www.citizens.intl-groups.com Open in urlscan Pro
208.67.23.5 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
https://www.citizens.intl-groups.com/
Submission: On March 13 via automatic, source certstream-suspicious (March 13th 2020, 7:42:18 am UTC)

Summary HTTP 43 Redirects Behaviour Indicators

Summary

This website contacted 4 IPs in 2 countries across 3 domains to perform 43 HTTP transactions. The main IP is 208.67.23.5, located in Burbank, United States and belongs to GTT-BACKBONE GTT, DE. The main domain is www.citizens.intl-groups.com.
TLS certificate: Issued by cPanel, Inc. Certification Authority on March 13th 2020. Valid for: 3 months.

This is the only time www.citizens.intl-groups.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Citizens Bank (Banking)

Domain & IP information

	IP Address	AS Autonomous System
10	208.67.23.5 208.67.23.5	3257 (GTT-BACKB...) (GTT-BACKBONE GTT)
9 37	172.227.94.116 172.227.94.116	16625 (AKAMAI-AS) (AKAMAI-AS)
1 2	2.21.37.45 2.21.37.45	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
43	4

10 208.67.23.5 (Burbank, United States)

ASN3257 (GTT-BACKBONE GTT, DE)
PTR: h159.cpanellogin.net

www.citizens.intl-groups.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

37 172.227.94.116 (United States) 9 redirects

ASN16625 (AKAMAI-AS, US)
PTR: a172-227-94-116.deploy.static.akamaitechnologies.com

www.citizensbank.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2.21.37.45 (France) 1 redirects

ASN20940 (AKAMAI-ASN1, US)
PTR: a2-21-37-45.deploy.static.akamaitechnologies.com

pixel.mathtag.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
37	citizensbank.com 9 redirects www.citizensbank.com	378 KB
10	intl-groups.com www.citizens.intl-groups.com	50 KB
2	mathtag.com 1 redirects pixel.mathtag.com	2 KB
43	3

	Domain	Requested by
37	www.citizensbank.com	9 redirects www.citizens.intl-groups.com
10	www.citizens.intl-groups.com	www.citizens.intl-groups.com www.citizensbank.com
2	pixel.mathtag.com	1 redirects www.citizens.intl-groups.com
43	3

This site contains no links.

Subject Issuer	Validity	Valid
citizens.intl-groups.com cPanel, Inc. Certification Authority	`2020-03-13` - `2020-06-11`	3 months	crt.sh
www.citizensbank.com DigiCert SHA2 Extended Validation Server CA	`2019-12-18` - `2020-11-06`	a year	crt.sh
pixel.mathtag.com DigiCert SHA2 Secure Server CA	`2019-01-25` - `2020-04-25`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://www.citizens.intl-groups.com/
Frame ID: 84AE5F51E8A8D3E8B76B813B30AFC99D
Requests: 43 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

Windows Server (Operating Systems) Expand

Overall confidence: 50%
Detected patterns

html /<input[^>]+name="__VIEWSTATE/i

Bootstrap (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

html /<link[^>]+?href="[^"]*bootstrap(?:\.min)?\.css/i
script /(?:\/([\d.]+))?(?:\/js)?\/bootstrap(?:\.min)?\.js/i

Microsoft ASP.NET (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

html /<input[^>]+name="__VIEWSTATE/i

Apache (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|\b)HTTPD)/i

IIS (Web Servers) Expand

Overall confidence: 50%
Detected patterns

html /<input[^>]+name="__VIEWSTATE/i

Modernizr (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

script /([\d.]+)?\/modernizr(?:.([\d.]+))?.*\.js/i

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

script /jquery[.-]([\d.]*\d)[^\/]*\.js/i
script /jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?/i

Page Statistics

43
Requests

91 %
HTTPS

0 %
IPv6

3
Domains

3
Subdomains

4
IPs

2
Countries

423 kB
Transfer

554 kB
Size

0
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 27

https://www.citizensbank.com/scripts/v4/vendor/caroufredsel/helper-plugins/jquery.mousewheel.min.js HTTP 302
https://www.citizensbank.com/pagenotfound.aspx HTTP 301
http://www.citizensbank.com/custom/404-page-not-found.aspx HTTP 301
https://www.citizensbank.com/custom/404-page-not-found.aspx

Request Chain 28

https://www.citizensbank.com/scripts/v4/vendor/caroufredsel/helper-plugins/jquery.touchSwipe.min.js HTTP 302
https://www.citizensbank.com/pagenotfound.aspx HTTP 301
http://www.citizensbank.com/custom/404-page-not-found.aspx HTTP 301
https://www.citizensbank.com/custom/404-page-not-found.aspx

Request Chain 29

https://www.citizensbank.com/scripts/v4/vendor/caroufredsel/helper-plugins/jquery.ba-throttle-debounce.min.js HTTP 302
https://www.citizensbank.com/pagenotfound.aspx HTTP 301
http://www.citizensbank.com/custom/404-page-not-found.aspx HTTP 301
https://www.citizensbank.com/custom/404-page-not-found.aspx

Request Chain 32

https://pixel.mathtag.com/event/js?mt_id=109747&mt_adid=100688&v1=&v2=&v3=&s1=&s2=[[flag]]&s3= HTTP 302
https://pixel.mathtag.com/event/js?mt_id=109747&mt_adid=100688&v1=&v2=&v3=&s1=&s2=[[flag]]&s3=&mm_bnc&mm_bct&UUID=58405e6b-3949-4400-b5a6-463a8aa3e1bb

