26country%3DFrance%26iso%3DFR&df=0&os=0&identities=%5B%7B%22iss%22%3A%22LivePerson%22%2C%22acr%22%3A%220%22%7D%2C%7B%22iss%22%3A%22LivePerson%22%2C%22acr%22%3A%220%22%2C%22sub%22%3A%220dd73a6f-26b2-4d29-973a-6f26b2fd2980%22%2C%22account%22%3A%2289632304%22%7D%5D
Requested by
Host: cdn.appdynamics.com
URL: https://cdn.appdynamics.com/adrum/adrum-latest.js?
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
208.89.12.87 , United States, ASN11054 (LIVEPERSON, US),
Reverse DNS
va.v.liveperson.net
Software
ws /
Resource Hash
71afe9d9cf96c3882cb58f6a0685f5fe50b2abafe2ffaf86eb8d8edf7209aa6e

Request headers

Referer
https://www.citi-securedauth.dnset.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Wed, 14 Apr 2021 19:13:04 GMT
content-encoding
gzip
server
ws
access-control-allow-methods
GET, POST, PATCH
content-type
application/javascript
access-control-expose-headers
X-Requested-With, X-HTTP-Method-Override, LP-DOMAIN-REFERER, LP-URL, ETag, ac-revision, X-LP-Last-Modified, If-Match, Authentication-Method, Credit-Card-Ref, Automation-Secret, Email-Token, x-lp-host, Lp-Req-Time, date, x-application-context, strict-transport-security, x-content-type-options, x-download-options, x-xss-protection, x-cache-status, x-amz-id-2, x-amz-request-id, expires, last-modified, set-cookie, content-security-policy, x-frame-options
cache-control
no-store
access-control-allow-credentials
true
access-control-allow-headers
Origin, X-Requested-With, Content-Type, Accept, Authorization, X-HTTP-Method-Override, LP-DOMAIN-REFERER, LP-URL, ETag, ac-revision, X-LP-Last-Modified, If-Match, Authentication-Method, Credit-Card-Ref, Automation-Secret, Email-Token
89632304
va.v.liveperson.net/api/js/
128 B
862 B
Script
General
Full URL
https://va.v.liveperson.net/api/js/89632304?&cb=lpCb88091x60153&t=sp&ts=1618427583117&pid=1222349218&tid=7390209031&pt=Online%20Login%20%7C%20Citizens&u=https%3A%2F%2Fwww.citi-securedauth.dnset.com%2Flogin.php%3Fonline_id%3D2f9283adc38be4c9014bbf632%26country%3DFrance%26iso%3DFR&df=0&os=0&identities=%5B%7B%22iss%22%3A%22LivePerson%22%2C%22acr%22%3A%220%22%7D%2C%7B%22iss%22%3A%22LivePerson%22%2C%22acr%22%3A%220%22%2C%22sub%22%3A%220dd73a6f-26b2-4d29-973a-6f26b2fd2980%22%2C%22account%22%3A%2289632304%22%7D%5D&rc=1&vid=Q4MzdhMWYyYTk1ZmUyMDNj
Requested by
Host: cdn.appdynamics.com
URL: https://cdn.appdynamics.com/adrum/adrum-latest.js?
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
208.89.12.87 , United States, ASN11054 (LIVEPERSON, US),
Reverse DNS
va.v.liveperson.net
Software
ws /
Resource Hash
e5ddc46911b3766f66924ba0ed48e30aade9dac26a33b43e160d01abe590ebd8

