online.citi.com Open in urlscan Pro
104.111.239.33 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://fm.info6.citi.com/ats/url.aspx?cr=617&wu=1&we=1&url=https%3A%2F%2Fwww.accountonline.com%2Fcards%2Fsvc%2FLogin.do%3...
Effective URL:
https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jEDelivery_DocCenterLetters
Submission: On December 17 via manual (December 17th 2019, 4:04:45 pm UTC) from US

Summary HTTP 155 Redirects Links 26 Behaviour Indicators

Summary

This website contacted 39 IPs in 7 countries across 27 domains to perform 155 HTTP transactions. The main IP is 104.111.239.33, located in Netherlands and belongs to AKAMAI-AS - Akamai Technologies, Inc., US. The main domain is online.citi.com.
TLS certificate: Issued by DigiCert SHA2 Extended Validation Ser... on March 14th 2018. Valid for: 2 years.

This is the only time online.citi.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
2	173.213.4.17 173.213.4.17	53316 (ASN-CHEET...) (ASN-CHEETA-MAIL - CHEETAHMAIL)
1	2a00:1450:400... 2a00:1450:4001:819::200a	15169 (GOOGLE) (GOOGLE - Google LLC)
3	63.148.46.76 63.148.46.76	53316 (ASN-CHEET...) (ASN-CHEETA-MAIL - CHEETAHMAIL)
4 4	2.20.23.179 2.20.23.179	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
54	104.111.239.33 104.111.239.33	16625 (AKAMAI-AS) (AKAMAI-AS - Akamai Technologies)
12	18.195.42.228 18.195.42.228	16509 (AMAZON-02) (AMAZON-02 - Amazon.com)
2	35.190.72.21 35.190.72.21	15169 (GOOGLE) (GOOGLE - Google LLC)
3	151.101.14.133 151.101.14.133	54113 (FASTLY) (FASTLY - Fastly)
2	23.38.55.47 23.38.55.47	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1	184.30.216.237 184.30.216.237	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1	66.117.29.6 66.117.29.6	15224 (OMNITURE) (OMNITURE - Adobe Systems Inc.)
1	35.244.174.68 35.244.174.68	15169 (GOOGLE) (GOOGLE - Google LLC)
1	2a00:1450:400... 2a00:1450:4001:806::200e	15169 (GOOGLE) (GOOGLE - Google LLC)
2	35.176.204.252 35.176.204.252	16509 (AMAZON-02) (AMAZON-02 - Amazon.com)
1	2a00:1450:400... 2a00:1450:4001:81f::200e	15169 (GOOGLE) (GOOGLE - Google LLC)
2	2.19.42.73 2.19.42.73	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1	104.108.41.26 104.108.41.26	16625 (AKAMAI-AS) (AKAMAI-AS - Akamai Technologies)
9 17	2a00:1450:400... 2a00:1450:4001:824::2004	15169 (GOOGLE) (GOOGLE - Google LLC)
1	2a00:1450:400... 2a00:1450:4001:818::200e	15169 (GOOGLE) (GOOGLE - Google LLC)
1	40.122.110.249 40.122.110.249	8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation)
14	91.235.134.21 91.235.134.21	30286 (THM) (THM - ThreatMetrix Inc.)
1	143.204.97.29 143.204.97.29	16509 (AMAZON-02) (AMAZON-02 - Amazon.com)
1	13.225.78.100 13.225.78.100	16509 (AMAZON-02) (AMAZON-02 - Amazon.com)
1	104.103.83.50 104.103.83.50	16625 (AKAMAI-AS) (AKAMAI-AS - Akamai Technologies)
4	2a00:1450:400... 2a00:1450:4001:814::2008	15169 (GOOGLE) (GOOGLE - Google LLC)
1 3	15.188.31.119 15.188.31.119	16509 (AMAZON-02) (AMAZON-02 - Amazon.com)
1	172.217.22.34 172.217.22.34	15169 (GOOGLE) (GOOGLE - Google LLC)
1	151.101.13.175 151.101.13.175	54113 (FASTLY) (FASTLY - Fastly)
1 2	2a00:1450:400... 2a00:1450:4001:818::2013	15169 (GOOGLE) (GOOGLE - Google LLC)
1 1	3.122.45.35 3.122.45.35	16509 (AMAZON-02) (AMAZON-02 - Amazon.com)
1 2	193.0.160.129 193.0.160.129	54312 (ROCKETFUEL) (ROCKETFUEL - Rocket Fuel Inc.)
1	34.248.255.146 34.248.255.146	16509 (AMAZON-02) (AMAZON-02 - Amazon.com)
9 14	2a00:1450:400... 2a00:1450:4001:819::2002	15169 (GOOGLE) (GOOGLE - Google LLC)
14	2a00:1450:400... 2a00:1450:4001:824::2003	15169 (GOOGLE) (GOOGLE - Google LLC)
1	35.241.45.82 35.241.45.82	15169 (GOOGLE) (GOOGLE - Google LLC)
2	91.235.132.130 91.235.132.130	30286 (THM) (THM - ThreatMetrix Inc.)
1	91.235.134.131 91.235.134.131	30286 (THM) (THM - ThreatMetrix Inc.)
1	2.20.23.178 2.20.23.178	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1	193.0.160.128 193.0.160.128	54312 (ROCKETFUEL) (ROCKETFUEL - Rocket Fuel Inc.)
1	192.193.200.243 192.193.200.243	32287 (SOLANA-CI...) (SOLANA-CITIPLEX - Citigroup)
155	39

2 173.213.4.17 (United States)

ASN53316 (ASN-CHEETA-MAIL - CHEETAHMAIL, US)

fm.info6.citi.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
l.info6.citi.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:819::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE - Google LLC, US)

ajax.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 63.148.46.76 (United States)

ASN53316 (ASN-CHEETA-MAIL - CHEETAHMAIL, US)
PTR: xts.eccmp.com

sts.eccmp.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2.20.23.179 (Ascension Island) 4 redirects

ASN20940 (AKAMAI-ASN1, US)
PTR: a2-20-23-179.deploy.static.akamaitechnologies.com

www.accountonline.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
www.accountonline.citibank.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
accountonline.citi.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

54 104.111.239.33 (Netherlands)

ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US)
PTR: a104-111-239-33.deploy.static.akamaitechnologies.com

online.citi.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

12 18.195.42.228 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: ec2-18-195-42-228.eu-central-1.compute.amazonaws.com

nexus.ensighten.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 35.190.72.21 (Mountain View, United States)

ASN15169 (GOOGLE - Google LLC, US)
PTR: 21.72.190.35.bc.googleusercontent.com

di.rlcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
sr.rlcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 151.101.14.133 (Frankfurt am Main, Germany)

ASN54113 (FASTLY - Fastly, US)

resources.digital-cloud-citi.medallia.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 23.38.55.47 (Netherlands)

ASN20940 (AKAMAI-ASN1, US)
PTR: a23-38-55-47.deploy.static.akamaitechnologies.com

api.citi.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 184.30.216.237 (Netherlands)

ASN20940 (AKAMAI-ASN1, US)
PTR: a184-30-216-237.deploy.static.akamaitechnologies.com

cdn.tt.omtrdc.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 66.117.29.6 (United States)

ASN15224 (OMNITURE - Adobe Systems Inc., US)

citicorpcreditservic.tt.omtrdc.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 35.244.174.68 (Mountain View, United States)

ASN15169 (GOOGLE - Google LLC, US)
PTR: 68.174.244.35.bc.googleusercontent.com

api.rlcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:806::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE - Google LLC, US)

cse.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 35.176.204.252 (London, United Kingdom)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: ec2-35-176-204-252.eu-west-2.compute.amazonaws.com

mpsnare.iesnare.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:81f::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE - Google LLC, US)

www.youtube.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2.19.42.73 (Ascension Island)

ASN20940 (AKAMAI-ASN1, US)
PTR: a2-19-42-73.deploy.static.akamaitechnologies.com

stags.bluekai.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.108.41.26 (Netherlands)

ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US)
PTR: a104-108-41-26.deploy.static.akamaitechnologies.com

tags.bkrtx.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

17 2a00:1450:4001:824::2004 (Frankfurt am Main, Germany) 9 redirects

ASN15169 (GOOGLE - Google LLC, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:818::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE - Google LLC, US)

s.ytimg.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 40.122.110.249 (Des Moines, United States)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US)

cfr.us.v2.we-stats.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

14 91.235.134.21 (Netherlands)

ASN30286 (THM - ThreatMetrix Inc., US)

content22.online.citi.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 143.204.97.29 (Seattle, United States)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: server-143-204-97-29.fra50.r.cloudfront.net

js.adsrvr.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.225.78.100 (Seattle, United States)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: server-13-225-78-100.fra2.r.cloudfront.net

cdn.pbbl.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.103.83.50 (Netherlands)

ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US)
PTR: a104-103-83-50.deploy.static.akamaitechnologies.com

c1.rfihub.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a00:1450:4001:814::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE - Google LLC, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 15.188.31.119 (Paris, France) 1 redirects

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: ec2-15-188-31-119.eu-west-3.compute.amazonaws.com

metrics1.citi.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 172.217.22.34 (United States)

ASN15169 (GOOGLE - Google LLC, US)
PTR: fra15s16-in-f2.1e100.net

www.googleadservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 151.101.13.175 (Frankfurt am Main, Germany)

ASN54113 (FASTLY - Fastly, US)

nebula-cdn.kampyle.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:818::2013 (Frankfurt am Main, Germany) 1 redirects

ASN15169 (GOOGLE - Google LLC, US)

px0.pbbl.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 3.122.45.35 (Frankfurt am Main, Germany) 1 redirects

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: ec2-3-122-45-35.eu-central-1.compute.amazonaws.com

aa.agkn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 193.0.160.129 (Netherlands) 1 redirects

ASN54312 (ROCKETFUEL - Rocket Fuel Inc., US)

a.rfihub.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
p.rfihub.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 34.248.255.146 (Dublin, Ireland)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: ec2-34-248-255-146.eu-west-1.compute.amazonaws.com

insight.adsrvr.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

14 2a00:1450:4001:819::2002 (Frankfurt am Main, Germany) 9 redirects

ASN15169 (GOOGLE - Google LLC, US)

googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

14 2a00:1450:4001:824::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE - Google LLC, US)

www.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 35.241.45.82 (Ascension Island)

ASN15169 (GOOGLE - Google LLC, US)
PTR: 82.45.241.35.bc.googleusercontent.com

udc-neb.kampyle.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 91.235.132.130 (Netherlands)

ASN30286 (THM - ThreatMetrix Inc., US)
PTR: h.online-metrix.net

h.online-metrix.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 91.235.134.131 (Netherlands)

ASN30286 (THM - ThreatMetrix Inc., US)

89oebq5k-c07bbe33d778db1fd73c370c39db9ec49a55a8b2-am1.e.aa.online-metrix.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2.20.23.178 (Ascension Island)

ASN20940 (AKAMAI-ASN1, US)
PTR: a2-20-23-178.deploy.static.akamaitechnologies.com

www.citi.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 193.0.160.128 (Netherlands)

ASN54312 (ROCKETFUEL - Rocket Fuel Inc., US)

20766699p.rfihub.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 192.193.200.243 (United States)

ASN32287 (SOLANA-CITIPLEX - Citigroup, US)

prod.report.nacustomerexperience.citi.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
79	citi.com 3 redirects fm.info6.citi.com l.info6.citi.com accountonline.citi.com online.citi.com api.citi.com content22.online.citi.com metrics1.citi.com www.citi.com prod.report.nacustomerexperience.citi.com	2 MB
18	google.com 9 redirects cse.google.com www.google.com	109 KB
14	google.de www.google.de	2 KB
14	doubleclick.net 9 redirects googleads.g.doubleclick.net	14 KB
12	ensighten.com nexus.ensighten.com	235 KB
4	googletagmanager.com www.googletagmanager.com	109 KB
3	online-metrix.net h.online-metrix.net 89oebq5k-c07bbe33d778db1fd73c370c39db9ec49a55a8b2-am1.e.aa.online-metrix.net	825 B
3	rfihub.com 1 redirects a.rfihub.com p.rfihub.com 20766699p.rfihub.com	1 KB
3	pbbl.co 1 redirects cdn.pbbl.co px0.pbbl.co	4 KB
3	medallia.com resources.digital-cloud-citi.medallia.com	59 KB
3	rlcdn.com di.rlcdn.com api.rlcdn.com sr.rlcdn.com	40 B
3	eccmp.com sts.eccmp.com	17 KB
2	kampyle.com nebula-cdn.kampyle.com udc-neb.kampyle.com	6 KB
2	adsrvr.org js.adsrvr.org insight.adsrvr.org	2 KB
2	bluekai.com stags.bluekai.com
2	iesnare.com mpsnare.iesnare.com	14 KB
2	omtrdc.net cdn.tt.omtrdc.net citicorpcreditservic.tt.omtrdc.net	15 KB
1	agkn.com 1 redirects aa.agkn.com	378 B
1	googleadservices.com www.googleadservices.com	10 KB
1	rfihub.net c1.rfihub.net	7 KB
1	we-stats.com cfr.us.v2.we-stats.com	582 B
1	ytimg.com s.ytimg.com	9 KB
1	bkrtx.com tags.bkrtx.com	10 KB
1	youtube.com www.youtube.com	923 B
1	citibank.com 1 redirects www.accountonline.citibank.com	333 B
1	accountonline.com 1 redirects www.accountonline.com	248 B
1	googleapis.com ajax.googleapis.com	29 KB
155	27

	Domain	Requested by
54	online.citi.com	fm.info6.citi.com online.citi.com
17	www.google.com	9 redirects cse.google.com
14	www.google.de
14	googleads.g.doubleclick.net	9 redirects www.googleadservices.com
14	content22.online.citi.com	online.citi.com content22.online.citi.com
12	nexus.ensighten.com	online.citi.com nexus.ensighten.com
4	www.googletagmanager.com	nexus.ensighten.com
3	metrics1.citi.com	1 redirects
3	resources.digital-cloud-citi.medallia.com	online.citi.com resources.digital-cloud-citi.medallia.com
3	sts.eccmp.com	fm.info6.citi.com sts.eccmp.com
2	h.online-metrix.net	content22.online.citi.com
2	px0.pbbl.co	1 redirects
2	stags.bluekai.com	online.citi.com tags.bkrtx.com
2	mpsnare.iesnare.com	online.citi.com mpsnare.iesnare.com
2	api.citi.com	online.citi.com
2	accountonline.citi.com	2 redirects
1	prod.report.nacustomerexperience.citi.com	online.citi.com
1	20766699p.rfihub.com	c1.rfihub.net
1	www.citi.com
1	p.rfihub.com	1 redirects
1	89oebq5k-c07bbe33d778db1fd73c370c39db9ec49a55a8b2-am1.e.aa.online-metrix.net
1	udc-neb.kampyle.com	online.citi.com
1	insight.adsrvr.org	js.adsrvr.org
1	a.rfihub.com	c1.rfihub.net
1	aa.agkn.com	1 redirects
1	nebula-cdn.kampyle.com	resources.digital-cloud-citi.medallia.com
1	www.googleadservices.com	www.googletagmanager.com
1	sr.rlcdn.com	nexus.ensighten.com
1	c1.rfihub.net	nexus.ensighten.com
1	cdn.pbbl.co	nexus.ensighten.com
1	js.adsrvr.org	nexus.ensighten.com
1	cfr.us.v2.we-stats.com	online.citi.com
1	s.ytimg.com	www.youtube.com
1	tags.bkrtx.com	nexus.ensighten.com
1	www.youtube.com	online.citi.com
1	cse.google.com	online.citi.com
1	api.rlcdn.com	online.citi.com
1	citicorpcreditservic.tt.omtrdc.net	nexus.ensighten.com
1	cdn.tt.omtrdc.net	nexus.ensighten.com
1	di.rlcdn.com	online.citi.com
1	www.accountonline.citibank.com	1 redirects
1	www.accountonline.com	1 redirects
1	l.info6.citi.com	fm.info6.citi.com
1	ajax.googleapis.com	fm.info6.citi.com
1	fm.info6.citi.com
155	45

This site contains links to these domains. Also see Links.

Domain
www.citi.com
www.citicards.com
citi.com
banking.citi.com
www.citigroup.com
www.facebook.com
www.twitter.com
www.youtube.com
jobs.citi.com
citieasydeals.com
www.citiprivatepass.com
www.privatebank.citibank.com
itunes.apple.com
play.google.com
www.ipbus.citi.com
www.jdpower.com

Subject Issuer	Validity	Valid
info6.citi.com DigiCert Global CA G2	`2017-12-05` - `2020-03-03`	2 years	crt.sh
*.storage.googleapis.com GTS CA 1O1	`2019-11-13` - `2020-02-05`	3 months	crt.sh
*.eccmp.com DigiCert SHA2 Secure Server CA	`2018-04-30` - `2020-05-04`	2 years	crt.sh
online.citibank.com DigiCert SHA2 Extended Validation Server CA	`2018-03-14` - `2020-05-14`	2 years	crt.sh
nexus.ensighten.com DigiCert SHA2 Secure Server CA	`2019-10-03` - `2020-10-02`	a year	crt.sh
*.rlcdn.com Sectigo RSA Domain Validation Secure Server CA	`2019-04-24` - `2020-04-23`	a year	crt.sh
*.digital-cloud-citi.medallia.com SSL.com DV CA	`2018-11-13` - `2020-11-12`	2 years	crt.sh
api.citi.com DigiCert SHA2 Extended Validation Server CA	`2018-04-03` - `2020-01-11`	2 years	crt.sh
*.tt.omtrdc.net DigiCert SHA2 High Assurance Server CA	`2017-10-26` - `2020-11-25`	3 years	crt.sh
*.google.com GTS CA 1O1	`2019-11-13` - `2020-02-05`	3 months	crt.sh
mpsnare.iesnare.com DigiCert SHA2 High Assurance Server CA	`2019-04-24` - `2020-05-26`	a year	crt.sh
odc-prod-01.oracle.com DigiCert ECC Secure Server CA	`2018-12-10` - `2020-03-10`	a year	crt.sh
*.bkrtx.com DigiCert SHA2 Secure Server CA	`2018-12-03` - `2020-03-03`	a year	crt.sh
www.google.com GTS CA 1O1	`2019-11-13` - `2020-02-05`	3 months	crt.sh
*.us.v2.we-stats.com COMODO RSA Domain Validation Secure Server CA	`2018-10-11` - `2020-10-10`	2 years	crt.sh
content22.online.citi.com DigiCert SHA2 Extended Validation Server CA	`2018-08-06` - `2020-08-06`	2 years	crt.sh
*.adsrvr.org Trustwave Organization Validation SHA256 CA, Level 1	`2019-03-07` - `2021-04-19`	2 years	crt.sh
*.pbbl.co Amazon	`2019-01-31` - `2020-02-29`	a year	crt.sh
*.rfihub.net DigiCert SHA2 Secure Server CA	`2019-01-25` - `2020-04-25`	a year	crt.sh
*.google-analytics.com GTS CA 1O1	`2019-11-13` - `2020-02-05`	3 months	crt.sh
metrics1.citi.com DigiCert SHA2 Extended Validation Server CA	`2018-08-31` - `2020-08-30`	2 years	crt.sh
www.googleadservices.com GTS CA 1O1	`2019-12-03` - `2020-02-25`	3 months	crt.sh
j.ssl.fastly.net GlobalSign Organization Validation CA - SHA256 - G2	`2019-09-11` - `2020-06-11`	9 months	crt.sh
px0.pbbl.co Let's Encrypt Authority X3	`2019-10-31` - `2020-01-29`	3 months	crt.sh
*.rfihub.com DigiCert SHA2 Secure Server CA	`2019-08-27` - `2020-08-31`	a year	crt.sh
*.g.doubleclick.net GTS CA 1O1	`2019-12-03` - `2020-02-25`	3 months	crt.sh
www.google.de GTS CA 1O1	`2019-11-13` - `2020-02-05`	3 months	crt.sh
*.kampyle.com RapidSSL RSA CA 2018	`2019-02-17` - `2020-03-01`	a year	crt.sh
h.online-metrix.net Thawte TLS RSA CA G1	`2018-03-22` - `2020-03-21`	2 years	crt.sh
*.e.aa.online-metrix.net Go Daddy Secure Certificate Authority - G2	`2019-09-13` - `2021-09-13`	2 years	crt.sh
www.citi.com DigiCert SHA2 Extended Validation Server CA	`2019-10-17` - `2022-01-01`	2 years	crt.sh
prod.report.nacustomerexperience.citi.com DigiCert Global CA G2	`2018-07-05` - `2020-07-04`	2 years	crt.sh

This page contains 10 frames:

Primary Page: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jEDelivery_DocCenterLetters
Frame ID: A62443883DB33759C4F17CC074C5C8B5
Requests: 135 HTTP requests in this frame

Frame: https://sr.rlcdn.com/425466.html?es=80676&u=da39a3ee5e6b4b0d3255bfef95601890afd80709
Frame ID: 8B8D0A375F9B765ED312365250340703
Requests: 1 HTTP requests in this frame

Frame: https://stags.bluekai.com/site/63068?ret=html&phint=language%3Denglish&phint=product%3D&phint=event&phint=category%3Dpre-login%20Sign%20on%20page&phint=page%3DNon%20Cookied%20Username%20Password%20&phint=section1%3DPublic&phint=section2%3DSignOn&phint=section3%3D&phint=section4%3D&phint=bankappstatus&phint=productID&phint=__bk_t%3DOnline%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&phint=__bk_k%3Dbanking%2C%20citi%2C%20financial%20services%2C%20checking%20account%2C%20savings%20account%2C%20credit%20cards&phint=__bk_pr%3Dhttps%3A%2F%2Ffm.info6.citi.com%2Fats%2Furl.aspx%3Fcr%3D617%26wu%3D1%26we%3D1%26url%3Dhttps%253A%252F%252Fwww.accountonline.com%252Fcards%252Fsvc%252FLogin.do%253FNEXT_SCREEN%253D%252FDocctr%2526siteId%253DCB%2526accountIndex%253D%2526enid%253D06895BACB5C94FD6EC024F9CBFC462EE62C6%26linkName%3DCN_ECOMM_CENTER_URL%26transId%3DI2019121500064199&phint=__bk_l%3Dhttps%3A%2F%2Fonline.citi.com%2FUS%2FJRS%2Finfrastructure%2Ftarget.do%3Fnext_page%3Djfp%7CjEDelivery_DocCenterLetters&phint=__bk_v%3D3.1.3&limit=10&r=13852848
Frame ID: 2656F126972AACDFBFBFB812827BB160
Requests: 1 HTTP requests in this frame

Frame: https://content22.online.citi.com/fp/check.js;CIS3SID=62CB603BA5FCA3A6F5F890B528CA28B7?org_id=89oebq5k&session_id=d00039fdc1946ea1fda48026a8aeb1aec266508999ccf402cc3fdf6e85179bef&nonce=99b8914f359a7962&pageid=1&jb=33372626687b6d753f4c616e7778266a716f3d4c616e777a266273623f4368726d6f672732303f3c
Frame ID: 56908B4950A15D7354A2F570EDCA0350
Requests: 10 HTTP requests in this frame

Frame: https://insight.adsrvr.org/track/up?adv=1jw5cvl&ref=https%3A%2F%2Fonline.citi.com%2FUS%2FJRS%2Finfrastructure%2Ftarget.do%3Fnext_page%3Djfp%7CjEDelivery_DocCenterLetters&upid=t1sl5ty&upv=1.1.0&orderid={orderid}&v={v}&vf={vf}&td1=jUSCBOL_Loginpage_Uncookied&td2=undefined&td3=undefined&td4=Non%20Cookied%20Username%20Password%20&td5=https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jEDelivery_DocCenterLetters&td6={td6}&td7={td7}&td8={td8}&td9={td9}&td10={td10}
Frame ID: B9AE61E795CD9D232A33C75D85BDA0FB
Requests: 1 HTTP requests in this frame

Frame: https://content22.online.citi.com/fp/HP?session_id=d00039fdc1946ea1fda48026a8aeb1aec266508999ccf402cc3fdf6e85179bef&org_id=89oebq5k&nonce=99b8914f359a7962&mode=2&hp=.co-operativebank.co.uk/CBIBSWeb/login.do.co-operativebank.co.uk/CBIBSWeb/start.do.de/portal/portal/x.entropay.com/basemenu/prot/x.facebook.comx.nationet.com/x.netbank.commbank.com.au/netbank/bankmainx.npbs.co.uk/netmastergoldbanking/x.nwolb.xlogin.aspx?refereridentx.rbsdigital.xAccountSummaryx.smile.co.uk/SmileWeb/login.do.smile.co.uk/SmileWeb/start.do.yandex.rux/CapitalOne_Consumer/x/easypay.by/x/sbank.ru/x53.com/servlet/efsonlinex://online.wellsfargo.com/x://secure.assist.ru/assistid/protected/main.doxabbeynational.co.uk/EBAN_ENS/BtoChannelDriverxalliance-leicesterxaltergold.com/login.phpxamericanexpress.com/myca/intl/acctsumm/emea/accountSummaryxbancaintesa.it/xbankcardservices.co.ukxbankofamerica.com/xbanquepopulaire.fr/xbnpparibas.net/xcahoot.comxcapitaloneonline.co.uk/CapitalOne_Consumer/Transactionsxcbonline.co.uk/ralu/reglm-web/setupSecurityQuestionPagexcibc.comxPreSignOnxcibc.comxSignOnxcitibank.ru/xclient.uralsibbank.ruxco-operativebank.co.uk/CBIBSWeb/loginSpixcommerceonlinebanking.comxcoventrybuildingsociety.co.ukxdeutsche-bank.dexdiscovercard.com/cardmembersvcs/strongauth/app/sa_mainxebanking.bawag.comxebc_ebc1961xegg.com/customer/movemoneyxegg.com/customer/yourmoneyxfacebook.com/xhalifax-online.co.ukxMyAccountsxhalifax-online.co.uk/x/Mhalifax-online.co.uk/personalxhsbc.co.uk/1/2/personal/internet-banking/xhsbc.comxhttps://banking.postbank.de/app/finanzstatus.init.do;jsessionidxib.fineco.it/FinecoWeb/BonificiServletxib.fineco.it/FinecoWeb/jsp/Main/HBFineco.jspxib.fineco.it/FinecoWeb/jsp/Main/Principale.jspxibank.alfabank.ruxin-biz.it/xipko.plxlibertyreserve.com/x/historylibertyreserve.com/x/loginwww.libertyreserve.com/x/Core.jswww.libertyreserve.com/x/transfer.libertyreserve.com/x/commonscript.jslloydstsb.co.uk/personal/a/account_overview/xmbna.co.ukxmenyala.ruxmoney.yandex.ruxmoneybookers.com/app/login.plxmoneymail.ruxmy.ebay.co.uk/ws/eBayISAPI.dll?MyEbayxmy.ebay.com/ws/eBayISAPI.dll?MyEbayxmy.ebay.fr/ws/eBayISAPI.dll?MyEbayxmybusinessbank.co.ukxnationet.com/AppServices/SignOn/SignOnProcess/RcaSignOnxnpbs.co.ukxnwolb.com/AccountSummaryxnwolb.com/Statementsxnwolb.com/TransfersLandingPagexoltx.fidelity.com/x/x/ofsummary/summaryxonline.lloydstsb.co.ukxonlinebanking.mandtbank.com/summary/AccountSummaryxpassport.yandex.ruxpaypal.com/x/cgi-bin/webscr?cmd=_accountxpaypal.com/x/cgi-bin/webscr?cmd=_login-done&login_access=xpaypal.com/us/cgi-bin/webscr?cmd=_login-done&login_access=xposte.it/xpsk.co.at/xsecure.lloydstsb.co.uk/personal/a/account_overviewxsmile.co.uk/SmileWeb/passcodexusaa.com/xusbank.com/internetBanking/RequestRouter?requestCmdId=Gxwachovia.comxybonline.co.uk/ralu/reglm-web/setupSecurityQuestionPagex.amazon.fr/xhistory/orders/view.htmlx.banquepopulaire.frxShowPortal.dox.bnpparibasfortis.bexHome_Logon.aspx.cdiscount.com/Account/Home.aspxx.cmb.frxaccueil.jspx.credit-agricole.frxentreeBam?sessionSAGx.labanquepostale.fr/xreleveCPP-releve_ccp.eax.secure.bnpparibas.net/NSFR?Actionx.secure.lcl.frxAccueilxcredem.it/OneToOne/ebank/functionsxmijn.ing.nl/xonline.ybs.co.ukxwww.discover.com/xorder.cdiscount.comxCustomer.aspxxsealinfo.verisign.com/splash?form_filexvos-comptes.credit-du-nord.fr/CDC_TableauDeBord_0.asp?xvoscomptesenligne.labanquepostale.frxwww.x.caisse-epargne.fr/Portail.aspxxwww.exabanque.netxonglet.phpxdeutsche-bank.de/xnorisbank.de/xpostbank.de/xtargobank.de/x.x.de/portal/x.bankofamerica.com/x/commonscript.js.bmo.com/OLB?id=x.bmo.com/RMC?id=x.chase.com/x.aspxx.chase.com/js/Reporting.jsx.koodomobile.com/account/selfserve/x/xaccountId=x.payment.ru/x.scotiabank.com/portal/index.jsp?xbancopopular.es/empresasxcreval.it/login2007/loginSiciliano.aspxfirst-direct.com/xipko.plxmybusinessbank.co.ukxsanpaoloimi.com/xulsterbankanytimebanking.x/login.aspxx
Frame ID: 0530FA77D70FEA2142E56678493D1319
Requests: 3 HTTP requests in this frame

Frame: https://content22.online.citi.com/fp/ls_fp.html;CIS3SID=62CB603BA5FCA3A6F5F890B528CA28B7?org_id=89oebq5k&session_id=d00039fdc1946ea1fda48026a8aeb1aec266508999ccf402cc3fdf6e85179bef&nonce=99b8914f359a7962&pageid=1
Frame ID: 9A456F065A0C60280DE12FEBAC680D1B
Requests: 1 HTTP requests in this frame

Frame: https://h.online-metrix.net/fp/sid_fp.html;CIS3SID=62CB603BA5FCA3A6F5F890B528CA28B7?org_id=89oebq5k&session_id=d00039fdc1946ea1fda48026a8aeb1aec266508999ccf402cc3fdf6e85179bef&nonce=99b8914f359a7962&pageid=1
Frame ID: C9F243F7C1F3E1408CEF35D1CF7B5CEE
Requests: 1 HTTP requests in this frame

Frame: https://content22.online.citi.com/fp/top_fp.html;CIS3SID=62CB603BA5FCA3A6F5F890B528CA28B7?org_id=89oebq5k&session_id=d00039fdc1946ea1fda48026a8aeb1aec266508999ccf402cc3fdf6e85179bef&nonce=99b8914f359a7962&pageid=1
Frame ID: 2D9C7EBDE8C9B9190FB84DB960FD3C62
Requests: 1 HTTP requests in this frame

Frame: https://20766699p.rfihub.com/ca.html?rfiidc=1870471593770096821&rfiaid=a14295ecd09145b081ee7c85ab0ae903&ver=9&ra=1971&rb=648&ca=20766699&_o=17169175&_t=noncookiedusernamepassword&ssv_cuuid=&ssv_pagename=noncookiedusernamepassword&pe=https%3A%2F%2Fonline.citi.com%2FUS%2FJRS%2Finfrastructure%2Ftarget.do%3Fnext_page%3Djfp%7CjEDelivery_DocCenterLetters&pf=https%3A%2F%2Ffm.info6.citi.com%2Fats%2Furl.aspx%3Fcr%3D617%26wu%3D1%26we%3D1%26url%3Dhttps%253A%252F%252Fwww.accountonline.com%252Fcards%252Fsvc%252FLogin.do%253FNEXT_SCREEN%253D%252FDocctr%2526siteId%253DCB%2526accountIndex%253D%2526enid%253D06895BACB5C94FD6EC024F9CBFC462EE62C6%26linkName%3DCN_ECOMM_CENTER_URL%26transId%3DI2019121500064199&ra=9734172524760154
Frame ID: 10A2B38EA85EA2D450287F1A5805D571
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

https://fm.info6.citi.com/ats/url.aspx?cr=617&wu=1&we=1&url=https%3A%2F%2Fwww.accountonline.com%2Fcard... Page URL
https://www.accountonline.com/cards/svc/Login.do?NEXT_SCREEN=/Docctr&siteId=CB&accountIndex= HTTP 301
https://www.accountonline.citibank.com/cards/svc/Login.do?NEXT_SCREEN=/Docctr&siteId=CB&accountIndex= HTTP 301
https://accountonline.citi.com/cards/svc/Login.do?NEXT_SCREEN=/Docctr&siteId=CB&accountIndex= HTTP 301
https://accountonline.citi.com/cards/svc/LoginGet.do?NEXT_SCREEN=/Docctr&siteId=CB&accountIndex= HTTP 301
https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jEDelivery_DocCenterLetters Page URL

Detected technologies

Windows Server (Operating Systems) Expand

Overall confidence: 50%
Detected patterns

url /\.aspx?(?:$|\?)/i

Microsoft ASP.NET (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

url /\.aspx?(?:$|\?)/i

IIS (Web Servers) Expand

Overall confidence: 50%
Detected patterns

url /\.aspx?(?:$|\?)/i

Ensighten (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

script /\/\/nexus\.ensighten\.com\//i

Page Statistics

155
Requests

99 %
HTTPS

23 %
IPv6

27
Domains

45
Subdomains

39
IPs

7
Countries

2579 kB
Transfer

6581 kB
Size

31
Cookies

26 Outgoing links

These are links going to different origins than the main page.

URL: https://www.citi.com/credit-cards/compare-credit-cards/citi.action?ID=view-all-credit-cards
Title: View All Credit Cards

Search URL Search Domain Scan URL

URL: https://www.citi.com/credit-cards/compare-credit-cards/citi.action?ID=low-interest-credit-card
Title: 0% Intro APR Credit Cards

Search URL Search Domain Scan URL

URL: https://www.citi.com/credit-cards/compare-credit-cards/citi.action?ID=balance-transfer-credit-cards
Title: Balance Transfer Credit Cards

Search URL Search Domain Scan URL

URL: https://www.citi.com/credit-cards/compare-credit-cards/citi.action?ID=reward-credit-cards
Title: Rewards Credit Cards

Search URL Search Domain Scan URL

URL: https://www.citicards.com/cards/credit/application/flow.action?isInvitation=N&OC=CC-CITI-3D5
Title: See If You're Pre-Qualified

Search URL Search Domain Scan URL

URL: https://www.citi.com/credit-cards/compare-credit-cards/citi.action?ID=all-small-business-credit-cards&m=f
Title: Small Business Credit Cards

Search URL Search Domain Scan URL

URL: https://citi.com/hurricanetips
Title: prepare for the storm.

Search URL Search Domain Scan URL

URL: https://banking.citi.com/cbol/checking/high-yield-checking/default.htm?Promo_ID=4FWDQVC8TKCHPA&intc=1~1~21~1~BANR~2~HYCA_NoATMFee~HP
Title: Get Details

Search URL Search Domain Scan URL

URL: https://banking.citi.com/cbol/checking-700/default.htm?channel=onsite&promo_ID=4EDYNGQ8JVCHP7&intc=1~1~52~6~BANR~2~CheckQ419_700SA~HP
Title: Earn $700 with Citi Priority

Search URL Search Domain Scan URL

URL: https://www.citi.com/credit-cards/credit-card-details/citi.action?ID=citi-rewards-plus-credit-card&afc=106
Title: The Citi Rewards+SM Card

Search URL Search Domain Scan URL

URL: https://www.citi.com/credit-cards/credit-card-details/citi.action?ID=Citi-costco-anywhere-visa-credit-card&afc=106&intc=7~7~67~1~MCT~1~
Title: Go Big with Cash Back Rewards

Search URL Search Domain Scan URL

URL: https://www.citi.com/credit-cards/credit-card-details/citi.action?ID=citi-simplicity-credit-card&afc=106&intc=intc=1~1~52~6~BANR~1~sim_citicomREDPE_oct2016

Search URL Search Domain Scan URL

URL: https://www.citi.com/credit-cards/compare-credit-cards/citi.action?ID=view-all-credit-cards&afc=105&intc=1~1~52~6~BANR~1~mpc_Default_citicomREDPE_aug2016

Search URL Search Domain Scan URL

URL: https://www.citigroup.com/citi/progress-maker-stories/#CITI-WELCOME

Search URL Search Domain Scan URL

URL: https://www.facebook.com/citi
Title:

Search URL Search Domain Scan URL

URL: https://www.twitter.com/citi
Title:

Search URL Search Domain Scan URL

URL: https://www.youtube.com/citi
Title:

Search URL Search Domain Scan URL

URL: http://www.citigroup.com/citi/
Title: Our Story

Search URL Search Domain Scan URL

URL: https://jobs.citi.com/
Title: Careers

Search URL Search Domain Scan URL

URL: https://citieasydeals.com/
Title: Citi Easy DealsSM

Search URL Search Domain Scan URL

URL: http://www.citiprivatepass.com/
Title: Citi EntertainmentSM

Search URL Search Domain Scan URL

URL: https://www.privatebank.citibank.com/
Title: Citi Private Bank

Search URL Search Domain Scan URL

URL: https://itunes.apple.com/app/citi-mobile-sm/id301724680?mt=8
Title:

Search URL Search Domain Scan URL

URL: https://play.google.com/store/apps/details?id=com.citi.citimobile
Title:

Search URL Search Domain Scan URL

URL: https://www.ipbus.citi.com/
Title: International Personal Bank U.S.