43 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request / Show response www.citizens.intl-groups.com/	43 KB 43 KB	958ms 159ms	Document text/html	208.67.23.5 GTT-BACKBONE GTT
General Check archive.org Show headers Download Go to Full URL https://www.citizens.intl-groups.com/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 208.67.23.5 Burbank, United States, ASN3257 (GTT-BACKBONE GTT, DE), Reverse DNS h159.cpanellogin.net Software Apache / Resource Hash `dbc84261329dc7edf847448fed0f193b49ad317d8e3017e8a4b065639a3b37de` Request headers Host www.citizens.intl-groups.com Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest document Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9 Sec-Fetch-Site none Sec-Fetch-Mode navigate Sec-Fetch-User ?1 Accept-Encoding gzip, deflate, br Accept-Language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest document Response headers Date Fri, 13 Mar 2020 07:42:00 GMT Server Apache Last-Modified Sun, 24 Nov 2019 16:16:36 GMT Accept-Ranges bytes Content-Length 44049 Keep-Alive timeout=5, max=100 Connection Keep-Alive Content-Type text/html
GET H/1.1	200 OK	bootstrap.min.css www.citizensbank.com/styles/v4/vendor/bootstrap/	87 KB 15 KB	130ms 33ms	Stylesheet text/css	172.227.94.116 AKAMAI-AS
General Check archive.org Show headers Download Go to Full URL https://www.citizensbank.com/styles/v4/vendor/bootstrap/bootstrap.min.css Requested by Host: www.citizens.intl-groups.com URL: https://www.citizens.intl-groups.com/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 172.227.94.116 , United States, ASN16625 (AKAMAI-AS, US), Reverse DNS a172-227-94-116.deploy.static.akamaitechnologies.com Software / Resource Hash `a5ecc6d16c4b7313ca5a5cababecabbad4fab22f6c939819225837b96ca4e8d1` Request headers Referer https://www.citizens.intl-groups.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest style Response headers Date Fri, 13 Mar 2020 07:42:01 GMT Content-Encoding gzip Last-Modified Wed, 29 Jan 2014 16:39:57 GMT ETag "806c83be101dcf1:0" Vary Accept-Encoding Content-Type text/css Cache-Control max-age=600 Connection keep-alive Accept-Ranges bytes Content-Length 15095
GET H/1.1	200 OK	non-responsive.css www.citizensbank.com/styles/v4/vendor/bootstrap/	2 KB 942 B	128ms 30ms	Stylesheet text/css	172.227.94.116 AKAMAI-AS
General Check archive.org Show headers Download Go to Full URL https://www.citizensbank.com/styles/v4/vendor/bootstrap/non-responsive.css Requested by Host: www.citizens.intl-groups.com URL: https://www.citizens.intl-groups.com/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 172.227.94.116 , United States, ASN16625 (AKAMAI-AS, US), Reverse DNS a172-227-94-116.deploy.static.akamaitechnologies.com Software / Resource Hash `8e760e7ccd92b044f50e80235a7f5f8ebe8f470615464b72d5afb4eb3278333c` Request headers Referer https://www.citizens.intl-groups.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest style Response headers Date Fri, 13 Mar 2020 07:42:01 GMT Content-Encoding gzip Last-Modified Fri, 20 Dec 2013 21:46:38 GMT ETag "033d7f5ccfdce1:0" Vary Accept-Encoding Content-Type text/css Cache-Control max-age=600 Connection keep-alive Accept-Ranges bytes Content-Length 648
GET H/1.1	200 OK	fonts.css www.citizensbank.com/styles/v4/	11 KB 2 KB	128ms 30ms	Stylesheet text/css	172.227.94.116 AKAMAI-AS
General Check archive.org Show headers Download Go to Full URL https://www.citizensbank.com/styles/v4/fonts.css Requested by Host: www.citizens.intl-groups.com URL: https://www.citizens.intl-groups.com/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 172.227.94.116 , United States, ASN16625 (AKAMAI-AS, US), Reverse DNS a172-227-94-116.deploy.static.akamaitechnologies.com Software / Resource Hash `1e60e4b897c55ef15d144992469e879b42028c6bc97ee233108edcc50430249e` Request headers Referer https://www.citizens.intl-groups.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest style Response headers Date Fri, 13 Mar 2020 07:42:01 GMT Content-Encoding gzip Last-Modified Thu, 29 May 2014 18:58:31 GMT ETag "80259dfb6f7bcf1:0" Vary Accept-Encoding Content-Type text/css Cache-Control max-age=600 Connection keep-alive Accept-Ranges bytes Content-Length 1599
GET H/1.1	200 OK	main.css www.citizensbank.com/styles/v4/	52 KB 10 KB	137ms 39ms	Stylesheet text/css	172.227.94.116 AKAMAI-AS
General Check archive.org Show headers Download Go to Full URL https://www.citizensbank.com/styles/v4/main.css Requested by Host: www.citizens.intl-groups.com URL: https://www.citizens.intl-groups.com/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 172.227.94.116 , United States, ASN16625 (AKAMAI-AS, US), Reverse DNS a172-227-94-116.deploy.static.akamaitechnologies.com Software / Resource Hash `91766a9dc308be730991d0d12b9ed65a9265738a7ad311cc4a33a4d94b9b5630` Request headers Referer https://www.citizens.intl-groups.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest style Response headers Date Fri, 13 Mar 2020 07:42:01 GMT Content-Encoding gzip Last-Modified Mon, 06 Jun 2016 19:12:07 GMT ETag "801d425127c0d11:0" Vary Accept-Encoding Content-Type text/css Cache-Control max-age=600 Connection keep-alive Accept-Ranges bytes Content-Length 10320
GET H/1.1	200 OK	modernizr-2.6.2.custom.js Show response www.citizensbank.com/scripts/v4/vendor/modernizr/	9 KB 4 KB	136ms 38ms	Script application/x-javascript	172.227.94.116 AKAMAI-AS
General Check archive.org Show headers Download Go to Full URL https://www.citizensbank.com/scripts/v4/vendor/modernizr/modernizr-2.6.2.custom.js Requested by Host: www.citizens.intl-groups.com URL: https://www.citizens.intl-groups.com/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 172.227.94.116 , United States, ASN16625 (AKAMAI-AS, US), Reverse DNS a172-227-94-116.deploy.static.akamaitechnologies.com Software / Resource Hash `7853565d284435e8eee9d1fc071c42f9d93933fc64bd3bf3a53cf5e95d24258f` Request headers Referer https://www.citizens.intl-groups.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers Pragma no-cache Date Fri, 13 Mar 2020 07:42:01 GMT Content-Encoding gzip Last-Modified Fri, 20 Dec 2013 21:46:38 GMT ETag "033d7f5ccfdce1:0" Vary Accept-Encoding Content-Type application/x-javascript Cache-Control max-age=0, no-cache, no-store Connection keep-alive Accept-Ranges bytes Content-Length 4148 Expires Fri, 13 Mar 2020 07:42:01 GMT