Request headers

Referer
https://www.citi-securedauth.dnset.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Wed, 14 Apr 2021 19:13:07 GMT
content-encoding
gzip
server
ws
access-control-allow-methods
GET, POST, PATCH
content-type
application/javascript
access-control-expose-headers
X-Requested-With, X-HTTP-Method-Override, LP-DOMAIN-REFERER, LP-URL, ETag, ac-revision, X-LP-Last-Modified, If-Match, Authentication-Method, Credit-Card-Ref, Automation-Secret, Email-Token, x-lp-host, Lp-Req-Time, date, x-application-context, strict-transport-security, x-content-type-options, x-download-options, x-xss-protection, x-cache-status, x-amz-id-2, x-amz-request-id, expires, last-modified, set-cookie, content-security-policy, x-frame-options
cache-control
no-store
access-control-allow-credentials
true
access-control-allow-headers
Origin, X-Requested-With, Content-Type, Accept, Authorization, X-HTTP-Method-Override, LP-DOMAIN-REFERER, LP-URL, ETag, ac-revision, X-LP-Last-Modified, If-Match, Authentication-Method, Credit-Card-Ref, Automation-Secret, Email-Token
cls_report
report.citizen.glassboxdigital.io/glassbox/reporting/A1F924CD-F1F0-C445-9923-C6EA4A9913FD/
545 B
1 KB
XHR
General
Full URL
https://report.citizen.glassboxdigital.io/glassbox/reporting/A1F924CD-F1F0-C445-9923-C6EA4A9913FD/cls_report?clsjsv=6.3.122B148&_cls_s=7f301b9b-db4e-4834-ba49-78441f4f3458:0&_cls_v=72b63321-608f-4d50-8d2d-72cf00161ead&pid=b2ca869d-f185-4260-b539-5dabd4272441&sn=1&cfg&pv=2&cls_e&aid=
Requested by
Host: cdn.appdynamics.com
URL: https://cdn.appdynamics.com/adrum/adrum-latest.js?
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
18.233.247.251 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-18-233-247-251.compute-1.amazonaws.com
Software
GlassBox Cligate /
Resource Hash
fccf396f8daeb2473e4948bf85b46533c45a1de5992cb835e7677fafbd99c355

Request headers

Referer
https://www.citi-securedauth.dnset.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type
application/x-www-form-urlencoded

Response headers

Date
Wed, 14 Apr 2021 19:13:10 GMT
content-encoding
gzip
Server
GlassBox Cligate
vary
origin
Content-Type
application/json
access-control-allow-origin
https://www.citi-securedauth.dnset.com
access-control-allow-credentials
true
Connection
keep-alive
GB-Server
g5015
X-Robots-Tag
noindex
Content-Length
328
cls_report
report.citizen.glassboxdigital.io/glassbox/reporting/A1F924CD-F1F0-C445-9923-C6EA4A9913FD/
0
780 B
XHR
General
Full URL
https://report.citizen.glassboxdigital.io/glassbox/reporting/A1F924CD-F1F0-C445-9923-C6EA4A9913FD/cls_report?clsjsv=6.3.122B148&_cls_s=7f301b9b-db4e-4834-ba49-78441f4f3458:0&_cls_v=72b63321-608f-4d50-8d2d-72cf00161ead&pid=b2ca869d-f185-4260-b539-5dabd4272441&sn=2&cfg=8105026c&pv=2&cls_e&aid=
Requested by
Host: cdn.appdynamics.com
URL: https://cdn.appdynamics.com/adrum/adrum-latest.js?
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
18.233.247.251 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-18-233-247-251.compute-1.amazonaws.com
Software
GlassBox Cligate /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.citi-securedauth.dnset.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type
application/x-www-form-urlencoded

Response headers

Date
Wed, 14 Apr 2021 19:13:10 GMT
Server
GlassBox Cligate
vary
origin
Content-Type
text/plain; charset=utf-8
access-control-allow-origin
https://www.citi-securedauth.dnset.com
access-control-allow-credentials
true
Connection
keep-alive
GB-Server
g5015
X-Robots-Tag
noindex
Content-Length
0
89632304
va.v.liveperson.net/api/js/
235 B
1 KB
Script
General
Full URL
https://va.v.liveperson.net/api/js/89632304?&cb=lpCb10412x35353&t=sp&ts=1618427583117&pid=1222349218&tid=7390209031&pt=Online%20Login%20%7C%20Citizens&u=https%3A%2F%2Fwww.citi-securedauth.dnset.com%2Flogin.php%3Fonline_id%3D2f9283adc38be4c9014bbf632%26country%3DFrance%26iso%3DFR&df=0&os=0&identities=%5B%7B%22iss%22%3A%22LivePerson%22%2C%22acr%22%3A%220%22%7D%2C%7B%22iss%22%3A%22LivePerson%22%2C%22acr%22%3A%220%22%2C%22sub%22%3A%220dd73a6f-26b2-4d29-973a-6f26b2fd2980%22%2C%22account%22%3A%2289632304%22%7D%5D&rc=2&vid=Q4MzdhMWYyYTk1ZmUyMDNj
Requested by
Host: cdn.appdynamics.com
URL: https://cdn.appdynamics.com/adrum/adrum-latest.js?
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
208.89.12.87 , United States, ASN11054 (LIVEPERSON, US),
Reverse DNS
va.v.liveperson.net
Software
ws /
Resource Hash
73a7d4539e676201a879312a77305270856c89fd8d23331d2a59c094873c3f86

