URL: https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
Submission: On March 29 via automatic, source openphish

Summary

This website contacted 44 IPs in 6 countries across 31 domains to perform 229 HTTP transactions. The main IP is 35.229.76.23, located in United States and belongs to GOOGLE, US. The main domain is ardacademy.org.
TLS certificate: Issued by Let's Encrypt Authority X3 on March 24th 2020. Valid for: 3 months.
This is the only time ardacademy.org was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Citibank (Banking)

Domain & IP information

IP Address AS Autonomous System
15 35.229.76.23 15169 (GOOGLE)
10 34 2a00:1450:400... 15169 (GOOGLE)
7 2a00:1450:400... 15169 (GOOGLE)
1 151.101.113.175 54113 (FASTLY)
2 23.38.48.101 20940 (AKAMAI-ASN1)
4 143.204.202.100 16509 (AMAZON-02)
2 143.204.207.113 16509 (AMAZON-02)
1 104.111.245.241 16625 (AKAMAI-AS)
17 18.195.42.228 16509 (AMAZON-02)
2 2a00:1450:400... 15169 (GOOGLE)
1 2a00:1450:400... 15169 (GOOGLE)
3 3.212.137.125 14618 (AMAZON-AES)
1 2a00:1450:400... 15169 (GOOGLE)
38 104.109.92.187 20940 (AKAMAI-ASN1)
1 104.111.235.198 16625 (AKAMAI-AS)
2 66.117.29.11 15224 (OMNITURE)
2 52.129.74.13 395492 (IOVATION3)
11 91.235.134.21 30286 (THM)
4 151.101.14.133 54113 (FASTLY)
10 28 2a00:1450:400... 15169 (GOOGLE)
3 35.190.72.21 15169 (GOOGLE)
2 4 2a00:1450:400... 15169 (GOOGLE)
2 2 52.29.85.133 16509 (AMAZON-02)
1 1 193.0.160.128 54312 (ROCKETFUEL)
1 23.67.129.14 20940 (AKAMAI-ASN1)
1 5 54.171.39.197 16509 (AMAZON-02)
28 2a00:1450:400... 15169 (GOOGLE)
1 35.244.174.68 15169 (GOOGLE)
2 54.154.151.160 16509 (AMAZON-02)
1 15.188.31.119 16509 (AMAZON-02)
1 1 66.117.28.86 15224 (OMNITURE)
1 40.122.110.249 8075 (MICROSOFT...)
3 23.45.237.36 20940 (AKAMAI-ASN1)
4 6 172.217.16.166 15169 (GOOGLE)
5 108.177.15.157 15169 (GOOGLE)
2 54.76.69.10 16509 (AMAZON-02)
2 185.31.128.129 54312 (ROCKETFUEL)
2 35.241.45.82 15169 (GOOGLE)
1 2600:9000:214... 16509 (AMAZON-02)
1 1 216.200.122.11 6461 (ZAYO-6461)
1 2a00:1450:400... 15169 (GOOGLE)
1 2a03:2880:f12... 32934 (FACEBOOK)
1 151.101.114.109 54113 (FASTLY)
1 172.217.18.98 15169 (GOOGLE)
4 192.193.200.243 32287 (SOLANA-CI...)
2 91.235.132.130 30286 (THM)
1 91.235.134.131 30286 (THM)
229 44
Apex Domain
Subdomains
Transfer
55 citi.com
online.citi.com
content22.online.citi.com
www.citi.com
metrics1.citi.com
prod.report.nacustomerexperience.citi.com
1 MB
39 doubleclick.net
googleads.g.doubleclick.net
6260004.fls.doubleclick.net
bid.g.doubleclick.net
ad.doubleclick.net
27 KB
36 google.com
www.google.com
cse.google.com
adservice.google.com
212 KB
28 google.de
www.google.de
3 KB
17 ensighten.com
nexus.ensighten.com
260 KB
15 ardacademy.org
ardacademy.org
99 KB
8 pbbl.co
cdn.pbbl.co
px0.pbbl.co
19 KB
7 demdex.net
dpm.demdex.net
citi.demdex.net
4 KB
7 googletagmanager.com
www.googletagmanager.com
196 KB
4 rlcdn.com
di.rlcdn.com
api.rlcdn.com
sr.rlcdn.com
40 B
4 medallia.com
resources.digital-cloud-citi.medallia.com
116 KB
4 adsrvr.org
js.adsrvr.org
insight.adsrvr.org
9 KB
3 online-metrix.net
h.online-metrix.net
89oebq5k6e5aknuqnxl5yc3ng5orx6szfks7ezmd1d35291145502344am1.e.aa.online-metrix.net
826 B
3 bluekai.com
stags.bluekai.com
3 rfihub.com
s.rfihub.com
a.rfihub.com
20766699p.rfihub.com
1 KB
3 agkn.com
aa.agkn.com
d.agkn.com
1 KB
3 omtrdc.net
cdn.tt.omtrdc.net
citicorpcreditservic.tt.omtrdc.net
16 KB
3 cyveillance.com
cyseal.cyveillance.com
1 KB
3 kampyle.com
nebula-cdn.kampyle.com
udc-neb.kampyle.com
6 KB
2 iesnare.com
mpsnare.iesnare.com
14 KB
2 ytimg.com
s.ytimg.com
27 KB
2 rfihub.net
c1.rfihub.net
13 KB
1 googleadservices.com
www.googleadservices.com
10 KB
1 ispot.tv
pt.ispot.tv
315 B
1 facebook.com
www.facebook.com
258 B
1 gwmtracking.com
gwmtracking.com
387 B
1 we-stats.com
cfr.us.v2.we-stats.com
375 B
1 everesttech.net
cm.everesttech.net
554 B
1 youtube.com
www.youtube.com
923 B
1 bkrtx.com
tags.bkrtx.com
11 KB
0 Failed
function sub() { [native code] }. Failed
229 31
Domain Requested by
38 online.citi.com ardacademy.org
online.citi.com
34 www.google.com 10 redirects ardacademy.org
cse.google.com
28 www.google.de ardacademy.org
28 googleads.g.doubleclick.net 10 redirects ardacademy.org
www.googleadservices.com
17 nexus.ensighten.com ardacademy.org
nexus.ensighten.com
15 ardacademy.org ardacademy.org
11 content22.online.citi.com ardacademy.org
content22.online.citi.com
7 www.googletagmanager.com ardacademy.org
nexus.ensighten.com
5 bid.g.doubleclick.net ardacademy.org
5 dpm.demdex.net 1 redirects ardacademy.org
4 prod.report.nacustomerexperience.citi.com ardacademy.org
4 6260004.fls.doubleclick.net 2 redirects ardacademy.org
www.googletagmanager.com
4 px0.pbbl.co 2 redirects ardacademy.org
4 resources.digital-cloud-citi.medallia.com ardacademy.org
resources.digital-cloud-citi.medallia.com
4 cdn.pbbl.co ardacademy.org
nexus.ensighten.com
cdn.pbbl.co
3 stags.bluekai.com ardacademy.org
tags.bkrtx.com
3 cyseal.cyveillance.com ardacademy.org
cyseal.cyveillance.com
2 h.online-metrix.net content22.online.citi.com
2 ad.doubleclick.net 2 redirects
2 udc-neb.kampyle.com ardacademy.org
2 insight.adsrvr.org ardacademy.org
js.adsrvr.org
2 sr.rlcdn.com ardacademy.org
nexus.ensighten.com
2 citi.demdex.net nexus.ensighten.com
ardacademy.org
2 aa.agkn.com 2 redirects
2 mpsnare.iesnare.com ardacademy.org
online.citi.com
2 citicorpcreditservic.tt.omtrdc.net ardacademy.org
nexus.ensighten.com
2 s.ytimg.com ardacademy.org
www.youtube.com
2 js.adsrvr.org ardacademy.org
nexus.ensighten.com
2 c1.rfihub.net ardacademy.org
nexus.ensighten.com
1 89oebq5k6e5aknuqnxl5yc3ng5orx6szfks7ezmd1d35291145502344am1.e.aa.online-metrix.net
1 www.googleadservices.com www.googletagmanager.com
1 pt.ispot.tv
1 www.facebook.com
1 adservice.google.com
1 gwmtracking.com 1 redirects
1 d.agkn.com
1 20766699p.rfihub.com c1.rfihub.net
1 a.rfihub.com c1.rfihub.net
1 cfr.us.v2.we-stats.com ardacademy.org
1 cm.everesttech.net 1 redirects
1 metrics1.citi.com ardacademy.org
1 api.rlcdn.com ardacademy.org
1 www.citi.com ardacademy.org
1 s.rfihub.com 1 redirects
1 di.rlcdn.com ardacademy.org
1 cdn.tt.omtrdc.net ardacademy.org
1 cse.google.com ardacademy.org
1 www.youtube.com ardacademy.org
1 tags.bkrtx.com ardacademy.org
1 nebula-cdn.kampyle.com ardacademy.org
0 0d22d313-900b-4c1e-b14c-8f366968c366 Failed ardacademy.org
229 51
Subject Issuer Validity Valid
ardacademy.org
Let's Encrypt Authority X3
2020-03-24 -
2020-06-22
3 months crt.sh
www.google.com
GTS CA 1O1
2020-03-03 -
2020-05-26
3 months crt.sh
*.google-analytics.com
GTS CA 1O1
2020-03-03 -
2020-05-26
3 months crt.sh
j.ssl.fastly.net
GlobalSign Organization Validation CA - SHA256 - G2
2020-02-28 -
2020-06-11
3 months crt.sh
*.rfihub.net
DigiCert SHA2 Secure Server CA
2019-01-25 -
2020-04-25
a year crt.sh
*.pbbl.co
Amazon
2020-01-01 -
2021-02-01
a year crt.sh
*.adsrvr.org
Trustwave Organization Validation SHA256 CA, Level 1
2019-03-07 -
2021-04-19
2 years crt.sh
*.bkrtx.com
DigiCert SHA2 Secure Server CA
2020-02-28 -
2021-05-29
a year crt.sh
nexus.ensighten.com
DigiCert SHA2 Secure Server CA
2019-10-03 -
2020-10-02
a year crt.sh
*.google.com
GTS CA 1O1
2020-03-03 -
2020-05-26
3 months crt.sh
cyseal.cyveillance.com
Amazon
2020-01-05 -
2021-02-05
a year crt.sh
online.citibank.com
DigiCert SHA2 Extended Validation Server CA
2018-03-14 -
2020-05-14
2 years crt.sh
*.tt.omtrdc.net
DigiCert SHA2 High Assurance Server CA
2017-10-26 -
2020-11-25
3 years crt.sh
mpsnare.iesnare.com
DigiCert SHA2 High Assurance Server CA
2019-04-24 -
2020-05-26
a year crt.sh
content22.online.citi.com
DigiCert SHA2 Extended Validation Server CA
2018-08-06 -
2020-08-06
2 years crt.sh
*.digital-cloud-citi.medallia.com
SSL.com DV CA
2018-11-13 -
2020-11-12
2 years crt.sh
*.g.doubleclick.net
GTS CA 1O1
2020-03-03 -
2020-05-26
3 months crt.sh
*.rlcdn.com
Sectigo RSA Domain Validation Secure Server CA
2019-04-24 -
2020-04-23
a year crt.sh
px0.pbbl.co
GTS CA 1D2
2020-02-29 -
2020-05-29
3 months crt.sh
www.citi.com
DigiCert SHA2 Extended Validation Server CA
2019-10-17 -
2022-01-01
2 years crt.sh
*.demdex.net
DigiCert SHA2 High Assurance Server CA
2018-01-09 -
2021-02-12
3 years crt.sh
www.google.de
GTS CA 1O1
2020-03-03 -
2020-05-26
3 months crt.sh
metrics1.citi.com
DigiCert SHA2 Extended Validation Server CA
2018-08-31 -
2020-08-30
2 years crt.sh
*.us.v2.we-stats.com
COMODO RSA Domain Validation Secure Server CA
2018-10-11 -
2020-10-10
2 years crt.sh
odc-prod-01.oracle.com
DigiCert SHA2 Secure Server CA
2020-01-10 -
2021-04-10
a year crt.sh
*.doubleclick.net
GTS CA 1O1
2020-03-03 -
2020-05-26
3 months crt.sh
*.rfihub.com
DigiCert SHA2 Secure Server CA
2019-08-27 -
2020-08-31
a year crt.sh
*.kampyle.com
RapidSSL RSA CA 2018
2020-02-11 -
2022-03-06
2 years crt.sh
*.agkn.com
RapidSSL RSA CA 2018
2018-06-21 -
2020-09-16
2 years crt.sh
*.facebook.com
DigiCert SHA2 High Assurance Server CA
2020-03-01 -
2020-05-30
3 months crt.sh
f3.shared.global.fastly.net
GlobalSign CloudSSL CA - SHA256 - G3
2019-05-29 -
2020-04-23
a year crt.sh
www.googleadservices.com
GTS CA 1O1
2020-03-03 -
2020-05-26
3 months crt.sh
prod.report.nacustomerexperience.citi.com
DigiCert Global CA G2
2018-07-05 -
2020-07-04
2 years crt.sh
h.online-metrix.net
Trustwave Organization Validation SHA256 CA, Level 1
2020-02-20 -
2021-02-19
a year crt.sh
*.e.aa.online-metrix.net
Go Daddy Secure Certificate Authority - G2
2019-09-13 -
2021-09-13
2 years crt.sh

This page contains 24 frames:

Primary Page: https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
Frame ID: CE1001B71859FF250F43B1251FA62844
Requests: 197 HTTP requests in this frame

Frame: https://citi.demdex.net/dest5.html?d_nsid=0
Frame ID: 8D5F92B1FC9B4C2F4EBBE4BF8DAB4480
Requests: 1 HTTP requests in this frame

Frame: https://citi.demdex.net/dest5.html?d_nsid=0
Frame ID: 402504E075FED8E8ACD00BACCB939D61
Requests: 1 HTTP requests in this frame

Frame: https://sr.rlcdn.com/425466.html?es=80676&u=cc87838e4caaadeb999f06d0f97757adab8948ed
Frame ID: 32E4C4CF59BA437120CB022D59C3FACC
Requests: 1 HTTP requests in this frame

Frame: https://stags.bluekai.com/site/63068?ret=html&phint=language%3Denglish&phint=product%3D&phint=event&phint=category%3Dpre-login%20Sign%20on%20page&phint=page%3DCookied%20Username%20Password&phint=section1%3DPublic&phint=section2%3DSignOn&phint=section3%3D&phint=section4%3D&phint=bankappstatus&phint=productID&phint=__bk_t%3DOnline%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&phint=__bk_k%3Dbanking%2C%20citi%2C%20financial%20services%2C%20checking%20account%2C%20savings%20account%2C%20credit%20cards&phint=__bk_l%3Dhttps%3A%2F%2Fonline.citi.com%2FUS%2Flogin.do&phint=__bk_v%3D3.1.4&limit=10&r=50577286
Frame ID: 38CC858445FA0FC11873FE6B5485E238
Requests: 1 HTTP requests in this frame

Frame: https://cdn.pbbl.co/i/pp.html
Frame ID: 45E4D855787710CE731F956377D188E6
Requests: 1 HTTP requests in this frame

Frame: https://6260004.fls.doubleclick.net/activityi;dc_pre=CIaB5de4vugCFVniuwgduiAFdg;src=6260004;type=citih0;cat=citih00;qty=1;cost=1;ord=74583402463.05983;gtm=2od3i0;auiddc=505230407.1578884161;~oref=https%3A%2F%2Fonline.citi.com%2FUS%2Flogin.do
Frame ID: C47BC074DF15F3F6F3E9B53416EB44E1
Requests: 1 HTTP requests in this frame

Frame: https://bid.g.doubleclick.net/xbbe/pixel?d=KAE
Frame ID: 40744EE490183967961B0B94373A237F
Requests: 1 HTTP requests in this frame

Frame: https://bid.g.doubleclick.net/xbbe/pixel?d=KAE
Frame ID: 6F19C2AFDABAE71BFF6D6250D3D9E6AD
Requests: 1 HTTP requests in this frame

Frame: https://bid.g.doubleclick.net/xbbe/pixel?d=KAE
Frame ID: 81D46AFE82B7B4B02A78A12340EBFBD1
Requests: 1 HTTP requests in this frame

Frame: https://bid.g.doubleclick.net/xbbe/pixel?d=KAE
Frame ID: 682055296645023EB3FE4546BB876C0C
Requests: 1 HTTP requests in this frame

Frame: https://bid.g.doubleclick.net/xbbe/pixel?d=KAE
Frame ID: 6515F2DA7DEAA6360EA1C0321F9363EC
Requests: 1 HTTP requests in this frame

Frame: https://insight.adsrvr.org/track/up?adv=1jw5cvl&ref=https%3A%2F%2Fonline.citi.com%2FUS%2Flogin.do&upid=t1sl5ty&upv=1.1.0&orderid={orderid}&v={v}&vf={vf}&td1=jUSCBOL_Loginpage_Cookied&td2=undefined&td3=undefined&td4=Cookied%20Username%20Password&td5=https://online.citi.com/US/login.do&td6={td6}&td7={td7}&td8={td8}&td9={td9}&td10={td10}
Frame ID: 6A386F842D3CD786562382B7EF510075
Requests: 1 HTTP requests in this frame

Frame: https://20766699p.rfihub.com/ca.html?rfiidc=1870471594818999025&rfiaid=9f17482743f54dc7ab409dcc8ec420ad&ver=9&ra=491&rb=648&ca=20766699&_o=17169175&_t=cookiedusernamepassword&ssv_cuuid=&ssv_pagename=cookiedusernamepassword&pe=https%3A%2F%2Fardacademy.org%2Fwp-content%2Fcc%2F%3Feml%3Djashye%40mail.nasd&pf=&ra=1180621879186321
Frame ID: F5B824FF10FDF4D7AB16E81578FFF608
Requests: 1 HTTP requests in this frame

Frame: https://6260004.fls.doubleclick.net/activityi;dc_pre=COPA9Ne4vugCFVTDuwgdVpsIEA;src=6260004;type=citih0;cat=citih00;qty=1;cost=1;ord=9577860299563.918;gtm=2od3i0;auiddc=1507464551.1585442264;~oref=https%3A%2F%2Fardacademy.org%2Fwp-content%2Fcc%2F%3Feml%3Djashye%40mail.nasd
Frame ID: 0076E5DFDBD7F83D305D7A3C3A01803C
Requests: 1 HTTP requests in this frame

Frame: https://sr.rlcdn.com/425466.html?es=80676&u=da39a3ee5e6b4b0d3255bfef95601890afd80709
Frame ID: D5670690679AE037E9C897E7985453A1
Requests: 1 HTTP requests in this frame

Frame: https://content22.online.citi.com/fp/check.js;CIS3SID=CB9CBD87942D7948E5F9FBE01E0E5A9B?org_id=89oebq5k&session_id=9646094ba7b58acb03dad3f75e50dcf29574f85b76dd9ada42ddaf7cafc1207c&nonce=1d35291145502344&pageid=1&jb=3b3526246a7b6f773d4e6b6e7d782468736d3d4c696c777a266a73623d416a70676d672530383736
Frame ID: 3C71FB4093D87788B1BA6A6504F24350
Requests: 10 HTTP requests in this frame

Frame: https://stags.bluekai.com/site/63068?ret=html&phint=language%3Denglish&phint=product%3D&phint=event&phint=category%3Dpre-login%20Sign%20on%20page&phint=page%3DCookied%20Username%20Password&phint=section1%3DPublic&phint=section2%3DSignOn&phint=section3%3D&phint=section4%3D&phint=bankappstatus&phint=productID&phint=__bk_t%3DOnline%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&phint=__bk_k%3Dbanking%2C%20citi%2C%20financial%20services%2C%20checking%20account%2C%20savings%20account%2C%20credit%20cards&phint=__bk_l%3Dhttps%3A%2F%2Fardacademy.org%2Fwp-content%2Fcc%2F%3Feml%3Djashye%40mail.nasd&phint=__bk_v%3D3.1.4&limit=10&r=97921021
Frame ID: E9B3C13E7F333212DCD6CF808E302155
Requests: 1 HTTP requests in this frame

Frame: https://stags.bluekai.com/site/63068?ret=html&phint=language%3Denglish&phint=product%3D&phint=event&phint=category%3Dpre-login%20Sign%20on%20page&phint=page%3DCookied%20Username%20Password&phint=section1%3DPublic&phint=section2%3DSignOn&phint=section3%3D&phint=section4%3D&phint=bankappstatus&phint=productID&phint=__bk_t%3DOnline%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&phint=__bk_k%3Dbanking%2C%20citi%2C%20financial%20services%2C%20checking%20account%2C%20savings%20account%2C%20credit%20cards&phint=__bk_l%3Dhttps%3A%2F%2Fardacademy.org%2Fwp-content%2Fcc%2F%3Feml%3Djashye%40mail.nasd&phint=__bk_v%3D3.1.4&limit=10&r=79181724
Frame ID: 163737446302657B5476BCB756399C5C
Requests: 1 HTTP requests in this frame

Frame: https://cdn.pbbl.co/i/pp.html
Frame ID: 2BA9146B804FF16C41DAC899AF0638D6
Requests: 1 HTTP requests in this frame

Frame: https://insight.adsrvr.org/track/up?adv=1jw5cvl&ref=https%3A%2F%2Fardacademy.org%2Fwp-content%2Fcc%2F%3Feml%3Djashye%40mail.nasd&upid=t1sl5ty&upv=1.1.0&orderid={orderid}&v={v}&vf={vf}&td1=jUSCBOL_Loginpage_Cookied&td2=undefined&td3=undefined&td4=Cookied%20Username%20Password&td5=https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd&td6={td6}&td7={td7}&td8={td8}&td9={td9}&td10={td10}
Frame ID: 56BBDEDF70FF160FC9DCF46DFC494823
Requests: 1 HTTP requests in this frame

Frame: https://content22.online.citi.com/fp/ls_fp.html;CIS3SID=CB9CBD87942D7948E5F9FBE01E0E5A9B?org_id=89oebq5k&session_id=9646094ba7b58acb03dad3f75e50dcf29574f85b76dd9ada42ddaf7cafc1207c&nonce=1d35291145502344&pageid=1
Frame ID: E3E0B3C5017D41FB5F2449751CB37709
Requests: 1 HTTP requests in this frame

Frame: https://h.online-metrix.net/fp/sid_fp.html;CIS3SID=CB9CBD87942D7948E5F9FBE01E0E5A9B?org_id=89oebq5k&session_id=9646094ba7b58acb03dad3f75e50dcf29574f85b76dd9ada42ddaf7cafc1207c&nonce=1d35291145502344&pageid=1
Frame ID: 974BB954AE9E9E950C07765EB49605B9
Requests: 1 HTTP requests in this frame

Frame: https://content22.online.citi.com/fp/top_fp.html;CIS3SID=CB9CBD87942D7948E5F9FBE01E0E5A9B?org_id=89oebq5k&session_id=9646094ba7b58acb03dad3f75e50dcf29574f85b76dd9ada42ddaf7cafc1207c&nonce=1d35291145502344&pageid=1
Frame ID: 25E409AA40DE4D9284C1FA02FE889B0A
Requests: 1 HTTP requests in this frame

Screenshot


Detected technologies

Overall confidence: 100%
Detected patterns
  • headers server /nginx(?:\/([\d.]+))?/i

Overall confidence: 100%
Detected patterns
  • script /\/\/nexus\.ensighten\.com\//i

Page Statistics

229
Requests

99 %
HTTPS

23 %
IPv6

31
Domains

51
Subdomains

44
IPs

6
Countries

2474 kB
Transfer

6653 kB
Size

22
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 78
  • https://px0.pbbl.co/ns/__p2.gif?ppid=&chk=true&brid=&brcid=&email=&orderId=&orderValue=&productId=&offerCode=&label=&pageUrl=https%3A%2F%2Fardacademy.org%2Fwp-content%2Fcc%2F%3Feml%3Djashye%40mail.nasd&referrerUrl=&targetUrl=https%3A%2F%2Fardacademy.org%2Fwp-content%2Fcc%2F%3Feml%3Djashye%40mail.nasd&sessionId=&markerType=seg&rand=vLUoDhqXDUdhvD8m&iabOptOut=-&jsVer=3.2.1&frVer=&markerId=348192 HTTP 302
  • https://aa.agkn.com/adscores/g.pixel?sid=9212282598&_ppid=59e19afc-941e-4859-ade5-7f6803468ced&_segid=99&iid=1b23fea0-65cc-4a54-86d8-e1a807ef5e28 HTTP 302
  • https://px0.pbbl.co/adadvisor.gif?segment=000&_ppid=59e19afc-941e-4859-ade5-7f6803468ced&_segid=99&_zip=&hk=&iid=1b23fea0-65cc-4a54-86d8-e1a807ef5e28&mt=&bd=
Request Chain 91
  • https://s.rfihub.com/uidm?_o=17169175&_u=18d2cc3c-4653-4936-a204-8147a1c1bd20&_sm=:R22534S@A3RIZZC24944S@A3RIZZC2232L2@A3RIZZS2233L2@A3RIZZS28259S1@A3RIZZS28266S1@A3RIZZS28267S1@A3RIZZS28227S1@A3RIZZS49119S@A3RIZZC47010S1@A3RIZZS48781S1@A3RIZZS38573S1@A3RIZZS&redirect=32 HTTP 302
  • https://www.citi.com/credit-cards/rfuidmatch/citi.action?XP_UID=SY-00GfVAAVulEvE=749
Request Chain 95
  • https://dpm.demdex.net/id?d_visid_ver=3.1.2&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=61834D9B5228A7430A490D45%40AdobeOrg&d_nsid=0&ts=1585442262984 HTTP 302
  • https://dpm.demdex.net/id/rd?d_visid_ver=3.1.2&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=61834D9B5228A7430A490D45%40AdobeOrg&d_nsid=0&ts=1585442262984
Request Chain 133
  • https://cm.everesttech.net/cm/dd?d_uuid=35599368996475573450980521148147697708 HTTP 302
  • https://dpm.demdex.net/ibs:dpid=411&dpuuid=Xn-t1wAAAwc161L0
Request Chain 156
  • https://6260004.fls.doubleclick.net/activityi;src=6260004;type=citih0;cat=citih00;qty=1;cost=1;ord=74583402463.05983;gtm=2od3i0;auiddc=505230407.1578884161;~oref=https%3A%2F%2Fonline.citi.com%2FUS%2Flogin.do HTTP 302
  • https://6260004.fls.doubleclick.net/activityi;dc_pre=CIaB5de4vugCFVniuwgduiAFdg;src=6260004;type=citih0;cat=citih00;qty=1;cost=1;ord=74583402463.05983;gtm=2od3i0;auiddc=505230407.1578884161;~oref=https%3A%2F%2Fonline.citi.com%2FUS%2Flogin.do
Request Chain 170
  • https://6260004.fls.doubleclick.net/activityi;src=6260004;type=citih0;cat=citih00;qty=1;cost=1;ord=9577860299563.918;gtm=2od3i0;auiddc=1507464551.1585442264;~oref=https%3A%2F%2Fardacademy.org%2Fwp-content%2Fcc%2F%3Feml%3Djashye%40mail.nasd HTTP 302
  • https://6260004.fls.doubleclick.net/activityi;dc_pre=COPA9Ne4vugCFVTDuwgdVpsIEA;src=6260004;type=citih0;cat=citih00;qty=1;cost=1;ord=9577860299563.918;gtm=2od3i0;auiddc=1507464551.1585442264;~oref=https%3A%2F%2Fardacademy.org%2Fwp-content%2Fcc%2F%3Feml%3Djashye%40mail.nasd
Request Chain 175
  • https://gwmtracking.com/p/v/1/5c54c477f870814b6fd57129/format/img HTTP 302
  • https://ad.doubleclick.net/ddm/activity/src=8825552;type=invmedia;cat=citio0;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;ord=1 HTTP 302
  • https://ad.doubleclick.net/ddm/activity/src=8825552;dc_pre=CLWio9i4vugCFdSKdwodgp4K7g;type=invmedia;cat=citio0;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;ord=1 HTTP 302
  • https://adservice.google.com/ddm/fls/z/src=8825552;dc_pre=CLWio9i4vugCFdSKdwodgp4K7g;type=invmedia;cat=citio0;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;ord=1
Request Chain 201
  • https://px0.pbbl.co/ns/__p2.gif?ppid=9b1c96a0-258f-4947-b02c-c9ebbbd4d951&chk=false&brid=1560&brcid=&email=&orderId=&orderValue=&productId=&offerCode=&label=&pageUrl=https%3A%2F%2Fardacademy.org%2Fwp-content%2Fcc%2F%3Feml%3Djashye%40mail.nasd&referrerUrl=&targetUrl=https%3A%2F%2Fardacademy.org%2Fwp-content%2Fcc%2F%3Feml%3Djashye%40mail.nasd&sessionId=&markerType=seg&rand=kctg6h9DJiN3C6UI&iabOptOut=-&jsVer=3.2.1&frVer=1.1&markerId=348192 HTTP 302
  • https://aa.agkn.com/adscores/g.pixel?sid=9212282598&_ppid=9b1c96a0-258f-4947-b02c-c9ebbbd4d951&_segid=99&iid=1782f822-4f6a-48a1-bec8-996ef7976b0a HTTP 302
  • https://px0.pbbl.co/adadvisor.gif?segment=000&_ppid=9b1c96a0-258f-4947-b02c-c9ebbbd4d951&_segid=99&_zip=&hk=&iid=1782f822-4f6a-48a1-bec8-996ef7976b0a&mt=&bd=
Request Chain 206
  • https://googleads.g.doubleclick.net/pagead/viewthroughconversion/975701947/?random=1585442264897&cv=9&fst=1585442264897&num=1&fmt=3&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2od3i0&sendb=1&ig=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fardacademy.org%2Fwp-content%2Fcc%2F%3Feml%3Djashye%40mail.nasd&tiba=Online%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&hn=www.googleadservices.com&async=1 HTTP 302
  • https://www.google.com/pagead/1p-user-list/975701947/?random=1585442264897&cv=9&fst=1585440000000&num=1&fmt=3&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2od3i0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fardacademy.org%2Fwp-content%2Fcc%2F%3Feml%3Djashye%40mail.nasd&tiba=Online%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&async=1&is_vtc=1&random=1463942815&resp=GooglemKTybQhCsO HTTP 302
  • https://www.google.de/pagead/1p-user-list/975701947/?random=1585442264897&cv=9&fst=1585440000000&num=1&fmt=3&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2od3i0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fardacademy.org%2Fwp-content%2Fcc%2F%3Feml%3Djashye%40mail.nasd&tiba=Online%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&async=1&is_vtc=1&random=1463942815&resp=GooglemKTybQhCsO&ipr=y&ezwbk=AZuM4hCQFpBwUyDJJoB2MO_1kOUlgPrXxFCPskIU96ItNr2Rh20dnI9-nb9SPuOdvD5EezcsnU85Qra-FEGJaCTBE3qY
Request Chain 207
  • https://googleads.g.doubleclick.net/pagead/viewthroughconversion/770961656/?random=1585442264897&cv=9&fst=1585442264897&num=1&fmt=3&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2od3i0&sendb=1&ig=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fardacademy.org%2Fwp-content%2Fcc%2F%3Feml%3Djashye%40mail.nasd&tiba=Online%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&hn=www.googleadservices.com&async=1 HTTP 302
  • https://www.google.com/pagead/1p-user-list/770961656/?random=1585442264897&cv=9&fst=1585440000000&num=1&fmt=3&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2od3i0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fardacademy.org%2Fwp-content%2Fcc%2F%3Feml%3Djashye%40mail.nasd&tiba=Online%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&async=1&is_vtc=1&random=593359102&resp=GooglemKTybQhCsO HTTP 302
  • https://www.google.de/pagead/1p-user-list/770961656/?random=1585442264897&cv=9&fst=1585440000000&num=1&fmt=3&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2od3i0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fardacademy.org%2Fwp-content%2Fcc%2F%3Feml%3Djashye%40mail.nasd&tiba=Online%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&async=1&is_vtc=1&random=593359102&resp=GooglemKTybQhCsO&ipr=y&ezwbk=AZuM4hDv_KXZlgm4YbeC7sjtIcF8tSOzZX2d_FE-Rara68iuPAgMt3Gz4cvkwmLiwIMQ5KKE48YyCjkliGoEusIeJHCx
Request Chain 208
  • https://googleads.g.doubleclick.net/pagead/viewthroughconversion/819500023/?random=1585442264897&cv=9&fst=1585442264897&num=1&fmt=3&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2od3i0&sendb=1&ig=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fardacademy.org%2Fwp-content%2Fcc%2F%3Feml%3Djashye%40mail.nasd&tiba=Online%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&hn=www.googleadservices.com&async=1 HTTP 302
  • https://www.google.com/pagead/1p-user-list/819500023/?random=1585442264897&cv=9&fst=1585440000000&num=1&fmt=3&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2od3i0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fardacademy.org%2Fwp-content%2Fcc%2F%3Feml%3Djashye%40mail.nasd&tiba=Online%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&async=1&is_vtc=1&random=3679954962&resp=GooglemKTybQhCsO HTTP 302
  • https://www.google.de/pagead/1p-user-list/819500023/?random=1585442264897&cv=9&fst=1585440000000&num=1&fmt=3&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2od3i0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fardacademy.org%2Fwp-content%2Fcc%2F%3Feml%3Djashye%40mail.nasd&tiba=Online%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&async=1&is_vtc=1&random=3679954962&resp=GooglemKTybQhCsO&ipr=y&ezwbk=AZuM4hD32pLtNohfmkms6d240khAaw2VmLuVEnj_gG0sHHDPHRz4zYlZxPQ6mYhVzuzYxGYVV-WPpQlrzHT4PkZ0GkBP
Request Chain 209
  • https://googleads.g.doubleclick.net/pagead/viewthroughconversion/763960929/?random=1585442264897&cv=9&fst=1585442264897&num=1&fmt=3&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2od3i0&sendb=1&ig=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fardacademy.org%2Fwp-content%2Fcc%2F%3Feml%3Djashye%40mail.nasd&tiba=Online%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&hn=www.googleadservices.com&async=1 HTTP 302
  • https://www.google.com/pagead/1p-user-list/763960929/?random=1585442264897&cv=9&fst=1585440000000&num=1&fmt=3&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2od3i0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fardacademy.org%2Fwp-content%2Fcc%2F%3Feml%3Djashye%40mail.nasd&tiba=Online%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&async=1&is_vtc=1&random=4059490916&resp=GooglemKTybQhCsO HTTP 302
  • https://www.google.de/pagead/1p-user-list/763960929/?random=1585442264897&cv=9&fst=1585440000000&num=1&fmt=3&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2od3i0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fardacademy.org%2Fwp-content%2Fcc%2F%3Feml%3Djashye%40mail.nasd&tiba=Online%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&async=1&is_vtc=1&random=4059490916&resp=GooglemKTybQhCsO&ipr=y&ezwbk=AZuM4hB6_-vb9N7gX83zaFXu8N_-C2JyPfb0h3AnOY3579oHhm4O7_H5Is-u4yeKuVfo5UGC6p2hkrZOCkMynyb9ptIw
Request Chain 210
  • https://googleads.g.doubleclick.net/pagead/viewthroughconversion/959299794/?random=1585442264897&cv=9&fst=1585442264897&num=1&fmt=3&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2od3i0&sendb=1&ig=1&data=event%3Dconversion&frm=0&url=https%3A%2F%2Fardacademy.org%2Fwp-content%2Fcc%2F%3Feml%3Djashye%40mail.nasd&tiba=Online%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&hn=www.googleadservices.com&async=1 HTTP 302
  • https://www.google.com/pagead/1p-user-list/959299794/?random=1585442264897&cv=9&fst=1585440000000&num=1&fmt=3&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2od3i0&sendb=1&data=event%3Dconversion&frm=0&url=https%3A%2F%2Fardacademy.org%2Fwp-content%2Fcc%2F%3Feml%3Djashye%40mail.nasd&tiba=Online%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&async=1&is_vtc=1&random=2769558500&resp=GooglemKTybQhCsO HTTP 302
  • https://www.google.de/pagead/1p-user-list/959299794/?random=1585442264897&cv=9&fst=1585440000000&num=1&fmt=3&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2od3i0&sendb=1&data=event%3Dconversion&frm=0&url=https%3A%2F%2Fardacademy.org%2Fwp-content%2Fcc%2F%3Feml%3Djashye%40mail.nasd&tiba=Online%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&async=1&is_vtc=1&random=2769558500&resp=GooglemKTybQhCsO&ipr=y&ezwbk=AZuM4hACYYfE9iLn60rDm9OIgv6RK3aDeNa_DMFwQ7ibS7b4fAR7uW4KXMNf7wLw6dAAXcwG-wk_yv3TptnaKS4bDHPX
Request Chain 211
  • https://googleads.g.doubleclick.net/pagead/viewthroughconversion/916451471/?random=1585442264898&cv=9&fst=1585442264898&num=1&fmt=3&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2od3i0&sendb=1&ig=1&data=event%3Dconversion&frm=0&url=https%3A%2F%2Fardacademy.org%2Fwp-content%2Fcc%2F%3Feml%3Djashye%40mail.nasd&tiba=Online%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&hn=www.googleadservices.com&async=1 HTTP 302
  • https://www.google.com/pagead/1p-user-list/916451471/?random=1585442264898&cv=9&fst=1585440000000&num=1&fmt=3&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2od3i0&sendb=1&data=event%3Dconversion&frm=0&url=https%3A%2F%2Fardacademy.org%2Fwp-content%2Fcc%2F%3Feml%3Djashye%40mail.nasd&tiba=Online%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&async=1&is_vtc=1&random=1366944797&resp=GooglemKTybQhCsO HTTP 302
  • https://www.google.de/pagead/1p-user-list/916451471/?random=1585442264898&cv=9&fst=1585440000000&num=1&fmt=3&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2od3i0&sendb=1&data=event%3Dconversion&frm=0&url=https%3A%2F%2Fardacademy.org%2Fwp-content%2Fcc%2F%3Feml%3Djashye%40mail.nasd&tiba=Online%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&async=1&is_vtc=1&random=1366944797&resp=GooglemKTybQhCsO&ipr=y&ezwbk=AZuM4hCVkIlaXakMRVMmlcTh295uz0jbNY2QvouwKirf4dXBjtY4WxN6J3WBoUwVTdVe7P2PmiZ8eXAlgXMWoIjMavVR
Request Chain 212
  • https://googleads.g.doubleclick.net/pagead/viewthroughconversion/975701947/?random=1585442264898&cv=9&fst=1585442264898&num=1&fmt=3&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2od3i0&sendb=1&ig=1&data=event%3Dconversion&frm=0&url=https%3A%2F%2Fardacademy.org%2Fwp-content%2Fcc%2F%3Feml%3Djashye%40mail.nasd&tiba=Online%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&hn=www.googleadservices.com&async=1 HTTP 302
  • https://www.google.com/pagead/1p-user-list/975701947/?random=1585442264898&cv=9&fst=1585440000000&num=1&fmt=3&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2od3i0&sendb=1&data=event%3Dconversion&frm=0&url=https%3A%2F%2Fardacademy.org%2Fwp-content%2Fcc%2F%3Feml%3Djashye%40mail.nasd&tiba=Online%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&async=1&is_vtc=1&random=3227876887&resp=GooglemKTybQhCsO HTTP 302
  • https://www.google.de/pagead/1p-user-list/975701947/?random=1585442264898&cv=9&fst=1585440000000&num=1&fmt=3&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2od3i0&sendb=1&data=event%3Dconversion&frm=0&url=https%3A%2F%2Fardacademy.org%2Fwp-content%2Fcc%2F%3Feml%3Djashye%40mail.nasd&tiba=Online%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&async=1&is_vtc=1&random=3227876887&resp=GooglemKTybQhCsO&ipr=y&ezwbk=AZuM4hColn3Sl7dmBxHZLuA4G9TmrFs-XlR1f_ku782PDUTIGsHYH6FT71O1h29JHquuHJk4Er_1xwSVWWJRjDu2sVwQ
Request Chain 213
  • https://googleads.g.doubleclick.net/pagead/viewthroughconversion/770961656/?random=1585442264898&cv=9&fst=1585442264898&num=1&fmt=3&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2od3i0&sendb=1&ig=1&data=event%3Dconversion&frm=0&url=https%3A%2F%2Fardacademy.org%2Fwp-content%2Fcc%2F%3Feml%3Djashye%40mail.nasd&tiba=Online%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&hn=www.googleadservices.com&async=1 HTTP 302
  • https://www.google.com/pagead/1p-user-list/770961656/?random=1585442264898&cv=9&fst=1585440000000&num=1&fmt=3&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2od3i0&sendb=1&data=event%3Dconversion&frm=0&url=https%3A%2F%2Fardacademy.org%2Fwp-content%2Fcc%2F%3Feml%3Djashye%40mail.nasd&tiba=Online%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&async=1&is_vtc=1&random=2601173948&resp=GooglemKTybQhCsO HTTP 302
  • https://www.google.de/pagead/1p-user-list/770961656/?random=1585442264898&cv=9&fst=1585440000000&num=1&fmt=3&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2od3i0&sendb=1&data=event%3Dconversion&frm=0&url=https%3A%2F%2Fardacademy.org%2Fwp-content%2Fcc%2F%3Feml%3Djashye%40mail.nasd&tiba=Online%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&async=1&is_vtc=1&random=2601173948&resp=GooglemKTybQhCsO&ipr=y&ezwbk=AZuM4hAy7J1Y1h0ZsNi6PXej2csGo7AakdrWb7IKaZ9sr3T9AmAoA3aQiGXuaHMPkVfDQCG7dxNLNXf42cZed-W3DV7F
Request Chain 214
  • https://googleads.g.doubleclick.net/pagead/viewthroughconversion/819500023/?random=1585442264898&cv=9&fst=1585442264898&num=1&fmt=3&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2od3i0&sendb=1&ig=1&data=event%3Dconversion&frm=0&url=https%3A%2F%2Fardacademy.org%2Fwp-content%2Fcc%2F%3Feml%3Djashye%40mail.nasd&tiba=Online%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&hn=www.googleadservices.com&async=1 HTTP 302
  • https://www.google.com/pagead/1p-user-list/819500023/?random=1585442264898&cv=9&fst=1585440000000&num=1&fmt=3&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2od3i0&sendb=1&data=event%3Dconversion&frm=0&url=https%3A%2F%2Fardacademy.org%2Fwp-content%2Fcc%2F%3Feml%3Djashye%40mail.nasd&tiba=Online%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&async=1&is_vtc=1&random=488110598&resp=GooglemKTybQhCsO HTTP 302
  • https://www.google.de/pagead/1p-user-list/819500023/?random=1585442264898&cv=9&fst=1585440000000&num=1&fmt=3&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2od3i0&sendb=1&data=event%3Dconversion&frm=0&url=https%3A%2F%2Fardacademy.org%2Fwp-content%2Fcc%2F%3Feml%3Djashye%40mail.nasd&tiba=Online%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&async=1&is_vtc=1&random=488110598&resp=GooglemKTybQhCsO&ipr=y&ezwbk=AZuM4hDQ9jpwXO3jKILmyJHFPtl_CUG0CJ1TjbSIFdEwMMq7R6Dw9pKj8Q77PA4X3lpb9Y3b-6E2bB9afVXGhiaVkBsD
Request Chain 215
  • https://googleads.g.doubleclick.net/pagead/viewthroughconversion/763960929/?random=1585442264898&cv=9&fst=1585442264898&num=1&fmt=3&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2od3i0&sendb=1&ig=1&data=event%3Dconversion&frm=0&url=https%3A%2F%2Fardacademy.org%2Fwp-content%2Fcc%2F%3Feml%3Djashye%40mail.nasd&tiba=Online%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&hn=www.googleadservices.com&async=1 HTTP 302
  • https://www.google.com/pagead/1p-user-list/763960929/?random=1585442264898&cv=9&fst=1585440000000&num=1&fmt=3&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2od3i0&sendb=1&data=event%3Dconversion&frm=0&url=https%3A%2F%2Fardacademy.org%2Fwp-content%2Fcc%2F%3Feml%3Djashye%40mail.nasd&tiba=Online%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&async=1&is_vtc=1&random=785431297&resp=GooglemKTybQhCsO HTTP 302
  • https://www.google.de/pagead/1p-user-list/763960929/?random=1585442264898&cv=9&fst=1585440000000&num=1&fmt=3&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2od3i0&sendb=1&data=event%3Dconversion&frm=0&url=https%3A%2F%2Fardacademy.org%2Fwp-content%2Fcc%2F%3Feml%3Djashye%40mail.nasd&tiba=Online%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&async=1&is_vtc=1&random=785431297&resp=GooglemKTybQhCsO&ipr=y&ezwbk=AZuM4hB9aGSJt8uVA2-BTg6Zx8PYVY9FpPvAkkL72XDGKszqt-bk2uZDPxJ41gAMBG_QixacrHJC3Fww4_RoRC6WXuYc