GET H/1.1	404 Not Found	Bootstrap.js www.citizens.intl-groups.com/nexus.ensighten.com/citizensbank/	0 0	298ms 157ms	Script text/html	208.67.23.5 GTT-BACKBONE GTT
General Check archive.org Show headers Download Go to Full URL https://www.citizens.intl-groups.com/nexus.ensighten.com/citizensbank/Bootstrap.js Requested by Host: www.citizens.intl-groups.com URL: https://www.citizens.intl-groups.com/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 208.67.23.5 Burbank, United States, ASN3257 (GTT-BACKBONE GTT, DE), Reverse DNS h159.cpanellogin.net Software Apache / Resource Hash Request headers Referer https://www.citizens.intl-groups.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers Date Fri, 13 Mar 2020 07:42:01 GMT Server Apache Connection Keep-Alive Keep-Alive timeout=5, max=99 Content-Length 315 Content-Type text/html; charset=iso-8859-1
GET H/1.1	200 OK	jquery.fancybox-1.3.4.css www.citizensbank.com/promotions/checking-offer/fancybox/	8 KB 2 KB	135ms 37ms	Stylesheet text/css	172.227.94.116 AKAMAI-AS
General Check archive.org Show headers Download Go to Full URL https://www.citizensbank.com/promotions/checking-offer/fancybox/jquery.fancybox-1.3.4.css Requested by Host: www.citizens.intl-groups.com URL: https://www.citizens.intl-groups.com/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 172.227.94.116 , United States, ASN16625 (AKAMAI-AS, US), Reverse DNS a172-227-94-116.deploy.static.akamaitechnologies.com Software / Resource Hash `9aa3d7beea155d9cc9e89c108d05608bdecc6f1eae8cdff26343c11510e9517d` Request headers Referer https://www.citizens.intl-groups.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest style Response headers Date Fri, 13 Mar 2020 07:42:01 GMT Content-Encoding gzip Last-Modified Mon, 03 Feb 2014 14:56:57 GMT ETag "80232ff020cf1:0" Vary Accept-Encoding Content-Type text/css Cache-Control max-age=600 Connection keep-alive Accept-Ranges bytes X-Robots-Tag none Content-Length 1796
GET H/1.1	200 OK	common.ashx Show response www.citizens.intl-groups.com/ajax/	3 KB 3 KB	476ms 177ms	Script text/plain	208.67.23.5 GTT-BACKBONE GTT
General Check archive.org Show headers Download Go to Full URL https://www.citizens.intl-groups.com/ajax/common.ashx Requested by Host: www.citizens.intl-groups.com URL: https://www.citizens.intl-groups.com/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 208.67.23.5 Burbank, United States, ASN3257 (GTT-BACKBONE GTT, DE), Reverse DNS h159.cpanellogin.net Software Apache / Resource Hash `d9788f957a0264a11cf4beeac5436e49aa2b908d80c60bcf6681a4e4e8113318` Request headers Referer https://www.citizens.intl-groups.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers Date Fri, 13 Mar 2020 07:42:01 GMT Last-Modified Wed, 18 Feb 2015 11:37:52 GMT Server Apache Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=98 Content-Length 2991
GET H/1.1	200 OK	Citizens.CmsSite.Web.cms.templates.v4.common.CommonHeader%2cCitizens.CmsSite.Web.ashx Show response www.citizens.intl-groups.com/ajax/	3 KB 3 KB	473ms 159ms	Script text/plain	208.67.23.5 GTT-BACKBONE GTT
General Check archive.org Show headers Download Go to Full URL https://www.citizens.intl-groups.com/ajax/Citizens.CmsSite.Web.cms.templates.v4.common.CommonHeader%2cCitizens.CmsSite.Web.ashx Requested by Host: www.citizens.intl-groups.com URL: https://www.citizens.intl-groups.com/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 208.67.23.5 Burbank, United States, ASN3257 (GTT-BACKBONE GTT, DE), Reverse DNS h159.cpanellogin.net Software Apache / Resource Hash `41c6298373fd5095a24a3f92b99b146206578fe00aa8d7f33a76b7cd0321ed60` Request headers Referer https://www.citizens.intl-groups.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers Date Fri, 13 Mar 2020 07:42:01 GMT Last-Modified Wed, 18 Feb 2015 11:37:52 GMT Server Apache Connection Keep-Alive Accept-Ranges bytes Keep-Alive timeout=5, max=100 Content-Length 2698
GET H/1.1	200 OK	ctz-logo.png www.citizensbank.com/images/v4/	3 KB 3 KB	30ms 29ms	Image image/png	172.227.94.116 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://www.citizensbank.com/images/v4/ctz-logo.png Requested by Host: www.citizens.intl-groups.com URL: https://www.citizens.intl-groups.com/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 172.227.94.116 , United States, ASN16625 (AKAMAI-AS, US), Reverse DNS a172-227-94-116.deploy.static.akamaitechnologies.com Software / Resource Hash `45c055a0777a84727d10fe4420cf9c721e548d63bc2bcaa81fc3adf37a2a1bd4` Request headers Referer https://www.citizens.intl-groups.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers Date Fri, 13 Mar 2020 07:42:01 GMT Last-Modified Fri, 20 Dec 2013 23:28:52 GMT ETag "052fd3ddbfdce1:0" Content-Type image/png Cache-Control max-age=600 Connection keep-alive Accept-Ranges bytes Content-Length 2591
GET H/1.1	200 OK	ctz-promo-sunburst-flag.png www.citizensbank.com/images/v4/	35 KB 36 KB	32ms 32ms	Image image/png	172.227.94.116 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://www.citizensbank.com/images/v4/ctz-promo-sunburst-flag.png Requested by Host: www.citizens.intl-groups.com URL: https://www.citizens.intl-groups.com/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 172.227.94.116 , United States, ASN16625 (AKAMAI-AS, US), Reverse DNS a172-227-94-116.deploy.static.akamaitechnologies.com Software / Resource Hash `ca3f3a3af2c25449f7be9310021c8f0d2a1531bc843c35a281b1e8438a858f9c` Request headers Referer https://www.citizens.intl-groups.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers Date Fri, 13 Mar 2020 07:42:01 GMT Last-Modified Tue, 06 Jan 2015 18:42:58 GMT ETag "0253597e029d01:0" Content-Type image/png Cache-Control max-age=600 Connection keep-alive Accept-Ranges bytes Content-Length 36152
GET H/1.1	200 OK	ctz-promo-q1-one-deposit.jpg www.citizensbank.com/images/v4/	28 KB 28 KB	38ms 37ms	Image image/jpeg	172.227.94.116 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://www.citizensbank.com/images/v4/ctz-promo-q1-one-deposit.jpg Requested by Host: www.citizens.intl-groups.com URL: https://www.citizens.intl-groups.com/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 172.227.94.116 , United States, ASN16625 (AKAMAI-AS, US), Reverse DNS a172-227-94-116.deploy.static.akamaitechnologies.com Software / Resource Hash `20c9447d184a8b03fcc06e184b19b2ca3e61c73317cab4e052134fca6baf833e` Request headers Referer https://www.citizens.intl-groups.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers Date Fri, 13 Mar 2020 07:42:01 GMT Last-Modified Mon, 22 Dec 2014 18:49:43 GMT ETag "80fd68c181ed01:0" Content-Type image/jpeg Cache-Control max-age=600 Connection keep-alive Accept-Ranges bytes Content-Length 28744