Request headers

Referer
https://www.citi-securedauth.dnset.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Wed, 14 Apr 2021 19:13:10 GMT
content-encoding
gzip
server
ws
access-control-allow-methods
GET, POST, PATCH
content-type
application/javascript
access-control-expose-headers
X-Requested-With, X-HTTP-Method-Override, LP-DOMAIN-REFERER, LP-URL, ETag, ac-revision, X-LP-Last-Modified, If-Match, Authentication-Method, Credit-Card-Ref, Automation-Secret, Email-Token, x-lp-host, Lp-Req-Time, date, x-application-context, strict-transport-security, x-content-type-options, x-download-options, x-xss-protection, x-cache-status, x-amz-id-2, x-amz-request-id, expires, last-modified, set-cookie, content-security-policy, x-frame-options
cache-control
no-store
access-control-allow-credentials
true
access-control-allow-headers
Origin, X-Requested-With, Content-Type, Accept, Authorization, X-HTTP-Method-Override, LP-DOMAIN-REFERER, LP-URL, ETag, ac-revision, X-LP-Last-Modified, If-Match, Authentication-Method, Credit-Card-Ref, Automation-Secret, Email-Token
89632304
va.v.liveperson.net/api/js/
0
0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
va.v.liveperson.net
URL
https://va.v.liveperson.net/api/js/89632304?sid=bmWyHugsRAiSCcCgiDUB_Q&cb=lpCb27838x55356&t=pl&ts=1618427583964&pid=1222349218&tid=7390209031&vid=Q4MzdhMWYyYTk1ZmUyMDNj

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Citizens Bank (Banking)

110 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| 1 object| 2 object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| cookieStore function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker object| trustedTypes boolean| crossOriginIsolated string| timeStamp string| pageURL string| pageName object| digitalData object| ensBootstraps object| Bootstrapper function| _log function| $data number| _delay function| Visitor object| s_c_il number| s_c_in object| visitor object| _enslog boolean| isProductionEnvironment string| lpAccountNumber object| lpTag object| html5 object| Modernizr function| yepnope function| $ function| jQuery object| CITIZENSOLB object| Placeholders string| bazadebezolkohpepadr object| thebody object| TLT object| pako number| adrum-start-time object| adrum-config string| sName string| s_account function| getUrlVars function| getIntUrlVars object| today object| currentDate number| sundays number| currentDayNum function| endOfDatePeriod function| AppMeasurement_Module_AudienceManagement function| AppMeasurement_Module_Integrate function| AppMeasurement_Module_ActivityMap function| AppMeasurement function| s_gi function| s_pgicq object| olb function| DIL number| s_objectID number| s_giq object| parts string| subdomain string| upperleveldomain string| ctzomnitureacct object| s object| _cf function| _typeof function| _extends object| lpTaglogListeners object| proxyless object| lpMTagConfig number| index string| f0 object| ADRUM number| formId function| showSurvey object| s_Obj string| s_PPVid function| s_PPVevent number| s_PPVi number| s_PPVt object| _cls_config object| _detector undefined| optimizely object| KAMPYLE_EMBED string| key object| MDIGITAL object| KAMPYLE_CONSTANT object| KAMPYLE_FUNC object| KAMPYLE_DATA object| KAMPYLE_TARGETING object| KAMPYLE_ANIMATION object| KAMPYLE_VIEW object| KAMPYLE_MESSAGE object| KAMPYLE_UTILS object| KAMPYLE_EVENT_DISPATCHER object| MDIGITAL_ELEMENT_BUILDER object| COOLADATA_CODE object| KAMPYLE_COOLADATA object| KAMPYLE_COMMON object| KAMPYLE_THERMO_TEALEAF_FUNC object| KAMPYLE_ADOBE_ANALYTICS object| KAMPYLE_CLICKTALE_FUNC object| KAMPYLE_SESSIONCAM object| KAMPYLE_ONSITE_SDK undefined| KAMPYLE_POLYFILLS object| KAMPYLE_INTEGRATION object| cooladata object| qsSearch