229 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request /
ardacademy.org/wp-content/cc/
347 KB
99 KB
Document
General
Full URL
https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
35.229.76.23 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
23.76.229.35.bc.googleusercontent.com
Software
nginx / WP Engine
Resource Hash
693b9b91798b4fdd281d3c029cb17eb5f3f24e2735aba88f35696e5197a52be2

Request headers

:method
GET
:authority
ardacademy.org
:scheme
https
:path
/wp-content/cc/?eml=jashye@mail.nasd
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-dest
document
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
none
sec-fetch-mode
navigate
sec-fetch-user
?1
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
document

Response headers

status
200
server
nginx
date
Sun, 29 Mar 2020 00:37:42 GMT
content-type
text/html
vary
Accept-Encoding Accept-Encoding Accept-Encoding,Cookie
last-modified
Thu, 26 Mar 2020 19:17:30 GMT
x-powered-by
WP Engine
x-cacheable
SHORT
cache-control
max-age=600, must-revalidate
etag
W/"56c88-5a1c6d60b735c-gzip"
x-cache
HIT: 3
x-cache-group
normal
content-encoding
br
conversion_async.js
www.google.com/pagead/
26 KB
10 KB
Script
General
Full URL
https://www.google.com/pagead/conversion_async.js
Requested by
Host: ardacademy.org
URL: https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80b::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
67e8a59dc958df2f9736da74581bbd147eb9613554faa4403c0b6bd3b44f411c
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

date
Sun, 29 Mar 2020 00:37:42 GMT
content-encoding
gzip
x-content-type-options
nosniff
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
content-disposition
attachment; filename="f.txt"
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length
9981
x-xss-protection
0
server
cafe
etag
155591084425688047
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
cache-control
private, max-age=3600
timing-allow-origin
*
expires
Sun, 29 Mar 2020 00:37:42 GMT
js
www.googletagmanager.com/gtag/
75 KB
28 KB
Script
General
Full URL
https://www.googletagmanager.com/gtag/js?id=DC-6256710
Requested by
Host: ardacademy.org
URL: https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:808::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
eca1d20a663a7e242fa10ee2c58c742eb6292c898df29e16734ac7d0df29f277
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

Referer
https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

date
Sun, 29 Mar 2020 00:37:42 GMT
content-encoding
br
status
200
strict-transport-security
max-age=31536000; includeSubDomains
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length
28637
x-xss-protection
0
last-modified
Sun, 29 Mar 2020 00:00:00 GMT
server
Google Tag Manager
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
http://www.googletagmanager.com
cache-control
private, max-age=900
access-control-allow-credentials
true
access-control-allow-headers
Cache-Control
expires
Sun, 29 Mar 2020 00:37:42 GMT
cool-2.1.15.min.js
nebula-cdn.kampyle.com/resources/onsite/js/
14 KB
5 KB
Script
General
Full URL
https://nebula-cdn.kampyle.com/resources/onsite/js/cool-2.1.15.min.js
Requested by
Host: ardacademy.org
URL: https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.113.175 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
3e72de5de67d6d80b65a114af684eaf880c53c250155a663cb17d677ff064bc1

Request headers

Referer
https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

date
Sun, 29 Mar 2020 00:37:42 GMT
content-encoding
gzip
age
0
via
1.1 varnish, 1.1 varnish
x-cache
MISS, HIT
status
200
content-length
5197
x-amz-request-id
9951A5F978E3F1C8
x-amz-id-2
XqVaKHOURU7MwBcpCCMUctvOEFoT/DWescBxrAjf4sZMYSxmxYYg9yZGPXef3JTIqggebmjHsaM=
x-served-by
cache-iad2139-IAD, cache-hhn4073-HHN
last-modified
Tue, 17 Mar 2020 11:10:17 GMT
server
AmazonS3
x-timer
S1585442263.645525,VS0,VE0
etag
"80dd5e3be5152c5c72d552c6a26ef6ff"
vary
Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=31536000
accept-ranges
bytes
x-cache-hits
0, 59555
js
www.googletagmanager.com/gtag/
75 KB
28 KB
Script
General
Full URL
https://www.googletagmanager.com/gtag/js?id=DC-6269322
Requested by
Host: ardacademy.org
URL: https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:808::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
b2fc35bcf7ad38c6cbc6d170cc5bf15a688ba76d282272c3f0af4c6b31eb0631
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

Referer
https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

date
Sun, 29 Mar 2020 00:37:42 GMT
content-encoding
br
status
200
strict-transport-security
max-age=31536000; includeSubDomains
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length
28637
x-xss-protection
0
last-modified
Sun, 29 Mar 2020 00:00:00 GMT
server
Google Tag Manager
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
http://www.googletagmanager.com
cache-control
private, max-age=900
access-control-allow-credentials
true
access-control-allow-headers
Cache-Control
expires
Sun, 29 Mar 2020 00:37:42 GMT
js
www.googletagmanager.com/gtag/
75 KB
28 KB
Script
General
Full URL
https://www.googletagmanager.com/gtag/js?id=DC-6260004
Requested by
Host: ardacademy.org
URL: https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:808::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
ca7048dd1a1d15f42c04c8f3db2d3bcffc6c7eb1be4506ca9fe2651b07766641
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

Referer
https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

date
Sun, 29 Mar 2020 00:37:42 GMT
content-encoding
br
status
200
strict-transport-security
max-age=31536000; includeSubDomains
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length
28637
x-xss-protection
0
last-modified
Sun, 29 Mar 2020 00:00:00 GMT
server
Google Tag Manager
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
http://www.googletagmanager.com
cache-control
private, max-age=900
access-control-allow-credentials
true
access-control-allow-headers
Cache-Control
expires
Sun, 29 Mar 2020 00:37:42 GMT
tc.min.js
c1.rfihub.net/js/
20 KB
7 KB
Script
General
Full URL
https://c1.rfihub.net/js/tc.min.js
Requested by
Host: ardacademy.org
URL: https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.38.48.101 , Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a23-38-48-101.deploy.static.akamaitechnologies.com
Software
Jetty(9.0.6.v20130930) /
Resource Hash
cb2bb21705b9cce9781d02c9223f3344a65bd5314027d11c5a8518ad4bd84e84

Request headers

Referer
https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

Date
Sun, 29 Mar 2020 00:37:42 GMT
Content-Encoding
gzip
Last-Modified
Wed, 24 Jul 2019 06:34:16 GMT
Server
Jetty(9.0.6.v20130930)
Vary
Accept-Encoding
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Cache-Control
public, max-age=3600
Connection
keep-alive
Content-Type
application/x-javascript
Content-Length
6375
Expires
Sun, 29 Mar 2020 01:37:42 GMT
1560.js
cdn.pbbl.co/r/
33 KB
9 KB
Script
General
Full URL
https://cdn.pbbl.co/r/1560.js
Requested by
Host: ardacademy.org
URL: https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
143.204.202.100 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-202-100.fra53.r.cloudfront.net
Software
nginx/1.10.3 (Ubuntu) /
Resource Hash
8e60e8edaca8a3167fe48e62f9b53ba1989a5b6a23283555f09ab12175fed96e
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Xss-Protection 1

Request headers

Referer
https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

strict-transport-security
max-age=31536000
content-encoding
gzip
age
1252
x-cache
Hit from cloudfront
status
200
x-xss-protection
1
last-modified
Tue, 03 Mar 2020 17:36:15 GMT
server
nginx/1.10.3 (Ubuntu)
date
Sun, 29 Mar 2020 00:16:50 GMT
vary
Accept-Encoding
content-type
application/javascript
via
1.1 c714e4f593454d65f62cf3fecf756a4c.cloudfront.net (CloudFront)
cache-control
max-age=1800, public
x-amz-cf-pop
FRA53-C1
x-amz-cf-id
_LY8qX_TLyrbOwwLCHuTBm5_isdPim6iPD7CD2goMFk0P33u6vO2_A==
expires
Sun, 29 Mar 2020 00:46:50 GMT
up_loader.1.1.0.js
js.adsrvr.org/
4 KB
4 KB
Script
General
Full URL
https://js.adsrvr.org/up_loader.1.1.0.js
Requested by
Host: ardacademy.org
URL: https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
143.204.207.113 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-207-113.fra53.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
0615974c40d602afdbf9759533e352bc17b0458c85aad6694b1a1ad20659625b

Request headers

Referer
https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

Date
Sat, 28 Mar 2020 21:05:37 GMT
Via
1.1 1cc446ef4692d8e752b16c07f2f58a59.cloudfront.net (CloudFront)
Last-Modified
Mon, 13 Jan 2020 19:16:48 GMT
Server
AmazonS3
Age
20529
ETag
"45bb7a1f2878be0c29077f7329fca766"
Vary
Accept-Encoding
X-Cache
Hit from cloudfront
Content-Type
application/x-javascript
X-Amz-Cf-Pop
FRA53-C1
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
4091
X-Amz-Cf-Id
PQ8S1_PpQjcppgVRxNge1iiT7cCMrVvTc9QZTDXdCujP5oK698vjoA==
bk-coretag.js
tags.bkrtx.com/js/
30 KB
11 KB
Script
General
Full URL
https://tags.bkrtx.com/js/bk-coretag.js
Requested by
Host: ardacademy.org
URL: https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.111.245.241 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-111-245-241.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
7b8cd61f9d36175fe1b2fc50dfd1585716b9e55a87a82e8ec3c5d9739d6fb939

Request headers

Referer
https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

Date
Sun, 29 Mar 2020 00:37:43 GMT
Content-Encoding
gzip
Last-Modified
Wed, 04 Mar 2020 16:24:16 GMT
Server
Apache
ETag
"31600f9-7850-5a009da075833"
Vary
Accept-Encoding
Content-Type
text/javascript
Cache-Control
max-age=604800
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
10546
Expires
Sun, 05 Apr 2020 00:37:43 GMT
557566dc60916e3de69e006bef252459.js
nexus.ensighten.com/citi/na_prod/code/
2 KB
961 B
Script
General
Full URL
https://nexus.ensighten.com/citi/na_prod/code/557566dc60916e3de69e006bef252459.js?conditionId0=4837456
Requested by
Host: ardacademy.org
URL: https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
18.195.42.228 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-18-195-42-228.eu-central-1.compute.amazonaws.com
Software
nginx /
Resource Hash
31b00ff4929696dfca06885da68e58c3e09f6ecb4ae0fe1ae287e99a3fd1f716

Request headers

Referer
https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

date
Sun, 29 Mar 2020 00:37:43 GMT
content-encoding
gzip
last-modified
Tue, 27 Aug 2019 16:59:12 GMT
server
nginx
etag
W/"5d656160-887"
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
status
200
cache-control
max-age=315360000
48070ca8866144aeed1d66dda4fe04f2.js
nexus.ensighten.com/citi/na_prod/code/
2 KB
1 KB
Script
General
Full URL
https://nexus.ensighten.com/citi/na_prod/code/48070ca8866144aeed1d66dda4fe04f2.js?conditionId0=4854834
Requested by
Host: ardacademy.org
URL: https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
18.195.42.228 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-18-195-42-228.eu-central-1.compute.amazonaws.com
Software
nginx /
Resource Hash
a9cebaefb3003c4944d0d59f71afdca3509d3975af5ff213d2750fdf8f719146

Request headers

Referer
https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

date
Sun, 29 Mar 2020 00:37:43 GMT
content-encoding
gzip
last-modified
Tue, 25 Jun 2019 17:02:14 GMT
server
nginx
etag
W/"5d125396-95c"
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
status
200
cache-control
max-age=315360000
ee55763bbebca7805817a98103ec6f50.js
nexus.ensighten.com/citi/na_prod/code/
1 KB
678 B
Script
General
Full URL
https://nexus.ensighten.com/citi/na_prod/code/ee55763bbebca7805817a98103ec6f50.js?conditionId0=4850690
Requested by
Host: ardacademy.org
URL: https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
18.195.42.228 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-18-195-42-228.eu-central-1.compute.amazonaws.com
Software
nginx /
Resource Hash
a612a8f640434c7aaee47569897c1fee79df6f146ec26115e2a8c9be645592b7

Request headers

Referer
https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

date
Sun, 29 Mar 2020 00:37:43 GMT
content-encoding
gzip
last-modified
Tue, 29 Oct 2019 17:20:39 GMT
server
nginx
etag
W/"5db874e7-425"
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
status
200
cache-control
max-age=315360000
c85faa5c0b8da7b1a58cd22d5430c4c5.js
nexus.ensighten.com/citi/na_prod/code/
2 KB
979 B
Script
General
Full URL
https://nexus.ensighten.com/citi/na_prod/code/c85faa5c0b8da7b1a58cd22d5430c4c5.js?conditionId0=405518
Requested by
Host: ardacademy.org
URL: https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
18.195.42.228 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-18-195-42-228.eu-central-1.compute.amazonaws.com
Software
nginx /
Resource Hash
f82e13743e667ec749b08d88f08a2a2ea1f688de0b2724b9c0b0b61ca6d680e3

Request headers

Referer
https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

date
Sun, 29 Mar 2020 00:37:43 GMT
content-encoding
gzip
last-modified
Tue, 19 Nov 2019 18:11:34 GMT
server
nginx
etag
W/"5dd43056-83e"
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
status
200
cache-control
max-age=315360000
d136239f021c14bd86738c333b8132f8.js
nexus.ensighten.com/citi/na_prod/code/
7 KB
3 KB
Script
General
Full URL
https://nexus.ensighten.com/citi/na_prod/code/d136239f021c14bd86738c333b8132f8.js?conditionId0=462132
Requested by
Host: ardacademy.org
URL: https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
18.195.42.228 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-18-195-42-228.eu-central-1.compute.amazonaws.com
Software
nginx /
Resource Hash
1d6b802e59b40aa8540347ab5a754ef472500480deeeea720385753ba96cc8e8

Request headers

Referer
https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

date
Sun, 29 Mar 2020 00:37:43 GMT
content-encoding
gzip
last-modified
Sun, 23 Feb 2020 11:10:02 GMT
server
nginx
etag
W/"5e525d8a-1cc2"
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
status
200
cache-control
max-age=315360000
2906f06ed928da15ec22eab16f8f3588.js
nexus.ensighten.com/citi/na_prod/code/
448 B
630 B
Script
General
Full URL
https://nexus.ensighten.com/citi/na_prod/code/2906f06ed928da15ec22eab16f8f3588.js?conditionId0=454466
Requested by
Host: ardacademy.org
URL: https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
18.195.42.228 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-18-195-42-228.eu-central-1.compute.amazonaws.com
Software
nginx /
Resource Hash
3cb1f89cca21255888919872c51263c08dfc181d2600d2375bdbd8fda57788ce

Request headers

Referer
https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

date
Sun, 29 Mar 2020 00:37:43 GMT
last-modified
Tue, 07 May 2019 17:03:33 GMT
server
nginx
etag
"5cd1ba65-1c0"
content-type
application/javascript; charset=utf-8
status
200
cache-control
max-age=315360000
accept-ranges
bytes
content-length
448
8637af7c210f4e79436bc39f71b49bfa.js
nexus.ensighten.com/citi/na_prod/code/
1 KB
737 B
Script
General
Full URL
https://nexus.ensighten.com/citi/na_prod/code/8637af7c210f4e79436bc39f71b49bfa.js?conditionId0=4827153
Requested by
Host: ardacademy.org
URL: https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
18.195.42.228 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-18-195-42-228.eu-central-1.compute.amazonaws.com
Software
nginx /
Resource Hash
06dfb367edf9bbff810def9f75f8695b3ccfbcb2813306609fc6e18fcacfc17e

Request headers

Referer
https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

date
Sun, 29 Mar 2020 00:37:43 GMT
content-encoding
gzip
last-modified
Wed, 10 Jul 2019 12:57:13 GMT
server
nginx
etag
W/"5d25e0a9-412"
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
status
200
cache-control
max-age=315360000
98eab123fd6eeaefc94916fb10ff0a06.js
nexus.ensighten.com/citi/na_prod/code/
30 KB
7 KB
Script
General
Full URL
https://nexus.ensighten.com/citi/na_prod/code/98eab123fd6eeaefc94916fb10ff0a06.js?conditionId0=467299
Requested by
Host: ardacademy.org
URL: https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
18.195.42.228 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-18-195-42-228.eu-central-1.compute.amazonaws.com
Software
nginx /
Resource Hash
972256d3bce669df3ed0d7060d4b6897500a1a144c4891700370b6de287ac3d9

Request headers

Referer
https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

date
Sun, 29 Mar 2020 00:37:43 GMT
content-encoding
gzip
last-modified
Tue, 03 Mar 2020 18:58:07 GMT
server
nginx
etag
W/"5e5ea8bf-76b0"
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
status
200
cache-control
max-age=315360000
c7fb8fdcd5c59e67afe63c97ddb163c5.js
nexus.ensighten.com/citi/na_prod/code/
253 KB
80 KB
Script
General
Full URL
https://nexus.ensighten.com/citi/na_prod/code/c7fb8fdcd5c59e67afe63c97ddb163c5.js?conditionId0=3013337
Requested by
Host: ardacademy.org
URL: https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
18.195.42.228 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-18-195-42-228.eu-central-1.compute.amazonaws.com
Software
nginx /
Resource Hash
147d5785b25331ac266f34841b05b4401ec78b0e0de6f85d63993ab0a9b5a253

Request headers

Referer
https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

date
Sun, 29 Mar 2020 00:37:43 GMT
content-encoding
gzip
last-modified
Wed, 20 Nov 2019 20:35:34 GMT
server
nginx
etag
W/"5dd5a396-3f565"
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
status
200
cache-control
max-age=315360000
298eff2fda6a766b160eb3fd281b83a1.js
nexus.ensighten.com/citi/na_prod/code/
126 KB
34 KB
Script
General
Full URL
https://nexus.ensighten.com/citi/na_prod/code/298eff2fda6a766b160eb3fd281b83a1.js?conditionId0=486757
Requested by
Host: ardacademy.org
URL: https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
18.195.42.228 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-18-195-42-228.eu-central-1.compute.amazonaws.com
Software
nginx /
Resource Hash
470006833167eb6002e768cbe0865a86338c1fec3955d551e0f4f1d6a0ef7fa6

Request headers

Referer
https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

date
Sun, 29 Mar 2020 00:37:43 GMT
content-encoding
gzip
last-modified
Tue, 03 Mar 2020 18:58:07 GMT
server
nginx
etag
W/"5e5ea8bf-1f8d4"
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
status
200
cache-control
max-age=315360000
ac1983fb1741bbd6bf2b1d3952ef4733.js
nexus.ensighten.com/citi/na_prod/code/
234 B
416 B
Script
General
Full URL
https://nexus.ensighten.com/citi/na_prod/code/ac1983fb1741bbd6bf2b1d3952ef4733.js?conditionId0=4860234
Requested by
Host: ardacademy.org
URL: https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
18.195.42.228 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-18-195-42-228.eu-central-1.compute.amazonaws.com
Software
nginx /
Resource Hash
c8d8089cd33d869efa694df91d860ce8b4f88135e1f2b590906799dc7a19a65a

Request headers

Referer
https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

date
Sun, 29 Mar 2020 00:37:43 GMT
last-modified
Tue, 22 Oct 2019 16:59:12 GMT
server
nginx
etag
"5daf3560-ea"
content-type
application/javascript; charset=utf-8
status
200
cache-control
max-age=315360000
accept-ranges
bytes
content-length
234
fdf45a7c15c1cee06bb71e10dac4e26e.js
nexus.ensighten.com/citi/na_prod/code/
989 B
1 KB
Script
General
Full URL
https://nexus.ensighten.com/citi/na_prod/code/fdf45a7c15c1cee06bb71e10dac4e26e.js?conditionId0=4849963
Requested by
Host: ardacademy.org
URL: https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
18.195.42.228 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-18-195-42-228.eu-central-1.compute.amazonaws.com
Software
nginx /
Resource Hash
7df13706eaab8ce9a3dcd2a501f60bc66987c83834d07dfaf07ae56ef814c110

Request headers

Referer
https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

date
Sun, 29 Mar 2020 00:37:43 GMT
last-modified
Tue, 14 May 2019 17:01:42 GMT
server
nginx
etag
"5cdaf476-3dd"
content-type
application/javascript; charset=utf-8
status
200
cache-control
max-age=315360000
accept-ranges
bytes
content-length
989
4b2c20707c9c91f3047831e7c4145026.js
nexus.ensighten.com/citi/na_prod/code/
97 KB
22 KB
Script
General
Full URL
https://nexus.ensighten.com/citi/na_prod/code/4b2c20707c9c91f3047831e7c4145026.js?conditionId0=421908
Requested by
Host: ardacademy.org
URL: https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
18.195.42.228 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-18-195-42-228.eu-central-1.compute.amazonaws.com
Software
nginx /
Resource Hash
880960ba5b705083263a8a5329436c1e436a4c5bd618e2551e3c313d18ef88e2

Request headers

Referer
https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

date
Sun, 29 Mar 2020 00:37:43 GMT
content-encoding
gzip
last-modified
Thu, 27 Feb 2020 21:46:14 GMT
server
nginx
etag
W/"5e5838a6-18322"
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
status
200
cache-control
max-age=315360000
f1c71c10d3e2f87f440821ca1f9e2e65.js
nexus.ensighten.com/citi/na_prod/code/
2 KB
863 B
Script
General
Full URL
https://nexus.ensighten.com/citi/na_prod/code/f1c71c10d3e2f87f440821ca1f9e2e65.js?conditionId0=480881
Requested by
Host: ardacademy.org
URL: https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
18.195.42.228 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-18-195-42-228.eu-central-1.compute.amazonaws.com
Software
nginx /
Resource Hash
e226935ba96b671378a7552d0669729f2b4733fab20624ed8018e86bad35401e

Request headers

Referer
https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

date
Sun, 29 Mar 2020 00:37:43 GMT
content-encoding
gzip
last-modified
Tue, 04 Feb 2020 18:16:27 GMT
server
nginx
etag
W/"5e39b4fb-631"
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
status
200
cache-control
max-age=315360000
www-widgetapi.js
s.ytimg.com/yts/jsbin/www-widgetapi-vfl13pyi5/
38 KB
14 KB
Script
General
Full URL
https://s.ytimg.com/yts/jsbin/www-widgetapi-vfl13pyi5/www-widgetapi.js
Requested by
Host: ardacademy.org
URL: https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:825::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
4734405c034b81eddf4f6a932437523f5ab8ba90e80182371c75736d0f3679fd
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

date
Fri, 27 Mar 2020 12:28:08 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
130175
status
200
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length
13922
x-xss-protection
0
last-modified
Wed, 25 Mar 2020 19:29:21 GMT
server
sffe
vary
Accept-Encoding, Origin
content-type
text/javascript
cache-control
public, max-age=691200
accept-ranges
bytes
timing-allow-origin
https://www.youtube.com
expires
Sat, 04 Apr 2020 12:28:08 GMT
iframe_api
www.youtube.com/
859 B
923 B
Script
General
Full URL
https://www.youtube.com/iframe_api
Requested by
Host: ardacademy.org
URL: https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81a::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
YouTube Frontend Proxy /
Resource Hash
331e846c17bf9cd732c1086710cdc3af20bb75a59d7de0fde40846a68b4fefd6
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

date
Sun, 29 Mar 2020 00:37:42 GMT
x-content-type-options
nosniff
server
YouTube Frontend Proxy
content-type
application/javascript
status
200
cache-control
no-cache
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length
859
x-xss-protection
0
expires
Tue, 27 Apr 1971 19:44:06 GMT
cyss.js
cyseal.cyveillance.com/SiteSeal/
0
226 B
Script
General
Full URL
https://cyseal.cyveillance.com/SiteSeal/cyss.js?ref=online.citi.com
Requested by
Host: ardacademy.org
URL: https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.212.137.125 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-3-212-137-125.compute-1.amazonaws.com
Software
Apache/2.4.6 (Red Hat Enterprise Linux) OpenSSL/1.0.1e-fips mod_jk/1.2.40 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

Date
Sun, 29 Mar 2020 00:37:43 GMT
Server
Apache/2.4.6 (Red Hat Enterprise Linux) OpenSSL/1.0.1e-fips mod_jk/1.2.40
Connection
keep-alive
Content-Length
0
Content-Type
application/javascript
cse.js
cse.google.com/cse/
11 KB
4 KB
Script
General
Full URL
https://cse.google.com/cse/cse.js?cx=009695499870347544712:e3dyicpbrwu
Requested by
Host: ardacademy.org
URL: https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:817::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
gws /
Resource Hash
5c1b3b2c4b13a950dbd72bb6132b2e172b446b20131f1bf8718e73011f15fd2b
Security Headers
Name Value
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Referer
https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

date
Sun, 29 Mar 2020 00:37:43 GMT
content-encoding
br
server
gws
x-frame-options
SAMEORIGIN
p3p
CP="This is not a P3P policy! See g.co/p3phelp for more info."
status
200
cache-control
private
content-disposition
attachment; filename="f.txt"
content-type
text/javascript; charset=UTF-8
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length
3475
x-xss-protection
0
expires
Sun, 29 Mar 2020 00:37:43 GMT
serverComponent.php
nexus.ensighten.com/citi/na_prod/
2 KB
924 B
Script
General
Full URL
https://nexus.ensighten.com/citi/na_prod/serverComponent.php?r=3077485.7486930583&ClientID=1129&PageID=https%3A%2F%2Fonline.citi.com%2FUS%2Flogin.do
Requested by
Host: ardacademy.org
URL: https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
18.195.42.228 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-18-195-42-228.eu-central-1.compute.amazonaws.com
Software
nginx /
Resource Hash
75fa9ee0533790f2671b2fedd28f1b4ce9bf66f178ccd9bb25e4a02377bb7b26

Request headers

Referer
https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

date
Sun, 29 Mar 2020 00:37:42 GMT
content-encoding
gzip
server
nginx
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
no-cache, no-store
expires
Sun, 29 Mar 2020 00:37:41 GMT
www-widgetapi.js
s.ytimg.com/yts/jsbin/www-widgetapi-vfln21F5R/
38 KB
14 KB
Script
General
Full URL
https://s.ytimg.com/yts/jsbin/www-widgetapi-vfln21F5R/www-widgetapi.js
Requested by
Host: www.youtube.com
URL: https://www.youtube.com/iframe_api
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:825::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
575d697f703ea404e1a023022aaeaaa81e98d1873cf2e7687238bd1606e4f625
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

date
Sat, 28 Mar 2020 06:23:37 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
65646
status
200
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length
13931
x-xss-protection
0
last-modified
Fri, 27 Mar 2020 02:58:53 GMT
server
sffe
vary
Accept-Encoding, Origin
content-type
text/javascript
cache-control
public, max-age=691200
accept-ranges
bytes
timing-allow-origin
https://www.youtube.com
expires
Sun, 05 Apr 2020 06:23:37 GMT
webrtc-patch.js
0d22d313-900b-4c1e-b14c-8f366968c366/scripts/
0
0

tagging.js
ardacademy.org/CBOL/taggingTransformation/
0
0
Script
General
Full URL
https://ardacademy.org/CBOL/taggingTransformation/tagging.js
Requested by
Host: ardacademy.org
URL: https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
35.229.76.23 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
23.76.229.35.bc.googleusercontent.com
Software
nginx /
Resource Hash

Request headers

Referer
https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

status
404
date
Sun, 29 Mar 2020 00:37:42 GMT
content-encoding
br
server
nginx
vary
Accept-Encoding, Accept-Encoding
content-type
text/html
main.css
online.citi.com/GFC/branding/responsivebranding/css/
45 KB
7 KB
Stylesheet
General
Full URL
https://online.citi.com/GFC/branding/responsivebranding/css/main.css
Requested by
Host: ardacademy.org
URL: https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.109.92.187 , Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a104-109-92-187.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
429d8af3190c76d5fcb9b1cad2aa6eb555684921323da905d62017fbdbf557c6
Security Headers
Name Value
Content-Security-Policy frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
Strict-Transport-Security max-age=300
X-Content-Security-Policy frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

Request headers

Referer
https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
style

Response headers

strict-transport-security
max-age=300
content-encoding
gzip
x-content-security-policy
frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
last-modified
Wed, 26 Jun 2019 07:44:47 GMT
x-akamai-citisite
SWDC
x-webkit-csp
frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
date
Sun, 29 Mar 2020 00:37:42 GMT
vary
Accept-Encoding
p3p
policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
status
200
cache-control
max-age=21600
content-security-policy
frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
content-type
text/css
content-length
7108
expires
Sun, 29 Mar 2020 06:37:42 GMT
ddl.min.css
online.citi.com/CBOL/common/ui/ddl/theme/latest/styles/
624 KB
69 KB
Stylesheet
General
Full URL
https://online.citi.com/CBOL/common/ui/ddl/theme/latest/styles/ddl.min.css
Requested by
Host: ardacademy.org
URL: https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.109.92.187 , Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a104-109-92-187.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
6177c6163dc1ad67fb596a94ef3d18a277bfd437dbb3c1a928cd6caacefeff2e
Security Headers
Name Value
Content-Security-Policy frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
Strict-Transport-Security max-age=300
X-Content-Security-Policy frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

Request headers

Referer
https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
style

Response headers

strict-transport-security
max-age=300
content-encoding
gzip
x-content-security-policy
frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
last-modified
Tue, 12 Sep 2017 16:59:12 GMT
x-akamai-citisite
SWDC
x-webkit-csp
frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
date
Sun, 29 Mar 2020 00:37:42 GMT
vary
Accept-Encoding
p3p
policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
status
200
cache-control
max-age=21600
content-security-policy
frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
content-type
text/css
content-length
69738
expires
Sun, 29 Mar 2020 06:37:42 GMT
jfpm.autocomplete.off.js
online.citi.com/JFP/js/modules/
1 KB
834 B
Script
General
Full URL
https://online.citi.com/JFP/js/modules/jfpm.autocomplete.off.js
Requested by
Host: ardacademy.org
URL: https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.109.92.187 , Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a104-109-92-187.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
9dad502247a8488c21ef5beb32aed1a78b17b748711bec817c472911f76b4ead
Security Headers
Name Value
Content-Security-Policy frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
Strict-Transport-Security max-age=300
X-Content-Security-Policy frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

Request headers

Referer
https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

strict-transport-security
max-age=300
content-encoding
gzip
x-content-security-policy
frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
last-modified
Tue, 12 Sep 2017 16:59:12 GMT
x-akamai-citisite
SWDC
x-webkit-csp
frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
date
Sun, 29 Mar 2020 00:37:43 GMT
vary
Accept-Encoding
p3p
policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
status
200
cache-control
max-age=21600
content-security-policy
frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
content-type
application/x-javascript
content-length
344
expires
Sun, 29 Mar 2020 06:37:43 GMT
main_branding.css
online.citi.com/GFC/branding/responsivebranding/css/
272 KB
43 KB
Stylesheet
General
Full URL
https://online.citi.com/GFC/branding/responsivebranding/css/main_branding.css
Requested by
Host: ardacademy.org
URL: https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.109.92.187 , Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a104-109-92-187.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
44d3d4e66e1e7636e57911765054e696958d07ea55189620e27a1e163ba33957
Security Headers
Name Value
Content-Security-Policy frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
Strict-Transport-Security max-age=300
X-Content-Security-Policy frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

Request headers

Referer
https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
style

Response headers

strict-transport-security
max-age=300
content-encoding
gzip
x-content-security-policy
frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
last-modified
Wed, 05 Feb 2020 04:55:56 GMT
x-akamai-citisite
SWDC
x-webkit-csp
frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
date
Sun, 29 Mar 2020 00:37:42 GMT
vary
Accept-Encoding
p3p
policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
status
200
cache-control
max-age=21600
content-security-policy
frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
content-type
text/css
content-length
43631
expires
Sun, 29 Mar 2020 06:37:42 GMT
vendor.js
online.citi.com/CBOL/common/ui/ddl/theme/latest/scripts/
204 KB
64 KB
Script
General
Full URL
https://online.citi.com/CBOL/common/ui/ddl/theme/latest/scripts/vendor.js
Requested by
Host: ardacademy.org
URL: https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.109.92.187 , Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a104-109-92-187.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
f2dd1ff20c3df202418f9d59c76f40bdb304d7a85d7163fc9935391528f3dee8
Security Headers
Name Value
Content-Security-Policy frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
Strict-Transport-Security max-age=300
X-Content-Security-Policy frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

Request headers

Referer
https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

strict-transport-security
max-age=300
content-encoding
gzip
x-content-security-policy
frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
last-modified
Tue, 12 Sep 2017 16:59:12 GMT
x-akamai-citisite
SWDC
x-webkit-csp
frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
date
Sun, 29 Mar 2020 00:37:42 GMT
vary
Accept-Encoding
p3p
policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
status
200
cache-control
max-age=21600
content-security-policy
frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
content-type
application/x-javascript
content-length
64910
expires
Sun, 29 Mar 2020 06:37:42 GMT
Bootstrap.js
nexus.ensighten.com/citi/na_prod/
327 KB
105 KB
Script
General
Full URL
https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Requested by
Host: ardacademy.org
URL: https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
18.195.42.228 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-18-195-42-228.eu-central-1.compute.amazonaws.com
Software
nginx /
Resource Hash
ae76982e42ad8bf33cc3a66ed389810d245242bcfa3dd2e3f05baf330f28098f

Request headers

Referer
https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

date
Sun, 29 Mar 2020 00:37:42 GMT
content-encoding
gzip
last-modified
Wed, 18 Mar 2020 10:04:46 GMT
server
nginx
etag
W/"5e71f23e-51cf6"
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
status
200
cache-control
max-age=300
target.js
cdn.tt.omtrdc.net/cdn/
43 KB
14 KB
Script
General
Full URL
https://cdn.tt.omtrdc.net/cdn/target.js
Requested by
Host: ardacademy.org
URL: https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.111.235.198 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-111-235-198.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
7ecf3bf86151cd72036fb67feb8fcbd8c80359e0ca871e1aeb955428ed43c26d

Request headers

Referer
https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

Date
Sun, 29 Mar 2020 00:37:42 GMT
Content-Encoding
gzip
Last-Modified
Tue, 01 Oct 2019 05:03:41 GMT
Server
Apache
ETag
"1fcda-aa3e-593d246a6d5b9"
Vary
Accept-Encoding
Content-Type
text/javascript; charset=utf-8
Cache-Control
must-revalidate, max-age=3600
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
14200
ajax
citicorpcreditservic.tt.omtrdc.net/m2/citicorpcreditservic/mbox/
811 B
1 KB
Script
General
Full URL
https://citicorpcreditservic.tt.omtrdc.net/m2/citicorpcreditservic/mbox/ajax?mboxHost=online.citi.com&mboxPage=e995cda6e40847cc8147e10e4a6ac240&screenHeight=768&screenWidth=1366&browserWidth=1366&browserHeight=693&browserTimeOffset=-300&colorDepth=24&mboxSession=e995cda6e40847cc8147e10e4a6ac240&mboxXDomain=enabled&mboxCount=1&mboxTime=1585229667031&mboxPC=7e2af4fc3aa542388607404c4b23e2b6.17_0&mbox=target-global-mbox&mboxId=0&mboxURL=https%3A%2F%2Fonline.citi.com%2FUS%2Flogin.do&mboxReferrer=&mboxVersion=63
Requested by
Host: ardacademy.org
URL: https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
66.117.29.11 , United States, ASN15224 (OMNITURE, US),
Reverse DNS
Software
/
Resource Hash
6b869fdcddeb24f7dcbe7223f77eb1f701e74c63581b69d3ef4ec9b445795bba

Request headers

Referer
https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

pragma
no-cache
date
Sun, 29 Mar 2020 00:37:42 GMT
content-type
text/javascript;charset=utf-8
p3p
CP="NOI DSP CURa OUR STP COM"
status
200
cache-control
no-cache
timing-allow-origin
*
content-length
811
x-request-id
aa3ffe20-6192-45ff-8645-7e7dfc8e5a51
homePage.min.css
online.citi.com/loginpage/styles/
24 KB
5 KB
Stylesheet
General
Full URL
https://online.citi.com/loginpage/styles/homePage.min.css
Requested by
Host: ardacademy.org
URL: https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.109.92.187 , Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a104-109-92-187.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
ed48ae9c1a324d49404d9fb4c508b880ca97a65f8fd21d352e241d1e4dfc50e2
Security Headers
Name Value
Content-Security-Policy frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
Strict-Transport-Security max-age=300
X-Content-Security-Policy frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

Request headers

Referer
https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
style

Response headers

strict-transport-security
max-age=300
content-encoding
gzip
x-content-security-policy
frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
last-modified
Tue, 12 Jun 2018 05:31:28 GMT
x-akamai-citisite
GTDC
x-webkit-csp
frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
date
Sun, 29 Mar 2020 00:37:42 GMT
vary
Accept-Encoding
p3p
policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
status
200
cache-control
max-age=21600
content-security-policy
frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
content-type
text/css
content-length
5032
expires
Sun, 29 Mar 2020 06:37:42 GMT
jquery.tmpl.js
online.citi.com/JFP/js/jquery/plugins/
6 KB
3 KB
Script
General
Full URL
https://online.citi.com/JFP/js/jquery/plugins/jquery.tmpl.js
Requested by
Host: ardacademy.org
URL: https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.109.92.187 , Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a104-109-92-187.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
629b48196dcc270143a42ce57535b251c655617f8d510277d4a05306c426fd38
Security Headers
Name Value
Content-Security-Policy frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
Strict-Transport-Security max-age=300
X-Content-Security-Policy frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

Request headers

Referer
https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

strict-transport-security
max-age=300
content-encoding
gzip
x-content-security-policy
frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
last-modified
Tue, 12 Sep 2017 17:24:52 GMT
x-akamai-citisite
GTDC
x-webkit-csp
frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
date
Sun, 29 Mar 2020 00:37:42 GMT
vary
Accept-Encoding
p3p
policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
status
200
cache-control
max-age=21600
content-security-policy
frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
content-type
application/x-javascript
content-length
2905
expires
Sun, 29 Mar 2020 06:37:42 GMT
fp.min.js
online.citi.com/JSO/js/
15 KB
5 KB
Script
General
Full URL
https://online.citi.com/JSO/js/fp.min.js
Requested by
Host: ardacademy.org
URL: https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.109.92.187 , Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a104-109-92-187.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
c3c994c3fe9bd4e055f6d0eb42067ecd6bdd3247e136bc22835b9882cfe77c61
Security Headers
Name Value
Content-Security-Policy frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
Strict-Transport-Security max-age=300
X-Content-Security-Policy frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

Request headers

Referer
https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

strict-transport-security
max-age=300
content-encoding
gzip
x-content-security-policy
frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
last-modified
Tue, 12 Sep 2017 17:20:58 GMT
x-akamai-citisite
GTDC
x-webkit-csp
frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
date
Sun, 29 Mar 2020 00:37:43 GMT
vary
Accept-Encoding
p3p
policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
status
200
cache-control
max-age=21600
content-security-policy
frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
content-type
application/x-javascript
content-length
4322
expires
Sun, 29 Mar 2020 06:37:43 GMT
citilive-search-responsive.css
online.citi.com/JEA/CitiSearch/nexus-platform/css/
58 KB
13 KB
Stylesheet
General
Full URL
https://online.citi.com/JEA/CitiSearch/nexus-platform/css/citilive-search-responsive.css
Requested by
Host: ardacademy.org
URL: https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.109.92.187 , Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a104-109-92-187.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
cdb828e2f4e62e1900133748ba426481b6c8383ebaca93133988da409506d3b4
Security Headers
Name Value
Content-Security-Policy frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
Strict-Transport-Security max-age=300
X-Content-Security-Policy frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

Request headers

Referer
https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
style

Response headers

strict-transport-security
max-age=300
content-encoding
gzip
x-content-security-policy
frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
last-modified
Mon, 20 Jan 2020 19:26:26 GMT
x-akamai-citisite
GTDC
x-webkit-csp
frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
date
Sun, 29 Mar 2020 00:37:42 GMT
vary
Accept-Encoding
p3p
policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
status
200
cache-control
max-age=21600
content-security-policy
frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
content-type
text/css
content-length
12501
expires
Sun, 29 Mar 2020 06:37:42 GMT
cse_element__en.js
www.google.com/cse/static/element/8b2252448421acb3/
257 KB
85 KB
Script
General
Full URL
https://www.google.com/cse/static/element/8b2252448421acb3/cse_element__en.js?usqp=CAI%3D
Requested by
Host: ardacademy.org
URL: https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80b::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
02c39275000c1280f9cde808ebe731ec1924477305678759c1140ecaac49eba0
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

date
Sat, 28 Mar 2020 14:14:14 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Thu, 31 Oct 2019 16:49:36 GMT
server
sffe
age
37408
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
public, max-age=31536000
accept-ranges
bytes
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length
86820
x-xss-protection
0
expires
Sun, 28 Mar 2021 14:14:14 GMT
default+en.css
www.google.com/cse/static/element/8b2252448421acb3/
40 KB
9 KB
Stylesheet
General
Full URL
https://www.google.com/cse/static/element/8b2252448421acb3/default+en.css
Requested by
Host: ardacademy.org
URL: https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80b::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
40a20291f9b526cba58796a4bbd0256d5663313e02c9d5ab5a842476562b3108
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
style