GET H/1.1	200 OK	ctz-promo-q1-sba-lender.jpg www.citizensbank.com/images/v4/	33 KB 34 KB	31ms 31ms	Image image/jpeg	172.227.94.116 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://www.citizensbank.com/images/v4/ctz-promo-q1-sba-lender.jpg Requested by Host: www.citizens.intl-groups.com URL: https://www.citizens.intl-groups.com/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 172.227.94.116 , United States, ASN16625 (AKAMAI-AS, US), Reverse DNS a172-227-94-116.deploy.static.akamaitechnologies.com Software / Resource Hash `aa6b23cf1278811d9424a85ccee2c1e7bc187e0cca8e55b8de01fc931762524d` Request headers Referer https://www.citizens.intl-groups.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers Date Fri, 13 Mar 2020 07:42:01 GMT Last-Modified Mon, 22 Dec 2014 18:49:43 GMT ETag "80fd68c181ed01:0" Content-Type image/jpeg Cache-Control max-age=600 Connection keep-alive Accept-Ranges bytes Content-Length 34088
GET H/1.1	200 OK	ctz-promo-q1-card-balance-transfer.jpg www.citizensbank.com/images/v4/	16 KB 16 KB	33ms 33ms	Image image/jpeg	172.227.94.116 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://www.citizensbank.com/images/v4/ctz-promo-q1-card-balance-transfer.jpg Requested by Host: www.citizens.intl-groups.com URL: https://www.citizens.intl-groups.com/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 172.227.94.116 , United States, ASN16625 (AKAMAI-AS, US), Reverse DNS a172-227-94-116.deploy.static.akamaitechnologies.com Software / Resource Hash `c124f2740b035b5e53361fcbdae0611548b937712342f4b14adaff55168b2819` Request headers Referer https://www.citizens.intl-groups.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers Date Fri, 13 Mar 2020 07:42:01 GMT Last-Modified Mon, 22 Dec 2014 18:49:41 GMT ETag "80d037b181ed01:0" Content-Type image/jpeg Cache-Control max-age=600 Connection keep-alive Accept-Ranges bytes Content-Length 16556
GET H/1.1	200 OK	ctz-promo-q1-equity.jpg www.citizensbank.com/images/v4/	31 KB 32 KB	32ms 32ms	Image image/jpeg	172.227.94.116 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://www.citizensbank.com/images/v4/ctz-promo-q1-equity.jpg Requested by Host: www.citizens.intl-groups.com URL: https://www.citizens.intl-groups.com/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 172.227.94.116 , United States, ASN16625 (AKAMAI-AS, US), Reverse DNS a172-227-94-116.deploy.static.akamaitechnologies.com Software / Resource Hash `35ad5df10083c2e919252447a32b0a818935e6009a7e76d1ff8b215708da7fae` Request headers Referer https://www.citizens.intl-groups.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers Date Fri, 13 Mar 2020 07:42:01 GMT Last-Modified Mon, 22 Dec 2014 18:49:42 GMT ETag "067d0b181ed01:0" Content-Type image/jpeg Cache-Control max-age=600 Connection keep-alive Accept-Ranges bytes Content-Length 32042
GET H/1.1	200 OK	equal-housing.gif www.citizensbank.com/images/v4/	1 KB 1 KB	58ms 58ms	Image image/gif	172.227.94.116 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://www.citizensbank.com/images/v4/equal-housing.gif Requested by Host: www.citizens.intl-groups.com URL: https://www.citizens.intl-groups.com/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 172.227.94.116 , United States, ASN16625 (AKAMAI-AS, US), Reverse DNS a172-227-94-116.deploy.static.akamaitechnologies.com Software / Resource Hash `319d82f567037eafefea25abbc64ea902db9255c5e7231fe9ddd462e4f5b9149` Request headers Referer https://www.citizens.intl-groups.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers Date Fri, 13 Mar 2020 07:42:01 GMT Last-Modified Fri, 20 Dec 2013 23:28:52 GMT ETag "052fd3ddbfdce1:0" Content-Type image/gif Cache-Control max-age=600 Connection keep-alive Accept-Ranges bytes Content-Length 1134
GET H/1.1	200 OK	elh.gif www.citizensbank.com/images/v2/content/	1 KB 2 KB	30ms 30ms	Image image/gif	172.227.94.116 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://www.citizensbank.com/images/v2/content/elh.gif Requested by Host: www.citizens.intl-groups.com URL: https://www.citizens.intl-groups.com/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 172.227.94.116 , United States, ASN16625 (AKAMAI-AS, US), Reverse DNS a172-227-94-116.deploy.static.akamaitechnologies.com Software / Resource Hash `56c43c6f5c8209acd47f355810bca2f9b0fc86c4bbdf1361d60fb2d2e2e66f8c` Request headers Referer https://www.citizens.intl-groups.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers Date Fri, 13 Mar 2020 07:42:01 GMT Last-Modified Tue, 17 Feb 2009 17:17:38 GMT ETag "065baa12391c91:0" Content-Type image/gif Cache-Control max-age=600 Connection keep-alive Accept-Ranges bytes Content-Length 1433
GET H/1.1	200 OK	fdicFooter.gif www.citizensbank.com/images/v2/content/	2 KB 2 KB	30ms 30ms	Image image/gif	172.227.94.116 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://www.citizensbank.com/images/v2/content/fdicFooter.gif Requested by Host: www.citizens.intl-groups.com URL: https://www.citizens.intl-groups.com/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 172.227.94.116 , United States, ASN16625 (AKAMAI-AS, US), Reverse DNS a172-227-94-116.deploy.static.akamaitechnologies.com Software / Resource Hash `dddb031e5144ce20d909dbf4829d637738efa477bf5ab4eab67b1990ef0efb2d` Request headers Referer https://www.citizens.intl-groups.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers Date Fri, 13 Mar 2020 07:42:01 GMT Last-Modified Tue, 17 Feb 2009 17:17:38 GMT ETag "065baa12391c91:0" Content-Type image/gif Cache-Control max-age=600 Connection keep-alive Accept-Ranges bytes Content-Length 2245
GET H/1.1	404 Not Found	jquery-1.10.2.min.js www.citizens.intl-groups.com/scripts/v4/vendor/jquery/	315 B 315 B	159ms 158ms	Image text/html	208.67.23.5 GTT-BACKBONE GTT
General Check archive.org Show headers Download Go to Show image Full URL https://www.citizens.intl-groups.com/scripts/v4/vendor/jquery/jquery-1.10.2.min.js Requested by Host: www.citizens.intl-groups.com URL: https://www.citizens.intl-groups.com/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 208.67.23.5 Burbank, United States, ASN3257 (GTT-BACKBONE GTT, DE), Reverse DNS h159.cpanellogin.net Software Apache / Resource Hash `d5a89e26beae0bc03ad18a0b0d1d3d75f87c32047879d25da11970cb5c4662a3` Request headers Referer https://www.citizens.intl-groups.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers Date Fri, 13 Mar 2020 07:42:01 GMT Server Apache Connection Keep-Alive Keep-Alive timeout=5, max=97 Content-Length 315 Content-Type text/html; charset=iso-8859-1