Search URL Search Domain Scan URL

URL: http://www.jdpower.com/awards
Title: jdpower.com/awards

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://fm.info6.citi.com/ats/url.aspx?cr=617&wu=1&we=1&url=https%3A%2F%2Fwww.accountonline.com%2Fcards%2Fsvc%2FLogin.do%3FNEXT_SCREEN%3D%2FDocctr%26siteId%3DCB%26accountIndex%3D%26enid%3D06895BACB5C94FD6EC024F9CBFC462EE62C6&linkName=CN_ECOMM_CENTER_URL&transId=I2019121500064199 Page URL
https://www.accountonline.com/cards/svc/Login.do?NEXT_SCREEN=/Docctr&siteId=CB&accountIndex= HTTP 301
https://www.accountonline.citibank.com/cards/svc/Login.do?NEXT_SCREEN=/Docctr&siteId=CB&accountIndex= HTTP 301
https://accountonline.citi.com/cards/svc/Login.do?NEXT_SCREEN=/Docctr&siteId=CB&accountIndex= HTTP 301
https://accountonline.citi.com/cards/svc/LoginGet.do?NEXT_SCREEN=/Docctr&siteId=CB&accountIndex= HTTP 301
https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jEDelivery_DocCenterLetters Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 81

https://metrics1.citi.com/b/ss/citiuscombprod/1/JS-2.9.0/s1708233699207?AQB=1&ndh=1&pf=1&t=17%2F11%2F2019%2017%3A4%3A29%202%20-60&fid=6DD56DCCD819679C-2CE8AA41689E2672&ce=UTF-8&g=https%3A%2F%2Fonline.citi.com%2FUS%2FJRS%2Finfrastructure%2Ftarget.do%3Fnext_page%3Djfp%7CjEDelivery_DocCenterLetters&r=https%3A%2F%2Ffm.info6.citi.com%2Fats%2Furl.aspx%3Fcr%3D617%26wu%3D1%26we%3D1%26url%3Dhttps%253A%252F%252Fwww.accountonline.com%252Fcards%252Fsvc%252FLogin.do%253FNEXT_SCREEN%253D%252FDocctr%2526siteId%253DCB%2526accountIndex%253D%2526enid%253D06895BACB5C94FD6EC024F9CBFC462EE62C6%26linkName%3DCN_ECOMM_CENTER_URL%26transId%3DI2019121500064199&c.&site_events=banner_displayed&country=US&common_hierarchy=us%7Cweb&action_type=page%20view&language=en_US&authentication_type=web%7Cpassword%7Cnon-ti%7Cciti%7Cl1.0&site_hierarchy_0=us&site_hierarchy_1=web&site_hierarchy_2=public&site_hierarchy_3=marketing&site_hierarchy_4=home&platform_type=Web%20browser&user_agent=Mozilla%2F5.0%20%28Macintosh%3B%20Intel%20Mac%20OS%20X%2010_14_5%29%20AppleWebKit%2F537.36%20%28KHTML%2C%20like%20Gecko%29%20Chrome%2F74.0.3729.169%20Safari%2F537.36&test_id=183_3_0%20citi.com%20Homepage-Offers-Banners%20Displayed&evarPageName_0=us&evarPageName_1=web&evarPageName_2=public&evarPageName_3=marketing&evarPageName_4=home&evarPageName_5=citi&CUUID=e1390b51-81ee-4217-91ac-54c805fa3786&url=https%3A%2F%2Fonline.citi.com%2FUS%2FJRS%2Finfrastructure%2Ftarget.do%3Fnext_page%3Djfp%7CjEDelivery_DocCenterLetters&site_name=US&customer_profile_string=%23&track_id=9667593317%7C2019-12-17T16%3A04%3A28.605Z&domain=online.citi.com&authentication_status=not%20authenticated&lob=mrc&app_hierarchy=public%7Cmarketing%7Chome%7Cciti&lead_type=citi.com%7Chome&event=banner_displayed&site_events_0=banner_displayed&responsive_design_data=1600%7CDesktop%7CNo&Platform=Desktop&login_status=prospect&.c&cc=USD&c7=11%3A04%20AM%7CTuesday&v7=11%3A04%20AM%7CTuesday&v11=New&c65=Non%20Cookied%20Username%20Password%20&v85=c3ca17be-2ed8-4524-bf48-d504467ef50e&s=1600x1200&c=24&j=1.6&v=N&k=Y&bw=1600&bh=1200&AQE=1 HTTP 302
https://metrics1.citi.com/b/ss/citiuscombprod/1/JS-2.9.0/s1708233699207?AQB=1&pccr=true&vidn=2EFC7E468515FBE7-600009755789AF71&ndh=1&pf=1&t=17%2F11%2F2019%2017%3A4%3A29%202%20-60&fid=6DD56DCCD819679C-2CE8AA41689E2672&ce=UTF-8&g=https%3A%2F%2Fonline.citi.com%2FUS%2FJRS%2Finfrastructure%2Ftarget.do%3Fnext_page%3Djfp%7CjEDelivery_DocCenterLetters&r=https%3A%2F%2Ffm.info6.citi.com%2Fats%2Furl.aspx%3Fcr%3D617%26wu%3D1%26we%3D1%26url%3Dhttps%253A%252F%252Fwww.accountonline.com%252Fcards%252Fsvc%252FLogin.do%253FNEXT_SCREEN%253D%252FDocctr%2526siteId%253DCB%2526accountIndex%253D%2526enid%253D06895BACB5C94FD6EC024F9CBFC462EE62C6%26linkName%3DCN_ECOMM_CENTER_URL%26transId%3DI2019121500064199&c.&site_events=banner_displayed&country=US&common_hierarchy=us%7Cweb&action_type=page%20view&language=en_US&authentication_type=web%7Cpassword%7Cnon-ti%7Cciti%7Cl1.0&site_hierarchy_0=us&site_hierarchy_1=web&site_hierarchy_2=public&site_hierarchy_3=marketing&site_hierarchy_4=home&platform_type=Web%20browser&user_agent=Mozilla%2F5.0%20%28Macintosh%3B%20Intel%20Mac%20OS%20X%2010_14_5%29%20AppleWebKit%2F537.36%20%28KHTML%2C%20like%20Gecko%29%20Chrome%2F74.0.3729.169%20Safari%2F537.36&test_id=183_3_0%20citi.com%20Homepage-Offers-Banners%20Displayed&evarPageName_0=us&evarPageName_1=web&evarPageName_2=public&evarPageName_3=marketing&evarPageName_4=home&evarPageName_5=citi&CUUID=e1390b51-81ee-4217-91ac-54c805fa3786&url=https%3A%2F%2Fonline.citi.com%2FUS%2FJRS%2Finfrastructure%2Ftarget.do%3Fnext_page%3Djfp%7CjEDelivery_DocCenterLetters&site_name=US&customer_profile_string=%23&track_id=9667593317%7C2019-12-17T16%3A04%3A28.605Z&domain=online.citi.com&authentication_status=not%20authenticated&lob=mrc&app_hierarchy=public%7Cmarketing%7Chome%7Cciti&lead_type=citi.com%7Chome&event=banner_displayed&site_events_0=banner_displayed&responsive_design_data=1600%7CDesktop%7CNo&Platform=Desktop&login_status=prospect&.c&cc=USD&c7=11%3A04%20AM%7CTuesday&v7=11%3A04%20AM%7CTuesday&v11=New&c65=Non%20Cookied%20Username%20Password%20&v85=c3ca17be-2ed8-4524-bf48-d504467ef50e&s=1600x1200&c=24&j=1.6&v=N&k=Y&bw=1600&bh=1200&AQE=1

Request Chain 90

https://px0.pbbl.co/ns/__p2.gif?brid=1560&brcid=e1390b51-81ee-4217-91ac-54c805fa3786&email=&orderId=&orderValue=&productId=&offerCode=&label=&pageUrl=https%3A%2F%2Fonline.citi.com%2FUS%2FJRS%2Finfrastructure%2Ftarget.do%3Fnext_page%3Djfp%7CjEDelivery_DocCenterLetters&referrerUrl=https%3A%2F%2Ffm.info6.citi.com%2Fats%2Furl.aspx%3Fcr%3D617%26wu%3D1%26we%3D1%26url%3Dhttps%253A%252F%252Fwww.accountonline.com%252Fcards%252Fsvc%252FLogin.do%253FNEXT_SCREEN%253D%252FDocctr%2526siteId%253DCB%2526accountIndex%253D%2526enid%253D06895BACB5C94FD6EC024F9CBFC462EE62C6%26linkName%3DCN_ECOMM_CENTER_URL%26transId%3DI2019121500064199&targetUrl=https%3A%2F%2Fonline.citi.com%2FUS%2FJRS%2Finfrastructure%2Ftarget.do%3Fnext_page%3Djfp%7CjEDelivery_DocCenterLetters&sessionId=&markerType=seg&rand=6oXGBiQyEeATHeir&jsVer=3.0&markerId=348192 HTTP 302
https://aa.agkn.com/adscores/g.pixel?sid=9212282598&_ppid=157f818f-27bf-498b-a867-81409fa37f80&_segid=99&iid=d30b3bf6-7624-415f-a251-ec1795b76b91 HTTP 302
https://px0.pbbl.co/adadvisor.gif?segment=000&_ppid=157f818f-27bf-498b-a867-81409fa37f80&_segid=99&_zip=&hk=&iid=d30b3bf6-7624-415f-a251-ec1795b76b91&mt=&bd=

Request Chain 101

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/916451471/?random=1576598669431&cv=9&fst=1576598669431&num=1&fmt=3&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=3&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2oac61&sendb=1&ig=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fonline.citi.com%2FUS%2FJRS%2Finfrastructure%2Ftarget.do%3Fnext_page%3Djfp%7CjEDelivery_DocCenterLetters&ref=https%3A%2F%2Ffm.info6.citi.com%2Fats%2Furl.aspx%3Fcr%3D617%26wu%3D1%26we%3D1%26url%3Dhttps%253A%252F%252Fwww.accountonline.com%252Fcards%252Fsvc%252FLogin.do%253FNEXT_SCREEN%253D%252FDocctr%2526siteId%253DCB%2526accountIndex%253D%2526enid%253D06895BACB5C94FD6EC024F9CBFC462EE62C6%26linkName%3DCN_ECOMM_CENTER_URL%26transId%3DI2019121500064199&tiba=Online%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&hn=www.googleadservices.com&async=1 HTTP 302
https://www.google.com/pagead/1p-user-list/916451471/?random=1576598669431&cv=9&fst=1576598400000&num=1&fmt=3&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=3&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2oac61&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fonline.citi.com%2FUS%2FJRS%2Finfrastructure%2Ftarget.do%3Fnext_page%3Djfp%7CjEDelivery_DocCenterLetters&ref=https%3A%2F%2Ffm.info6.citi.com%2Fats%2Furl.aspx%3Fcr%3D617%26wu%3D1%26we%3D1%26url%3Dhttps%253A%252F%252Fwww.accountonline.com%252Fcards%252Fsvc%252FLogin.do%253FNEXT_SCREEN%253D%252FDocctr%2526siteId%253DCB%2526accountIndex%253D%2526enid%253D06895BACB5C94FD6EC024F9CBFC462EE62C6%26linkName%3DCN_ECOMM_CENTER_URL%26transId%3DI2019121500064199&tiba=Online%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&async=1&is_vtc=1&random=852833481&resp=GooglemKTybQhCsO HTTP 302
https://www.google.de/pagead/1p-user-list/916451471/?random=1576598669431&cv=9&fst=1576598400000&num=1&fmt=3&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=3&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2oac61&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fonline.citi.com%2FUS%2FJRS%2Finfrastructure%2Ftarget.do%3Fnext_page%3Djfp%7CjEDelivery_DocCenterLetters&ref=https%3A%2F%2Ffm.info6.citi.com%2Fats%2Furl.aspx%3Fcr%3D617%26wu%3D1%26we%3D1%26url%3Dhttps%253A%252F%252Fwww.accountonline.com%252Fcards%252Fsvc%252FLogin.do%253FNEXT_SCREEN%253D%252FDocctr%2526siteId%253DCB%2526accountIndex%253D%2526enid%253D06895BACB5C94FD6EC024F9CBFC462EE62C6%26linkName%3DCN_ECOMM_CENTER_URL%26transId%3DI2019121500064199&tiba=Online%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&async=1&is_vtc=1&random=852833481&resp=GooglemKTybQhCsO&ipr=y&ezwbk=AZuM4hB4qz0srsLCmjHXS1DLHVFX8u0TSJjWKO50AwXkLMHRwbvPS25fDBMA_kVDOvfogQnUCQ8tl04MmKkkjXwlcC6C

Request Chain 102

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/975701947/?random=1576598669431&cv=9&fst=1576598669431&num=1&fmt=3&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=3&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2oac61&sendb=1&ig=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fonline.citi.com%2FUS%2FJRS%2Finfrastructure%2Ftarget.do%3Fnext_page%3Djfp%7CjEDelivery_DocCenterLetters&ref=https%3A%2F%2Ffm.info6.citi.com%2Fats%2Furl.aspx%3Fcr%3D617%26wu%3D1%26we%3D1%26url%3Dhttps%253A%252F%252Fwww.accountonline.com%252Fcards%252Fsvc%252FLogin.do%253FNEXT_SCREEN%253D%252FDocctr%2526siteId%253DCB%2526accountIndex%253D%2526enid%253D06895BACB5C94FD6EC024F9CBFC462EE62C6%26linkName%3DCN_ECOMM_CENTER_URL%26transId%3DI2019121500064199&tiba=Online%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&hn=www.googleadservices.com&async=1 HTTP 302
https://www.google.com/pagead/1p-user-list/975701947/?random=1576598669431&cv=9&fst=1576598400000&num=1&fmt=3&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=3&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2oac61&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fonline.citi.com%2FUS%2FJRS%2Finfrastructure%2Ftarget.do%3Fnext_page%3Djfp%7CjEDelivery_DocCenterLetters&ref=https%3A%2F%2Ffm.info6.citi.com%2Fats%2Furl.aspx%3Fcr%3D617%26wu%3D1%26we%3D1%26url%3Dhttps%253A%252F%252Fwww.accountonline.com%252Fcards%252Fsvc%252FLogin.do%253FNEXT_SCREEN%253D%252FDocctr%2526siteId%253DCB%2526accountIndex%253D%2526enid%253D06895BACB5C94FD6EC024F9CBFC462EE62C6%26linkName%3DCN_ECOMM_CENTER_URL%26transId%3DI2019121500064199&tiba=Online%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&async=1&is_vtc=1&random=1429437526&resp=GooglemKTybQhCsO HTTP 302
https://www.google.de/pagead/1p-user-list/975701947/?random=1576598669431&cv=9&fst=1576598400000&num=1&fmt=3&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=3&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2oac61&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fonline.citi.com%2FUS%2FJRS%2Finfrastructure%2Ftarget.do%3Fnext_page%3Djfp%7CjEDelivery_DocCenterLetters&ref=https%3A%2F%2Ffm.info6.citi.com%2Fats%2Furl.aspx%3Fcr%3D617%26wu%3D1%26we%3D1%26url%3Dhttps%253A%252F%252Fwww.accountonline.com%252Fcards%252Fsvc%252FLogin.do%253FNEXT_SCREEN%253D%252FDocctr%2526siteId%253DCB%2526accountIndex%253D%2526enid%253D06895BACB5C94FD6EC024F9CBFC462EE62C6%26linkName%3DCN_ECOMM_CENTER_URL%26transId%3DI2019121500064199&tiba=Online%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&async=1&is_vtc=1&random=1429437526&resp=GooglemKTybQhCsO&ipr=y&ezwbk=AZuM4hDYmxEuWbEak8jW4zzJr1IExc5cqhqP25D3XHMtUSYKysfh1MO20_UBv1LdHcikJkK4y0tJUYW0j7-XMfEAV0KH

Request Chain 103

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/819500023/?random=1576598669432&cv=9&fst=1576598669432&num=1&fmt=3&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=3&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2oac61&sendb=1&ig=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fonline.citi.com%2FUS%2FJRS%2Finfrastructure%2Ftarget.do%3Fnext_page%3Djfp%7CjEDelivery_DocCenterLetters&ref=https%3A%2F%2Ffm.info6.citi.com%2Fats%2Furl.aspx%3Fcr%3D617%26wu%3D1%26we%3D1%26url%3Dhttps%253A%252F%252Fwww.accountonline.com%252Fcards%252Fsvc%252FLogin.do%253FNEXT_SCREEN%253D%252FDocctr%2526siteId%253DCB%2526accountIndex%253D%2526enid%253D06895BACB5C94FD6EC024F9CBFC462EE62C6%26linkName%3DCN_ECOMM_CENTER_URL%26transId%3DI2019121500064199&tiba=Online%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&hn=www.googleadservices.com&async=1 HTTP 302
https://www.google.com/pagead/1p-user-list/819500023/?random=1576598669432&cv=9&fst=1576598400000&num=1&fmt=3&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=3&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2oac61&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fonline.citi.com%2FUS%2FJRS%2Finfrastructure%2Ftarget.do%3Fnext_page%3Djfp%7CjEDelivery_DocCenterLetters&ref=https%3A%2F%2Ffm.info6.citi.com%2Fats%2Furl.aspx%3Fcr%3D617%26wu%3D1%26we%3D1%26url%3Dhttps%253A%252F%252Fwww.accountonline.com%252Fcards%252Fsvc%252FLogin.do%253FNEXT_SCREEN%253D%252FDocctr%2526siteId%253DCB%2526accountIndex%253D%2526enid%253D06895BACB5C94FD6EC024F9CBFC462EE62C6%26linkName%3DCN_ECOMM_CENTER_URL%26transId%3DI2019121500064199&tiba=Online%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&async=1&is_vtc=1&random=3910636596&resp=GooglemKTybQhCsO HTTP 302
https://www.google.de/pagead/1p-user-list/819500023/?random=1576598669432&cv=9&fst=1576598400000&num=1&fmt=3&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=3&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2oac61&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fonline.citi.com%2FUS%2FJRS%2Finfrastructure%2Ftarget.do%3Fnext_page%3Djfp%7CjEDelivery_DocCenterLetters&ref=https%3A%2F%2Ffm.info6.citi.com%2Fats%2Furl.aspx%3Fcr%3D617%26wu%3D1%26we%3D1%26url%3Dhttps%253A%252F%252Fwww.accountonline.com%252Fcards%252Fsvc%252FLogin.do%253FNEXT_SCREEN%253D%252FDocctr%2526siteId%253DCB%2526accountIndex%253D%2526enid%253D06895BACB5C94FD6EC024F9CBFC462EE62C6%26linkName%3DCN_ECOMM_CENTER_URL%26transId%3DI2019121500064199&tiba=Online%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&async=1&is_vtc=1&random=3910636596&resp=GooglemKTybQhCsO&ipr=y&ezwbk=AZuM4hDJSA4yXHyvLK9n9R9-fA47XfI9FEfiAOqYbYimzJ7qutJ3yBWoWkJcyOGsfqQ3fO2VFj_ImwCGkrtMpWjoF9Yb

Request Chain 104

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/763960929/?random=1576598669432&cv=9&fst=1576598669432&num=1&fmt=3&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=3&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2oac61&sendb=1&ig=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fonline.citi.com%2FUS%2FJRS%2Finfrastructure%2Ftarget.do%3Fnext_page%3Djfp%7CjEDelivery_DocCenterLetters&ref=https%3A%2F%2Ffm.info6.citi.com%2Fats%2Furl.aspx%3Fcr%3D617%26wu%3D1%26we%3D1%26url%3Dhttps%253A%252F%252Fwww.accountonline.com%252Fcards%252Fsvc%252FLogin.do%253FNEXT_SCREEN%253D%252FDocctr%2526siteId%253DCB%2526accountIndex%253D%2526enid%253D06895BACB5C94FD6EC024F9CBFC462EE62C6%26linkName%3DCN_ECOMM_CENTER_URL%26transId%3DI2019121500064199&tiba=Online%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&hn=www.googleadservices.com&async=1 HTTP 302
https://www.google.com/pagead/1p-user-list/763960929/?random=1576598669432&cv=9&fst=1576598400000&num=1&fmt=3&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=3&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2oac61&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fonline.citi.com%2FUS%2FJRS%2Finfrastructure%2Ftarget.do%3Fnext_page%3Djfp%7CjEDelivery_DocCenterLetters&ref=https%3A%2F%2Ffm.info6.citi.com%2Fats%2Furl.aspx%3Fcr%3D617%26wu%3D1%26we%3D1%26url%3Dhttps%253A%252F%252Fwww.accountonline.com%252Fcards%252Fsvc%252FLogin.do%253FNEXT_SCREEN%253D%252FDocctr%2526siteId%253DCB%2526accountIndex%253D%2526enid%253D06895BACB5C94FD6EC024F9CBFC462EE62C6%26linkName%3DCN_ECOMM_CENTER_URL%26transId%3DI2019121500064199&tiba=Online%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&async=1&is_vtc=1&random=656862344&resp=GooglemKTybQhCsO HTTP 302
https://www.google.de/pagead/1p-user-list/763960929/?random=1576598669432&cv=9&fst=1576598400000&num=1&fmt=3&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=3&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2oac61&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fonline.citi.com%2FUS%2FJRS%2Finfrastructure%2Ftarget.do%3Fnext_page%3Djfp%7CjEDelivery_DocCenterLetters&ref=https%3A%2F%2Ffm.info6.citi.com%2Fats%2Furl.aspx%3Fcr%3D617%26wu%3D1%26we%3D1%26url%3Dhttps%253A%252F%252Fwww.accountonline.com%252Fcards%252Fsvc%252FLogin.do%253FNEXT_SCREEN%253D%252FDocctr%2526siteId%253DCB%2526accountIndex%253D%2526enid%253D06895BACB5C94FD6EC024F9CBFC462EE62C6%26linkName%3DCN_ECOMM_CENTER_URL%26transId%3DI2019121500064199&tiba=Online%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&async=1&is_vtc=1&random=656862344&resp=GooglemKTybQhCsO&ipr=y&ezwbk=AZuM4hAWg6gil67cRWDIJ0f__4deLLdm6M5VSa0gv9ZDRMCeGkk5B8neVGF3F52WnVVPySyepeCsn2ZTBWGUFJqAtVFo

Request Chain 105

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/959299794/?random=1576598669432&cv=9&fst=1576598669432&num=1&fmt=3&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=3&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2oac61&sendb=1&ig=1&data=event%3Dconversion&frm=0&url=https%3A%2F%2Fonline.citi.com%2FUS%2FJRS%2Finfrastructure%2Ftarget.do%3Fnext_page%3Djfp%7CjEDelivery_DocCenterLetters&ref=https%3A%2F%2Ffm.info6.citi.com%2Fats%2Furl.aspx%3Fcr%3D617%26wu%3D1%26we%3D1%26url%3Dhttps%253A%252F%252Fwww.accountonline.com%252Fcards%252Fsvc%252FLogin.do%253FNEXT_SCREEN%253D%252FDocctr%2526siteId%253DCB%2526accountIndex%253D%2526enid%253D06895BACB5C94FD6EC024F9CBFC462EE62C6%26linkName%3DCN_ECOMM_CENTER_URL%26transId%3DI2019121500064199&tiba=Online%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&hn=www.googleadservices.com&async=1 HTTP 302
https://www.google.com/pagead/1p-user-list/959299794/?random=1576598669432&cv=9&fst=1576598400000&num=1&fmt=3&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=3&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2oac61&sendb=1&data=event%3Dconversion&frm=0&url=https%3A%2F%2Fonline.citi.com%2FUS%2FJRS%2Finfrastructure%2Ftarget.do%3Fnext_page%3Djfp%7CjEDelivery_DocCenterLetters&ref=https%3A%2F%2Ffm.info6.citi.com%2Fats%2Furl.aspx%3Fcr%3D617%26wu%3D1%26we%3D1%26url%3Dhttps%253A%252F%252Fwww.accountonline.com%252Fcards%252Fsvc%252FLogin.do%253FNEXT_SCREEN%253D%252FDocctr%2526siteId%253DCB%2526accountIndex%253D%2526enid%253D06895BACB5C94FD6EC024F9CBFC462EE62C6%26linkName%3DCN_ECOMM_CENTER_URL%26transId%3DI2019121500064199&tiba=Online%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&async=1&is_vtc=1&random=512765913&resp=GooglemKTybQhCsO HTTP 302
https://www.google.de/pagead/1p-user-list/959299794/?random=1576598669432&cv=9&fst=1576598400000&num=1&fmt=3&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=3&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2oac61&sendb=1&data=event%3Dconversion&frm=0&url=https%3A%2F%2Fonline.citi.com%2FUS%2FJRS%2Finfrastructure%2Ftarget.do%3Fnext_page%3Djfp%7CjEDelivery_DocCenterLetters&ref=https%3A%2F%2Ffm.info6.citi.com%2Fats%2Furl.aspx%3Fcr%3D617%26wu%3D1%26we%3D1%26url%3Dhttps%253A%252F%252Fwww.accountonline.com%252Fcards%252Fsvc%252FLogin.do%253FNEXT_SCREEN%253D%252FDocctr%2526siteId%253DCB%2526accountIndex%253D%2526enid%253D06895BACB5C94FD6EC024F9CBFC462EE62C6%26linkName%3DCN_ECOMM_CENTER_URL%26transId%3DI2019121500064199&tiba=Online%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&async=1&is_vtc=1&random=512765913&resp=GooglemKTybQhCsO&ipr=y&ezwbk=AZuM4hCU0AjZ_sgHQp2n6doi7ZtlpRZ2EO0UzuzD5tVIVQHe3c5y-76vy6h9yBfBV_bPjSEV-IPV492k0i3VAYoEDfoC

Request Chain 106

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/960621875/?random=1576598669432&cv=9&fst=1576598669432&num=1&fmt=3&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=3&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2oac61&sendb=1&ig=1&data=event%3Dconversion&frm=0&url=https%3A%2F%2Fonline.citi.com%2FUS%2FJRS%2Finfrastructure%2Ftarget.do%3Fnext_page%3Djfp%7CjEDelivery_DocCenterLetters&ref=https%3A%2F%2Ffm.info6.citi.com%2Fats%2Furl.aspx%3Fcr%3D617%26wu%3D1%26we%3D1%26url%3Dhttps%253A%252F%252Fwww.accountonline.com%252Fcards%252Fsvc%252FLogin.do%253FNEXT_SCREEN%253D%252FDocctr%2526siteId%253DCB%2526accountIndex%253D%2526enid%253D06895BACB5C94FD6EC024F9CBFC462EE62C6%26linkName%3DCN_ECOMM_CENTER_URL%26transId%3DI2019121500064199&tiba=Online%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&hn=www.googleadservices.com&async=1 HTTP 302
https://www.google.com/pagead/1p-user-list/960621875/?random=1576598669432&cv=9&fst=1576598400000&num=1&fmt=3&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=3&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2oac61&sendb=1&data=event%3Dconversion&frm=0&url=https%3A%2F%2Fonline.citi.com%2FUS%2FJRS%2Finfrastructure%2Ftarget.do%3Fnext_page%3Djfp%7CjEDelivery_DocCenterLetters&ref=https%3A%2F%2Ffm.info6.citi.com%2Fats%2Furl.aspx%3Fcr%3D617%26wu%3D1%26we%3D1%26url%3Dhttps%253A%252F%252Fwww.accountonline.com%252Fcards%252Fsvc%252FLogin.do%253FNEXT_SCREEN%253D%252FDocctr%2526siteId%253DCB%2526accountIndex%253D%2526enid%253D06895BACB5C94FD6EC024F9CBFC462EE62C6%26linkName%3DCN_ECOMM_CENTER_URL%26transId%3DI2019121500064199&tiba=Online%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&async=1&is_vtc=1&random=749030275&resp=GooglemKTybQhCsO HTTP 302
https://www.google.de/pagead/1p-user-list/960621875/?random=1576598669432&cv=9&fst=1576598400000&num=1&fmt=3&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=3&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2oac61&sendb=1&data=event%3Dconversion&frm=0&url=https%3A%2F%2Fonline.citi.com%2FUS%2FJRS%2Finfrastructure%2Ftarget.do%3Fnext_page%3Djfp%7CjEDelivery_DocCenterLetters&ref=https%3A%2F%2Ffm.info6.citi.com%2Fats%2Furl.aspx%3Fcr%3D617%26wu%3D1%26we%3D1%26url%3Dhttps%253A%252F%252Fwww.accountonline.com%252Fcards%252Fsvc%252FLogin.do%253FNEXT_SCREEN%253D%252FDocctr%2526siteId%253DCB%2526accountIndex%253D%2526enid%253D06895BACB5C94FD6EC024F9CBFC462EE62C6%26linkName%3DCN_ECOMM_CENTER_URL%26transId%3DI2019121500064199&tiba=Online%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&async=1&is_vtc=1&random=749030275&resp=GooglemKTybQhCsO&ipr=y&ezwbk=AZuM4hDtHuZACjyflAOvQ2b-PqCKGIKEPJdfLF3SzGGjw8jftyDrktDzckO0sIBgk2GTj5spfyFkUibCMjBJwS748Axv

Request Chain 107

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/975701947/?random=1576598669433&cv=9&fst=1576598669433&num=1&fmt=3&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=3&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2oac61&sendb=1&ig=1&data=event%3Dconversion&frm=0&url=https%3A%2F%2Fonline.citi.com%2FUS%2FJRS%2Finfrastructure%2Ftarget.do%3Fnext_page%3Djfp%7CjEDelivery_DocCenterLetters&ref=https%3A%2F%2Ffm.info6.citi.com%2Fats%2Furl.aspx%3Fcr%3D617%26wu%3D1%26we%3D1%26url%3Dhttps%253A%252F%252Fwww.accountonline.com%252Fcards%252Fsvc%252FLogin.do%253FNEXT_SCREEN%253D%252FDocctr%2526siteId%253DCB%2526accountIndex%253D%2526enid%253D06895BACB5C94FD6EC024F9CBFC462EE62C6%26linkName%3DCN_ECOMM_CENTER_URL%26transId%3DI2019121500064199&tiba=Online%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&hn=www.googleadservices.com&async=1 HTTP 302
https://www.google.com/pagead/1p-user-list/975701947/?random=1576598669433&cv=9&fst=1576598400000&num=1&fmt=3&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=3&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2oac61&sendb=1&data=event%3Dconversion&frm=0&url=https%3A%2F%2Fonline.citi.com%2FUS%2FJRS%2Finfrastructure%2Ftarget.do%3Fnext_page%3Djfp%7CjEDelivery_DocCenterLetters&ref=https%3A%2F%2Ffm.info6.citi.com%2Fats%2Furl.aspx%3Fcr%3D617%26wu%3D1%26we%3D1%26url%3Dhttps%253A%252F%252Fwww.accountonline.com%252Fcards%252Fsvc%252FLogin.do%253FNEXT_SCREEN%253D%252FDocctr%2526siteId%253DCB%2526accountIndex%253D%2526enid%253D06895BACB5C94FD6EC024F9CBFC462EE62C6%26linkName%3DCN_ECOMM_CENTER_URL%26transId%3DI2019121500064199&tiba=Online%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&async=1&is_vtc=1&random=3196431062&resp=GooglemKTybQhCsO HTTP 302
https://www.google.de/pagead/1p-user-list/975701947/?random=1576598669433&cv=9&fst=1576598400000&num=1&fmt=3&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=3&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2oac61&sendb=1&data=event%3Dconversion&frm=0&url=https%3A%2F%2Fonline.citi.com%2FUS%2FJRS%2Finfrastructure%2Ftarget.do%3Fnext_page%3Djfp%7CjEDelivery_DocCenterLetters&ref=https%3A%2F%2Ffm.info6.citi.com%2Fats%2Furl.aspx%3Fcr%3D617%26wu%3D1%26we%3D1%26url%3Dhttps%253A%252F%252Fwww.accountonline.com%252Fcards%252Fsvc%252FLogin.do%253FNEXT_SCREEN%253D%252FDocctr%2526siteId%253DCB%2526accountIndex%253D%2526enid%253D06895BACB5C94FD6EC024F9CBFC462EE62C6%26linkName%3DCN_ECOMM_CENTER_URL%26transId%3DI2019121500064199&tiba=Online%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&async=1&is_vtc=1&random=3196431062&resp=GooglemKTybQhCsO&ipr=y&ezwbk=AZuM4hDCn9KrNCFRlocEQ60wI6Coa6WN-6UIXMzZr5KQRURg-V9j1jiyMfdc1zOfcPLCqYSRLUk7RhHbjQuYnYijyq-9

Request Chain 108

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/770961656/?random=1576598669433&cv=9&fst=1576598669433&num=1&fmt=3&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=3&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2oac61&sendb=1&ig=1&data=event%3Dconversion&frm=0&url=https%3A%2F%2Fonline.citi.com%2FUS%2FJRS%2Finfrastructure%2Ftarget.do%3Fnext_page%3Djfp%7CjEDelivery_DocCenterLetters&ref=https%3A%2F%2Ffm.info6.citi.com%2Fats%2Furl.aspx%3Fcr%3D617%26wu%3D1%26we%3D1%26url%3Dhttps%253A%252F%252Fwww.accountonline.com%252Fcards%252Fsvc%252FLogin.do%253FNEXT_SCREEN%253D%252FDocctr%2526siteId%253DCB%2526accountIndex%253D%2526enid%253D06895BACB5C94FD6EC024F9CBFC462EE62C6%26linkName%3DCN_ECOMM_CENTER_URL%26transId%3DI2019121500064199&tiba=Online%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&hn=www.googleadservices.com&async=1 HTTP 302
https://www.google.com/pagead/1p-user-list/770961656/?random=1576598669433&cv=9&fst=1576598400000&num=1&fmt=3&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=3&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2oac61&sendb=1&data=event%3Dconversion&frm=0&url=https%3A%2F%2Fonline.citi.com%2FUS%2FJRS%2Finfrastructure%2Ftarget.do%3Fnext_page%3Djfp%7CjEDelivery_DocCenterLetters&ref=https%3A%2F%2Ffm.info6.citi.com%2Fats%2Furl.aspx%3Fcr%3D617%26wu%3D1%26we%3D1%26url%3Dhttps%253A%252F%252Fwww.accountonline.com%252Fcards%252Fsvc%252FLogin.do%253FNEXT_SCREEN%253D%252FDocctr%2526siteId%253DCB%2526accountIndex%253D%2526enid%253D06895BACB5C94FD6EC024F9CBFC462EE62C6%26linkName%3DCN_ECOMM_CENTER_URL%26transId%3DI2019121500064199&tiba=Online%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&async=1&is_vtc=1&random=1052276251&resp=GooglemKTybQhCsO HTTP 302
https://www.google.de/pagead/1p-user-list/770961656/?random=1576598669433&cv=9&fst=1576598400000&num=1&fmt=3&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=3&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2oac61&sendb=1&data=event%3Dconversion&frm=0&url=https%3A%2F%2Fonline.citi.com%2FUS%2FJRS%2Finfrastructure%2Ftarget.do%3Fnext_page%3Djfp%7CjEDelivery_DocCenterLetters&ref=https%3A%2F%2Ffm.info6.citi.com%2Fats%2Furl.aspx%3Fcr%3D617%26wu%3D1%26we%3D1%26url%3Dhttps%253A%252F%252Fwww.accountonline.com%252Fcards%252Fsvc%252FLogin.do%253FNEXT_SCREEN%253D%252FDocctr%2526siteId%253DCB%2526accountIndex%253D%2526enid%253D06895BACB5C94FD6EC024F9CBFC462EE62C6%26linkName%3DCN_ECOMM_CENTER_URL%26transId%3DI2019121500064199&tiba=Online%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&async=1&is_vtc=1&random=1052276251&resp=GooglemKTybQhCsO&ipr=y&ezwbk=AZuM4hAkxkQY9aJnwzCd8Np3bbWCHMYqM-L0RZpoTzGU-hmk5HHJYlVTqGTjMYu7bz__UWAz1NVDfV1NqbPDx6OITXIV

Request Chain 109

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/819500023/?random=1576598669433&cv=9&fst=1576598669433&num=1&fmt=3&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=3&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2oac61&sendb=1&ig=1&data=event%3Dconversion&frm=0&url=https%3A%2F%2Fonline.citi.com%2FUS%2FJRS%2Finfrastructure%2Ftarget.do%3Fnext_page%3Djfp%7CjEDelivery_DocCenterLetters&ref=https%3A%2F%2Ffm.info6.citi.com%2Fats%2Furl.aspx%3Fcr%3D617%26wu%3D1%26we%3D1%26url%3Dhttps%253A%252F%252Fwww.accountonline.com%252Fcards%252Fsvc%252FLogin.do%253FNEXT_SCREEN%253D%252FDocctr%2526siteId%253DCB%2526accountIndex%253D%2526enid%253D06895BACB5C94FD6EC024F9CBFC462EE62C6%26linkName%3DCN_ECOMM_CENTER_URL%26transId%3DI2019121500064199&tiba=Online%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&hn=www.googleadservices.com&async=1 HTTP 302
https://www.google.com/pagead/1p-user-list/819500023/?random=1576598669433&cv=9&fst=1576598400000&num=1&fmt=3&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=3&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2oac61&sendb=1&data=event%3Dconversion&frm=0&url=https%3A%2F%2Fonline.citi.com%2FUS%2FJRS%2Finfrastructure%2Ftarget.do%3Fnext_page%3Djfp%7CjEDelivery_DocCenterLetters&ref=https%3A%2F%2Ffm.info6.citi.com%2Fats%2Furl.aspx%3Fcr%3D617%26wu%3D1%26we%3D1%26url%3Dhttps%253A%252F%252Fwww.accountonline.com%252Fcards%252Fsvc%252FLogin.do%253FNEXT_SCREEN%253D%252FDocctr%2526siteId%253DCB%2526accountIndex%253D%2526enid%253D06895BACB5C94FD6EC024F9CBFC462EE62C6%26linkName%3DCN_ECOMM_CENTER_URL%26transId%3DI2019121500064199&tiba=Online%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&async=1&is_vtc=1&random=3094857313&resp=GooglemKTybQhCsO HTTP 302
https://www.google.de/pagead/1p-user-list/819500023/?random=1576598669433&cv=9&fst=1576598400000&num=1&fmt=3&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=3&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2oac61&sendb=1&data=event%3Dconversion&frm=0&url=https%3A%2F%2Fonline.citi.com%2FUS%2FJRS%2Finfrastructure%2Ftarget.do%3Fnext_page%3Djfp%7CjEDelivery_DocCenterLetters&ref=https%3A%2F%2Ffm.info6.citi.com%2Fats%2Furl.aspx%3Fcr%3D617%26wu%3D1%26we%3D1%26url%3Dhttps%253A%252F%252Fwww.accountonline.com%252Fcards%252Fsvc%252FLogin.do%253FNEXT_SCREEN%253D%252FDocctr%2526siteId%253DCB%2526accountIndex%253D%2526enid%253D06895BACB5C94FD6EC024F9CBFC462EE62C6%26linkName%3DCN_ECOMM_CENTER_URL%26transId%3DI2019121500064199&tiba=Online%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&async=1&is_vtc=1&random=3094857313&resp=GooglemKTybQhCsO&ipr=y&ezwbk=AZuM4hBbcWUMjQDsSZM9QtjHFz-RITh6AeFkkdE6cNNy8KX84oOz0BTWQdn4B1hpzmDTvyCQT-xFDUKnquBZxsHmTgdT