Response headers

date
Sat, 28 Mar 2020 14:14:44 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Thu, 31 Oct 2019 16:49:36 GMT
server
sffe
age
37378
vary
Accept-Encoding
content-type
text/css
status
200
cache-control
public, max-age=31536000
accept-ranges
bytes
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length
9042
x-xss-protection
0
expires
Sun, 28 Mar 2021 14:14:44 GMT
default.css
www.google.com/cse/static/style/look/v3/
11 KB
3 KB
Stylesheet
General
Full URL
https://www.google.com/cse/static/style/look/v3/default.css
Requested by
Host: ardacademy.org
URL: https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80b::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
9ceaa25ec7654a66294c16e28989fbf1ecb9cebc9debe96ec597529465c7cd50
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
style

Response headers

date
Sun, 29 Mar 2020 00:14:42 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Thu, 21 Nov 2019 23:30:00 GMT
server
sffe
age
1380
vary
Accept-Encoding
content-type
text/css
status
200
cache-control
public, max-age=3000
accept-ranges
bytes
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length
2719
x-xss-protection
0
expires
Sun, 29 Mar 2020 01:04:42 GMT
logo.js
mpsnare.iesnare.com/script/
96 B
514 B
Script
General
Full URL
https://mpsnare.iesnare.com/script/logo.js
Requested by
Host: ardacademy.org
URL: https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.129.74.13 , United States, ASN395492 (IOVATION3, US),
Reverse DNS
mpsnare.iesnare.com
Software
nginx /
Resource Hash
db263c3392725557d609ae8445e2912ef2ba5bf79a7ba9831abd4b874556592d
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains

Request headers

Referer
https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

Date
Sun, 29 Mar 2020 00:37:42 GMT
Content-Encoding
gzip
Last-Modified
Tue, 06 May 2014 00:01:40 GMT
Server
nginx
Strict-Transport-Security
max-age=15552000; includeSubDomains
p3p
CP="NON DSP COR CURa"
Cache-Control
private
Transfer-Encoding
chunked
Connection
keep-alive
Content-Type
text/javascript; charset=utf-8
Expires
Mon, 29 Mar 2021 00:37:42 GMT
tags.js
content22.online.citi.com/fp/
49 KB
11 KB
Script
General
Full URL
https://content22.online.citi.com/fp/tags.js?org_id=89oebq5k&session_id=9646094ba7b58acb03dad3f75e50dcf29574f85b76dd9ada42ddaf7cafc1207c&allow_reprofile=1
Requested by
Host: ardacademy.org
URL: https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
91.235.134.21 , Netherlands, ASN30286 (THM, US),
Reverse DNS
Software
Apache /
Resource Hash
51c032378bf28554b291386f91a0887454f180d7a691fb6fab51ea18a9167293
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

Pragma
no-cache
Date
Sun, 29 Mar 2020 00:37:42 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Server
Apache
Strict-Transport-Security
max-age=31536000
P3P
CP=IVAa PSAa
Cache-Control
no-cache, no-store, must-revalidate
Transfer-Encoding
chunked
Connection
Keep-Alive, Keep-Alive
Content-Type
text/javascript;charset=UTF-8
Vary
Accept-Encoding
X-XSS-Protection
1; mode=block
Keep-Alive
timeout=2, max=100
Expires
Thu, 01 Jan 1970 00:00:00 GMT
embed.js
resources.digital-cloud-citi.medallia.com/wdcusciti/50/onsite/
2 KB
1 KB
Script
General
Full URL
https://resources.digital-cloud-citi.medallia.com/wdcusciti/50/onsite/embed.js
Requested by
Host: ardacademy.org
URL: https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.14.133 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
128b5eb2de7c92e9be2f566be1ce1a72763a9be9d4c7554f7ea493f57d7e39e9

Request headers

Referer
https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

x-amz-version-id
xdVzN.FTbUYeBK.pOoPjKVFQC00uq.2h
content-encoding
gzip
age
63
x-cache
HIT
status
200
date
Sun, 29 Mar 2020 00:37:42 GMT
content-length
675
x-amz-id-2
fOJ1mZjFp2hS/ZwKKGFTcz95l3HI3R05OFeJWMDAIdSfRuxGqjvErZhQIgf+1KZnuqP3PTMjHf0=
x-served-by
cache-fra19124-FRA
access-control-allow-origin
*
last-modified
Mon, 09 Mar 2020 13:11:50 GMT
server
AmazonS3
x-timer
S1585442263.844755,VS0,VE1
etag
"57e8540faebd2fcec4adaab077b5e4ec"
vary
Accept-Encoding
x-amz-request-id
6256F29EFCD5FA07
via
1.1 varnish
cache-control
max-age=0,must-revalidate
accept-ranges
bytes
content-type
application/javascript
x-cache-hits
1
/
googleads.g.doubleclick.net/pagead/viewthroughconversion/959299794/
2 KB
1 KB
Script
General
Full URL
https://googleads.g.doubleclick.net/pagead/viewthroughconversion/959299794/?random=1585247682996&cv=9&fst=1585247682996&num=1&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=768&u_w=1366&u_ah=768&u_aw=1366&u_cd=24&u_his=1&u_tz=-300&u_java=false&u_nplug=0&u_nmime=0&gtm=2od3i0&ig=0&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fonline.citi.com%2FUS%2Flogin.do&tiba=Online%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&hn=www.google.com&async=1&rfmt=3&fmt=4
Requested by
Host: ardacademy.org
URL: https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:816::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
e48bd2b6e52ab098b853e901115ddf24a6b2d4fe04e96a5666ac7467bcb11958
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

pragma
no-cache
date
Sun, 29 Mar 2020 00:37:42 GMT
content-encoding
gzip
x-content-type-options
nosniff
content-type
text/javascript; charset=UTF-8
server
cafe
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status
200
cache-control
no-cache, must-revalidate
content-disposition
attachment; filename="f.txt"
timing-allow-origin
*
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length
1060
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
googleads.g.doubleclick.net/pagead/viewthroughconversion/960621875/
2 KB
1 KB
Script
General
Full URL
https://googleads.g.doubleclick.net/pagead/viewthroughconversion/960621875/?random=1585247683006&cv=9&fst=1585247683006&num=1&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=768&u_w=1366&u_ah=768&u_aw=1366&u_cd=24&u_his=1&u_tz=-300&u_java=false&u_nplug=0&u_nmime=0&gtm=2od3i0&ig=0&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fonline.citi.com%2FUS%2Flogin.do&tiba=Online%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&hn=www.google.com&async=1&rfmt=3&fmt=4
Requested by
Host: ardacademy.org
URL: https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:816::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
6d7ad53250169ccd9281596f258514e23bc9a51c091132c6ee7cb7d3b52bc4c9
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

pragma
no-cache
date
Sun, 29 Mar 2020 00:37:42 GMT
content-encoding
gzip
x-content-type-options
nosniff
content-type
text/javascript; charset=UTF-8
server
cafe
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status
200
cache-control
no-cache, must-revalidate
content-disposition
attachment; filename="f.txt"
timing-allow-origin
*
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length
1061
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
googleads.g.doubleclick.net/pagead/viewthroughconversion/916451471/
2 KB
1 KB
Script
General
Full URL
https://googleads.g.doubleclick.net/pagead/viewthroughconversion/916451471/?random=1585247683010&cv=9&fst=1585247683010&num=1&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=768&u_w=1366&u_ah=768&u_aw=1366&u_cd=24&u_his=1&u_tz=-300&u_java=false&u_nplug=0&u_nmime=0&gtm=2od3i0&ig=0&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fonline.citi.com%2FUS%2Flogin.do&tiba=Online%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&hn=www.google.com&async=1&rfmt=3&fmt=4
Requested by
Host: ardacademy.org
URL: https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:816::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
975ae8ed1eb80709002033f37d9a76d4dfb7f1b680888ebd18bf9ec93ac39100
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

pragma
no-cache
date
Sun, 29 Mar 2020 00:37:42 GMT
content-encoding
gzip
x-content-type-options
nosniff
content-type
text/javascript; charset=UTF-8
server
cafe
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status
200
cache-control
no-cache, must-revalidate
content-disposition
attachment; filename="f.txt"
timing-allow-origin
*
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length
1061
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
googleads.g.doubleclick.net/pagead/viewthroughconversion/975701947/
2 KB
1 KB
Script
General
Full URL
https://googleads.g.doubleclick.net/pagead/viewthroughconversion/975701947/?random=1585247683013&cv=9&fst=1585247683013&num=1&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=768&u_w=1366&u_ah=768&u_aw=1366&u_cd=24&u_his=1&u_tz=-300&u_java=false&u_nplug=0&u_nmime=0&gtm=2od3i0&ig=0&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fonline.citi.com%2FUS%2Flogin.do&tiba=Online%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&hn=www.google.com&async=1&rfmt=3&fmt=4
Requested by
Host: ardacademy.org
URL: https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:816::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
6b21f7aaec509f321d98fb6fb80a90fcd674214d5eee801edfb543901970507e
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

pragma
no-cache
date
Sun, 29 Mar 2020 00:37:42 GMT
content-encoding
gzip
x-content-type-options
nosniff
content-type
text/javascript; charset=UTF-8
server
cafe
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status
200
cache-control
no-cache, must-revalidate
content-disposition
attachment; filename="f.txt"
timing-allow-origin
*
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length
1061
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
googleads.g.doubleclick.net/pagead/viewthroughconversion/770961656/
2 KB
1 KB
Script
General
Full URL
https://googleads.g.doubleclick.net/pagead/viewthroughconversion/770961656/?random=1585247683017&cv=9&fst=1585247683017&num=1&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=768&u_w=1366&u_ah=768&u_aw=1366&u_cd=24&u_his=1&u_tz=-300&u_java=false&u_nplug=0&u_nmime=0&gtm=2od3i0&ig=0&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fonline.citi.com%2FUS%2Flogin.do&tiba=Online%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&hn=www.google.com&async=1&rfmt=3&fmt=4
Requested by
Host: ardacademy.org
URL: https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:816::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
e4f8bbc199745205470fa339a93a6160feee3a02f395f0458faa1853e0ded450
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

pragma
no-cache
date
Sun, 29 Mar 2020 00:37:42 GMT
content-encoding
gzip
x-content-type-options
nosniff
content-type
text/javascript; charset=UTF-8
server
cafe
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status
200
cache-control
no-cache, must-revalidate
content-disposition
attachment; filename="f.txt"
timing-allow-origin
*
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length
1061
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
googleads.g.doubleclick.net/pagead/viewthroughconversion/819500023/
2 KB
1 KB
Script
General
Full URL
https://googleads.g.doubleclick.net/pagead/viewthroughconversion/819500023/?random=1585247683020&cv=9&fst=1585247683020&num=1&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=768&u_w=1366&u_ah=768&u_aw=1366&u_cd=24&u_his=1&u_tz=-300&u_java=false&u_nplug=0&u_nmime=0&gtm=2od3i0&ig=0&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fonline.citi.com%2FUS%2Flogin.do&tiba=Online%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&hn=www.google.com&async=1&rfmt=3&fmt=4
Requested by
Host: ardacademy.org
URL: https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:816::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
e881e62582a1f9dbcb66a45f54ef7483ab57129314dbc98b897fcceaa61a4357
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

pragma
no-cache
date
Sun, 29 Mar 2020 00:37:42 GMT
content-encoding
gzip
x-content-type-options
nosniff
content-type
text/javascript; charset=UTF-8
server
cafe
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status
200
cache-control
no-cache, must-revalidate
content-disposition
attachment; filename="f.txt"
timing-allow-origin
*
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length
1060
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
googleads.g.doubleclick.net/pagead/viewthroughconversion/763960929/
2 KB
1 KB
Script
General
Full URL
https://googleads.g.doubleclick.net/pagead/viewthroughconversion/763960929/?random=1585247683026&cv=9&fst=1585247683026&num=1&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=768&u_w=1366&u_ah=768&u_aw=1366&u_cd=24&u_his=1&u_tz=-300&u_java=false&u_nplug=0&u_nmime=0&gtm=2od3i0&ig=0&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fonline.citi.com%2FUS%2Flogin.do&tiba=Online%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&hn=www.google.com&async=1&rfmt=3&fmt=4
Requested by
Host: ardacademy.org
URL: https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:816::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
2f6d5d0b789697b08e7795901a5ce92029eb4e30a1f4e927f8e55be0fdcce242
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

pragma
no-cache
date
Sun, 29 Mar 2020 00:37:42 GMT
content-encoding
gzip
x-content-type-options
nosniff
content-type
text/javascript; charset=UTF-8
server
cafe
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status
200
cache-control
no-cache, must-revalidate
content-disposition
attachment; filename="f.txt"
timing-allow-origin
*
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length
1061
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
googleads.g.doubleclick.net/pagead/viewthroughconversion/959299794/
2 KB
1 KB
Script
General
Full URL
https://googleads.g.doubleclick.net/pagead/viewthroughconversion/959299794/?random=1585247683029&cv=9&fst=1585247683029&num=1&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=768&u_w=1366&u_ah=768&u_aw=1366&u_cd=24&u_his=1&u_tz=-300&u_java=false&u_nplug=0&u_nmime=0&gtm=2od3i0&ig=0&data=event%3Dconversion&frm=0&url=https%3A%2F%2Fonline.citi.com%2FUS%2Flogin.do&tiba=Online%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&hn=www.google.com&async=1&rfmt=3&fmt=4
Requested by
Host: ardacademy.org
URL: https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:816::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
3340c28399b6004486ff6093d0426059c48f4c569c7a5d0061f6d8f3d8325ddd
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

pragma
no-cache
date
Sun, 29 Mar 2020 00:37:42 GMT
content-encoding
gzip
x-content-type-options
nosniff
content-type
text/javascript; charset=UTF-8
server
cafe
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status
200
cache-control
no-cache, must-revalidate
content-disposition
attachment; filename="f.txt"
timing-allow-origin
*
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length
1058
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
googleads.g.doubleclick.net/pagead/viewthroughconversion/960621875/
2 KB
1 KB
Script
General
Full URL
https://googleads.g.doubleclick.net/pagead/viewthroughconversion/960621875/?random=1585247683033&cv=9&fst=1585247683033&num=1&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=768&u_w=1366&u_ah=768&u_aw=1366&u_cd=24&u_his=1&u_tz=-300&u_java=false&u_nplug=0&u_nmime=0&gtm=2od3i0&ig=0&data=event%3Dconversion&frm=0&url=https%3A%2F%2Fonline.citi.com%2FUS%2Flogin.do&tiba=Online%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&hn=www.google.com&async=1&rfmt=3&fmt=4
Requested by
Host: ardacademy.org
URL: https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:816::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
fcc69810a68fed3e656a71993629e6ab25b858a7354556ec487644d4cb360aa9
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

pragma
no-cache
date
Sun, 29 Mar 2020 00:37:42 GMT
content-encoding
gzip
x-content-type-options
nosniff
content-type
text/javascript; charset=UTF-8
server
cafe
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status
200
cache-control
no-cache, must-revalidate
content-disposition
attachment; filename="f.txt"
timing-allow-origin
*
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length
1058
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
googleads.g.doubleclick.net/pagead/viewthroughconversion/916451471/
2 KB
1 KB
Script
General
Full URL
https://googleads.g.doubleclick.net/pagead/viewthroughconversion/916451471/?random=1585247683036&cv=9&fst=1585247683036&num=1&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&eid=376635471&u_h=768&u_w=1366&u_ah=768&u_aw=1366&u_cd=24&u_his=1&u_tz=-300&u_java=false&u_nplug=0&u_nmime=0&gtm=2od3i0&ig=0&data=event%3Dconversion&frm=0&url=https%3A%2F%2Fonline.citi.com%2FUS%2Flogin.do&tiba=Online%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&hn=www.google.com&async=1&rfmt=3&fmt=4
Requested by
Host: ardacademy.org
URL: https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:816::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
358e7e9829fe41f8f61a8531fbd02b600fa77c8ae638f511eccdf0fb8475b4ac
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

pragma
no-cache
date
Sun, 29 Mar 2020 00:37:42 GMT
content-encoding
gzip
x-content-type-options
nosniff
content-type
text/javascript; charset=UTF-8
server
cafe
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status
200
cache-control
no-cache, must-revalidate
content-disposition
attachment; filename="f.txt"
timing-allow-origin
*
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length
1071
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
googleads.g.doubleclick.net/pagead/viewthroughconversion/975701947/
2 KB
1 KB
Script
General
Full URL
https://googleads.g.doubleclick.net/pagead/viewthroughconversion/975701947/?random=1585247683049&cv=9&fst=1585247683049&num=1&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&eid=376635471&u_h=768&u_w=1366&u_ah=768&u_aw=1366&u_cd=24&u_his=1&u_tz=-300&u_java=false&u_nplug=0&u_nmime=0&gtm=2od3i0&ig=0&data=event%3Dconversion&frm=0&url=https%3A%2F%2Fonline.citi.com%2FUS%2Flogin.do&tiba=Online%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&hn=www.google.com&async=1&rfmt=3&fmt=4
Requested by
Host: ardacademy.org
URL: https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:816::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
9c44fb0565ffc7d415e1005124b6ab06f8f5af1ea0078a51c5b03fcc4ec882f0
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

pragma
no-cache
date
Sun, 29 Mar 2020 00:37:42 GMT
content-encoding
gzip
x-content-type-options
nosniff
content-type
text/javascript; charset=UTF-8
server
cafe
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status
200
cache-control
no-cache, must-revalidate
content-disposition
attachment; filename="f.txt"
timing-allow-origin
*
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length
1070
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
googleads.g.doubleclick.net/pagead/viewthroughconversion/770961656/
2 KB
1 KB
Script
General
Full URL
https://googleads.g.doubleclick.net/pagead/viewthroughconversion/770961656/?random=1585247683063&cv=9&fst=1585247683063&num=1&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&eid=376635471&u_h=768&u_w=1366&u_ah=768&u_aw=1366&u_cd=24&u_his=1&u_tz=-300&u_java=false&u_nplug=0&u_nmime=0&gtm=2od3i0&ig=0&data=event%3Dconversion&frm=0&url=https%3A%2F%2Fonline.citi.com%2FUS%2Flogin.do&tiba=Online%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&hn=www.google.com&async=1&rfmt=3&fmt=4
Requested by
Host: ardacademy.org
URL: https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:816::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
d51830559f7549f10986694223043bdbac38b03e6130ec51434e154dd3702cde
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

pragma
no-cache
date
Sun, 29 Mar 2020 00:37:42 GMT
content-encoding
gzip
x-content-type-options
nosniff
content-type
text/javascript; charset=UTF-8
server
cafe
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status
200
cache-control
no-cache, must-revalidate
content-disposition
attachment; filename="f.txt"
timing-allow-origin
*
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length
1071
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
googleads.g.doubleclick.net/pagead/viewthroughconversion/819500023/
2 KB
1 KB
Script
General
Full URL
https://googleads.g.doubleclick.net/pagead/viewthroughconversion/819500023/?random=1585247683075&cv=9&fst=1585247683075&num=1&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&eid=376635471&u_h=768&u_w=1366&u_ah=768&u_aw=1366&u_cd=24&u_his=1&u_tz=-300&u_java=false&u_nplug=0&u_nmime=0&gtm=2od3i0&ig=0&data=event%3Dconversion&frm=0&url=https%3A%2F%2Fonline.citi.com%2FUS%2Flogin.do&tiba=Online%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&hn=www.google.com&async=1&rfmt=3&fmt=4
Requested by
Host: ardacademy.org
URL: https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:816::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
06974cc8c0ce8992ec94dd445dba1277b057effa321153aea76e1b160255a84c
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

pragma
no-cache
date
Sun, 29 Mar 2020 00:37:42 GMT
content-encoding
gzip
x-content-type-options
nosniff
content-type
text/javascript; charset=UTF-8
server
cafe
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status
200
cache-control
no-cache, must-revalidate
content-disposition
attachment; filename="f.txt"
timing-allow-origin
*
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length
1069
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
googleads.g.doubleclick.net/pagead/viewthroughconversion/763960929/
2 KB
1 KB
Script
General
Full URL
https://googleads.g.doubleclick.net/pagead/viewthroughconversion/763960929/?random=1585247683083&cv=9&fst=1585247683083&num=1&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&eid=376635471&u_h=768&u_w=1366&u_ah=768&u_aw=1366&u_cd=24&u_his=1&u_tz=-300&u_java=false&u_nplug=0&u_nmime=0&gtm=2od3i0&ig=0&data=event%3Dconversion&frm=0&url=https%3A%2F%2Fonline.citi.com%2FUS%2Flogin.do&tiba=Online%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&hn=www.google.com&async=1&rfmt=3&fmt=4
Requested by
Host: ardacademy.org
URL: https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:816::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
4ac3cdf047e3c924611a51a52368039e2084e57d1a6c7a8c1313bc9f7c8effe3
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

pragma
no-cache
date
Sun, 29 Mar 2020 00:37:42 GMT
content-encoding
gzip
x-content-type-options
nosniff
content-type
text/javascript; charset=UTF-8
server
cafe
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status
200
cache-control
no-cache, must-revalidate
content-disposition
attachment; filename="f.txt"
timing-allow-origin
*
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length
1070
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
463166.gif
di.rlcdn.com/
0
40 B
Image
General
Full URL
https://di.rlcdn.com/463166.gif?partner_uid=18d2cc3c-4653-4936-a204-8147a1c1bd20
Requested by
Host: ardacademy.org
URL: https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
35.190.72.21 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
21.72.190.35.bc.googleusercontent.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

status
204
date
Sun, 29 Mar 2020 00:37:43 GMT
via
1.1 google
alt-svc
clear
bcsid.js
online.citi.com/passivebio/
947 B
977 B
Script
General
Full URL
https://online.citi.com/passivebio/bcsid.js
Requested by
Host: ardacademy.org
URL: https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.109.92.187 , Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a104-109-92-187.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
7d481eb36581746fd3662c7c452856b695df90cdce24664c48f565aa119c8b16
Security Headers
Name Value
Content-Security-Policy frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
Strict-Transport-Security max-age=300
X-Content-Security-Policy frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

Request headers

Referer
https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

strict-transport-security
max-age=300
content-encoding
gzip
x-content-security-policy
frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
last-modified
Tue, 30 Oct 2018 06:18:02 GMT
x-akamai-citisite
GTDC
x-webkit-csp
frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
date
Sun, 29 Mar 2020 00:37:42 GMT
vary
Accept-Encoding
p3p
policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
status
200
cache-control
max-age=21600
content-security-policy
frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
content-type
application/x-javascript
content-length
427
expires
Sun, 29 Mar 2020 06:37:42 GMT
BiocatchATO.js
online.citi.com/passivebio/
338 KB
88 KB
Script
General
Full URL
https://online.citi.com/passivebio/BiocatchATO.js
Requested by
Host: ardacademy.org
URL: https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.109.92.187 , Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a104-109-92-187.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
f9baacb75f3cb0e0911a506dbdab685aab38537ac52edda6f9b65bc5f0ea306d
Security Headers
Name Value
Content-Security-Policy frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
Strict-Transport-Security max-age=300
X-Content-Security-Policy frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

Request headers

Referer
https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

strict-transport-security
max-age=300
content-encoding
gzip
x-content-security-policy
frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
last-modified
Tue, 30 Oct 2018 06:18:02 GMT
x-akamai-citisite
GTDC
x-webkit-csp
frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
date
Sun, 29 Mar 2020 00:37:42 GMT
vary
Accept-Encoding
p3p
policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
status
200
cache-control
max-age=21600
content-security-policy
frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
content-type
application/x-javascript
content-length
89195
expires
Sun, 29 Mar 2020 06:37:42 GMT
cbol-smartSearch.css
online.citi.com/NCCS/smartSearch/css/
8 KB
1 KB
Stylesheet
General
Full URL
https://online.citi.com/NCCS/smartSearch/css/cbol-smartSearch.css
Requested by
Host: ardacademy.org
URL: https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.109.92.187 , Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a104-109-92-187.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
6d3001c9deac8cb1f88ea5254105f8d678de5532f1998a24eab1b59906eaf86b
Security Headers
Name Value
Content-Security-Policy frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
Strict-Transport-Security max-age=300
X-Content-Security-Policy frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

Request headers

Referer
https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
style

Response headers

strict-transport-security
max-age=300
content-encoding
gzip
x-content-security-policy
frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
last-modified
Tue, 13 Feb 2018 16:10:30 GMT
x-akamai-citisite
GTDC
x-webkit-csp
frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
date
Sun, 29 Mar 2020 00:37:42 GMT
vary
Accept-Encoding
p3p
policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
status
200
cache-control
max-age=21600
content-security-policy
frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
content-type
text/css
content-length
899
expires
Sun, 29 Mar 2020 06:37:42 GMT
search-white.png
online.citi.com/GFC/branding/img/
429 B
859 B
Image
General
Full URL
https://online.citi.com/GFC/branding/img/search-white.png
Requested by
Host: ardacademy.org
URL: https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.109.92.187 , Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a104-109-92-187.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
e2812b1e3529e5f39e3b0586e82c7ad0dfc3fc61cfa0107edfac16483d0547d7
Security Headers
Name Value
Content-Security-Policy frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
Strict-Transport-Security max-age=300
X-Content-Security-Policy frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

Request headers

Referer
https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

strict-transport-security
max-age=300
last-modified
Wed, 14 Jun 2017 18:29:07 GMT
x-akamai-citisite
GTDC
date
Sun, 29 Mar 2020 00:37:43 GMT
p3p
policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
status
200
x-webkit-csp
frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
content-security-policy
frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
accept-ranges
bytes
content-type
image/png
content-length
429
x-content-security-policy
frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
citiHomePage.min.js
online.citi.com/loginpage/scripts/
14 KB
5 KB
Script
General
Full URL
https://online.citi.com/loginpage/scripts/citiHomePage.min.js
Requested by
Host: ardacademy.org
URL: https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.109.92.187 , Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a104-109-92-187.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
d118102507b97407ebf1533cc98ccd2e9d244524b456fd9c2b469b553396238a
Security Headers
Name Value
Content-Security-Policy frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
Strict-Transport-Security max-age=300
X-Content-Security-Policy frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

Request headers

Referer
https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

strict-transport-security
max-age=300
content-encoding
gzip
x-content-security-policy
frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
last-modified
Mon, 20 Jan 2020 19:26:26 GMT
x-akamai-citisite
GTDC
x-webkit-csp
frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
date
Sun, 29 Mar 2020 00:37:43 GMT
vary
Accept-Encoding
p3p
policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
status
200
cache-control
max-age=21600
content-security-policy
frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
content-type
application/x-javascript
content-length
4228
expires
Sun, 29 Mar 2020 06:37:43 GMT
rsa.js
online.citi.com/CBOL/sec/debcaract/js/
36 KB
11 KB
Script
General
Full URL
https://online.citi.com/CBOL/sec/debcaract/js/rsa.js
Requested by
Host: ardacademy.org
URL: https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.109.92.187 , Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a104-109-92-187.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
793c2f3d02d0bc3ad8a2cdc901b2134159b66245e951ac258fee1ac8b2709f44
Security Headers
Name Value
Content-Security-Policy frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
Strict-Transport-Security max-age=300
X-Content-Security-Policy frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

Request headers

Referer
https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

strict-transport-security
max-age=300
content-encoding
gzip
x-content-security-policy
frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
last-modified
Tue, 12 Sep 2017 17:12:06 GMT
x-akamai-citisite
GTDC
x-webkit-csp
frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
date
Sun, 29 Mar 2020 00:37:43 GMT
vary
Accept-Encoding
p3p
policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
status
200
cache-control
max-age=21600
content-security-policy
frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
content-type
application/x-javascript
content-length
10616
expires
Sun, 29 Mar 2020 06:37:43 GMT
peworkflow.min.js
ardacademy.org/personalization/
0
0
Script
General
Full URL
https://ardacademy.org/personalization/peworkflow.min.js
Requested by
Host: ardacademy.org
URL: https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
35.229.76.23 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
23.76.229.35.bc.googleusercontent.com
Software
nginx /
Resource Hash

Request headers

Referer
https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

status
404
date
Sun, 29 Mar 2020 00:37:43 GMT
content-encoding
br
server
nginx
vary
Accept-Encoding, Accept-Encoding
content-type
text/html
HP3379_H.jpg
online.citi.com/JRS/banners/hero_background/
201 KB
202 KB
Image
General
Full URL
https://online.citi.com/JRS/banners/hero_background/HP3379_H.jpg
Requested by
Host: ardacademy.org
URL: https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.109.92.187 , Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a104-109-92-187.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
e05565885e234eeb2f32d5dabdf0a586c5dab3badbba206b1c27e1b34a75148b
Security Headers
Name Value
Content-Security-Policy frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
Strict-Transport-Security max-age=300
X-Content-Security-Policy frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

Request headers

Referer
https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

strict-transport-security
max-age=300
last-modified
Wed, 12 Dec 2018 15:40:28 GMT
x-akamai-citisite
SWDC
date
Sun, 29 Mar 2020 00:37:43 GMT
p3p
policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
status
200
x-webkit-csp
frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
content-security-policy
frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
accept-ranges
bytes
content-type
image/jpeg
content-length
205627
x-content-security-policy
frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
HP5821_M.jpg
online.citi.com/JRS/banners/modules/
94 KB
95 KB
Image
General
Full URL
https://online.citi.com/JRS/banners/modules/HP5821_M.jpg
Requested by
Host: ardacademy.org
URL: https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.109.92.187 , Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a104-109-92-187.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
7adf69580aead1321588b6f81a92518ac9724f3da846970c349fa91630145bfc
Security Headers
Name Value
Content-Security-Policy frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
Strict-Transport-Security max-age=300
X-Content-Security-Policy frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

Request headers

Referer
https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

strict-transport-security
max-age=300
last-modified
Thu, 26 Sep 2019 14:15:43 GMT
x-akamai-citisite
SWDC
date
Sun, 29 Mar 2020 00:37:43 GMT
p3p
policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
status
200
x-webkit-csp
frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
content-security-policy
frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
accept-ranges
bytes
content-type
image/jpeg
content-length
96259
x-content-security-policy
frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
M1-M7_Rewards.jpg
online.citi.com/JRS/banners/modules/
99 KB
100 KB
Image
General
Full URL
https://online.citi.com/JRS/banners/modules/M1-M7_Rewards.jpg
Requested by
Host: ardacademy.org
URL: https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.109.92.187 , Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a104-109-92-187.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
b7264725078e153ab3a4af37c52374b3a5d46b8fb5fc7b5f8af2e773364eef93
Security Headers
Name Value
Content-Security-Policy frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
Strict-Transport-Security max-age=300
X-Content-Security-Policy frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

Request headers

Referer
https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

strict-transport-security
max-age=300
last-modified
Thu, 21 Nov 2019 18:59:04 GMT
x-akamai-citisite
SWDC
date
Sun, 29 Mar 2020 00:37:43 GMT
p3p
policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
status
200
x-webkit-csp
frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
content-security-policy
frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
accept-ranges
bytes
content-type
image/jpeg
content-length
101509
x-content-security-policy
frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
M1-M7_Citi-card-cluster-4.jpg
online.citi.com/JRS/banners/modules/
102 KB
102 KB
Image
General
Full URL
https://online.citi.com/JRS/banners/modules/M1-M7_Citi-card-cluster-4.jpg
Requested by
Host: ardacademy.org
URL: https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.109.92.187 , Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a104-109-92-187.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
fb42046c6feabb3126634752069391d76d8ded5770a936eb1ce0cdd6aa7358b9
Security Headers
Name Value
Content-Security-Policy frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
Strict-Transport-Security max-age=300
X-Content-Security-Policy frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

Request headers

Referer
https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

strict-transport-security
max-age=300
last-modified
Thu, 21 Nov 2019 18:59:03 GMT
x-akamai-citisite
SWDC
date
Sun, 29 Mar 2020 00:37:43 GMT
p3p
policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
status
200
x-webkit-csp
frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
content-security-policy
frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
accept-ranges
bytes
content-type
image/jpeg
content-length
104105
x-content-security-policy
frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
HP5903_M.jpg
online.citi.com/JRS/banners/modules/
87 KB
88 KB
Image
General
Full URL
https://online.citi.com/JRS/banners/modules/HP5903_M.jpg
Requested by
Host: ardacademy.org
URL: https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.109.92.187 , Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a104-109-92-187.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
2c19e11d4471da9bc727265662f6668dc3f142b0ae6a91d5ae908d6a6b2bc8ee
Security Headers
Name Value
Content-Security-Policy frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
Strict-Transport-Security max-age=300
X-Content-Security-Policy frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

Request headers

Referer
https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

strict-transport-security
max-age=300
last-modified
Fri, 11 Oct 2019 18:13:10 GMT
x-akamai-citisite
SWDC
date
Sun, 29 Mar 2020 00:37:43 GMT
p3p
policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
status
200
x-webkit-csp
frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
content-security-policy
frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
accept-ranges
bytes
content-type
image/jpeg
content-length
89188
x-content-security-policy
frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
00165_NoahSyndergaard.jpg
online.citi.com/JRS/banners/modules/
90 KB
91 KB
Image
General
Full URL
https://online.citi.com/JRS/banners/modules/00165_NoahSyndergaard.jpg
Requested by
Host: ardacademy.org
URL: https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.109.92.187 , Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a104-109-92-187.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
a6cd789bddb9565dd498ea70472bd4c85eef40c5f6a0572b5f870ab93c8f3032
Security Headers
Name Value
Content-Security-Policy frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
Strict-Transport-Security max-age=300
X-Content-Security-Policy frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

Request headers

Referer
https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

strict-transport-security
max-age=300
last-modified
Mon, 17 Feb 2020 23:07:46 GMT
x-akamai-citisite
SWDC
date
Sun, 29 Mar 2020 00:37:43 GMT
p3p
policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
status
200
x-webkit-csp
frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
content-security-policy
frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
accept-ranges
bytes
content-type
image/jpeg
content-length
92151
x-content-security-policy
frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
2019CertifiedMobileApp.png
online.citi.com/JRS/images/
28 KB
29 KB
Image
General
Full URL
https://online.citi.com/JRS/images/2019CertifiedMobileApp.png
Requested by
Host: ardacademy.org
URL: https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.109.92.187 , Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a104-109-92-187.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
771c92ecc9167287111bc793f6392bfb0dc8a51a830b497f7591e6d3493fc1fc
Security Headers
Name Value
Content-Security-Policy frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
Strict-Transport-Security max-age=300
X-Content-Security-Policy frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

Request headers

Referer
https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

strict-transport-security
max-age=300
last-modified
Tue, 05 Mar 2019 18:17:00 GMT
x-akamai-citisite
GTDC
date
Sun, 29 Mar 2020 00:37:43 GMT
p3p
policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
status
200
x-webkit-csp
frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
content-security-policy
frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
accept-ranges
bytes
content-type
image/png
content-length
29171
x-content-security-policy
frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
adadvisor.gif
px0.pbbl.co/
Redirect Chain
  • https://px0.pbbl.co/ns/__p2.gif?ppid=&chk=true&brid=&brcid=&email=&orderId=&orderValue=&productId=&offerCode=&label=&pageUrl=https%3A%2F%2Fardacademy.org%2Fwp-content%2Fcc%2F%3Feml%3Djashye%40mail....
  • https://aa.agkn.com/adscores/g.pixel?sid=9212282598&_ppid=59e19afc-941e-4859-ade5-7f6803468ced&_segid=99&iid=1b23fea0-65cc-4a54-86d8-e1a807ef5e28
  • https://px0.pbbl.co/adadvisor.gif?segment=000&_ppid=59e19afc-941e-4859-ade5-7f6803468ced&_segid=99&_zip=&hk=&iid=1b23fea0-65cc-4a54-86d8-e1a807ef5e28&mt=&bd=
42 B
135 B
Image
General
Full URL
https://px0.pbbl.co/adadvisor.gif?segment=000&_ppid=59e19afc-941e-4859-ade5-7f6803468ced&_segid=99&_zip=&hk=&iid=1b23fea0-65cc-4a54-86d8-e1a807ef5e28&mt=&bd=
Requested by
Host: ardacademy.org
URL: https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:824::2013 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Frontend /
Resource Hash
99c2917ee5b2a01459a923bdd1c676f15ee73b62b87f696e6735312d26f51e12
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1

Request headers

Referer
https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma
no-cache
date
Sun, 29 Mar 2020 00:37:43 GMT
x-content-type-options
nosniff
server
Google Frontend
content-type
image/gif
status
200
x-cloud-trace-context
33e1927dd0224bec8546ad0d218f55df
cache-control
must-revalidate, no-cache, no-store
content-length
42
x-xss-protection
1
expires
0

Redirect headers

pragma
no-cache
date
Sun, 29 Mar 2020 00:37:43 GMT
server
AAWebServer
location
https://px0.pbbl.co/adadvisor.gif?segment=000&_ppid=59e19afc-941e-4859-ade5-7f6803468ced&_segid=99&_zip=&hk=&iid=1b23fea0-65cc-4a54-86d8-e1a807ef5e28&mt=&bd=
p3p
policyref="http://www.agkn.com/p3p/p3p.xml",CP="NOI NID"
status
302
cache-control
no-cache, no-store, must-revalidate
content-length
0
expires
0
oo_engine.min.js
ardacademy.org/GFC/branding/olab/js/
0
0
Script
General
Full URL
https://ardacademy.org/GFC/branding/olab/js/oo_engine.min.js
Requested by
Host: ardacademy.org
URL: https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
35.229.76.23 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
23.76.229.35.bc.googleusercontent.com
Software
nginx /
Resource Hash

Request headers

Referer
https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

status
404
date
Sun, 29 Mar 2020 00:37:43 GMT
content-encoding
br
server
nginx
vary
Accept-Encoding, Accept-Encoding
content-type
text/html
ddl.min.js
ardacademy.org/CBOL/common/ui/ddl/theme/latest/scripts/
0
0
Script
General
Full URL
https://ardacademy.org/CBOL/common/ui/ddl/theme/latest/scripts/ddl.min.js
Requested by
Host: ardacademy.org
URL: https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
35.229.76.23 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
23.76.229.35.bc.googleusercontent.com
Software
nginx /
Resource Hash

Request headers

Referer
https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

status
404
date
Sun, 29 Mar 2020 00:37:43 GMT
content-encoding
br
server
nginx
vary
Accept-Encoding, Accept-Encoding
content-type
text/html
main.js
ardacademy.org/GFC/branding/responsivebranding/js/
0
0
Script
General
Full URL
https://ardacademy.org/GFC/branding/responsivebranding/js/main.js
Requested by
Host: ardacademy.org
URL: https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
35.229.76.23 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
23.76.229.35.bc.googleusercontent.com
Software
nginx /
Resource Hash

Request headers

Referer
https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

status
404
date
Sun, 29 Mar 2020 00:37:43 GMT
content-encoding
br
server
nginx
vary
Accept-Encoding, Accept-Encoding
content-type
text/html
citilive-search.js
ardacademy.org/JEA/CitiSearch/nexus-platform/js/
0
0
Script
General
Full URL
https://ardacademy.org/JEA/CitiSearch/nexus-platform/js/citilive-search.js
Requested by
Host: ardacademy.org
URL: https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
35.229.76.23 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
23.76.229.35.bc.googleusercontent.com
Software
nginx /
Resource Hash

Request headers

Referer
https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

status
404
date
Sun, 29 Mar 2020 00:37:43 GMT
content-encoding
br
server
nginx
vary
Accept-Encoding, Accept-Encoding
content-type
text/html
cbol-smartSearch-inject.js
ardacademy.org/NCCS/smartSearch/js/
0
0
Script
General
Full URL
https://ardacademy.org/NCCS/smartSearch/js/cbol-smartSearch-inject.js
Requested by
Host: ardacademy.org
URL: https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
35.229.76.23 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
23.76.229.35.bc.googleusercontent.com
Software
nginx /
Resource Hash

Request headers

Referer
https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

status
404
date
Sun, 29 Mar 2020 00:37:43 GMT
content-encoding
br
server
nginx
vary
Accept-Encoding, Accept-Encoding
content-type
text/html
TMXProfiling.js
ardacademy.org/TMX/
0
0
Script
General
Full URL
https://ardacademy.org/TMX/TMXProfiling.js
Requested by
Host: ardacademy.org
URL: https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
35.229.76.23 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
23.76.229.35.bc.googleusercontent.com
Software
nginx /
Resource Hash

Request headers

Referer
https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

status
404
date
Sun, 29 Mar 2020 00:37:43 GMT
content-encoding
br
server
nginx
vary
Accept-Encoding, Accept-Encoding
content-type
text/html
siteseal2p.async.js
cyseal.cyveillance.com/SiteSeal/
685 B
1004 B
Script
General
Full URL
https://cyseal.cyveillance.com/SiteSeal/siteseal2p.async.js
Requested by
Host: ardacademy.org
URL: https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.212.137.125 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-3-212-137-125.compute-1.amazonaws.com
Software
Apache/2.4.6 (Red Hat Enterprise Linux) OpenSSL/1.0.1e-fips mod_jk/1.2.40 /
Resource Hash
8cad2492e705a54e5c4a634509b1d6c836dfb5bd179c2e58063653cc8635d6df

Request headers

Referer
https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

Date
Sun, 29 Mar 2020 00:37:43 GMT
Last-Modified
Fri, 30 Jun 2017 16:15:48 GMT
Server
Apache/2.4.6 (Red Hat Enterprise Linux) OpenSSL/1.0.1e-fips mod_jk/1.2.40
ETag
W/"685-1498839348000"
Content-Type
application/javascript
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
685
cobrowse_overlay.css
online.citi.com/GPS/portal/css/
7 KB
2 KB
Stylesheet
General
Full URL
https://online.citi.com/GPS/portal/css/cobrowse_overlay.css
Requested by
Host: ardacademy.org
URL: https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.109.92.187 , Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a104-109-92-187.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
a9623118fb6ec3944d1312cd0d492c3f32455e89bc1e01eafa67628a309d9c60
Security Headers
Name Value
Content-Security-Policy frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
Strict-Transport-Security max-age=300
X-Content-Security-Policy frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

Request headers

Referer
https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
style

Response headers

strict-transport-security
max-age=300
content-encoding
gzip
x-content-security-policy
frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
last-modified
Tue, 13 Aug 2019 07:17:14 GMT
x-akamai-citisite
SWDC
x-webkit-csp
frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
date
Sun, 29 Mar 2020 00:37:43 GMT
vary
Accept-Encoding
p3p
policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
status
200
cache-control
max-age=21600
content-security-policy
frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
content-type
text/css
content-length
1597
expires
Sun, 29 Mar 2020 06:37:43 GMT
citilive-search-library.js
online.citi.com/JEA/CitiSearch/nexus-platform/js/
179 KB
61 KB
Script
General
Full URL
https://online.citi.com/JEA/CitiSearch/nexus-platform/js/citilive-search-library.js
Requested by
Host: ardacademy.org
URL: https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.109.92.187 , Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a104-109-92-187.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
d57c8034f9c12aa3ce626c9ed1d61a4bb0941c3ef320bb59346f20496fb0096a
Security Headers
Name Value
Content-Security-Policy frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
Strict-Transport-Security max-age=300
X-Content-Security-Policy frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