GET H/1.1	404 Not Found	bootstrap.min.js www.citizens.intl-groups.com/scripts/v4/vendor/bootstrap/	315 B 315 B	158ms 157ms	Image text/html	208.67.23.5 GTT-BACKBONE GTT
General Check archive.org Show headers Download Go to Show image Full URL https://www.citizens.intl-groups.com/scripts/v4/vendor/bootstrap/bootstrap.min.js Requested by Host: www.citizens.intl-groups.com URL: https://www.citizens.intl-groups.com/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 208.67.23.5 Burbank, United States, ASN3257 (GTT-BACKBONE GTT, DE), Reverse DNS h159.cpanellogin.net Software Apache / Resource Hash `d5a89e26beae0bc03ad18a0b0d1d3d75f87c32047879d25da11970cb5c4662a3` Request headers Referer https://www.citizens.intl-groups.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers Date Fri, 13 Mar 2020 07:42:01 GMT Server Apache Connection Keep-Alive Keep-Alive timeout=5, max=99 Content-Length 315 Content-Type text/html; charset=iso-8859-1
GET H/1.1	404 Not Found	jquery.transit.js www.citizens.intl-groups.com/scripts/v4/vendor/jquery-transit/	315 B 315 B	158ms 157ms	Image text/html	208.67.23.5 GTT-BACKBONE GTT
General Check archive.org Show headers Download Go to Show image Full URL https://www.citizens.intl-groups.com/scripts/v4/vendor/jquery-transit/jquery.transit.js Requested by Host: www.citizens.intl-groups.com URL: https://www.citizens.intl-groups.com/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 208.67.23.5 Burbank, United States, ASN3257 (GTT-BACKBONE GTT, DE), Reverse DNS h159.cpanellogin.net Software Apache / Resource Hash `d5a89e26beae0bc03ad18a0b0d1d3d75f87c32047879d25da11970cb5c4662a3` Request headers Referer https://www.citizens.intl-groups.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers Date Fri, 13 Mar 2020 07:42:01 GMT Server Apache Connection Keep-Alive Keep-Alive timeout=5, max=100 Content-Length 315 Content-Type text/html; charset=iso-8859-1
GET H/1.1	404 Not Found	jquery.hoverintent.min.js www.citizens.intl-groups.com/scripts/v4/vendor/jquery-hoverintent/	315 B 315 B	159ms 157ms	Image text/html	208.67.23.5 GTT-BACKBONE GTT
General Check archive.org Show headers Download Go to Show image Full URL https://www.citizens.intl-groups.com/scripts/v4/vendor/jquery-hoverintent/jquery.hoverintent.min.js Requested by Host: www.citizens.intl-groups.com URL: https://www.citizens.intl-groups.com/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 208.67.23.5 Burbank, United States, ASN3257 (GTT-BACKBONE GTT, DE), Reverse DNS h159.cpanellogin.net Software Apache / Resource Hash `d5a89e26beae0bc03ad18a0b0d1d3d75f87c32047879d25da11970cb5c4662a3` Request headers Referer https://www.citizens.intl-groups.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers Date Fri, 13 Mar 2020 07:42:01 GMT Server Apache Connection Keep-Alive Keep-Alive timeout=5, max=100 Content-Length 315 Content-Type text/html; charset=iso-8859-1
GET H/1.1	200 OK	jquery.detectmobilebrowsers.min.js www.citizensbank.com/scripts/v4/vendor/detectmobilebrowsers/	2 KB 2 KB	31ms 30ms	Image application/x-javascript	172.227.94.116 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://www.citizensbank.com/scripts/v4/vendor/detectmobilebrowsers/jquery.detectmobilebrowsers.min.js Requested by Host: www.citizens.intl-groups.com URL: https://www.citizens.intl-groups.com/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 172.227.94.116 , United States, ASN16625 (AKAMAI-AS, US), Reverse DNS a172-227-94-116.deploy.static.akamaitechnologies.com Software / Resource Hash `e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855` Request headers Referer https://www.citizens.intl-groups.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers Pragma no-cache Date Fri, 13 Mar 2020 07:42:01 GMT Content-Encoding gzip Last-Modified Fri, 20 Dec 2013 21:46:38 GMT ETag "033d7f5ccfdce1:0" Vary Accept-Encoding Content-Type application/x-javascript Cache-Control max-age=0, no-cache, no-store Connection keep-alive Accept-Ranges bytes Content-Length 1412 Expires Fri, 13 Mar 2020 07:42:01 GMT
GET H/1.1	200 OK	form.js www.citizensbank.com/scripts/v4/	12 KB 12 KB	31ms 29ms	Image application/x-javascript	172.227.94.116 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://www.citizensbank.com/scripts/v4/form.js Requested by Host: www.citizens.intl-groups.com URL: https://www.citizens.intl-groups.com/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 172.227.94.116 , United States, ASN16625 (AKAMAI-AS, US), Reverse DNS a172-227-94-116.deploy.static.akamaitechnologies.com Software / Resource Hash `e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855` Request headers Referer https://www.citizens.intl-groups.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers Pragma no-cache Date Fri, 13 Mar 2020 07:42:01 GMT Content-Encoding gzip Last-Modified Fri, 20 Dec 2013 21:46:36 GMT ETag "06a6f4ccfdce1:0" Vary Accept-Encoding Content-Type application/x-javascript Cache-Control max-age=0, no-cache, no-store Connection keep-alive Accept-Ranges bytes Content-Length 2828 Expires Fri, 13 Mar 2020 07:42:01 GMT
GET H/1.1	200 OK	utilities.js www.citizensbank.com/scripts/v4/	15 KB 15 KB	36ms 35ms	Image application/x-javascript	172.227.94.116 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://www.citizensbank.com/scripts/v4/utilities.js Requested by Host: www.citizens.intl-groups.com URL: https://www.citizens.intl-groups.com/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 172.227.94.116 , United States, ASN16625 (AKAMAI-AS, US), Reverse DNS a172-227-94-116.deploy.static.akamaitechnologies.com Software / Resource Hash `e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855` Request headers Referer https://www.citizens.intl-groups.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers Pragma no-cache Date Fri, 13 Mar 2020 07:42:01 GMT Content-Encoding gzip Last-Modified Mon, 12 May 2014 19:40:18 GMT ETag "03de101a6ecf1:0" Vary Accept-Encoding Content-Type application/x-javascript Cache-Control max-age=0, no-cache, no-store Connection keep-alive Accept-Ranges bytes Content-Length 3668 Expires Fri, 13 Mar 2020 07:42:01 GMT