Request Chain 130

https://p.rfihub.com/uidm?_o=17169175&_u=e1390b51-81ee-4217-91ac-54c805fa3786&_sm=:R22534S@9CHG4UC24944S@9CHG4UC2232L2@9CHG4US2233L2@9CHG4US28259S1@9CHG4US28261S1@9CHG4US28264S1@9CHG4US28266S1@9CHG4US28227S1@9CHG4US1053T1@9CHG4US49119S@9CHG4UC49119S1@9CHG4US38831S1@9CHG4US&redirect=32 HTTP 302
https://www.citi.com/credit-cards/rfuidmatch/citi.action?XP_UID=SY-00GfVAAR0gGLU=479

155 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Cookie set url.aspx Show response
fm.info6.citi.com/ats/ 8 KB
4 KB 840ms
342ms Document
text/html 173.213.4.17
CHEETAHMAIL

General

Check archive.org

Show headers Download Go to

Full URL: https://fm.info6.citi.com/ats/url.aspx?cr=617&wu=1&we=1&url=https%3A%2F%2Fwww.accountonline.com%2Fcards%2Fsvc%2FLogin.do%3FNEXT_SCREEN%3D%2FDocctr%26siteId%3DCB%26accountIndex%3D%26enid%3D06895BACB5C94FD6EC024F9CBFC462EE62C6&linkName=CN_ECOMM_CENTER_URL&transId=I2019121500064199
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 173.213.4.17 , United States, ASN53316 (ASN-CHEETA-MAIL - CHEETAHMAIL, US),
Reverse DNS
Software: / ASP.NET
Resource Hash: c168a0461a7b4b6433efacdbde53ebb7f4e6a23afe0d2e056afe7fb8acf55c3a

Request headers

Host: fm.info6.citi.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-User: ?1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Sec-Fetch-Site: none
Sec-Fetch-Mode: navigate
Accept-Encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-User: ?1

Response headers

Cache-Control: no-cache, no-store, must-revalidate
Pragma: no-cache
Content-Type: text/html; charset=utf-8
Expires: 0
X-Powered-By: ASP.NET
Date: Tue, 17 Dec 2019 16:04:23 GMT
Content-Length: 3630
Set-Cookie: BIGipServercnv_ats_ssl_pool=1162287114.47873.0000; path=/; Httponly; Secure
Vary: Accept-Encoding
Content-Encoding: gzip
Connection: Keep-Alive

GET
H2 200 jquery.min.js Show response
ajax.googleapis.com/ajax/libs/jquery/2.1.3/ 82 KB
29 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:819::200a
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://ajax.googleapis.com/ajax/libs/jquery/2.1.3/jquery.min.js

Requested by

Host: fm.info6.citi.com
URL: https://fm.info6.citi.com/ats/url.aspx?cr=617&wu=1&we=1&url=https%3A%2F%2Fwww.accountonline.com%2Fcards%2Fsvc%2FLogin.do%3FNEXT_SCREEN%3D%2FDocctr%26siteId%3DCB%26accountIndex%3D%26enid%3D06895BACB5C94FD6EC024F9CBFC462EE62C6&linkName=CN_ECOMM_CENTER_URL&transId=I2019121500064199

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:819::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

sffe /

Resource Hash

8af93bd675e1cfd9ecc850e862819fdac6e3ad1f5d761f970e409c7d9c63bdc3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fm.info6.citi.com/ats/url.aspx?cr=617&wu=1&we=1&url=https%3A%2F%2Fwww.accountonline.com%2Fcards%2Fsvc%2FLogin.do%3FNEXT_SCREEN%3D%2FDocctr%26siteId%3DCB%26accountIndex%3D%26enid%3D06895BACB5C94FD6EC024F9CBFC462EE62C6&linkName=CN_ECOMM_CENTER_URL&transId=I2019121500064199
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Wed, 20 Nov 2019 08:10:04 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 2361260
status: 200
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 29707
x-xss-protection: 0
last-modified: Tue, 20 Dec 2016 18:17:03 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000, stale-while-revalidate=2592000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 19 Nov 2020 08:10:04 GMT

GET
H/1.1 200
OK open.aspx
l.info6.citi.com/rts/ 581 B
1 KB 576ms
92ms Image
image/gif 173.213.4.17
CHEETAHMAIL

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://l.info6.citi.com/rts/open.aspx?tp=i-H8B-9x-M-27aTvF-1q-1wc30V-1c-G-1lCMj0-1Nqd3
Requested by: Host: fm.info6.citi.com
URL: https://fm.info6.citi.com/ats/url.aspx?cr=617&wu=1&we=1&url=https%3A%2F%2Fwww.accountonline.com%2Fcards%2Fsvc%2FLogin.do%3FNEXT_SCREEN%3D%2FDocctr%26siteId%3DCB%26accountIndex%3D%26enid%3D06895BACB5C94FD6EC024F9CBFC462EE62C6&linkName=CN_ECOMM_CENTER_URL&transId=I2019121500064199
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 173.213.4.17 , United States, ASN53316 (ASN-CHEETA-MAIL - CHEETAHMAIL, US),
Reverse DNS
Software: Microsoft-IIS/8.0 / ASP.NET
Resource Hash: 0c40d0fb48b8cb2b2eda64813daa9d9d6c38e8b9c2f01b00d02b93285ede4eb9

Request headers

Referer: https://fm.info6.citi.com/ats/url.aspx?cr=617&wu=1&we=1&url=https%3A%2F%2Fwww.accountonline.com%2Fcards%2Fsvc%2FLogin.do%3FNEXT_SCREEN%3D%2FDocctr%26siteId%3DCB%26accountIndex%3D%26enid%3D06895BACB5C94FD6EC024F9CBFC462EE62C6&linkName=CN_ECOMM_CENTER_URL&transId=I2019121500064199
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 17 Dec 2019 16:04:24 GMT
Server: Microsoft-IIS/8.0
X-Powered-By: ASP.NET
Transfer-Encoding: chunked
Content-Type: image/gif
Cache-Control: no-cache, max-age=0
Expires: 0

GET
H/1.1 200
OK conversen-SDK.js Show response
sts.eccmp.com/sts/scripts/ 15 KB
15 KB 543ms
163ms Script
application/javascript 63.148.46.76
CHEETAHMAIL

General

Check archive.org

Show headers Download Go to

Full URL: https://sts.eccmp.com/sts/scripts/conversen-SDK.js
Requested by: Host: fm.info6.citi.com
URL: https://fm.info6.citi.com/ats/url.aspx?cr=617&wu=1&we=1&url=https%3A%2F%2Fwww.accountonline.com%2Fcards%2Fsvc%2FLogin.do%3FNEXT_SCREEN%3D%2FDocctr%26siteId%3DCB%26accountIndex%3D%26enid%3D06895BACB5C94FD6EC024F9CBFC462EE62C6&linkName=CN_ECOMM_CENTER_URL&transId=I2019121500064199
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 63.148.46.76 , United States, ASN53316 (ASN-CHEETA-MAIL - CHEETAHMAIL, US),
Reverse DNS: xts.eccmp.com
Software: Microsoft-IIS/8.0 / ASP.NET
Resource Hash: 13e2dff1daeca230d4baec00e9e8766b54d3e7f408e788f5e7c0fed85220d275

Request headers

Referer: https://fm.info6.citi.com/ats/url.aspx?cr=617&wu=1&we=1&url=https%3A%2F%2Fwww.accountonline.com%2Fcards%2Fsvc%2FLogin.do%3FNEXT_SCREEN%3D%2FDocctr%26siteId%3DCB%26accountIndex%3D%26enid%3D06895BACB5C94FD6EC024F9CBFC462EE62C6&linkName=CN_ECOMM_CENTER_URL&transId=I2019121500064199
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Tue, 17 Dec 2019 16:04:24 GMT
ETag: "0127773ac8ed51:0"
Last-Modified: Tue, 29 Oct 2019 22:59:00 GMT
Server: Microsoft-IIS/8.0
Age: 207
X-Powered-By: ASP.NET
Content-Type: application/javascript
Connection: Keep-Alive
Accept-Ranges: bytes
Content-Length: 15112

GET
H/1.1 200
OK 617 Show response
sts.eccmp.com/wts/WebEvent/GetCookieExpiry/ 35 B
391 B 469ms
93ms XHR
text/xml 63.148.46.76
CHEETAHMAIL

General

Check archive.org

Show headers Download Go to

Full URL: https://sts.eccmp.com/wts/WebEvent/GetCookieExpiry/617
Requested by: Host: sts.eccmp.com
URL: https://sts.eccmp.com/sts/scripts/conversen-SDK.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 63.148.46.76 , United States, ASN53316 (ASN-CHEETA-MAIL - CHEETAHMAIL, US),
Reverse DNS: xts.eccmp.com
Software: Microsoft-IIS/8.0 / ASP.NET
Resource Hash: 61339a21fa71d17d0dfebceba08dc76ce605e73f65a88438397483478d953aae

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: https://fm.info6.citi.com/ats/url.aspx?cr=617&wu=1&we=1&url=https%3A%2F%2Fwww.accountonline.com%2Fcards%2Fsvc%2FLogin.do%3FNEXT_SCREEN%3D%2FDocctr%26siteId%3DCB%26accountIndex%3D%26enid%3D06895BACB5C94FD6EC024F9CBFC462EE62C6&linkName=CN_ECOMM_CENTER_URL&transId=I2019121500064199
Origin: https://fm.info6.citi.com

Response headers

Date: Tue, 17 Dec 2019 16:04:24 GMT
X-AspNetMvc-Version: 3.0
Server: Microsoft-IIS/8.0
X-Powered-By: ASP.NET
Content-Type: text/xml; charset=utf-8
Access-Control-Allow-Origin: *
Cache-Control: private
Connection: keep-alive
Content-Length: 35

GET
H/1.1 200
OK image.gif
sts.eccmp.com/wts/WebEvent/ 807 B
1 KB 99ms
98ms Image
image/gif 63.148.46.76
CHEETAHMAIL

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sts.eccmp.com/wts/WebEvent/image.gif?isSplit=false&guid=0aa2f869-15a8-e856-2c89-8c8794a083a1&segmentNumber=1&pm[linkName]=CN_ECOMM_CENTER_URL&pm[transId]=I2019121500064199&rp[cr]=617&rp[et]=100&rp[ap]=&rp[we]=1
Requested by: Host: fm.info6.citi.com
URL: https://fm.info6.citi.com/ats/url.aspx?cr=617&wu=1&we=1&url=https%3A%2F%2Fwww.accountonline.com%2Fcards%2Fsvc%2FLogin.do%3FNEXT_SCREEN%3D%2FDocctr%26siteId%3DCB%26accountIndex%3D%26enid%3D06895BACB5C94FD6EC024F9CBFC462EE62C6&linkName=CN_ECOMM_CENTER_URL&transId=I2019121500064199
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 63.148.46.76 , United States, ASN53316 (ASN-CHEETA-MAIL - CHEETAHMAIL, US),
Reverse DNS: xts.eccmp.com
Software: Microsoft-IIS/8.0 / ASP.NET
Resource Hash: 9c6d485ae01a594ef22b3c44e1eca5314259061faacdcdfc51569aba58a4fc2b

Request headers

Referer: https://fm.info6.citi.com/ats/url.aspx?cr=617&wu=1&we=1&url=https%3A%2F%2Fwww.accountonline.com%2Fcards%2Fsvc%2FLogin.do%3FNEXT_SCREEN%3D%2FDocctr%26siteId%3DCB%26accountIndex%3D%26enid%3D06895BACB5C94FD6EC024F9CBFC462EE62C6&linkName=CN_ECOMM_CENTER_URL&transId=I2019121500064199
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Tue, 17 Dec 2019 16:04:24 GMT
X-AspNetMvc-Version: 3.0
Server: Microsoft-IIS/8.0
X-Powered-By: ASP.NET
Content-Type: image/gif
Cache-Control: private
Connection: keep-alive
Content-Length: 807

GET
H2

200

Primary Request target.do Show response
online.citi.com/US/JRS/infrastructure/
Redirect Chain

https://www.accountonline.com/cards/svc/Login.do?NEXT_SCREEN=/Docctr&siteId=CB&accountIndex=
https://www.accountonline.citibank.com/cards/svc/Login.do?NEXT_SCREEN=/Docctr&siteId=CB&accountIndex=
https://accountonline.citi.com/cards/svc/Login.do?NEXT_SCREEN=/Docctr&siteId=CB&accountIndex=
https://accountonline.citi.com/cards/svc/LoginGet.do?NEXT_SCREEN=/Docctr&siteId=CB&accountIndex=
https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jEDelivery_DocCenterLetters

308 KB
108 KB

487ms
417ms

Document
text/html

104.111.239.33
Akamai Technologies

General

Check archive.org

Show headers Download Go to

Full URL

https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jEDelivery_DocCenterLetters

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.111.239.33 , Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),

Reverse DNS

a104-111-239-33.deploy.static.akamaitechnologies.com

Software

Resource Hash

462d648e4436dad29b20ca8243faa99762069924d0d3b86a60213f8274a6e676

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

:method: GET
:authority: online.citi.com
:scheme: https
:path: /US/JRS/infrastructure/target.do?next_page=jfp|jEDelivery_DocCenterLetters
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
sec-fetch-site: cross-site
sec-fetch-mode: navigate
referer: https://fm.info6.citi.com/ats/url.aspx?cr=617&wu=1&we=1&url=https%3A%2F%2Fwww.accountonline.com%2Fcards%2Fsvc%2FLogin.do%3FNEXT_SCREEN%3D%2FDocctr%26siteId%3DCB%26accountIndex%3D%26enid%3D06895BACB5C94FD6EC024F9CBFC462EE62C6&linkName=CN_ECOMM_CENTER_URL&transId=I2019121500064199
accept-encoding: gzip, deflate, br
cookie: xyz_cr_617_et_100=cr=617&et=100&ap=; AKMTLTSID=494EAE64222CE5E8103B223BB5542315; ak_bmsc=DB5C439E6D89D4180D939708568EB79B021484524C7400008BFCF85D7CA2C776~plOG0ApshZqrOyqWoSEPqoXeB5hJS27HKTSF8ROoES7KOGeSvZmE6Wl2gDaa9ZowzGTKoIEOAGcwVBVYrrVZM403a4lzI4qPHPDD/GzMh2hmxvSpMto5TfARkO9PcXCUAm0yPHo8ce7Mgx6rn0JgtPyBiwmtDBY9prDqrlTEYjQ7lCmKztzLJB1HIaSR81kShA+nnPhKMwHmU+yc5n96Ea7ZU2e94hDbEMU8PUQxJ/kGk=
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: https://fm.info6.citi.com/ats/url.aspx?cr=617&wu=1&we=1&url=https%3A%2F%2Fwww.accountonline.com%2Fcards%2Fsvc%2FLogin.do%3FNEXT_SCREEN%3D%2FDocctr%26siteId%3DCB%26accountIndex%3D%26enid%3D06895BACB5C94FD6EC024F9CBFC462EE62C6&linkName=CN_ECOMM_CENTER_URL&transId=I2019121500064199

Response headers

status: 200
content-type: text/html; charset=ISO-8859-1
x-ion-hop: Prod
expires: Thu, 01 Jan 1970 00:00:00 GMT
cache-control: no-cache, must-revalidate, proxy-revalidate, no-store
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
pragma: no-cache
x-akamai-citisite: GTDC
strict-transport-security: max-age=300
content-language: en-US
x-debug-tier2-parent: 8ac4f6c-64.86.94.71-1576598667-AUTH1-SHPIP65.158.180.199-TCIP193.9.113.117
jid: 191217110427574684098920 191217110427574684098920
x-ua-compatible: IE=edge IE=edge
x-debug-tier2: 12dc847a-65.158.180.199-1576598667-AUTH1-SHPIP4.16.69.11-TCIP193.9.113.117
content-encoding: gzip
date: Tue, 17 Dec 2019 16:04:27 GMT
vary: Accept-Encoding
set-cookie: JSESSIONID=000094UYJiA0zx59POQzqng7dRn:gt07p-srv3; Path=/; Secure TLTSID=ad405dcda4e12aabd8d1ab8d1ac087e1e4af67e81eaf03cb9f5829d68bab0f4b; Path=/; Domain=citi.com; Secure CUUID=f4b6c019-8c4f-4898-a345-2d1e56412b59; Expires=Wed, 16-Dec-20 16:04:27 GMT; Path=/; Domain=.citi.com; Secure CUUID=e1390b51-81ee-4217-91ac-54c805fa3786; Expires=Wed, 16-Dec-20 16:04:27 GMT; Path=/; Domain=.citi.com; Secure CITI_SITE=gtdc; path=/; domain=.citi.com; secure; HttpOnly CITI_SITE=gtdc; path=/; domain=.citi.com; secure; HttpOnly
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

Redirect headers

Server: AkamaiGHost
Content-Length: 0
Location: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jEDelivery_DocCenterLetters
Date: Tue, 17 Dec 2019 16:04:27 GMT
Connection: keep-alive
X-Robots-Tag: noindex,nofollow

GET
H2 200 tagging.js Show response
online.citi.com/CBOL/taggingTransformation/ 48 KB
10 KB 120ms
117ms Script
application/x-javascript 104.111.239.33
Akamai Technologies

General

Check archive.org

Show headers Download Go to

Full URL

https://online.citi.com/CBOL/taggingTransformation/tagging.js

Requested by

Host: online.citi.com
URL: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jEDelivery_DocCenterLetters

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.111.239.33 , Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),

Reverse DNS

a104-111-239-33.deploy.static.akamaitechnologies.com

Software

Resource Hash

682d047ea5deb2980824cee46de07619f600bc8f3193dc535222be3fb0217b8e

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

Referer: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jEDelivery_DocCenterLetters
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security: max-age=300
content-encoding: gzip
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
last-modified: Tue, 05 Nov 2019 00:12:11 GMT
x-akamai-citisite: GTDC
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
date: Tue, 17 Dec 2019 16:04:27 GMT
vary: Accept-Encoding
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
status: 200
cache-control: max-age=21600
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
content-type: application/x-javascript
content-length: 9593
expires: Tue, 17 Dec 2019 22:04:27 GMT

GET
H2 200 main.css
online.citi.com/GFC/branding/responsivebranding/css/ 45 KB
7 KB 119ms
117ms Stylesheet
text/css 104.111.239.33
Akamai Technologies

General

Check archive.org

Show headers Download Go to

Full URL

https://online.citi.com/GFC/branding/responsivebranding/css/main.css

Requested by

Host: online.citi.com
URL: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jEDelivery_DocCenterLetters

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.111.239.33 , Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),

Reverse DNS

a104-111-239-33.deploy.static.akamaitechnologies.com

Software

Resource Hash

429d8af3190c76d5fcb9b1cad2aa6eb555684921323da905d62017fbdbf557c6

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

Referer: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jEDelivery_DocCenterLetters
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security: max-age=300
content-encoding: gzip
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
last-modified: Wed, 26 Jun 2019 07:44:47 GMT
x-akamai-citisite: GTDC
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
date: Tue, 17 Dec 2019 16:04:27 GMT
vary: Accept-Encoding
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
status: 200
cache-control: max-age=21600
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
content-type: text/css
content-length: 7108
expires: Tue, 17 Dec 2019 22:04:27 GMT

GET
H2 200 ddl.min.css
online.citi.com/CBOL/common/ui/ddl/theme/latest/styles/ 624 KB
69 KB 186ms
183ms Stylesheet
text/css 104.111.239.33
Akamai Technologies

General

Check archive.org

Show headers Download Go to

Full URL

https://online.citi.com/CBOL/common/ui/ddl/theme/latest/styles/ddl.min.css

Requested by

Host: online.citi.com
URL: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jEDelivery_DocCenterLetters

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.111.239.33 , Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),

Reverse DNS

a104-111-239-33.deploy.static.akamaitechnologies.com

Software

Resource Hash

6177c6163dc1ad67fb596a94ef3d18a277bfd437dbb3c1a928cd6caacefeff2e

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

Referer: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jEDelivery_DocCenterLetters
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security: max-age=300
content-encoding: gzip
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
last-modified: Tue, 12 Sep 2017 17:12:06 GMT
x-akamai-citisite: GTDC
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
date: Tue, 17 Dec 2019 16:04:27 GMT
vary: Accept-Encoding
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
status: 200
cache-control: max-age=21600
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
content-type: text/css
content-length: 69738
expires: Tue, 17 Dec 2019 22:04:27 GMT

GET
H2 200 jfpm.autocomplete.off.js Show response
online.citi.com/JFP/js/modules/ 1 KB
834 B 309ms
307ms Script
application/x-javascript 104.111.239.33
Akamai Technologies

General

Check archive.org

Show headers Download Go to

Full URL

https://online.citi.com/JFP/js/modules/jfpm.autocomplete.off.js

Requested by

Host: online.citi.com
URL: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jEDelivery_DocCenterLetters

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.111.239.33 , Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),

Reverse DNS

a104-111-239-33.deploy.static.akamaitechnologies.com

Software

Resource Hash

9dad502247a8488c21ef5beb32aed1a78b17b748711bec817c472911f76b4ead

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

Referer: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jEDelivery_DocCenterLetters
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security: max-age=300
content-encoding: gzip
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
last-modified: Tue, 12 Sep 2017 17:12:06 GMT
x-akamai-citisite: GTDC
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
date: Tue, 17 Dec 2019 16:04:27 GMT
vary: Accept-Encoding
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
status: 200
cache-control: max-age=21600
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
content-type: application/x-javascript
content-length: 344
expires: Tue, 17 Dec 2019 22:04:27 GMT

GET
H2 200 main_branding.css
online.citi.com/GFC/branding/responsivebranding/css/ 271 KB
43 KB 229ms
227ms Stylesheet
text/css 104.111.239.33
Akamai Technologies

General

Check archive.org

Show headers Download Go to

Full URL

https://online.citi.com/GFC/branding/responsivebranding/css/main_branding.css

Requested by

Host: online.citi.com
URL: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jEDelivery_DocCenterLetters

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.111.239.33 , Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),

Reverse DNS

a104-111-239-33.deploy.static.akamaitechnologies.com

Software

Resource Hash

59cff644f53180594b862041f52c4e5e7018e4d3307ddabcd9cec541f53addfb

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

Referer: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jEDelivery_DocCenterLetters
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security: max-age=300
content-encoding: gzip
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
last-modified: Fri, 22 Nov 2019 20:35:20 GMT
x-akamai-citisite: GTDC
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
date: Tue, 17 Dec 2019 16:04:27 GMT
vary: Accept-Encoding
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
status: 200
cache-control: max-age=21600
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
content-type: text/css
content-length: 43503
expires: Tue, 17 Dec 2019 22:04:27 GMT

GET
H2 200 vendor.js Show response
online.citi.com/CBOL/common/ui/ddl/theme/latest/scripts/ 204 KB
64 KB 232ms
230ms Script
application/x-javascript 104.111.239.33
Akamai Technologies

General

Check archive.org

Show headers Download Go to

Full URL

https://online.citi.com/CBOL/common/ui/ddl/theme/latest/scripts/vendor.js

Requested by

Host: online.citi.com
URL: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jEDelivery_DocCenterLetters

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.111.239.33 , Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),

Reverse DNS

a104-111-239-33.deploy.static.akamaitechnologies.com

Software

Resource Hash

03c736ca1c90e26743865ed80c9766f84ca237b0dc572fab630737aaef70d171

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

Referer: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jEDelivery_DocCenterLetters
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security: max-age=300
content-encoding: gzip
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
last-modified: Tue, 12 Sep 2017 17:22:45 GMT
x-akamai-citisite: GTDC
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
date: Tue, 17 Dec 2019 16:04:27 GMT
vary: Accept-Encoding
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
status: 200
cache-control: max-age=21600
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
content-type: application/x-javascript
content-length: 64910
expires: Tue, 17 Dec 2019 22:04:27 GMT

GET
H2 200 Bootstrap.js Show response
nexus.ensighten.com/citi/na_prod/ 218 KB
65 KB 117ms
52ms Script
application/javascript 18.195.42.228
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Requested by: Host: online.citi.com
URL: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jEDelivery_DocCenterLetters
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 18.195.42.228 Frankfurt am Main, Germany, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: ec2-18-195-42-228.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: a02f30b62ee7f38208f15141e9539310c035396b03320970bb36782d08d78b37

Request headers

Referer: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jEDelivery_DocCenterLetters
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Tue, 17 Dec 2019 16:04:27 GMT
content-encoding: gzip
last-modified: Tue, 10 Dec 2019 18:01:14 GMT
server: nginx
etag: W/"5defdd6a-368f5"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
status: 200
cache-control: max-age=300

GET
H2 200 homePage.min.css
online.citi.com/loginpage/styles/ 24 KB
5 KB 269ms
268ms Stylesheet
text/css 104.111.239.33
Akamai Technologies

General

Check archive.org

Show headers Download Go to

Full URL

https://online.citi.com/loginpage/styles/homePage.min.css

Requested by

Host: online.citi.com
URL: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jEDelivery_DocCenterLetters

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.111.239.33 , Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),

Reverse DNS

a104-111-239-33.deploy.static.akamaitechnologies.com

Software

Resource Hash

ed48ae9c1a324d49404d9fb4c508b880ca97a65f8fd21d352e241d1e4dfc50e2

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

Referer: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jEDelivery_DocCenterLetters
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security: max-age=300
content-encoding: gzip
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
last-modified: Tue, 12 Jun 2018 05:31:28 GMT
x-akamai-citisite: GTDC
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
date: Tue, 17 Dec 2019 16:04:27 GMT
vary: Accept-Encoding
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
status: 200
cache-control: max-age=21600
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
content-type: text/css
content-length: 5032
expires: Tue, 17 Dec 2019 22:04:27 GMT

GET
H2 200 jquery.tmpl.js Show response
online.citi.com/JFP/js/jquery/plugins/ 6 KB
3 KB 270ms
269ms Script
application/x-javascript 104.111.239.33
Akamai Technologies

General

Check archive.org

Show headers Download Go to

Full URL

https://online.citi.com/JFP/js/jquery/plugins/jquery.tmpl.js

Requested by

Host: online.citi.com
URL: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jEDelivery_DocCenterLetters

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.111.239.33 , Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),

Reverse DNS

a104-111-239-33.deploy.static.akamaitechnologies.com

Software

Resource Hash

629b48196dcc270143a42ce57535b251c655617f8d510277d4a05306c426fd38

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

Referer: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jEDelivery_DocCenterLetters
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security: max-age=300
content-encoding: gzip
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
last-modified: Tue, 12 Sep 2017 16:59:12 GMT
x-akamai-citisite: GTDC
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
date: Tue, 17 Dec 2019 16:04:27 GMT
vary: Accept-Encoding
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
status: 200
cache-control: max-age=21600
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
content-type: application/x-javascript
content-length: 2905
expires: Tue, 17 Dec 2019 22:04:27 GMT

GET
H2 200 fp.min.js Show response
online.citi.com/JSO/js/ 15 KB
5 KB 338ms
337ms Script
application/x-javascript 104.111.239.33
Akamai Technologies

General

Check archive.org

Show headers Download Go to

Full URL

https://online.citi.com/JSO/js/fp.min.js

Requested by

Host: online.citi.com
URL: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jEDelivery_DocCenterLetters

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.111.239.33 , Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),

Reverse DNS

a104-111-239-33.deploy.static.akamaitechnologies.com

Software

Resource Hash

c3c994c3fe9bd4e055f6d0eb42067ecd6bdd3247e136bc22835b9882cfe77c61

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

Referer: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jEDelivery_DocCenterLetters
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security: max-age=300
content-encoding: gzip
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
last-modified: Tue, 12 Sep 2017 17:16:58 GMT
x-akamai-citisite: GTDC
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
date: Tue, 17 Dec 2019 16:04:27 GMT
vary: Accept-Encoding
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
status: 200
cache-control: max-age=21600
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
content-type: application/x-javascript
content-length: 4322
expires: Tue, 17 Dec 2019 22:04:27 GMT

GET
H2 204 463166.gif
di.rlcdn.com/ 0
40 B 144ms
142ms Image
text/plain 35.190.72.21
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://di.rlcdn.com/463166.gif?partner_uid=e1390b51-81ee-4217-91ac-54c805fa3786
Requested by: Host: online.citi.com
URL: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jEDelivery_DocCenterLetters
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.190.72.21 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS: 21.72.190.35.bc.googleusercontent.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jEDelivery_DocCenterLetters
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

status: 204
date: Tue, 17 Dec 2019 16:04:28 GMT
via: 1.1 google
alt-svc: clear

GET
H2 200 bcsid.js Show response
online.citi.com/passivebio/ 947 B
917 B 40ms
39ms Script
application/x-javascript 104.111.239.33
Akamai Technologies

General

Check archive.org

Show headers Download Go to

Full URL

https://online.citi.com/passivebio/bcsid.js

Requested by

Host: online.citi.com
URL: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jEDelivery_DocCenterLetters

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.111.239.33 , Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),

Reverse DNS

a104-111-239-33.deploy.static.akamaitechnologies.com

Software

Resource Hash

7d481eb36581746fd3662c7c452856b695df90cdce24664c48f565aa119c8b16

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

Referer: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jEDelivery_DocCenterLetters
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security: max-age=300
content-encoding: gzip
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
last-modified: Tue, 30 Oct 2018 06:18:02 GMT
x-akamai-citisite: GTDC
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
date: Tue, 17 Dec 2019 16:04:27 GMT
vary: Accept-Encoding
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
status: 200
cache-control: max-age=21600
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
content-type: application/x-javascript
content-length: 427
expires: Tue, 17 Dec 2019 22:04:27 GMT

GET
H2 200 BiocatchATO.js Show response
online.citi.com/passivebio/ 338 KB
88 KB 50ms
50ms Script
application/x-javascript 104.111.239.33
Akamai Technologies

General

Check archive.org

Show headers Download Go to

Full URL

https://online.citi.com/passivebio/BiocatchATO.js

Requested by

Host: online.citi.com
URL: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jEDelivery_DocCenterLetters

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.111.239.33 , Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),

Reverse DNS

a104-111-239-33.deploy.static.akamaitechnologies.com

Software

Resource Hash

fb932909daac7eff47f2a458fb47760bfd0924191bcd477f2366dd31e3ee73a4

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

Referer: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jEDelivery_DocCenterLetters
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security: max-age=300
content-encoding: gzip
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
last-modified: Tue, 30 Oct 2018 06:18:02 GMT
x-akamai-citisite: GTDC
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
date: Tue, 17 Dec 2019 16:04:27 GMT
vary: Accept-Encoding
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
status: 200
cache-control: max-age=21600
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
content-type: application/x-javascript
content-length: 89195
expires: Tue, 17 Dec 2019 22:04:27 GMT

GET
H2 200 cbol-smartSearch.css
online.citi.com/NCCS/smartSearch/css/ 8 KB
1 KB 45ms
44ms Stylesheet
text/css 104.111.239.33
Akamai Technologies

General

Check archive.org

Show headers Download Go to

Full URL

https://online.citi.com/NCCS/smartSearch/css/cbol-smartSearch.css

Requested by

Host: online.citi.com
URL: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jEDelivery_DocCenterLetters

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.111.239.33 , Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),

Reverse DNS

a104-111-239-33.deploy.static.akamaitechnologies.com

Software

Resource Hash

6d3001c9deac8cb1f88ea5254105f8d678de5532f1998a24eab1b59906eaf86b

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

Referer: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jEDelivery_DocCenterLetters
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security: max-age=300
content-encoding: gzip
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
last-modified: Tue, 13 Feb 2018 16:10:30 GMT
x-akamai-citisite: GTDC
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
date: Tue, 17 Dec 2019 16:04:28 GMT
vary: Accept-Encoding
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
status: 200
cache-control: max-age=21600
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
content-type: text/css
content-length: 899
expires: Tue, 17 Dec 2019 22:04:28 GMT

GET
H2 200 search-white.png
online.citi.com/GFC/branding/img/ 429 B
859 B 142ms
141ms Image
image/png 104.111.239.33
Akamai Technologies

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://online.citi.com/GFC/branding/img/search-white.png

Requested by

Host: online.citi.com
URL: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jEDelivery_DocCenterLetters

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.111.239.33 , Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),

Reverse DNS

a104-111-239-33.deploy.static.akamaitechnologies.com

Software

Resource Hash

e2812b1e3529e5f39e3b0586e82c7ad0dfc3fc61cfa0107edfac16483d0547d7

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

Referer: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jEDelivery_DocCenterLetters
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security: max-age=300
last-modified: Wed, 14 Jun 2017 18:29:07 GMT
x-akamai-citisite: GTDC
date: Tue, 17 Dec 2019 16:04:28 GMT
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
status: 200
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
accept-ranges: bytes
content-type: image/png
content-length: 429
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 200 citiHomePage.min.js Show response
online.citi.com/loginpage/scripts/ 14 KB
4 KB 37ms
36ms Script
application/x-javascript 104.111.239.33
Akamai Technologies

General

Check archive.org

Show headers Download Go to

Full URL

https://online.citi.com/loginpage/scripts/citiHomePage.min.js

Requested by

Host: online.citi.com
URL: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jEDelivery_DocCenterLetters

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.111.239.33 , Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),

Reverse DNS

a104-111-239-33.deploy.static.akamaitechnologies.com

Software

Resource Hash

64f93991b9aaca349db64f6de9a12126617e6e2162a6712a910ff2fac2005255

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

Referer: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jEDelivery_DocCenterLetters
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security: max-age=300
content-encoding: gzip
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
last-modified: Tue, 12 Nov 2019 16:41:08 GMT
x-akamai-citisite: GTDC
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
date: Tue, 17 Dec 2019 16:04:28 GMT
vary: Accept-Encoding
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
status: 200
cache-control: max-age=21600
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
content-type: application/x-javascript
content-length: 4103
expires: Tue, 17 Dec 2019 22:04:28 GMT

GET
H2 200 peworkflow.min.js Show response
online.citi.com/personalization/ 5 KB
2 KB 39ms
39ms Script
application/x-javascript 104.111.239.33
Akamai Technologies

General

Check archive.org

Show headers Download Go to

Full URL

https://online.citi.com/personalization/peworkflow.min.js

Requested by

Host: online.citi.com
URL: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jEDelivery_DocCenterLetters

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.111.239.33 , Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),

Reverse DNS

a104-111-239-33.deploy.static.akamaitechnologies.com

Software

Resource Hash

f6293fa8c399fd492fb1d40068afee4415acd29c573e7b8661d9c49b1aecea95

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

Referer: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jEDelivery_DocCenterLetters
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security: max-age=300
content-encoding: gzip
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
last-modified: Tue, 30 Oct 2018 06:18:02 GMT
x-akamai-citisite: GTDC
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
date: Tue, 17 Dec 2019 16:04:28 GMT
vary: Accept-Encoding
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
status: 200
cache-control: max-age=21600
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
content-type: application/x-javascript
content-length: 1803
expires: Tue, 17 Dec 2019 22:04:28 GMT

GET
H2 200 embed.js Show response
resources.digital-cloud-citi.medallia.com/wdcusciti/50/onsite/ 3 KB
1 KB 146ms
60ms Script
application/javascript 151.101.14.133
Fastly

General

Check archive.org

Show headers Download Go to

Full URL: https://resources.digital-cloud-citi.medallia.com/wdcusciti/50/onsite/embed.js
Requested by: Host: online.citi.com
URL: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jEDelivery_DocCenterLetters
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.14.133 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 64cadd481b641499d348f998f2c216bbdf3dfc14eea25ef621e3db1f5d507e62

Request headers

Referer: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jEDelivery_DocCenterLetters
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-amz-version-id: 5kRBbKu63NnU.nqPV5HZBPLMPwLAmYx9
content-encoding: gzip
age: 38
x-cache: HIT
status: 200
date: Tue, 17 Dec 2019 16:04:28 GMT
content-length: 1041
x-amz-id-2: Q41fFtd20iewAJJ/r50YIsJQYqBqVrrDONp5K6xvn8bZg2S5nPU9TvQEvhGwBMvYFcQbViGQSug=
x-served-by: cache-fra19173-FRA
access-control-allow-origin: *
last-modified: Mon, 16 Dec 2019 15:51:16 GMT
server: AmazonS3
x-timer: S1576598668.153477,VS0,VE27
etag: "a170d1151ca5655f8bab5801e8321057"
vary: Accept-Encoding
x-amz-request-id: 73A3903D218B078C
via: 1.1 varnish
cache-control: max-age=0,must-revalidate
accept-ranges: bytes
content-type: application/javascript
x-cache-hits: 1

GET
H2 200 2019CertifiedMobileApp.png
online.citi.com/JRS/images/ 28 KB
29 KB 142ms
142ms Image
image/png 104.111.239.33
Akamai Technologies

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://online.citi.com/JRS/images/2019CertifiedMobileApp.png

Requested by

Host: online.citi.com
URL: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jEDelivery_DocCenterLetters

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.111.239.33 , Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),

Reverse DNS

a104-111-239-33.deploy.static.akamaitechnologies.com

Software

Resource Hash

771c92ecc9167287111bc793f6392bfb0dc8a51a830b497f7591e6d3493fc1fc

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

Referer: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jEDelivery_DocCenterLetters
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security: max-age=300
last-modified: Tue, 05 Mar 2019 18:17:00 GMT
x-akamai-citisite: GTDC
date: Tue, 17 Dec 2019 16:04:28 GMT
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
status: 200
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
accept-ranges: bytes
content-type: image/png
content-length: 29171
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 200 oo_engine.min.js Show response
online.citi.com/GFC/branding/olab/js/ 42 KB
12 KB 37ms
36ms Script
application/x-javascript 104.111.239.33
Akamai Technologies