Request headers

Referer
https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

strict-transport-security
max-age=300
content-encoding
gzip
x-content-security-policy
frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
last-modified
Tue, 12 Sep 2017 16:59:12 GMT
x-akamai-citisite
SWDC
x-webkit-csp
frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
date
Sun, 29 Mar 2020 00:37:43 GMT
vary
Accept-Encoding
p3p
policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
status
200
cache-control
max-age=21600
content-security-policy
frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
content-type
application/x-javascript
content-length
61658
expires
Sun, 29 Mar 2020 06:37:43 GMT
citilive-search-service.js
online.citi.com/JEA/CitiSearch/nexus-platform/js/
9 KB
3 KB
Script
General
Full URL
https://online.citi.com/JEA/CitiSearch/nexus-platform/js/citilive-search-service.js
Requested by
Host: ardacademy.org
URL: https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.109.92.187 , Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a104-109-92-187.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
eec5cc477e7cb4f1eee1f26dce3eb411a63716d89a9b659c7d5559571c837ccb
Security Headers
Name Value
Content-Security-Policy frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
Strict-Transport-Security max-age=300
X-Content-Security-Policy frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

Request headers

Referer
https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

strict-transport-security
max-age=300
content-encoding
gzip
x-content-security-policy
frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
last-modified
Tue, 11 Sep 2018 07:31:14 GMT
x-akamai-citisite
SWDC
x-webkit-csp
frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
date
Sun, 29 Mar 2020 00:37:43 GMT
vary
Accept-Encoding
p3p
policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
status
200
cache-control
max-age=21600
content-security-policy
frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
content-type
application/x-javascript
content-length
2415
expires
Sun, 29 Mar 2020 06:37:43 GMT
citi-search-tmpl.js
online.citi.com/JEA/CitiSearch/nexus-platform/js/
18 KB
6 KB
Script
General
Full URL
https://online.citi.com/JEA/CitiSearch/nexus-platform/js/citi-search-tmpl.js
Requested by
Host: ardacademy.org
URL: https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.109.92.187 , Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a104-109-92-187.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
61e114badfc7677a5ed175cf71afd46968ef8262cd4e5ec64ba0c743daae8e11
Security Headers
Name Value
Content-Security-Policy frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
Strict-Transport-Security max-age=300
X-Content-Security-Policy frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

Request headers

Referer
https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

strict-transport-security
max-age=300
content-encoding
gzip
x-content-security-policy
frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
last-modified
Thu, 11 Jul 2019 10:22:32 GMT
x-akamai-citisite
GTDC
x-webkit-csp
frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
date
Sun, 29 Mar 2020 00:37:43 GMT
vary
Accept-Encoding
p3p
policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
status
200
cache-control
max-age=21600
content-security-policy
frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
content-type
application/x-javascript
content-length
5146
expires
Sun, 29 Mar 2020 06:37:43 GMT
citilive-search-controller.js
online.citi.com/JEA/CitiSearch/nexus-platform/js/
112 KB
23 KB
Script
General
Full URL
https://online.citi.com/JEA/CitiSearch/nexus-platform/js/citilive-search-controller.js
Requested by
Host: ardacademy.org
URL: https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.109.92.187 , Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a104-109-92-187.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
99dd8270560893cf9937d476c3fd0cc09b406ee608f67cd568f8fe544aef6fce
Security Headers
Name Value
Content-Security-Policy frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
Strict-Transport-Security max-age=300
X-Content-Security-Policy frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

Request headers

Referer
https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

strict-transport-security
max-age=300
content-encoding
gzip
x-content-security-policy
frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
last-modified
Mon, 20 Jan 2020 19:26:26 GMT
x-akamai-citisite
GTDC
x-webkit-csp
frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
date
Sun, 29 Mar 2020 00:37:43 GMT
vary
Accept-Encoding
p3p
policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
status
200
cache-control
max-age=21600
content-security-policy
frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
content-type
application/x-javascript
content-length
22588
expires
Sun, 29 Mar 2020 06:37:43 GMT
citi.action
www.citi.com/credit-cards/rfuidmatch/
Redirect Chain
  • https://s.rfihub.com/uidm?_o=17169175&_u=18d2cc3c-4653-4936-a204-8147a1c1bd20&_sm=:R22534S@A3RIZZC24944S@A3RIZZC2232L2@A3RIZZS2233L2@A3RIZZS28259S1@A3RIZZS28266S1@A3RIZZS28267S1@A3RIZZS28227S1@A3RI...
  • https://www.citi.com/credit-cards/rfuidmatch/citi.action?XP_UID=SY-00GfVAAVulEvE=749
0
904 B
Image
General
Full URL
https://www.citi.com/credit-cards/rfuidmatch/citi.action?XP_UID=SY-00GfVAAVulEvE=749
Requested by
Host: ardacademy.org
URL: https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.67.129.14 , Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a23-67-129-14.deploy.static.akamaitechnologies.com
Software
/ Servlet/3.0
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Sun, 29 Mar 2020 00:37:43 GMT
X-Akamai-CITISITE
SWDC
P3P
policyref="/w3c/p3p.xml"\,CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
X-Powered-By
Servlet/3.0
Content-Language
en-US
Access-Control-Allow-Origin
https://citimobile.citibankonline.com
Expires
Thu, 01 Dec 1994 16:00:00 GMT
Cache-Control
no-cache="set-cookie, set-cookie2"
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
text/html
Content-Length
0
X-UA-Compatible
IE=edge, IE=edge

Redirect headers

Location
https://www.citi.com/credit-cards/rfuidmatch/citi.action?XP_UID=SY-00GfVAAVulEvE=749
Cache-Control
no-cache
Server
Jetty(9.0.6.v20130930)
Content-Length
0
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
generic1583759509314.js
resources.digital-cloud-citi.medallia.com/wdcusciti/50/onsite/
292 KB
56 KB
Script
General
Full URL
https://resources.digital-cloud-citi.medallia.com/wdcusciti/50/onsite/generic1583759509314.js
Requested by
Host: ardacademy.org
URL: https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.14.133 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
495c2b78f2deeec56065c5078a56deb4b4b6601773c98224cbe8517d0545adb2

Request headers

Referer
https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

x-amz-version-id
uAPRU1.TEa4IccOvtJ5W8HtqM3e6HTPR
content-encoding
gzip
age
62
x-cache
HIT
status
200
date
Sun, 29 Mar 2020 00:37:43 GMT
content-length
57360
x-amz-id-2
mIazVyvwuBp4rl6b4rqWuI288NQ9PJebsBXYr2Nxx74z6NZrVDWXEBYiGPCitw1erzHetRy6jA8=
x-served-by
cache-fra19124-FRA
access-control-allow-origin
*
last-modified
Mon, 09 Mar 2020 13:11:50 GMT
server
AmazonS3
x-timer
S1585442263.052738,VS0,VE1
etag
"554d96b22cd4fa4f07c79604a171a56f"
vary
Accept-Encoding
x-amz-request-id
1593E55C3DF1132E
via
1.1 varnish
cache-control
max-age=0,must-revalidate
accept-ranges
bytes
content-type
application/javascript
x-cache-hits
1
copy_copy_1551286869362_Feedback.png
resources.digital-cloud-citi.medallia.com/wdcusciti/50/resources/image/
2 KB
2 KB
Image
General
Full URL
https://resources.digital-cloud-citi.medallia.com/wdcusciti/50/resources/image/copy_copy_1551286869362_Feedback.png
Requested by
Host: ardacademy.org
URL: https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.14.133 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
506575b752d10714465811aec4dd67a7bfb471fcbc2e9619c1faad68c110759e

Request headers

Referer
https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

x-amz-version-id
c4QPIOt7jeoG0ZVKM.gnL_o4mPR3HO8Y
content-encoding
gzip
age
0
x-cache
HIT
status
200
date
Sun, 29 Mar 2020 00:37:43 GMT
content-length
2016
x-amz-id-2
zFx5tKfVu9c6VEzMWpi/0QBv1v/rhs78q4GDD4SXrkk9DMMRyGkY0Q64kLEcyIPKGVZ79rQc+MU=
x-served-by
cache-fra19124-FRA
access-control-allow-origin
*
last-modified
Thu, 14 Nov 2019 20:30:23 GMT
server
AmazonS3
x-timer
S1585442263.052730,VS0,VE622
etag
"8515c838c29a9151befa4f4350e41381"
vary
Accept-Encoding
x-amz-request-id
F28D4231A2969D25
via
1.1 varnish
cache-control
max-age=0,must-revalidate
accept-ranges
bytes
content-type
image/png
x-cache-hits
1
ajax
citicorpcreditservic.tt.omtrdc.net/m2/citicorpcreditservic/mbox/
142 B
211 B
Script
General
Full URL
https://citicorpcreditservic.tt.omtrdc.net/m2/citicorpcreditservic/mbox/ajax?mboxHost=ardacademy.org&mboxPage=2edfc057fb494797824e633a5fc6297d&screenHeight=1200&screenWidth=1600&browserWidth=1600&browserHeight=1200&browserTimeOffset=60&colorDepth=24&mboxSession=2edfc057fb494797824e633a5fc6297d&mboxXDomain=enabled&mboxCount=1&mboxTime=1585445862980&pageDef=jUSCBOL_Loginpage_Cookied&ProspectCustomer=true&pageLanguage=english&pageLang=en&mbox=target-global-mbox&mboxId=0&mboxURL=https%3A%2F%2Fardacademy.org%2Fwp-content%2Fcc%2F%3Feml%3Djashye%40mail.nasd&mboxReferrer=&mboxVersion=63
Requested by
Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
66.117.29.11 , United States, ASN15224 (OMNITURE, US),
Reverse DNS
Software
/
Resource Hash
dd256ae72a5f42f07046db6419e33dca617fe970ccb3844663a4fef8c23875e2

Request headers

Referer
https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
Sec-Fetch-Dest
script
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Intervention
<https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

pragma
no-cache
date
Sun, 29 Mar 2020 00:37:42 GMT
content-type
text/javascript;charset=utf-8
p3p
CP="NOI DSP CURa OUR STP COM"
status
200
cache-control
no-cache
timing-allow-origin
*
content-length
142
x-request-id
927f380a-d7d4-4a68-908f-76f8df6a6f79
rd
dpm.demdex.net/id/
Redirect Chain
  • https://dpm.demdex.net/id?d_visid_ver=3.1.2&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=61834D9B5228A7430A490D45%40AdobeOrg&d_nsid=0&ts=1585442262984
  • https://dpm.demdex.net/id/rd?d_visid_ver=3.1.2&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=61834D9B5228A7430A490D45%40AdobeOrg&d_nsid=0&ts=1585442262984
0
-1 B
XHR
General
Full URL
https://dpm.demdex.net/id/rd?d_visid_ver=3.1.2&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=61834D9B5228A7430A490D45%40AdobeOrg&d_nsid=0&ts=1585442262984
Requested by
Host: ardacademy.org
URL: https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.171.39.197 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-54-171-39-197.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Referer
https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma
no-cache
Strict-Transport-Security
max-age=31536000; includeSubDomains
Location
https://dpm.demdex.net/id/rd?d_visid_ver=3.1.2&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=61834D9B5228A7430A490D45%40AdobeOrg&d_nsid=0&ts=1585442262984
X-TID
KM4XkfKjT6I=
Vary
Origin
P3P
policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Access-Control-Allow-Origin
https://ardacademy.org
Cache-Control
no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Length
0
Expires
Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

Pragma
no-cache
Strict-Transport-Security
max-age=31536000; includeSubDomains
Access-Control-Allow-Origin
https://ardacademy.org
X-TID
KM4XkfKjT6I=
Vary
Origin
P3P
policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Location
https://dpm.demdex.net/id/rd?d_visid_ver=3.1.2&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=61834D9B5228A7430A490D45%40AdobeOrg&d_nsid=0&ts=1585442262984
Cache-Control
no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Length
0
Expires
Thu, 01 Jan 1970 00:00:00 GMT
serverComponent.php
nexus.ensighten.com/citi/na_prod/
1 KB
704 B
Script
General
Full URL
https://nexus.ensighten.com/citi/na_prod/serverComponent.php?r=32207.035175886434&ClientID=1129&PageID=https%3A%2F%2Fardacademy.org%2Fwp-content%2Fcc%2F%3Feml%3Djashye%40mail.nasd
Requested by
Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
18.195.42.228 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-18-195-42-228.eu-central-1.compute.amazonaws.com
Software
nginx /
Resource Hash
1f2a57e02b78d41500eefc5786833bb24fcb010a90157effe981461cce195e0b

Request headers

Referer
https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

date
Sun, 29 Mar 2020 00:37:43 GMT
content-encoding
gzip
server
nginx
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
no-cache, no-store
expires
Sun, 29 Mar 2020 00:37:42 GMT
/
www.google.com/pagead/1p-user-list/959299794/
42 B
119 B
Image
General
Full URL
https://www.google.com/pagead/1p-user-list/959299794/?random=1585247682996&cv=9&fst=1585245600000&num=1&bg=ffffff&guid=ON&u_h=768&u_w=1366&u_ah=768&u_aw=1366&u_cd=24&u_his=1&u_tz=-300&u_java=false&u_nplug=0&u_nmime=0&gtm=2od3i0&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fonline.citi.com%2FUS%2Flogin.do&tiba=Online%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&async=1&fmt=3&is_vtc=1&random=3731162054&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y
Requested by
Host: ardacademy.org
URL: https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80b::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

pragma
no-cache
date
Sun, 29 Mar 2020 00:37:43 GMT
x-content-type-options
nosniff
content-type
image/gif
server
cafe
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
cache-control
no-cache, no-store, must-revalidate
content-security-policy
script-src 'none'; object-src 'none'
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
www.google.de/pagead/1p-user-list/959299794/
42 B
110 B
Image
General
Full URL
https://www.google.de/pagead/1p-user-list/959299794/?random=1585247682996&cv=9&fst=1585245600000&num=1&bg=ffffff&guid=ON&u_h=768&u_w=1366&u_ah=768&u_aw=1366&u_cd=24&u_his=1&u_tz=-300&u_java=false&u_nplug=0&u_nmime=0&gtm=2od3i0&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fonline.citi.com%2FUS%2Flogin.do&tiba=Online%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&async=1&fmt=3&is_vtc=1&random=3731162054&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y
Requested by
Host: ardacademy.org
URL: https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:816::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

pragma
no-cache
date
Sun, 29 Mar 2020 00:37:43 GMT
x-content-type-options
nosniff
content-type
image/gif
server
cafe
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
cache-control
no-cache, no-store, must-revalidate
content-security-policy
script-src 'none'; object-src 'none'
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
www.google.com/pagead/1p-user-list/960621875/
42 B
119 B
Image
General
Full URL
https://www.google.com/pagead/1p-user-list/960621875/?random=1585247683006&cv=9&fst=1585245600000&num=1&bg=ffffff&guid=ON&u_h=768&u_w=1366&u_ah=768&u_aw=1366&u_cd=24&u_his=1&u_tz=-300&u_java=false&u_nplug=0&u_nmime=0&gtm=2od3i0&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fonline.citi.com%2FUS%2Flogin.do&tiba=Online%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&async=1&fmt=3&is_vtc=1&random=2531320636&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y
Requested by
Host: ardacademy.org
URL: https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80b::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

pragma
no-cache
date
Sun, 29 Mar 2020 00:37:43 GMT
x-content-type-options
nosniff
content-type
image/gif
server
cafe
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
cache-control
no-cache, no-store, must-revalidate
content-security-policy
script-src 'none'; object-src 'none'
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
www.google.de/pagead/1p-user-list/960621875/
42 B
110 B
Image
General
Full URL
https://www.google.de/pagead/1p-user-list/960621875/?random=1585247683006&cv=9&fst=1585245600000&num=1&bg=ffffff&guid=ON&u_h=768&u_w=1366&u_ah=768&u_aw=1366&u_cd=24&u_his=1&u_tz=-300&u_java=false&u_nplug=0&u_nmime=0&gtm=2od3i0&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fonline.citi.com%2FUS%2Flogin.do&tiba=Online%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&async=1&fmt=3&is_vtc=1&random=2531320636&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y
Requested by
Host: ardacademy.org
URL: https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:816::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

pragma
no-cache
date
Sun, 29 Mar 2020 00:37:43 GMT
x-content-type-options
nosniff
content-type
image/gif
server
cafe
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
cache-control
no-cache, no-store, must-revalidate
content-security-policy
script-src 'none'; object-src 'none'
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
www.google.com/pagead/1p-user-list/916451471/
42 B
119 B
Image
General
Full URL
https://www.google.com/pagead/1p-user-list/916451471/?random=1585247683010&cv=9&fst=1585245600000&num=1&bg=ffffff&guid=ON&u_h=768&u_w=1366&u_ah=768&u_aw=1366&u_cd=24&u_his=1&u_tz=-300&u_java=false&u_nplug=0&u_nmime=0&gtm=2od3i0&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fonline.citi.com%2FUS%2Flogin.do&tiba=Online%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&async=1&fmt=3&is_vtc=1&random=3874367844&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y
Requested by
Host: ardacademy.org
URL: https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80b::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

pragma
no-cache
date
Sun, 29 Mar 2020 00:37:43 GMT
x-content-type-options
nosniff
content-type
image/gif
server
cafe
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
cache-control
no-cache, no-store, must-revalidate
content-security-policy
script-src 'none'; object-src 'none'
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
www.google.de/pagead/1p-user-list/916451471/
42 B
110 B
Image
General
Full URL
https://www.google.de/pagead/1p-user-list/916451471/?random=1585247683010&cv=9&fst=1585245600000&num=1&bg=ffffff&guid=ON&u_h=768&u_w=1366&u_ah=768&u_aw=1366&u_cd=24&u_his=1&u_tz=-300&u_java=false&u_nplug=0&u_nmime=0&gtm=2od3i0&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fonline.citi.com%2FUS%2Flogin.do&tiba=Online%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&async=1&fmt=3&is_vtc=1&random=3874367844&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y
Requested by
Host: ardacademy.org
URL: https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:816::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

pragma
no-cache
date
Sun, 29 Mar 2020 00:37:43 GMT
x-content-type-options
nosniff
content-type
image/gif
server
cafe
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
cache-control
no-cache, no-store, must-revalidate
content-security-policy
script-src 'none'; object-src 'none'
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
www.google.com/pagead/1p-user-list/975701947/
42 B
119 B
Image
General
Full URL
https://www.google.com/pagead/1p-user-list/975701947/?random=1585247683013&cv=9&fst=1585245600000&num=1&bg=ffffff&guid=ON&u_h=768&u_w=1366&u_ah=768&u_aw=1366&u_cd=24&u_his=1&u_tz=-300&u_java=false&u_nplug=0&u_nmime=0&gtm=2od3i0&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fonline.citi.com%2FUS%2Flogin.do&tiba=Online%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&async=1&fmt=3&is_vtc=1&random=1066994658&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y
Requested by
Host: ardacademy.org
URL: https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80b::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

pragma
no-cache
date
Sun, 29 Mar 2020 00:37:43 GMT
x-content-type-options
nosniff
content-type
image/gif
server
cafe
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
cache-control
no-cache, no-store, must-revalidate
content-security-policy
script-src 'none'; object-src 'none'
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
www.google.de/pagead/1p-user-list/975701947/
42 B
110 B
Image
General
Full URL
https://www.google.de/pagead/1p-user-list/975701947/?random=1585247683013&cv=9&fst=1585245600000&num=1&bg=ffffff&guid=ON&u_h=768&u_w=1366&u_ah=768&u_aw=1366&u_cd=24&u_his=1&u_tz=-300&u_java=false&u_nplug=0&u_nmime=0&gtm=2od3i0&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fonline.citi.com%2FUS%2Flogin.do&tiba=Online%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&async=1&fmt=3&is_vtc=1&random=1066994658&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y
Requested by
Host: ardacademy.org
URL: https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:816::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

pragma
no-cache
date
Sun, 29 Mar 2020 00:37:43 GMT
x-content-type-options
nosniff
content-type
image/gif
server
cafe
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
cache-control
no-cache, no-store, must-revalidate
content-security-policy
script-src 'none'; object-src 'none'
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
www.google.com/pagead/1p-user-list/770961656/
42 B
119 B
Image
General
Full URL
https://www.google.com/pagead/1p-user-list/770961656/?random=1585247683017&cv=9&fst=1585245600000&num=1&bg=ffffff&guid=ON&u_h=768&u_w=1366&u_ah=768&u_aw=1366&u_cd=24&u_his=1&u_tz=-300&u_java=false&u_nplug=0&u_nmime=0&gtm=2od3i0&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fonline.citi.com%2FUS%2Flogin.do&tiba=Online%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&async=1&fmt=3&is_vtc=1&random=2509551619&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y
Requested by
Host: ardacademy.org
URL: https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80b::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

pragma
no-cache
date
Sun, 29 Mar 2020 00:37:43 GMT
x-content-type-options
nosniff
content-type
image/gif
server
cafe
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
cache-control
no-cache, no-store, must-revalidate
content-security-policy
script-src 'none'; object-src 'none'
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
www.google.de/pagead/1p-user-list/770961656/
42 B
110 B
Image
General
Full URL
https://www.google.de/pagead/1p-user-list/770961656/?random=1585247683017&cv=9&fst=1585245600000&num=1&bg=ffffff&guid=ON&u_h=768&u_w=1366&u_ah=768&u_aw=1366&u_cd=24&u_his=1&u_tz=-300&u_java=false&u_nplug=0&u_nmime=0&gtm=2od3i0&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fonline.citi.com%2FUS%2Flogin.do&tiba=Online%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&async=1&fmt=3&is_vtc=1&random=2509551619&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y
Requested by
Host: ardacademy.org
URL: https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:816::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

pragma
no-cache
date
Sun, 29 Mar 2020 00:37:43 GMT
x-content-type-options
nosniff
content-type
image/gif
server
cafe
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
cache-control
no-cache, no-store, must-revalidate
content-security-policy
script-src 'none'; object-src 'none'
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
www.google.com/pagead/1p-user-list/819500023/
42 B
119 B
Image
General
Full URL
https://www.google.com/pagead/1p-user-list/819500023/?random=1585247683020&cv=9&fst=1585245600000&num=1&bg=ffffff&guid=ON&u_h=768&u_w=1366&u_ah=768&u_aw=1366&u_cd=24&u_his=1&u_tz=-300&u_java=false&u_nplug=0&u_nmime=0&gtm=2od3i0&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fonline.citi.com%2FUS%2Flogin.do&tiba=Online%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&async=1&fmt=3&is_vtc=1&random=627559608&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y
Requested by
Host: ardacademy.org
URL: https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80b::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

pragma
no-cache
date
Sun, 29 Mar 2020 00:37:43 GMT
x-content-type-options
nosniff
content-type
image/gif
server
cafe
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
cache-control
no-cache, no-store, must-revalidate
content-security-policy
script-src 'none'; object-src 'none'
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
www.google.de/pagead/1p-user-list/819500023/
42 B
110 B
Image
General
Full URL
https://www.google.de/pagead/1p-user-list/819500023/?random=1585247683020&cv=9&fst=1585245600000&num=1&bg=ffffff&guid=ON&u_h=768&u_w=1366&u_ah=768&u_aw=1366&u_cd=24&u_his=1&u_tz=-300&u_java=false&u_nplug=0&u_nmime=0&gtm=2od3i0&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fonline.citi.com%2FUS%2Flogin.do&tiba=Online%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&async=1&fmt=3&is_vtc=1&random=627559608&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y
Requested by
Host: ardacademy.org
URL: https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:816::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

pragma
no-cache
date
Sun, 29 Mar 2020 00:37:43 GMT
x-content-type-options
nosniff
content-type
image/gif
server
cafe
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
cache-control
no-cache, no-store, must-revalidate
content-security-policy
script-src 'none'; object-src 'none'
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
www.google.com/pagead/1p-user-list/763960929/
42 B
119 B
Image
General
Full URL
https://www.google.com/pagead/1p-user-list/763960929/?random=1585247683026&cv=9&fst=1585245600000&num=1&bg=ffffff&guid=ON&u_h=768&u_w=1366&u_ah=768&u_aw=1366&u_cd=24&u_his=1&u_tz=-300&u_java=false&u_nplug=0&u_nmime=0&gtm=2od3i0&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fonline.citi.com%2FUS%2Flogin.do&tiba=Online%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&async=1&fmt=3&is_vtc=1&random=1129669827&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y
Requested by
Host: ardacademy.org
URL: https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80b::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

pragma
no-cache
date
Sun, 29 Mar 2020 00:37:43 GMT
x-content-type-options
nosniff
content-type
image/gif
server
cafe
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
cache-control
no-cache, no-store, must-revalidate
content-security-policy
script-src 'none'; object-src 'none'
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
www.google.de/pagead/1p-user-list/763960929/
42 B
110 B
Image
General
Full URL
https://www.google.de/pagead/1p-user-list/763960929/?random=1585247683026&cv=9&fst=1585245600000&num=1&bg=ffffff&guid=ON&u_h=768&u_w=1366&u_ah=768&u_aw=1366&u_cd=24&u_his=1&u_tz=-300&u_java=false&u_nplug=0&u_nmime=0&gtm=2od3i0&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fonline.citi.com%2FUS%2Flogin.do&tiba=Online%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&async=1&fmt=3&is_vtc=1&random=1129669827&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y
Requested by
Host: ardacademy.org
URL: https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:816::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

pragma
no-cache
date
Sun, 29 Mar 2020 00:37:43 GMT
x-content-type-options
nosniff
content-type
image/gif
server
cafe
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
cache-control
no-cache, no-store, must-revalidate
content-security-policy
script-src 'none'; object-src 'none'
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
www.google.com/pagead/1p-user-list/959299794/
42 B
119 B
Image
General
Full URL
https://www.google.com/pagead/1p-user-list/959299794/?random=1585247683029&cv=9&fst=1585245600000&num=1&bg=ffffff&guid=ON&u_h=768&u_w=1366&u_ah=768&u_aw=1366&u_cd=24&u_his=1&u_tz=-300&u_java=false&u_nplug=0&u_nmime=0&gtm=2od3i0&data=event%3Dconversion&frm=0&url=https%3A%2F%2Fonline.citi.com%2FUS%2Flogin.do&tiba=Online%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&async=1&fmt=3&is_vtc=1&random=981151180&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y
Requested by
Host: ardacademy.org
URL: https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80b::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

pragma
no-cache
date
Sun, 29 Mar 2020 00:37:43 GMT
x-content-type-options
nosniff
content-type
image/gif
server
cafe
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
cache-control
no-cache, no-store, must-revalidate
content-security-policy
script-src 'none'; object-src 'none'
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
www.google.de/pagead/1p-user-list/959299794/
42 B
110 B
Image
General
Full URL
https://www.google.de/pagead/1p-user-list/959299794/?random=1585247683029&cv=9&fst=1585245600000&num=1&bg=ffffff&guid=ON&u_h=768&u_w=1366&u_ah=768&u_aw=1366&u_cd=24&u_his=1&u_tz=-300&u_java=false&u_nplug=0&u_nmime=0&gtm=2od3i0&data=event%3Dconversion&frm=0&url=https%3A%2F%2Fonline.citi.com%2FUS%2Flogin.do&tiba=Online%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&async=1&fmt=3&is_vtc=1&random=981151180&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y
Requested by
Host: ardacademy.org
URL: https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:816::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

pragma
no-cache
date
Sun, 29 Mar 2020 00:37:43 GMT
x-content-type-options
nosniff
content-type
image/gif
server
cafe
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
cache-control
no-cache, no-store, must-revalidate
content-security-policy
script-src 'none'; object-src 'none'
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
www.google.com/pagead/1p-user-list/960621875/
42 B
119 B
Image
General
Full URL
https://www.google.com/pagead/1p-user-list/960621875/?random=1585247683033&cv=9&fst=1585245600000&num=1&bg=ffffff&guid=ON&u_h=768&u_w=1366&u_ah=768&u_aw=1366&u_cd=24&u_his=1&u_tz=-300&u_java=false&u_nplug=0&u_nmime=0&gtm=2od3i0&data=event%3Dconversion&frm=0&url=https%3A%2F%2Fonline.citi.com%2FUS%2Flogin.do&tiba=Online%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&async=1&fmt=3&is_vtc=1&random=3116657411&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y
Requested by
Host: ardacademy.org
URL: https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80b::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

pragma
no-cache
date
Sun, 29 Mar 2020 00:37:43 GMT
x-content-type-options
nosniff
content-type
image/gif
server
cafe
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
cache-control
no-cache, no-store, must-revalidate
content-security-policy
script-src 'none'; object-src 'none'
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
www.google.de/pagead/1p-user-list/960621875/
42 B
110 B
Image
General
Full URL
https://www.google.de/pagead/1p-user-list/960621875/?random=1585247683033&cv=9&fst=1585245600000&num=1&bg=ffffff&guid=ON&u_h=768&u_w=1366&u_ah=768&u_aw=1366&u_cd=24&u_his=1&u_tz=-300&u_java=false&u_nplug=0&u_nmime=0&gtm=2od3i0&data=event%3Dconversion&frm=0&url=https%3A%2F%2Fonline.citi.com%2FUS%2Flogin.do&tiba=Online%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&async=1&fmt=3&is_vtc=1&random=3116657411&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y
Requested by
Host: ardacademy.org
URL: https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:816::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

pragma
no-cache
date
Sun, 29 Mar 2020 00:37:43 GMT
x-content-type-options
nosniff
content-type
image/gif
server
cafe
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
cache-control
no-cache, no-store, must-revalidate
content-security-policy
script-src 'none'; object-src 'none'
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
www.google.com/pagead/1p-user-list/916451471/
42 B
119 B
Image
General
Full URL
https://www.google.com/pagead/1p-user-list/916451471/?random=1585247683036&cv=9&fst=1585245600000&num=1&bg=ffffff&guid=ON&eid=376635471&u_h=768&u_w=1366&u_ah=768&u_aw=1366&u_cd=24&u_his=1&u_tz=-300&u_java=false&u_nplug=0&u_nmime=0&gtm=2od3i0&data=event%3Dconversion&frm=0&url=https%3A%2F%2Fonline.citi.com%2FUS%2Flogin.do&tiba=Online%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&async=1&fmt=3&is_vtc=1&random=2068581912&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y
Requested by
Host: ardacademy.org
URL: https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80b::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

pragma
no-cache
date
Sun, 29 Mar 2020 00:37:43 GMT
x-content-type-options
nosniff
content-type
image/gif
server
cafe
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
cache-control
no-cache, no-store, must-revalidate
content-security-policy
script-src 'none'; object-src 'none'
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
www.google.de/pagead/1p-user-list/916451471/
42 B
110 B
Image
General
Full URL
https://www.google.de/pagead/1p-user-list/916451471/?random=1585247683036&cv=9&fst=1585245600000&num=1&bg=ffffff&guid=ON&eid=376635471&u_h=768&u_w=1366&u_ah=768&u_aw=1366&u_cd=24&u_his=1&u_tz=-300&u_java=false&u_nplug=0&u_nmime=0&gtm=2od3i0&data=event%3Dconversion&frm=0&url=https%3A%2F%2Fonline.citi.com%2FUS%2Flogin.do&tiba=Online%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&async=1&fmt=3&is_vtc=1&random=2068581912&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y
Requested by
Host: ardacademy.org
URL: https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:816::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

pragma
no-cache
date
Sun, 29 Mar 2020 00:37:43 GMT
x-content-type-options
nosniff
content-type
image/gif
server
cafe
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
cache-control
no-cache, no-store, must-revalidate
content-security-policy
script-src 'none'; object-src 'none'
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
www.google.com/pagead/1p-user-list/975701947/
42 B
119 B
Image
General
Full URL
https://www.google.com/pagead/1p-user-list/975701947/?random=1585247683049&cv=9&fst=1585245600000&num=1&bg=ffffff&guid=ON&eid=376635471&u_h=768&u_w=1366&u_ah=768&u_aw=1366&u_cd=24&u_his=1&u_tz=-300&u_java=false&u_nplug=0&u_nmime=0&gtm=2od3i0&data=event%3Dconversion&frm=0&url=https%3A%2F%2Fonline.citi.com%2FUS%2Flogin.do&tiba=Online%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&async=1&fmt=3&is_vtc=1&random=371542892&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y
Requested by
Host: ardacademy.org
URL: https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80b::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

pragma
no-cache
date
Sun, 29 Mar 2020 00:37:43 GMT
x-content-type-options
nosniff
content-type
image/gif
server
cafe
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
cache-control
no-cache, no-store, must-revalidate
content-security-policy
script-src 'none'; object-src 'none'
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
www.google.de/pagead/1p-user-list/975701947/
42 B
110 B
Image
General
Full URL
https://www.google.de/pagead/1p-user-list/975701947/?random=1585247683049&cv=9&fst=1585245600000&num=1&bg=ffffff&guid=ON&eid=376635471&u_h=768&u_w=1366&u_ah=768&u_aw=1366&u_cd=24&u_his=1&u_tz=-300&u_java=false&u_nplug=0&u_nmime=0&gtm=2od3i0&data=event%3Dconversion&frm=0&url=https%3A%2F%2Fonline.citi.com%2FUS%2Flogin.do&tiba=Online%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&async=1&fmt=3&is_vtc=1&random=371542892&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y
Requested by
Host: ardacademy.org
URL: https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:816::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

pragma
no-cache
date
Sun, 29 Mar 2020 00:37:43 GMT
x-content-type-options
nosniff
content-type
image/gif
server
cafe
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
cache-control
no-cache, no-store, must-revalidate
content-security-policy
script-src 'none'; object-src 'none'
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
www.google.com/pagead/1p-user-list/770961656/
42 B
119 B
Image
General
Full URL
https://www.google.com/pagead/1p-user-list/770961656/?random=1585247683063&cv=9&fst=1585245600000&num=1&bg=ffffff&guid=ON&eid=376635471&u_h=768&u_w=1366&u_ah=768&u_aw=1366&u_cd=24&u_his=1&u_tz=-300&u_java=false&u_nplug=0&u_nmime=0&gtm=2od3i0&data=event%3Dconversion&frm=0&url=https%3A%2F%2Fonline.citi.com%2FUS%2Flogin.do&tiba=Online%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&async=1&fmt=3&is_vtc=1&random=4058050227&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y
Requested by
Host: ardacademy.org
URL: https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80b::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

pragma
no-cache
date
Sun, 29 Mar 2020 00:37:43 GMT
x-content-type-options
nosniff
content-type
image/gif
server
cafe
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
cache-control
no-cache, no-store, must-revalidate
content-security-policy
script-src 'none'; object-src 'none'
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
www.google.de/pagead/1p-user-list/770961656/
42 B
110 B
Image
General
Full URL
https://www.google.de/pagead/1p-user-list/770961656/?random=1585247683063&cv=9&fst=1585245600000&num=1&bg=ffffff&guid=ON&eid=376635471&u_h=768&u_w=1366&u_ah=768&u_aw=1366&u_cd=24&u_his=1&u_tz=-300&u_java=false&u_nplug=0&u_nmime=0&gtm=2od3i0&data=event%3Dconversion&frm=0&url=https%3A%2F%2Fonline.citi.com%2FUS%2Flogin.do&tiba=Online%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&async=1&fmt=3&is_vtc=1&random=4058050227&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y
Requested by
Host: ardacademy.org
URL: https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:816::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

pragma
no-cache
date
Sun, 29 Mar 2020 00:37:43 GMT
x-content-type-options
nosniff
content-type
image/gif
server
cafe
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
cache-control
no-cache, no-store, must-revalidate
content-security-policy
script-src 'none'; object-src 'none'
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
www.google.com/pagead/1p-user-list/819500023/
42 B
119 B
Image
General
Full URL
https://www.google.com/pagead/1p-user-list/819500023/?random=1585247683075&cv=9&fst=1585245600000&num=1&bg=ffffff&guid=ON&eid=376635471&u_h=768&u_w=1366&u_ah=768&u_aw=1366&u_cd=24&u_his=1&u_tz=-300&u_java=false&u_nplug=0&u_nmime=0&gtm=2od3i0&data=event%3Dconversion&frm=0&url=https%3A%2F%2Fonline.citi.com%2FUS%2Flogin.do&tiba=Online%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&async=1&fmt=3&is_vtc=1&random=1573621412&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y
Requested by
Host: ardacademy.org
URL: https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80b::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

pragma
no-cache
date
Sun, 29 Mar 2020 00:37:43 GMT
x-content-type-options
nosniff
content-type
image/gif
server
cafe
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
cache-control
no-cache, no-store, must-revalidate
content-security-policy
script-src 'none'; object-src 'none'
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
www.google.de/pagead/1p-user-list/819500023/
42 B
110 B
Image
General
Full URL
https://www.google.de/pagead/1p-user-list/819500023/?random=1585247683075&cv=9&fst=1585245600000&num=1&bg=ffffff&guid=ON&eid=376635471&u_h=768&u_w=1366&u_ah=768&u_aw=1366&u_cd=24&u_his=1&u_tz=-300&u_java=false&u_nplug=0&u_nmime=0&gtm=2od3i0&data=event%3Dconversion&frm=0&url=https%3A%2F%2Fonline.citi.com%2FUS%2Flogin.do&tiba=Online%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&async=1&fmt=3&is_vtc=1&random=1573621412&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y
Requested by
Host: ardacademy.org
URL: https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:816::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

pragma
no-cache
date
Sun, 29 Mar 2020 00:37:43 GMT
x-content-type-options
nosniff
content-type
image/gif
server
cafe
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
cache-control
no-cache, no-store, must-revalidate
content-security-policy
script-src 'none'; object-src 'none'
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
www.google.com/pagead/1p-user-list/763960929/
42 B
119 B
Image
General
Full URL
https://www.google.com/pagead/1p-user-list/763960929/?random=1585247683083&cv=9&fst=1585245600000&num=1&bg=ffffff&guid=ON&eid=376635471&u_h=768&u_w=1366&u_ah=768&u_aw=1366&u_cd=24&u_his=1&u_tz=-300&u_java=false&u_nplug=0&u_nmime=0&gtm=2od3i0&data=event%3Dconversion&frm=0&url=https%3A%2F%2Fonline.citi.com%2FUS%2Flogin.do&tiba=Online%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&async=1&fmt=3&is_vtc=1&random=2657774255&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y
Requested by
Host: ardacademy.org
URL: https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80b::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

pragma
no-cache
date
Sun, 29 Mar 2020 00:37:43 GMT
x-content-type-options
nosniff
content-type
image/gif
server
cafe
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
cache-control
no-cache, no-store, must-revalidate
content-security-policy
script-src 'none'; object-src 'none'
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
www.google.de/pagead/1p-user-list/763960929/
42 B
110 B
Image
General
Full URL
https://www.google.de/pagead/1p-user-list/763960929/?random=1585247683083&cv=9&fst=1585245600000&num=1&bg=ffffff&guid=ON&eid=376635471&u_h=768&u_w=1366&u_ah=768&u_aw=1366&u_cd=24&u_his=1&u_tz=-300&u_java=false&u_nplug=0&u_nmime=0&gtm=2od3i0&data=event%3Dconversion&frm=0&url=https%3A%2F%2Fonline.citi.com%2FUS%2Flogin.do&tiba=Online%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&async=1&fmt=3&is_vtc=1&random=2657774255&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y
Requested by
Host: ardacademy.org
URL: https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:816::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

pragma
no-cache
date
Sun, 29 Mar 2020 00:37:43 GMT
x-content-type-options
nosniff
content-type
image/gif
server
cafe
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
cache-control
no-cache, no-store, must-revalidate
content-security-policy
script-src 'none'; object-src 'none'
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
identity
api.rlcdn.com/api/
0
0
XHR
General
Full URL
https://api.rlcdn.com/api/identity?pid=1&rt=idl
Requested by
Host: ardacademy.org
URL: https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.244.174.68 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
68.174.244.35.bc.googleusercontent.com
Software
/
Resource Hash

Request headers

Accept
application/json, text/javascript, */*; q=0.01
Referer
https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
Origin
https://ardacademy.org
Sec-Fetch-Dest
empty
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

ca962ada-2169-49b9-bb92-83f372034ab4
https://ardacademy.org/
138 KB
0
Other
General
Full URL
blob:https://ardacademy.org/ca962ada-2169-49b9-bb92-83f372034ab4
Requested by
Host: online.citi.com
URL: https://online.citi.com/passivebio/BiocatchATO.js
Protocol
BLOB
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
e5168b3d0c8f929a1b8c4c1b4e4ebac60ee0e1ecfd759aeb4be4c2b15e3fc097

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
worker

Response headers

Content-Length
140879
Content-Type
application/javascript
rd
dpm.demdex.net/id/
363 B
1 KB
XHR
General
Full URL
https://dpm.demdex.net/id/rd?d_visid_ver=3.1.2&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=61834D9B5228A7430A490D45%40AdobeOrg&d_nsid=0&ts=1585442262984
Requested by
Host: ardacademy.org
URL: https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.171.39.197 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-54-171-39-197.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash
fe9cd3e92481365c0bee77c4499f3858cea82822e4aae7744f5cbc2c88108888
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Referer
https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
Origin
https://ardacademy.org
Sec-Fetch-Dest
empty
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type
application/x-www-form-urlencoded

Response headers

DCS
dcs-prod-irl1-v064-06e167488.edge-irl1.demdex.com 5.66.0.20200310121811 3ms (+0ms)
Pragma
no-cache
Strict-Transport-Security
max-age=31536000; includeSubDomains
Content-Encoding
gzip
X-TID
/z79N9iPTKc=
Vary
Origin, Accept-Encoding, User-Agent
P3P
policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Access-Control-Allow-Origin
https://ardacademy.org
Cache-Control
no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
application/json;charset=utf-8
Content-Length
298
Expires
Thu, 01 Jan 1970 00:00:00 GMT
Citi-Enterprise-White.png
online.citi.com/GFC/branding/img/
1 KB
1 KB
Image
General
Full URL
https://online.citi.com/GFC/branding/img/Citi-Enterprise-White.png
Requested by
Host: ardacademy.org
URL: https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.109.92.187 , Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a104-109-92-187.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
7cb24e06c00e47bb6bc6c38b935d6bc62817f656703387e4fb7591add96c7454
Security Headers
Name Value
Content-Security-Policy frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
Strict-Transport-Security max-age=300
X-Content-Security-Policy frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