GET H/1.1	200 OK	main.js www.citizensbank.com/scripts/v4/	17 KB 17 KB	36ms 34ms	Image application/x-javascript	172.227.94.116 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://www.citizensbank.com/scripts/v4/main.js Requested by Host: www.citizens.intl-groups.com URL: https://www.citizens.intl-groups.com/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 172.227.94.116 , United States, ASN16625 (AKAMAI-AS, US), Reverse DNS a172-227-94-116.deploy.static.akamaitechnologies.com Software / Resource Hash `e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855` Request headers Referer https://www.citizens.intl-groups.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers Pragma no-cache Date Fri, 13 Mar 2020 07:42:01 GMT Content-Encoding gzip Last-Modified Fri, 14 Mar 2014 18:13:04 GMT ETag "0f8ccab13fcf1:0" Vary Accept-Encoding Content-Type application/x-javascript Cache-Control max-age=0, no-cache, no-store Connection keep-alive Accept-Ranges bytes Content-Length 5369 Expires Fri, 13 Mar 2020 07:42:01 GMT
GET H/1.1	200 OK	jquery.carouFredSel-6.2.1-packed.js www.citizensbank.com/scripts/v4/vendor/caroufredsel/	53 KB 53 KB	32ms 31ms	Image application/x-javascript	172.227.94.116 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://www.citizensbank.com/scripts/v4/vendor/caroufredsel/jquery.carouFredSel-6.2.1-packed.js Requested by Host: www.citizens.intl-groups.com URL: https://www.citizens.intl-groups.com/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 172.227.94.116 , United States, ASN16625 (AKAMAI-AS, US), Reverse DNS a172-227-94-116.deploy.static.akamaitechnologies.com Software / Resource Hash `e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855` Request headers Referer https://www.citizens.intl-groups.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers Pragma no-cache Date Fri, 13 Mar 2020 07:42:01 GMT Content-Encoding gzip Last-Modified Fri, 20 Dec 2013 21:46:36 GMT ETag "06a6f4ccfdce1:0" Vary Accept-Encoding Content-Type application/x-javascript Cache-Control max-age=0, no-cache, no-store Connection keep-alive Accept-Ranges bytes Content-Length 13676 Expires Fri, 13 Mar 2020 07:42:01 GMT
GET H/1.1	200 OK	404-page-not-found.aspx www.citizensbank.com/custom/ Redirect Chain https://www.citizensbank.com/scripts/v4/vendor/caroufredsel/helper-plugins/jquery.mousewheel.min.js https://www.citizensbank.com/pagenotfound.aspx http://www.citizensbank.com/custom/404-page-not-found.aspx https://www.citizensbank.com/custom/404-page-not-found.aspx	0 0	321ms 320ms	Image text/html	172.227.94.116 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://www.citizensbank.com/custom/404-page-not-found.aspx Requested by Host: www.citizens.intl-groups.com URL: https://www.citizens.intl-groups.com/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 172.227.94.116 , United States, ASN16625 (AKAMAI-AS, US), Reverse DNS a172-227-94-116.deploy.static.akamaitechnologies.com Software / Resource Hash `e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855` Request headers User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Redirect headers Pragma no-cache Date Fri, 13 Mar 2020 07:42:02 GMT Server AkamaiGHost Location https://www.citizensbank.com/custom/404-page-not-found.aspx Cache-Control max-age=0, no-cache, no-store Connection keep-alive X-Robots-Tag none Content-Length 0 Expires Fri, 13 Mar 2020 07:42:02 GMT
GET H/1.1	200 OK	404-page-not-found.aspx www.citizensbank.com/custom/ Redirect Chain https://www.citizensbank.com/scripts/v4/vendor/caroufredsel/helper-plugins/jquery.touchSwipe.min.js https://www.citizensbank.com/pagenotfound.aspx http://www.citizensbank.com/custom/404-page-not-found.aspx https://www.citizensbank.com/custom/404-page-not-found.aspx	0 0	272ms 272ms	Image text/html	172.227.94.116 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://www.citizensbank.com/custom/404-page-not-found.aspx Requested by Host: www.citizens.intl-groups.com URL: https://www.citizens.intl-groups.com/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 172.227.94.116 , United States, ASN16625 (AKAMAI-AS, US), Reverse DNS a172-227-94-116.deploy.static.akamaitechnologies.com Software / Resource Hash `e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855` Request headers User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Redirect headers Pragma no-cache Date Fri, 13 Mar 2020 07:42:02 GMT Server AkamaiGHost Location https://www.citizensbank.com/custom/404-page-not-found.aspx Cache-Control max-age=0, no-cache, no-store Connection keep-alive X-Robots-Tag none Content-Length 0 Expires Fri, 13 Mar 2020 07:42:02 GMT
GET H/1.1	200 OK	404-page-not-found.aspx www.citizensbank.com/custom/ Redirect Chain https://www.citizensbank.com/scripts/v4/vendor/caroufredsel/helper-plugins/jquery.ba-throttle-debounce.min.js https://www.citizensbank.com/pagenotfound.aspx http://www.citizensbank.com/custom/404-page-not-found.aspx https://www.citizensbank.com/custom/404-page-not-found.aspx	0 0	352ms 352ms	Image text/html	172.227.94.116 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://www.citizensbank.com/custom/404-page-not-found.aspx Requested by Host: www.citizens.intl-groups.com URL: https://www.citizens.intl-groups.com/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 172.227.94.116 , United States, ASN16625 (AKAMAI-AS, US), Reverse DNS a172-227-94-116.deploy.static.akamaitechnologies.com Software / Resource Hash `e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855` Request headers User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Redirect headers Pragma no-cache Date Fri, 13 Mar 2020 07:42:02 GMT Server AkamaiGHost Location https://www.citizensbank.com/custom/404-page-not-found.aspx Cache-Control max-age=0, no-cache, no-store Connection keep-alive X-Robots-Tag none Content-Length 0 Expires Fri, 13 Mar 2020 07:42:02 GMT