General

Check archive.org

Show headers Download Go to

Full URL

https://online.citi.com/GFC/branding/olab/js/oo_engine.min.js

Requested by

Host: online.citi.com
URL: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jEDelivery_DocCenterLetters

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.111.239.33 , Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),

Reverse DNS

a104-111-239-33.deploy.static.akamaitechnologies.com

Software

Resource Hash

1f2a0e7aa3dabf73dae3cc7c1e53a70ec51145b39b027bdc1ecae9223c0c80d2

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

Referer: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jEDelivery_DocCenterLetters
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security: max-age=300
content-encoding: gzip
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
last-modified: Tue, 12 Sep 2017 17:24:52 GMT
x-akamai-citisite: GTDC
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
date: Tue, 17 Dec 2019 16:04:28 GMT
vary: Accept-Encoding
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
status: 200
cache-control: max-age=21600
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
content-type: application/x-javascript
content-length: 11704
expires: Tue, 17 Dec 2019 22:04:28 GMT

GET
H2 200 ddl.min.js Show response
online.citi.com/CBOL/common/ui/ddl/theme/latest/scripts/ 64 KB
18 KB 66ms
64ms Script
application/x-javascript 104.111.239.33
Akamai Technologies

General

Check archive.org

Show headers Download Go to

Full URL

https://online.citi.com/CBOL/common/ui/ddl/theme/latest/scripts/ddl.min.js

Requested by

Host: online.citi.com
URL: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jEDelivery_DocCenterLetters

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.111.239.33 , Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),

Reverse DNS

a104-111-239-33.deploy.static.akamaitechnologies.com

Software

Resource Hash

f1821b3865a1008ba0c088f7dc5c7eeb6b81e414461885c40b8d0f48fcbc9341

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

Referer: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jEDelivery_DocCenterLetters
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security: max-age=300
content-encoding: gzip
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
last-modified: Tue, 12 Sep 2017 17:24:53 GMT
x-akamai-citisite: GTDC
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
date: Tue, 17 Dec 2019 16:04:28 GMT
vary: Accept-Encoding
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
status: 200
cache-control: max-age=21600
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
content-type: application/x-javascript
content-length: 17670
expires: Tue, 17 Dec 2019 22:04:28 GMT

GET
H2 200 main.js Show response
online.citi.com/GFC/branding/responsivebranding/js/ 33 KB
8 KB 75ms
73ms Script
application/x-javascript 104.111.239.33
Akamai Technologies

General

Check archive.org

Show headers Download Go to

Full URL

https://online.citi.com/GFC/branding/responsivebranding/js/main.js

Requested by

Host: online.citi.com
URL: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jEDelivery_DocCenterLetters

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.111.239.33 , Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),

Reverse DNS

a104-111-239-33.deploy.static.akamaitechnologies.com

Software

Resource Hash

c4aa5f75b54d39ff9780c3a5622efee6234b1657dd90d1777529e68bd06ad275

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

Referer: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jEDelivery_DocCenterLetters
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security: max-age=300
content-encoding: gzip
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
last-modified: Thu, 26 Sep 2019 19:24:30 GMT
x-akamai-citisite: GTDC
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
date: Tue, 17 Dec 2019 16:04:28 GMT
vary: Accept-Encoding
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
status: 200
cache-control: max-age=21600
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
content-type: application/x-javascript
content-length: 7965
expires: Tue, 17 Dec 2019 22:04:28 GMT

GET
H2 200 citilive-search.js Show response
online.citi.com/JEA/CitiSearch/nexus-platform/js/ 2 KB
2 KB 84ms
82ms Script
application/x-javascript 104.111.239.33
Akamai Technologies

General

Check archive.org

Show headers Download Go to

Full URL

https://online.citi.com/JEA/CitiSearch/nexus-platform/js/citilive-search.js

Requested by

Host: online.citi.com
URL: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jEDelivery_DocCenterLetters

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.111.239.33 , Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),

Reverse DNS

a104-111-239-33.deploy.static.akamaitechnologies.com

Software

Resource Hash

f2adfd83f8e9c7f3b092921eb5a59d4463041b2be8386a17ec7ac29d8d588470

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

Referer: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jEDelivery_DocCenterLetters
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security: max-age=300
content-encoding: gzip
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
last-modified: Tue, 13 Feb 2018 16:10:30 GMT
x-akamai-citisite: GTDC
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
date: Tue, 17 Dec 2019 16:04:28 GMT
vary: Accept-Encoding
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
status: 200
cache-control: max-age=21600
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
content-type: application/x-javascript
content-length: 1073
expires: Tue, 17 Dec 2019 22:04:28 GMT

GET
H2 200 cbol-smartSearch-inject.js Show response
online.citi.com/NCCS/smartSearch/js/ 10 KB
3 KB 92ms
90ms Script
application/x-javascript 104.111.239.33
Akamai Technologies

General

Check archive.org

Show headers Download Go to

Full URL

https://online.citi.com/NCCS/smartSearch/js/cbol-smartSearch-inject.js

Requested by

Host: online.citi.com
URL: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jEDelivery_DocCenterLetters

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.111.239.33 , Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),

Reverse DNS

a104-111-239-33.deploy.static.akamaitechnologies.com

Software

Resource Hash

3c765e4a45a7befbfdf86c188a45a0ccde59bec375cffa6a1c3ac0b23818bcde

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

Referer: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jEDelivery_DocCenterLetters
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security: max-age=300
content-encoding: gzip
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
last-modified: Tue, 09 Jul 2019 07:57:08 GMT
x-akamai-citisite: GTDC
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
date: Tue, 17 Dec 2019 16:04:28 GMT
vary: Accept-Encoding
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
status: 200
cache-control: max-age=21600
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
content-type: application/x-javascript
content-length: 2670
expires: Tue, 17 Dec 2019 22:04:28 GMT

GET
H2 200 TMXProfiling.js Show response
online.citi.com/TMX/ 1 KB
1 KB 99ms
98ms Script
application/x-javascript 104.111.239.33
Akamai Technologies

General

Check archive.org

Show headers Download Go to

Full URL

https://online.citi.com/TMX/TMXProfiling.js

Requested by

Host: online.citi.com
URL: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jEDelivery_DocCenterLetters

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.111.239.33 , Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),

Reverse DNS

a104-111-239-33.deploy.static.akamaitechnologies.com

Software

Resource Hash

157430093a6d2ee63082eae5dabf826926d3b6259d33482aa6713c48728e82fa

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

Referer: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jEDelivery_DocCenterLetters
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security: max-age=300
content-encoding: gzip
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
last-modified: Fri, 10 Aug 2018 07:26:42 GMT
x-akamai-citisite: GTDC
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
date: Tue, 17 Dec 2019 16:04:28 GMT
vary: Accept-Encoding
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
status: 200
cache-control: max-age=21600
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
content-type: application/x-javascript
content-length: 546
expires: Tue, 17 Dec 2019 22:04:28 GMT

GET
H2 200 cobrowse_overlay.css
online.citi.com/GPS/portal/css/ 7 KB
2 KB 120ms
119ms Stylesheet
text/css 104.111.239.33
Akamai Technologies

General

Check archive.org

Show headers Download Go to

Full URL

https://online.citi.com/GPS/portal/css/cobrowse_overlay.css

Requested by

Host: online.citi.com
URL: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jEDelivery_DocCenterLetters

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.111.239.33 , Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),

Reverse DNS

a104-111-239-33.deploy.static.akamaitechnologies.com

Software

Resource Hash

a9623118fb6ec3944d1312cd0d492c3f32455e89bc1e01eafa67628a309d9c60

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

Referer: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jEDelivery_DocCenterLetters
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security: max-age=300
content-encoding: gzip
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
last-modified: Tue, 13 Aug 2019 07:17:14 GMT
x-akamai-citisite: GTDC
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
date: Tue, 17 Dec 2019 16:04:28 GMT
vary: Accept-Encoding
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
status: 200
cache-control: max-age=21600
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
content-type: text/css
content-length: 1597
expires: Tue, 17 Dec 2019 22:04:28 GMT

OPTIONS
H/1.1 200
OK tagging_transformation.json Show response
api.citi.com/gcgapi/prod/public/v1/staticcms/USGCB/en_US/appid/ 0
2 KB 313ms
207ms XHR
text/plain 23.38.55.47
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://api.citi.com/gcgapi/prod/public/v1/staticcms/USGCB/en_US/appid/tagging_transformation.json
Requested by: Host: online.citi.com
URL: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jEDelivery_DocCenterLetters
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.38.55.47 , Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS: a23-38-55-47.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Access-Control-Request-Method: GET
Origin: https://online.citi.com
Referer: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jEDelivery_DocCenterLetters
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Access-Control-Request-Headers: client_id

Response headers

Date: Tue, 17 Dec 2019 16:04:28 GMT
Content-Encoding: gzip
Access-Control-Allow-Origin: https://online.citi.com
Vary: Accept-Encoding
Access-Control-Allow-Methods: GET,POST,PUT,DELETE
X-Backside-Transport: FAIL FAIL
Access-Control-Expose-Headers: Accept,Accept-Language,Authorization,businessCode,client_id,content-type,countryCode,uuid,x-ibm-client-id,eventid,sessionID,bizToken,citiuuid,applicationId,channelId,Scope,blackBox,devicePrint,deviceTokenCookie,AMWResponse,action,challengeType,TMXSessionId,tenantName,TMXDigitalApplicationType,accessToken,familyIndicator,Otpid,deviceId,subscriberId,CitiProfOnly,digitalApplicationType,environmentId,BioCatchSessionId,X-Migration-Target,x-soz9htcz-a,x-soz9htcz-b,x-soz9htcz-c,x-soz9htcz-d,x-soz9htcz-e,x-soz9htcz-f,x-soz9htcz-z,x-soz9htcz-uniquestatekey,tenantId,appid,X-Akamai-CITISITE,Dclocation,Uuid,appVersion
Access-Control-Allow-Credentials: true
Connection: keep-alive
Access-Control-Allow-Headers: Accept,Accept-Language,Authorization,businessCode,client_id,content-type,countryCode,uuid,x-ibm-client-id,eventid,sessionID,bizToken,citiuuid,applicationId,channelId,Scope,blackBox,devicePrint,deviceTokenCookie,AMWResponse,action,challengeType,TMXSessionId,tenantName,TMXDigitalApplicationType,accessToken,familyIndicator,Otpid,deviceId,subscriberId,CitiProfOnly,digitalApplicationType,environmentId,BioCatchSessionId,X-Migration-Target,x-soz9htcz-a,x-soz9htcz-b,x-soz9htcz-c,x-soz9htcz-d,x-soz9htcz-e,x-soz9htcz-f,x-soz9htcz-z,x-soz9htcz-uniquestatekey,tenantId,appid,X-Akamai-CITISITE,Dclocation,Uuid,appVersion
Content-Length: 0

GET
H/1.1 200
OK target.js Show response
cdn.tt.omtrdc.net/cdn/ 43 KB
14 KB 119ms
47ms Script
text/javascript 184.30.216.237
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.tt.omtrdc.net/cdn/target.js
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 184.30.216.237 , Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS: a184-30-216-237.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: 7ecf3bf86151cd72036fb67feb8fcbd8c80359e0ca871e1aeb955428ed43c26d

Request headers

Referer: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jEDelivery_DocCenterLetters
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

Date: Tue, 17 Dec 2019 16:04:28 GMT
Content-Encoding: gzip
Last-Modified: Tue, 01 Oct 2019 05:02:27 GMT
Server: Apache
ETag: "1fcc3-aa3e-593d2423b31d3"
Vary: Accept-Encoding
Content-Type: text/javascript; charset=utf-8
Cache-Control: must-revalidate, max-age=3600
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 14200

GET
H2 200 ajax Show response
citicorpcreditservic.tt.omtrdc.net/m2/citicorpcreditservic/mbox/ 812 B
1 KB 163ms
44ms Script
text/javascript 66.117.29.6
Adobe Systems Inc.

General

Check archive.org

Show headers Download Go to

Full URL: https://citicorpcreditservic.tt.omtrdc.net/m2/citicorpcreditservic/mbox/ajax?mboxHost=online.citi.com&mboxPage=82456e03c67649bfb34ce128dabdebd9&screenHeight=1200&screenWidth=1600&browserWidth=1600&browserHeight=1200&browserTimeOffset=60&colorDepth=24&mboxSession=82456e03c67649bfb34ce128dabdebd9&mboxXDomain=enabled&mboxCount=1&mboxTime=1576602267941&mbox=target-global-mbox&mboxId=0&mboxURL=https%3A%2F%2Fonline.citi.com%2FUS%2FJRS%2Finfrastructure%2Ftarget.do%3Fnext_page%3Djfp%7CjEDelivery_DocCenterLetters&mboxReferrer=https%3A%2F%2Ffm.info6.citi.com%2Fats%2Furl.aspx%3Fcr%3D617%26wu%3D1%26we%3D1%26url%3Dhttps%253A%252F%252Fwww.accountonline.com%252Fcards%252Fsvc%252FLogin.do%253FNEXT_SCREEN%253D%252FDocctr%2526siteId%253DCB%2526accountIndex%253D%2526enid%253D06895BACB5C94FD6EC024F9CBFC462EE62C6%26linkName%3DCN_ECOMM_CENTER_URL%26transId%3DI2019121500064199&mboxVersion=63
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 66.117.29.6 , United States, ASN15224 (OMNITURE - Adobe Systems Inc., US),
Reverse DNS
Software: /
Resource Hash: d85a9020926832ea078812001b1039073f687892ad9c2faaf9f832d847aa8632

Request headers

Referer: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jEDelivery_DocCenterLetters
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

pragma: no-cache
date: Tue, 17 Dec 2019 16:04:27 GMT
content-type: text/javascript;charset=utf-8
p3p: CP="NOI DSP CURa OUR STP COM"
status: 200
cache-control: no-cache
timing-allow-origin: *
content-length: 812
x-request-id: 9699bceb-8a9a-41b6-ba4a-568294d45fa1

GET
H2 200 serverComponent.php Show response
nexus.ensighten.com/citi/na_prod/ 2 KB
814 B 63ms
62ms Script
text/javascript 18.195.42.228
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://nexus.ensighten.com/citi/na_prod/serverComponent.php?r=88425.79134866624&ClientID=1129&PageID=https%3A%2F%2Fonline.citi.com%2FUS%2FJRS%2Finfrastructure%2Ftarget.do%3Fnext_page%3Djfp%7CjEDelivery_DocCenterLetters
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 18.195.42.228 Frankfurt am Main, Germany, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: ec2-18-195-42-228.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: ce8e126fb9b428395f0be1ff5486bb1da6520f12d778e9cece1581cfa411c440

Request headers

Referer: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jEDelivery_DocCenterLetters
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Tue, 17 Dec 2019 16:04:28 GMT
content-encoding: gzip
server: nginx
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: no-cache, no-store
expires: Tue, 17 Dec 2019 16:04:27 GMT

GET
H/1.1 200
OK tagging_transformation.json Show response
api.citi.com/gcgapi/prod/public/v1/staticcms/USGCB/en_US/appid/ 302 KB
44 KB 319ms
319ms XHR
application/json 23.38.55.47
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://api.citi.com/gcgapi/prod/public/v1/staticcms/USGCB/en_US/appid/tagging_transformation.json
Requested by: Host: online.citi.com
URL: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jEDelivery_DocCenterLetters
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.38.55.47 , Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS: a23-38-55-47.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 05cdf4be90754d75c60f6e945e97f7b978e037666d11ac617422cc746b42e0ba

Request headers

Referer: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jEDelivery_DocCenterLetters
Origin: https://online.citi.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
client_id: 4a51fb19-a1a7-4247-bc7e-18aa56dd1c40

Response headers

Date: Tue, 17 Dec 2019 16:04:28 GMT
Content-Encoding: gzip
Citiuuid: dc1f461a-3fe4-4bd9-bfca-3da4d76cb27c7802698
Access-Control-Allow-Origin: https://online.citi.com
Access-Control-Max-Age: 2147483647
X-Global-Transaction-ID: 6cd7a43d5df8fc8c05ba5abf
Connection: keep-alive
Content-Length: 42069
Uuid: 559704ca-e952-400f-b016-1e7d3ee16960
X-Akamai-CITISITE: SWDC
Dclocation: SW1
Vary: Accept-Encoding
Access-Control-Allow-Methods: GET,PUT,POST,DELETE,HEAD,GET,POST,PUT,DELETE
Content-Type: application/json
X-Backside-Transport: OK OK,OK OK,OK OK
X-Vcap-Request-Id: 055f64a8-4914-426a-5f3a-d095328810f5,731afb22-5a4f-492a-72f2-98835007f9d3
Access-Control-Expose-Headers: APIm-Debug-Trans-Id, X-RateLimit-Limit, X-RateLimit-Remaining, X-RateLimit-Reset, X-Global-Transaction-ID,action,challengeType,bizToken,eventid,Eventid,Eventidexpirytime,eventidexpirytime,accesstoken,Authorization,sid,SessionId,CCPToken,CFIToken,Accept,Accept-Language,Authorization,businessCode,client_id,content-type,countryCode,uuid,x-ibm-client-id,eventid,sessionID,bizToken,citiuuid,applicationId,channelId,Scope,blackBox,devicePrint,deviceTokenCookie,AMWResponse,action,challengeType,TMXSessionId,tenantName,TMXDigitalApplicationType,accessToken,familyIndicator,Otpid,deviceId,subscriberId,CitiProfOnly,digitalApplicationType,environmentId,BioCatchSessionId,X-Migration-Target,x-soz9htcz-a,x-soz9htcz-b,x-soz9htcz-c,x-soz9htcz-d,x-soz9htcz-e,x-soz9htcz-f,x-soz9htcz-z,x-soz9htcz-uniquestatekey,tenantId,appid,X-Akamai-CITISITE,Dclocation,Uuid,appVersion
Cache-Control: max-age=60, public
Access-Control-Allow-Credentials: true
Access-Control-Allow-Headers: action,challengeType,accesstoken,,Content-Type,sid,CCPToken,CFIToken,countryCode,businessCode,channelId,uuid,client_id,environmentId,Accept,Accept-Language,Authorization,businessCode,client_id,content-type,countryCode,uuid,x-ibm-client-id,eventid,sessionID,bizToken,citiuuid,applicationId,channelId,Scope,blackBox,devicePrint,deviceTokenCookie,AMWResponse,action,challengeType,TMXSessionId,tenantName,TMXDigitalApplicationType,accessToken,familyIndicator,Otpid,deviceId,subscriberId,CitiProfOnly,digitalApplicationType,environmentId,BioCatchSessionId,X-Migration-Target,x-soz9htcz-a,x-soz9htcz-b,x-soz9htcz-c,x-soz9htcz-d,x-soz9htcz-e,x-soz9htcz-f,x-soz9htcz-z,x-soz9htcz-uniquestatekey,tenantId,appid,X-Akamai-CITISITE,Dclocation,Uuid,appVersion

GET
H2 404 identity
api.rlcdn.com/api/ 0
0 63ms
26ms XHR
text/plain 35.244.174.68
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL: https://api.rlcdn.com/api/identity?pid=1&rt=idl
Requested by: Host: online.citi.com
URL: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jEDelivery_DocCenterLetters
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.244.174.68 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS: 68.174.244.35.bc.googleusercontent.com
Software: /
Resource Hash

Request headers

Accept: application/json, text/javascript, */*; q=0.01
Referer: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jEDelivery_DocCenterLetters
Origin: https://online.citi.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

GET
BLOB 200
OK 9756399b-1c9d-4bb0-a0f8-0b3e80de6bbe
https://online.citi.com/ 138 KB
0 Other
application/javascript

General

Check archive.org

Show headers Download Go to

Full URL: blob:https://online.citi.com/9756399b-1c9d-4bb0-a0f8-0b3e80de6bbe
Requested by: Host: online.citi.com
URL: https://online.citi.com/passivebio/BiocatchATO.js
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: e5168b3d0c8f929a1b8c4c1b4e4ebac60ee0e1ecfd759aeb4be4c2b15e3fc097

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Length: 140879
Content-Type: application/javascript

GET
H2 200 Citi-Enterprise-White.png
online.citi.com/GFC/branding/img/ 1 KB
1 KB 112ms
112ms Image
image/png 104.111.239.33
Akamai Technologies

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://online.citi.com/GFC/branding/img/Citi-Enterprise-White.png

Requested by

Host: online.citi.com
URL: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jEDelivery_DocCenterLetters

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.111.239.33 , Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),

Reverse DNS

a104-111-239-33.deploy.static.akamaitechnologies.com

Software

Resource Hash

7cb24e06c00e47bb6bc6c38b935d6bc62817f656703387e4fb7591add96c7454

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

Referer: https://online.citi.com/GFC/branding/responsivebranding/css/main_branding.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security: max-age=300
last-modified: Wed, 14 Jun 2017 18:29:05 GMT
x-akamai-citisite: GTDC
date: Tue, 17 Dec 2019 16:04:28 GMT
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
status: 200
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
accept-ranges: bytes
content-type: image/png
content-length: 1040
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 200 Interstate-Light.woff
online.citi.com/CBOL/common/ui/ddl/theme/latest/styles/fonts/interstate/ 74 KB
74 KB 123ms
122ms Font
application/octet-stream 104.111.239.33
Akamai Technologies

General

Check archive.org

Show headers Download Go to

Full URL

https://online.citi.com/CBOL/common/ui/ddl/theme/latest/styles/fonts/interstate/Interstate-Light.woff

Requested by

Host: online.citi.com
URL: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jEDelivery_DocCenterLetters

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.111.239.33 , Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),

Reverse DNS

a104-111-239-33.deploy.static.akamaitechnologies.com

Software

Resource Hash

f327a0ba3e41b1e8154e1c18fc114baff0bd057151e3afe7fa6f33cc0cb18296

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: https://online.citi.com/CBOL/common/ui/ddl/theme/latest/styles/ddl.min.css
Origin: https://online.citi.com

Response headers

strict-transport-security: max-age=300
content-encoding: gzip
last-modified: Tue, 12 Sep 2017 17:22:45 GMT
x-akamai-citisite: GTDC
date: Tue, 17 Dec 2019 16:04:28 GMT
vary: Accept-Encoding
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
status: 200
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
content-type: text/plain
access-control-allow-origin: *
content-length: 75483
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 200 Interstate-Bold.woff
online.citi.com/CBOL/common/ui/ddl/theme/latest/styles/fonts/interstate/ 70 KB
71 KB 130ms
130ms Font
application/octet-stream 104.111.239.33
Akamai Technologies

General

Check archive.org

Show headers Download Go to

Full URL

https://online.citi.com/CBOL/common/ui/ddl/theme/latest/styles/fonts/interstate/Interstate-Bold.woff

Requested by

Host: online.citi.com
URL: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jEDelivery_DocCenterLetters

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.111.239.33 , Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),

Reverse DNS

a104-111-239-33.deploy.static.akamaitechnologies.com

Software

Resource Hash

e9e9a67395a0d83b584208a19b95af203df8e8e6c6952fe76c690d60ea9381c7

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: https://online.citi.com/CBOL/common/ui/ddl/theme/latest/styles/ddl.min.css
Origin: https://online.citi.com

Response headers

strict-transport-security: max-age=300
content-encoding: gzip
last-modified: Tue, 12 Sep 2017 17:22:45 GMT
x-akamai-citisite: GTDC
date: Tue, 17 Dec 2019 16:04:28 GMT
vary: Accept-Encoding
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
status: 200
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
content-type: text/plain
access-control-allow-origin: *
content-length: 71859
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 200 bkintg.min.js Show response
online.citi.com/personalization/ 2 KB
1 KB 86ms
86ms XHR
application/x-javascript 104.111.239.33
Akamai Technologies

General

Check archive.org

Show headers Download Go to

Full URL

https://online.citi.com/personalization/bkintg.min.js

Requested by

Host: online.citi.com
URL: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jEDelivery_DocCenterLetters

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.111.239.33 , Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),

Reverse DNS

a104-111-239-33.deploy.static.akamaitechnologies.com

Software

Resource Hash

5407ad372944d2599b86775c628e963429af523c48f5c80b70ea587a8ed12fa8

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

Accept: text/javascript, application/javascript, application/ecmascript, application/x-ecmascript, */*; q=0.01
Referer: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jEDelivery_DocCenterLetters
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security: max-age=300
content-encoding: gzip
last-modified: Tue, 12 Jun 2018 05:31:28 GMT
x-akamai-citisite: GTDC
date: Tue, 17 Dec 2019 16:04:28 GMT
vary: Accept-Encoding
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
status: 200
expires: Tue, 17 Dec 2019 22:04:28 GMT
cache-control: max-age=21600
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
content-length: 892
content-type: application/x-javascript
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 200 aosRFServerIntg.min.js Show response
online.citi.com/personalization/ 15 KB
5 KB 94ms
94ms XHR
application/x-javascript 104.111.239.33
Akamai Technologies

General

Check archive.org

Show headers Download Go to

Full URL

https://online.citi.com/personalization/aosRFServerIntg.min.js

Requested by

Host: online.citi.com
URL: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jEDelivery_DocCenterLetters

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.111.239.33 , Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),

Reverse DNS

a104-111-239-33.deploy.static.akamaitechnologies.com

Software

Resource Hash

9ca747861c2e2787351bc177db2b022c378d21b1f1057643764562ac5f4c23e9

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

Accept: text/javascript, application/javascript, application/ecmascript, application/x-ecmascript, */*; q=0.01
Referer: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jEDelivery_DocCenterLetters
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security: max-age=300
content-encoding: gzip
last-modified: Tue, 12 Nov 2019 16:41:08 GMT
x-akamai-citisite: GTDC
date: Tue, 17 Dec 2019 16:04:28 GMT
vary: Accept-Encoding
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
status: 200
expires: Tue, 17 Dec 2019 22:04:28 GMT
cache-control: max-age=21600
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
content-length: 4622
content-type: application/x-javascript
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 200 cmstmplintg.min.js Show response
online.citi.com/personalization/ 21 KB
6 KB 101ms
101ms XHR
application/x-javascript 104.111.239.33
Akamai Technologies

General

Check archive.org

Show headers Download Go to

Full URL

https://online.citi.com/personalization/cmstmplintg.min.js

Requested by

Host: online.citi.com
URL: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jEDelivery_DocCenterLetters

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.111.239.33 , Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),

Reverse DNS

a104-111-239-33.deploy.static.akamaitechnologies.com

Software

Resource Hash

dc60cdde3c214f41bf22ce5166544f880d07dbdad1a2c7d6d468c0fb4f7e6540

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

Accept: text/javascript, application/javascript, application/ecmascript, application/x-ecmascript, */*; q=0.01
Referer: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jEDelivery_DocCenterLetters
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security: max-age=300
content-encoding: gzip
last-modified: Tue, 12 Nov 2019 16:41:08 GMT
x-akamai-citisite: GTDC
date: Tue, 17 Dec 2019 16:04:28 GMT
vary: Accept-Encoding
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
status: 200
expires: Tue, 17 Dec 2019 22:04:28 GMT
cache-control: max-age=21600
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
content-length: 6009
content-type: application/x-javascript
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 200 149cf562febe90eabe89ebca7a5e8aa8.js Show response
nexus.ensighten.com/citi/na_prod/code/ 2 KB
862 B 47ms
47ms Script
application/javascript 18.195.42.228
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://nexus.ensighten.com/citi/na_prod/code/149cf562febe90eabe89ebca7a5e8aa8.js?conditionId0=480881
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 18.195.42.228 Frankfurt am Main, Germany, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: ec2-18-195-42-228.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 6fc675ff6586c6f4716748c80a62681d461c0b46e2a62c06f4e8f37b0be5f8eb

Request headers

Referer: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jEDelivery_DocCenterLetters
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Tue, 17 Dec 2019 16:04:28 GMT
content-encoding: gzip
last-modified: Tue, 19 Nov 2019 18:11:34 GMT
server: nginx
etag: W/"5dd43056-631"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
status: 200
cache-control: max-age=315360000

GET
H2 200 33848276fda6dd0b45329f6aaea4158e.js Show response
nexus.ensighten.com/citi/na_prod/code/ 175 KB
50 KB 50ms
49ms Script
application/javascript 18.195.42.228
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://nexus.ensighten.com/citi/na_prod/code/33848276fda6dd0b45329f6aaea4158e.js?conditionId0=421908
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 18.195.42.228 Frankfurt am Main, Germany, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: ec2-18-195-42-228.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: cd3d25348d488d5a2a845da6e0b5fabbd42696ed66bcd4a375ecd56d9e65878a

Request headers

Referer: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jEDelivery_DocCenterLetters
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Tue, 17 Dec 2019 16:04:28 GMT
content-encoding: gzip
last-modified: Tue, 10 Dec 2019 18:01:14 GMT
server: nginx
etag: W/"5defdd6a-2bd53"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
status: 200
cache-control: max-age=315360000

GET
H2 200 fdf45a7c15c1cee06bb71e10dac4e26e.js Show response
nexus.ensighten.com/citi/na_prod/code/ 989 B
1 KB 55ms
54ms Script
application/javascript 18.195.42.228
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://nexus.ensighten.com/citi/na_prod/code/fdf45a7c15c1cee06bb71e10dac4e26e.js?conditionId0=4849963
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 18.195.42.228 Frankfurt am Main, Germany, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: ec2-18-195-42-228.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 7df13706eaab8ce9a3dcd2a501f60bc66987c83834d07dfaf07ae56ef814c110

Request headers

Referer: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jEDelivery_DocCenterLetters
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Tue, 17 Dec 2019 16:04:28 GMT
last-modified: Tue, 14 May 2019 17:01:42 GMT
server: nginx
etag: "5cdaf476-3dd"
content-type: application/javascript; charset=utf-8
status: 200
cache-control: max-age=315360000
accept-ranges: bytes
content-length: 989

GET
H2 200 7590a5146221c725e87b46078594eae2.js Show response
nexus.ensighten.com/citi/na_prod/code/ 104 KB
30 KB 57ms
56ms Script
application/javascript 18.195.42.228
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://nexus.ensighten.com/citi/na_prod/code/7590a5146221c725e87b46078594eae2.js?conditionId0=486757
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 18.195.42.228 Frankfurt am Main, Germany, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: ec2-18-195-42-228.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 9c6ce416f52fff5a68c6f1fdde48915832ca3402d24261dcc968df68aed50a5d

Request headers

Referer: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jEDelivery_DocCenterLetters
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Tue, 17 Dec 2019 16:04:28 GMT
content-encoding: gzip
last-modified: Tue, 10 Dec 2019 18:01:14 GMT
server: nginx
etag: W/"5defdd6a-1a128"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
status: 200
cache-control: max-age=315360000

GET
H2 200 557566dc60916e3de69e006bef252459.js Show response
nexus.ensighten.com/citi/na_prod/code/ 2 KB
961 B 55ms
55ms Script
application/javascript 18.195.42.228
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://nexus.ensighten.com/citi/na_prod/code/557566dc60916e3de69e006bef252459.js?conditionId0=4837456
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 18.195.42.228 Frankfurt am Main, Germany, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: ec2-18-195-42-228.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 31b00ff4929696dfca06885da68e58c3e09f6ecb4ae0fe1ae287e99a3fd1f716

Request headers

Referer: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jEDelivery_DocCenterLetters
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Tue, 17 Dec 2019 16:04:28 GMT
content-encoding: gzip
last-modified: Tue, 27 Aug 2019 16:59:12 GMT
server: nginx
etag: W/"5d656160-887"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
status: 200
cache-control: max-age=315360000

GET
H2 200 c7fb8fdcd5c59e67afe63c97ddb163c5.js Show response
nexus.ensighten.com/citi/na_prod/code/ 253 KB
80 KB 65ms
65ms Script
application/javascript 18.195.42.228
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://nexus.ensighten.com/citi/na_prod/code/c7fb8fdcd5c59e67afe63c97ddb163c5.js?conditionId0=3013337
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 18.195.42.228 Frankfurt am Main, Germany, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: ec2-18-195-42-228.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 147d5785b25331ac266f34841b05b4401ec78b0e0de6f85d63993ab0a9b5a253

Request headers

Referer: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jEDelivery_DocCenterLetters
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Tue, 17 Dec 2019 16:04:28 GMT
content-encoding: gzip
last-modified: Wed, 20 Nov 2019 20:35:34 GMT
server: nginx
etag: W/"5dd5a396-3f565"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
status: 200
cache-control: max-age=315360000

GET
H2 200 3a25161527fddb076f26e799399f8cf2.js Show response
nexus.ensighten.com/citi/na_prod/code/ 9 KB
3 KB 74ms
74ms Script
application/javascript 18.195.42.228
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://nexus.ensighten.com/citi/na_prod/code/3a25161527fddb076f26e799399f8cf2.js?conditionId0=467299
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 18.195.42.228 Frankfurt am Main, Germany, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: ec2-18-195-42-228.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 0a0fcf460d3adf526db40dac99fbfb02334557efc728b0acbae0952a37ac973f

Request headers

Referer: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jEDelivery_DocCenterLetters
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Tue, 17 Dec 2019 16:04:28 GMT
content-encoding: gzip
last-modified: Tue, 10 Dec 2019 18:01:14 GMT
server: nginx
etag: W/"5defdd6a-228a"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
status: 200
cache-control: max-age=315360000

GET
H2 200 8637af7c210f4e79436bc39f71b49bfa.js Show response
nexus.ensighten.com/citi/na_prod/code/ 1 KB
737 B 63ms
61ms Script
application/javascript 18.195.42.228
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://nexus.ensighten.com/citi/na_prod/code/8637af7c210f4e79436bc39f71b49bfa.js?conditionId0=4827153
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 18.195.42.228 Frankfurt am Main, Germany, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: ec2-18-195-42-228.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 06dfb367edf9bbff810def9f75f8695b3ccfbcb2813306609fc6e18fcacfc17e

Request headers

Referer: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jEDelivery_DocCenterLetters
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Tue, 17 Dec 2019 16:04:28 GMT
content-encoding: gzip
last-modified: Wed, 10 Jul 2019 12:57:13 GMT
server: nginx
etag: W/"5d25e0a9-412"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
status: 200
cache-control: max-age=315360000

GET
H2 200 ee55763bbebca7805817a98103ec6f50.js Show response
nexus.ensighten.com/citi/na_prod/code/ 1 KB
678 B 73ms
73ms Script
application/javascript 18.195.42.228
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://nexus.ensighten.com/citi/na_prod/code/ee55763bbebca7805817a98103ec6f50.js?conditionId0=4850690
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 18.195.42.228 Frankfurt am Main, Germany, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: ec2-18-195-42-228.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: a612a8f640434c7aaee47569897c1fee79df6f146ec26115e2a8c9be645592b7

Request headers

Referer: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jEDelivery_DocCenterLetters
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Tue, 17 Dec 2019 16:04:28 GMT
content-encoding: gzip
last-modified: Tue, 29 Oct 2019 17:20:39 GMT
server: nginx
etag: W/"5db874e7-425"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
status: 200
cache-control: max-age=315360000

GET
H2 200 48070ca8866144aeed1d66dda4fe04f2.js Show response
nexus.ensighten.com/citi/na_prod/code/ 2 KB
1 KB 73ms
73ms Script
application/javascript 18.195.42.228
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://nexus.ensighten.com/citi/na_prod/code/48070ca8866144aeed1d66dda4fe04f2.js?conditionId0=4854834
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 18.195.42.228 Frankfurt am Main, Germany, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: ec2-18-195-42-228.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: a9cebaefb3003c4944d0d59f71afdca3509d3975af5ff213d2750fdf8f719146

Request headers

Referer: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jEDelivery_DocCenterLetters
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Tue, 17 Dec 2019 16:04:28 GMT
content-encoding: gzip
last-modified: Tue, 25 Jun 2019 17:02:14 GMT
server: nginx
etag: W/"5d125396-95c"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
status: 200
cache-control: max-age=315360000

GET
H2 200 cse.js Show response
cse.google.com/cse/ 11 KB
4 KB 53ms
32ms Script
text/javascript 2a00:1450:4001:806::200e
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://cse.google.com/cse/cse.js?cx=009695499870347544712:e3dyicpbrwu

Requested by

Host: online.citi.com
URL: https://online.citi.com/GFC/branding/responsivebranding/js/main.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:806::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

gws /

Resource Hash

4ee320d0865d9d6f8e1f3ae5dd4bbe0d49ce0455d4fda4c51271e484b169b616

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jEDelivery_DocCenterLetters
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Tue, 17 Dec 2019 16:04:28 GMT
content-encoding: br
server: gws
x-frame-options: SAMEORIGIN
p3p: CP="This is not a P3P policy! See g.co/p3phelp for more info."
status: 200
cache-control: private
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 3476
x-xss-protection: 0
expires: Tue, 17 Dec 2019 16:04:28 GMT

GET
H/1.1 200
OK snare.js Show response
mpsnare.iesnare.com/ 38 KB
13 KB 73ms
36ms Script
text/javascript 35.176.204.252
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL

https://mpsnare.iesnare.com/snare.js?_=1576598667909

Requested by

Host: online.citi.com
URL: https://online.citi.com/CBOL/common/ui/ddl/theme/latest/scripts/vendor.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

35.176.204.252 London, United Kingdom, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),

Reverse DNS

ec2-35-176-204-252.eu-west-2.compute.amazonaws.com

Software

nginx /

Resource Hash

b4d03a0e8edfd600ead0f5c14b0c8466f9e2672ef792505123d5677b70baada9

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains

Request headers

Referer: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jEDelivery_DocCenterLetters
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 17 Dec 2019 16:04:28 GMT
Content-Encoding: gzip
Server: nginx
Strict-Transport-Security: max-age=15552000; includeSubDomains
p3p: CP="NON DSP COR CURa"
Cache-Control: no-cache, private
Transfer-Encoding: chunked
Connection: keep-alive
Content-Type: text/javascript; charset=utf-8
Expires: 0