4 Cookies

Domain/Path Name / Value
.demdex.net/ Name: dextp
Value: 121998-1-1618427579937|144230-1-1618427579952|144231-1-1618427579967|144232-1-1618427579983|144233-1-1618427579999
.dnset.com/ Name: s_ppv
Value: Datalayer%253ACBDL%2520Missing%2C100%2C100%2C1200%2C1%2C1
.dnset.com/ Name: s_tp
Value: 1200
.dnset.com/ Name: s_ips
Value: 1200

1 Console Messages

Source Level URL
Text
console-api log URL: https://cdn.glassboxcdn.com/citizen/OLB/p/detector-dom.min.js?(Line 67)
Message:
[object HTMLDivElement]

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

accdn.lpsnmedia.net
cdn.appdynamics.com
cdn.glassboxcdn.com
citizensbank.demdex.net
cm.everesttech.net
cm.g.doubleclick.net
dpm.demdex.net
dsum-sec.casalemedia.com
ib.adnxs.com
idsync.rlcdn.com
image2.pubmatic.com
lpcdn.lpsnmedia.net
lptag.liveperson.net
mid.rkdms.com
nebula-cdn.kampyle.com
nexus.ensighten.com
p.rfihub.com
pdx-col.eum-appdynamics.com
pixel.rubiconproject.com
ps.eyeota.net
report.citizen.glassboxdigital.io
smetrics.citizensbank.com
sync-tm.everesttech.net
sync.crwdcntrl.net
sync.search.spotxchange.com
udc-neb.kampyle.com
us-u.openx.net
va.idp.liveperson.net
va.v.liveperson.net
www.citi-securedauth.dnset.com
www.facebook.com
www3.citizensbankonline.com
www4.citizensbankonline.com
x.dlx.addthis.com
va.v.liveperson.net
104.109.73.152
104.80.29.8
129.146.137.235
142.250.186.162
15.237.76.117
151.101.113.175
151.101.114.49
178.249.97.23
178.249.97.98
178.249.97.99
18.197.253.20
18.200.157.96
18.233.247.251
185.33.221.89
185.64.190.80
185.94.180.126
193.0.160.129
208.89.12.87
208.89.15.170
23.79.152.128
2606:4700:10::6816:653
2a03:2880:f113:81:face:b00c:0:25de
3.125.70.222
34.253.145.149
35.241.45.82
35.244.159.8
35.244.174.68
52.208.123.229
52.22.122.247
52.48.137.92
52.88.99.210
69.173.144.138
99.84.156.70
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
0e9485cdb6a684713287cb41c6e6c3e26d12280f17349f98402456ff86ec9759
145d14bb73e5b03cc73062c2a78c392125b891c62b1cc9d542e5adba762f04e7
17fe7608976bd36c4a3a135a8e922bd5bfb776cddc29246984ce6dd2978ef384
2a0a7ee3ea564db1e157dd2202c20b8092228fea9091f5cd1e83551e170ec277
355dbaa7ae4da51b32cb42cc087e033d82758b4f6fa173d3c62529d8f70c3b26
3c1833f23523e4b36106538cf009a443e93fbb009bf44c2237a3ae7889d5cd77
3e72de5de67d6d80b65a114af684eaf880c53c250155a663cb17d677ff064bc1
4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef
4caa2b03a1e06d8d2041cc20dfe487cfc2a4207823c6ed14ec54002bcfb79dc3
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49
5346dfc0f18be96e38080c303c312d99867487d6078f5ce0f1c0ddaaf165c473
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87
54f57b4a405937824e7a0baf1c10e5c290f15007eed2d98d7b6a1f84d1546a54
56a8532b2a60ca2ae39c213f7e1e65e47834af927e6365444457f22ed12ed79c