GET H/1.1	200 OK	jquery.fancybox-1.3.4.js www.citizensbank.com/promotions/checking-offer/fancybox/	30 KB 30 KB	30ms 29ms	Image application/x-javascript	172.227.94.116 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://www.citizensbank.com/promotions/checking-offer/fancybox/jquery.fancybox-1.3.4.js Requested by Host: www.citizens.intl-groups.com URL: https://www.citizens.intl-groups.com/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 172.227.94.116 , United States, ASN16625 (AKAMAI-AS, US), Reverse DNS a172-227-94-116.deploy.static.akamaitechnologies.com Software / Resource Hash `e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855` Request headers Referer https://www.citizens.intl-groups.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers Pragma no-cache Date Fri, 13 Mar 2020 07:42:01 GMT Content-Encoding gzip Last-Modified Thu, 06 Feb 2014 14:55:07 GMT ETag "8097af6c4b23cf1:0" Vary Accept-Encoding Content-Type application/x-javascript Cache-Control max-age=0, no-cache, no-store Connection keep-alive Accept-Ranges bytes X-Robots-Tag none Content-Length 7726 Expires Fri, 13 Mar 2020 07:42:01 GMT
GET H/1.1	200 OK	ctzHomeSuperTag.js www.citizensbank.com/promotions/checking-offer/script/	854 B 854 B	29ms 29ms	Image application/x-javascript	172.227.94.116 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://www.citizensbank.com/promotions/checking-offer/script/ctzHomeSuperTag.js Requested by Host: www.citizens.intl-groups.com URL: https://www.citizens.intl-groups.com/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 172.227.94.116 , United States, ASN16625 (AKAMAI-AS, US), Reverse DNS a172-227-94-116.deploy.static.akamaitechnologies.com Software / Resource Hash `e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855` Request headers Referer https://www.citizens.intl-groups.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers Pragma no-cache Date Fri, 13 Mar 2020 07:42:01 GMT Content-Encoding gzip Last-Modified Mon, 03 Feb 2014 14:56:59 GMT ETag "802f3430f020cf1:0" Vary Accept-Encoding Content-Type application/x-javascript Cache-Control max-age=0, no-cache, no-store Connection keep-alive Accept-Ranges bytes X-Robots-Tag none Content-Length 488 Expires Fri, 13 Mar 2020 07:42:01 GMT
GET H/1.1	200 OK	js pixel.mathtag.com/event/ Redirect Chain https://pixel.mathtag.com/event/js?mt_id=109747&mt_adid=100688&v1=&v2=&v3=&s1=&s2=[[flag]]&s3= https://pixel.mathtag.com/event/js?mt_id=109747&mt_adid=100688&v1=&v2=&v3=&s1=&s2=[[flag]]&s3=&mm_bnc&mm_bct&UUID=58405e6b-3949-4400-b5a6-463a8aa3e1bb	2 KB 2 KB	42ms 41ms	Image text/javascript	2.21.37.45 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Show image Full URL https://pixel.mathtag.com/event/js?mt_id=109747&mt_adid=100688&v1=&v2=&v3=&s1=&s2=[[flag]]&s3=&mm_bnc&mm_bct&UUID=58405e6b-3949-4400-b5a6-463a8aa3e1bb Requested by Host: www.citizens.intl-groups.com URL: https://www.citizens.intl-groups.com/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2.21.37.45 , France, ASN20940 (AKAMAI-ASN1, US), Reverse DNS a2-21-37-45.deploy.static.akamaitechnologies.com Software MT3 2187 76c51ad master cdg-pixel-x22 / Resource Hash `e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855` Request headers Referer https://www.citizens.intl-groups.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Response headers Date Fri, 13 Mar 2020 07:42:01 GMT Server MT3 2187 76c51ad master cdg-pixel-x22 P3P CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA" Cache-Control no-cache Connection keep-alive Content-Type text/javascript Content-Length 1788 Expires Fri, 13 Mar 2020 07:43:16 GMT Redirect headers Date Fri, 13 Mar 2020 07:42:01 GMT Server MT3 2187 76c51ad master cdg-pixel-x21 P3P CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA" Location https://pixel.mathtag.com/event/js?mt_id=109747&mt_adid=100688&v1=&v2=&v3=&s1=&s2=[[flag]]&s3=&mm_bnc&mm_bct&UUID=58405e6b-3949-4400-b5a6-463a8aa3e1bb Cache-Control no-cache Connection keep-alive Content-Type text/javascript Content-Length 0 Expires Fri, 13 Mar 2020 07:43:16 GMT
GET H/1.1	200 OK	ctz-home-banner.png www.citizensbank.com/images/v4/	49 KB 49 KB	31ms 31ms	Image image/png	172.227.94.116 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://www.citizensbank.com/images/v4/ctz-home-banner.png Requested by Host: www.citizens.intl-groups.com URL: https://www.citizens.intl-groups.com/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 172.227.94.116 , United States, ASN16625 (AKAMAI-AS, US), Reverse DNS a172-227-94-116.deploy.static.akamaitechnologies.com Software / Resource Hash `2395c2d20bc94523f7ab82420b2cba616c8d6642e0fda3a684ac1dc247ef0adb` Request headers Referer https://www.citizensbank.com/styles/v4/main.css User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers Date Fri, 13 Mar 2020 07:42:01 GMT Last-Modified Fri, 20 Dec 2013 23:28:52 GMT ETag "052fd3ddbfdce1:0" Content-Type image/png Cache-Control max-age=600 Connection keep-alive Accept-Ranges bytes Content-Length 49737
GET H/1.1	200 OK	ctz-select-btn.gif www.citizensbank.com/images/v4/	1 KB 1 KB	28ms 28ms	Image image/gif	172.227.94.116 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://www.citizensbank.com/images/v4/ctz-select-btn.gif Requested by Host: www.citizens.intl-groups.com URL: https://www.citizens.intl-groups.com/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 172.227.94.116 , United States, ASN16625 (AKAMAI-AS, US), Reverse DNS a172-227-94-116.deploy.static.akamaitechnologies.com Software / Resource Hash `aaeba11accc7f508ed4a1504a549553aa27d4a82a2060b15751fa41f84c93540` Request headers Referer https://www.citizensbank.com/styles/v4/main.css User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers Date Fri, 13 Mar 2020 07:42:01 GMT Last-Modified Fri, 20 Dec 2013 23:28:52 GMT ETag "052fd3ddbfdce1:0" Content-Type image/gif Cache-Control max-age=600 Connection keep-alive Accept-Ranges bytes Content-Length 1285
GET H/1.1	200 OK	ctz-green-arrow.png www.citizensbank.com/images/v4/	2 KB 2 KB	28ms 27ms	Image image/png	172.227.94.116 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://www.citizensbank.com/images/v4/ctz-green-arrow.png Requested by Host: www.citizens.intl-groups.com URL: https://www.citizens.intl-groups.com/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 172.227.94.116 , United States, ASN16625 (AKAMAI-AS, US), Reverse DNS a172-227-94-116.deploy.static.akamaitechnologies.com Software / Resource Hash `aed4093b36d18ae335c4b3c5d9786e560dc8feebc6655d8045716299e7bee83e` Request headers Referer https://www.citizensbank.com/styles/v4/main.css User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest image Response headers Date Fri, 13 Mar 2020 07:42:01 GMT Last-Modified Fri, 20 Dec 2013 23:28:52 GMT ETag "052fd3ddbfdce1:0" Content-Type image/png Cache-Control max-age=600 Connection keep-alive Accept-Ranges bytes Content-Length 1923
GET		citisanb-webfont.woff www.citizensbank.com/fonts/v4/	0 0