Request headers

Referer
https://online.citi.com/GFC/branding/responsivebranding/css/main_branding.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

strict-transport-security
max-age=300
last-modified
Wed, 14 Jun 2017 18:29:05 GMT
x-akamai-citisite
GTDC
date
Sun, 29 Mar 2020 00:37:43 GMT
p3p
policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
status
200
x-webkit-csp
frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
content-security-policy
frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
accept-ranges
bytes
content-type
image/png
content-length
1040
x-content-security-policy
frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
Interstate-Light.woff
online.citi.com/CBOL/common/ui/ddl/theme/latest/styles/fonts/interstate/
74 KB
74 KB
Font
General
Full URL
https://online.citi.com/CBOL/common/ui/ddl/theme/latest/styles/fonts/interstate/Interstate-Light.woff
Requested by
Host: ardacademy.org
URL: https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.109.92.187 , Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a104-109-92-187.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
f327a0ba3e41b1e8154e1c18fc114baff0bd057151e3afe7fa6f33cc0cb18296
Security Headers
Name Value
Content-Security-Policy frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
Strict-Transport-Security max-age=300
X-Content-Security-Policy frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

Request headers

Referer
https://online.citi.com/CBOL/common/ui/ddl/theme/latest/styles/ddl.min.css
Origin
https://ardacademy.org
Sec-Fetch-Dest
font
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security
max-age=300
content-encoding
gzip
last-modified
Tue, 12 Sep 2017 16:59:12 GMT
x-akamai-citisite
SWDC
date
Sun, 29 Mar 2020 00:37:43 GMT
vary
Accept-Encoding
p3p
policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
status
200
x-webkit-csp
frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
content-security-policy
frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
content-type
text/plain
access-control-allow-origin
*
content-length
75483
x-content-security-policy
frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
Interstate-Bold.woff
online.citi.com/CBOL/common/ui/ddl/theme/latest/styles/fonts/interstate/
70 KB
71 KB
Font
General
Full URL
https://online.citi.com/CBOL/common/ui/ddl/theme/latest/styles/fonts/interstate/Interstate-Bold.woff
Requested by
Host: ardacademy.org
URL: https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.109.92.187 , Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a104-109-92-187.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
e9e9a67395a0d83b584208a19b95af203df8e8e6c6952fe76c690d60ea9381c7
Security Headers
Name Value
Content-Security-Policy frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
Strict-Transport-Security max-age=300
X-Content-Security-Policy frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

Request headers

Referer
https://online.citi.com/CBOL/common/ui/ddl/theme/latest/styles/ddl.min.css
Origin
https://ardacademy.org
Sec-Fetch-Dest
font
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security
max-age=300
content-encoding
gzip
last-modified
Tue, 12 Sep 2017 16:59:12 GMT
x-akamai-citisite
SWDC
date
Sun, 29 Mar 2020 00:37:43 GMT
vary
Accept-Encoding
p3p
policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
status
200
x-webkit-csp
frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
content-security-policy
frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
content-type
text/plain
access-control-allow-origin
*
content-length
71859
x-content-security-policy
frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
Cookie set dest5.html
citi.demdex.net/ Frame 8D5F
0
0
Document
General
Full URL
https://citi.demdex.net/dest5.html?d_nsid=0
Requested by
Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.154.151.160 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-54-154-151-160.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Host
citi.demdex.net
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
iframe
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site
cross-site
Sec-Fetch-Mode
navigate
Referer
https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
Accept-Encoding
gzip, deflate, br
Accept-Language
en-US
Cookie
demdex=35599368996475573450980521148147697708
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
iframe
Referer
https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd

Response headers

Accept-Ranges
bytes
Cache-Control
max-age=21600
Content-Encoding
gzip
Content-Type
text/html
Expires
Thu, 01 Jan 1970 00:00:00 GMT
Last-Modified
Wed, 18 Mar 2020 11:39:41 GMT
P3P
policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Pragma
no-cache
Set-Cookie
demdex=35599368996475573450980521148147697708;Path=/;Domain=.demdex.net;Expires=Fri, 25-Sep-2020 00:37:43 GMT;Max-Age=15552000;Secure;SameSite=None
Strict-Transport-Security
max-age=31536000; includeSubDomains
Vary
Accept-Encoding, User-Agent
X-TID
1+BAvS1EQRw=
Content-Length
2785
Connection
keep-alive
id
metrics1.citi.com/
89 B
627 B
XHR
General
Full URL
https://metrics1.citi.com/id?d_visid_ver=3.1.2&d_fieldgroup=A&mcorgid=61834D9B5228A7430A490D45%40AdobeOrg&mid=40906643178000525460304020409647378831&ts=1585442263126
Requested by
Host: ardacademy.org
URL: https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
15.188.31.119 Paris, France, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-15-188-31-119.eu-west-3.compute.amazonaws.com
Software
jag /
Resource Hash
12b943f092c830301700c4abb5e5fdafbf07e34b66871c83c009befd63f7dfc0
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
Origin
https://ardacademy.org
Sec-Fetch-Dest
empty
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type
application/x-www-form-urlencoded

Response headers

status
200
date
Sun, 29 Mar 2020 00:37:43 GMT
x-content-type-options
nosniff
server
jag
xserver
anedge-5cd6d4f775-cm6z6
vary
Origin
x-c
master-1216.I0bfb28.M0-370
p3p
CP="This is not a P3P policy"
access-control-allow-origin
https://ardacademy.org
cache-control
no-cache, no-store, max-age=0, no-transform, private
access-control-allow-credentials
true
content-type
application/x-javascript;charset=utf-8
content-length
89
x-xss-protection
1; mode=block
ibs:dpid=411&dpuuid=Xn-t1wAAAwc161L0
dpm.demdex.net/
Redirect Chain
  • https://cm.everesttech.net/cm/dd?d_uuid=35599368996475573450980521148147697708
  • https://dpm.demdex.net/ibs:dpid=411&dpuuid=Xn-t1wAAAwc161L0
42 B
915 B
Image
General
Full URL
https://dpm.demdex.net/ibs:dpid=411&dpuuid=Xn-t1wAAAwc161L0
Requested by
Host: ardacademy.org
URL: https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.171.39.197 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-54-171-39-197.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff

Request headers

Referer
https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

DCS
dcs-prod-irl1-v064-094748176.edge-irl1.demdex.com 5.66.0.20200310121811 1ms (+1ms)
Pragma
no-cache
Strict-Transport-Security
max-age=31536000; includeSubDomains
X-Content-Type-Options
nosniff
X-TID
1nLs0MAkSCE=
P3P
policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Cache-Control
no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection
keep-alive
Content-Type
image/gif
Content-Length
42
Expires
Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

Date
Sun, 29 Mar 2020 00:37:42 GMT
Server
AMO-cookiemap/1.1
P3P
CP="NOI NID DEVa PSAa PSDa OUR IND PUR COM NAV INT DEM"
Location
https://dpm.demdex.net/ibs:dpid=411&dpuuid=Xn-t1wAAAwc161L0
Cache-Control
no-cache
Connection
Keep-Alive
Keep-Alive
timeout=15,max=100
Content-Length
0
cse_element__de.js
www.google.com/cse/static/element/8b2252448421acb3/
257 KB
85 KB
Script
General
Full URL
https://www.google.com/cse/static/element/8b2252448421acb3/cse_element__de.js?usqp=CAI%3D
Requested by
Host: cse.google.com
URL: https://cse.google.com/cse/cse.js?cx=009695499870347544712:e3dyicpbrwu
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80b::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
2233a44f005e8d416636e52aca33bc7ce726c1ab4d0801865162829d762c6de2
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

date
Fri, 27 Mar 2020 22:12:36 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Thu, 31 Oct 2019 16:49:36 GMT
server
sffe
age
95107
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
public, max-age=31536000
accept-ranges
bytes
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length
86952
x-xss-protection
0
expires
Sat, 27 Mar 2021 22:12:36 GMT
default+de.css
www.google.com/cse/static/element/8b2252448421acb3/
40 KB
9 KB
Stylesheet
General
Full URL
https://www.google.com/cse/static/element/8b2252448421acb3/default+de.css
Requested by
Host: cse.google.com
URL: https://cse.google.com/cse/cse.js?cx=009695499870347544712:e3dyicpbrwu
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80b::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
40a20291f9b526cba58796a4bbd0256d5663313e02c9d5ab5a842476562b3108
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
style

Response headers

date
Fri, 27 Mar 2020 22:12:36 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Thu, 31 Oct 2019 16:49:36 GMT
server
sffe
age
95107
vary
Accept-Encoding
content-type
text/css
status
200
cache-control
public, max-age=31536000
accept-ranges
bytes
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length
9042
x-xss-protection
0
expires
Sat, 27 Mar 2021 22:12:36 GMT
HP4782_M.jpg
online.citi.com/JRS/banners/modules/
90 KB
90 KB
Image
General
Full URL
https://online.citi.com/JRS/banners/modules/HP4782_M.jpg
Requested by
Host: ardacademy.org
URL: https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.109.92.187 , Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a104-109-92-187.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
043494ebdb60e363e2e8e0fa548a3863505bda2d81f28d2bf87d4f11380f39f4
Security Headers
Name Value
Content-Security-Policy frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
Strict-Transport-Security max-age=300
X-Content-Security-Policy frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

Request headers

Referer
https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

strict-transport-security
max-age=300
last-modified
Wed, 15 May 2019 15:20:42 GMT
x-akamai-citisite
SWDC
date
Sun, 29 Mar 2020 00:37:43 GMT
p3p
policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
status
200
x-webkit-csp
frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
content-security-policy
frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
accept-ranges
bytes
content-type
image/jpeg
content-length
91963
x-content-security-policy
frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
arrow-btn-next-blue-sm-bold.svg
online.citi.com/CBOL/common/ui/ddl/theme/latest/images/icons/svgs/arrows/
918 B
1000 B
Image
General
Full URL
https://online.citi.com/CBOL/common/ui/ddl/theme/latest/images/icons/svgs/arrows/arrow-btn-next-blue-sm-bold.svg
Requested by
Host: ardacademy.org
URL: https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.109.92.187 , Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a104-109-92-187.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
e90fb0eba512ed6473f6fb8acf4cd09b38732f150f43c396246c12bb2aacbb67
Security Headers
Name Value
Content-Security-Policy frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
Strict-Transport-Security max-age=300
X-Content-Security-Policy frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

Request headers

Referer
https://online.citi.com/GFC/branding/responsivebranding/css/main.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

strict-transport-security
max-age=300
content-encoding
gzip
last-modified
Tue, 12 Sep 2017 17:16:57 GMT
x-akamai-citisite
GTDC
date
Sun, 29 Mar 2020 00:37:43 GMT
vary
Accept-Encoding
p3p
policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
status
200
x-webkit-csp
frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
content-security-policy
frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
accept-ranges
bytes
content-type
image/svg+xml
content-length
499
x-content-security-policy
frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
id
dpm.demdex.net/
363 B
1 KB
XHR
General
Full URL
https://dpm.demdex.net/id?d_visid_ver=3.1.2&d_fieldgroup=AAM&d_rtbd=json&d_ver=2&d_orgid=61834D9B5228A7430A490D45%40AdobeOrg&d_nsid=0&d_mid=40906643178000525460304020409647378831&d_blob=RKhpRz8krg2tLO6pguXWp5olkAcUniQYPHaMWWgdJ3xzPWQmdj0y&d_cid_ic=AVID%012F3FF6EB8515B1F3-6000089B8445EBA9&ts=1585442263323
Requested by
Host: ardacademy.org
URL: https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.171.39.197 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-54-171-39-197.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash
195eb9928411a79a221ccfa9ce7fcc9898e55624ab0d66331af867d57adad461
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Referer
https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
Origin
https://ardacademy.org
Sec-Fetch-Dest
empty
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type
application/x-www-form-urlencoded

Response headers

DCS
dcs-prod-irl1-v064-0bbb5120b.edge-irl1.demdex.com 5.66.0.20200310121811 2ms (+0ms)
Pragma
no-cache
Strict-Transport-Security
max-age=31536000; includeSubDomains
Content-Encoding
gzip
X-TID
EgHzlleGRhM=
Vary
Origin, Accept-Encoding, User-Agent
P3P
policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Access-Control-Allow-Origin
https://ardacademy.org
Cache-Control
no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
application/json;charset=utf-8
Content-Length
300
Expires
Thu, 01 Jan 1970 00:00:00 GMT
Citi-Branding-Sprite.png
online.citi.com/GFC/branding/img/
5 KB
5 KB
Image
General
Full URL
https://online.citi.com/GFC/branding/img/Citi-Branding-Sprite.png
Requested by
Host: ardacademy.org
URL: https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.109.92.187 , Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a104-109-92-187.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
3fca3de24621f0f10186594054444d608016297c2e853e548710b3521e42a609
Security Headers
Name Value
Content-Security-Policy frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
Strict-Transport-Security max-age=300
X-Content-Security-Policy frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

Request headers

Referer
https://online.citi.com/GFC/branding/responsivebranding/css/main_branding.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

strict-transport-security
max-age=300
last-modified
Wed, 14 Jun 2017 18:29:01 GMT
x-akamai-citisite
SWDC
date
Sun, 29 Mar 2020 00:37:43 GMT
p3p
policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
status
200
x-webkit-csp
frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
content-security-policy
frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
accept-ranges
bytes
content-type
image/png
content-length
4952
x-content-security-policy
frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
appStore_1px.png
online.citi.com/GFC/branding/responsivebranding/img/
3 KB
4 KB
Image
General
Full URL
https://online.citi.com/GFC/branding/responsivebranding/img/appStore_1px.png
Requested by
Host: ardacademy.org
URL: https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.109.92.187 , Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a104-109-92-187.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
f44e4692a52b6a382cb481e23f8bcb9a6d4c24eec8aa60143c7e2ca3a85758b2
Security Headers
Name Value
Content-Security-Policy frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
Strict-Transport-Security max-age=300
X-Content-Security-Policy frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

Request headers

Referer
https://online.citi.com/GFC/branding/responsivebranding/css/main_branding.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

strict-transport-security
max-age=300
last-modified
Thu, 27 Sep 2018 21:19:09 GMT
x-akamai-citisite
GTDC
date
Sun, 29 Mar 2020 00:37:43 GMT
p3p
policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
status
200
x-webkit-csp
frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
content-security-policy
frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
accept-ranges
bytes
content-type
image/png
content-length
3513
x-content-security-policy
frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
googlePlay_1px.png
online.citi.com/GFC/branding/responsivebranding/img/
4 KB
4 KB
Image
General
Full URL
https://online.citi.com/GFC/branding/responsivebranding/img/googlePlay_1px.png
Requested by
Host: ardacademy.org
URL: https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.109.92.187 , Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a104-109-92-187.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
1cc4ec61057f30cea6d47126e0444f119b2606720b1fe8d7e0deff1f5742a82b
Security Headers
Name Value
Content-Security-Policy frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
Strict-Transport-Security max-age=300
X-Content-Security-Policy frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

Request headers

Referer
https://online.citi.com/GFC/branding/responsivebranding/css/main_branding.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

strict-transport-security
max-age=300
last-modified
Thu, 27 Sep 2018 21:21:52 GMT
x-akamai-citisite
SWDC
date
Sun, 29 Mar 2020 00:37:43 GMT
p3p
policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
status
200
x-webkit-csp
frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
content-security-policy
frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
accept-ranges
bytes
content-type
image/png
content-length
3900
x-content-security-policy
frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
arrow-btn-next-white-sm-bold.svg
online.citi.com/CBOL/common/ui/ddl/theme/latest/images/icons/svgs/arrows/
918 B
997 B
Image
General
Full URL
https://online.citi.com/CBOL/common/ui/ddl/theme/latest/images/icons/svgs/arrows/arrow-btn-next-white-sm-bold.svg
Requested by
Host: ardacademy.org
URL: https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.109.92.187 , Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a104-109-92-187.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
4f918cd256712c03a1b88007176cabf623cc63740e919d35a217c18dc7ebe607
Security Headers
Name Value
Content-Security-Policy frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
Strict-Transport-Security max-age=300
X-Content-Security-Policy frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

Request headers

Referer
https://online.citi.com/loginpage/styles/homePage.min.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

strict-transport-security
max-age=300
content-encoding
gzip
last-modified
Tue, 12 Sep 2017 16:59:12 GMT
x-akamai-citisite
SWDC
date
Sun, 29 Mar 2020 00:37:43 GMT
vary
Accept-Encoding
p3p
policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
status
200
x-webkit-csp
frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
content-security-policy
frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
accept-ranges
bytes
content-type
image/svg+xml
content-length
496
x-content-security-policy
frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
oo_icon_retina.gif
online.citi.com/GFC/branding/olab/images/
2 KB
3 KB
Image
General
Full URL
https://online.citi.com/GFC/branding/olab/images/oo_icon_retina.gif
Requested by
Host: ardacademy.org
URL: https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.109.92.187 , Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a104-109-92-187.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
701d2f9f02741b8429f4fb892b2b48c34a8a0f9189cb09013b2799031f22e484
Security Headers
Name Value
Content-Security-Policy frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
Strict-Transport-Security max-age=300
X-Content-Security-Policy frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

Request headers

Referer
https://online.citi.com/GFC/branding/responsivebranding/css/main_branding.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

strict-transport-security
max-age=300
last-modified
Tue, 12 Sep 2017 16:59:12 GMT
x-akamai-citisite
SWDC
date
Sun, 29 Mar 2020 00:37:43 GMT
p3p
policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
status
200
x-webkit-csp
frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
content-security-policy
frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
accept-ranges
bytes
content-type
image/gif
content-length
2204
x-content-security-policy
frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
oo_engine.min.js
ardacademy.org/GFC/branding/olab/js/
0
0
Script
General
Full URL
https://ardacademy.org/GFC/branding/olab/js/oo_engine.min.js
Requested by
Host: ardacademy.org
URL: https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
35.229.76.23 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
23.76.229.35.bc.googleusercontent.com
Software
nginx /
Resource Hash

Request headers

Referer
https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

status
404
date
Sun, 29 Mar 2020 00:37:43 GMT
content-encoding
br
server
nginx
vary
Accept-Encoding, Accept-Encoding
content-type
text/html
ddl.min.js
ardacademy.org/CBOL/common/ui/ddl/theme/latest/scripts/
0
0
Script
General
Full URL
https://ardacademy.org/CBOL/common/ui/ddl/theme/latest/scripts/ddl.min.js
Requested by
Host: ardacademy.org
URL: https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
35.229.76.23 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
23.76.229.35.bc.googleusercontent.com
Software
nginx /
Resource Hash

Request headers

Referer
https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

status
404
date
Sun, 29 Mar 2020 00:37:43 GMT
content-encoding
br
server
nginx
vary
Accept-Encoding, Accept-Encoding
content-type
text/html
cr.png
cfr.us.v2.we-stats.com/api/v1/
4 B
375 B
XHR
General
Full URL
https://cfr.us.v2.we-stats.com/api/v1/cr.png?cid=cedric&snum=1585442263466-sjn0000572-86b731ad-6c4a-4fe2-904e-a516885d7550&muid=1585442263051-A8C330A6-6277-437C-864C-E966FF1E3348
Requested by
Host: ardacademy.org
URL: https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
40.122.110.249 Des Moines, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
nginx /
Resource Hash
74234e98afe7498fb5daf1f36ac2d78acc339464f950703b8c019892f982b90b

Request headers

Referer
https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
Origin
https://ardacademy.org
Sec-Fetch-Dest
empty
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma
no-cache
Date
Sun, 29 Mar 2020 00:37:43 GMT
Server
nginx
tail-id
8be6c01d-8239-49c8-96aa-359aec4af4e7
X-Kong-Proxy-Latency
0
Content-Type
application/json
access-control-allow-origin
*
X-Kong-Upstream-Latency
2
cache-control
no-cache, no-store
access-control-allow-credentials
true
Connection
keep-alive
Content-Length
4
main.js
ardacademy.org/GFC/branding/responsivebranding/js/
0
0
Script
General
Full URL
https://ardacademy.org/GFC/branding/responsivebranding/js/main.js
Requested by
Host: ardacademy.org
URL: https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
35.229.76.23 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
23.76.229.35.bc.googleusercontent.com
Software
nginx /
Resource Hash

Request headers

Referer
https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

status
404
date
Sun, 29 Mar 2020 00:37:43 GMT
content-encoding
br
server
nginx
vary
Accept-Encoding, Accept-Encoding
content-type
text/html
citilive-search.js
ardacademy.org/JEA/CitiSearch/nexus-platform/js/
0
0
Script
General
Full URL
https://ardacademy.org/JEA/CitiSearch/nexus-platform/js/citilive-search.js
Requested by
Host: ardacademy.org
URL: https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
35.229.76.23 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
23.76.229.35.bc.googleusercontent.com
Software
nginx /
Resource Hash

Request headers

Referer
https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

status
404
date
Sun, 29 Mar 2020 00:37:43 GMT
content-encoding
br
server
nginx
vary
Accept-Encoding, Accept-Encoding
content-type
text/html
cbol-smartSearch-inject.js
ardacademy.org/NCCS/smartSearch/js/
0
0
Script
General
Full URL
https://ardacademy.org/NCCS/smartSearch/js/cbol-smartSearch-inject.js
Requested by
Host: ardacademy.org
URL: https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
35.229.76.23 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
23.76.229.35.bc.googleusercontent.com
Software
nginx /
Resource Hash

Request headers

Referer
https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

status
404
date
Sun, 29 Mar 2020 00:37:43 GMT
content-encoding
br
server
nginx
vary
Accept-Encoding, Accept-Encoding
content-type
text/html
TMXProfiling.js
ardacademy.org/TMX/
0
0
Script
General
Full URL
https://ardacademy.org/TMX/TMXProfiling.js
Requested by
Host: ardacademy.org
URL: https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
35.229.76.23 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
23.76.229.35.bc.googleusercontent.com
Software
nginx /
Resource Hash

Request headers

Referer
https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

status
404
date
Sun, 29 Mar 2020 00:37:43 GMT
content-encoding
br
server
nginx
vary
Accept-Encoding, Accept-Encoding
content-type
text/html
cyss.js
cyseal.cyveillance.com/SiteSeal/
0
226 B
Script
General
Full URL
https://cyseal.cyveillance.com/SiteSeal/cyss.js?ref=ardacademy.org
Requested by
Host: cyseal.cyveillance.com
URL: https://cyseal.cyveillance.com/SiteSeal/siteseal2p.async.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.212.137.125 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-3-212-137-125.compute-1.amazonaws.com
Software
Apache/2.4.6 (Red Hat Enterprise Linux) OpenSSL/1.0.1e-fips mod_jk/1.2.40 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

Date
Sun, 29 Mar 2020 00:37:44 GMT
Server
Apache/2.4.6 (Red Hat Enterprise Linux) OpenSSL/1.0.1e-fips mod_jk/1.2.40
Connection
keep-alive
Content-Length
0
Content-Type
application/javascript
Cookie set dest5.html
citi.demdex.net/ Frame 4025
0
0
Document
General
Full URL
https://citi.demdex.net/dest5.html?d_nsid=0
Requested by
Host: ardacademy.org
URL: https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.154.151.160 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-54-154-151-160.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Host
citi.demdex.net
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
iframe
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site
cross-site
Sec-Fetch-Mode
navigate
Referer
https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
Accept-Encoding
gzip, deflate, br
Accept-Language
en-US
Cookie
demdex=35599368996475573450980521148147697708
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
iframe
Referer
https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd

Response headers

Accept-Ranges
bytes
Cache-Control
max-age=21600
Content-Encoding
gzip
Content-Type
text/html
Expires
Thu, 01 Jan 1970 00:00:00 GMT
Last-Modified
Wed, 18 Mar 2020 12:22:28 GMT
P3P
policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Pragma
no-cache
Set-Cookie
demdex=35599368996475573450980521148147697708;Path=/;Domain=.demdex.net;Expires=Fri, 25-Sep-2020 00:37:44 GMT;Max-Age=15552000;Secure;SameSite=None
Strict-Transport-Security
max-age=31536000; includeSubDomains
Vary
Accept-Encoding, User-Agent
X-TID
LNBK1IxIRMU=
Content-Length
2785
Connection
keep-alive
425466.html
sr.rlcdn.com/ Frame 32E4
0
0
Document
General
Full URL
https://sr.rlcdn.com/425466.html?es=80676&u=cc87838e4caaadeb999f06d0f97757adab8948ed
Requested by
Host: ardacademy.org
URL: https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
35.190.72.21 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
21.72.190.35.bc.googleusercontent.com
Software
/
Resource Hash

Request headers

:method
GET
:authority
sr.rlcdn.com
:scheme
https
:path
/425466.html?es=80676&u=cc87838e4caaadeb999f06d0f97757adab8948ed
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-dest
iframe
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
referer
https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
iframe
Referer
https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd

Response headers

status
204
date
Sun, 29 Mar 2020 00:37:44 GMT
via
1.1 google
alt-svc
clear
63068
stags.bluekai.com/site/ Frame 38CC
0
0
Document
General
Full URL
https://stags.bluekai.com/site/63068?ret=html&phint=language%3Denglish&phint=product%3D&phint=event&phint=category%3Dpre-login%20Sign%20on%20page&phint=page%3DCookied%20Username%20Password&phint=section1%3DPublic&phint=section2%3DSignOn&phint=section3%3D&phint=section4%3D&phint=bankappstatus&phint=productID&phint=__bk_t%3DOnline%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&phint=__bk_k%3Dbanking%2C%20citi%2C%20financial%20services%2C%20checking%20account%2C%20savings%20account%2C%20credit%20cards&phint=__bk_l%3Dhttps%3A%2F%2Fonline.citi.com%2FUS%2Flogin.do&phint=__bk_v%3D3.1.4&limit=10&r=50577286
Requested by
Host: ardacademy.org
URL: https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
23.45.237.36 , United States, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a23-45-237-36.deploy.static.akamaitechnologies.com
Software
/
Resource Hash

Request headers

Host
stags.bluekai.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
iframe
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site
cross-site
Sec-Fetch-Mode
navigate
Referer
https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
Accept-Encoding
gzip, deflate, br
Accept-Language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
iframe
Referer
https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd

Response headers

Content-Type
text/html
Content-Length
71
P3P
CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV", policyref="http://tags.bluekai.com/w3c/p3p.xml"
BK-Server
1bcc
Date
Sun, 29 Mar 2020 00:37:44 GMT
Connection
keep-alive
X-N
S
pp.html
cdn.pbbl.co/i/ Frame 45E4
0
0
Document
General
Full URL
https://cdn.pbbl.co/i/pp.html
Requested by
Host: ardacademy.org
URL: https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
143.204.202.100 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-202-100.fra53.r.cloudfront.net
Software
nginx/1.10.3 (Ubuntu) /
Resource Hash

Request headers

:method
GET
:authority
cdn.pbbl.co
:scheme
https
:path
/i/pp.html
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-dest
iframe
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
referer
https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
accept-encoding
gzip, deflate, br
accept-language
en-US
cookie
pp_uid=59e19afc-941e-4859-ade5-7f6803468ced
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
iframe
Referer
https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd

Response headers

status
200
content-type
text/html
server
nginx/1.10.3 (Ubuntu)
date
Sun, 29 Mar 2020 00:16:53 GMT
last-modified
Thu, 30 Jan 2020 18:07:58 GMT
content-encoding
gzip
vary
Accept-Encoding
x-cache
Hit from cloudfront
via
1.1 c714e4f593454d65f62cf3fecf756a4c.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA53-C1
x-amz-cf-id
1CHyj9GrdyfnCezfgR0g2I4CqJZKXgdwhVF42CzEGyfgxiwX8iL9KQ==
age
1251
activityi;dc_pre=CIaB5de4vugCFVniuwgduiAFdg;src=6260004;type=citih0;cat=citih00;qty=1;cost=1;ord=74583402463.05983;gtm=2od3i0;auiddc=505230407.1578884161;~oref=https%3A%2F%2Fonline.citi.com%2FUS%2F...
6260004.fls.doubleclick.net/ Frame C47B
Redirect Chain
  • https://6260004.fls.doubleclick.net/activityi;src=6260004;type=citih0;cat=citih00;qty=1;cost=1;ord=74583402463.05983;gtm=2od3i0;auiddc=505230407.1578884161;~oref=https%3A%2F%2Fonline.citi.com%2FUS%...
  • https://6260004.fls.doubleclick.net/activityi;dc_pre=CIaB5de4vugCFVniuwgduiAFdg;src=6260004;type=citih0;cat=citih00;qty=1;cost=1;ord=74583402463.05983;gtm=2od3i0;auiddc=505230407.1578884161;~oref=h...
0
0
Document
General
Full URL
https://6260004.fls.doubleclick.net/activityi;dc_pre=CIaB5de4vugCFVniuwgduiAFdg;src=6260004;type=citih0;cat=citih00;qty=1;cost=1;ord=74583402463.05983;gtm=2od3i0;auiddc=505230407.1578884161;~oref=https%3A%2F%2Fonline.citi.com%2FUS%2Flogin.do?
Requested by
Host: ardacademy.org
URL: https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.217.16.166 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra15s11-in-f166.1e100.net
Software
cafe /
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=21600
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

:method
GET
:authority
6260004.fls.doubleclick.net
:scheme
https
:path
/activityi;dc_pre=CIaB5de4vugCFVniuwgduiAFdg;src=6260004;type=citih0;cat=citih00;qty=1;cost=1;ord=74583402463.05983;gtm=2od3i0;auiddc=505230407.1578884161;~oref=https%3A%2F%2Fonline.citi.com%2FUS%2Flogin.do?
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-dest
iframe
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
referer
https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
accept-encoding
gzip, deflate, br
accept-language
en-US
cookie
IDE=AHWqTUm3-vAAabXpRgvS6RVzRV0_Yd8bSk2SipP4qW0RJsiRPplzQcGYt73FQFdP
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
iframe
Referer
https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd

Response headers

status
200
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin
*
date
Sun, 29 Mar 2020 00:37:44 GMT
expires
Sun, 29 Mar 2020 00:37:44 GMT
cache-control
private, max-age=0
strict-transport-security
max-age=21600
content-type
text/html; charset=UTF-8
x-content-type-options
nosniff
content-encoding
gzip
server
cafe
content-length
343
x-xss-protection
0
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000

Redirect headers

status
302
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin
*
date
Sun, 29 Mar 2020 00:37:44 GMT
pragma
no-cache
expires
Fri, 01 Jan 1990 00:00:00 GMT
cache-control
no-cache, must-revalidate
follow-only-when-prerender-shown
1
strict-transport-security
max-age=21600
location
https://6260004.fls.doubleclick.net/activityi;dc_pre=CIaB5de4vugCFVniuwgduiAFdg;src=6260004;type=citih0;cat=citih00;qty=1;cost=1;ord=74583402463.05983;gtm=2od3i0;auiddc=505230407.1578884161;~oref=https%3A%2F%2Fonline.citi.com%2FUS%2Flogin.do?
content-type
text/html; charset=UTF-8
x-content-type-options
nosniff
server
cafe
content-length
0
x-xss-protection
0
set-cookie
IDE=AHWqTUm3-vAAabXpRgvS6RVzRV0_Yd8bSk2SipP4qW0RJsiRPplzQcGYt73FQFdP; expires=Fri, 23-Apr-2021 00:37:44 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none test_cookie=; domain=.doubleclick.net; path=/; expires=Mon, 21 Jul 2008 23:59:00 GMT; SameSite=none; Secure
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
pixel
bid.g.doubleclick.net/xbbe/ Frame 4074
0
0
Document
General
Full URL
https://bid.g.doubleclick.net/xbbe/pixel?d=KAE
Requested by
Host: ardacademy.org
URL: https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
108.177.15.157 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
wr-in-f157.1e100.net
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

:method
GET
:authority
bid.g.doubleclick.net
:scheme
https
:path
/xbbe/pixel?d=KAE
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-dest
iframe
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
referer
https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
accept-encoding
gzip, deflate, br
accept-language
en-US
cookie
test_cookie=CheckForPermission
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
iframe
Referer
https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd

Response headers

status
200
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin
*
content-type
text/html; charset=UTF-8
x-content-type-options
nosniff
date
Sun, 29 Mar 2020 00:37:44 GMT
server
cafe
content-length
0
x-xss-protection
0
set-cookie
test_cookie=; domain=.doubleclick.net; path=/; expires=Mon, 21 Jul 2008 23:59:00 GMT; SameSite=none; Secure IDE=AHWqTUl-kii7wCSKocNr7ovT36FiPYPJszuPPFJgGegpcCYRRkKAUln73VIZnlyq; expires=Fri, 23-Apr-2021 00:37:44 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
expires
Sun, 29 Mar 2020 00:37:44 GMT
cache-control
private
pixel
bid.g.doubleclick.net/xbbe/ Frame 6F19
0
0
Document
General
Full URL
https://bid.g.doubleclick.net/xbbe/pixel?d=KAE
Requested by
Host: ardacademy.org
URL: https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
108.177.15.157 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
wr-in-f157.1e100.net
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

:method
GET
:authority
bid.g.doubleclick.net
:scheme
https
:path
/xbbe/pixel?d=KAE
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-dest
iframe
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
referer
https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
accept-encoding
gzip, deflate, br
accept-language
en-US
cookie
test_cookie=CheckForPermission
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
iframe
Referer
https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd

Response headers

status
200
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin
*
content-type
text/html; charset=UTF-8
x-content-type-options
nosniff
date
Sun, 29 Mar 2020 00:37:44 GMT
server
cafe
content-length
0
x-xss-protection
0
set-cookie
test_cookie=; domain=.doubleclick.net; path=/; expires=Mon, 21 Jul 2008 23:59:00 GMT; SameSite=none; Secure IDE=AHWqTUkvUlUG_NvdBqOD4r0Kov58FavXJoAvNFjNUi5RH16iGskk3juusZ8XHp9D; expires=Fri, 23-Apr-2021 00:37:44 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
expires
Sun, 29 Mar 2020 00:37:44 GMT
cache-control
private
pixel
bid.g.doubleclick.net/xbbe/ Frame 81D4
0
0
Document
General
Full URL
https://bid.g.doubleclick.net/xbbe/pixel?d=KAE
Requested by
Host: ardacademy.org
URL: https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
108.177.15.157 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
wr-in-f157.1e100.net
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

:method
GET
:authority
bid.g.doubleclick.net
:scheme
https
:path
/xbbe/pixel?d=KAE
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-dest
iframe
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
referer
https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
accept-encoding
gzip, deflate, br
accept-language
en-US
cookie
test_cookie=CheckForPermission
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
iframe
Referer
https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd

Response headers

status
200
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin
*
content-type
text/html; charset=UTF-8
x-content-type-options
nosniff
date
Sun, 29 Mar 2020 00:37:44 GMT
server
cafe
content-length
0
x-xss-protection
0
set-cookie
test_cookie=; domain=.doubleclick.net; path=/; expires=Mon, 21 Jul 2008 23:59:00 GMT; SameSite=none; Secure IDE=AHWqTUmrrs7isgknDQ08tZEC3CQaRYm9_mktWK5dvETMQcuqOeeTscqPjiR1_obP; expires=Fri, 23-Apr-2021 00:37:44 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
expires
Sun, 29 Mar 2020 00:37:44 GMT
cache-control
private
pixel
bid.g.doubleclick.net/xbbe/ Frame 6820
0
0
Document
General
Full URL
https://bid.g.doubleclick.net/xbbe/pixel?d=KAE
Requested by
Host: ardacademy.org
URL: https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
108.177.15.157 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
wr-in-f157.1e100.net
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

:method
GET
:authority
bid.g.doubleclick.net
:scheme
https
:path
/xbbe/pixel?d=KAE
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-dest
iframe
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
referer
https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
accept-encoding
gzip, deflate, br
accept-language
en-US
cookie
test_cookie=CheckForPermission
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
iframe
Referer
https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd

Response headers

status
200
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin
*
content-type
text/html; charset=UTF-8
x-content-type-options
nosniff
date
Sun, 29 Mar 2020 00:37:44 GMT
server
cafe
content-length
0
x-xss-protection
0
set-cookie
test_cookie=; domain=.doubleclick.net; path=/; expires=Mon, 21 Jul 2008 23:59:00 GMT; SameSite=none; Secure IDE=AHWqTUkTKaiikoNlItoo1OL8Zfje4apqx1RFZh2i5MkMahussj7kioEZ8LhQBRJO; expires=Fri, 23-Apr-2021 00:37:44 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
expires
Sun, 29 Mar 2020 00:37:44 GMT
cache-control
private
pixel
bid.g.doubleclick.net/xbbe/ Frame 6515
0
0
Document
General
Full URL
https://bid.g.doubleclick.net/xbbe/pixel?d=KAE
Requested by
Host: ardacademy.org
URL: https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
108.177.15.157 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
wr-in-f157.1e100.net
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

:method
GET
:authority
bid.g.doubleclick.net
:scheme
https
:path
/xbbe/pixel?d=KAE
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-dest
iframe
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
referer
https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
accept-encoding
gzip, deflate, br
accept-language
en-US
cookie
test_cookie=CheckForPermission
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
iframe
Referer
https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd

Response headers

status
200
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin
*
content-type
text/html; charset=UTF-8
x-content-type-options
nosniff
date
Sun, 29 Mar 2020 00:37:44 GMT
server
cafe
content-length
0
x-xss-protection
0
set-cookie
test_cookie=; domain=.doubleclick.net; path=/; expires=Mon, 21 Jul 2008 23:59:00 GMT; SameSite=none; Secure IDE=AHWqTUnWrdlw7NmK3LPQAHxikqqdENLp3Rdcjus1Y5Sczyfe9AsLKm3hFbu7ZOn2; expires=Fri, 23-Apr-2021 00:37:44 GMT; path=/; domain=.doubleclick.net; Secure; HttpOnly; SameSite=none
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
expires
Sun, 29 Mar 2020 00:37:44 GMT
cache-control
private
up
insight.adsrvr.org/track/ Frame 6A38
0
0
Document
General
Full URL
https://insight.adsrvr.org/track/up?adv=1jw5cvl&ref=https%3A%2F%2Fonline.citi.com%2FUS%2Flogin.do&upid=t1sl5ty&upv=1.1.0&orderid={orderid}&v={v}&vf={vf}&td1=jUSCBOL_Loginpage_Cookied&td2=undefined&td3=undefined&td4=Cookied%20Username%20Password&td5=https://online.citi.com/US/login.do&td6={td6}&td7={td7}&td8={td8}&td9={td9}&td10={td10}
Requested by
Host: ardacademy.org
URL: https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.76.69.10 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-54-76-69-10.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash

Request headers

:method
GET
:authority
insight.adsrvr.org
:scheme
https
:path
/track/up?adv=1jw5cvl&ref=https%3A%2F%2Fonline.citi.com%2FUS%2Flogin.do&upid=t1sl5ty&upv=1.1.0&orderid={orderid}&v={v}&vf={vf}&td1=jUSCBOL_Loginpage_Cookied&td2=undefined&td3=undefined&td4=Cookied%20Username%20Password&td5=https://online.citi.com/US/login.do&td6={td6}&td7={td7}&td8={td8}&td9={td9}&td10={td10}
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-dest
iframe
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
referer
https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
iframe
Referer
https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd

Response headers

status
200
date
Sun, 29 Mar 2020 00:37:44 GMT
content-type
text/html
cache-control
private,no-cache, must-revalidate
pragma
no-cache
x-aspnet-version
4.0.30319
p3p
CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
snare.js
mpsnare.iesnare.com/
38 KB
13 KB
Script
General
Full URL
https://mpsnare.iesnare.com/snare.js?_=1585442262955
Requested by
Host: online.citi.com
URL: https://online.citi.com/CBOL/common/ui/ddl/theme/latest/scripts/vendor.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.129.74.13 , United States, ASN395492 (IOVATION3, US),
Reverse DNS
mpsnare.iesnare.com
Software
nginx /
Resource Hash
4dcaf45c24f68f1e0b0007e72e3aa48fa417791740d2115cf7af1ba7f5c55571
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains

Request headers

Referer
https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

Pragma
no-cache
Date
Sun, 29 Mar 2020 00:37:44 GMT
Content-Encoding
gzip
Server
nginx
Strict-Transport-Security
max-age=15552000; includeSubDomains
p3p
CP="NON DSP COR CURa"
Cache-Control
no-cache, private
Transfer-Encoding
chunked
Connection
keep-alive
Content-Type
text/javascript; charset=utf-8
Expires
0
close.svg
online.citi.com/CBOL/common/ui/ddl/theme/latest/images/icons/svgs/
1 KB
1 KB
Image
General
Full URL
https://online.citi.com/CBOL/common/ui/ddl/theme/latest/images/icons/svgs/close.svg
Requested by
Host: online.citi.com
URL: https://online.citi.com/CBOL/common/ui/ddl/theme/latest/scripts/vendor.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.109.92.187 , Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a104-109-92-187.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
55e066703c69d4d89a1f4d66794d474aa93d710624d8f807096bac17a7867b17
Security Headers
Name Value
Content-Security-Policy frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
Strict-Transport-Security max-age=300
X-Content-Security-Policy frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

Request headers

Referer
https://online.citi.com/CBOL/common/ui/ddl/theme/latest/styles/ddl.min.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

strict-transport-security
max-age=300
content-encoding
gzip
last-modified
Tue, 12 Sep 2017 16:59:12 GMT
x-akamai-citisite
SWDC
date
Sun, 29 Mar 2020 00:37:44 GMT
vary
Accept-Encoding
p3p
policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
status
200
x-webkit-csp
frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
content-security-policy
frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
accept-ranges
bytes
content-type
image/svg+xml
content-length
641
x-content-security-policy
frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
idr.js
a.rfihub.com/
83 B
686 B
Script
General
Full URL
https://a.rfihub.com/idr.js?_callback=window.RocketfuelBCP.jsonpCallbacks.request_cmZpSWRJbkNhY2hl
Requested by
Host: c1.rfihub.net
URL: https://c1.rfihub.net/js/tc.min.js
Protocol
HTTP/1.1
Security
TLS 1.2, RSA, AES_256_CBC
Server
185.31.128.129 , Netherlands, ASN54312 (ROCKETFUEL, US),
Reverse DNS
Software
Jetty(9.0.6.v20130930) /
Resource Hash
ba74f7ef0a30f98952d47695239f892f41936959a479cfdaa33d7db58291fe3e