57a2dc0af7db36023b2b6c53e01dbd8e716d96174486ad20d68b2549589c5441
59f4843277d9aca1200c779c52318aadb380021a0051a6644b75274acb7fe158
5b3e2b65268a6cf88688001ac22b2864827d15fb67bd116f9c0d2d10e6c10603
5cb497f231aa55d85dea3e56489efce34692c3f3a989560ad28080e5411b4254
66a13cad6c244da4061da65fd2fbf027bf1bb49e21c42f5e7c943a9379f1e7c4
71afe9d9cf96c3882cb58f6a0685f5fe50b2abafe2ffaf86eb8d8edf7209aa6e
73a7d4539e676201a879312a77305270856c89fd8d23331d2a59c094873c3f86
7aaf6df215bb7018439342fe6bcd1058de3e7dfa2c7b4e1176c842b1a8e529ac
7b350c757ab1dbc07893535b11ef3addd98c042e2f815e350ed474e8e5b0ab48
7bea17a80a61ed0f54248b4ffc4c718f7c8ff2619742577a73591d62ce074da8
8d41ee3a5bb7a24c386d5cdcf9eacab12fb41ad26cf4bc947ea77b9f0639f6d0
91afb84bded857517d6a7e43932e3d4a43eaf42d1e4d0b77a8bc9c07973e21d2
99373341554ceaade5ea6c81725f1cd4d05e906621a15797d99d01343ae551f8
a34a2cc88b5ee938fdebdd26a120fcd6ef25d687936fd361d41d803288f39aa2
aa084d3968ab19898ebbed807ebc134b622fab78a888e7b36ae8386841636801
acccc501aa6afa3cfac15e8ddccf1561deed2ed08c2f7d652abbdbe9aa71609a
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
b23d0629822256b320de68cece2a79525216c20a0b040d4ee0ee6dd216b98115
b769305d18e59ddd6f13c3fb6db4f90a15770b3717aaddbadb6e543918178bc8
b866a58e02b01ca9537cb6d024f348f7373c88b94a92d310560885c93de8abd2
babf6fd29c079790cc4d522f66f21af7c099e981080ddf11b5344b12b904e8a5
bacfd23af9c90b604030b1fde7b8b7ca90f47c6902724d666a99e02ea36d682c
bbb90a8f240e6dbbda1d3da534f8848f256e623ed470d045e1d86a465e424d69
c401ce328e0383e71cd811709055aa8671cee50e355c6588bd567c1320b4e4ab
c8a977fd23fc151d7944387ad07220eb673de84b4343d6304efe5a8e1c061b02
c8b1f6c22756521c86a5b0053b8565b49436f7fa19d1bb7cdf00a7808df28d42
c8cd0b0d514cecdaf4e7214325a70bba9bae301e156265bd0d880f9065d1d183
c8d87d770112e188f7b1482e9a416ffc441a9a6e08e2fc38a886fa2986efdb46
c9ec544b30e63c36cce0becfe0a9fd0fd61f020294705b9d7ffcc4e40af6e4b1
cd054ab484b28d0eaf36bf09f37ffb3cfc8823e75dbebb508483929afd8dedb8
cf25ec18f223f4c51ce1128a42e644cdc2244d88f89d1a51440d9dbe51f4efe8
d5a89e26beae0bc03ad18a0b0d1d3d75f87c32047879d25da11970cb5c4662a3
dfc042f7ff75f3c2f916bcfbff48c82834bab07b698a2c564906ca073f8286b2
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e4f84975b5e75685353839e16e83bec3a357f7c3c7405f2684b3e8fec0e0e530
e586a84d8523747f42e510d78e141015b6424cf67d612854e892a7bcedc8ec9e
e5ddc46911b3766f66924ba0ed48e30aade9dac26a33b43e160d01abe590ebd8
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f7b4c01edef29deff0c9c54e6dd504b25bec2ed87bf88074d6a739f98d335acd
f8b7b68c5f936d47e62c88e53190d189089caa2c13dabf0e69f83df5ffbef631
fccf396f8daeb2473e4948bf85b46533c45a1de5992cb835e7677fafbd99c355
ff327ec2a6dbd3fc76ceecf59e472d5d2f43c94dce851ced740abe5f75bb832e