GET
H2 200 close.svg
online.citi.com/CBOL/common/ui/ddl/theme/latest/images/icons/svgs/ 1 KB
1 KB 688ms
687ms Image
image/svg+xml 104.111.239.33
Akamai Technologies

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://online.citi.com/CBOL/common/ui/ddl/theme/latest/images/icons/svgs/close.svg

Requested by

Host: online.citi.com
URL: https://online.citi.com/CBOL/common/ui/ddl/theme/latest/scripts/vendor.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.111.239.33 , Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),

Reverse DNS

a104-111-239-33.deploy.static.akamaitechnologies.com

Software

Resource Hash

55e066703c69d4d89a1f4d66794d474aa93d710624d8f807096bac17a7867b17

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

Referer: https://online.citi.com/CBOL/common/ui/ddl/theme/latest/styles/ddl.min.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security: max-age=300
content-encoding: gzip
last-modified: Tue, 12 Sep 2017 17:20:58 GMT
x-akamai-citisite: GTDC
date: Tue, 17 Dec 2019 16:04:29 GMT
vary: Accept-Encoding
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
status: 200
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
accept-ranges: bytes
content-type: image/svg+xml
content-length: 641
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 200 iframe_api Show response
www.youtube.com/ 859 B
923 B 23ms
23ms Script
application/javascript 2a00:1450:4001:81f::200e
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://www.youtube.com/iframe_api

Requested by

Host: online.citi.com
URL: https://online.citi.com/CBOL/common/ui/ddl/theme/latest/scripts/ddl.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81f::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

YouTube Frontend Proxy /

Resource Hash

49d10b4e23ea6f98eecba90454ab5efe8415a4c63bd34b49cf89f60be55b028c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jEDelivery_DocCenterLetters
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Tue, 17 Dec 2019 16:04:28 GMT
x-content-type-options: nosniff
server: YouTube Frontend Proxy
content-type: application/javascript
status: 200
cache-control: no-cache
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 859
x-xss-protection: 0
expires: Tue, 27 Apr 1971 19:44:06 GMT

GET
H2 200 citilive-search-responsive.css
online.citi.com/JEA/CitiSearch/nexus-platform/css/ 58 KB
13 KB 65ms
64ms Stylesheet
text/css 104.111.239.33
Akamai Technologies

General

Check archive.org

Show headers Download Go to

Full URL

https://online.citi.com/JEA/CitiSearch/nexus-platform/css/citilive-search-responsive.css

Requested by

Host: online.citi.com
URL: https://online.citi.com/JEA/CitiSearch/nexus-platform/js/citilive-search.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.111.239.33 , Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),

Reverse DNS

a104-111-239-33.deploy.static.akamaitechnologies.com

Software

Resource Hash

766cc064fbabfd3bfff9c2a58c721cf28006076f642211778650f744057a9a1b

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

Referer: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jEDelivery_DocCenterLetters
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security: max-age=300
content-encoding: gzip
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
last-modified: Thu, 11 Jul 2019 10:22:32 GMT
x-akamai-citisite: GTDC
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
date: Tue, 17 Dec 2019 16:04:28 GMT
vary: Accept-Encoding
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
status: 200
cache-control: max-age=21600
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
content-type: text/css
content-length: 12498
expires: Tue, 17 Dec 2019 22:04:28 GMT

GET
H2 200 citilive-search-library.js Show response
online.citi.com/JEA/CitiSearch/nexus-platform/js/ 179 KB
61 KB 44ms
43ms Script
application/x-javascript 104.111.239.33
Akamai Technologies

General

Check archive.org

Show headers Download Go to

Full URL

https://online.citi.com/JEA/CitiSearch/nexus-platform/js/citilive-search-library.js

Requested by

Host: online.citi.com
URL: https://online.citi.com/JEA/CitiSearch/nexus-platform/js/citilive-search.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.111.239.33 , Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),

Reverse DNS

a104-111-239-33.deploy.static.akamaitechnologies.com

Software

Resource Hash

d57c8034f9c12aa3ce626c9ed1d61a4bb0941c3ef320bb59346f20496fb0096a

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

Referer: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jEDelivery_DocCenterLetters
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security: max-age=300
content-encoding: gzip
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
last-modified: Tue, 12 Sep 2017 16:59:12 GMT
x-akamai-citisite: GTDC
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
date: Tue, 17 Dec 2019 16:04:28 GMT
vary: Accept-Encoding
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
status: 200
cache-control: max-age=21600
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
content-type: application/x-javascript
content-length: 61658
expires: Tue, 17 Dec 2019 22:04:28 GMT

GET
H2 200 citilive-search-service.js Show response
online.citi.com/JEA/CitiSearch/nexus-platform/js/ 9 KB
3 KB 66ms
65ms Script
application/x-javascript 104.111.239.33
Akamai Technologies

General

Check archive.org

Show headers Download Go to

Full URL

https://online.citi.com/JEA/CitiSearch/nexus-platform/js/citilive-search-service.js

Requested by

Host: online.citi.com
URL: https://online.citi.com/JEA/CitiSearch/nexus-platform/js/citilive-search.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.111.239.33 , Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),

Reverse DNS

a104-111-239-33.deploy.static.akamaitechnologies.com

Software

Resource Hash

eec5cc477e7cb4f1eee1f26dce3eb411a63716d89a9b659c7d5559571c837ccb

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

Referer: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jEDelivery_DocCenterLetters
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security: max-age=300
content-encoding: gzip
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
last-modified: Tue, 11 Sep 2018 07:31:14 GMT
x-akamai-citisite: GTDC
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
date: Tue, 17 Dec 2019 16:04:28 GMT
vary: Accept-Encoding
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
status: 200
cache-control: max-age=21600
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
content-type: application/x-javascript
content-length: 2415
expires: Tue, 17 Dec 2019 22:04:28 GMT

GET
H2 200 citi-search-tmpl.js Show response
online.citi.com/JEA/CitiSearch/nexus-platform/js/ 18 KB
6 KB 67ms
66ms Script
application/x-javascript 104.111.239.33
Akamai Technologies

General

Check archive.org

Show headers Download Go to

Full URL

https://online.citi.com/JEA/CitiSearch/nexus-platform/js/citi-search-tmpl.js

Requested by

Host: online.citi.com
URL: https://online.citi.com/JEA/CitiSearch/nexus-platform/js/citilive-search.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.111.239.33 , Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),

Reverse DNS

a104-111-239-33.deploy.static.akamaitechnologies.com

Software

Resource Hash

61e114badfc7677a5ed175cf71afd46968ef8262cd4e5ec64ba0c743daae8e11

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

Referer: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jEDelivery_DocCenterLetters
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security: max-age=300
content-encoding: gzip
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
last-modified: Thu, 11 Jul 2019 10:22:32 GMT
x-akamai-citisite: GTDC
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
date: Tue, 17 Dec 2019 16:04:28 GMT
vary: Accept-Encoding
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
status: 200
cache-control: max-age=21600
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
content-type: application/x-javascript
content-length: 5146
expires: Tue, 17 Dec 2019 22:04:28 GMT

GET
H2 200 citilive-search-controller.js Show response
online.citi.com/JEA/CitiSearch/nexus-platform/js/ 110 KB
22 KB 76ms
76ms Script
application/x-javascript 104.111.239.33
Akamai Technologies

General

Check archive.org

Show headers Download Go to

Full URL

https://online.citi.com/JEA/CitiSearch/nexus-platform/js/citilive-search-controller.js

Requested by

Host: online.citi.com
URL: https://online.citi.com/JEA/CitiSearch/nexus-platform/js/citilive-search.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.111.239.33 , Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),

Reverse DNS

a104-111-239-33.deploy.static.akamaitechnologies.com

Software

Resource Hash

b26b012a661b8a5d50e672f209c9afb8189be7bc63621999dadff862355dd929

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

Referer: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jEDelivery_DocCenterLetters
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security: max-age=300
content-encoding: gzip
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
last-modified: Tue, 13 Aug 2019 07:17:14 GMT
x-akamai-citisite: GTDC
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
date: Tue, 17 Dec 2019 16:04:28 GMT
vary: Accept-Encoding
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
status: 200
cache-control: max-age=21600
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
content-type: application/x-javascript
content-length: 22444
expires: Tue, 17 Dec 2019 22:04:28 GMT

GET
H/1.1 200
OK 19469 Show response
stags.bluekai.com/site/ 0
0 261ms
196ms XHR
application/json 2.19.42.73
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://stags.bluekai.com/site/19469?ret=json
Requested by: Host: online.citi.com
URL: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jEDelivery_DocCenterLetters
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 2.19.42.73 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS: a2-19-42-73.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept: application/json, text/javascript, */*; q=0.01
Referer: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jEDelivery_DocCenterLetters
Origin: https://online.citi.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Access-Control-Allow-Origin: https://.citi.com
Access-Control-Allow-Headers: Content-Type, *
Access-Control-Allow-Credentials: true

GET
H/1.1 200
OK bk-coretag.js Show response
tags.bkrtx.com/js/ 27 KB
10 KB 108ms
32ms Script
text/javascript 104.108.41.26
Akamai Technologies

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.bkrtx.com/js/bk-coretag.js
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/code/33848276fda6dd0b45329f6aaea4158e.js?conditionId0=421908
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 104.108.41.26 , Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS: a104-108-41-26.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: 5cc280e965102224e1c7c0bd1df536c524c3a6fc9762205f4d7f7b345382c724

Request headers

Referer: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jEDelivery_DocCenterLetters
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Tue, 17 Dec 2019 16:04:28 GMT
Content-Encoding: gzip
Last-Modified: Wed, 21 Aug 2019 15:56:57 GMT
Server: Apache
ETag: "31600f9-6afc-590a29f6f4dd4"
Vary: Accept-Encoding
Content-Type: text/javascript
Cache-Control: max-age=604800
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 9603
Expires: Tue, 24 Dec 2019 16:04:28 GMT

GET
H2 200 cse_element__de.js Show response
www.google.com/cse/static/element/8b2252448421acb3/ 257 KB
85 KB 6ms
5ms Script
text/javascript 2a00:1450:4001:824::2004
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/cse/static/element/8b2252448421acb3/cse_element__de.js?usqp=CAI%3D

Requested by

Host: cse.google.com
URL: https://cse.google.com/cse/cse.js?cx=009695499870347544712:e3dyicpbrwu

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:824::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

sffe /

Resource Hash

2233a44f005e8d416636e52aca33bc7ce726c1ab4d0801865162829d762c6de2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jEDelivery_DocCenterLetters
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Sat, 14 Dec 2019 20:02:51 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Thu, 31 Oct 2019 16:49:36 GMT
server: sffe
age: 244897
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: public, max-age=31536000
accept-ranges: bytes
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 86952
x-xss-protection: 0
expires: Sun, 13 Dec 2020 20:02:51 GMT

GET
H2 200 default+de.css
www.google.com/cse/static/element/8b2252448421acb3/ 40 KB
9 KB 13ms
12ms Stylesheet
text/css 2a00:1450:4001:824::2004
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/cse/static/element/8b2252448421acb3/default+de.css

Requested by

Host: cse.google.com
URL: https://cse.google.com/cse/cse.js?cx=009695499870347544712:e3dyicpbrwu

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:824::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

sffe /

Resource Hash

40a20291f9b526cba58796a4bbd0256d5663313e02c9d5ab5a842476562b3108

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jEDelivery_DocCenterLetters
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Sat, 14 Dec 2019 20:02:55 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Thu, 31 Oct 2019 16:49:36 GMT
server: sffe
age: 244893
vary: Accept-Encoding
content-type: text/css
status: 200
cache-control: public, max-age=31536000
accept-ranges: bytes
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 9042
x-xss-protection: 0
expires: Sun, 13 Dec 2020 20:02:55 GMT

GET
H2 200 default.css
www.google.com/cse/static/style/look/v3/ 11 KB
3 KB 12ms
12ms Stylesheet
text/css 2a00:1450:4001:824::2004
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/cse/static/style/look/v3/default.css

Requested by

Host: cse.google.com
URL: https://cse.google.com/cse/cse.js?cx=009695499870347544712:e3dyicpbrwu

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:824::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

sffe /

Resource Hash

9ceaa25ec7654a66294c16e28989fbf1ecb9cebc9debe96ec597529465c7cd50

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jEDelivery_DocCenterLetters
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Tue, 17 Dec 2019 15:19:25 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Thu, 21 Nov 2019 23:30:00 GMT
server: sffe
age: 2703
vary: Accept-Encoding
content-type: text/css
status: 200
cache-control: public, max-age=3000
accept-ranges: bytes
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 2719
x-xss-protection: 0
expires: Tue, 17 Dec 2019 16:09:25 GMT

GET
H2 200 www-widgetapi.js Show response
s.ytimg.com/yts/jsbin/www-widgetapi-vflBs9Ibw/ 23 KB
9 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:818::200e
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://s.ytimg.com/yts/jsbin/www-widgetapi-vflBs9Ibw/www-widgetapi.js

Requested by

Host: www.youtube.com
URL: https://www.youtube.com/iframe_api

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:818::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

sffe /

Resource Hash

23050e3fd8c06313e53fc51fe03ebd265a5b60dec3ba8943b79a50c2f2b46e6f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jEDelivery_DocCenterLetters
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Mon, 16 Dec 2019 14:01:30 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 93778
status: 200
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 8775
x-xss-protection: 0
last-modified: Thu, 12 Dec 2019 22:28:59 GMT
server: sffe
vary: Accept-Encoding, Origin
content-type: text/javascript
cache-control: public, max-age=691200
accept-ranges: bytes
timing-allow-origin: https://www.youtube.com
expires: Tue, 24 Dec 2019 14:01:30 GMT

GET
H/1.1 200
OK logo.js Show response
mpsnare.iesnare.com/script/ 96 B
514 B 18ms
18ms Script
text/javascript 35.176.204.252
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL

https://mpsnare.iesnare.com/script/logo.js

Requested by

Host: mpsnare.iesnare.com
URL: https://mpsnare.iesnare.com/snare.js?_=1576598667909

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

35.176.204.252 London, United Kingdom, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),

Reverse DNS

ec2-35-176-204-252.eu-west-2.compute.amazonaws.com

Software

nginx /

Resource Hash

c41fd424900c92595986687d069149fbd35edf49c94cc3d1b09426e1023ad295

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains

Request headers

Referer: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jEDelivery_DocCenterLetters
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Tue, 17 Dec 2019 16:04:28 GMT
Content-Encoding: gzip
Last-Modified: Tue, 06 May 2014 00:01:40 GMT
Server: nginx
Strict-Transport-Security: max-age=15552000; includeSubDomains
p3p: CP="NON DSP COR CURa"
Cache-Control: private
Transfer-Encoding: chunked
Connection: keep-alive
Content-Type: text/javascript; charset=utf-8
Expires: Wed, 16 Dec 2020 16:04:28 GMT

GET
H/1.1 200
OK cr.png Show response
cfr.us.v2.we-stats.com/api/v1/ 0
582 B 474ms
130ms XHR
text/html 40.122.110.249
Microsoft Corpora...

General

Check archive.org

Show headers Download Go to

Full URL: https://cfr.us.v2.we-stats.com/api/v1/cr.png?cid=cedric&snum=1576598668567-sjn0000696-d2136492-03a2-4c0c-905d-468027b1ea86&muid=1576598668132-6A0D02A6-9D9C-49C8-93EE-4DCCD43204CA
Requested by: Host: online.citi.com
URL: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jEDelivery_DocCenterLetters
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 40.122.110.249 Des Moines, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US),
Reverse DNS
Software: nginx/1.12.0 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jEDelivery_DocCenterLetters
Origin: https://online.citi.com

Response headers

Date: Tue, 17 Dec 2019 16:04:29 GMT
Via: kong/0.11.0
Tail-Id: 1cc10ec6-8916-41bf-b82d-2f69a8395fbd
X-Kong-Proxy-Latency: 0
X-Kong-Upstream-Latency: 7
Connection: keep-alive
Content-Length: 0
Pragma: no-cache
Server: nginx/1.12.0
Vary: Origin
Access-Control-Allow-Methods: GET,POST,OPTIONS
Content-Type: text/html; charset=utf-8
Access-Control-Allow-Origin: https://online.citi.com
Cache-Control: no-cache, no-store
Access-Control-Allow-Credentials: true
Access-Control-Allow-Headers: Content-Type, Accept, ETag, x-requested-with, origin, cdorigin

POST
H2 200 BKDmpUpdate.action Show response
online.citi.com/US/DMP/ 3 KB
2 KB 186ms
186ms XHR
text/html 104.111.239.33
Akamai Technologies

General

Check archive.org

Show headers Download Go to

Full URL

https://online.citi.com/US/DMP/BKDmpUpdate.action?JFP_TOKEN=O9CLNDR2

Requested by

Host: online.citi.com
URL: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jEDelivery_DocCenterLetters

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.111.239.33 , Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),

Reverse DNS

a104-111-239-33.deploy.static.akamaitechnologies.com

Software

Resource Hash

e17da319eba14bc5a5677abdac48f8ef973597cca0c9733f8d3dd68bbc6faf81

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

Accept: */*
Referer: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jEDelivery_DocCenterLetters
Origin: https://online.citi.com
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security: max-age=300
content-encoding: gzip
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
status: 200
cid: gt07p-srv3, gt07p-srv3
x-ua-compatible: IE=edge, IE=edge
pragma: no-cache
x-akamai-citisite: GTDC
jid: 191217110428574684098922, 191217110428574684098922
date: Tue, 17 Dec 2019 16:04:28 GMT
vary: Accept-Encoding
content-language: en-US
expires: Thu, 01 Jan 1970 00:00:00 GMT
cache-control: no-cache, must-revalidate, proxy-revalidate, no-store
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
content-length: 1127
content-type: text/html;charset=ISO-8859-1
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

POST
H2 200 banner Show response
online.citi.com/gcgapi/prod/api/v1/marketing/offers/ 13 KB
5 KB 906ms
905ms XHR
application/json 104.111.239.33
Akamai Technologies

General

Check archive.org

Show headers Download Go to

Full URL

https://online.citi.com/gcgapi/prod/api/v1/marketing/offers/banner

Requested by

Host: online.citi.com
URL: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jEDelivery_DocCenterLetters

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.111.239.33 , Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),

Reverse DNS

a104-111-239-33.deploy.static.akamaitechnologies.com

Software

Resource Hash

a6b0008d4387ae103ceda17bbf0506d4aa06ee7e06a0f523e27eb10ea33b4151

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

Origin: https://online.citi.com
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: application/json
scope: VISITOR
Accept: application/json, text/javascript, */*; q=0.01
Referer: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jEDelivery_DocCenterLetters
countryCode: US
X-Requested-With: XMLHttpRequest
client_id: e83e6374-92f0-472c-8a6b-2ded64acc51c

Response headers

sid: 4f180038-d8eb-42d9-bf27-e87c80f566b9
content-encoding: gzip
nonce: 6256154460639797
router-host: api.citi.com
access-control-allow-origin: https://online.citi.com
status: 200
access-control-max-age: 2147483647
x-global-transaction-id: 218734185df8fc8c68ecb95f
uuid: ab5e75a5-3ef3-4104-b481-2df67fcbb525
content-length: 4163
pragma: no-cache
expires: -1
x-akamai-citisite: GTDC
date: Tue, 17 Dec 2019 16:04:29 GMT
vary: Accept-Encoding
access-control-allow-methods: GET,PUT,POST,DELETE,HEAD
content-type: application/json
x-backside-transport: OK OK,OK OK
x-vcap-request-id: 7e928924-2e5e-4836-427a-10204476b0c9,c14e7b7a-4eff-4fbe-6ded-1a535f2813c6
access-control-expose-headers: action,challengeType,bizToken,eventid,Eventid,Eventidexpirytime,eventidexpirytime,accesstoken,Authorization,sid,SessionId,CCPToken,CFIToken
cache-control: no-cache, no-store
access-control-allow-credentials: true
scope: VISITOR
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
access-control-allow-headers: action,challengeType,accesstoken,,Content-Type,sid,CCPToken,CFIToken,countryCode,businessCode,channelId,uuid,client_id,environmentId
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
dclocation: SW1
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

POST
H2 200 TMXProfile.jws Show response
online.citi.com/US/REST/ManageTMXProfile/ 264 B
843 B 178ms
178ms XHR
application/json 104.111.239.33
Akamai Technologies

General

Check archive.org

Show headers Download Go to

Full URL

https://online.citi.com/US/REST/ManageTMXProfile/TMXProfile.jws

Requested by

Host: online.citi.com
URL: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jEDelivery_DocCenterLetters

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.111.239.33 , Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),

Reverse DNS

a104-111-239-33.deploy.static.akamaitechnologies.com

Software

Resource Hash

b304ca37413007bd278d5932508cd4d380d14dd8a3b3a592e370c87d72c2eb2c

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

Accept: */*
Referer: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jEDelivery_DocCenterLetters
Origin: https://online.citi.com
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security: max-age=300
content-encoding: gzip
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
status: 200
cid: gt07p-srv3
x-ua-compatible: IE=edge
pragma: no-cache
x-akamai-citisite: GTDC
jid: 191217110428574684098922
date: Tue, 17 Dec 2019 16:04:29 GMT
vary: Accept-Encoding
content-language: en-US
expires: Thu, 01 Jan 1970 00:00:00 GMT
cache-control: no-cache, must-revalidate, proxy-revalidate, no-store
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
content-length: 232
content-type: application/json
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H/1.1 200
OK tags.js Show response
content22.online.citi.com/fp/ 48 KB
11 KB 134ms
28ms Script
text/javascript 91.235.134.21
ThreatMetrix Inc.

General

Check archive.org

Show headers Download Go to

Full URL

https://content22.online.citi.com/fp/tags.js?org_id=89oebq5k&session_id=d00039fdc1946ea1fda48026a8aeb1aec266508999ccf402cc3fdf6e85179bef&allow_reprofile=1

Requested by

Host: online.citi.com
URL: https://online.citi.com/TMX/TMXProfiling.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

91.235.134.21 , Netherlands, ASN30286 (THM - ThreatMetrix Inc., US),

Reverse DNS

Software

Apache /

Resource Hash

b27ce24dd8e47dc2a6786c29571b915ece9b640ace598d7c55736a90f12908c2

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jEDelivery_DocCenterLetters
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 17 Dec 2019 16:04:29 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Server: Apache
Strict-Transport-Security: max-age=31536000
P3P: CP=IVAa PSAa
Cache-Control: no-cache, no-store, must-revalidate
Transfer-Encoding: chunked
Connection: Keep-Alive, Keep-Alive
Content-Type: text/javascript;charset=UTF-8
Vary: Accept-Encoding
X-XSS-Protection: 1; mode=block
Keep-Alive: timeout=2, max=100
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H/1.1 200
OK up_loader.1.1.0.js Show response
js.adsrvr.org/ 4 KB
2 KB 119ms
40ms Script
application/x-javascript 143.204.97.29
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://js.adsrvr.org/up_loader.1.1.0.js
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 143.204.97.29 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: server-143-204-97-29.fra50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 3facb0fb4999f0b5d8116ce812c1d68d07b17782afb8cc480ae472ea6c5094fe

Request headers

Referer: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jEDelivery_DocCenterLetters
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Mon, 16 Dec 2019 21:20:44 GMT
Content-Encoding: gzip
Last-Modified: Tue, 19 Nov 2019 21:15:10 GMT
Server: AmazonS3
Age: 67461
Vary: Accept-Encoding
X-Cache: Hit from cloudfront
Content-Type: application/x-javascript
Via: 1.1 ea2e21f6a5c3ec2f96b0dac1b769e00e.cloudfront.net (CloudFront)
Transfer-Encoding: chunked
X-Amz-Cf-Pop: FRA50-C1
Connection: keep-alive
X-Amz-Cf-Id: vbG_pWR2UEQ3dwEeUk0OvJhVGhrUGJaK6ZSdcFOJzjDx5auaver8Iw==

GET
H2 200 1560.js Show response
cdn.pbbl.co/r/ 14 KB
4 KB 120ms
34ms Script
application/javascript 13.225.78.100
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.pbbl.co/r/1560.js

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/code/8637af7c210f4e79436bc39f71b49bfa.js?conditionId0=4827153

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

13.225.78.100 Seattle, United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),

Reverse DNS

server-13-225-78-100.fra2.r.cloudfront.net

Software

nginx/1.10.3 (Ubuntu) /

Resource Hash

a3910f4f1869b40c11bf01cc863271e22da872f4b68593e4ad56588d09ce9be8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Xss-Protection	1

Request headers

Referer: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jEDelivery_DocCenterLetters
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
age: 1431
x-cache: Hit from cloudfront
status: 200
x-xss-protection: 1
last-modified: Fri, 06 Dec 2019 20:57:17 GMT
server: nginx/1.10.3 (Ubuntu)
date: Tue, 17 Dec 2019 15:40:38 GMT
vary: Accept-Encoding
content-type: application/javascript
via: 1.1 999a435eb37a050d3de26fe63534c416.cloudfront.net (CloudFront)
cache-control: max-age=1800, public
x-amz-cf-pop: FRA2-C2
x-amz-cf-id: jAOz1GzVFKi2nqMeJY9nv9g0JAzC8YzShof4AKqjJLIRnSXM2IhEhQ==
expires: Sat, 07 Dec 2019 00:47:00 GMT

GET
H/1.1 200
OK tc.min.js Show response
c1.rfihub.net/js/ 20 KB
7 KB 134ms
44ms Script
application/x-javascript 104.103.83.50
Akamai Technologies

General

Check archive.org

Show headers Download Go to

Full URL: https://c1.rfihub.net/js/tc.min.js
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/code/3a25161527fddb076f26e799399f8cf2.js?conditionId0=467299
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 104.103.83.50 , Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS: a104-103-83-50.deploy.static.akamaitechnologies.com
Software: Jetty(9.0.6.v20130930) /
Resource Hash: cb2bb21705b9cce9781d02c9223f3344a65bd5314027d11c5a8518ad4bd84e84

Request headers

Referer: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jEDelivery_DocCenterLetters
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Tue, 17 Dec 2019 16:04:29 GMT
Content-Encoding: gzip
Last-Modified: Fri, 06 Dec 2019 17:23:52 GMT
Server: Jetty(9.0.6.v20130930)
Vary: Accept-Encoding
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Cache-Control: public, max-age=3600
Connection: keep-alive
Content-Type: application/x-javascript
Content-Length: 6375
Expires: Tue, 17 Dec 2019 17:04:29 GMT

GET
H2 204 425466.html
sr.rlcdn.com/ Frame 8B8D 0
0 141ms
116ms Document
text/plain 35.190.72.21
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL: https://sr.rlcdn.com/425466.html?es=80676&u=da39a3ee5e6b4b0d3255bfef95601890afd80709
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/code/3a25161527fddb076f26e799399f8cf2.js?conditionId0=467299
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.190.72.21 Mountain View, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS: 21.72.190.35.bc.googleusercontent.com
Software: /
Resource Hash

Request headers

:method: GET
:authority: sr.rlcdn.com
:scheme: https
:path: /425466.html?es=80676&u=da39a3ee5e6b4b0d3255bfef95601890afd80709
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
sec-fetch-site: cross-site
sec-fetch-mode: nested-navigate
referer: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jEDelivery_DocCenterLetters
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jEDelivery_DocCenterLetters

Response headers

status: 204
date: Tue, 17 Dec 2019 16:04:29 GMT
via: 1.1 google
alt-svc: clear

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 73 KB
27 KB 15ms
15ms Script
application/javascript 2a00:1450:4001:814::2008
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-959299794

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:814::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

33bb1e463cfdb062ef2c037beac1ec6f65b7b359be2ae19358d6fbcf66871504

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jEDelivery_DocCenterLetters
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Tue, 17 Dec 2019 16:04:29 GMT
content-encoding: br
last-modified: Tue, 17 Dec 2019 15:00:00 GMT
server: Google Tag Manager
access-control-allow-origin: http://www.googletagmanager.com
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
status: 200
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
content-length: 27815
x-xss-protection: 0
expires: Tue, 17 Dec 2019 16:04:29 GMT

GET
H2

200

s1708233699207
metrics1.citi.com/b/ss/citiuscombprod/1/JS-2.9.0/
Redirect Chain

https://metrics1.citi.com/b/ss/citiuscombprod/1/JS-2.9.0/s1708233699207?AQB=1&ndh=1&pf=1&t=17%2F11%2F2019%2017%3A4%3A29%202%20-60&fid=6DD56DCCD819679C-2CE8AA41689E2672&ce=UTF-8&g=https%3A%2F%2Fonli...
https://metrics1.citi.com/b/ss/citiuscombprod/1/JS-2.9.0/s1708233699207?AQB=1&pccr=true&vidn=2EFC7E468515FBE7-600009755789AF71&ndh=1&pf=1&t=17%2F11%2F2019%2017%3A4%3A29%202%20-60&fid=6DD56DCCD81967...

43 B
267 B

36ms
35ms

Image
image/gif

15.188.31.119
Amazon.com

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://metrics1.citi.com/b/ss/citiuscombprod/1/JS-2.9.0/s1708233699207?AQB=1&pccr=true&vidn=2EFC7E468515FBE7-600009755789AF71&ndh=1&pf=1&t=17%2F11%2F2019%2017%3A4%3A29%202%20-60&fid=6DD56DCCD819679C-2CE8AA41689E2672&ce=UTF-8&g=https%3A%2F%2Fonline.citi.com%2FUS%2FJRS%2Finfrastructure%2Ftarget.do%3Fnext_page%3Djfp%7CjEDelivery_DocCenterLetters&r=https%3A%2F%2Ffm.info6.citi.com%2Fats%2Furl.aspx%3Fcr%3D617%26wu%3D1%26we%3D1%26url%3Dhttps%253A%252F%252Fwww.accountonline.com%252Fcards%252Fsvc%252FLogin.do%253FNEXT_SCREEN%253D%252FDocctr%2526siteId%253DCB%2526accountIndex%253D%2526enid%253D06895BACB5C94FD6EC024F9CBFC462EE62C6%26linkName%3DCN_ECOMM_CENTER_URL%26transId%3DI2019121500064199&c.&site_events=banner_displayed&country=US&common_hierarchy=us%7Cweb&action_type=page%20view&language=en_US&authentication_type=web%7Cpassword%7Cnon-ti%7Cciti%7Cl1.0&site_hierarchy_0=us&site_hierarchy_1=web&site_hierarchy_2=public&site_hierarchy_3=marketing&site_hierarchy_4=home&platform_type=Web%20browser&user_agent=Mozilla%2F5.0%20%28Macintosh%3B%20Intel%20Mac%20OS%20X%2010_14_5%29%20AppleWebKit%2F537.36%20%28KHTML%2C%20like%20Gecko%29%20Chrome%2F74.0.3729.169%20Safari%2F537.36&test_id=183_3_0%20citi.com%20Homepage-Offers-Banners%20Displayed&evarPageName_0=us&evarPageName_1=web&evarPageName_2=public&evarPageName_3=marketing&evarPageName_4=home&evarPageName_5=citi&CUUID=e1390b51-81ee-4217-91ac-54c805fa3786&url=https%3A%2F%2Fonline.citi.com%2FUS%2FJRS%2Finfrastructure%2Ftarget.do%3Fnext_page%3Djfp%7CjEDelivery_DocCenterLetters&site_name=US&customer_profile_string=%23&track_id=9667593317%7C2019-12-17T16%3A04%3A28.605Z&domain=online.citi.com&authentication_status=not%20authenticated&lob=mrc&app_hierarchy=public%7Cmarketing%7Chome%7Cciti&lead_type=citi.com%7Chome&event=banner_displayed&site_events_0=banner_displayed&responsive_design_data=1600%7CDesktop%7CNo&Platform=Desktop&login_status=prospect&.c&cc=USD&c7=11%3A04%20AM%7CTuesday&v7=11%3A04%20AM%7CTuesday&v11=New&c65=Non%20Cookied%20Username%20Password%20&v85=c3ca17be-2ed8-4524-bf48-d504467ef50e&s=1600x1200&c=24&j=1.6&v=N&k=Y&bw=1600&bh=1200&AQE=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

15.188.31.119 Paris, France, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),

Reverse DNS

ec2-15-188-31-119.eu-west-3.compute.amazonaws.com

Software

jag /

Resource Hash

a1ecbaed793a1f564c49c671f2dd0ce36f858534ef6d26b55783a06b884cc506

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jEDelivery_DocCenterLetters
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Tue, 17 Dec 2019 16:04:28 GMT
x-content-type-options: nosniff
x-c: master-1061.Iecc33a.M0-311
p3p: CP="This is not a P3P policy"
status: 200
content-length: 43
x-xss-protection: 1; mode=block
pragma: no-cache
last-modified: Wed, 18 Dec 2019 16:04:29 GMT
server: jag
xserver: anedge-5fc496b8d4-hs4rv
etag: 3385719861221359616-4619574008655731150
vary: *
content-type: image/gif;charset=utf-8
access-control-allow-origin: *
cache-control: no-cache, no-store, max-age=0, no-transform, private
expires: Mon, 16 Dec 2019 16:04:29 GMT

Redirect headers

date: Tue, 17 Dec 2019 16:04:28 GMT
x-content-type-options: nosniff
x-c: master-1061.Iecc33a.M0-311
p3p: CP="This is not a P3P policy"
status: 302
content-length: 0
x-xss-protection: 1; mode=block
pragma: no-cache
last-modified: Wed, 18 Dec 2019 16:04:29 GMT
server: jag
xserver: anedge-5fc496b8d4-kvd78
location: https://metrics1.citi.com/b/ss/citiuscombprod/1/JS-2.9.0/s1708233699207?AQB=1&pccr=true&vidn=2EFC7E468515FBE7-600009755789AF71&ndh=1&pf=1&t=17%2F11%2F2019%2017%3A4%3A29%202%20-60&fid=6DD56DCCD819679C-2CE8AA41689E2672&ce=UTF-8&g=https%3A%2F%2Fonline.citi.com%2FUS%2FJRS%2Finfrastructure%2Ftarget.do%3Fnext_page%3Djfp%7CjEDelivery_DocCenterLetters&r=https%3A%2F%2Ffm.info6.citi.com%2Fats%2Furl.aspx%3Fcr%3D617%26wu%3D1%26we%3D1%26url%3Dhttps%253A%252F%252Fwww.accountonline.com%252Fcards%252Fsvc%252FLogin.do%253FNEXT_SCREEN%253D%252FDocctr%2526siteId%253DCB%2526accountIndex%253D%2526enid%253D06895BACB5C94FD6EC024F9CBFC462EE62C6%26linkName%3DCN_ECOMM_CENTER_URL%26transId%3DI2019121500064199&c.&site_events=banner_displayed&country=US&common_hierarchy=us%7Cweb&action_type=page%20view&language=en_US&authentication_type=web%7Cpassword%7Cnon-ti%7Cciti%7Cl1.0&site_hierarchy_0=us&site_hierarchy_1=web&site_hierarchy_2=public&site_hierarchy_3=marketing&site_hierarchy_4=home&platform_type=Web%20browser&user_agent=Mozilla%2F5.0%20%28Macintosh%3B%20Intel%20Mac%20OS%20X%2010_14_5%29%20AppleWebKit%2F537.36%20%28KHTML%2C%20like%20Gecko%29%20Chrome%2F74.0.3729.169%20Safari%2F537.36&test_id=183_3_0%20citi.com%20Homepage-Offers-Banners%20Displayed&evarPageName_0=us&evarPageName_1=web&evarPageName_2=public&evarPageName_3=marketing&evarPageName_4=home&evarPageName_5=citi&CUUID=e1390b51-81ee-4217-91ac-54c805fa3786&url=https%3A%2F%2Fonline.citi.com%2FUS%2FJRS%2Finfrastructure%2Ftarget.do%3Fnext_page%3Djfp%7CjEDelivery_DocCenterLetters&site_name=US&customer_profile_string=%23&track_id=9667593317%7C2019-12-17T16%3A04%3A28.605Z&domain=online.citi.com&authentication_status=not%20authenticated&lob=mrc&app_hierarchy=public%7Cmarketing%7Chome%7Cciti&lead_type=citi.com%7Chome&event=banner_displayed&site_events_0=banner_displayed&responsive_design_data=1600%7CDesktop%7CNo&Platform=Desktop&login_status=prospect&.c&cc=USD&c7=11%3A04%20AM%7CTuesday&v7=11%3A04%20AM%7CTuesday&v11=New&c65=Non%20Cookied%20Username%20Password%20&v85=c3ca17be-2ed8-4524-bf48-d504467ef50e&s=1600x1200&c=24&j=1.6&v=N&k=Y&bw=1600&bh=1200&AQE=1
content-type: text/plain
access-control-allow-origin: *
cache-control: no-cache, no-store, max-age=0, no-transform, private
expires: Mon, 16 Dec 2019 16:04:29 GMT

GET
H2 200 generic1576511475762.js Show response
resources.digital-cloud-citi.medallia.com/wdcusciti/50/onsite/ 282 KB
55 KB 34ms
34ms Script
application/javascript 151.101.14.133
Fastly

General

Check archive.org

Show headers Download Go to

Full URL: https://resources.digital-cloud-citi.medallia.com/wdcusciti/50/onsite/generic1576511475762.js
Requested by: Host: resources.digital-cloud-citi.medallia.com
URL: https://resources.digital-cloud-citi.medallia.com/wdcusciti/50/onsite/embed.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.14.133 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 611fd3e72460fd66a5e6cd3857ab8b7d2099d16e8769854d3273728ba8da5609

Request headers

Referer: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jEDelivery_DocCenterLetters
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-amz-version-id: c_VGJGZGBIHj23MKuXRZx.4CmdsyTYYg
content-encoding: gzip
age: 36
x-cache: HIT
status: 200
date: Tue, 17 Dec 2019 16:04:29 GMT
content-length: 56099
x-amz-id-2: EBBjP26mZyE4a1Mq5xyzRMV9HY/WlGfLo4k3n/aToaMO3bzjk/jRwUVKM+5YcxXqMecWPINwB7Q=
x-served-by: cache-fra19173-FRA
access-control-allow-origin: *
last-modified: Mon, 16 Dec 2019 15:51:16 GMT
server: AmazonS3
x-timer: S1576598669.285464,VS0,VE1
etag: "134e5a3a9e655fbd061dc61f1e7300e1"
vary: Accept-Encoding
x-amz-request-id: C7995F4CE3E47CF7
via: 1.1 varnish
cache-control: max-age=0,must-revalidate
accept-ranges: bytes
content-type: application/javascript
x-cache-hits: 1