GET		icomoon.woff www.citizensbank.com/fonts/v4/	0 0

GET H/1.1	404 Not Found	jquery-1.10.2.min.js www.citizens.intl-groups.com/scripts/v4/vendor/jquery/	0 0	279ms 157ms	Script text/html	208.67.23.5 GTT-BACKBONE GTT
General Check archive.org Show headers Download Go to Full URL https://www.citizens.intl-groups.com/scripts/v4/vendor/jquery/jquery-1.10.2.min.js Requested by Host: www.citizensbank.com URL: https://www.citizensbank.com/scripts/v4/vendor/modernizr/modernizr-2.6.2.custom.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 208.67.23.5 Burbank, United States, ASN3257 (GTT-BACKBONE GTT, DE), Reverse DNS h159.cpanellogin.net Software Apache / Resource Hash Request headers Referer https://www.citizens.intl-groups.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers Date Fri, 13 Mar 2020 07:42:01 GMT Server Apache Connection Keep-Alive Keep-Alive timeout=5, max=98 Content-Length 315 Content-Type text/html; charset=iso-8859-1
GET		icomoon.ttf www.citizensbank.com/fonts/v4/	0 0

GET		citisanb-webfont.ttf www.citizensbank.com/fonts/v4/	0 0

GET H/1.1	404 Not Found	bootstrap.min.js www.citizens.intl-groups.com/scripts/v4/vendor/bootstrap/	0 0	158ms 158ms	Script text/html	208.67.23.5 GTT-BACKBONE GTT
General Check archive.org Show headers Download Go to Full URL https://www.citizens.intl-groups.com/scripts/v4/vendor/bootstrap/bootstrap.min.js Requested by Host: www.citizensbank.com URL: https://www.citizensbank.com/scripts/v4/vendor/modernizr/modernizr-2.6.2.custom.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 208.67.23.5 Burbank, United States, ASN3257 (GTT-BACKBONE GTT, DE), Reverse DNS h159.cpanellogin.net Software Apache / Resource Hash Request headers Referer https://www.citizens.intl-groups.com/ User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36 Sec-Fetch-Dest script Response headers Date Fri, 13 Mar 2020 07:42:11 GMT Server Apache Connection Keep-Alive Keep-Alive timeout=5, max=100 Content-Length 315 Content-Type text/html; charset=iso-8859-1

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: www.citizensbank.com
URL: https://www.citizensbank.com/fonts/v4/citisanb-webfont.woff

Domain: www.citizensbank.com
URL: https://www.citizensbank.com/fonts/v4/icomoon.woff

Domain: www.citizensbank.com
URL: https://www.citizensbank.com/fonts/v4/icomoon.ttf

Domain: www.citizensbank.com
URL: https://www.citizensbank.com/fonts/v4/citisanb-webfont.ttf

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Citizens Bank (Banking)

36 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

pixel.mathtag.com
www.citizens.intl-groups.com
www.citizensbank.com
www.citizensbank.com
172.227.94.116
2.21.37.45
208.67.23.5
1e60e4b897c55ef15d144992469e879b42028c6bc97ee233108edcc50430249e
20c9447d184a8b03fcc06e184b19b2ca3e61c73317cab4e052134fca6baf833e
2395c2d20bc94523f7ab82420b2cba616c8d6642e0fda3a684ac1dc247ef0adb
319d82f567037eafefea25abbc64ea902db9255c5e7231fe9ddd462e4f5b9149
35ad5df10083c2e919252447a32b0a818935e6009a7e76d1ff8b215708da7fae
41c6298373fd5095a24a3f92b99b146206578fe00aa8d7f33a76b7cd0321ed60
45c055a0777a84727d10fe4420cf9c721e548d63bc2bcaa81fc3adf37a2a1bd4
56c43c6f5c8209acd47f355810bca2f9b0fc86c4bbdf1361d60fb2d2e2e66f8c
7853565d284435e8eee9d1fc071c42f9d93933fc64bd3bf3a53cf5e95d24258f
8e760e7ccd92b044f50e80235a7f5f8ebe8f470615464b72d5afb4eb3278333c
91766a9dc308be730991d0d12b9ed65a9265738a7ad311cc4a33a4d94b9b5630
9aa3d7beea155d9cc9e89c108d05608bdecc6f1eae8cdff26343c11510e9517d
a5ecc6d16c4b7313ca5a5cababecabbad4fab22f6c939819225837b96ca4e8d1
aa6b23cf1278811d9424a85ccee2c1e7bc187e0cca8e55b8de01fc931762524d
aaeba11accc7f508ed4a1504a549553aa27d4a82a2060b15751fa41f84c93540
aed4093b36d18ae335c4b3c5d9786e560dc8feebc6655d8045716299e7bee83e
c124f2740b035b5e53361fcbdae0611548b937712342f4b14adaff55168b2819
ca3f3a3af2c25449f7be9310021c8f0d2a1531bc843c35a281b1e8438a858f9c
d5a89e26beae0bc03ad18a0b0d1d3d75f87c32047879d25da11970cb5c4662a3
d9788f957a0264a11cf4beeac5436e49aa2b908d80c60bcf6681a4e4e8113318
dbc84261329dc7edf847448fed0f193b49ad317d8e3017e8a4b065639a3b37de
dddb031e5144ce20d909dbf4829d637738efa477bf5ab4eab67b1990ef0efb2d
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

www.citizens.intl-groups.com Open in urlscan Pro 208.67.23.5 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

43 Requests

91 %HTTPS

0 %IPv6

3 Domains

3 Subdomains

4 IPs

2 Countries

423 kBTransfer

554 kBSize

0 Cookies

0 Outgoing links

Redirected requests

43 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

www.citizens.intl-groups.com Open in urlscan Pro
208.67.23.5 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

43
Requests

91 %
HTTPS

0 %
IPv6

3
Domains

3
Subdomains

4
IPs

2
Countries

423 kB
Transfer

554 kB
Size

0
Cookies

43 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!