Request headers

Referer
https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

Expires
Fri, 23 Apr 2021 00:37:44 GMT
Cache-Control
public, max-age=33696000
Server
Jetty(9.0.6.v20130930)
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Content-Length
83
Content-Type
application/javascript
__cool.gif
udc-neb.kampyle.com/egw/5/qceuv8449dzg58ptt1bhda9g8ue19c7s/track/
0
321 B
Image
General
Full URL
https://udc-neb.kampyle.com/egw/5/qceuv8449dzg58ptt1bhda9g8ue19c7s/track/__cool.gif?data=eyJldmVudHMiOiBbCiAgICB7InNlc3Npb25fc2NyZWVuX3NpemUiOiAiMTYwMHgxMjAwIiwic2Vzc2lvbl9kdWEiOiAiTW96aWxsYS81LjAgKE1hY2ludG9zaDsgSW50ZWwgTWFjIE9TIFggMTBfMTRfNSkgQXBwbGVXZWJLaXQvNTM3LjM2IChLSFRNTCwgbGlrZSBHZWNrbykgQ2hyb21lLzc0LjAuMzcyOS4xNjkgU2FmYXJpLzUzNy4zNiIsInNlc3Npb25fcGxhdGZvcm0iOiAiTGludXggeDg2XzY0IiwidHJhY2tlcl90eXBlIjogImphdmFzY3JpcHQiLCJ0cmFja2VyX3ZlcnNpb24iOiAiMi4xLjE1IiwiZXZlbnRfbmFtZSI6ICJuZWJ1bGFfcGFnZV92aWV3IiwiZXZlbnRfdGltZXN0YW1wX2Vwb2NoIjogIjE1ODU0NDIyNjQyNTYiLCJldmVudF90aW1lem9uZV9vZmZzZXQiOiAxLCJ1c2VyX2lkIjogIjE3MTIzYjkxNGJlZjY3LTAzYjcwZWRkZDJkZDU3LTM3NjQ3ZTAzLTFkNGMwMC0xNzEyM2I5MTRiZmU1MiIsImVudmlyb21lbnQiOiAiZGlnaXRhbC1jbG91ZC11cy1jaXRpIiwiYWNjb3VudElkIjogNDksInVybCI6ICJodHRwczovL2FyZGFjYWRlbXkub3JnL3dwLWNvbnRlbnQvY2MvP2VtbD1qYXNoeWVAbWFpbC5uYXNkIiwid2Vic2l0ZUlkIjogNTAsImZlZWRiYWNrX3V1aWQiOiBudWxsLCJmb3JtSWQiOiBudWxsLCJmb3JtVHJpZ2dlclR5cGUiOiBudWxsLCJrYW1weWxlX2RhdGEiOiB7IkxBU1RfSU5WSVRBVElPTl9WSUVXIjogIiIsIkRFQ0xJTkVEX0RBVEUiOiAiIiwia2FtcHlsZUludml0ZVByZXNlbnRlZCI6ICIiLCJrYW1weWxlX3VzZXJpZCI6ICI0NTY5LTIzYzEtNDFkYi00ZWVmLTRhNzEtODhjMy00NDRlLTkxYTgiLCJrYW1weWxlVXNlclNlc3Npb24iOiAiMTU4NTQ0MjI2NDE3NyIsImthbXB5bGVVc2VyUGVyY2VudGlsZSI6ICIiLCJTVUJNSVRURURfREFURSI6ICIifSwiY29va2llX3NpemUiOiAxMDc4LCJrYW1weWxlX3ZlcnNpb24iOiAiMC4wLjAuMCIsImhpc3RvcnlfbGVuZ3RoIjogMiwiZXZlbnRfbG9jYWxfdGltZXN0YW1wIjogMTU4NTQ0MjI2NDE3OSwicG9zaXRpb24iOiBudWxsLCJpc1VzZXJJZGVudGlmaWVkIjogZmFsc2V9Cl19
Requested by
Host: ardacademy.org
URL: https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.241.45.82 , Ascension Island, ASN15169 (GOOGLE, US),
Reverse DNS
82.45.241.35.bc.googleusercontent.com
Software
Jetty(9.2.11.v20150529) /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

x-me
prod-instance-gatewayservice-green-6q82
date
Sun, 29 Mar 2020 00:37:44 GMT
via
1.1 google
alt-svc
clear
server
Jetty(9.2.11.v20150529)
access-control-allow-origin
*
access-control-max-age
1800
access-control-allow-methods
GET, POST, PUT, DELETE
content-type
image/gif; charset=UTF-8
status
200
access-control-allow-credentials
true
access-control-allow-headers
X-Requested-With, Origin, Content-Type, Accept
content-length
0
x-application-context
application:9090
Cookie set ca.html
20766699p.rfihub.com/ Frame F5B8
0
0
Document
General
Full URL
https://20766699p.rfihub.com/ca.html?rfiidc=1870471594818999025&rfiaid=9f17482743f54dc7ab409dcc8ec420ad&ver=9&ra=491&rb=648&ca=20766699&_o=17169175&_t=cookiedusernamepassword&ssv_cuuid=&ssv_pagename=cookiedusernamepassword&pe=https%3A%2F%2Fardacademy.org%2Fwp-content%2Fcc%2F%3Feml%3Djashye%40mail.nasd&pf=&ra=1180621879186321
Requested by
Host: c1.rfihub.net
URL: https://c1.rfihub.net/js/tc.min.js
Protocol
HTTP/1.1
Security
TLS 1.2, RSA, AES_256_CBC
Server
185.31.128.129 , Netherlands, ASN54312 (ROCKETFUEL, US),
Reverse DNS
Software
Jetty(9.0.6.v20130930) /
Resource Hash

Request headers

Host
20766699p.rfihub.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
iframe
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site
cross-site
Sec-Fetch-Mode
navigate
Referer
https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
Accept-Encoding
gzip, deflate, br
Accept-Language
en-US
Cookie
ruds=H4sIAAAAAAAAAOMSNrQwNzAxNzS1NLEwtLC0tDQwMhXiM9TNKItycg0tzigrykkHAFb0sywlAAAA; rud=H4sIAAAAAAAAAOMSNrQwNzAxNzS1NLEwtLC0tDQwMhXiM9TNKItycg0tzigrykmX4jU0tTA1MTEyMjM2tDQFAF7UFmc0AAAA
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
iframe
Referer
https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd

Response headers

P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Set-Cookie
ruds=H4sIAAAAAAAAAOMSNrQwNzAxNzS1NLEwtLC0tDQwMhXiM9TNKItycg0tzigrykkHAFb0sywlAAAA; Path=/; Domain=.rfihub.com; Secure; SameSite=None rud=H4sIAAAAAAAAAOMSNrQwNzAxNzS1NLEwtLC0tDQwMhXiM9TNKItycg0tzigrykmX4jU0tTA1MTEyMjM2tDQFAF7UFmc0AAAA; Path=/; Domain=.rfihub.com; Expires=Fri, 23 Apr 2021 00:37:44 GMT; Secure; SameSite=None
Cache-Control
no-cache
Content-Type
text/html
Content-Encoding
gzip
Vary
Accept-Encoding, User-Agent
Transfer-Encoding
chunked
Server
Jetty(9.0.6.v20130930)
up_loader.1.1.0.js
js.adsrvr.org/
4 KB
4 KB
Script
General
Full URL
https://js.adsrvr.org/up_loader.1.1.0.js
Requested by
Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
143.204.207.113 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-207-113.fra53.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
0615974c40d602afdbf9759533e352bc17b0458c85aad6694b1a1ad20659625b

Request headers

Referer
https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

Date
Sat, 28 Mar 2020 21:05:37 GMT
Via
1.1 1cc446ef4692d8e752b16c07f2f58a59.cloudfront.net (CloudFront)
Last-Modified
Mon, 13 Jan 2020 19:16:48 GMT
Server
AmazonS3
Age
20531
ETag
"45bb7a1f2878be0c29077f7329fca766"
Vary
Accept-Encoding
X-Cache
Hit from cloudfront
Content-Type
application/x-javascript
X-Amz-Cf-Pop
FRA53-C1
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
4091
X-Amz-Cf-Id
MzoiMov8eZl18BCemWwD2BVV9JFcYcDspTppUA27pbsh-keint-IbA==
js
www.googletagmanager.com/gtag/
74 KB
28 KB
Script
General
Full URL
https://www.googletagmanager.com/gtag/js?id=AW-959299794
Requested by
Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:808::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
920a1269c4469182796fcaef9661e4a89fd9667ae24fa5e70b16317a020f3062
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

Referer
https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

date
Sun, 29 Mar 2020 00:37:44 GMT
content-encoding
br
status
200
strict-transport-security
max-age=31536000; includeSubDomains
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length
28423
x-xss-protection
0
last-modified
Sun, 29 Mar 2020 00:00:00 GMT
server
Google Tag Manager
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
http://www.googletagmanager.com
cache-control
private, max-age=900
access-control-allow-credentials
true
access-control-allow-headers
Cache-Control
expires
Sun, 29 Mar 2020 00:37:44 GMT
activityi;dc_pre=COPA9Ne4vugCFVTDuwgdVpsIEA;src=6260004;type=citih0;cat=citih00;qty=1;cost=1;ord=9577860299563.918;gtm=2od3i0;auiddc=1507464551.1585442264;~oref=https%3A%2F%2Fardacademy.org%2Fwp-co...
6260004.fls.doubleclick.net/ Frame 0076
Redirect Chain
  • https://6260004.fls.doubleclick.net/activityi;src=6260004;type=citih0;cat=citih00;qty=1;cost=1;ord=9577860299563.918;gtm=2od3i0;auiddc=1507464551.1585442264;~oref=https%3A%2F%2Fardacademy.org%2Fwp-...
  • https://6260004.fls.doubleclick.net/activityi;dc_pre=COPA9Ne4vugCFVTDuwgdVpsIEA;src=6260004;type=citih0;cat=citih00;qty=1;cost=1;ord=9577860299563.918;gtm=2od3i0;auiddc=1507464551.1585442264;~oref=...
0
0
Document
General
Full URL
https://6260004.fls.doubleclick.net/activityi;dc_pre=COPA9Ne4vugCFVTDuwgdVpsIEA;src=6260004;type=citih0;cat=citih00;qty=1;cost=1;ord=9577860299563.918;gtm=2od3i0;auiddc=1507464551.1585442264;~oref=https%3A%2F%2Fardacademy.org%2Fwp-content%2Fcc%2F%3Feml%3Djashye%40mail.nasd?
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=DC-6260004
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.217.16.166 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra15s11-in-f166.1e100.net
Software
cafe /
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=21600
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

:method
GET
:authority
6260004.fls.doubleclick.net
:scheme
https
:path
/activityi;dc_pre=COPA9Ne4vugCFVTDuwgdVpsIEA;src=6260004;type=citih0;cat=citih00;qty=1;cost=1;ord=9577860299563.918;gtm=2od3i0;auiddc=1507464551.1585442264;~oref=https%3A%2F%2Fardacademy.org%2Fwp-content%2Fcc%2F%3Feml%3Djashye%40mail.nasd?
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-dest
iframe
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
referer
https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
accept-encoding
gzip, deflate, br
accept-language
en-US
cookie
IDE=AHWqTUm3-vAAabXpRgvS6RVzRV0_Yd8bSk2SipP4qW0RJsiRPplzQcGYt73FQFdP
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
iframe
Referer
about:blank

Response headers

status
200
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin
*
date
Sun, 29 Mar 2020 00:37:44 GMT
expires
Sun, 29 Mar 2020 00:37:44 GMT
cache-control
private, max-age=0
strict-transport-security
max-age=21600
content-type
text/html; charset=UTF-8
x-content-type-options
nosniff
content-encoding
gzip
server
cafe
content-length
370
x-xss-protection
0
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000

Redirect headers

status
302
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin
*
date
Sun, 29 Mar 2020 00:37:44 GMT
pragma
no-cache
expires
Fri, 01 Jan 1990 00:00:00 GMT
cache-control
no-cache, must-revalidate
follow-only-when-prerender-shown
1
strict-transport-security
max-age=21600
location
https://6260004.fls.doubleclick.net/activityi;dc_pre=COPA9Ne4vugCFVTDuwgdVpsIEA;src=6260004;type=citih0;cat=citih00;qty=1;cost=1;ord=9577860299563.918;gtm=2od3i0;auiddc=1507464551.1585442264;~oref=https%3A%2F%2Fardacademy.org%2Fwp-content%2Fcc%2F%3Feml%3Djashye%40mail.nasd?
content-type
text/html; charset=UTF-8
x-content-type-options
nosniff
server
cafe
content-length
0
x-xss-protection
0
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
tc.min.js
c1.rfihub.net/js/
20 KB
7 KB
Script
General
Full URL
https://c1.rfihub.net/js/tc.min.js
Requested by
Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/code/d136239f021c14bd86738c333b8132f8.js?conditionId0=462132
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.38.48.101 , Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a23-38-48-101.deploy.static.akamaitechnologies.com
Software
Jetty(9.0.6.v20130930) /
Resource Hash
cb2bb21705b9cce9781d02c9223f3344a65bd5314027d11c5a8518ad4bd84e84

Request headers

Referer
https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

Date
Sun, 29 Mar 2020 00:37:44 GMT
Content-Encoding
gzip
Last-Modified
Wed, 24 Jul 2019 06:34:16 GMT
Server
Jetty(9.0.6.v20130930)
Vary
Accept-Encoding
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Cache-Control
public, max-age=3600
Connection
keep-alive
Content-Type
application/x-javascript
Content-Length
6375
Expires
Sun, 29 Mar 2020 01:37:44 GMT
1560.js
cdn.pbbl.co/r/
33 KB
9 KB
Script
General
Full URL
https://cdn.pbbl.co/r/1560.js
Requested by
Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/code/8637af7c210f4e79436bc39f71b49bfa.js?conditionId0=4827153
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
143.204.202.100 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-202-100.fra53.r.cloudfront.net
Software
nginx/1.10.3 (Ubuntu) /
Resource Hash
8e60e8edaca8a3167fe48e62f9b53ba1989a5b6a23283555f09ab12175fed96e
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Xss-Protection 1

Request headers

Referer
https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

strict-transport-security
max-age=31536000
content-encoding
gzip
age
1254
x-cache
Hit from cloudfront
status
200
x-xss-protection
1
last-modified
Tue, 03 Mar 2020 17:36:15 GMT
server
nginx/1.10.3 (Ubuntu)
date
Sun, 29 Mar 2020 00:16:50 GMT
vary
Accept-Encoding
content-type
application/javascript
via
1.1 c714e4f593454d65f62cf3fecf756a4c.cloudfront.net (CloudFront)
cache-control
max-age=1800, public
x-amz-cf-pop
FRA53-C1
x-amz-cf-id
sqyPnoXoPX7Fg4-_JYDSra0r1KZ8jW5okbaHyLNoc1FIyD7182Aauw==
expires
Sun, 29 Mar 2020 00:46:50 GMT
425466.html
sr.rlcdn.com/ Frame D567
0
0
Document
General
Full URL
https://sr.rlcdn.com/425466.html?es=80676&u=da39a3ee5e6b4b0d3255bfef95601890afd80709
Requested by
Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/code/98eab123fd6eeaefc94916fb10ff0a06.js?conditionId0=467299
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
35.190.72.21 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
21.72.190.35.bc.googleusercontent.com
Software
/
Resource Hash

Request headers

:method
GET
:authority
sr.rlcdn.com
:scheme
https
:path
/425466.html?es=80676&u=da39a3ee5e6b4b0d3255bfef95601890afd80709
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-dest
iframe
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
referer
https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
iframe
Referer
https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd

Response headers

status
204
date
Sun, 29 Mar 2020 00:37:44 GMT
via
1.1 google
alt-svc
clear
/
d.agkn.com/pixel/9340/
43 B
592 B
Image
General
Full URL
https://d.agkn.com/pixel/9340/?che=8200620495.243116&abid=undefined
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:9000:214f:a800:19:fc2c:a140:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Apache-Coyote/1.1 /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer
https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

pragma
no-cache
date
Sun, 29 Mar 2020 00:37:44 GMT
via
1.1 16dc09493f48bbc1fd2cdd6e175a94f7.cloudfront.net (CloudFront)
server
Apache-Coyote/1.1
x-amz-cf-pop
FRA53-C1
x-cache
Miss from cloudfront
p3p
CP="NOI DSP COR CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
status
200
cache-control
no-cache, must-revalidate
content-type
image/gif
content-length
43
x-amz-cf-id
INMSN-rklNb-urWNJ1uoNL0G_-YfiP8VV_vLgxbBD5tufeK0rxvtLQ==
expires
Sat, 01 Jan 2000 00:00:00 GMT
src=8825552;dc_pre=CLWio9i4vugCFdSKdwodgp4K7g;type=invmedia;cat=citio0;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;ord=1
adservice.google.com/ddm/fls/z/
Redirect Chain
  • https://gwmtracking.com/p/v/1/5c54c477f870814b6fd57129/format/img
  • https://ad.doubleclick.net/ddm/activity/src=8825552;type=invmedia;cat=citio0;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;ord=1?
  • https://ad.doubleclick.net/ddm/activity/src=8825552;dc_pre=CLWio9i4vugCFdSKdwodgp4K7g;type=invmedia;cat=citio0;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;ord=1?
  • https://adservice.google.com/ddm/fls/z/src=8825552;dc_pre=CLWio9i4vugCFdSKdwodgp4K7g;type=invmedia;cat=citio0;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;ord=1
42 B
109 B
Image
General
Full URL
https://adservice.google.com/ddm/fls/z/src=8825552;dc_pre=CLWio9i4vugCFdSKdwodgp4K7g;type=invmedia;cat=citio0;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;ord=1
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81c::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma
no-cache
date
Sun, 29 Mar 2020 00:37:45 GMT
x-content-type-options
nosniff
content-type
image/gif
server
cafe
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
cache-control
no-cache, must-revalidate
timing-allow-origin
*
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma
no-cache
date
Sun, 29 Mar 2020 00:37:45 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
location
https://adservice.google.com/ddm/fls/z/src=8825552;dc_pre=CLWio9i4vugCFdSKdwodgp4K7g;type=invmedia;cat=citio0;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;ord=1
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status
302
cache-control
no-cache, must-revalidate
content-type
text/html; charset=UTF-8
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length
0
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
tr
www.facebook.com/
44 B
258 B
Image
General
Full URL
https://www.facebook.com/tr?id=313693532491635&ev=PageView&cd[order_id]=undefined
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f12d:83:face:b00c:0:25de , Ireland, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
proxygen-bolt /
Resource Hash
10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Referer
https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

date
Sun, 29 Mar 2020 00:37:44 GMT, Sun, 29 Mar 2020 00:37:44 GMT
last-modified
Fri, 21 Dec 2012 00:00:01 GMT
server
proxygen-bolt
strict-transport-security
max-age=31536000; includeSubDomains
content-type
image/gif
status
200
cache-control
no-cache, must-revalidate, max-age=0
alt-svc
h3-27=":443"; ma=3600
content-length
44
expires
Sun, 29 Mar 2020 00:37:44 GMT
TC-3498-2.gif
pt.ispot.tv/v2/
43 B
315 B
Image
General
Full URL
https://pt.ispot.tv/v2/TC-3498-2.gif?app=web&type=citi
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.114.109 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
0227e0e4dea130eb6f3163aa3ab03720dce83a0e219c282189b03bc5b8a727e3

Request headers

Referer
https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

pragma
no-cache
date
Sun, 29 Mar 2020 00:37:44 GMT
content-type
image/gif
status
200
cache-control
no-cache, no-store, must-revalidate
accept-ranges
bytes
content-length
43
expires
0
check.js;CIS3SID=CB9CBD87942D7948E5F9FBE01E0E5A9B
content22.online.citi.com/fp/ Frame 3C71
173 KB
44 KB
Script
General
Full URL
https://content22.online.citi.com/fp/check.js;CIS3SID=CB9CBD87942D7948E5F9FBE01E0E5A9B?org_id=89oebq5k&session_id=9646094ba7b58acb03dad3f75e50dcf29574f85b76dd9ada42ddaf7cafc1207c&nonce=1d35291145502344&pageid=1&jb=3b3526246a7b6f773d4e6b6e7d782468736d3d4c696c777a266a73623d416a70676d672530383736
Requested by
Host: content22.online.citi.com
URL: https://content22.online.citi.com/fp/tags.js?org_id=89oebq5k&session_id=9646094ba7b58acb03dad3f75e50dcf29574f85b76dd9ada42ddaf7cafc1207c&allow_reprofile=1
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
91.235.134.21 , Netherlands, ASN30286 (THM, US),
Reverse DNS
Software
Apache /
Resource Hash
297c569cc74fa320e70736aaab738141d85c5c9d383fc26dc07beec92dd3b55d
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

Pragma
no-cache
Date
Sun, 29 Mar 2020 00:37:44 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Server
Apache
Strict-Transport-Security
max-age=31536000
Content-Type
text/javascript;charset=UTF-8
Cache-Control
no-cache, no-store, must-revalidate
Transfer-Encoding
chunked
tmx-nonce
1d35291145502344
Connection
Keep-Alive, Keep-Alive
Vary
Accept-Encoding
X-XSS-Protection
1; mode=block
Keep-Alive
timeout=2, max=99
Expires
Thu, 01 Jan 1970 00:00:00 GMT
clear.png
content22.online.citi.com/fp/ Frame 3C71
81 B
475 B
Image
General
Full URL
https://content22.online.citi.com/fp/clear.png?org_id=89oebq5k&session_id=9646094ba7b58acb03dad3f75e50dcf29574f85b76dd9ada42ddaf7cafc1207c&nonce=1d35291145502344&pageid=1&w=cd262e4d67eff5ce&ck=0&m=1
Requested by
Host: content22.online.citi.com
URL: https://content22.online.citi.com/fp/tags.js?org_id=89oebq5k&session_id=9646094ba7b58acb03dad3f75e50dcf29574f85b76dd9ada42ddaf7cafc1207c&allow_reprofile=1
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
91.235.134.21 , Netherlands, ASN30286 (THM, US),
Reverse DNS
Software
Apache /
Resource Hash
95518cbec0d55a574a9c8ef72a2a7d62ac0d40a4de5dfe67a76a7d214dc8b743
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

Pragma
no-cache
Date
Sun, 29 Mar 2020 00:37:44 GMT
X-Content-Type-Options
nosniff
Server
Apache
Strict-Transport-Security
max-age=31536000
Content-Type
image/png
Cache-Control
no-cache, no-store, must-revalidate
Connection
Keep-Alive
Keep-Alive
timeout=2, max=100
Content-Length
81
X-XSS-Protection
1; mode=block
Expires
Thu, 01 Jan 1970 00:00:00 GMT
clear.png
content22.online.citi.com/fp/ Frame 3C71
81 B
475 B
Image
General
Full URL
https://content22.online.citi.com/fp/clear.png?org_id=89oebq5k&session_id=9646094ba7b58acb03dad3f75e50dcf29574f85b76dd9ada42ddaf7cafc1207c&nonce=1d35291145502344&pageid=1&ck=0&m=2
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
91.235.134.21 , Netherlands, ASN30286 (THM, US),
Reverse DNS
Software
Apache /
Resource Hash
95518cbec0d55a574a9c8ef72a2a7d62ac0d40a4de5dfe67a76a7d214dc8b743
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

Pragma
no-cache
Date
Sun, 29 Mar 2020 00:37:44 GMT
X-Content-Type-Options
nosniff
Server
Apache
Strict-Transport-Security
max-age=31536000
Content-Type
image/png
Cache-Control
no-cache, no-store, must-revalidate
Connection
Keep-Alive
Keep-Alive
timeout=2, max=100
Content-Length
81
X-XSS-Protection
1; mode=block
Expires
Thu, 01 Jan 1970 00:00:00 GMT
generic1583759509314.js
resources.digital-cloud-citi.medallia.com/wdcusciti/50/onsite/
292 KB
56 KB
Script
General
Full URL
https://resources.digital-cloud-citi.medallia.com/wdcusciti/50/onsite/generic1583759509314.js
Requested by
Host: resources.digital-cloud-citi.medallia.com
URL: https://resources.digital-cloud-citi.medallia.com/wdcusciti/50/onsite/embed.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.14.133 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
495c2b78f2deeec56065c5078a56deb4b4b6601773c98224cbe8517d0545adb2

Request headers

Referer
https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

x-amz-version-id
uAPRU1.TEa4IccOvtJ5W8HtqM3e6HTPR
content-encoding
gzip
age
64
x-cache
HIT
status
200
date
Sun, 29 Mar 2020 00:37:44 GMT
content-length
57360
x-amz-id-2
mIazVyvwuBp4rl6b4rqWuI288NQ9PJebsBXYr2Nxx74z6NZrVDWXEBYiGPCitw1erzHetRy6jA8=
x-served-by
cache-fra19124-FRA
access-control-allow-origin
*
last-modified
Mon, 09 Mar 2020 13:11:50 GMT
server
AmazonS3
x-timer
S1585442265.556036,VS0,VE0
etag
"554d96b22cd4fa4f07c79604a171a56f"
vary
Accept-Encoding
x-amz-request-id
1593E55C3DF1132E
via
1.1 varnish
cache-control
max-age=0,must-revalidate
accept-ranges
bytes
content-type
application/javascript
x-cache-hits
2
63068
stags.bluekai.com/site/ Frame E9B3
0
0
Document
General
Full URL
https://stags.bluekai.com/site/63068?ret=html&phint=language%3Denglish&phint=product%3D&phint=event&phint=category%3Dpre-login%20Sign%20on%20page&phint=page%3DCookied%20Username%20Password&phint=section1%3DPublic&phint=section2%3DSignOn&phint=section3%3D&phint=section4%3D&phint=bankappstatus&phint=productID&phint=__bk_t%3DOnline%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&phint=__bk_k%3Dbanking%2C%20citi%2C%20financial%20services%2C%20checking%20account%2C%20savings%20account%2C%20credit%20cards&phint=__bk_l%3Dhttps%3A%2F%2Fardacademy.org%2Fwp-content%2Fcc%2F%3Feml%3Djashye%40mail.nasd&phint=__bk_v%3D3.1.4&limit=10&r=97921021
Requested by
Host: tags.bkrtx.com
URL: https://tags.bkrtx.com/js/bk-coretag.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
23.45.237.36 , United States, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a23-45-237-36.deploy.static.akamaitechnologies.com
Software
/
Resource Hash

Request headers

Host
stags.bluekai.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
iframe
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site
cross-site
Sec-Fetch-Mode
navigate
Referer
https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
Accept-Encoding
gzip, deflate, br
Accept-Language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
iframe
Referer
https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd

Response headers

Content-Type
text/html
Content-Length
71
P3P
CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV", policyref="http://tags.bluekai.com/w3c/p3p.xml"
BK-Server
aef4
Date
Sun, 29 Mar 2020 00:37:44 GMT
Connection
keep-alive
X-N
S
63068
stags.bluekai.com/site/ Frame 1637
0
0
Document
General
Full URL
https://stags.bluekai.com/site/63068?ret=html&phint=language%3Denglish&phint=product%3D&phint=event&phint=category%3Dpre-login%20Sign%20on%20page&phint=page%3DCookied%20Username%20Password&phint=section1%3DPublic&phint=section2%3DSignOn&phint=section3%3D&phint=section4%3D&phint=bankappstatus&phint=productID&phint=__bk_t%3DOnline%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&phint=__bk_k%3Dbanking%2C%20citi%2C%20financial%20services%2C%20checking%20account%2C%20savings%20account%2C%20credit%20cards&phint=__bk_l%3Dhttps%3A%2F%2Fardacademy.org%2Fwp-content%2Fcc%2F%3Feml%3Djashye%40mail.nasd&phint=__bk_v%3D3.1.4&limit=10&r=79181724
Requested by
Host: tags.bkrtx.com
URL: https://tags.bkrtx.com/js/bk-coretag.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
23.45.237.36 , United States, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a23-45-237-36.deploy.static.akamaitechnologies.com
Software
/
Resource Hash

Request headers

Host
stags.bluekai.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
iframe
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site
cross-site
Sec-Fetch-Mode
navigate
Referer
https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
Accept-Encoding
gzip, deflate, br
Accept-Language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
iframe
Referer
https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd

Response headers

Content-Type
text/html
Content-Length
71
P3P
CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV", policyref="http://tags.bluekai.com/w3c/p3p.xml"
BK-Server
ff50
Date
Sun, 29 Mar 2020 00:37:44 GMT
Connection
keep-alive
X-N
S
js
www.googletagmanager.com/gtag/
75 KB
28 KB
Script
General
Full URL
https://www.googletagmanager.com/gtag/js?id=DC-6260004
Requested by
Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:808::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
ca7048dd1a1d15f42c04c8f3db2d3bcffc6c7eb1be4506ca9fe2651b07766641
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

Referer
https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

date
Sun, 29 Mar 2020 00:37:44 GMT
content-encoding
br
status
200
strict-transport-security
max-age=31536000; includeSubDomains
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length
28637
x-xss-protection
0
last-modified
Sun, 29 Mar 2020 00:00:00 GMT
server
Google Tag Manager
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
http://www.googletagmanager.com
cache-control
private, max-age=900
access-control-allow-credentials
true
access-control-allow-headers
Cache-Control
expires
Sun, 29 Mar 2020 00:37:44 GMT
js
www.googletagmanager.com/gtag/
75 KB
28 KB
Script
General
Full URL
https://www.googletagmanager.com/gtag/js?id=DC-6269322
Requested by
Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:808::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
b2fc35bcf7ad38c6cbc6d170cc5bf15a688ba76d282272c3f0af4c6b31eb0631
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

Referer
https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

date
Sun, 29 Mar 2020 00:37:44 GMT
content-encoding
br
status
200
strict-transport-security
max-age=31536000; includeSubDomains
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length
28637
x-xss-protection
0
last-modified
Sun, 29 Mar 2020 00:00:00 GMT
server
Google Tag Manager
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
http://www.googletagmanager.com
cache-control
private, max-age=900
access-control-allow-credentials
true
access-control-allow-headers
Cache-Control
expires
Sun, 29 Mar 2020 00:37:44 GMT
js
www.googletagmanager.com/gtag/
75 KB
28 KB
Script
General
Full URL
https://www.googletagmanager.com/gtag/js?id=DC-6256710
Requested by
Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:808::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
eca1d20a663a7e242fa10ee2c58c742eb6292c898df29e16734ac7d0df29f277
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

Referer
https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

date
Sun, 29 Mar 2020 00:37:44 GMT
content-encoding
br
status
200
strict-transport-security
max-age=31536000; includeSubDomains
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length
28637
x-xss-protection
0
last-modified
Sun, 29 Mar 2020 00:00:00 GMT
server
Google Tag Manager
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
http://www.googletagmanager.com
cache-control
private, max-age=900
access-control-allow-credentials
true
access-control-allow-headers
Cache-Control
expires
Sun, 29 Mar 2020 00:37:44 GMT
conversion_async.js
www.googleadservices.com/pagead/
26 KB
10 KB
Script
General
Full URL
https://www.googleadservices.com/pagead/conversion_async.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=DC-6256710
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.217.18.98 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
zrh04s05-in-f98.1e100.net
Software
cafe /
Resource Hash
c5b1ef448841c8a0f34532d4be5f5656d9eb4eea66e04755c0b64f2662d35eed
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

date
Sun, 29 Mar 2020 00:37:44 GMT
content-encoding
gzip
x-content-type-options
nosniff
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
content-disposition
attachment; filename="f.txt"
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length
9982
x-xss-protection
0
server
cafe
etag
13837497077581106518
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
cache-control
private, max-age=3600
timing-allow-origin
*
expires
Sun, 29 Mar 2020 00:37:44 GMT
pp.html
cdn.pbbl.co/i/ Frame 2BA9
0
0
Document
General
Full URL
https://cdn.pbbl.co/i/pp.html
Requested by
Host: cdn.pbbl.co
URL: https://cdn.pbbl.co/r/1560.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
143.204.202.100 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-202-100.fra53.r.cloudfront.net
Software
nginx/1.10.3 (Ubuntu) /
Resource Hash

Request headers

:method
GET
:authority
cdn.pbbl.co
:scheme
https
:path
/i/pp.html
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-dest
iframe
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
referer
https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
accept-encoding
gzip, deflate, br
accept-language
en-US
cookie
pp_uid=59e19afc-941e-4859-ade5-7f6803468ced
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
iframe
Referer
https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd

Response headers

status
200
content-type
text/html
server
nginx/1.10.3 (Ubuntu)
date
Sun, 29 Mar 2020 00:16:53 GMT
last-modified
Thu, 30 Jan 2020 18:07:58 GMT
content-encoding
gzip
vary
Accept-Encoding
x-cache
Hit from cloudfront
via
1.1 c714e4f593454d65f62cf3fecf756a4c.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA53-C1
x-amz-cf-id
a7pbLxxWbLDOuUomP68gbTlVJ83c8FrbDfKIt5A22uDfe-RqqOM93A==
age
1251
cls_report
prod.report.nacustomerexperience.citi.com/glassbox/reporting/
0
613 B
XHR
General
Full URL
https://prod.report.nacustomerexperience.citi.com/glassbox/reporting/cls_report?_cls_s=2bdee520-cded-44cf-a1e5-117ab42128d6%3A0&_cls_v=80a8b913-209a-4f2e-839d-44749fa3731c
Requested by
Host: ardacademy.org
URL: https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
192.193.200.243 , United States, ASN32287 (SOLANA-CITIPLEX, US),
Reverse DNS
Software
GlassBox Cligate /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubdomains;
X-Frame-Options SAMEORIGIN

Request headers

Referer
https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
Origin
https://ardacademy.org
Sec-Fetch-Dest
empty
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Sun, 29 Mar 2020 00:37:45 GMT
Strict-Transport-Security
max-age=63072000; includeSubdomains;
Vary
Origin
Server
GlassBox Cligate
X-Akamai-CITISITE
SWDC
X-Frame-Options
SAMEORIGIN
Content-Type
text/plain; charset=utf-8
Access-Control-Allow-Origin
https://ardacademy.org
Access-Control-Allow-Credentials
true
Connection
close
Content-Length
0
up
insight.adsrvr.org/track/ Frame 56BB
0
0
Document
General
Full URL
https://insight.adsrvr.org/track/up?adv=1jw5cvl&ref=https%3A%2F%2Fardacademy.org%2Fwp-content%2Fcc%2F%3Feml%3Djashye%40mail.nasd&upid=t1sl5ty&upv=1.1.0&orderid={orderid}&v={v}&vf={vf}&td1=jUSCBOL_Loginpage_Cookied&td2=undefined&td3=undefined&td4=Cookied%20Username%20Password&td5=https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd&td6={td6}&td7={td7}&td8={td8}&td9={td9}&td10={td10}
Requested by
Host: js.adsrvr.org
URL: https://js.adsrvr.org/up_loader.1.1.0.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.76.69.10 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-54-76-69-10.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash

Request headers

:method
GET
:authority
insight.adsrvr.org
:scheme
https
:path
/track/up?adv=1jw5cvl&ref=https%3A%2F%2Fardacademy.org%2Fwp-content%2Fcc%2F%3Feml%3Djashye%40mail.nasd&upid=t1sl5ty&upv=1.1.0&orderid={orderid}&v={v}&vf={vf}&td1=jUSCBOL_Loginpage_Cookied&td2=undefined&td3=undefined&td4=Cookied%20Username%20Password&td5=https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd&td6={td6}&td7={td7}&td8={td8}&td9={td9}&td10={td10}
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-dest
iframe
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
referer
https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
iframe
Referer
https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd

Response headers

status
200
date
Sun, 29 Mar 2020 00:37:44 GMT
content-type
text/html
cache-control
private,no-cache, must-revalidate
pragma
no-cache
x-aspnet-version
4.0.30319
p3p
CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
clear.png
content22.online.citi.com/fp/ Frame 3C71
81 B
530 B
XHR
General
Full URL
https://content22.online.citi.com/fp/clear.png
Requested by
Host: content22.online.citi.com
URL: https://content22.online.citi.com/fp/check.js;CIS3SID=CB9CBD87942D7948E5F9FBE01E0E5A9B?org_id=89oebq5k&session_id=9646094ba7b58acb03dad3f75e50dcf29574f85b76dd9ada42ddaf7cafc1207c&nonce=1d35291145502344&pageid=1&jb=3b3526246a7b6f773d4e6b6e7d782468736d3d4c696c777a266a73623d416a70676d672530383736
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
91.235.134.21 , Netherlands, ASN30286 (THM, US),
Reverse DNS
Software
Apache /
Resource Hash
95518cbec0d55a574a9c8ef72a2a7d62ac0d40a4de5dfe67a76a7d214dc8b743
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

Accept
*/*, 89oebq5k/1d352911455023449646094ba7b58acb03dad3f75e50dcf29574f85b76dd9ada42ddaf7cafc1207c
Referer
https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
Origin
https://ardacademy.org
Sec-Fetch-Dest
empty
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date
Sun, 29 Mar 2020 00:37:44 GMT
Last-Modified
Sun, 29 Mar 2020 00:37:44 GMT
Server
Apache
Etag
c36815af688a40d6aad4b08257af6fe8
Strict-Transport-Security
max-age=31536000
Content-Type
image/png
Access-Control-Allow-Origin
https://ardacademy.org
Cache-Control
private, must-revalidate, max-age=0
Connection
Keep-Alive
Keep-Alive
timeout=2, max=100
Content-Length
81
Expires
Fri, 28 Mar 2025 00:37:44 GMT
ls_fp.html;CIS3SID=CB9CBD87942D7948E5F9FBE01E0E5A9B
content22.online.citi.com/fp/ Frame E3E0
0
0
Document
General
Full URL
https://content22.online.citi.com/fp/ls_fp.html;CIS3SID=CB9CBD87942D7948E5F9FBE01E0E5A9B?org_id=89oebq5k&session_id=9646094ba7b58acb03dad3f75e50dcf29574f85b76dd9ada42ddaf7cafc1207c&nonce=1d35291145502344&pageid=1
Requested by
Host: content22.online.citi.com
URL: https://content22.online.citi.com/fp/check.js;CIS3SID=CB9CBD87942D7948E5F9FBE01E0E5A9B?org_id=89oebq5k&session_id=9646094ba7b58acb03dad3f75e50dcf29574f85b76dd9ada42ddaf7cafc1207c&nonce=1d35291145502344&pageid=1&jb=3b3526246a7b6f773d4e6b6e7d782468736d3d4c696c777a266a73623d416a70676d672530383736
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
91.235.134.21 , Netherlands, ASN30286 (THM, US),
Reverse DNS
Software
Apache /
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Host
content22.online.citi.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
iframe
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site
cross-site
Sec-Fetch-Mode
navigate
Referer
https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
Accept-Encoding
gzip, deflate, br
Accept-Language
en-US
Cookie
thx_guid=d805ca3dc96545c7947e181bde97703f; AKMTLTSID=39C825044CBC616D06DAAFA134398E9B; s_vi=[CS]v1|2F3FF6EB8515B1F3-6000089B8445EBA9[CE]; CITI_SITE=swdc; RFXPUID=SY-00GfVAAVulEvE=749
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
iframe
Referer
https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd

Response headers

Date
Sun, 29 Mar 2020 00:37:44 GMT
Server
Apache
Strict-Transport-Security
max-age=31536000
Cache-Control
no-cache, no-store, must-revalidate
Pragma
no-cache
Connection
Keep-Alive, Keep-Alive
X-Content-Type-Options
nosniff
X-XSS-Protection
1; mode=block
Expires
Thu, 01 Jan 1970 00:00:00 GMT
Content-Type
text/html;charset=UTF-8
Vary
Accept-Encoding
Content-Encoding
gzip
Keep-Alive
timeout=2, max=99
Transfer-Encoding
chunked
clear.png
content22.online.citi.com/fp/ Frame 3C71
0
387 B
Script
General
Full URL
https://content22.online.citi.com/fp/clear.png?org_id=89oebq5k&session_id=9646094ba7b58acb03dad3f75e50dcf29574f85b76dd9ada42ddaf7cafc1207c&nonce=1d35291145502344&if=ls
Requested by
Host: content22.online.citi.com
URL: https://content22.online.citi.com/fp/check.js;CIS3SID=CB9CBD87942D7948E5F9FBE01E0E5A9B?org_id=89oebq5k&session_id=9646094ba7b58acb03dad3f75e50dcf29574f85b76dd9ada42ddaf7cafc1207c&nonce=1d35291145502344&pageid=1&jb=3b3526246a7b6f773d4e6b6e7d782468736d3d4c696c777a266a73623d416a70676d672530383736
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
91.235.134.21 , Netherlands, ASN30286 (THM, US),
Reverse DNS
Software
Apache /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

Pragma
no-cache
Date
Sun, 29 Mar 2020 00:37:44 GMT
X-Content-Type-Options
nosniff
Server
Apache
Strict-Transport-Security
max-age=31536000
Content-Type
text/javascript
Cache-Control
no-cache, no-store, must-revalidate
Connection
Keep-Alive
Keep-Alive
timeout=2, max=99
X-XSS-Protection
1; mode=block
Expires
Thu, 01 Jan 1970 00:00:00 GMT
sid_fp.html;CIS3SID=CB9CBD87942D7948E5F9FBE01E0E5A9B
h.online-metrix.net/fp/ Frame 974B
0
0
Document
General
Full URL
https://h.online-metrix.net/fp/sid_fp.html;CIS3SID=CB9CBD87942D7948E5F9FBE01E0E5A9B?org_id=89oebq5k&session_id=9646094ba7b58acb03dad3f75e50dcf29574f85b76dd9ada42ddaf7cafc1207c&nonce=1d35291145502344&pageid=1
Requested by
Host: content22.online.citi.com
URL: https://content22.online.citi.com/fp/check.js;CIS3SID=CB9CBD87942D7948E5F9FBE01E0E5A9B?org_id=89oebq5k&session_id=9646094ba7b58acb03dad3f75e50dcf29574f85b76dd9ada42ddaf7cafc1207c&nonce=1d35291145502344&pageid=1&jb=3b3526246a7b6f773d4e6b6e7d782468736d3d4c696c777a266a73623d416a70676d672530383736
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
91.235.132.130 , Netherlands, ASN30286 (THM, US),
Reverse DNS
h.online-metrix.net
Software
Apache /
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Host
h.online-metrix.net
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
iframe
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site
cross-site
Sec-Fetch-Mode
navigate
Referer
https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
Accept-Encoding
gzip, deflate, br
Accept-Language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
iframe
Referer
https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd

Response headers

Date
Sun, 29 Mar 2020 00:37:44 GMT
Server
Apache
Strict-Transport-Security
max-age=31536000
Cache-Control
no-cache, no-store, must-revalidate
Pragma
no-cache
Connection
Keep-Alive, Keep-Alive
X-Content-Type-Options
nosniff
X-XSS-Protection
1; mode=block
Expires
Thu, 01 Jan 1970 00:00:00 GMT
Content-Type
text/html;charset=UTF-8
Vary
Accept-Encoding
Content-Encoding
gzip
Keep-Alive
timeout=2, max=100
Transfer-Encoding
chunked
clear.png
h.online-metrix.net/fp/ Frame 3C71
0
388 B
Script
General
Full URL
https://h.online-metrix.net/fp/clear.png?org_id=89oebq5k&session_id=9646094ba7b58acb03dad3f75e50dcf29574f85b76dd9ada42ddaf7cafc1207c&nonce=1d35291145502344&if=sid
Requested by
Host: content22.online.citi.com
URL: https://content22.online.citi.com/fp/check.js;CIS3SID=CB9CBD87942D7948E5F9FBE01E0E5A9B?org_id=89oebq5k&session_id=9646094ba7b58acb03dad3f75e50dcf29574f85b76dd9ada42ddaf7cafc1207c&nonce=1d35291145502344&pageid=1&jb=3b3526246a7b6f773d4e6b6e7d782468736d3d4c696c777a266a73623d416a70676d672530383736
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
91.235.132.130 , Netherlands, ASN30286 (THM, US),
Reverse DNS
h.online-metrix.net
Software
Apache /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