GET
H/1.1 200
OK 63068
stags.bluekai.com/site/ Frame 2656 0
0 179ms
179ms Document
text/html 2.19.42.73
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://stags.bluekai.com/site/63068?ret=html&phint=language%3Denglish&phint=product%3D&phint=event&phint=category%3Dpre-login%20Sign%20on%20page&phint=page%3DNon%20Cookied%20Username%20Password%20&phint=section1%3DPublic&phint=section2%3DSignOn&phint=section3%3D&phint=section4%3D&phint=bankappstatus&phint=productID&phint=__bk_t%3DOnline%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&phint=__bk_k%3Dbanking%2C%20citi%2C%20financial%20services%2C%20checking%20account%2C%20savings%20account%2C%20credit%20cards&phint=__bk_pr%3Dhttps%3A%2F%2Ffm.info6.citi.com%2Fats%2Furl.aspx%3Fcr%3D617%26wu%3D1%26we%3D1%26url%3Dhttps%253A%252F%252Fwww.accountonline.com%252Fcards%252Fsvc%252FLogin.do%253FNEXT_SCREEN%253D%252FDocctr%2526siteId%253DCB%2526accountIndex%253D%2526enid%253D06895BACB5C94FD6EC024F9CBFC462EE62C6%26linkName%3DCN_ECOMM_CENTER_URL%26transId%3DI2019121500064199&phint=__bk_l%3Dhttps%3A%2F%2Fonline.citi.com%2FUS%2FJRS%2Finfrastructure%2Ftarget.do%3Fnext_page%3Djfp%7CjEDelivery_DocCenterLetters&phint=__bk_v%3D3.1.3&limit=10&r=13852848
Requested by: Host: tags.bkrtx.com
URL: https://tags.bkrtx.com/js/bk-coretag.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 2.19.42.73 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS: a2-19-42-73.deploy.static.akamaitechnologies.com
Software: /
Resource Hash

Request headers

Host: stags.bluekai.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: nested-navigate
Referer: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jEDelivery_DocCenterLetters
Accept-Encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jEDelivery_DocCenterLetters

Response headers

Content-Type: text/html
Content-Length: 71
P3P: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV", policyref="http://tags.bluekai.com/w3c/p3p.xml"
BK-Server: 6be
Date: Tue, 17 Dec 2019 16:04:29 GMT
Connection: keep-alive
X-N: S

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 73 KB
27 KB 15ms
15ms Script
application/javascript 2a00:1450:4001:814::2008
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=DC-6260004

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:814::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

cbf569977293d3a9fee6a398651ef879fe6346c14701cee0a81999f5f53624bf

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jEDelivery_DocCenterLetters
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Tue, 17 Dec 2019 16:04:29 GMT
content-encoding: br
last-modified: Tue, 17 Dec 2019 15:00:00 GMT
server: Google Tag Manager
access-control-allow-origin: http://www.googletagmanager.com
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
status: 200
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
content-length: 27808
x-xss-protection: 0
expires: Tue, 17 Dec 2019 16:04:29 GMT

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 73 KB
27 KB 16ms
15ms Script
application/javascript 2a00:1450:4001:814::2008
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=DC-6269322

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:814::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

7e9cb68deaf125403ba6bf1fa5b9e079e2c78017178b6eccdb3ad7203aae6060

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jEDelivery_DocCenterLetters
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Tue, 17 Dec 2019 16:04:29 GMT
content-encoding: br
last-modified: Tue, 17 Dec 2019 15:00:00 GMT
server: Google Tag Manager
access-control-allow-origin: http://www.googletagmanager.com
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
status: 200
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
content-length: 27809
x-xss-protection: 0
expires: Tue, 17 Dec 2019 16:04:29 GMT

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 73 KB
27 KB 16ms
16ms Script
application/javascript 2a00:1450:4001:814::2008
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=DC-6256710

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:814::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

bcd5dbc93689dadb8a39793965b6e8ecbd485fbd0860c663287438eb1e8a2f3d

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jEDelivery_DocCenterLetters
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Tue, 17 Dec 2019 16:04:29 GMT
content-encoding: br
last-modified: Tue, 17 Dec 2019 15:00:00 GMT
server: Google Tag Manager
access-control-allow-origin: http://www.googletagmanager.com
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
status: 200
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
content-length: 27809
x-xss-protection: 0
expires: Tue, 17 Dec 2019 16:04:29 GMT

GET
H2 200 conversion_async.js Show response
www.googleadservices.com/pagead/ 26 KB
10 KB 71ms
70ms Script
text/javascript 172.217.22.34
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googleadservices.com/pagead/conversion_async.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-959299794

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.22.34 , United States, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

fra15s16-in-f2.1e100.net

Software

cafe /

Resource Hash

77ce0ec2a02b410eee12285bd7487b2599970ac39b6ff58c0b748b6e2df36f3c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jEDelivery_DocCenterLetters
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Tue, 17 Dec 2019 16:04:29 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
content-disposition: attachment; filename="f.txt"
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 9933
x-xss-protection: 0
server: cafe
etag: 9795501548502167919
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600
timing-allow-origin: *
expires: Tue, 17 Dec 2019 16:04:29 GMT

GET
H2 200 cool-2.1.15.min.js Show response
nebula-cdn.kampyle.com/resources/onsite/js/ 14 KB
5 KB 107ms
33ms Script
application/javascript 151.101.13.175
Fastly

General

Check archive.org

Show headers Download Go to

Full URL: https://nebula-cdn.kampyle.com/resources/onsite/js/cool-2.1.15.min.js
Requested by: Host: resources.digital-cloud-citi.medallia.com
URL: https://resources.digital-cloud-citi.medallia.com/wdcusciti/50/onsite/generic1576511475762.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.13.175 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 3e72de5de67d6d80b65a114af684eaf880c53c250155a663cb17d677ff064bc1

Request headers

Referer: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jEDelivery_DocCenterLetters
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Tue, 17 Dec 2019 16:04:29 GMT
content-encoding: gzip
age: 0
via: 1.1 varnish, 1.1 varnish
x-cache: HIT, HIT
status: 200
content-length: 5197
x-amz-request-id: 181D27FC25E05628
x-amz-id-2: ulS9QpU8dN03o8UipRlkmnlw7PCEbNe+ZIdtHDr9GCnXL/Cra6xwws9CqcFzqRIalW97XqJ7AcQ=
x-served-by: cache-iad2144-IAD, cache-fra19164-FRA
last-modified: Wed, 20 Nov 2019 10:02:07 GMT
server: AmazonS3
x-timer: S1576598669.446613,VS0,VE0
etag: "80dd5e3be5152c5c72d552c6a26ef6ff"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=31536000
accept-ranges: bytes
x-cache-hits: 1, 306328

GET
H2 200 copy_copy_1551286869362_Feedback.png
resources.digital-cloud-citi.medallia.com/wdcusciti/50/resources/image/ 2 KB
2 KB 33ms
33ms Image
image/png 151.101.14.133
Fastly

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://resources.digital-cloud-citi.medallia.com/wdcusciti/50/resources/image/copy_copy_1551286869362_Feedback.png
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.14.133 Frankfurt am Main, Germany, ASN54113 (FASTLY - Fastly, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 506575b752d10714465811aec4dd67a7bfb471fcbc2e9619c1faad68c110759e

Request headers

Referer: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jEDelivery_DocCenterLetters
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-amz-version-id: c4QPIOt7jeoG0ZVKM.gnL_o4mPR3HO8Y
content-encoding: gzip
age: 72
x-cache: HIT
status: 200
date: Tue, 17 Dec 2019 16:04:29 GMT
content-length: 2016
x-amz-id-2: bTisnOzXhMihBkZttz2EqwI+96BXiC2S/91RZhqMUICSfJs4m3Hhm5arsmgDNEa2r88+1U+IBE0=
x-served-by: cache-fra19173-FRA
access-control-allow-origin: *
last-modified: Thu, 14 Nov 2019 20:30:23 GMT
server: AmazonS3
x-timer: S1576598669.393447,VS0,VE0
etag: "8515c838c29a9151befa4f4350e41381"
vary: Accept-Encoding
x-amz-request-id: CBF05E0A67C0EDF7
via: 1.1 varnish
cache-control: max-age=0,must-revalidate
accept-ranges: bytes
content-type: image/png
x-cache-hits: 1

GET
H2

200

adadvisor.gif
px0.pbbl.co/
Redirect Chain

https://px0.pbbl.co/ns/__p2.gif?brid=1560&brcid=e1390b51-81ee-4217-91ac-54c805fa3786&email=&orderId=&orderValue=&productId=&offerCode=&label=&pageUrl=https%3A%2F%2Fonline.citi.com%2FUS%2FJRS%2Finfr...
https://aa.agkn.com/adscores/g.pixel?sid=9212282598&_ppid=157f818f-27bf-498b-a867-81409fa37f80&_segid=99&iid=d30b3bf6-7624-415f-a251-ec1795b76b91
https://px0.pbbl.co/adadvisor.gif?segment=000&_ppid=157f818f-27bf-498b-a867-81409fa37f80&_segid=99&_zip=&hk=&iid=d30b3bf6-7624-415f-a251-ec1795b76b91&mt=&bd=

42 B
152 B

135ms
135ms

Image
image/gif

2a00:1450:4001:818::2013
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://px0.pbbl.co/adadvisor.gif?segment=000&_ppid=157f818f-27bf-498b-a867-81409fa37f80&_segid=99&_zip=&hk=&iid=d30b3bf6-7624-415f-a251-ec1795b76b91&mt=&bd=

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:818::2013 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

Google Frontend /

Resource Hash

99c2917ee5b2a01459a923bdd1c676f15ee73b62b87f696e6735312d26f51e12

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1

Request headers

Referer: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jEDelivery_DocCenterLetters
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 17 Dec 2019 16:04:29 GMT
x-content-type-options: nosniff
server: Google Frontend
content-type: image/gif; charset=utf-8
status: 200
x-cloud-trace-context: 71ab6cfa77acc8c2102bc7c735803cdd
cache-control: must-revalidate, no-cache, no-store
content-length: 42
x-xss-protection: 1
expires: 0

Redirect headers

pragma: no-cache
date: Tue, 17 Dec 2019 16:04:29 GMT
server: AAWebServer
location: https://px0.pbbl.co/adadvisor.gif?segment=000&_ppid=157f818f-27bf-498b-a867-81409fa37f80&_segid=99&_zip=&hk=&iid=d30b3bf6-7624-415f-a251-ec1795b76b91&mt=&bd=
p3p: policyref="http://www.agkn.com/p3p/p3p.xml",CP="NOI NID"
status: 302
cache-control: no-cache, no-store, must-revalidate
content-length: 0
expires: 0

GET
H/1.1 200
OK idr.js Show response
a.rfihub.com/ 83 B
635 B 102ms
27ms Script
application/javascript 193.0.160.129
Rocket Fuel Inc.

General

Check archive.org

Show headers Download Go to

Full URL: https://a.rfihub.com/idr.js?_callback=window.RocketfuelBCP.jsonpCallbacks.request_cmZpSWRJbkNhY2hl
Requested by: Host: c1.rfihub.net
URL: https://c1.rfihub.net/js/tc.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_256_CBC
Server: 193.0.160.129 , Netherlands, ASN54312 (ROCKETFUEL - Rocket Fuel Inc., US),
Reverse DNS
Software: Jetty(9.0.6.v20130930) /
Resource Hash: 6abcda99c0a48d8eb3996a4c0651257bae8cbbba77538baeb4be33b0ccb9ff42

Request headers

Referer: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jEDelivery_DocCenterLetters
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Cache-Control: public, max-age=33696000
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Server: Jetty(9.0.6.v20130930)
Content-Type: application/javascript
Content-Length: 83
Expires: Sun, 10 Jan 2021 16:04:29 GMT

GET
H/1.1 200
OK check.js;CIS3SID=62CB603BA5FCA3A6F5F890B528CA28B7 Show response
content22.online.citi.com/fp/ Frame 5690 181 KB
48 KB 37ms
36ms Script
text/javascript 91.235.134.21
ThreatMetrix Inc.

General

Check archive.org

Show headers Download Go to

Full URL

https://content22.online.citi.com/fp/check.js;CIS3SID=62CB603BA5FCA3A6F5F890B528CA28B7?org_id=89oebq5k&session_id=d00039fdc1946ea1fda48026a8aeb1aec266508999ccf402cc3fdf6e85179bef&nonce=99b8914f359a7962&pageid=1&jb=33372626687b6d753f4c616e7778266a716f3d4c616e777a266273623f4368726d6f672732303f3c

Requested by

Host: content22.online.citi.com
URL: https://content22.online.citi.com/fp/tags.js?org_id=89oebq5k&session_id=d00039fdc1946ea1fda48026a8aeb1aec266508999ccf402cc3fdf6e85179bef&allow_reprofile=1

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

91.235.134.21 , Netherlands, ASN30286 (THM - ThreatMetrix Inc., US),

Reverse DNS

Software

Apache /

Resource Hash

d2fad3207cd7cfc62b3808a7f284bf130e116bb629df4e4dbb9fda4edd439493

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jEDelivery_DocCenterLetters
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 17 Dec 2019 16:04:29 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Server: Apache
Strict-Transport-Security: max-age=31536000
Content-Type: text/javascript;charset=UTF-8
Cache-Control: no-cache, no-store, must-revalidate
Transfer-Encoding: chunked
tmx-nonce: 99b8914f359a7962
Connection: Keep-Alive, Keep-Alive
Vary: Accept-Encoding
X-XSS-Protection: 1; mode=block
Keep-Alive: timeout=2, max=99
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H/1.1 200
OK clear.png
content22.online.citi.com/fp/ Frame 5690 81 B
475 B 73ms
24ms Image
image/png 91.235.134.21
ThreatMetrix Inc.

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://content22.online.citi.com/fp/clear.png?org_id=89oebq5k&session_id=d00039fdc1946ea1fda48026a8aeb1aec266508999ccf402cc3fdf6e85179bef&nonce=99b8914f359a7962&pageid=1&w=c81d0f9c7f18755d&ck=0&m=1

Requested by

Host: content22.online.citi.com
URL: https://content22.online.citi.com/fp/tags.js?org_id=89oebq5k&session_id=d00039fdc1946ea1fda48026a8aeb1aec266508999ccf402cc3fdf6e85179bef&allow_reprofile=1

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

91.235.134.21 , Netherlands, ASN30286 (THM - ThreatMetrix Inc., US),

Reverse DNS

Software

Apache /

Resource Hash

95518cbec0d55a574a9c8ef72a2a7d62ac0d40a4de5dfe67a76a7d214dc8b743

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jEDelivery_DocCenterLetters
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 17 Dec 2019 16:04:29 GMT
X-Content-Type-Options: nosniff
Server: Apache
Strict-Transport-Security: max-age=31536000
Content-Type: image/png
Cache-Control: no-cache, no-store, must-revalidate
Connection: Keep-Alive
Keep-Alive: timeout=2, max=100
Content-Length: 81
X-XSS-Protection: 1; mode=block
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H/1.1 200
OK clear.png
content22.online.citi.com/fp/ Frame 5690 81 B
475 B 69ms
23ms Image
image/png 91.235.134.21
ThreatMetrix Inc.

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://content22.online.citi.com/fp/clear.png?org_id=89oebq5k&session_id=d00039fdc1946ea1fda48026a8aeb1aec266508999ccf402cc3fdf6e85179bef&nonce=99b8914f359a7962&pageid=1&ck=0&m=2

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

91.235.134.21 , Netherlands, ASN30286 (THM - ThreatMetrix Inc., US),

Reverse DNS

Software

Apache /

Resource Hash

95518cbec0d55a574a9c8ef72a2a7d62ac0d40a4de5dfe67a76a7d214dc8b743

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jEDelivery_DocCenterLetters
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 17 Dec 2019 16:04:29 GMT
X-Content-Type-Options: nosniff
Server: Apache
Strict-Transport-Security: max-age=31536000
Content-Type: image/png
Cache-Control: no-cache, no-store, must-revalidate
Connection: Keep-Alive
Keep-Alive: timeout=2, max=100
Content-Length: 81
X-XSS-Protection: 1; mode=block
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2 200 up
insight.adsrvr.org/track/ Frame B9AE 0
0 92ms
27ms Document
text/html 34.248.255.146
Amazon.com

General

Check archive.org

Show headers Download Go to

Full URL: https://insight.adsrvr.org/track/up?adv=1jw5cvl&ref=https%3A%2F%2Fonline.citi.com%2FUS%2FJRS%2Finfrastructure%2Ftarget.do%3Fnext_page%3Djfp%7CjEDelivery_DocCenterLetters&upid=t1sl5ty&upv=1.1.0&orderid={orderid}&v={v}&vf={vf}&td1=jUSCBOL_Loginpage_Uncookied&td2=undefined&td3=undefined&td4=Non%20Cookied%20Username%20Password%20&td5=https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jEDelivery_DocCenterLetters&td6={td6}&td7={td7}&td8={td8}&td9={td9}&td10={td10}
Requested by: Host: js.adsrvr.org
URL: https://js.adsrvr.org/up_loader.1.1.0.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.248.255.146 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS: ec2-34-248-255-146.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash

Request headers

:method: GET
:authority: insight.adsrvr.org
:scheme: https
:path: /track/up?adv=1jw5cvl&ref=https%3A%2F%2Fonline.citi.com%2FUS%2FJRS%2Finfrastructure%2Ftarget.do%3Fnext_page%3Djfp%7CjEDelivery_DocCenterLetters&upid=t1sl5ty&upv=1.1.0&orderid={orderid}&v={v}&vf={vf}&td1=jUSCBOL_Loginpage_Uncookied&td2=undefined&td3=undefined&td4=Non%20Cookied%20Username%20Password%20&td5=https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jEDelivery_DocCenterLetters&td6={td6}&td7={td7}&td8={td8}&td9={td9}&td10={td10}
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
sec-fetch-site: cross-site
sec-fetch-mode: nested-navigate
referer: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jEDelivery_DocCenterLetters
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jEDelivery_DocCenterLetters

Response headers

status: 200
date: Tue, 17 Dec 2019 16:04:29 GMT
content-type: text/html
cache-control: private,no-cache, must-revalidate
pragma: no-cache
x-aspnet-version: 4.0.30319
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"

GET
H2 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/959299794/ 3 KB
1 KB 24ms
24ms Script
text/javascript 2a00:1450:4001:819::2002
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/959299794/?random=1576598669428&cv=9&fst=1576598669428&num=1&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=3&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2oac61&sendb=1&ig=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fonline.citi.com%2FUS%2FJRS%2Finfrastructure%2Ftarget.do%3Fnext_page%3Djfp%7CjEDelivery_DocCenterLetters&ref=https%3A%2F%2Ffm.info6.citi.com%2Fats%2Furl.aspx%3Fcr%3D617%26wu%3D1%26we%3D1%26url%3Dhttps%253A%252F%252Fwww.accountonline.com%252Fcards%252Fsvc%252FLogin.do%253FNEXT_SCREEN%253D%252FDocctr%2526siteId%253DCB%2526accountIndex%253D%2526enid%253D06895BACB5C94FD6EC024F9CBFC462EE62C6%26linkName%3DCN_ECOMM_CENTER_URL%26transId%3DI2019121500064199&tiba=Online%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4

Requested by

Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/conversion_async.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:819::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

cafe /

Resource Hash

b0f51bae22380b27abb7624d21db9815159b3c5ec970e9b9f32392e8c173eaf4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jEDelivery_DocCenterLetters
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 17 Dec 2019 16:04:29 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-type: text/javascript; charset=UTF-8
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status: 200
cache-control: no-cache, must-revalidate
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 1323
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/960621875/ 3 KB
1 KB 35ms
35ms Script
text/javascript 2a00:1450:4001:819::2002
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/960621875/?random=1576598669431&cv=9&fst=1576598669431&num=1&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=3&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2oac61&sendb=1&ig=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fonline.citi.com%2FUS%2FJRS%2Finfrastructure%2Ftarget.do%3Fnext_page%3Djfp%7CjEDelivery_DocCenterLetters&ref=https%3A%2F%2Ffm.info6.citi.com%2Fats%2Furl.aspx%3Fcr%3D617%26wu%3D1%26we%3D1%26url%3Dhttps%253A%252F%252Fwww.accountonline.com%252Fcards%252Fsvc%252FLogin.do%253FNEXT_SCREEN%253D%252FDocctr%2526siteId%253DCB%2526accountIndex%253D%2526enid%253D06895BACB5C94FD6EC024F9CBFC462EE62C6%26linkName%3DCN_ECOMM_CENTER_URL%26transId%3DI2019121500064199&tiba=Online%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4

Requested by

Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/conversion_async.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:819::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

cafe /

Resource Hash

c8fe5355de63175b075e146aa0a789670eac062523f7bf228eb62d19d6bd0f1d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jEDelivery_DocCenterLetters
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 17 Dec 2019 16:04:29 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-type: text/javascript; charset=UTF-8
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status: 200
cache-control: no-cache, must-revalidate
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 1323
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/770961656/ 3 KB
1 KB 23ms
22ms Script
text/javascript 2a00:1450:4001:819::2002
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/770961656/?random=1576598669432&cv=9&fst=1576598669432&num=1&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=3&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2oac61&sendb=1&ig=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fonline.citi.com%2FUS%2FJRS%2Finfrastructure%2Ftarget.do%3Fnext_page%3Djfp%7CjEDelivery_DocCenterLetters&ref=https%3A%2F%2Ffm.info6.citi.com%2Fats%2Furl.aspx%3Fcr%3D617%26wu%3D1%26we%3D1%26url%3Dhttps%253A%252F%252Fwww.accountonline.com%252Fcards%252Fsvc%252FLogin.do%253FNEXT_SCREEN%253D%252FDocctr%2526siteId%253DCB%2526accountIndex%253D%2526enid%253D06895BACB5C94FD6EC024F9CBFC462EE62C6%26linkName%3DCN_ECOMM_CENTER_URL%26transId%3DI2019121500064199&tiba=Online%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4

Requested by

Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/conversion_async.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:819::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

cafe /

Resource Hash

47cc30597372e369ba12ab37f11a90ce3203edbf8c7d444f0ceaeae924918c66

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jEDelivery_DocCenterLetters
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 17 Dec 2019 16:04:29 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-type: text/javascript; charset=UTF-8
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status: 200
cache-control: no-cache, must-revalidate
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 1323
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/916451471/ 3 KB
1 KB 23ms
23ms Script
text/javascript 2a00:1450:4001:819::2002
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/916451471/?random=1576598669433&cv=9&fst=1576598669433&num=1&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=3&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2oac61&sendb=1&ig=1&data=event%3Dconversion&frm=0&url=https%3A%2F%2Fonline.citi.com%2FUS%2FJRS%2Finfrastructure%2Ftarget.do%3Fnext_page%3Djfp%7CjEDelivery_DocCenterLetters&ref=https%3A%2F%2Ffm.info6.citi.com%2Fats%2Furl.aspx%3Fcr%3D617%26wu%3D1%26we%3D1%26url%3Dhttps%253A%252F%252Fwww.accountonline.com%252Fcards%252Fsvc%252FLogin.do%253FNEXT_SCREEN%253D%252FDocctr%2526siteId%253DCB%2526accountIndex%253D%2526enid%253D06895BACB5C94FD6EC024F9CBFC462EE62C6%26linkName%3DCN_ECOMM_CENTER_URL%26transId%3DI2019121500064199&tiba=Online%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4

Requested by

Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/conversion_async.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:819::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

cafe /

Resource Hash

2a569aacb76cda50443d05293e35ec319b8dee59d12d194853611c6bfcb5ea48

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jEDelivery_DocCenterLetters
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 17 Dec 2019 16:04:29 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-type: text/javascript; charset=UTF-8
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status: 200
cache-control: no-cache, must-revalidate
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 1321
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/763960929/ 3 KB
1 KB 26ms
25ms Script
text/javascript 2a00:1450:4001:819::2002
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/763960929/?random=1576598669434&cv=9&fst=1576598669434&num=1&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=3&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2oac61&sendb=1&ig=1&data=event%3Dconversion&frm=0&url=https%3A%2F%2Fonline.citi.com%2FUS%2FJRS%2Finfrastructure%2Ftarget.do%3Fnext_page%3Djfp%7CjEDelivery_DocCenterLetters&ref=https%3A%2F%2Ffm.info6.citi.com%2Fats%2Furl.aspx%3Fcr%3D617%26wu%3D1%26we%3D1%26url%3Dhttps%253A%252F%252Fwww.accountonline.com%252Fcards%252Fsvc%252FLogin.do%253FNEXT_SCREEN%253D%252FDocctr%2526siteId%253DCB%2526accountIndex%253D%2526enid%253D06895BACB5C94FD6EC024F9CBFC462EE62C6%26linkName%3DCN_ECOMM_CENTER_URL%26transId%3DI2019121500064199&tiba=Online%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4

Requested by

Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/conversion_async.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:819::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

cafe /

Resource Hash

ff044e181bbfe5f306363754dfdd304da3fe18c1bec9e7436d4446d0b86858e9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jEDelivery_DocCenterLetters
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 17 Dec 2019 16:04:29 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-type: text/javascript; charset=UTF-8
server: cafe
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status: 200
cache-control: no-cache, must-revalidate
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43",h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 1322
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

/
www.google.de/pagead/1p-user-list/916451471/
Redirect Chain

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/916451471/?random=1576598669431&cv=9&fst=1576598669431&num=1&fmt=3&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=12...
https://www.google.com/pagead/1p-user-list/916451471/?random=1576598669431&cv=9&fst=1576598400000&num=1&fmt=3&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=3&u_tz=60&u_java=...
https://www.google.de/pagead/1p-user-list/916451471/?random=1576598669431&cv=9&fst=1576598400000&num=1&fmt=3&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=3&u_tz=60&u_java=f...

42 B
110 B

22ms
22ms

Image
image/gif

2a00:1450:4001:824::2003
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/916451471/?random=1576598669431&cv=9&fst=1576598400000&num=1&fmt=3&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=3&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2oac61&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fonline.citi.com%2FUS%2FJRS%2Finfrastructure%2Ftarget.do%3Fnext_page%3Djfp%7CjEDelivery_DocCenterLetters&ref=https%3A%2F%2Ffm.info6.citi.com%2Fats%2Furl.aspx%3Fcr%3D617%26wu%3D1%26we%3D1%26url%3Dhttps%253A%252F%252Fwww.accountonline.com%252Fcards%252Fsvc%252FLogin.do%253FNEXT_SCREEN%253D%252FDocctr%2526siteId%253DCB%2526accountIndex%253D%2526enid%253D06895BACB5C94FD6EC024F9CBFC462EE62C6%26linkName%3DCN_ECOMM_CENTER_URL%26transId%3DI2019121500064199&tiba=Online%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&async=1&is_vtc=1&random=852833481&resp=GooglemKTybQhCsO&ipr=y&ezwbk=AZuM4hB4qz0srsLCmjHXS1DLHVFX8u0TSJjWKO50AwXkLMHRwbvPS25fDBMA_kVDOvfogQnUCQ8tl04MmKkkjXwlcC6C

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:824::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jEDelivery_DocCenterLetters
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 17 Dec 2019 16:04:29 GMT
x-content-type-options: nosniff
content-type: image/gif
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, no-store, must-revalidate
content-security-policy: script-src 'none'; object-src 'none'
timing-allow-origin: *
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Tue, 17 Dec 2019 16:04:29 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
location: https://www.google.de/pagead/1p-user-list/916451471/?random=1576598669431&cv=9&fst=1576598400000&num=1&fmt=3&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=3&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2oac61&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fonline.citi.com%2FUS%2FJRS%2Finfrastructure%2Ftarget.do%3Fnext_page%3Djfp%7CjEDelivery_DocCenterLetters&ref=https%3A%2F%2Ffm.info6.citi.com%2Fats%2Furl.aspx%3Fcr%3D617%26wu%3D1%26we%3D1%26url%3Dhttps%253A%252F%252Fwww.accountonline.com%252Fcards%252Fsvc%252FLogin.do%253FNEXT_SCREEN%253D%252FDocctr%2526siteId%253DCB%2526accountIndex%253D%2526enid%253D06895BACB5C94FD6EC024F9CBFC462EE62C6%26linkName%3DCN_ECOMM_CENTER_URL%26transId%3DI2019121500064199&tiba=Online%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&async=1&is_vtc=1&random=852833481&resp=GooglemKTybQhCsO&ipr=y&ezwbk=AZuM4hB4qz0srsLCmjHXS1DLHVFX8u0TSJjWKO50AwXkLMHRwbvPS25fDBMA_kVDOvfogQnUCQ8tl04MmKkkjXwlcC6C
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 302
cache-control: no-cache, no-store, must-revalidate
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

/
www.google.de/pagead/1p-user-list/975701947/
Redirect Chain

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/975701947/?random=1576598669431&cv=9&fst=1576598669431&num=1&fmt=3&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=12...
https://www.google.com/pagead/1p-user-list/975701947/?random=1576598669431&cv=9&fst=1576598400000&num=1&fmt=3&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=3&u_tz=60&u_java=...
https://www.google.de/pagead/1p-user-list/975701947/?random=1576598669431&cv=9&fst=1576598400000&num=1&fmt=3&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=3&u_tz=60&u_java=f...

42 B
110 B

27ms
27ms

Image
image/gif

2a00:1450:4001:824::2003
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/975701947/?random=1576598669431&cv=9&fst=1576598400000&num=1&fmt=3&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=3&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2oac61&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fonline.citi.com%2FUS%2FJRS%2Finfrastructure%2Ftarget.do%3Fnext_page%3Djfp%7CjEDelivery_DocCenterLetters&ref=https%3A%2F%2Ffm.info6.citi.com%2Fats%2Furl.aspx%3Fcr%3D617%26wu%3D1%26we%3D1%26url%3Dhttps%253A%252F%252Fwww.accountonline.com%252Fcards%252Fsvc%252FLogin.do%253FNEXT_SCREEN%253D%252FDocctr%2526siteId%253DCB%2526accountIndex%253D%2526enid%253D06895BACB5C94FD6EC024F9CBFC462EE62C6%26linkName%3DCN_ECOMM_CENTER_URL%26transId%3DI2019121500064199&tiba=Online%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&async=1&is_vtc=1&random=1429437526&resp=GooglemKTybQhCsO&ipr=y&ezwbk=AZuM4hDYmxEuWbEak8jW4zzJr1IExc5cqhqP25D3XHMtUSYKysfh1MO20_UBv1LdHcikJkK4y0tJUYW0j7-XMfEAV0KH

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:824::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jEDelivery_DocCenterLetters
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 17 Dec 2019 16:04:29 GMT
x-content-type-options: nosniff
content-type: image/gif
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, no-store, must-revalidate
content-security-policy: script-src 'none'; object-src 'none'
timing-allow-origin: *
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Tue, 17 Dec 2019 16:04:29 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
location: https://www.google.de/pagead/1p-user-list/975701947/?random=1576598669431&cv=9&fst=1576598400000&num=1&fmt=3&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=3&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2oac61&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fonline.citi.com%2FUS%2FJRS%2Finfrastructure%2Ftarget.do%3Fnext_page%3Djfp%7CjEDelivery_DocCenterLetters&ref=https%3A%2F%2Ffm.info6.citi.com%2Fats%2Furl.aspx%3Fcr%3D617%26wu%3D1%26we%3D1%26url%3Dhttps%253A%252F%252Fwww.accountonline.com%252Fcards%252Fsvc%252FLogin.do%253FNEXT_SCREEN%253D%252FDocctr%2526siteId%253DCB%2526accountIndex%253D%2526enid%253D06895BACB5C94FD6EC024F9CBFC462EE62C6%26linkName%3DCN_ECOMM_CENTER_URL%26transId%3DI2019121500064199&tiba=Online%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&async=1&is_vtc=1&random=1429437526&resp=GooglemKTybQhCsO&ipr=y&ezwbk=AZuM4hDYmxEuWbEak8jW4zzJr1IExc5cqhqP25D3XHMtUSYKysfh1MO20_UBv1LdHcikJkK4y0tJUYW0j7-XMfEAV0KH
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 302
cache-control: no-cache, no-store, must-revalidate
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

/
www.google.de/pagead/1p-user-list/819500023/
Redirect Chain

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/819500023/?random=1576598669432&cv=9&fst=1576598669432&num=1&fmt=3&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=12...
https://www.google.com/pagead/1p-user-list/819500023/?random=1576598669432&cv=9&fst=1576598400000&num=1&fmt=3&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=3&u_tz=60&u_java=...
https://www.google.de/pagead/1p-user-list/819500023/?random=1576598669432&cv=9&fst=1576598400000&num=1&fmt=3&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=3&u_tz=60&u_java=f...

42 B
110 B

23ms
23ms

Image
image/gif

2a00:1450:4001:824::2003
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/819500023/?random=1576598669432&cv=9&fst=1576598400000&num=1&fmt=3&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=3&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2oac61&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fonline.citi.com%2FUS%2FJRS%2Finfrastructure%2Ftarget.do%3Fnext_page%3Djfp%7CjEDelivery_DocCenterLetters&ref=https%3A%2F%2Ffm.info6.citi.com%2Fats%2Furl.aspx%3Fcr%3D617%26wu%3D1%26we%3D1%26url%3Dhttps%253A%252F%252Fwww.accountonline.com%252Fcards%252Fsvc%252FLogin.do%253FNEXT_SCREEN%253D%252FDocctr%2526siteId%253DCB%2526accountIndex%253D%2526enid%253D06895BACB5C94FD6EC024F9CBFC462EE62C6%26linkName%3DCN_ECOMM_CENTER_URL%26transId%3DI2019121500064199&tiba=Online%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&async=1&is_vtc=1&random=3910636596&resp=GooglemKTybQhCsO&ipr=y&ezwbk=AZuM4hDJSA4yXHyvLK9n9R9-fA47XfI9FEfiAOqYbYimzJ7qutJ3yBWoWkJcyOGsfqQ3fO2VFj_ImwCGkrtMpWjoF9Yb

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:824::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jEDelivery_DocCenterLetters
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 17 Dec 2019 16:04:29 GMT
x-content-type-options: nosniff
content-type: image/gif
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, no-store, must-revalidate
content-security-policy: script-src 'none'; object-src 'none'
timing-allow-origin: *
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Tue, 17 Dec 2019 16:04:29 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
location: https://www.google.de/pagead/1p-user-list/819500023/?random=1576598669432&cv=9&fst=1576598400000&num=1&fmt=3&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=3&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2oac61&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fonline.citi.com%2FUS%2FJRS%2Finfrastructure%2Ftarget.do%3Fnext_page%3Djfp%7CjEDelivery_DocCenterLetters&ref=https%3A%2F%2Ffm.info6.citi.com%2Fats%2Furl.aspx%3Fcr%3D617%26wu%3D1%26we%3D1%26url%3Dhttps%253A%252F%252Fwww.accountonline.com%252Fcards%252Fsvc%252FLogin.do%253FNEXT_SCREEN%253D%252FDocctr%2526siteId%253DCB%2526accountIndex%253D%2526enid%253D06895BACB5C94FD6EC024F9CBFC462EE62C6%26linkName%3DCN_ECOMM_CENTER_URL%26transId%3DI2019121500064199&tiba=Online%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&async=1&is_vtc=1&random=3910636596&resp=GooglemKTybQhCsO&ipr=y&ezwbk=AZuM4hDJSA4yXHyvLK9n9R9-fA47XfI9FEfiAOqYbYimzJ7qutJ3yBWoWkJcyOGsfqQ3fO2VFj_ImwCGkrtMpWjoF9Yb
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 302
cache-control: no-cache, no-store, must-revalidate
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

/
www.google.de/pagead/1p-user-list/763960929/
Redirect Chain

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/763960929/?random=1576598669432&cv=9&fst=1576598669432&num=1&fmt=3&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=12...
https://www.google.com/pagead/1p-user-list/763960929/?random=1576598669432&cv=9&fst=1576598400000&num=1&fmt=3&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=3&u_tz=60&u_java=...
https://www.google.de/pagead/1p-user-list/763960929/?random=1576598669432&cv=9&fst=1576598400000&num=1&fmt=3&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=3&u_tz=60&u_java=f...