Pragma
no-cache
Date
Sun, 29 Mar 2020 00:37:44 GMT
X-Content-Type-Options
nosniff
Server
Apache
Strict-Transport-Security
max-age=31536000
Content-Type
text/javascript
Cache-Control
no-cache, no-store, must-revalidate
Connection
Keep-Alive
Keep-Alive
timeout=2, max=100
X-XSS-Protection
1; mode=block
Expires
Thu, 01 Jan 1970 00:00:00 GMT
clear.png
content22.online.citi.com/fp/ Frame 3C71
0
387 B
Script
General
Full URL
https://content22.online.citi.com/fp/clear.png?org_id=89oebq5k&session_id=9646094ba7b58acb03dad3f75e50dcf29574f85b76dd9ada42ddaf7cafc1207c&nonce=1d35291145502344&pageid=1&jd=3f36262477356366323a30653c6434356564663563672468666e3d362668646a35633a6364396364343b39313f6533623663353662646436623a30313a3863633e246a6474663d323a30353a3e
Requested by
Host: content22.online.citi.com
URL: https://content22.online.citi.com/fp/check.js;CIS3SID=CB9CBD87942D7948E5F9FBE01E0E5A9B?org_id=89oebq5k&session_id=9646094ba7b58acb03dad3f75e50dcf29574f85b76dd9ada42ddaf7cafc1207c&nonce=1d35291145502344&pageid=1&jb=3b3526246a7b6f773d4e6b6e7d782468736d3d4c696c777a266a73623d416a70676d672530383736
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
91.235.134.21 , Netherlands, ASN30286 (THM, US),
Reverse DNS
Software
Apache /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

Pragma
no-cache
Date
Sun, 29 Mar 2020 00:37:44 GMT
X-Content-Type-Options
nosniff
Server
Apache
Strict-Transport-Security
max-age=31536000
Content-Type
text/javascript
Cache-Control
no-cache, no-store, must-revalidate
Connection
Keep-Alive
Keep-Alive
timeout=2, max=98
X-XSS-Protection
1; mode=block
Expires
Thu, 01 Jan 1970 00:00:00 GMT
top_fp.html;CIS3SID=CB9CBD87942D7948E5F9FBE01E0E5A9B
content22.online.citi.com/fp/ Frame 25E4
0
0
Document
General
Full URL
https://content22.online.citi.com/fp/top_fp.html;CIS3SID=CB9CBD87942D7948E5F9FBE01E0E5A9B?org_id=89oebq5k&session_id=9646094ba7b58acb03dad3f75e50dcf29574f85b76dd9ada42ddaf7cafc1207c&nonce=1d35291145502344&pageid=1
Requested by
Host: content22.online.citi.com
URL: https://content22.online.citi.com/fp/check.js;CIS3SID=CB9CBD87942D7948E5F9FBE01E0E5A9B?org_id=89oebq5k&session_id=9646094ba7b58acb03dad3f75e50dcf29574f85b76dd9ada42ddaf7cafc1207c&nonce=1d35291145502344&pageid=1&jb=3b3526246a7b6f773d4e6b6e7d782468736d3d4c696c777a266a73623d416a70676d672530383736
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
91.235.134.21 , Netherlands, ASN30286 (THM, US),
Reverse DNS
Software
Apache /
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Host
content22.online.citi.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
iframe
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site
cross-site
Sec-Fetch-Mode
navigate
Referer
https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
Accept-Encoding
gzip, deflate, br
Accept-Language
en-US
Cookie
thx_guid=d805ca3dc96545c7947e181bde97703f; AKMTLTSID=39C825044CBC616D06DAAFA134398E9B; s_vi=[CS]v1|2F3FF6EB8515B1F3-6000089B8445EBA9[CE]; CITI_SITE=swdc; RFXPUID=SY-00GfVAAVulEvE=749
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
iframe
Referer
https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd

Response headers

Date
Sun, 29 Mar 2020 00:37:44 GMT
Server
Apache
Strict-Transport-Security
max-age=31536000
Cache-Control
no-cache, no-store, must-revalidate
Pragma
no-cache
Connection
Keep-Alive, Keep-Alive
X-Content-Type-Options
nosniff
X-XSS-Protection
1; mode=block
Expires
Thu, 01 Jan 1970 00:00:00 GMT
Content-Type
text/html;charset=UTF-8
Vary
Accept-Encoding
Content-Encoding
gzip
Keep-Alive
timeout=2, max=98
Transfer-Encoding
chunked
clear.png
content22.online.citi.com/fp/ Frame 3C71
0
218 B
Script
General
Full URL
https://content22.online.citi.com/fp/clear.png?org_id=89oebq5k&session_id=9646094ba7b58acb03dad3f75e50dcf29574f85b76dd9ada42ddaf7cafc1207c&nonce=1d35291145502344&pageid=1&ja=3e363124267f3d6164303a326d3466343767666635616724633d363026783f343826643d333e30327a33323038266470723f312c31343232783330303226636435333632307031303032247370793f327832267363663f3034266c683d6a767678732733432d3244273046617a6461636166656d792c6d706727304675702f61676c74676e7c2530466161253a46273146676d6c25314668617368796527363265616b6c2c666171662464723526703d706e7567696c5d646c6371685c66636e7b6721726c7d676b6e5d756966646d75735d6d65646b635d706c617965705c64696c716523786c77656b6e5f69646f62655d6163726d6063745c64616e736723786e756569665f73756b616b7c696f675e64616c736723726c7567696e5d716a67636977637e655c64636c736d21706c7565696e5f7067636c726e617b65705c6e636c716529706e75656b6e57766e615f726c617967705c66616c736523726e7d676b6e5d6c6574636e76725666616c736721706c77656b6e5d7176655f746b6d7565705e6e616e736723706475656b6e5d6a6176635c64616c7365266a6a3f3166663630316630333330653c346433356436623133373b393a3a63336237322e68736d3d44696c757a246a7b623f4168706f6d652730323734266a736d773f44696c757a2e6e6a613f31362e6e646d3d3a26747a663f4775706d70672530444a67726e6966266f61766a72353432323366316332606761303265366361373438303a32636c3137373630316e643435383a3134316634676163303466633b3669646266373a333333333b366926677a333f34656264303a32383265656032343f306430363d6167616461306a38613564323165653732666634246361643f303832303230&jb=393430246c793d4f6f786b6c6461273046372e302530322a4d6163696e766d7160253142273a304b6c76656c2d32304d61612532304d512732325a25303033325733345d352125303043727064655567624969742530443733372e3336273032204b4a544f4425304127323064696b65253030476561696d292730304168706d65672530463f342c302c31373a392c33363b25323051636461726925324437313f2e3136
Requested by
Host: content22.online.citi.com
URL: https://content22.online.citi.com/fp/check.js;CIS3SID=CB9CBD87942D7948E5F9FBE01E0E5A9B?org_id=89oebq5k&session_id=9646094ba7b58acb03dad3f75e50dcf29574f85b76dd9ada42ddaf7cafc1207c&nonce=1d35291145502344&pageid=1&jb=3b3526246a7b6f773d4e6b6e7d782468736d3d4c696c777a266a73623d416a70676d672530383736
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
91.235.134.21 , Netherlands, ASN30286 (THM, US),
Reverse DNS
Software
Apache /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

Referer
https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

Date
Sun, 29 Mar 2020 00:37:44 GMT
Server
Apache
Connection
Keep-Alive
Keep-Alive
timeout=2, max=98
Strict-Transport-Security
max-age=31536000
Content-Type
text/javascript;charset=UTF-8
clear.png
89oebq5k6e5aknuqnxl5yc3ng5orx6szfks7ezmd1d35291145502344am1.e.aa.online-metrix.net/fp/ Frame 3C71
81 B
438 B
Image
General
Full URL
https://89oebq5k6e5aknuqnxl5yc3ng5orx6szfks7ezmd1d35291145502344am1.e.aa.online-metrix.net/fp/clear.png?org_id=89oebq5k&session_id=9646094ba7b58acb03dad3f75e50dcf29574f85b76dd9ada42ddaf7cafc1207c&nonce=1d35291145502344&pageid=1&di=yes
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
91.235.134.131 , Netherlands, ASN30286 (THM, US),
Reverse DNS
Software
Apache /
Resource Hash
95518cbec0d55a574a9c8ef72a2a7d62ac0d40a4de5dfe67a76a7d214dc8b743
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

Pragma
no-cache
Date
Sun, 29 Mar 2020 00:37:44 GMT
X-Content-Type-Options
nosniff
Server
Apache
Strict-Transport-Security
max-age=31536000
Content-Type
image/png
Cache-Control
no-cache, no-store, must-revalidate
Connection
close
Content-Length
81
X-XSS-Protection
1; mode=block
Expires
Thu, 01 Jan 1970 00:00:00 GMT
__cool.gif
udc-neb.kampyle.com/egw/5/qceuv8449dzg58ptt1bhda9g8ue19c7s/track/
0
79 B
Image
General
Full URL
https://udc-neb.kampyle.com/egw/5/qceuv8449dzg58ptt1bhda9g8ue19c7s/track/__cool.gif?data=eyJldmVudHMiOiBbCiAgICB7InNlc3Npb25fc2NyZWVuX3NpemUiOiAiMTYwMHgxMjAwIiwic2Vzc2lvbl9kdWEiOiAiTW96aWxsYS81LjAgKE1hY2ludG9zaDsgSW50ZWwgTWFjIE9TIFggMTBfMTRfNSkgQXBwbGVXZWJLaXQvNTM3LjM2IChLSFRNTCwgbGlrZSBHZWNrbykgQ2hyb21lLzc0LjAuMzcyOS4xNjkgU2FmYXJpLzUzNy4zNiIsInNlc3Npb25fcGxhdGZvcm0iOiAiTGludXggeDg2XzY0IiwidHJhY2tlcl90eXBlIjogImphdmFzY3JpcHQiLCJ0cmFja2VyX3ZlcnNpb24iOiAiMi4xLjE1IiwiZXZlbnRfbmFtZSI6ICJuZWJ1bGFfcGFnZV92aWV3IiwiZXZlbnRfdGltZXN0YW1wX2Vwb2NoIjogIjE1ODU0NDIyNjQ3OTAiLCJldmVudF90aW1lem9uZV9vZmZzZXQiOiAxLCJ1c2VyX2lkIjogIjE3MTIzYjkxNGJlZjY3LTAzYjcwZWRkZDJkZDU3LTM3NjQ3ZTAzLTFkNGMwMC0xNzEyM2I5MTRiZmU1MiIsImVudmlyb21lbnQiOiAiZGlnaXRhbC1jbG91ZC11cy1jaXRpIiwiYWNjb3VudElkIjogNDksInVybCI6ICJodHRwczovL2FyZGFjYWRlbXkub3JnL3dwLWNvbnRlbnQvY2MvP2VtbD1qYXNoeWVAbWFpbC5uYXNkIiwid2Vic2l0ZUlkIjogNTAsImZlZWRiYWNrX3V1aWQiOiBudWxsLCJmb3JtSWQiOiBudWxsLCJmb3JtVHJpZ2dlclR5cGUiOiBudWxsLCJrYW1weWxlX2RhdGEiOiB7IkxBU1RfSU5WSVRBVElPTl9WSUVXIjogIiIsIkRFQ0xJTkVEX0RBVEUiOiAiIiwia2FtcHlsZUludml0ZVByZXNlbnRlZCI6ICIiLCJrYW1weWxlX3VzZXJpZCI6ICI0NTY5LTIzYzEtNDFkYi00ZWVmLTRhNzEtODhjMy00NDRlLTkxYTgiLCJrYW1weWxlVXNlclNlc3Npb24iOiAiMTU4NTQ0MjI2NDc4NyIsImthbXB5bGVVc2VyUGVyY2VudGlsZSI6ICIiLCJTVUJNSVRURURfREFURSI6ICIifSwiY29va2llX3NpemUiOiAxMTk4LCJrYW1weWxlX3ZlcnNpb24iOiAiMC4wLjAuMCIsImhpc3RvcnlfbGVuZ3RoIjogMiwiZXZlbnRfbG9jYWxfdGltZXN0YW1wIjogMTU4NTQ0MjI2NDc5MCwicG9zaXRpb24iOiBudWxsLCJpc1VzZXJJZGVudGlmaWVkIjogZmFsc2V9Cl19
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.241.45.82 , Ascension Island, ASN15169 (GOOGLE, US),
Reverse DNS
82.45.241.35.bc.googleusercontent.com
Software
Jetty(9.2.11.v20150529) /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

x-me
prod-instance-gatewayservice-green-m211
date
Sun, 29 Mar 2020 00:37:44 GMT
via
1.1 google
alt-svc
clear
server
Jetty(9.2.11.v20150529)
access-control-allow-origin
*
access-control-max-age
1800
access-control-allow-methods
GET, POST, PUT, DELETE
content-type
image/gif; charset=UTF-8
status
200
access-control-allow-credentials
true
access-control-allow-headers
X-Requested-With, Origin, Content-Type, Accept
content-length
0
x-application-context
application:9090
adadvisor.gif
px0.pbbl.co/
Redirect Chain
  • https://px0.pbbl.co/ns/__p2.gif?ppid=9b1c96a0-258f-4947-b02c-c9ebbbd4d951&chk=false&brid=1560&brcid=&email=&orderId=&orderValue=&productId=&offerCode=&label=&pageUrl=https%3A%2F%2Fardacademy.org%2F...
  • https://aa.agkn.com/adscores/g.pixel?sid=9212282598&_ppid=9b1c96a0-258f-4947-b02c-c9ebbbd4d951&_segid=99&iid=1782f822-4f6a-48a1-bec8-996ef7976b0a
  • https://px0.pbbl.co/adadvisor.gif?segment=000&_ppid=9b1c96a0-258f-4947-b02c-c9ebbbd4d951&_segid=99&_zip=&hk=&iid=1782f822-4f6a-48a1-bec8-996ef7976b0a&mt=&bd=
42 B
131 B
Image
General
Full URL
https://px0.pbbl.co/adadvisor.gif?segment=000&_ppid=9b1c96a0-258f-4947-b02c-c9ebbbd4d951&_segid=99&_zip=&hk=&iid=1782f822-4f6a-48a1-bec8-996ef7976b0a&mt=&bd=
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:824::2013 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Frontend /
Resource Hash
99c2917ee5b2a01459a923bdd1c676f15ee73b62b87f696e6735312d26f51e12
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1

Request headers

Referer
https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma
no-cache
date
Sun, 29 Mar 2020 00:37:45 GMT
x-content-type-options
nosniff
server
Google Frontend
content-type
image/gif
status
200
x-cloud-trace-context
4f8e41ee00e1fd47685730cc0a38ba4c
cache-control
must-revalidate, no-cache, no-store
content-length
42
x-xss-protection
1
expires
0

Redirect headers

pragma
no-cache
date
Sun, 29 Mar 2020 00:37:44 GMT
server
AAWebServer
location
https://px0.pbbl.co/adadvisor.gif?segment=000&_ppid=9b1c96a0-258f-4947-b02c-c9ebbbd4d951&_segid=99&_zip=&hk=&iid=1782f822-4f6a-48a1-bec8-996ef7976b0a&mt=&bd=
p3p
policyref="http://www.agkn.com/p3p/p3p.xml",CP="NOI NID"
status
302
cache-control
no-cache, no-store, must-revalidate
content-length
0
expires
0
/
googleads.g.doubleclick.net/pagead/viewthroughconversion/959299794/
2 KB
1 KB
Script
General
Full URL
https://googleads.g.doubleclick.net/pagead/viewthroughconversion/959299794/?random=1585442264895&cv=9&fst=1585442264895&num=1&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2od3i0&sendb=1&ig=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fardacademy.org%2Fwp-content%2Fcc%2F%3Feml%3Djashye%40mail.nasd&tiba=Online%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4
Requested by
Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/conversion_async.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:816::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
574d7d4cc6ec33afda64c46a558217ef40ce6f0481d0c313cde52c430f2000fe
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

pragma
no-cache
date
Sun, 29 Mar 2020 00:37:44 GMT
content-encoding
gzip
x-content-type-options
nosniff
content-type
text/javascript; charset=UTF-8
server
cafe
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status
200
cache-control
no-cache, must-revalidate
content-disposition
attachment; filename="f.txt"
timing-allow-origin
*
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length
1088
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
googleads.g.doubleclick.net/pagead/viewthroughconversion/960621875/
2 KB
1 KB
Script
General
Full URL
https://googleads.g.doubleclick.net/pagead/viewthroughconversion/960621875/?random=1585442264896&cv=9&fst=1585442264896&num=1&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2od3i0&sendb=1&ig=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fardacademy.org%2Fwp-content%2Fcc%2F%3Feml%3Djashye%40mail.nasd&tiba=Online%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4
Requested by
Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/conversion_async.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:816::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
65855ae5635ed6239f9b29d48c4f677036051e61961161a882c9e4719659aa75
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

pragma
no-cache
date
Sun, 29 Mar 2020 00:37:44 GMT
content-encoding
gzip
x-content-type-options
nosniff
content-type
text/javascript; charset=UTF-8
server
cafe
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status
200
cache-control
no-cache, must-revalidate
content-disposition
attachment; filename="f.txt"
timing-allow-origin
*
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length
1086
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
googleads.g.doubleclick.net/pagead/viewthroughconversion/916451471/
2 KB
1 KB
Script
General
Full URL
https://googleads.g.doubleclick.net/pagead/viewthroughconversion/916451471/?random=1585442264897&cv=9&fst=1585442264897&num=1&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2od3i0&sendb=1&ig=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fardacademy.org%2Fwp-content%2Fcc%2F%3Feml%3Djashye%40mail.nasd&tiba=Online%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4
Requested by
Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/conversion_async.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:816::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
13163595ed65608d87010840f927abe515a8d6cdef23d43e36bddd46a03f3bbf
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

pragma
no-cache
date
Sun, 29 Mar 2020 00:37:44 GMT
content-encoding
gzip
x-content-type-options
nosniff
content-type
text/javascript; charset=UTF-8
server
cafe
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status
200
cache-control
no-cache, must-revalidate
content-disposition
attachment; filename="f.txt"
timing-allow-origin
*
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length
1086
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
googleads.g.doubleclick.net/pagead/viewthroughconversion/960621875/
2 KB
1 KB
Script
General
Full URL
https://googleads.g.doubleclick.net/pagead/viewthroughconversion/960621875/?random=1585442264898&cv=9&fst=1585442264898&num=1&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2od3i0&sendb=1&ig=1&data=event%3Dconversion&frm=0&url=https%3A%2F%2Fardacademy.org%2Fwp-content%2Fcc%2F%3Feml%3Djashye%40mail.nasd&tiba=Online%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4
Requested by
Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/conversion_async.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:816::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
e67c7e22d2ab8eecb0aca966f8da51fe7590de887dcaefba7c70ef8e7409e47c
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

pragma
no-cache
date
Sun, 29 Mar 2020 00:37:44 GMT
content-encoding
gzip
x-content-type-options
nosniff
content-type
text/javascript; charset=UTF-8
server
cafe
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status
200
cache-control
no-cache, must-revalidate
content-disposition
attachment; filename="f.txt"
timing-allow-origin
*
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length
1087
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
www.google.de/pagead/1p-user-list/975701947/
Redirect Chain
  • https://googleads.g.doubleclick.net/pagead/viewthroughconversion/975701947/?random=1585442264897&cv=9&fst=1585442264897&num=1&fmt=3&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=12...
  • https://www.google.com/pagead/1p-user-list/975701947/?random=1585442264897&cv=9&fst=1585440000000&num=1&fmt=3&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=...
  • https://www.google.de/pagead/1p-user-list/975701947/?random=1585442264897&cv=9&fst=1585440000000&num=1&fmt=3&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=f...
42 B
110 B
Image
General
Full URL
https://www.google.de/pagead/1p-user-list/975701947/?random=1585442264897&cv=9&fst=1585440000000&num=1&fmt=3&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2od3i0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fardacademy.org%2Fwp-content%2Fcc%2F%3Feml%3Djashye%40mail.nasd&tiba=Online%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&async=1&is_vtc=1&random=1463942815&resp=GooglemKTybQhCsO&ipr=y&ezwbk=AZuM4hCQFpBwUyDJJoB2MO_1kOUlgPrXxFCPskIU96ItNr2Rh20dnI9-nb9SPuOdvD5EezcsnU85Qra-FEGJaCTBE3qY
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:816::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma
no-cache
date
Sun, 29 Mar 2020 00:37:44 GMT
x-content-type-options
nosniff
content-type
image/gif
server
cafe
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
cache-control
no-cache, no-store, must-revalidate
content-security-policy
script-src 'none'; object-src 'none'
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma
no-cache
date
Sun, 29 Mar 2020 00:37:44 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
location
https://www.google.de/pagead/1p-user-list/975701947/?random=1585442264897&cv=9&fst=1585440000000&num=1&fmt=3&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2od3i0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fardacademy.org%2Fwp-content%2Fcc%2F%3Feml%3Djashye%40mail.nasd&tiba=Online%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&async=1&is_vtc=1&random=1463942815&resp=GooglemKTybQhCsO&ipr=y&ezwbk=AZuM4hCQFpBwUyDJJoB2MO_1kOUlgPrXxFCPskIU96ItNr2Rh20dnI9-nb9SPuOdvD5EezcsnU85Qra-FEGJaCTBE3qY
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
302
cache-control
no-cache, no-store, must-revalidate
content-security-policy
script-src 'none'; object-src 'none'
content-type
image/gif
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
www.google.de/pagead/1p-user-list/770961656/
Redirect Chain
  • https://googleads.g.doubleclick.net/pagead/viewthroughconversion/770961656/?random=1585442264897&cv=9&fst=1585442264897&num=1&fmt=3&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=12...
  • https://www.google.com/pagead/1p-user-list/770961656/?random=1585442264897&cv=9&fst=1585440000000&num=1&fmt=3&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=...
  • https://www.google.de/pagead/1p-user-list/770961656/?random=1585442264897&cv=9&fst=1585440000000&num=1&fmt=3&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=f...
42 B
110 B
Image
General
Full URL
https://www.google.de/pagead/1p-user-list/770961656/?random=1585442264897&cv=9&fst=1585440000000&num=1&fmt=3&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2od3i0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fardacademy.org%2Fwp-content%2Fcc%2F%3Feml%3Djashye%40mail.nasd&tiba=Online%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&async=1&is_vtc=1&random=593359102&resp=GooglemKTybQhCsO&ipr=y&ezwbk=AZuM4hDv_KXZlgm4YbeC7sjtIcF8tSOzZX2d_FE-Rara68iuPAgMt3Gz4cvkwmLiwIMQ5KKE48YyCjkliGoEusIeJHCx
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:816::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma
no-cache
date
Sun, 29 Mar 2020 00:37:44 GMT
x-content-type-options
nosniff
content-type
image/gif
server
cafe
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
cache-control
no-cache, no-store, must-revalidate
content-security-policy
script-src 'none'; object-src 'none'
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma
no-cache
date
Sun, 29 Mar 2020 00:37:44 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
location
https://www.google.de/pagead/1p-user-list/770961656/?random=1585442264897&cv=9&fst=1585440000000&num=1&fmt=3&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2od3i0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fardacademy.org%2Fwp-content%2Fcc%2F%3Feml%3Djashye%40mail.nasd&tiba=Online%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&async=1&is_vtc=1&random=593359102&resp=GooglemKTybQhCsO&ipr=y&ezwbk=AZuM4hDv_KXZlgm4YbeC7sjtIcF8tSOzZX2d_FE-Rara68iuPAgMt3Gz4cvkwmLiwIMQ5KKE48YyCjkliGoEusIeJHCx
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
302
cache-control
no-cache, no-store, must-revalidate
content-security-policy
script-src 'none'; object-src 'none'
content-type
image/gif
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
www.google.de/pagead/1p-user-list/819500023/
Redirect Chain
  • https://googleads.g.doubleclick.net/pagead/viewthroughconversion/819500023/?random=1585442264897&cv=9&fst=1585442264897&num=1&fmt=3&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=12...
  • https://www.google.com/pagead/1p-user-list/819500023/?random=1585442264897&cv=9&fst=1585440000000&num=1&fmt=3&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=...
  • https://www.google.de/pagead/1p-user-list/819500023/?random=1585442264897&cv=9&fst=1585440000000&num=1&fmt=3&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=f...
42 B
110 B
Image
General
Full URL
https://www.google.de/pagead/1p-user-list/819500023/?random=1585442264897&cv=9&fst=1585440000000&num=1&fmt=3&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2od3i0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fardacademy.org%2Fwp-content%2Fcc%2F%3Feml%3Djashye%40mail.nasd&tiba=Online%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&async=1&is_vtc=1&random=3679954962&resp=GooglemKTybQhCsO&ipr=y&ezwbk=AZuM4hD32pLtNohfmkms6d240khAaw2VmLuVEnj_gG0sHHDPHRz4zYlZxPQ6mYhVzuzYxGYVV-WPpQlrzHT4PkZ0GkBP
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:816::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma
no-cache
date
Sun, 29 Mar 2020 00:37:44 GMT
x-content-type-options
nosniff
content-type
image/gif
server
cafe
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
cache-control
no-cache, no-store, must-revalidate
content-security-policy
script-src 'none'; object-src 'none'
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma
no-cache
date
Sun, 29 Mar 2020 00:37:44 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
location
https://www.google.de/pagead/1p-user-list/819500023/?random=1585442264897&cv=9&fst=1585440000000&num=1&fmt=3&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2od3i0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fardacademy.org%2Fwp-content%2Fcc%2F%3Feml%3Djashye%40mail.nasd&tiba=Online%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&async=1&is_vtc=1&random=3679954962&resp=GooglemKTybQhCsO&ipr=y&ezwbk=AZuM4hD32pLtNohfmkms6d240khAaw2VmLuVEnj_gG0sHHDPHRz4zYlZxPQ6mYhVzuzYxGYVV-WPpQlrzHT4PkZ0GkBP
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
302
cache-control
no-cache, no-store, must-revalidate
content-security-policy
script-src 'none'; object-src 'none'
content-type
image/gif
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
www.google.de/pagead/1p-user-list/763960929/
Redirect Chain
  • https://googleads.g.doubleclick.net/pagead/viewthroughconversion/763960929/?random=1585442264897&cv=9&fst=1585442264897&num=1&fmt=3&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=12...
  • https://www.google.com/pagead/1p-user-list/763960929/?random=1585442264897&cv=9&fst=1585440000000&num=1&fmt=3&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=...
  • https://www.google.de/pagead/1p-user-list/763960929/?random=1585442264897&cv=9&fst=1585440000000&num=1&fmt=3&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=f...
42 B
110 B
Image
General
Full URL
https://www.google.de/pagead/1p-user-list/763960929/?random=1585442264897&cv=9&fst=1585440000000&num=1&fmt=3&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2od3i0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fardacademy.org%2Fwp-content%2Fcc%2F%3Feml%3Djashye%40mail.nasd&tiba=Online%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&async=1&is_vtc=1&random=4059490916&resp=GooglemKTybQhCsO&ipr=y&ezwbk=AZuM4hB6_-vb9N7gX83zaFXu8N_-C2JyPfb0h3AnOY3579oHhm4O7_H5Is-u4yeKuVfo5UGC6p2hkrZOCkMynyb9ptIw
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:816::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma
no-cache
date
Sun, 29 Mar 2020 00:37:44 GMT
x-content-type-options
nosniff
content-type
image/gif
server
cafe
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
cache-control
no-cache, no-store, must-revalidate
content-security-policy
script-src 'none'; object-src 'none'
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma
no-cache
date
Sun, 29 Mar 2020 00:37:44 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
location
https://www.google.de/pagead/1p-user-list/763960929/?random=1585442264897&cv=9&fst=1585440000000&num=1&fmt=3&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2od3i0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fardacademy.org%2Fwp-content%2Fcc%2F%3Feml%3Djashye%40mail.nasd&tiba=Online%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&async=1&is_vtc=1&random=4059490916&resp=GooglemKTybQhCsO&ipr=y&ezwbk=AZuM4hB6_-vb9N7gX83zaFXu8N_-C2JyPfb0h3AnOY3579oHhm4O7_H5Is-u4yeKuVfo5UGC6p2hkrZOCkMynyb9ptIw
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
302
cache-control
no-cache, no-store, must-revalidate
content-security-policy
script-src 'none'; object-src 'none'
content-type
image/gif
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
www.google.de/pagead/1p-user-list/959299794/
Redirect Chain
  • https://googleads.g.doubleclick.net/pagead/viewthroughconversion/959299794/?random=1585442264897&cv=9&fst=1585442264897&num=1&fmt=3&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=12...
  • https://www.google.com/pagead/1p-user-list/959299794/?random=1585442264897&cv=9&fst=1585440000000&num=1&fmt=3&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=...
  • https://www.google.de/pagead/1p-user-list/959299794/?random=1585442264897&cv=9&fst=1585440000000&num=1&fmt=3&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=f...
42 B
110 B
Image
General
Full URL
https://www.google.de/pagead/1p-user-list/959299794/?random=1585442264897&cv=9&fst=1585440000000&num=1&fmt=3&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2od3i0&sendb=1&data=event%3Dconversion&frm=0&url=https%3A%2F%2Fardacademy.org%2Fwp-content%2Fcc%2F%3Feml%3Djashye%40mail.nasd&tiba=Online%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&async=1&is_vtc=1&random=2769558500&resp=GooglemKTybQhCsO&ipr=y&ezwbk=AZuM4hACYYfE9iLn60rDm9OIgv6RK3aDeNa_DMFwQ7ibS7b4fAR7uW4KXMNf7wLw6dAAXcwG-wk_yv3TptnaKS4bDHPX
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:816::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma
no-cache
date
Sun, 29 Mar 2020 00:37:44 GMT
x-content-type-options
nosniff
content-type
image/gif
server
cafe
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
cache-control
no-cache, no-store, must-revalidate
content-security-policy
script-src 'none'; object-src 'none'
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma
no-cache
date
Sun, 29 Mar 2020 00:37:44 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
location
https://www.google.de/pagead/1p-user-list/959299794/?random=1585442264897&cv=9&fst=1585440000000&num=1&fmt=3&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2od3i0&sendb=1&data=event%3Dconversion&frm=0&url=https%3A%2F%2Fardacademy.org%2Fwp-content%2Fcc%2F%3Feml%3Djashye%40mail.nasd&tiba=Online%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&async=1&is_vtc=1&random=2769558500&resp=GooglemKTybQhCsO&ipr=y&ezwbk=AZuM4hACYYfE9iLn60rDm9OIgv6RK3aDeNa_DMFwQ7ibS7b4fAR7uW4KXMNf7wLw6dAAXcwG-wk_yv3TptnaKS4bDHPX
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
302
cache-control
no-cache, no-store, must-revalidate
content-security-policy
script-src 'none'; object-src 'none'
content-type
image/gif
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
www.google.de/pagead/1p-user-list/916451471/
Redirect Chain
  • https://googleads.g.doubleclick.net/pagead/viewthroughconversion/916451471/?random=1585442264898&cv=9&fst=1585442264898&num=1&fmt=3&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=12...
  • https://www.google.com/pagead/1p-user-list/916451471/?random=1585442264898&cv=9&fst=1585440000000&num=1&fmt=3&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=...
  • https://www.google.de/pagead/1p-user-list/916451471/?random=1585442264898&cv=9&fst=1585440000000&num=1&fmt=3&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=f...
42 B
110 B
Image
General
Full URL
https://www.google.de/pagead/1p-user-list/916451471/?random=1585442264898&cv=9&fst=1585440000000&num=1&fmt=3&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2od3i0&sendb=1&data=event%3Dconversion&frm=0&url=https%3A%2F%2Fardacademy.org%2Fwp-content%2Fcc%2F%3Feml%3Djashye%40mail.nasd&tiba=Online%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&async=1&is_vtc=1&random=1366944797&resp=GooglemKTybQhCsO&ipr=y&ezwbk=AZuM4hCVkIlaXakMRVMmlcTh295uz0jbNY2QvouwKirf4dXBjtY4WxN6J3WBoUwVTdVe7P2PmiZ8eXAlgXMWoIjMavVR
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:816::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma
no-cache
date
Sun, 29 Mar 2020 00:37:44 GMT
x-content-type-options
nosniff
content-type
image/gif
server
cafe
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
cache-control
no-cache, no-store, must-revalidate
content-security-policy
script-src 'none'; object-src 'none'
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma
no-cache
date
Sun, 29 Mar 2020 00:37:44 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
location
https://www.google.de/pagead/1p-user-list/916451471/?random=1585442264898&cv=9&fst=1585440000000&num=1&fmt=3&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2od3i0&sendb=1&data=event%3Dconversion&frm=0&url=https%3A%2F%2Fardacademy.org%2Fwp-content%2Fcc%2F%3Feml%3Djashye%40mail.nasd&tiba=Online%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&async=1&is_vtc=1&random=1366944797&resp=GooglemKTybQhCsO&ipr=y&ezwbk=AZuM4hCVkIlaXakMRVMmlcTh295uz0jbNY2QvouwKirf4dXBjtY4WxN6J3WBoUwVTdVe7P2PmiZ8eXAlgXMWoIjMavVR
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
302
cache-control
no-cache, no-store, must-revalidate
content-security-policy
script-src 'none'; object-src 'none'
content-type
image/gif
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
www.google.de/pagead/1p-user-list/975701947/
Redirect Chain
  • https://googleads.g.doubleclick.net/pagead/viewthroughconversion/975701947/?random=1585442264898&cv=9&fst=1585442264898&num=1&fmt=3&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=12...
  • https://www.google.com/pagead/1p-user-list/975701947/?random=1585442264898&cv=9&fst=1585440000000&num=1&fmt=3&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=...
  • https://www.google.de/pagead/1p-user-list/975701947/?random=1585442264898&cv=9&fst=1585440000000&num=1&fmt=3&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=f...
42 B
110 B
Image
General
Full URL
https://www.google.de/pagead/1p-user-list/975701947/?random=1585442264898&cv=9&fst=1585440000000&num=1&fmt=3&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2od3i0&sendb=1&data=event%3Dconversion&frm=0&url=https%3A%2F%2Fardacademy.org%2Fwp-content%2Fcc%2F%3Feml%3Djashye%40mail.nasd&tiba=Online%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&async=1&is_vtc=1&random=3227876887&resp=GooglemKTybQhCsO&ipr=y&ezwbk=AZuM4hColn3Sl7dmBxHZLuA4G9TmrFs-XlR1f_ku782PDUTIGsHYH6FT71O1h29JHquuHJk4Er_1xwSVWWJRjDu2sVwQ
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:816::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma
no-cache
date
Sun, 29 Mar 2020 00:37:45 GMT
x-content-type-options
nosniff
content-type
image/gif
server
cafe
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
cache-control
no-cache, no-store, must-revalidate
content-security-policy
script-src 'none'; object-src 'none'
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma
no-cache
date
Sun, 29 Mar 2020 00:37:45 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
location
https://www.google.de/pagead/1p-user-list/975701947/?random=1585442264898&cv=9&fst=1585440000000&num=1&fmt=3&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2od3i0&sendb=1&data=event%3Dconversion&frm=0&url=https%3A%2F%2Fardacademy.org%2Fwp-content%2Fcc%2F%3Feml%3Djashye%40mail.nasd&tiba=Online%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&async=1&is_vtc=1&random=3227876887&resp=GooglemKTybQhCsO&ipr=y&ezwbk=AZuM4hColn3Sl7dmBxHZLuA4G9TmrFs-XlR1f_ku782PDUTIGsHYH6FT71O1h29JHquuHJk4Er_1xwSVWWJRjDu2sVwQ
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
302
cache-control
no-cache, no-store, must-revalidate
content-security-policy
script-src 'none'; object-src 'none'
content-type
image/gif
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
www.google.de/pagead/1p-user-list/770961656/
Redirect Chain
  • https://googleads.g.doubleclick.net/pagead/viewthroughconversion/770961656/?random=1585442264898&cv=9&fst=1585442264898&num=1&fmt=3&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=12...
  • https://www.google.com/pagead/1p-user-list/770961656/?random=1585442264898&cv=9&fst=1585440000000&num=1&fmt=3&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=...
  • https://www.google.de/pagead/1p-user-list/770961656/?random=1585442264898&cv=9&fst=1585440000000&num=1&fmt=3&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=f...
42 B
110 B
Image
General
Full URL
https://www.google.de/pagead/1p-user-list/770961656/?random=1585442264898&cv=9&fst=1585440000000&num=1&fmt=3&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2od3i0&sendb=1&data=event%3Dconversion&frm=0&url=https%3A%2F%2Fardacademy.org%2Fwp-content%2Fcc%2F%3Feml%3Djashye%40mail.nasd&tiba=Online%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&async=1&is_vtc=1&random=2601173948&resp=GooglemKTybQhCsO&ipr=y&ezwbk=AZuM4hAy7J1Y1h0ZsNi6PXej2csGo7AakdrWb7IKaZ9sr3T9AmAoA3aQiGXuaHMPkVfDQCG7dxNLNXf42cZed-W3DV7F
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:816::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma
no-cache
date
Sun, 29 Mar 2020 00:37:45 GMT
x-content-type-options
nosniff
content-type
image/gif
server
cafe
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
cache-control
no-cache, no-store, must-revalidate
content-security-policy
script-src 'none'; object-src 'none'
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma
no-cache
date
Sun, 29 Mar 2020 00:37:45 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
location
https://www.google.de/pagead/1p-user-list/770961656/?random=1585442264898&cv=9&fst=1585440000000&num=1&fmt=3&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2od3i0&sendb=1&data=event%3Dconversion&frm=0&url=https%3A%2F%2Fardacademy.org%2Fwp-content%2Fcc%2F%3Feml%3Djashye%40mail.nasd&tiba=Online%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&async=1&is_vtc=1&random=2601173948&resp=GooglemKTybQhCsO&ipr=y&ezwbk=AZuM4hAy7J1Y1h0ZsNi6PXej2csGo7AakdrWb7IKaZ9sr3T9AmAoA3aQiGXuaHMPkVfDQCG7dxNLNXf42cZed-W3DV7F
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
302
cache-control
no-cache, no-store, must-revalidate
content-security-policy
script-src 'none'; object-src 'none'
content-type
image/gif
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
www.google.de/pagead/1p-user-list/819500023/
Redirect Chain
  • https://googleads.g.doubleclick.net/pagead/viewthroughconversion/819500023/?random=1585442264898&cv=9&fst=1585442264898&num=1&fmt=3&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=12...
  • https://www.google.com/pagead/1p-user-list/819500023/?random=1585442264898&cv=9&fst=1585440000000&num=1&fmt=3&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=...
  • https://www.google.de/pagead/1p-user-list/819500023/?random=1585442264898&cv=9&fst=1585440000000&num=1&fmt=3&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=f...
42 B
110 B
Image
General
Full URL
https://www.google.de/pagead/1p-user-list/819500023/?random=1585442264898&cv=9&fst=1585440000000&num=1&fmt=3&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2od3i0&sendb=1&data=event%3Dconversion&frm=0&url=https%3A%2F%2Fardacademy.org%2Fwp-content%2Fcc%2F%3Feml%3Djashye%40mail.nasd&tiba=Online%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&async=1&is_vtc=1&random=488110598&resp=GooglemKTybQhCsO&ipr=y&ezwbk=AZuM4hDQ9jpwXO3jKILmyJHFPtl_CUG0CJ1TjbSIFdEwMMq7R6Dw9pKj8Q77PA4X3lpb9Y3b-6E2bB9afVXGhiaVkBsD
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:816::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma
no-cache
date
Sun, 29 Mar 2020 00:37:45 GMT
x-content-type-options
nosniff
content-type
image/gif
server
cafe
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
cache-control
no-cache, no-store, must-revalidate
content-security-policy
script-src 'none'; object-src 'none'
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma
no-cache
date
Sun, 29 Mar 2020 00:37:45 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
location
https://www.google.de/pagead/1p-user-list/819500023/?random=1585442264898&cv=9&fst=1585440000000&num=1&fmt=3&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2od3i0&sendb=1&data=event%3Dconversion&frm=0&url=https%3A%2F%2Fardacademy.org%2Fwp-content%2Fcc%2F%3Feml%3Djashye%40mail.nasd&tiba=Online%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&async=1&is_vtc=1&random=488110598&resp=GooglemKTybQhCsO&ipr=y&ezwbk=AZuM4hDQ9jpwXO3jKILmyJHFPtl_CUG0CJ1TjbSIFdEwMMq7R6Dw9pKj8Q77PA4X3lpb9Y3b-6E2bB9afVXGhiaVkBsD
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
302
cache-control
no-cache, no-store, must-revalidate
content-security-policy
script-src 'none'; object-src 'none'
content-type
image/gif
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
www.google.de/pagead/1p-user-list/763960929/
Redirect Chain
  • https://googleads.g.doubleclick.net/pagead/viewthroughconversion/763960929/?random=1585442264898&cv=9&fst=1585442264898&num=1&fmt=3&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=12...
  • https://www.google.com/pagead/1p-user-list/763960929/?random=1585442264898&cv=9&fst=1585440000000&num=1&fmt=3&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=...
  • https://www.google.de/pagead/1p-user-list/763960929/?random=1585442264898&cv=9&fst=1585440000000&num=1&fmt=3&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=f...
42 B
110 B
Image
General
Full URL
https://www.google.de/pagead/1p-user-list/763960929/?random=1585442264898&cv=9&fst=1585440000000&num=1&fmt=3&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2od3i0&sendb=1&data=event%3Dconversion&frm=0&url=https%3A%2F%2Fardacademy.org%2Fwp-content%2Fcc%2F%3Feml%3Djashye%40mail.nasd&tiba=Online%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&async=1&is_vtc=1&random=785431297&resp=GooglemKTybQhCsO&ipr=y&ezwbk=AZuM4hB9aGSJt8uVA2-BTg6Zx8PYVY9FpPvAkkL72XDGKszqt-bk2uZDPxJ41gAMBG_QixacrHJC3Fww4_RoRC6WXuYc
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:816::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma
no-cache
date
Sun, 29 Mar 2020 00:37:45 GMT
x-content-type-options
nosniff
content-type
image/gif
server
cafe
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
cache-control
no-cache, no-store, must-revalidate
content-security-policy
script-src 'none'; object-src 'none'
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma
no-cache
date
Sun, 29 Mar 2020 00:37:45 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
location
https://www.google.de/pagead/1p-user-list/763960929/?random=1585442264898&cv=9&fst=1585440000000&num=1&fmt=3&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2od3i0&sendb=1&data=event%3Dconversion&frm=0&url=https%3A%2F%2Fardacademy.org%2Fwp-content%2Fcc%2F%3Feml%3Djashye%40mail.nasd&tiba=Online%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&async=1&is_vtc=1&random=785431297&resp=GooglemKTybQhCsO&ipr=y&ezwbk=AZuM4hB9aGSJt8uVA2-BTg6Zx8PYVY9FpPvAkkL72XDGKszqt-bk2uZDPxJ41gAMBG_QixacrHJC3Fww4_RoRC6WXuYc
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
302
cache-control
no-cache, no-store, must-revalidate
content-security-policy
script-src 'none'; object-src 'none'
content-type
image/gif
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
www.google.com/pagead/1p-user-list/916451471/
42 B
119 B
Image
General
Full URL
https://www.google.com/pagead/1p-user-list/916451471/?random=1585442264897&cv=9&fst=1585440000000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2od3i0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fardacademy.org%2Fwp-content%2Fcc%2F%3Feml%3Djashye%40mail.nasd&tiba=Online%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&async=1&fmt=3&is_vtc=1&random=3738449790&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80b::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

pragma
no-cache
date
Sun, 29 Mar 2020 00:37:44 GMT
x-content-type-options
nosniff
content-type
image/gif
server
cafe
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
cache-control
no-cache, no-store, must-revalidate
content-security-policy
script-src 'none'; object-src 'none'
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
www.google.de/pagead/1p-user-list/916451471/
42 B
110 B
Image
General
Full URL
https://www.google.de/pagead/1p-user-list/916451471/?random=1585442264897&cv=9&fst=1585440000000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2od3i0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fardacademy.org%2Fwp-content%2Fcc%2F%3Feml%3Djashye%40mail.nasd&tiba=Online%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&async=1&fmt=3&is_vtc=1&random=3738449790&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:816::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

pragma
no-cache
date
Sun, 29 Mar 2020 00:37:44 GMT
x-content-type-options
nosniff
content-type
image/gif
server
cafe
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
cache-control
no-cache, no-store, must-revalidate
content-security-policy
script-src 'none'; object-src 'none'
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
www.google.com/pagead/1p-user-list/959299794/
42 B
119 B
Image
General
Full URL
https://www.google.com/pagead/1p-user-list/959299794/?random=1585442264895&cv=9&fst=1585440000000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2od3i0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fardacademy.org%2Fwp-content%2Fcc%2F%3Feml%3Djashye%40mail.nasd&tiba=Online%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&async=1&fmt=3&is_vtc=1&random=2891108212&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80b::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

pragma
no-cache
date
Sun, 29 Mar 2020 00:37:44 GMT
x-content-type-options
nosniff
content-type
image/gif
server
cafe
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
cache-control
no-cache, no-store, must-revalidate
content-security-policy
script-src 'none'; object-src 'none'
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
www.google.de/pagead/1p-user-list/959299794/
42 B
110 B
Image
General
Full URL
https://www.google.de/pagead/1p-user-list/959299794/?random=1585442264895&cv=9&fst=1585440000000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2od3i0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fardacademy.org%2Fwp-content%2Fcc%2F%3Feml%3Djashye%40mail.nasd&tiba=Online%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&async=1&fmt=3&is_vtc=1&random=2891108212&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:816::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

pragma
no-cache
date
Sun, 29 Mar 2020 00:37:44 GMT
x-content-type-options
nosniff
content-type
image/gif
server
cafe
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
cache-control
no-cache, no-store, must-revalidate
content-security-policy
script-src 'none'; object-src 'none'
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
www.google.com/pagead/1p-user-list/960621875/
42 B
113 B
Image
General
Full URL
https://www.google.com/pagead/1p-user-list/960621875/?random=1585442264896&cv=9&fst=1585440000000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2od3i0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fardacademy.org%2Fwp-content%2Fcc%2F%3Feml%3Djashye%40mail.nasd&tiba=Online%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&async=1&fmt=3&is_vtc=1&random=1519201027&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80b::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

pragma
no-cache
date
Sun, 29 Mar 2020 00:37:44 GMT
x-content-type-options
nosniff
content-type
image/gif
server
cafe
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
cache-control
no-cache, no-store, must-revalidate
content-security-policy
script-src 'none'; object-src 'none'
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
www.google.de/pagead/1p-user-list/960621875/
42 B
110 B
Image
General
Full URL
https://www.google.de/pagead/1p-user-list/960621875/?random=1585442264896&cv=9&fst=1585440000000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2od3i0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fardacademy.org%2Fwp-content%2Fcc%2F%3Feml%3Djashye%40mail.nasd&tiba=Online%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&async=1&fmt=3&is_vtc=1&random=1519201027&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:816::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

pragma
no-cache
date
Sun, 29 Mar 2020 00:37:44 GMT
x-content-type-options
nosniff
content-type
image/gif
server
cafe
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
cache-control
no-cache, no-store, must-revalidate
content-security-policy
script-src 'none'; object-src 'none'
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
www.google.com/pagead/1p-user-list/960621875/
42 B
113 B
Image
General
Full URL
https://www.google.com/pagead/1p-user-list/960621875/?random=1585442264898&cv=9&fst=1585440000000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2od3i0&sendb=1&data=event%3Dconversion&frm=0&url=https%3A%2F%2Fardacademy.org%2Fwp-content%2Fcc%2F%3Feml%3Djashye%40mail.nasd&tiba=Online%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&async=1&fmt=3&is_vtc=1&random=2094701577&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80b::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

pragma
no-cache
date
Sun, 29 Mar 2020 00:37:44 GMT
x-content-type-options
nosniff
content-type
image/gif
server
cafe
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
cache-control
no-cache, no-store, must-revalidate
content-security-policy
script-src 'none'; object-src 'none'
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
www.google.de/pagead/1p-user-list/960621875/
42 B
110 B
Image
General
Full URL
https://www.google.de/pagead/1p-user-list/960621875/?random=1585442264898&cv=9&fst=1585440000000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2od3i0&sendb=1&data=event%3Dconversion&frm=0&url=https%3A%2F%2Fardacademy.org%2Fwp-content%2Fcc%2F%3Feml%3Djashye%40mail.nasd&tiba=Online%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&async=1&fmt=3&is_vtc=1&random=2094701577&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:816::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
image