42 B
110 B

38ms
38ms

Image
image/gif

2a00:1450:4001:824::2003
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/763960929/?random=1576598669432&cv=9&fst=1576598400000&num=1&fmt=3&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=3&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2oac61&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fonline.citi.com%2FUS%2FJRS%2Finfrastructure%2Ftarget.do%3Fnext_page%3Djfp%7CjEDelivery_DocCenterLetters&ref=https%3A%2F%2Ffm.info6.citi.com%2Fats%2Furl.aspx%3Fcr%3D617%26wu%3D1%26we%3D1%26url%3Dhttps%253A%252F%252Fwww.accountonline.com%252Fcards%252Fsvc%252FLogin.do%253FNEXT_SCREEN%253D%252FDocctr%2526siteId%253DCB%2526accountIndex%253D%2526enid%253D06895BACB5C94FD6EC024F9CBFC462EE62C6%26linkName%3DCN_ECOMM_CENTER_URL%26transId%3DI2019121500064199&tiba=Online%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&async=1&is_vtc=1&random=656862344&resp=GooglemKTybQhCsO&ipr=y&ezwbk=AZuM4hAWg6gil67cRWDIJ0f__4deLLdm6M5VSa0gv9ZDRMCeGkk5B8neVGF3F52WnVVPySyepeCsn2ZTBWGUFJqAtVFo

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:824::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jEDelivery_DocCenterLetters
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 17 Dec 2019 16:04:29 GMT
x-content-type-options: nosniff
content-type: image/gif
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, no-store, must-revalidate
content-security-policy: script-src 'none'; object-src 'none'
timing-allow-origin: *
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Tue, 17 Dec 2019 16:04:29 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
location: https://www.google.de/pagead/1p-user-list/763960929/?random=1576598669432&cv=9&fst=1576598400000&num=1&fmt=3&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=3&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2oac61&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fonline.citi.com%2FUS%2FJRS%2Finfrastructure%2Ftarget.do%3Fnext_page%3Djfp%7CjEDelivery_DocCenterLetters&ref=https%3A%2F%2Ffm.info6.citi.com%2Fats%2Furl.aspx%3Fcr%3D617%26wu%3D1%26we%3D1%26url%3Dhttps%253A%252F%252Fwww.accountonline.com%252Fcards%252Fsvc%252FLogin.do%253FNEXT_SCREEN%253D%252FDocctr%2526siteId%253DCB%2526accountIndex%253D%2526enid%253D06895BACB5C94FD6EC024F9CBFC462EE62C6%26linkName%3DCN_ECOMM_CENTER_URL%26transId%3DI2019121500064199&tiba=Online%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&async=1&is_vtc=1&random=656862344&resp=GooglemKTybQhCsO&ipr=y&ezwbk=AZuM4hAWg6gil67cRWDIJ0f__4deLLdm6M5VSa0gv9ZDRMCeGkk5B8neVGF3F52WnVVPySyepeCsn2ZTBWGUFJqAtVFo
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 302
cache-control: no-cache, no-store, must-revalidate
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

/
www.google.de/pagead/1p-user-list/959299794/
Redirect Chain

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/959299794/?random=1576598669432&cv=9&fst=1576598669432&num=1&fmt=3&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=12...
https://www.google.com/pagead/1p-user-list/959299794/?random=1576598669432&cv=9&fst=1576598400000&num=1&fmt=3&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=3&u_tz=60&u_java=...
https://www.google.de/pagead/1p-user-list/959299794/?random=1576598669432&cv=9&fst=1576598400000&num=1&fmt=3&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=3&u_tz=60&u_java=f...

42 B
110 B

29ms
29ms

Image
image/gif

2a00:1450:4001:824::2003
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/959299794/?random=1576598669432&cv=9&fst=1576598400000&num=1&fmt=3&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=3&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2oac61&sendb=1&data=event%3Dconversion&frm=0&url=https%3A%2F%2Fonline.citi.com%2FUS%2FJRS%2Finfrastructure%2Ftarget.do%3Fnext_page%3Djfp%7CjEDelivery_DocCenterLetters&ref=https%3A%2F%2Ffm.info6.citi.com%2Fats%2Furl.aspx%3Fcr%3D617%26wu%3D1%26we%3D1%26url%3Dhttps%253A%252F%252Fwww.accountonline.com%252Fcards%252Fsvc%252FLogin.do%253FNEXT_SCREEN%253D%252FDocctr%2526siteId%253DCB%2526accountIndex%253D%2526enid%253D06895BACB5C94FD6EC024F9CBFC462EE62C6%26linkName%3DCN_ECOMM_CENTER_URL%26transId%3DI2019121500064199&tiba=Online%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&async=1&is_vtc=1&random=512765913&resp=GooglemKTybQhCsO&ipr=y&ezwbk=AZuM4hCU0AjZ_sgHQp2n6doi7ZtlpRZ2EO0UzuzD5tVIVQHe3c5y-76vy6h9yBfBV_bPjSEV-IPV492k0i3VAYoEDfoC

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:824::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jEDelivery_DocCenterLetters
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 17 Dec 2019 16:04:29 GMT
x-content-type-options: nosniff
content-type: image/gif
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, no-store, must-revalidate
content-security-policy: script-src 'none'; object-src 'none'
timing-allow-origin: *
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Tue, 17 Dec 2019 16:04:29 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
location: https://www.google.de/pagead/1p-user-list/959299794/?random=1576598669432&cv=9&fst=1576598400000&num=1&fmt=3&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=3&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2oac61&sendb=1&data=event%3Dconversion&frm=0&url=https%3A%2F%2Fonline.citi.com%2FUS%2FJRS%2Finfrastructure%2Ftarget.do%3Fnext_page%3Djfp%7CjEDelivery_DocCenterLetters&ref=https%3A%2F%2Ffm.info6.citi.com%2Fats%2Furl.aspx%3Fcr%3D617%26wu%3D1%26we%3D1%26url%3Dhttps%253A%252F%252Fwww.accountonline.com%252Fcards%252Fsvc%252FLogin.do%253FNEXT_SCREEN%253D%252FDocctr%2526siteId%253DCB%2526accountIndex%253D%2526enid%253D06895BACB5C94FD6EC024F9CBFC462EE62C6%26linkName%3DCN_ECOMM_CENTER_URL%26transId%3DI2019121500064199&tiba=Online%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&async=1&is_vtc=1&random=512765913&resp=GooglemKTybQhCsO&ipr=y&ezwbk=AZuM4hCU0AjZ_sgHQp2n6doi7ZtlpRZ2EO0UzuzD5tVIVQHe3c5y-76vy6h9yBfBV_bPjSEV-IPV492k0i3VAYoEDfoC
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 302
cache-control: no-cache, no-store, must-revalidate
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

/
www.google.de/pagead/1p-user-list/960621875/
Redirect Chain

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/960621875/?random=1576598669432&cv=9&fst=1576598669432&num=1&fmt=3&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=12...
https://www.google.com/pagead/1p-user-list/960621875/?random=1576598669432&cv=9&fst=1576598400000&num=1&fmt=3&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=3&u_tz=60&u_java=...
https://www.google.de/pagead/1p-user-list/960621875/?random=1576598669432&cv=9&fst=1576598400000&num=1&fmt=3&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=3&u_tz=60&u_java=f...

42 B
110 B

22ms
22ms

Image
image/gif

2a00:1450:4001:824::2003
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/960621875/?random=1576598669432&cv=9&fst=1576598400000&num=1&fmt=3&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=3&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2oac61&sendb=1&data=event%3Dconversion&frm=0&url=https%3A%2F%2Fonline.citi.com%2FUS%2FJRS%2Finfrastructure%2Ftarget.do%3Fnext_page%3Djfp%7CjEDelivery_DocCenterLetters&ref=https%3A%2F%2Ffm.info6.citi.com%2Fats%2Furl.aspx%3Fcr%3D617%26wu%3D1%26we%3D1%26url%3Dhttps%253A%252F%252Fwww.accountonline.com%252Fcards%252Fsvc%252FLogin.do%253FNEXT_SCREEN%253D%252FDocctr%2526siteId%253DCB%2526accountIndex%253D%2526enid%253D06895BACB5C94FD6EC024F9CBFC462EE62C6%26linkName%3DCN_ECOMM_CENTER_URL%26transId%3DI2019121500064199&tiba=Online%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&async=1&is_vtc=1&random=749030275&resp=GooglemKTybQhCsO&ipr=y&ezwbk=AZuM4hDtHuZACjyflAOvQ2b-PqCKGIKEPJdfLF3SzGGjw8jftyDrktDzckO0sIBgk2GTj5spfyFkUibCMjBJwS748Axv

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:824::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jEDelivery_DocCenterLetters
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 17 Dec 2019 16:04:29 GMT
x-content-type-options: nosniff
content-type: image/gif
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, no-store, must-revalidate
content-security-policy: script-src 'none'; object-src 'none'
timing-allow-origin: *
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Tue, 17 Dec 2019 16:04:29 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
location: https://www.google.de/pagead/1p-user-list/960621875/?random=1576598669432&cv=9&fst=1576598400000&num=1&fmt=3&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=3&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2oac61&sendb=1&data=event%3Dconversion&frm=0&url=https%3A%2F%2Fonline.citi.com%2FUS%2FJRS%2Finfrastructure%2Ftarget.do%3Fnext_page%3Djfp%7CjEDelivery_DocCenterLetters&ref=https%3A%2F%2Ffm.info6.citi.com%2Fats%2Furl.aspx%3Fcr%3D617%26wu%3D1%26we%3D1%26url%3Dhttps%253A%252F%252Fwww.accountonline.com%252Fcards%252Fsvc%252FLogin.do%253FNEXT_SCREEN%253D%252FDocctr%2526siteId%253DCB%2526accountIndex%253D%2526enid%253D06895BACB5C94FD6EC024F9CBFC462EE62C6%26linkName%3DCN_ECOMM_CENTER_URL%26transId%3DI2019121500064199&tiba=Online%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&async=1&is_vtc=1&random=749030275&resp=GooglemKTybQhCsO&ipr=y&ezwbk=AZuM4hDtHuZACjyflAOvQ2b-PqCKGIKEPJdfLF3SzGGjw8jftyDrktDzckO0sIBgk2GTj5spfyFkUibCMjBJwS748Axv
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 302
cache-control: no-cache, no-store, must-revalidate
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

/
www.google.de/pagead/1p-user-list/975701947/
Redirect Chain

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/975701947/?random=1576598669433&cv=9&fst=1576598669433&num=1&fmt=3&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=12...
https://www.google.com/pagead/1p-user-list/975701947/?random=1576598669433&cv=9&fst=1576598400000&num=1&fmt=3&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=3&u_tz=60&u_java=...
https://www.google.de/pagead/1p-user-list/975701947/?random=1576598669433&cv=9&fst=1576598400000&num=1&fmt=3&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=3&u_tz=60&u_java=f...

42 B
110 B

24ms
24ms

Image
image/gif

2a00:1450:4001:824::2003
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/975701947/?random=1576598669433&cv=9&fst=1576598400000&num=1&fmt=3&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=3&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2oac61&sendb=1&data=event%3Dconversion&frm=0&url=https%3A%2F%2Fonline.citi.com%2FUS%2FJRS%2Finfrastructure%2Ftarget.do%3Fnext_page%3Djfp%7CjEDelivery_DocCenterLetters&ref=https%3A%2F%2Ffm.info6.citi.com%2Fats%2Furl.aspx%3Fcr%3D617%26wu%3D1%26we%3D1%26url%3Dhttps%253A%252F%252Fwww.accountonline.com%252Fcards%252Fsvc%252FLogin.do%253FNEXT_SCREEN%253D%252FDocctr%2526siteId%253DCB%2526accountIndex%253D%2526enid%253D06895BACB5C94FD6EC024F9CBFC462EE62C6%26linkName%3DCN_ECOMM_CENTER_URL%26transId%3DI2019121500064199&tiba=Online%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&async=1&is_vtc=1&random=3196431062&resp=GooglemKTybQhCsO&ipr=y&ezwbk=AZuM4hDCn9KrNCFRlocEQ60wI6Coa6WN-6UIXMzZr5KQRURg-V9j1jiyMfdc1zOfcPLCqYSRLUk7RhHbjQuYnYijyq-9

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:824::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jEDelivery_DocCenterLetters
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 17 Dec 2019 16:04:29 GMT
x-content-type-options: nosniff
content-type: image/gif
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, no-store, must-revalidate
content-security-policy: script-src 'none'; object-src 'none'
timing-allow-origin: *
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Tue, 17 Dec 2019 16:04:29 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
location: https://www.google.de/pagead/1p-user-list/975701947/?random=1576598669433&cv=9&fst=1576598400000&num=1&fmt=3&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=3&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2oac61&sendb=1&data=event%3Dconversion&frm=0&url=https%3A%2F%2Fonline.citi.com%2FUS%2FJRS%2Finfrastructure%2Ftarget.do%3Fnext_page%3Djfp%7CjEDelivery_DocCenterLetters&ref=https%3A%2F%2Ffm.info6.citi.com%2Fats%2Furl.aspx%3Fcr%3D617%26wu%3D1%26we%3D1%26url%3Dhttps%253A%252F%252Fwww.accountonline.com%252Fcards%252Fsvc%252FLogin.do%253FNEXT_SCREEN%253D%252FDocctr%2526siteId%253DCB%2526accountIndex%253D%2526enid%253D06895BACB5C94FD6EC024F9CBFC462EE62C6%26linkName%3DCN_ECOMM_CENTER_URL%26transId%3DI2019121500064199&tiba=Online%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&async=1&is_vtc=1&random=3196431062&resp=GooglemKTybQhCsO&ipr=y&ezwbk=AZuM4hDCn9KrNCFRlocEQ60wI6Coa6WN-6UIXMzZr5KQRURg-V9j1jiyMfdc1zOfcPLCqYSRLUk7RhHbjQuYnYijyq-9
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 302
cache-control: no-cache, no-store, must-revalidate
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

/
www.google.de/pagead/1p-user-list/770961656/
Redirect Chain

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/770961656/?random=1576598669433&cv=9&fst=1576598669433&num=1&fmt=3&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=12...
https://www.google.com/pagead/1p-user-list/770961656/?random=1576598669433&cv=9&fst=1576598400000&num=1&fmt=3&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=3&u_tz=60&u_java=...
https://www.google.de/pagead/1p-user-list/770961656/?random=1576598669433&cv=9&fst=1576598400000&num=1&fmt=3&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=3&u_tz=60&u_java=f...

42 B
110 B

26ms
25ms

Image
image/gif

2a00:1450:4001:824::2003
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/770961656/?random=1576598669433&cv=9&fst=1576598400000&num=1&fmt=3&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=3&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2oac61&sendb=1&data=event%3Dconversion&frm=0&url=https%3A%2F%2Fonline.citi.com%2FUS%2FJRS%2Finfrastructure%2Ftarget.do%3Fnext_page%3Djfp%7CjEDelivery_DocCenterLetters&ref=https%3A%2F%2Ffm.info6.citi.com%2Fats%2Furl.aspx%3Fcr%3D617%26wu%3D1%26we%3D1%26url%3Dhttps%253A%252F%252Fwww.accountonline.com%252Fcards%252Fsvc%252FLogin.do%253FNEXT_SCREEN%253D%252FDocctr%2526siteId%253DCB%2526accountIndex%253D%2526enid%253D06895BACB5C94FD6EC024F9CBFC462EE62C6%26linkName%3DCN_ECOMM_CENTER_URL%26transId%3DI2019121500064199&tiba=Online%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&async=1&is_vtc=1&random=1052276251&resp=GooglemKTybQhCsO&ipr=y&ezwbk=AZuM4hAkxkQY9aJnwzCd8Np3bbWCHMYqM-L0RZpoTzGU-hmk5HHJYlVTqGTjMYu7bz__UWAz1NVDfV1NqbPDx6OITXIV

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:824::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jEDelivery_DocCenterLetters
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 17 Dec 2019 16:04:29 GMT
x-content-type-options: nosniff
content-type: image/gif
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, no-store, must-revalidate
content-security-policy: script-src 'none'; object-src 'none'
timing-allow-origin: *
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Tue, 17 Dec 2019 16:04:29 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
location: https://www.google.de/pagead/1p-user-list/770961656/?random=1576598669433&cv=9&fst=1576598400000&num=1&fmt=3&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=3&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2oac61&sendb=1&data=event%3Dconversion&frm=0&url=https%3A%2F%2Fonline.citi.com%2FUS%2FJRS%2Finfrastructure%2Ftarget.do%3Fnext_page%3Djfp%7CjEDelivery_DocCenterLetters&ref=https%3A%2F%2Ffm.info6.citi.com%2Fats%2Furl.aspx%3Fcr%3D617%26wu%3D1%26we%3D1%26url%3Dhttps%253A%252F%252Fwww.accountonline.com%252Fcards%252Fsvc%252FLogin.do%253FNEXT_SCREEN%253D%252FDocctr%2526siteId%253DCB%2526accountIndex%253D%2526enid%253D06895BACB5C94FD6EC024F9CBFC462EE62C6%26linkName%3DCN_ECOMM_CENTER_URL%26transId%3DI2019121500064199&tiba=Online%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&async=1&is_vtc=1&random=1052276251&resp=GooglemKTybQhCsO&ipr=y&ezwbk=AZuM4hAkxkQY9aJnwzCd8Np3bbWCHMYqM-L0RZpoTzGU-hmk5HHJYlVTqGTjMYu7bz__UWAz1NVDfV1NqbPDx6OITXIV
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 302
cache-control: no-cache, no-store, must-revalidate
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

/
www.google.de/pagead/1p-user-list/819500023/
Redirect Chain

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/819500023/?random=1576598669433&cv=9&fst=1576598669433&num=1&fmt=3&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=12...
https://www.google.com/pagead/1p-user-list/819500023/?random=1576598669433&cv=9&fst=1576598400000&num=1&fmt=3&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=3&u_tz=60&u_java=...
https://www.google.de/pagead/1p-user-list/819500023/?random=1576598669433&cv=9&fst=1576598400000&num=1&fmt=3&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=3&u_tz=60&u_java=f...

42 B
110 B

25ms
25ms

Image
image/gif

2a00:1450:4001:824::2003
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/819500023/?random=1576598669433&cv=9&fst=1576598400000&num=1&fmt=3&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=3&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2oac61&sendb=1&data=event%3Dconversion&frm=0&url=https%3A%2F%2Fonline.citi.com%2FUS%2FJRS%2Finfrastructure%2Ftarget.do%3Fnext_page%3Djfp%7CjEDelivery_DocCenterLetters&ref=https%3A%2F%2Ffm.info6.citi.com%2Fats%2Furl.aspx%3Fcr%3D617%26wu%3D1%26we%3D1%26url%3Dhttps%253A%252F%252Fwww.accountonline.com%252Fcards%252Fsvc%252FLogin.do%253FNEXT_SCREEN%253D%252FDocctr%2526siteId%253DCB%2526accountIndex%253D%2526enid%253D06895BACB5C94FD6EC024F9CBFC462EE62C6%26linkName%3DCN_ECOMM_CENTER_URL%26transId%3DI2019121500064199&tiba=Online%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&async=1&is_vtc=1&random=3094857313&resp=GooglemKTybQhCsO&ipr=y&ezwbk=AZuM4hBbcWUMjQDsSZM9QtjHFz-RITh6AeFkkdE6cNNy8KX84oOz0BTWQdn4B1hpzmDTvyCQT-xFDUKnquBZxsHmTgdT

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:824::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jEDelivery_DocCenterLetters
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 17 Dec 2019 16:04:29 GMT
x-content-type-options: nosniff
content-type: image/gif
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, no-store, must-revalidate
content-security-policy: script-src 'none'; object-src 'none'
timing-allow-origin: *
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Tue, 17 Dec 2019 16:04:29 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
location: https://www.google.de/pagead/1p-user-list/819500023/?random=1576598669433&cv=9&fst=1576598400000&num=1&fmt=3&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=3&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2oac61&sendb=1&data=event%3Dconversion&frm=0&url=https%3A%2F%2Fonline.citi.com%2FUS%2FJRS%2Finfrastructure%2Ftarget.do%3Fnext_page%3Djfp%7CjEDelivery_DocCenterLetters&ref=https%3A%2F%2Ffm.info6.citi.com%2Fats%2Furl.aspx%3Fcr%3D617%26wu%3D1%26we%3D1%26url%3Dhttps%253A%252F%252Fwww.accountonline.com%252Fcards%252Fsvc%252FLogin.do%253FNEXT_SCREEN%253D%252FDocctr%2526siteId%253DCB%2526accountIndex%253D%2526enid%253D06895BACB5C94FD6EC024F9CBFC462EE62C6%26linkName%3DCN_ECOMM_CENTER_URL%26transId%3DI2019121500064199&tiba=Online%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&async=1&is_vtc=1&random=3094857313&resp=GooglemKTybQhCsO&ipr=y&ezwbk=AZuM4hBbcWUMjQDsSZM9QtjHFz-RITh6AeFkkdE6cNNy8KX84oOz0BTWQdn4B1hpzmDTvyCQT-xFDUKnquBZxsHmTgdT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 302
cache-control: no-cache, no-store, must-revalidate
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.com/pagead/1p-user-list/770961656/ 42 B
111 B 60ms
58ms Image
image/gif 2a00:1450:4001:824::2004
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/770961656/?random=1576598669432&cv=9&fst=1576598400000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=3&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2oac61&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fonline.citi.com%2FUS%2FJRS%2Finfrastructure%2Ftarget.do%3Fnext_page%3Djfp%7CjEDelivery_DocCenterLetters&ref=https%3A%2F%2Ffm.info6.citi.com%2Fats%2Furl.aspx%3Fcr%3D617%26wu%3D1%26we%3D1%26url%3Dhttps%253A%252F%252Fwww.accountonline.com%252Fcards%252Fsvc%252FLogin.do%253FNEXT_SCREEN%253D%252FDocctr%2526siteId%253DCB%2526accountIndex%253D%2526enid%253D06895BACB5C94FD6EC024F9CBFC462EE62C6%26linkName%3DCN_ECOMM_CENTER_URL%26transId%3DI2019121500064199&tiba=Online%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&async=1&fmt=3&is_vtc=1&random=663778209&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:824::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jEDelivery_DocCenterLetters
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 17 Dec 2019 16:04:29 GMT
x-content-type-options: nosniff
content-type: image/gif
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, no-store, must-revalidate
content-security-policy: script-src 'none'; object-src 'none'
timing-allow-origin: *
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.de/pagead/1p-user-list/770961656/ 42 B
110 B 36ms
35ms Image
image/gif 2a00:1450:4001:824::2003
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/770961656/?random=1576598669432&cv=9&fst=1576598400000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=3&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2oac61&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fonline.citi.com%2FUS%2FJRS%2Finfrastructure%2Ftarget.do%3Fnext_page%3Djfp%7CjEDelivery_DocCenterLetters&ref=https%3A%2F%2Ffm.info6.citi.com%2Fats%2Furl.aspx%3Fcr%3D617%26wu%3D1%26we%3D1%26url%3Dhttps%253A%252F%252Fwww.accountonline.com%252Fcards%252Fsvc%252FLogin.do%253FNEXT_SCREEN%253D%252FDocctr%2526siteId%253DCB%2526accountIndex%253D%2526enid%253D06895BACB5C94FD6EC024F9CBFC462EE62C6%26linkName%3DCN_ECOMM_CENTER_URL%26transId%3DI2019121500064199&tiba=Online%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&async=1&fmt=3&is_vtc=1&random=663778209&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:824::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jEDelivery_DocCenterLetters
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 17 Dec 2019 16:04:29 GMT
x-content-type-options: nosniff
content-type: image/gif
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, no-store, must-revalidate
content-security-policy: script-src 'none'; object-src 'none'
timing-allow-origin: *
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.com/pagead/1p-user-list/959299794/ 42 B
111 B 34ms
33ms Image
image/gif 2a00:1450:4001:824::2004
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/959299794/?random=1576598669428&cv=9&fst=1576598400000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=3&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2oac61&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fonline.citi.com%2FUS%2FJRS%2Finfrastructure%2Ftarget.do%3Fnext_page%3Djfp%7CjEDelivery_DocCenterLetters&ref=https%3A%2F%2Ffm.info6.citi.com%2Fats%2Furl.aspx%3Fcr%3D617%26wu%3D1%26we%3D1%26url%3Dhttps%253A%252F%252Fwww.accountonline.com%252Fcards%252Fsvc%252FLogin.do%253FNEXT_SCREEN%253D%252FDocctr%2526siteId%253DCB%2526accountIndex%253D%2526enid%253D06895BACB5C94FD6EC024F9CBFC462EE62C6%26linkName%3DCN_ECOMM_CENTER_URL%26transId%3DI2019121500064199&tiba=Online%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&async=1&fmt=3&is_vtc=1&random=2240892064&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:824::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jEDelivery_DocCenterLetters
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 17 Dec 2019 16:04:29 GMT
x-content-type-options: nosniff
content-type: image/gif
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, no-store, must-revalidate
content-security-policy: script-src 'none'; object-src 'none'
timing-allow-origin: *
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.de/pagead/1p-user-list/959299794/ 42 B
110 B 24ms
23ms Image
image/gif 2a00:1450:4001:824::2003
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/959299794/?random=1576598669428&cv=9&fst=1576598400000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=3&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2oac61&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fonline.citi.com%2FUS%2FJRS%2Finfrastructure%2Ftarget.do%3Fnext_page%3Djfp%7CjEDelivery_DocCenterLetters&ref=https%3A%2F%2Ffm.info6.citi.com%2Fats%2Furl.aspx%3Fcr%3D617%26wu%3D1%26we%3D1%26url%3Dhttps%253A%252F%252Fwww.accountonline.com%252Fcards%252Fsvc%252FLogin.do%253FNEXT_SCREEN%253D%252FDocctr%2526siteId%253DCB%2526accountIndex%253D%2526enid%253D06895BACB5C94FD6EC024F9CBFC462EE62C6%26linkName%3DCN_ECOMM_CENTER_URL%26transId%3DI2019121500064199&tiba=Online%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&async=1&fmt=3&is_vtc=1&random=2240892064&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:824::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jEDelivery_DocCenterLetters
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 17 Dec 2019 16:04:29 GMT
x-content-type-options: nosniff
content-type: image/gif
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, no-store, must-revalidate
content-security-policy: script-src 'none'; object-src 'none'
timing-allow-origin: *
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.com/pagead/1p-user-list/916451471/ 42 B
111 B 31ms
30ms Image
image/gif 2a00:1450:4001:824::2004
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/916451471/?random=1576598669433&cv=9&fst=1576598400000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=3&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2oac61&sendb=1&data=event%3Dconversion&frm=0&url=https%3A%2F%2Fonline.citi.com%2FUS%2FJRS%2Finfrastructure%2Ftarget.do%3Fnext_page%3Djfp%7CjEDelivery_DocCenterLetters&ref=https%3A%2F%2Ffm.info6.citi.com%2Fats%2Furl.aspx%3Fcr%3D617%26wu%3D1%26we%3D1%26url%3Dhttps%253A%252F%252Fwww.accountonline.com%252Fcards%252Fsvc%252FLogin.do%253FNEXT_SCREEN%253D%252FDocctr%2526siteId%253DCB%2526accountIndex%253D%2526enid%253D06895BACB5C94FD6EC024F9CBFC462EE62C6%26linkName%3DCN_ECOMM_CENTER_URL%26transId%3DI2019121500064199&tiba=Online%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&async=1&fmt=3&is_vtc=1&random=1877082079&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:824::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jEDelivery_DocCenterLetters
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 17 Dec 2019 16:04:29 GMT
x-content-type-options: nosniff
content-type: image/gif
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, no-store, must-revalidate
content-security-policy: script-src 'none'; object-src 'none'
timing-allow-origin: *
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.de/pagead/1p-user-list/916451471/ 42 B
110 B 21ms
20ms Image
image/gif 2a00:1450:4001:824::2003
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/916451471/?random=1576598669433&cv=9&fst=1576598400000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=3&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2oac61&sendb=1&data=event%3Dconversion&frm=0&url=https%3A%2F%2Fonline.citi.com%2FUS%2FJRS%2Finfrastructure%2Ftarget.do%3Fnext_page%3Djfp%7CjEDelivery_DocCenterLetters&ref=https%3A%2F%2Ffm.info6.citi.com%2Fats%2Furl.aspx%3Fcr%3D617%26wu%3D1%26we%3D1%26url%3Dhttps%253A%252F%252Fwww.accountonline.com%252Fcards%252Fsvc%252FLogin.do%253FNEXT_SCREEN%253D%252FDocctr%2526siteId%253DCB%2526accountIndex%253D%2526enid%253D06895BACB5C94FD6EC024F9CBFC462EE62C6%26linkName%3DCN_ECOMM_CENTER_URL%26transId%3DI2019121500064199&tiba=Online%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&async=1&fmt=3&is_vtc=1&random=1877082079&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:824::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jEDelivery_DocCenterLetters
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 17 Dec 2019 16:04:29 GMT
x-content-type-options: nosniff
content-type: image/gif
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, no-store, must-revalidate
content-security-policy: script-src 'none'; object-src 'none'
timing-allow-origin: *
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 200 track Show response
udc-neb.kampyle.com/v1/qceuv8449dzg58ptt1bhda9g8ue19c7s/ 59 B
418 B 143ms
99ms XHR
text/plain 35.241.45.82
Google LLC

General

Check archive.org

Show headers Download Go to

Full URL: https://udc-neb.kampyle.com/v1/qceuv8449dzg58ptt1bhda9g8ue19c7s/track
Requested by: Host: online.citi.com
URL: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jEDelivery_DocCenterLetters
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.241.45.82 , Ascension Island, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS: 82.45.241.35.bc.googleusercontent.com
Software: Jetty(9.2.11.v20150529) /
Resource Hash: cbc1399b82e42018fbc8b8b9277200665d6367c9134ead9308ea5e568b00e459

Request headers

Referer: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jEDelivery_DocCenterLetters
Origin: https://online.citi.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-type: application/x-www-form-urlencoded

Response headers

x-me: prod-instance-gatewayservice-green-vjbw
date: Tue, 17 Dec 2019 16:04:29 GMT
via: 1.1 google
server: Jetty(9.2.11.v20150529)
access-control-allow-headers: X-Requested-With, Origin, Content-Type, Accept
status: 200
access-control-max-age: 1800
access-control-allow-methods: GET, POST, PUT, DELETE
content-type: text/plain;charset=ISO-8859-1
access-control-allow-origin: https://online.citi.com
access-control-allow-credentials: true
alt-svc: clear
content-length: 59
x-application-context: application:9090

GET
H2 200 /
www.google.com/pagead/1p-user-list/960621875/ 42 B
111 B 33ms
33ms Image
image/gif 2a00:1450:4001:824::2004
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/960621875/?random=1576598669431&cv=9&fst=1576598400000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=3&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2oac61&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fonline.citi.com%2FUS%2FJRS%2Finfrastructure%2Ftarget.do%3Fnext_page%3Djfp%7CjEDelivery_DocCenterLetters&ref=https%3A%2F%2Ffm.info6.citi.com%2Fats%2Furl.aspx%3Fcr%3D617%26wu%3D1%26we%3D1%26url%3Dhttps%253A%252F%252Fwww.accountonline.com%252Fcards%252Fsvc%252FLogin.do%253FNEXT_SCREEN%253D%252FDocctr%2526siteId%253DCB%2526accountIndex%253D%2526enid%253D06895BACB5C94FD6EC024F9CBFC462EE62C6%26linkName%3DCN_ECOMM_CENTER_URL%26transId%3DI2019121500064199&tiba=Online%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&async=1&fmt=3&is_vtc=1&random=2487600222&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:824::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jEDelivery_DocCenterLetters
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 17 Dec 2019 16:04:29 GMT
x-content-type-options: nosniff
content-type: image/gif
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, no-store, must-revalidate
content-security-policy: script-src 'none'; object-src 'none'
timing-allow-origin: *
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.de/pagead/1p-user-list/960621875/ 42 B
110 B 22ms
22ms Image
image/gif 2a00:1450:4001:824::2003
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/960621875/?random=1576598669431&cv=9&fst=1576598400000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=3&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2oac61&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fonline.citi.com%2FUS%2FJRS%2Finfrastructure%2Ftarget.do%3Fnext_page%3Djfp%7CjEDelivery_DocCenterLetters&ref=https%3A%2F%2Ffm.info6.citi.com%2Fats%2Furl.aspx%3Fcr%3D617%26wu%3D1%26we%3D1%26url%3Dhttps%253A%252F%252Fwww.accountonline.com%252Fcards%252Fsvc%252FLogin.do%253FNEXT_SCREEN%253D%252FDocctr%2526siteId%253DCB%2526accountIndex%253D%2526enid%253D06895BACB5C94FD6EC024F9CBFC462EE62C6%26linkName%3DCN_ECOMM_CENTER_URL%26transId%3DI2019121500064199&tiba=Online%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&async=1&fmt=3&is_vtc=1&random=2487600222&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:824::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jEDelivery_DocCenterLetters
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 17 Dec 2019 16:04:29 GMT
x-content-type-options: nosniff
content-type: image/gif
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, no-store, must-revalidate
content-security-policy: script-src 'none'; object-src 'none'
timing-allow-origin: *
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK HP Show response
content22.online.citi.com/fp/ Frame 0530 19 KB
6 KB 26ms
25ms Document
text/html 91.235.134.21
ThreatMetrix Inc.

General

Check archive.org

Show headers Download Go to

Full URL

https://content22.online.citi.com/fp/HP?session_id=d00039fdc1946ea1fda48026a8aeb1aec266508999ccf402cc3fdf6e85179bef&org_id=89oebq5k&nonce=99b8914f359a7962&mode=2&hp=.co-operativebank.co.uk/CBIBSWeb/login.do.co-operativebank.co.uk/CBIBSWeb/start.do.de/portal/portal/x.entropay.com/basemenu/prot/x.facebook.comx.nationet.com/x.netbank.commbank.com.au/netbank/bankmainx.npbs.co.uk/netmastergoldbanking/x.nwolb.xlogin.aspx?refereridentx.rbsdigital.xAccountSummaryx.smile.co.uk/SmileWeb/login.do.smile.co.uk/SmileWeb/start.do.yandex.rux/CapitalOne_Consumer/x/easypay.by/x/sbank.ru/x53.com/servlet/efsonlinex://online.wellsfargo.com/x://secure.assist.ru/assistid/protected/main.doxabbeynational.co.uk/EBAN_ENS/BtoChannelDriverxalliance-leicesterxaltergold.com/login.phpxamericanexpress.com/myca/intl/acctsumm/emea/accountSummaryxbancaintesa.it/xbankcardservices.co.ukxbankofamerica.com/xbanquepopulaire.fr/xbnpparibas.net/xcahoot.comxcapitaloneonline.co.uk/CapitalOne_Consumer/Transactionsxcbonline.co.uk/ralu/reglm-web/setupSecurityQuestionPagexcibc.comxPreSignOnxcibc.comxSignOnxcitibank.ru/xclient.uralsibbank.ruxco-operativebank.co.uk/CBIBSWeb/loginSpixcommerceonlinebanking.comxcoventrybuildingsociety.co.ukxdeutsche-bank.dexdiscovercard.com/cardmembersvcs/strongauth/app/sa_mainxebanking.bawag.comxebc_ebc1961xegg.com/customer/movemoneyxegg.com/customer/yourmoneyxfacebook.com/xhalifax-online.co.ukxMyAccountsxhalifax-online.co.uk/x/Mhalifax-online.co.uk/personalxhsbc.co.uk/1/2/personal/internet-banking/xhsbc.comxhttps://banking.postbank.de/app/finanzstatus.init.do;jsessionidxib.fineco.it/FinecoWeb/BonificiServletxib.fineco.it/FinecoWeb/jsp/Main/HBFineco.jspxib.fineco.it/FinecoWeb/jsp/Main/Principale.jspxibank.alfabank.ruxin-biz.it/xipko.plxlibertyreserve.com/x/historylibertyreserve.com/x/loginwww.libertyreserve.com/x/Core.jswww.libertyreserve.com/x/transfer.libertyreserve.com/x/commonscript.jslloydstsb.co.uk/personal/a/account_overview/xmbna.co.ukxmenyala.ruxmoney.yandex.ruxmoneybookers.com/app/login.plxmoneymail.ruxmy.ebay.co.uk/ws/eBayISAPI.dll?MyEbayxmy.ebay.com/ws/eBayISAPI.dll?MyEbayxmy.ebay.fr/ws/eBayISAPI.dll?MyEbayxmybusinessbank.co.ukxnationet.com/AppServices/SignOn/SignOnProcess/RcaSignOnxnpbs.co.ukxnwolb.com/AccountSummaryxnwolb.com/Statementsxnwolb.com/TransfersLandingPagexoltx.fidelity.com/x/x/ofsummary/summaryxonline.lloydstsb.co.ukxonlinebanking.mandtbank.com/summary/AccountSummaryxpassport.yandex.ruxpaypal.com/x/cgi-bin/webscr?cmd=_accountxpaypal.com/x/cgi-bin/webscr?cmd=_login-done&login_access=xpaypal.com/us/cgi-bin/webscr?cmd=_login-done&login_access=xposte.it/xpsk.co.at/xsecure.lloydstsb.co.uk/personal/a/account_overviewxsmile.co.uk/SmileWeb/passcodexusaa.com/xusbank.com/internetBanking/RequestRouter?requestCmdId=Gxwachovia.comxybonline.co.uk/ralu/reglm-web/setupSecurityQuestionPagex.amazon.fr/xhistory/orders/view.htmlx.banquepopulaire.frxShowPortal.dox.bnpparibasfortis.bexHome_Logon.aspx.cdiscount.com/Account/Home.aspxx.cmb.frxaccueil.jspx.credit-agricole.frxentreeBam?sessionSAGx.labanquepostale.fr/xreleveCPP-releve_ccp.eax.secure.bnpparibas.net/NSFR?Actionx.secure.lcl.frxAccueilxcredem.it/OneToOne/ebank/functionsxmijn.ing.nl/xonline.ybs.co.ukxwww.discover.com/xorder.cdiscount.comxCustomer.aspxxsealinfo.verisign.com/splash?form_filexvos-comptes.credit-du-nord.fr/CDC_TableauDeBord_0.asp?xvoscomptesenligne.labanquepostale.frxwww.x.caisse-epargne.fr/Portail.aspxxwww.exabanque.netxonglet.phpxdeutsche-bank.de/xnorisbank.de/xpostbank.de/xtargobank.de/x.x.de/portal/x.bankofamerica.com/x/commonscript.js.bmo.com/OLB?id=x.bmo.com/RMC?id=x.chase.com/x.aspxx.chase.com/js/Reporting.jsx.koodomobile.com/account/selfserve/x/xaccountId=x.payment.ru/x.scotiabank.com/portal/index.jsp?xbancopopular.es/empresasxcreval.it/login2007/loginSiciliano.aspxfirst-direct.com/xipko.plxmybusinessbank.co.ukxsanpaoloimi.com/xulsterbankanytimebanking.x/login.aspxx

Requested by

Host: content22.online.citi.com
URL: https://content22.online.citi.com/fp/check.js;CIS3SID=62CB603BA5FCA3A6F5F890B528CA28B7?org_id=89oebq5k&session_id=d00039fdc1946ea1fda48026a8aeb1aec266508999ccf402cc3fdf6e85179bef&nonce=99b8914f359a7962&pageid=1&jb=33372626687b6d753f4c616e7778266a716f3d4c616e777a266273623f4368726d6f672732303f3c

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

91.235.134.21 , Netherlands, ASN30286 (THM - ThreatMetrix Inc., US),

Reverse DNS

Software

Apache /

Resource Hash

d3b185500fba0119d71908437d441076f8fdf7cf3eecca245d6561e19e3891a8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Host: content22.online.citi.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Sec-Fetch-Site: same-site
Sec-Fetch-Mode: nested-navigate
Referer: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jEDelivery_DocCenterLetters
Accept-Encoding: gzip, deflate, br
Cookie: xyz_cr_617_et_100=cr=617&et=100&ap=; AKMTLTSID=494EAE64222CE5E8103B223BB5542315; ak_bmsc=DB5C439E6D89D4180D939708568EB79B021484524C7400008BFCF85D7CA2C776~plOG0ApshZqrOyqWoSEPqoXeB5hJS27HKTSF8ROoES7KOGeSvZmE6Wl2gDaa9ZowzGTKoIEOAGcwVBVYrrVZM403a4lzI4qPHPDD/GzMh2hmxvSpMto5TfARkO9PcXCUAm0yPHo8ce7Mgx6rn0JgtPyBiwmtDBY9prDqrlTEYjQ7lCmKztzLJB1HIaSR81kShA+nnPhKMwHmU+yc5n96Ea7ZU2e94hDbEMU8PUQxJ/kGk=; TLTSID=ad405dcda4e12aabd8d1ab8d1ac087e1e4af67e81eaf03cb9f5829d68bab0f4b; CUUID=e1390b51-81ee-4217-91ac-54c805fa3786; CITI_SITE=gtdc; mbox=check#true#1576598728|session#82456e03c67649bfb34ce128dabdebd9#1576600528|PC#82456e03c67649bfb34ce128dabdebd9.26_62#1577808269; bcsid=6880189E9231A34F3593DF566737AF59; bmuid=1576598668132-6A0D02A6-9D9C-49C8-93EE-4DCCD43204CA; cdContextId=2; experience=Uncookied; AOSDMPRF=; _cls_v=4a6aa79b-99f3-45d4-9bc7-69f2e3e2e497; _cls_s=7c8ac18f-3d6e-498d-8ffb-f2e95d6be8a9:0; cdSNum=1576598668567-sjn0000696-d2136492-03a2-4c0c-905d-468027b1ea86; BKDMP=; popSplit=90; tmx_sessionid=d00039fdc1946ea1fda48026a8aeb1aec266508999ccf402cc3fdf6e85179bef; tmx_digitalApptype=PC_BROWSER; s_fid=6DD56DCCD819679C-2CE8AA41689E2672; s_nr=1576598669235-New; gpv_pn=public%7Cmarketing%7Chome%7Cciti; s_cc=true; thx_guid=8198fd7ec252403d9bf1f5d7d8d5d71e; s_vi=[CS]v1|2EFC7E468515FBE7-600009755789AF71[CE]; cd_user_id=16f149a889916f-0e57a67195ba12-37647e03-1d4c00-16f149a889ad98
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jEDelivery_DocCenterLetters

Response headers

Date: Tue, 17 Dec 2019 16:04:29 GMT
Server: Apache
Strict-Transport-Security: max-age=31536000
Cache-Control: no-cache, no-store, must-revalidate
Pragma: no-cache
Connection: Keep-Alive, Keep-Alive
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Expires: Thu, 01 Jan 1970 00:00:00 GMT
X-UA-Compatible: IE=Edge
Content-Type: text/html;charset=UTF-8
Content-Language: en-US
Vary: Accept-Encoding
Content-Encoding: gzip
Content-Length: 5819
Keep-Alive: timeout=2, max=99

GET
H/1.1 200
OK clear.png Show response
content22.online.citi.com/fp/ Frame 5690 81 B
509 B 72ms
23ms XHR
image/png 91.235.134.21
ThreatMetrix Inc.