Response headers

pragma
no-cache
date
Sun, 29 Mar 2020 00:37:44 GMT
x-content-type-options
nosniff
content-type
image/gif
server
cafe
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status
200
cache-control
no-cache, no-store, must-revalidate
content-security-policy
script-src 'none'; object-src 'none'
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
clear.png
content22.online.citi.com/fp/ Frame 3C71
0
387 B
Script
General
Full URL
https://content22.online.citi.com/fp/clear.png?org_id=89oebq5k&session_id=9646094ba7b58acb03dad3f75e50dcf29574f85b76dd9ada42ddaf7cafc1207c&nonce=1d35291145502344&pageid=1&jac=1&je=3a373024267f65607276615f616e7667726c616c5f6b723f343533333867353625303a323125346637352d626d32632d3234643634346134663a37382c6c6d61696e2c33343c3764383a3a2d393060642d363631342f3b6733312d333134676769346631353d332c6e6d636164267765627074635f677a7665706c616e5f6b72353339362e3b362c3133322e3a35302462637473743f79206c6576656c2038332630322c207b74637677732232226368617067696e65207f266377646a3d66666a673361633e3531326330656e336737373766326667376662313737333263673f3537313269373232646161393765376333333233373030343532663666
Requested by
Host: content22.online.citi.com
URL: https://content22.online.citi.com/fp/check.js;CIS3SID=CB9CBD87942D7948E5F9FBE01E0E5A9B?org_id=89oebq5k&session_id=9646094ba7b58acb03dad3f75e50dcf29574f85b76dd9ada42ddaf7cafc1207c&nonce=1d35291145502344&pageid=1&jb=3b3526246a7b6f773d4e6b6e7d782468736d3d4c696c777a266a73623d416a70676d672530383736
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
91.235.134.21 , Netherlands, ASN30286 (THM, US),
Reverse DNS
Software
Apache /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest
script

Response headers

Pragma
no-cache
Date
Sun, 29 Mar 2020 00:37:45 GMT
X-Content-Type-Options
nosniff
Server
Apache
Strict-Transport-Security
max-age=31536000
Content-Type
text/javascript
Cache-Control
no-cache, no-store, must-revalidate
Connection
Keep-Alive
Keep-Alive
timeout=2, max=97
X-XSS-Protection
1; mode=block
Expires
Thu, 01 Jan 1970 00:00:00 GMT
cls_report
prod.report.nacustomerexperience.citi.com/glassbox/reporting/
9 KB
2 KB
XHR
General
Full URL
https://prod.report.nacustomerexperience.citi.com/glassbox/reporting/cls_report?clsjsv=6.2.78B29&_cls_s=2bdee520-cded-44cf-a1e5-117ab42128d6:0&_cls_v=80a8b913-209a-4f2e-839d-44749fa3731c&pid=b6bcb460-4bb2-40b3-bdd9-ab11044aa7f1&sn=1
Requested by
Host: ardacademy.org
URL: https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
192.193.200.243 , United States, ASN32287 (SOLANA-CITIPLEX, US),
Reverse DNS
Software
GlassBox Cligate /
Resource Hash
e5a404fe91ba8702ae9142d9aa2ccd348658d0bc7fb2011f3ec0907be83c3dbe
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubdomains;
X-Frame-Options SAMEORIGIN

Request headers

Referer
https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
Origin
https://ardacademy.org
Sec-Fetch-Dest
empty
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type
application/x-www-form-urlencoded

Response headers

Date
Sun, 29 Mar 2020 00:37:45 GMT
Content-Encoding
gzip
Vary
Origin
Server
GlassBox Cligate
X-Akamai-CITISITE
SWDC
X-Frame-Options
SAMEORIGIN
Strict-Transport-Security
max-age=63072000; includeSubdomains;
Content-Type
application/json
Access-Control-Allow-Origin
https://ardacademy.org
Access-Control-Allow-Credentials
true
Connection
close
Transfer-Encoding
chunked
cls_report
prod.report.nacustomerexperience.citi.com/glassbox/reporting/
9 KB
2 KB
XHR
General
Full URL
https://prod.report.nacustomerexperience.citi.com/glassbox/reporting/cls_report?clsjsv=6.2.78B29&_cls_s=2bdee520-cded-44cf-a1e5-117ab42128d6:0&_cls_v=80a8b913-209a-4f2e-839d-44749fa3731c&pid=b6bcb460-4bb2-40b3-bdd9-ab11044aa7f1&sn=2
Requested by
Host: ardacademy.org
URL: https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
192.193.200.243 , United States, ASN32287 (SOLANA-CITIPLEX, US),
Reverse DNS
Software
GlassBox Cligate /
Resource Hash
e5a404fe91ba8702ae9142d9aa2ccd348658d0bc7fb2011f3ec0907be83c3dbe
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubdomains;
X-Frame-Options SAMEORIGIN

Request headers

Referer
https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
Origin
https://ardacademy.org
Sec-Fetch-Dest
empty
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type
application/x-www-form-urlencoded

Response headers

Date
Sun, 29 Mar 2020 00:37:55 GMT
Content-Encoding
gzip
Vary
Origin
Server
GlassBox Cligate
X-Akamai-CITISITE
SWDC
X-Frame-Options
SAMEORIGIN
Strict-Transport-Security
max-age=63072000; includeSubdomains;
Content-Type
application/json
Access-Control-Allow-Origin
https://ardacademy.org
Access-Control-Allow-Credentials
true
Connection
close
Transfer-Encoding
chunked
cls_report
prod.report.nacustomerexperience.citi.com/glassbox/reporting/
9 KB
2 KB
XHR
General
Full URL
https://prod.report.nacustomerexperience.citi.com/glassbox/reporting/cls_report?clsjsv=6.2.78B29&_cls_s=2bdee520-cded-44cf-a1e5-117ab42128d6:0&_cls_v=80a8b913-209a-4f2e-839d-44749fa3731c&pid=b6bcb460-4bb2-40b3-bdd9-ab11044aa7f1&sn=3
Requested by
Host: ardacademy.org
URL: https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
192.193.200.243 , United States, ASN32287 (SOLANA-CITIPLEX, US),
Reverse DNS
Software
GlassBox Cligate /
Resource Hash
e5a404fe91ba8702ae9142d9aa2ccd348658d0bc7fb2011f3ec0907be83c3dbe
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubdomains;
X-Frame-Options SAMEORIGIN

Request headers

Referer
https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd
Origin
https://ardacademy.org
Sec-Fetch-Dest
empty
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type
application/x-www-form-urlencoded

Response headers

Date
Sun, 29 Mar 2020 00:37:55 GMT
Content-Encoding
gzip
Vary
Origin
Server
GlassBox Cligate
X-Akamai-CITISITE
SWDC
X-Frame-Options
SAMEORIGIN
Strict-Transport-Security
max-age=63072000; includeSubdomains;
Content-Type
application/json
Access-Control-Allow-Origin
https://ardacademy.org
Access-Control-Allow-Credentials
true
Connection
close
Transfer-Encoding
chunked

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
0d22d313-900b-4c1e-b14c-8f366968c366
URL
moz-extension://0d22d313-900b-4c1e-b14c-8f366968c366/scripts/webrtc-patch.js

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Citibank (Banking)

494 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onformdata object| onpointerrawupdate function| GooglemKTybQhCsO function| google_trackConversion object| google_tag_manager object| dataLayer object| YT object| YTConfig function| onYTReady function| extend function| RocketfuelBCPInclude function| RocketfuelBCPClass function| RocketfuelUtils function| _rfi object| RocketfuelBCP object| bundle function| _trackAnalytics object| _dl object| _pp function| setImmediate function| clearImmediate function| ttd_dom_ready function| TTDUniversalPixelApi undefined| module undefined| lang undefined| searchEnable undefined| userRole undefined| visitor undefined| isLoggedin undefined| _j object| citiData string| pageDef string| _server string| _site string| pageName boolean| isLEChatDisable string| _locale string| _f function| $ function| jQuery object| jQuery191018006514221457426 object| respond object| ensBootstraps object| Bootstrapper function| targetPageParams function| mboxUrlBuilder function| mboxStandardFetcher function| mboxAjaxFetcher function| mboxMap function| mboxList function| mboxSignaler function| mboxLocatorDefault function| mboxLocatorNode function| mboxOfferContent function| mboxOfferAjax function| mboxOfferDefault function| mboxCookieManager function| mboxSession function| mboxPC function| mboxGetPageParameter function| mboxCookiePageDomain function| mboxShiftArray function| mboxGenerateId function| mboxScreenHeight function| mboxScreenWidth function| mboxBrowserWidth function| mboxBrowserHeight function| mboxBrowserTimeOffset function| mboxScreenColorDepth function| mbox function| mboxFactory function| mboxScPluginFetcher object| mboxFactories object| mboxFactoryDefault number| mboxVersion function| mboxCreate function| mboxDefine function| mboxUpdate function| mboxVizTargetUrl function| mboxSetCookie function| mboxGetCookie function| mboxLoadSCPlugin object| _AT object| TNT string| mboxCopyright function| Visitor object| s_c_il number| s_c_in object| adobe_visitor function| getSizzleForTarget object| mboxCurrent object| google object| td_2A boolean| tmx_profiling_started object| td_4j function| tmx_run_page_fingerprinting function| tmx_post_session_params_fixed object| KAMPYLE_EMBED string| isPeOfferSSIServiceFlag string| peOfferServiceThrottleValue string| liveRampUrl_NGA boolean| liveRampFeatureOct18 string| liveRampUrl_CSI_Oct18 string| liveRampUrl_SSI_Oct18 string| liveRampUrl_newApi_Oct18 string| liveRampTimeout_newApi_Oct18 object| liveRampStatus string| idl object| vendorData object| liveRampParseTempArray object| liveRampMessage function| prepareLiveRampUrl function| triggerLiveRamp function| validateLiveRampResponse function| parseLiveRampResponse function| updateLiveRampStatus string| aosDomain boolean| peOfferServiceThrottle string| bcCookieName string| bcsid function| setBCCookie function| getBCCookie object| cdApi function| getParentLocation function| isSelfLoc function| isXFSWhiteListed string| parentLocation boolean| XFSWhitelisted string| domainName string| JFP_CSRF_TOKEN object| OBJ_JFP_CSRF_TOKEN boolean| isCSRFAutomationEnabled function| isValidDomain function| isValidUrl function| aMMAddl2uLXQQ function| JKJpkyMhBVhgVP function| jIB6chJDVpcn function| addExtraField string| topDM boolean| flagvalue object| ttMETA function| ttMBX number| signonInitialHeight undefined| signonModalHeight boolean| signonBlock function| populateEFDParams function| populateClientData function| submitRSADevicePrint function| submitmobilegeolocation function| doSubmit function| signOnUnamePwdError function| clearFieldErrorValidation function| onSelectUser function| insertAfter function| mask function| focusOn function| blurOn function| doMask function| OpenInNewTab function| displayLable function| launchPopup function| tv function| initMLC function| displayServerName function| isTestDomain function| getCookie function| setCookie function| calLinkCharLength function| truncateOtherAlert function| truncateBrowserAlert function| passTmplObj function| closeAlertBox function| showFullMsg function| hideFullMsg function| truncateMsg function| showAlerts function| hideAlerts function| handleOutageAlert function| handleSignonLink function| adjustHeroHeight function| adjustHeroOnRotation object| yt function| ytDomDomGetNextId object| ytEventsEventsListeners object| ytEventsEventsCounter object| ytPubsubPubsubInstance object| ytPubsubPubsubSubscribedKeys object| ytPubsubPubsubTopicToKeys object| ytPubsubPubsubIsSynchronous object| ytLoggingTransportLogPayloadsQueue_ object| ytLoggingTransportTokensToCttTargetIds_ object| ytLoggingTransportDispatchedStats_ object| ytytLoggingTransportCapturedTime_ object| ytLoggingGelSequenceIdObj_ function| Hashtable function| startsWith function| DomDataCollection function| IE_FingerPrint function| Mozilla_FingerPrint function| Opera_FingerPrint function| Timer function| getRandomPort object| ProxyCollector function| BlackberryLocationCollector function| detectFields string| SEP string| PAIR string| DEV function| FingerPrint function| urlEncode function| encode_deviceprint function| decode_deviceprint function| post_deviceprint function| post_fingerprints function| add_deviceprint function| form_add_data function| form_add_deviceprint string| HTML5 string| BLACKBERRY string| UNDEFINED string| GEO_LOCATION_DEFAULT_STRUCT object| geoLocator boolean| geoLocatorStatus function| detectDeviceCollectionAPIMode function| init function| startCollection function| stopCollection function| getGeolocationStruct function| HTML5LocationCollector object| UIEventCollector function| UIEvent function| InteractionElement function| UIElementList function| activeXDetect function| stripIllegalChars function| stripFullPath object| BrowserDetect function| convertTimestampToGMT function| getTimestampInMillis function| debug function| forceIE89Synchronicity string| test boolean| defaultOffersActive undefined| RFObject string| language boolean| isAggregator function| ngaKA string| counter string| loginExp object| jsonContent object| offerPlacements boolean| epTurnedOff boolean| isPELocale object| PRConfig undefined| PRcallback function| reviewsClicked function| prConnection function| setReview_banner function| fetchPRReviews string| isTaggingTransformationSet object| taggingDlArr string| OSResponse string| RFResponse string| CMSStatus object| moduleArr object| contentIdArr object| resPlKeys object| offerlistArr object| rfPlacementsArr boolean| isMobile boolean| RFthrottle string| userType string| GPOLUrl string| acxiomTimeout string| cmsCallTimeout string| CUUIDUpdated boolean| bkEnabled string| bluekaiUrl string| aoUrl string| mktUrl string| updateDmpTimeout string| ecmCampaign object| ecmNames string| loginbkTimeout string| subChannel string| RFUrl string| rfCallTimeout boolean| PEAugustFallback boolean| PESeptFallback string| clientIpAddress string| osUrl string| osTimeout string| osClientId string| osScope string| peOfferSSIFlowCookie boolean| peOctFallback boolean| peNovFallback undefined| callCMSServiceRFDecision string| cmsBannerServiceDomain string| cmsBannerServiceTimeout string| cmsBannerServiceScope string| cmsBannerServiceClientId string| locale_PE boolean| peBluekaiMobileIntgFlag string| metricsCaptureUrl string| metricsCaptureClientId string| metricsCaptureScope string| metricsCaptureTimeout object| clientMetricsStatus object| metricsCaptureArray object| clientMetricsRequestKeys boolean| peClientMetricsFlag boolean| august2018FeaturesSwitch object| defaultContentIdArray object| bannerTrackingJSON undefined| bannerTrackingDefaultOffers boolean| peUrlMaskingFeature object| OSRawResponse object| schshArray object| sourceCodeBrandArr string| clearExp string| expCookieValue undefined| exdate undefined| cookie_value boolean| clearExpCookie object| __gcse object| _cls_config object| eventEncodingUtils object| _detector function| getParameterByName string| email object| httpStatus function| AppMeasurement number| s_objectID number| s_giq string| rsidAry object| s_tms function| bk_async object| detachedRemChkBoxDesktop object| detachedRemChkBoxMobile string| maskedPlaceHolder string| uidInputField string| contextPath object| alerts boolean| signonLock undefined| callbackFunction boolean| io_install_flash boolean| io_install_stm string| io_bbout_element_id number| io_exclude_stm string| iovationUrl string| iovationTimeout string| iovationNotAvailable function| setIOBlackBox function| deviceprint_blackbox function| removeSignonLock object| val object| tags object| BKTAG function| bk_addUserCtx function| bk_addPageCtx function| bk_addEmailHash function| bk_addPhoneHash function| bk_doJSTag function| bk_doJSTag2 function| bk_doCarsJSTag function| bk_doPartnerAltTag function| bk_doCallbackTag function| bk_doCallbackTagWithTimeOut function| mobileBadgeClick function| desktopBadgeClick boolean| bk_use_multiple_iframes boolean| bk_allow_multiple_calls object| closure_lm_423105 function| nullCheck function| firstCobrowseOverlay function| hideOverlay function| cobrowseOverlay function| showAlert function| requestCobrowse object| dropdownData function| $CitiSearch function| StringBuffer object| Base64 function| Utf8EncodeEnumerator function| Base64DecodeEnumerator function| _ object| Handlebars undefined| CitiSearchService undefined| nexusPlatformChatEscalationCBOL undefined| CitiSearchDelegate object| CitiSmartSearchTmpl undefined| nexusPlatformDelegateToCBOL undefined| CitiSearchJSVar undefined| contentFetchFromDB undefined| bodySearchCall undefined| CitiLiveSearchController undefined| CitiFullSearchController function| $autocomplete function| disableAutocomplete function| asyncpost_deviceprint string| m7gBdXvqO2XCe516E string| q5dmCt1o0Q9Gp1gxvHF string| bbDbyUXgK1NNs20M9 string| migratedAlert object| v object| MDIGITAL object| KAMPYLE_CONSTANT object| KAMPYLE_FUNC object| KAMPYLE_DATA object| KAMPYLE_TARGETING object| KAMPYLE_ANIMATION object| KAMPYLE_VIEW object| KAMPYLE_MESSAGE object| KAMPYLE_UTILS object| KAMPYLE_EVENT_DISPATCHER object| MDIGITAL_OnPrem object| KAMPYLE_COOLADATA object| KAMPYLE_COMMON object| KAMPYLE_THERMO_TEALEAF_FUNC object| KAMPYLE_ADOBE_ANALYTICS object| KAMPYLE_CLICKTALE_FUNC object| KAMPYLE_SESSIONCAM object| KAMPYLE_ONSITE_SDK undefined| KAMPYLE_POLYFILLS object| KAMPYLE_INTEGRATION object| cooladata string| _i_a string| localObjectName function| __if_a function| __if_b function| __if_c object| _i_d object| _i_o object| _i_z object| _i_aa object| _i_ac object| _i_cr function| __if_d object| io_adp function| __if_e object| _i_dt function| __if_f function| iov_fl_cb function| iov_fl_fn function| iov_fl_get_value function| __if_g object| io_dp function| __if_h function| ioGetBlackbox object| io_cm function| __if_i object| _i_fm object| _i_fn object| _i_fo object| _i_dl object| _i_fp function| __if_j function| __if_k number| _i_fq function| __if_l number| _i_fs function| __if_m string| io_last_error object| IGLOO string| io_stm_cab_url string| io_install_stm_error_handler string| io_flash_needs_update_handler boolean| io_enable_rip object| io_flash_blacklist object| io_flash_whitelist string| io_min_flash_in_firefox_version string| io_min_flash_in_firefox_linux_version string| io_min_flash_version string| _i_dw number| _i_g number| _i_bl object| local_params function| gtag boolean| yetToRunBannerTrack undefined| CCSID undefined| citiLocale boolean| citiNGA string| pageID string| sName function| s_getLoadTime function| s_gi function| s_pgicq function| c_r function| c_rspers function| c_w object| s number| s_loadT object| GooglebQhCsO

22 Cookies

Domain/Path Name / Value
.rfihub.com/ Name: rud
Value: H4sIAAAAAAAAAOMSNrQwNzAxNzS1NLEwtLC0tDQwMhXiM9TNKItycg0tzigrykmX4jU0tTA1MTEyMjM2tDQFAF7UFmc0AAAA
.rfihub.com/ Name: ruds
Value: H4sIAAAAAAAAAOMSNrQwNzAxNzS1NLEwtLC0tDQwMhXiM9TNKItycg0tzigrykkHAFb0sywlAAAA
ardacademy.org/ Name: kampyleSessionPageCounter
Value: 1
ardacademy.org/ Name: kampyleUserSessionsCount
Value: 1
ardacademy.org/ Name: kampyleUserSession
Value: 1585442264177
.ardacademy.org/ Name: cdSNum
Value: 1585442263466-sjn0000572-86b731ad-6c4a-4fe2-904e-a516885d7550
.doubleclick.net/ Name: IDE
Value: AHWqTUm3-vAAabXpRgvS6RVzRV0_Yd8bSk2SipP4qW0RJsiRPplzQcGYt73FQFdP
.ardacademy.org/ Name: cd_user_id
Value: 17123b914bef67-03b70eddd2dd57-37647e03-1d4c00-17123b914bfe52
.ardacademy.org/ Name: _cls_s
Value: 2bdee520-cded-44cf-a1e5-117ab42128d6:0
ardacademy.org/ Name: AMCVS_61834D9B5228A7430A490D45%40AdobeOrg
Value: 1
ardacademy.org/ Name: AMCV_61834D9B5228A7430A490D45%40AdobeOrg
Value: -330454231%7CMCIDTS%7C18351%7CMCMID%7C40906643178000525460304020409647378831%7CMCAAMLH-1586047063%7C6%7CMCAAMB-1586047063%7CRKhpRz8krg2tLO6pguXWp5olkAcUniQYPHaMWWgdJ3xzPWQmdj0y%7CMCOPTOUT-1585449463s%7CNONE%7CMCAID%7C2F3FF6EB8515B1F3-6000089B8445EBA9%7CMCSYNCSOP%7C411-18358%7CvVersion%7C3.1.2
.pbbl.co/ Name: pp_uid
Value: 59e19afc-941e-4859-ade5-7f6803468ced
.ardacademy.org/ Name: _gcl_au
Value: 1.1.1507464551.1585442264
ardacademy.org/ Name: 7018
Value:
.ardacademy.org/ Name: _cls_v
Value: 80a8b913-209a-4f2e-839d-44749fa3731c
ardacademy.org/ Name: count
Value: 1
.demdex.net/ Name: demdex
Value: 35599368996475573450980521148147697708
ardacademy.org/ Name: kampyle_userid
Value: 4569-23c1-41db-4eef-4a71-88c3-444e-91a8
.ardacademy.org/ Name: bmuid
Value: 1585442263051-A8C330A6-6277-437C-864C-E966FF1E3348
.ardacademy.org/ Name: cdContextId
Value: 2
ardacademy.org/ Name: 7830
Value: error
.ardacademy.org/ Name: mbox
Value: check#true#1585442323|session#2edfc057fb494797824e633a5fc6297d#1585444123|PC#7e2af4fc3aa542388607404c4b23e2b6.26_0#1586651864

8 Console Messages

Source Level URL
Text
console-api error URL: https://nebula-cdn.kampyle.com/resources/onsite/js/cool-2.1.15.min.js(Line 13)
Message:
Cooladata error: 'cooladata' object not initialized. Ensure you are using the latest version of the Cooladata JS Library along with the snippet we provide.
console-api log URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js(Line 136)
Message:
addMbox_tnt_cards value is false
console-api log URL: https://online.citi.com/passivebio/bcsid.js(Line 5)
Message:
Setting new bcsid Cookie
console-api log URL: https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd(Line 1581)
Message:
rsa flagtrue
console-api log URL: https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd(Line 1601)
Message:
isDCAFallback flag value is : false
console-api log URL: https://ardacademy.org/wp-content/cc/?eml=jashye@mail.nasd(Line 2581)
Message:
qrsignon cookie not found!
console-api log (Line 11)
Message:
test 12
console-api log URL: https://nebula-cdn.kampyle.com/resources/onsite/js/cool-2.1.15.min.js(Line 13)
Message:
You must name your new library: init(token, config, name)

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

0d22d313-900b-4c1e-b14c-8f366968c366
20766699p.rfihub.com
6260004.fls.doubleclick.net
89oebq5k6e5aknuqnxl5yc3ng5orx6szfks7ezmd1d35291145502344am1.e.aa.online-metrix.net
a.rfihub.com
aa.agkn.com
ad.doubleclick.net
adservice.google.com
api.rlcdn.com
ardacademy.org
bid.g.doubleclick.net
c1.rfihub.net
cdn.pbbl.co
cdn.tt.omtrdc.net
cfr.us.v2.we-stats.com
citi.demdex.net
citicorpcreditservic.tt.omtrdc.net
cm.everesttech.net
content22.online.citi.com
cse.google.com
cyseal.cyveillance.com
d.agkn.com
di.rlcdn.com
dpm.demdex.net
googleads.g.doubleclick.net
gwmtracking.com
h.online-metrix.net
insight.adsrvr.org
js.adsrvr.org
metrics1.citi.com
mpsnare.iesnare.com
nebula-cdn.kampyle.com
nexus.ensighten.com
online.citi.com
prod.report.nacustomerexperience.citi.com
pt.ispot.tv
px0.pbbl.co
resources.digital-cloud-citi.medallia.com
s.rfihub.com
s.ytimg.com
sr.rlcdn.com
stags.bluekai.com
tags.bkrtx.com
udc-neb.kampyle.com
www.citi.com
www.facebook.com
www.google.com
www.google.de
www.googleadservices.com
www.googletagmanager.com
www.youtube.com
0d22d313-900b-4c1e-b14c-8f366968c366
104.109.92.187
104.111.235.198
104.111.245.241
108.177.15.157
143.204.202.100
143.204.207.113
15.188.31.119
151.101.113.175
151.101.114.109
151.101.14.133
172.217.16.166
172.217.18.98
18.195.42.228
185.31.128.129
192.193.200.243
193.0.160.128
216.200.122.11
23.38.48.101
23.45.237.36
23.67.129.14
2600:9000:214f:a800:19:fc2c:a140:93a1
2a00:1450:4001:808::2008
2a00:1450:4001:80b::2004
2a00:1450:4001:816::2002
2a00:1450:4001:816::2003
2a00:1450:4001:817::200e
2a00:1450:4001:81a::200e
2a00:1450:4001:81c::2002
2a00:1450:4001:824::2013
2a00:1450:4001:825::200e
2a03:2880:f12d:83:face:b00c:0:25de
3.212.137.125
35.190.72.21
35.229.76.23
35.241.45.82
35.244.174.68
40.122.110.249
52.129.74.13
52.29.85.133
54.154.151.160
54.171.39.197
54.76.69.10
66.117.28.86
66.117.29.11
91.235.132.130
91.235.134.131
91.235.134.21
0227e0e4dea130eb6f3163aa3ab03720dce83a0e219c282189b03bc5b8a727e3
02c39275000c1280f9cde808ebe731ec1924477305678759c1140ecaac49eba0
043494ebdb60e363e2e8e0fa548a3863505bda2d81f28d2bf87d4f11380f39f4
0615974c40d602afdbf9759533e352bc17b0458c85aad6694b1a1ad20659625b
06974cc8c0ce8992ec94dd445dba1277b057effa321153aea76e1b160255a84c
06dfb367edf9bbff810def9f75f8695b3ccfbcb2813306609fc6e18fcacfc17e
10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa
128b5eb2de7c92e9be2f566be1ce1a72763a9be9d4c7554f7ea493f57d7e39e9
12b943f092c830301700c4abb5e5fdafbf07e34b66871c83c009befd63f7dfc0
13163595ed65608d87010840f927abe515a8d6cdef23d43e36bddd46a03f3bbf
147d5785b25331ac266f34841b05b4401ec78b0e0de6f85d63993ab0a9b5a253
195eb9928411a79a221ccfa9ce7fcc9898e55624ab0d66331af867d57adad461
1cc4ec61057f30cea6d47126e0444f119b2606720b1fe8d7e0deff1f5742a82b
1d6b802e59b40aa8540347ab5a754ef472500480deeeea720385753ba96cc8e8
1f2a57e02b78d41500eefc5786833bb24fcb010a90157effe981461cce195e0b
2233a44f005e8d416636e52aca33bc7ce726c1ab4d0801865162829d762c6de2
297c569cc74fa320e70736aaab738141d85c5c9d383fc26dc07beec92dd3b55d
2c19e11d4471da9bc727265662f6668dc3f142b0ae6a91d5ae908d6a6b2bc8ee
2f6d5d0b789697b08e7795901a5ce92029eb4e30a1f4e927f8e55be0fdcce242
31b00ff4929696dfca06885da68e58c3e09f6ecb4ae0fe1ae287e99a3fd1f716
331e846c17bf9cd732c1086710cdc3af20bb75a59d7de0fde40846a68b4fefd6
3340c28399b6004486ff6093d0426059c48f4c569c7a5d0061f6d8f3d8325ddd
358e7e9829fe41f8f61a8531fbd02b600fa77c8ae638f511eccdf0fb8475b4ac
3cb1f89cca21255888919872c51263c08dfc181d2600d2375bdbd8fda57788ce
3e72de5de67d6d80b65a114af684eaf880c53c250155a663cb17d677ff064bc1
3fca3de24621f0f10186594054444d608016297c2e853e548710b3521e42a609
40a20291f9b526cba58796a4bbd0256d5663313e02c9d5ab5a842476562b3108
429d8af3190c76d5fcb9b1cad2aa6eb555684921323da905d62017fbdbf557c6
44d3d4e66e1e7636e57911765054e696958d07ea55189620e27a1e163ba33957
470006833167eb6002e768cbe0865a86338c1fec3955d551e0f4f1d6a0ef7fa6
4734405c034b81eddf4f6a932437523f5ab8ba90e80182371c75736d0f3679fd
495c2b78f2deeec56065c5078a56deb4b4b6601773c98224cbe8517d0545adb2
4ac3cdf047e3c924611a51a52368039e2084e57d1a6c7a8c1313bc9f7c8effe3
4dcaf45c24f68f1e0b0007e72e3aa48fa417791740d2115cf7af1ba7f5c55571
4f918cd256712c03a1b88007176cabf623cc63740e919d35a217c18dc7ebe607
506575b752d10714465811aec4dd67a7bfb471fcbc2e9619c1faad68c110759e
51c032378bf28554b291386f91a0887454f180d7a691fb6fab51ea18a9167293
55e066703c69d4d89a1f4d66794d474aa93d710624d8f807096bac17a7867b17
574d7d4cc6ec33afda64c46a558217ef40ce6f0481d0c313cde52c430f2000fe
575d697f703ea404e1a023022aaeaaa81e98d1873cf2e7687238bd1606e4f625
5c1b3b2c4b13a950dbd72bb6132b2e172b446b20131f1bf8718e73011f15fd2b
6177c6163dc1ad67fb596a94ef3d18a277bfd437dbb3c1a928cd6caacefeff2e
61e114badfc7677a5ed175cf71afd46968ef8262cd4e5ec64ba0c743daae8e11
629b48196dcc270143a42ce57535b251c655617f8d510277d4a05306c426fd38
65855ae5635ed6239f9b29d48c4f677036051e61961161a882c9e4719659aa75
67e8a59dc958df2f9736da74581bbd147eb9613554faa4403c0b6bd3b44f411c
693b9b91798b4fdd281d3c029cb17eb5f3f24e2735aba88f35696e5197a52be2
6b21f7aaec509f321d98fb6fb80a90fcd674214d5eee801edfb543901970507e
6b869fdcddeb24f7dcbe7223f77eb1f701e74c63581b69d3ef4ec9b445795bba
6d3001c9deac8cb1f88ea5254105f8d678de5532f1998a24eab1b59906eaf86b
6d7ad53250169ccd9281596f258514e23bc9a51c091132c6ee7cb7d3b52bc4c9
701d2f9f02741b8429f4fb892b2b48c34a8a0f9189cb09013b2799031f22e484
74234e98afe7498fb5daf1f36ac2d78acc339464f950703b8c019892f982b90b
75fa9ee0533790f2671b2fedd28f1b4ce9bf66f178ccd9bb25e4a02377bb7b26
771c92ecc9167287111bc793f6392bfb0dc8a51a830b497f7591e6d3493fc1fc
793c2f3d02d0bc3ad8a2cdc901b2134159b66245e951ac258fee1ac8b2709f44
7adf69580aead1321588b6f81a92518ac9724f3da846970c349fa91630145bfc
7b8cd61f9d36175fe1b2fc50dfd1585716b9e55a87a82e8ec3c5d9739d6fb939
7cb24e06c00e47bb6bc6c38b935d6bc62817f656703387e4fb7591add96c7454
7d481eb36581746fd3662c7c452856b695df90cdce24664c48f565aa119c8b16
7df13706eaab8ce9a3dcd2a501f60bc66987c83834d07dfaf07ae56ef814c110
7ecf3bf86151cd72036fb67feb8fcbd8c80359e0ca871e1aeb955428ed43c26d
880960ba5b705083263a8a5329436c1e436a4c5bd618e2551e3c313d18ef88e2
8cad2492e705a54e5c4a634509b1d6c836dfb5bd179c2e58063653cc8635d6df
8e60e8edaca8a3167fe48e62f9b53ba1989a5b6a23283555f09ab12175fed96e
920a1269c4469182796fcaef9661e4a89fd9667ae24fa5e70b16317a020f3062
95518cbec0d55a574a9c8ef72a2a7d62ac0d40a4de5dfe67a76a7d214dc8b743
972256d3bce669df3ed0d7060d4b6897500a1a144c4891700370b6de287ac3d9
975ae8ed1eb80709002033f37d9a76d4dfb7f1b680888ebd18bf9ec93ac39100
99c2917ee5b2a01459a923bdd1c676f15ee73b62b87f696e6735312d26f51e12
99dd8270560893cf9937d476c3fd0cc09b406ee608f67cd568f8fe544aef6fce
9c44fb0565ffc7d415e1005124b6ab06f8f5af1ea0078a51c5b03fcc4ec882f0
9ceaa25ec7654a66294c16e28989fbf1ecb9cebc9debe96ec597529465c7cd50
9dad502247a8488c21ef5beb32aed1a78b17b748711bec817c472911f76b4ead
a612a8f640434c7aaee47569897c1fee79df6f146ec26115e2a8c9be645592b7
a6cd789bddb9565dd498ea70472bd4c85eef40c5f6a0572b5f870ab93c8f3032
a9623118fb6ec3944d1312cd0d492c3f32455e89bc1e01eafa67628a309d9c60
a9cebaefb3003c4944d0d59f71afdca3509d3975af5ff213d2750fdf8f719146
ae76982e42ad8bf33cc3a66ed389810d245242bcfa3dd2e3f05baf330f28098f
b2fc35bcf7ad38c6cbc6d170cc5bf15a688ba76d282272c3f0af4c6b31eb0631
b7264725078e153ab3a4af37c52374b3a5d46b8fb5fc7b5f8af2e773364eef93
ba74f7ef0a30f98952d47695239f892f41936959a479cfdaa33d7db58291fe3e
c3c994c3fe9bd4e055f6d0eb42067ecd6bdd3247e136bc22835b9882cfe77c61
c5b1ef448841c8a0f34532d4be5f5656d9eb4eea66e04755c0b64f2662d35eed
c8d8089cd33d869efa694df91d860ce8b4f88135e1f2b590906799dc7a19a65a
ca7048dd1a1d15f42c04c8f3db2d3bcffc6c7eb1be4506ca9fe2651b07766641
cb2bb21705b9cce9781d02c9223f3344a65bd5314027d11c5a8518ad4bd84e84
cdb828e2f4e62e1900133748ba426481b6c8383ebaca93133988da409506d3b4
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda
d118102507b97407ebf1533cc98ccd2e9d244524b456fd9c2b469b553396238a
d51830559f7549f10986694223043bdbac38b03e6130ec51434e154dd3702cde
d57c8034f9c12aa3ce626c9ed1d61a4bb0941c3ef320bb59346f20496fb0096a
db263c3392725557d609ae8445e2912ef2ba5bf79a7ba9831abd4b874556592d
dd256ae72a5f42f07046db6419e33dca617fe970ccb3844663a4fef8c23875e2
e05565885e234eeb2f32d5dabdf0a586c5dab3badbba206b1c27e1b34a75148b
e226935ba96b671378a7552d0669729f2b4733fab20624ed8018e86bad35401e
e2812b1e3529e5f39e3b0586e82c7ad0dfc3fc61cfa0107edfac16483d0547d7
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e48bd2b6e52ab098b853e901115ddf24a6b2d4fe04e96a5666ac7467bcb11958
e4f8bbc199745205470fa339a93a6160feee3a02f395f0458faa1853e0ded450
e5168b3d0c8f929a1b8c4c1b4e4ebac60ee0e1ecfd759aeb4be4c2b15e3fc097
e5a404fe91ba8702ae9142d9aa2ccd348658d0bc7fb2011f3ec0907be83c3dbe
e67c7e22d2ab8eecb0aca966f8da51fe7590de887dcaefba7c70ef8e7409e47c
e881e62582a1f9dbcb66a45f54ef7483ab57129314dbc98b897fcceaa61a4357
e90fb0eba512ed6473f6fb8acf4cd09b38732f150f43c396246c12bb2aacbb67
e9e9a67395a0d83b584208a19b95af203df8e8e6c6952fe76c690d60ea9381c7
eca1d20a663a7e242fa10ee2c58c742eb6292c898df29e16734ac7d0df29f277
ed48ae9c1a324d49404d9fb4c508b880ca97a65f8fd21d352e241d1e4dfc50e2
eec5cc477e7cb4f1eee1f26dce3eb411a63716d89a9b659c7d5559571c837ccb
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f2dd1ff20c3df202418f9d59c76f40bdb304d7a85d7163fc9935391528f3dee8
f327a0ba3e41b1e8154e1c18fc114baff0bd057151e3afe7fa6f33cc0cb18296
f44e4692a52b6a382cb481e23f8bcb9a6d4c24eec8aa60143c7e2ca3a85758b2
f82e13743e667ec749b08d88f08a2a2ea1f688de0b2724b9c0b0b61ca6d680e3
f9baacb75f3cb0e0911a506dbdab685aab38537ac52edda6f9b65bc5f0ea306d
fb42046c6feabb3126634752069391d76d8ded5770a936eb1ce0cdd6aa7358b9
fcc69810a68fed3e656a71993629e6ab25b858a7354556ec487644d4cb360aa9
fe9cd3e92481365c0bee77c4499f3858cea82822e4aae7744f5cbc2c88108888