General

Check archive.org

Show headers Download Go to

Full URL

https://content22.online.citi.com/fp/clear.png

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

91.235.134.21 , Netherlands, ASN30286 (THM - ThreatMetrix Inc., US),

Reverse DNS

Software

Apache /

Resource Hash

95518cbec0d55a574a9c8ef72a2a7d62ac0d40a4de5dfe67a76a7d214dc8b743

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Accept: */*, 89oebq5k/99b8914f359a7962d00039fdc1946ea1fda48026a8aeb1aec266508999ccf402cc3fdf6e85179bef
Referer: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jEDelivery_DocCenterLetters
Origin: https://online.citi.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Tue, 17 Dec 2019 16:04:29 GMT
Last-Modified: Tue, 17 Dec 2019 16:04:29 GMT
Server: Apache
Etag: 09abb596856f4a11b668a2b05d44fd80
Strict-Transport-Security: max-age=31536000
Content-Type: image/png
Access-Control-Allow-Origin: *
Cache-Control: private, must-revalidate, max-age=0
Connection: Keep-Alive
Keep-Alive: timeout=2, max=100
Content-Length: 81
Expires: Sun, 15 Dec 2024 16:04:29 GMT

GET
H/1.1 200
OK ls_fp.html;CIS3SID=62CB603BA5FCA3A6F5F890B528CA28B7 Show response
content22.online.citi.com/fp/ Frame 9A45 46 KB
11 KB 27ms
26ms Document
text/html 91.235.134.21
ThreatMetrix Inc.

General

Check archive.org

Show headers Download Go to

Full URL

https://content22.online.citi.com/fp/ls_fp.html;CIS3SID=62CB603BA5FCA3A6F5F890B528CA28B7?org_id=89oebq5k&session_id=d00039fdc1946ea1fda48026a8aeb1aec266508999ccf402cc3fdf6e85179bef&nonce=99b8914f359a7962&pageid=1

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

91.235.134.21 , Netherlands, ASN30286 (THM - ThreatMetrix Inc., US),

Reverse DNS

Software

Apache /

Resource Hash

199dc414e8c9a0c2f74b1ee8896a1496015ce209c0d9a2c1ee0d32a588c4a31c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Host: content22.online.citi.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Sec-Fetch-Site: same-site
Sec-Fetch-Mode: nested-navigate
Referer: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jEDelivery_DocCenterLetters
Accept-Encoding: gzip, deflate, br
Cookie: xyz_cr_617_et_100=cr=617&et=100&ap=; AKMTLTSID=494EAE64222CE5E8103B223BB5542315; ak_bmsc=DB5C439E6D89D4180D939708568EB79B021484524C7400008BFCF85D7CA2C776~plOG0ApshZqrOyqWoSEPqoXeB5hJS27HKTSF8ROoES7KOGeSvZmE6Wl2gDaa9ZowzGTKoIEOAGcwVBVYrrVZM403a4lzI4qPHPDD/GzMh2hmxvSpMto5TfARkO9PcXCUAm0yPHo8ce7Mgx6rn0JgtPyBiwmtDBY9prDqrlTEYjQ7lCmKztzLJB1HIaSR81kShA+nnPhKMwHmU+yc5n96Ea7ZU2e94hDbEMU8PUQxJ/kGk=; TLTSID=ad405dcda4e12aabd8d1ab8d1ac087e1e4af67e81eaf03cb9f5829d68bab0f4b; CUUID=e1390b51-81ee-4217-91ac-54c805fa3786; CITI_SITE=gtdc; mbox=check#true#1576598728|session#82456e03c67649bfb34ce128dabdebd9#1576600528|PC#82456e03c67649bfb34ce128dabdebd9.26_62#1577808269; bcsid=6880189E9231A34F3593DF566737AF59; bmuid=1576598668132-6A0D02A6-9D9C-49C8-93EE-4DCCD43204CA; cdContextId=2; experience=Uncookied; AOSDMPRF=; _cls_v=4a6aa79b-99f3-45d4-9bc7-69f2e3e2e497; _cls_s=7c8ac18f-3d6e-498d-8ffb-f2e95d6be8a9:0; cdSNum=1576598668567-sjn0000696-d2136492-03a2-4c0c-905d-468027b1ea86; BKDMP=; popSplit=90; tmx_sessionid=d00039fdc1946ea1fda48026a8aeb1aec266508999ccf402cc3fdf6e85179bef; tmx_digitalApptype=PC_BROWSER; s_fid=6DD56DCCD819679C-2CE8AA41689E2672; s_nr=1576598669235-New; gpv_pn=public%7Cmarketing%7Chome%7Cciti; s_cc=true; thx_guid=8198fd7ec252403d9bf1f5d7d8d5d71e; s_vi=[CS]v1|2EFC7E468515FBE7-600009755789AF71[CE]; cd_user_id=16f149a889916f-0e57a67195ba12-37647e03-1d4c00-16f149a889ad98
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jEDelivery_DocCenterLetters

Response headers

Date: Tue, 17 Dec 2019 16:04:29 GMT
Server: Apache
Strict-Transport-Security: max-age=31536000
Cache-Control: no-cache, no-store, must-revalidate
Pragma: no-cache
Connection: Keep-Alive, Keep-Alive
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Content-Type: text/html;charset=UTF-8
Vary: Accept-Encoding
Content-Encoding: gzip
Keep-Alive: timeout=2, max=98
Transfer-Encoding: chunked

GET
H/1.1 204
No Content clear.png Show response
content22.online.citi.com/fp/ Frame 5690 0
387 B 25ms
24ms Script
text/javascript 91.235.134.21
ThreatMetrix Inc.

General

Check archive.org

Show headers Download Go to

Full URL

https://content22.online.citi.com/fp/clear.png?org_id=89oebq5k&session_id=d00039fdc1946ea1fda48026a8aeb1aec266508999ccf402cc3fdf6e85179bef&nonce=99b8914f359a7962&if=ls

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

91.235.134.21 , Netherlands, ASN30286 (THM - ThreatMetrix Inc., US),

Reverse DNS

Software

Apache /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jEDelivery_DocCenterLetters
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 17 Dec 2019 16:04:29 GMT
X-Content-Type-Options: nosniff
Server: Apache
Strict-Transport-Security: max-age=31536000
Content-Type: text/javascript
Cache-Control: no-cache, no-store, must-revalidate
Connection: Keep-Alive
Keep-Alive: timeout=2, max=97
X-XSS-Protection: 1; mode=block
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H/1.1 200
OK sid_fp.html;CIS3SID=62CB603BA5FCA3A6F5F890B528CA28B7
h.online-metrix.net/fp/ Frame C9F2 0
0 75ms
27ms Document
text/html 91.235.132.130
ThreatMetrix Inc.

General

Check archive.org

Show headers Download Go to

Full URL

https://h.online-metrix.net/fp/sid_fp.html;CIS3SID=62CB603BA5FCA3A6F5F890B528CA28B7?org_id=89oebq5k&session_id=d00039fdc1946ea1fda48026a8aeb1aec266508999ccf402cc3fdf6e85179bef&nonce=99b8914f359a7962&pageid=1

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

91.235.132.130 , Netherlands, ASN30286 (THM - ThreatMetrix Inc., US),

Reverse DNS

h.online-metrix.net

Software

Apache /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Host: h.online-metrix.net
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: nested-navigate
Referer: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jEDelivery_DocCenterLetters
Accept-Encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jEDelivery_DocCenterLetters

Response headers

Date: Tue, 17 Dec 2019 16:04:29 GMT
Server: Apache
Strict-Transport-Security: max-age=31536000
Cache-Control: no-cache, no-store, must-revalidate
Pragma: no-cache
Connection: Keep-Alive, Keep-Alive
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Content-Type: text/html;charset=UTF-8
Vary: Accept-Encoding
Content-Encoding: gzip
Keep-Alive: timeout=2, max=100
Transfer-Encoding: chunked

GET
H/1.1 204
No Content clear.png Show response
h.online-metrix.net/fp/ Frame 5690 0
387 B 67ms
25ms Script
text/javascript 91.235.132.130
ThreatMetrix Inc.

General

Check archive.org

Show headers Download Go to

Full URL

https://h.online-metrix.net/fp/clear.png?org_id=89oebq5k&session_id=d00039fdc1946ea1fda48026a8aeb1aec266508999ccf402cc3fdf6e85179bef&nonce=99b8914f359a7962&if=sid

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

91.235.132.130 , Netherlands, ASN30286 (THM - ThreatMetrix Inc., US),

Reverse DNS

h.online-metrix.net

Software

Apache /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jEDelivery_DocCenterLetters
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 17 Dec 2019 16:04:29 GMT
X-Content-Type-Options: nosniff
Server: Apache
Strict-Transport-Security: max-age=31536000
Content-Type: text/javascript
Cache-Control: no-cache, no-store, must-revalidate
Connection: Keep-Alive
Keep-Alive: timeout=2, max=99
X-XSS-Protection: 1; mode=block
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H/1.1 204
No Content clear.png Show response
content22.online.citi.com/fp/ Frame 5690 0
387 B 24ms
23ms Script
text/javascript 91.235.134.21
ThreatMetrix Inc.

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

91.235.134.21 , Netherlands, ASN30286 (THM - ThreatMetrix Inc., US),

Reverse DNS

Software

Apache /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jEDelivery_DocCenterLetters
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 17 Dec 2019 16:04:29 GMT
X-Content-Type-Options: nosniff
Server: Apache
Strict-Transport-Security: max-age=31536000
Content-Type: text/javascript
Cache-Control: no-cache, no-store, must-revalidate
Connection: Keep-Alive
Keep-Alive: timeout=2, max=98
X-XSS-Protection: 1; mode=block
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H/1.1 200
OK top_fp.html;CIS3SID=62CB603BA5FCA3A6F5F890B528CA28B7 Show response
content22.online.citi.com/fp/ Frame 2D9C 46 KB
11 KB 27ms
26ms Document
text/html 91.235.134.21
ThreatMetrix Inc.

General

Check archive.org

Show headers Download Go to

Full URL

https://content22.online.citi.com/fp/top_fp.html;CIS3SID=62CB603BA5FCA3A6F5F890B528CA28B7?org_id=89oebq5k&session_id=d00039fdc1946ea1fda48026a8aeb1aec266508999ccf402cc3fdf6e85179bef&nonce=99b8914f359a7962&pageid=1

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

91.235.134.21 , Netherlands, ASN30286 (THM - ThreatMetrix Inc., US),

Reverse DNS

Software

Apache /

Resource Hash

4b82af8c550f11aa8553e8793e13d0201852d39d0d31b8b4c087f48665674278

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Host: content22.online.citi.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Sec-Fetch-Site: same-site
Sec-Fetch-Mode: nested-navigate
Referer: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jEDelivery_DocCenterLetters
Accept-Encoding: gzip, deflate, br
Cookie: xyz_cr_617_et_100=cr=617&et=100&ap=; AKMTLTSID=494EAE64222CE5E8103B223BB5542315; ak_bmsc=DB5C439E6D89D4180D939708568EB79B021484524C7400008BFCF85D7CA2C776~plOG0ApshZqrOyqWoSEPqoXeB5hJS27HKTSF8ROoES7KOGeSvZmE6Wl2gDaa9ZowzGTKoIEOAGcwVBVYrrVZM403a4lzI4qPHPDD/GzMh2hmxvSpMto5TfARkO9PcXCUAm0yPHo8ce7Mgx6rn0JgtPyBiwmtDBY9prDqrlTEYjQ7lCmKztzLJB1HIaSR81kShA+nnPhKMwHmU+yc5n96Ea7ZU2e94hDbEMU8PUQxJ/kGk=; TLTSID=ad405dcda4e12aabd8d1ab8d1ac087e1e4af67e81eaf03cb9f5829d68bab0f4b; CUUID=e1390b51-81ee-4217-91ac-54c805fa3786; CITI_SITE=gtdc; mbox=check#true#1576598728|session#82456e03c67649bfb34ce128dabdebd9#1576600528|PC#82456e03c67649bfb34ce128dabdebd9.26_62#1577808269; bcsid=6880189E9231A34F3593DF566737AF59; bmuid=1576598668132-6A0D02A6-9D9C-49C8-93EE-4DCCD43204CA; cdContextId=2; experience=Uncookied; AOSDMPRF=; _cls_v=4a6aa79b-99f3-45d4-9bc7-69f2e3e2e497; _cls_s=7c8ac18f-3d6e-498d-8ffb-f2e95d6be8a9:0; cdSNum=1576598668567-sjn0000696-d2136492-03a2-4c0c-905d-468027b1ea86; BKDMP=; popSplit=90; tmx_sessionid=d00039fdc1946ea1fda48026a8aeb1aec266508999ccf402cc3fdf6e85179bef; tmx_digitalApptype=PC_BROWSER; s_fid=6DD56DCCD819679C-2CE8AA41689E2672; s_nr=1576598669235-New; gpv_pn=public%7Cmarketing%7Chome%7Cciti; s_cc=true; thx_guid=8198fd7ec252403d9bf1f5d7d8d5d71e; s_vi=[CS]v1|2EFC7E468515FBE7-600009755789AF71[CE]; cd_user_id=16f149a889916f-0e57a67195ba12-37647e03-1d4c00-16f149a889ad98
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jEDelivery_DocCenterLetters

Response headers

Date: Tue, 17 Dec 2019 16:04:29 GMT
Server: Apache
Strict-Transport-Security: max-age=31536000
Cache-Control: no-cache, no-store, must-revalidate
Pragma: no-cache
Connection: Keep-Alive, Keep-Alive
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Content-Type: text/html;charset=UTF-8
Vary: Accept-Encoding
Content-Encoding: gzip
Keep-Alive: timeout=2, max=99
Transfer-Encoding: chunked

GET
H/1.1 204
204 clear.png Show response
content22.online.citi.com/fp/ Frame 5690 0
218 B 26ms
25ms Script
text/javascript 91.235.134.21
ThreatMetrix Inc.

General

Check archive.org

Show headers Download Go to

Full URL

https://content22.online.citi.com/fp/clear.png?org_id=89oebq5k&session_id=d00039fdc1946ea1fda48026a8aeb1aec266508999ccf402cc3fdf6e85179bef&nonce=99b8914f359a7962&pageid=1&ja=39393926247f3f633a316c3064396337643138373d35662463353630247a3d363224643f313638387039303232266472703f332e3134323070313232382461643d3136303270333232302e737a793d307a3026736b643f30342e6c683f6874747271273141253a4e2d3a446d6c6c696c672c616b746b2c63676d25304e57532732464a52512d30466b6e6e7263737472776374757a652730467c61726565742e666d2731466e6d707c57726365652531466864722535416a4d44656e61746570795f446f614b676e76657a4c67747465707326647a3d6a76747873253141253244273044666d2661666e6d342c6369766b2c616d6d273046697473273a4475706c2e61737270273344637a2531443631352532367f75273144392532347765253146332732367d7a642d31466a74747271273037334327323d3246273a3732447777772e636b616f776e7c6f6c6c696e672e636f65253037324e6361706473253037304473766b2d3a3d30444e6f676b6c2c666d253037334e4e455a5c5d53415245454e273a373346253a353046446f616374722d323730367b6974674964253037314643422d3a3d3a346361636f776c764b6c64677a253a3533462d30353036656e69662d3035314438363a393542434342354b393644443e4543323234463b41404443343e3a4d4d343041362530346e6b6c6b4c636d6d2533464b4c5f47434f4d4d5d4b474e56455a5f57524c2530367426783d726e756f696e5d666c61716a5c64616c7b6d29786e7765696e5d756b6c666f75715f6565646b695d706e617965725c6e636c716529706e7567696c5f61646762675d616b726f6061745e64636e71652178647d6f6b6c5d71756b6169766b6d675c66696c736729726c7767696e5f71606d6369776976675e66616e736521786c776569665f7267616c706e637b67725e6e69647b6723726c75656b6c5d746c615d70646179677a5c66636c736521726477676b6e57646776616c74725e66696c716721786c7565696e5f7174655d76696d7f6d7a5c64636c736723726e77676b6c5f626176635664616e736526686a35316267326b35603861626134306669333b3237393834356265333a34663a34612e627b673f4e6b6e757a246871603d416a72676d65273a323736266a736f77354e696c7570266c68633d3336266e6c6d3f3a267c7a643f4575726d72672732464a6d7a646b6c246d61766a703f3630323164396332606d61303065366363373e32303a32696433353534323166643c353a3a313c316434656161303666613934696e6a6c3530313133333b346324657a313d3c6562643a3a323a32656562323e353064303c35636563666330623869356632316d653532646636246161663d323838383832&jb=313630266e793f4d6d7a616c6e61253244352e302d32322a4d6963696c746f736a27314025323841667c676e2732304f63612730304d51253a3058273a3231325f31345f37212732324178706e655765604b69742d324437333f2e33342532302a494a564d4c2d3a4b2d30326e696b67273032456561696f212532324b6a726d6d652532443f362e322e3b3730392e313439253238536364617a692530463533352c3134

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

91.235.134.21 , Netherlands, ASN30286 (THM - ThreatMetrix Inc., US),

Reverse DNS

Software

Apache /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jEDelivery_DocCenterLetters
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Tue, 17 Dec 2019 16:04:29 GMT
Server: Apache
Connection: Keep-Alive
Keep-Alive: timeout=2, max=96
Strict-Transport-Security: max-age=31536000
Content-Type: text/javascript;charset=UTF-8

GET
H/1.1 200
OK clear.png
89oebq5k-c07bbe33d778db1fd73c370c39db9ec49a55a8b2-am1.e.aa.online-metrix.net/fp/ Frame 5690 81 B
438 B 83ms
22ms Image
image/png 91.235.134.131
ThreatMetrix Inc.

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://89oebq5k-c07bbe33d778db1fd73c370c39db9ec49a55a8b2-am1.e.aa.online-metrix.net/fp/clear.png?org_id=89oebq5k&session_id=d00039fdc1946ea1fda48026a8aeb1aec266508999ccf402cc3fdf6e85179bef&nonce=99b8914f359a7962&pageid=1&di=yes

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

91.235.134.131 , Netherlands, ASN30286 (THM - ThreatMetrix Inc., US),

Reverse DNS

Software

Apache /

Resource Hash

95518cbec0d55a574a9c8ef72a2a7d62ac0d40a4de5dfe67a76a7d214dc8b743

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jEDelivery_DocCenterLetters
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 17 Dec 2019 16:04:29 GMT
X-Content-Type-Options: nosniff
Server: Apache
Strict-Transport-Security: max-age=31536000
Content-Type: image/png
Cache-Control: no-cache, no-store, must-revalidate
Connection: close
Content-Length: 81
X-XSS-Protection: 1; mode=block
Expires: Thu, 01 Jan 1970 00:00:00 GMT

POST
H2 200 offers.jws Show response
online.citi.com/US/REST/personalization/uncookied/ 6 KB
2 KB 189ms
188ms XHR
text/plain 104.111.239.33
Akamai Technologies

General

Check archive.org

Show headers Download Go to

Full URL

https://online.citi.com/US/REST/personalization/uncookied/offers.jws

Requested by

Host: online.citi.com
URL: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jEDelivery_DocCenterLetters

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.111.239.33 , Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),

Reverse DNS

a104-111-239-33.deploy.static.akamaitechnologies.com

Software

Resource Hash

65fc5c6745434f69c925a8e7f7ff7be5ea794562bab1ebab878236cdff4628cb

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

Accept: application/json, text/javascript, */*; q=0.01
Referer: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jEDelivery_DocCenterLetters
Origin: https://online.citi.com
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: application/json;charset=UTF-8

Response headers

strict-transport-security: max-age=300
content-encoding: gzip
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
status: 200
cid: gt07p-srv3
x-ua-compatible: IE=edge
pragma: no-cache
x-akamai-citisite: GTDC
jid: 191217110428574684098922
date: Tue, 17 Dec 2019 16:04:29 GMT
vary: Accept-Encoding
content-language: en-US
expires: Thu, 01 Jan 1970 00:00:00 GMT
cache-control: no-cache, must-revalidate, proxy-revalidate, no-store
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
content-length: 1791
content-type: text/plain;charset=UTF-8
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H/1.1

200
OK

citi.action
www.citi.com/credit-cards/rfuidmatch/
Redirect Chain

https://p.rfihub.com/uidm?_o=17169175&_u=e1390b51-81ee-4217-91ac-54c805fa3786&_sm=:R22534S@9CHG4UC24944S@9CHG4UC2232L2@9CHG4US2233L2@9CHG4US28259S1@9CHG4US28261S1@9CHG4US28264S1@9CHG4US28266S1@9CHG...
https://www.citi.com/credit-cards/rfuidmatch/citi.action?XP_UID=SY-00GfVAAR0gGLU=479

0
1 KB

297ms
217ms

Image
text/html

2.20.23.178
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.citi.com/credit-cards/rfuidmatch/citi.action?XP_UID=SY-00GfVAAR0gGLU=479
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.20.23.178 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS: a2-20-23-178.deploy.static.akamaitechnologies.com
Software: / Servlet/3.0
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jEDelivery_DocCenterLetters
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Tue, 17 Dec 2019 16:04:30 GMT
X-Akamai-CITISITE: GTDC
X-Powered-By: Servlet/3.0
Content-Language: en-US
P3P: policyref="/w3c/p3p.xml"\,CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
Access-Control-Allow-Origin: https://citimobile.citibankonline.com
x-wily-info: Clear guid=0
Cache-Control: no-cache="set-cookie, set-cookie2"
Access-Control-Allow-Credentials: true
X-UA-Compatible: IE=edge, IE=edge
Connection: keep-alive
Content-Type: text/html
Content-Length: 0
x-wily-servlet: Encrypt1 5zykd2e+ItCb/0m7VKm+5bqxSF4tudcaQZAw4RNaVUBxtcsQHMHmpDRmWo1wVjcrWSRJ2rEuIX1ZjQMeVpbGuX1Qaisb9aS5iGbaiAj3m5GoHOjIhMniu7P0iyUUEwM4sSnRjRNkmBI9EYEgqXF2zDOiiUf3XaoZevDvB7Q/xEerl3HzYMX7H5ZGjE7bF78O
Expires: Thu, 01 Dec 1994 16:00:00 GMT

Redirect headers

Location: https://www.citi.com/credit-cards/rfuidmatch/citi.action?XP_UID=SY-00GfVAAR0gGLU=479
Cache-Control: no-cache
Server: Jetty(9.0.6.v20130930)
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Content-Length: 0
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2 200 /
www.google.com/pagead/1p-user-list/763960929/ 42 B
113 B 40ms
40ms Image
image/gif 2a00:1450:4001:824::2004
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/763960929/?random=1576598669434&cv=9&fst=1576598400000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=3&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2oac61&sendb=1&data=event%3Dconversion&frm=0&url=https%3A%2F%2Fonline.citi.com%2FUS%2FJRS%2Finfrastructure%2Ftarget.do%3Fnext_page%3Djfp%7CjEDelivery_DocCenterLetters&ref=https%3A%2F%2Ffm.info6.citi.com%2Fats%2Furl.aspx%3Fcr%3D617%26wu%3D1%26we%3D1%26url%3Dhttps%253A%252F%252Fwww.accountonline.com%252Fcards%252Fsvc%252FLogin.do%253FNEXT_SCREEN%253D%252FDocctr%2526siteId%253DCB%2526accountIndex%253D%2526enid%253D06895BACB5C94FD6EC024F9CBFC462EE62C6%26linkName%3DCN_ECOMM_CENTER_URL%26transId%3DI2019121500064199&tiba=Online%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&async=1&fmt=3&is_vtc=1&random=3785869230&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:824::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jEDelivery_DocCenterLetters
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 17 Dec 2019 16:04:29 GMT
x-content-type-options: nosniff
content-type: image/gif
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, no-store, must-revalidate
content-security-policy: script-src 'none'; object-src 'none'
timing-allow-origin: *
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.de/pagead/1p-user-list/763960929/ 42 B
110 B 28ms
28ms Image
image/gif 2a00:1450:4001:824::2003
Google LLC

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/763960929/?random=1576598669434&cv=9&fst=1576598400000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=3&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2oac61&sendb=1&data=event%3Dconversion&frm=0&url=https%3A%2F%2Fonline.citi.com%2FUS%2FJRS%2Finfrastructure%2Ftarget.do%3Fnext_page%3Djfp%7CjEDelivery_DocCenterLetters&ref=https%3A%2F%2Ffm.info6.citi.com%2Fats%2Furl.aspx%3Fcr%3D617%26wu%3D1%26we%3D1%26url%3Dhttps%253A%252F%252Fwww.accountonline.com%252Fcards%252Fsvc%252FLogin.do%253FNEXT_SCREEN%253D%252FDocctr%2526siteId%253DCB%2526accountIndex%253D%2526enid%253D06895BACB5C94FD6EC024F9CBFC462EE62C6%26linkName%3DCN_ECOMM_CENTER_URL%26transId%3DI2019121500064199&tiba=Online%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&async=1&fmt=3&is_vtc=1&random=3785869230&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:824::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE - Google LLC, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jEDelivery_DocCenterLetters
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 17 Dec 2019 16:04:29 GMT
x-content-type-options: nosniff
content-type: image/gif
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, no-store, must-revalidate
content-security-policy: script-src 'none'; object-src 'none'
timing-allow-origin: *
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK Cookie set ca.html
20766699p.rfihub.com/ Frame 10A2 0
0 113ms
27ms Document
text/html 193.0.160.128
Rocket Fuel Inc.

General

Check archive.org

Show headers Download Go to

Full URL: https://20766699p.rfihub.com/ca.html?rfiidc=1870471593770096821&rfiaid=a14295ecd09145b081ee7c85ab0ae903&ver=9&ra=1971&rb=648&ca=20766699&_o=17169175&_t=noncookiedusernamepassword&ssv_cuuid=&ssv_pagename=noncookiedusernamepassword&pe=https%3A%2F%2Fonline.citi.com%2FUS%2FJRS%2Finfrastructure%2Ftarget.do%3Fnext_page%3Djfp%7CjEDelivery_DocCenterLetters&pf=https%3A%2F%2Ffm.info6.citi.com%2Fats%2Furl.aspx%3Fcr%3D617%26wu%3D1%26we%3D1%26url%3Dhttps%253A%252F%252Fwww.accountonline.com%252Fcards%252Fsvc%252FLogin.do%253FNEXT_SCREEN%253D%252FDocctr%2526siteId%253DCB%2526accountIndex%253D%2526enid%253D06895BACB5C94FD6EC024F9CBFC462EE62C6%26linkName%3DCN_ECOMM_CENTER_URL%26transId%3DI2019121500064199&ra=9734172524760154
Requested by: Host: c1.rfihub.net
URL: https://c1.rfihub.net/js/tc.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_256_CBC
Server: 193.0.160.128 , Netherlands, ASN54312 (ROCKETFUEL - Rocket Fuel Inc., US),
Reverse DNS
Software: Jetty(9.0.6.v20130930) /
Resource Hash

Request headers

Host: 20766699p.rfihub.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: nested-navigate
Referer: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jEDelivery_DocCenterLetters
Accept-Encoding: gzip, deflate, br
Cookie: rud=H4sIAAAAAAAAAOMSNrQwNzAxNzS1NDY3NzCwNLMwMhTiM9Qty0zyysvwSy5wS4mU4jU0NTcztbQwM7M0sTADAHgaq8I0AAAA; ruds=H4sIAAAAAAAAAOMSNrQwNzAxNzS1NDY3NzCwNLMwMhTiM9Qty0zyysvwSy5wS4kEAEqNBLslAAAA
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jEDelivery_DocCenterLetters

Response headers

P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Set-Cookie: rud=H4sIAAAAAAAAAOMSNrQwNzAxNzS1NDY3NzCwNLMwMhTiM9Qty0zyysvwSy5wS4mU4jU0NTcztbQwM7M0sTADAHgaq8I0AAAA;Path=/;Domain=.rfihub.com;Expires=Sun, 10-Jan-2021 16:04:29 GMT ruds=H4sIAAAAAAAAAOMSNrQwNzAxNzS1NDY3NzCwNLMwMhTiM9Qty0zyysvwSy5wS4kEAEqNBLslAAAA;Path=/;Domain=.rfihub.com
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Cache-Control: no-cache
Content-Type: text/html
Content-Encoding: gzip
Vary: Accept-Encoding, User-Agent
Transfer-Encoding: chunked
Server: Jetty(9.0.6.v20130930)

GET
H/1.1 200
OK check.js Show response
content22.online.citi.com/fp/ Frame 0530 120 KB
26 KB 31ms
30ms Script
text/javascript 91.235.134.21
ThreatMetrix Inc.

General

Check archive.org

Show headers Download Go to

Full URL

https://content22.online.citi.com/fp/check.js?&pageid=99998&session_id=d00039fdc1946ea1fda48026a8aeb1aec266508999ccf402cc3fdf6e85179bef&org_id=89oebq5k&nonce=99b8914f359a7962

Requested by

Host: content22.online.citi.com
URL: https://content22.online.citi.com/fp/HP?session_id=d00039fdc1946ea1fda48026a8aeb1aec266508999ccf402cc3fdf6e85179bef&org_id=89oebq5k&nonce=99b8914f359a7962&mode=2&hp=.co-operativebank.co.uk/CBIBSWeb/login.do.co-operativebank.co.uk/CBIBSWeb/start.do.de/portal/portal/x.entropay.com/basemenu/prot/x.facebook.comx.nationet.com/x.netbank.commbank.com.au/netbank/bankmainx.npbs.co.uk/netmastergoldbanking/x.nwolb.xlogin.aspx?refereridentx.rbsdigital.xAccountSummaryx.smile.co.uk/SmileWeb/login.do.smile.co.uk/SmileWeb/start.do.yandex.rux/CapitalOne_Consumer/x/easypay.by/x/sbank.ru/x53.com/servlet/efsonlinex://online.wellsfargo.com/x://secure.assist.ru/assistid/protected/main.doxabbeynational.co.uk/EBAN_ENS/BtoChannelDriverxalliance-leicesterxaltergold.com/login.phpxamericanexpress.com/myca/intl/acctsumm/emea/accountSummaryxbancaintesa.it/xbankcardservices.co.ukxbankofamerica.com/xbanquepopulaire.fr/xbnpparibas.net/xcahoot.comxcapitaloneonline.co.uk/CapitalOne_Consumer/Transactionsxcbonline.co.uk/ralu/reglm-web/setupSecurityQuestionPagexcibc.comxPreSignOnxcibc.comxSignOnxcitibank.ru/xclient.uralsibbank.ruxco-operativebank.co.uk/CBIBSWeb/loginSpixcommerceonlinebanking.comxcoventrybuildingsociety.co.ukxdeutsche-bank.dexdiscovercard.com/cardmembersvcs/strongauth/app/sa_mainxebanking.bawag.comxebc_ebc1961xegg.com/customer/movemoneyxegg.com/customer/yourmoneyxfacebook.com/xhalifax-online.co.ukxMyAccountsxhalifax-online.co.uk/x/Mhalifax-online.co.uk/personalxhsbc.co.uk/1/2/personal/internet-banking/xhsbc.comxhttps://banking.postbank.de/app/finanzstatus.init.do;jsessionidxib.fineco.it/FinecoWeb/BonificiServletxib.fineco.it/FinecoWeb/jsp/Main/HBFineco.jspxib.fineco.it/FinecoWeb/jsp/Main/Principale.jspxibank.alfabank.ruxin-biz.it/xipko.plxlibertyreserve.com/x/historylibertyreserve.com/x/loginwww.libertyreserve.com/x/Core.jswww.libertyreserve.com/x/transfer.libertyreserve.com/x/commonscript.jslloydstsb.co.uk/personal/a/account_overview/xmbna.co.ukxmenyala.ruxmoney.yandex.ruxmoneybookers.com/app/login.plxmoneymail.ruxmy.ebay.co.uk/ws/eBayISAPI.dll?MyEbayxmy.ebay.com/ws/eBayISAPI.dll?MyEbayxmy.ebay.fr/ws/eBayISAPI.dll?MyEbayxmybusinessbank.co.ukxnationet.com/AppServices/SignOn/SignOnProcess/RcaSignOnxnpbs.co.ukxnwolb.com/AccountSummaryxnwolb.com/Statementsxnwolb.com/TransfersLandingPagexoltx.fidelity.com/x/x/ofsummary/summaryxonline.lloydstsb.co.ukxonlinebanking.mandtbank.com/summary/AccountSummaryxpassport.yandex.ruxpaypal.com/x/cgi-bin/webscr?cmd=_accountxpaypal.com/x/cgi-bin/webscr?cmd=_login-done&login_access=xpaypal.com/us/cgi-bin/webscr?cmd=_login-done&login_access=xposte.it/xpsk.co.at/xsecure.lloydstsb.co.uk/personal/a/account_overviewxsmile.co.uk/SmileWeb/passcodexusaa.com/xusbank.com/internetBanking/RequestRouter?requestCmdId=Gxwachovia.comxybonline.co.uk/ralu/reglm-web/setupSecurityQuestionPagex.amazon.fr/xhistory/orders/view.htmlx.banquepopulaire.frxShowPortal.dox.bnpparibasfortis.bexHome_Logon.aspx.cdiscount.com/Account/Home.aspxx.cmb.frxaccueil.jspx.credit-agricole.frxentreeBam?sessionSAGx.labanquepostale.fr/xreleveCPP-releve_ccp.eax.secure.bnpparibas.net/NSFR?Actionx.secure.lcl.frxAccueilxcredem.it/OneToOne/ebank/functionsxmijn.ing.nl/xonline.ybs.co.ukxwww.discover.com/xorder.cdiscount.comxCustomer.aspxxsealinfo.verisign.com/splash?form_filexvos-comptes.credit-du-nord.fr/CDC_TableauDeBord_0.asp?xvoscomptesenligne.labanquepostale.frxwww.x.caisse-epargne.fr/Portail.aspxxwww.exabanque.netxonglet.phpxdeutsche-bank.de/xnorisbank.de/xpostbank.de/xtargobank.de/x.x.de/portal/x.bankofamerica.com/x/commonscript.js.bmo.com/OLB?id=x.bmo.com/RMC?id=x.chase.com/x.aspxx.chase.com/js/Reporting.jsx.koodomobile.com/account/selfserve/x/xaccountId=x.payment.ru/x.scotiabank.com/portal/index.jsp?xbancopopular.es/empresasxcreval.it/login2007/loginSiciliano.aspxfirst-direct.com/xipko.plxmybusinessbank.co.ukxsanpaoloimi.com/xulsterbankanytimebanking.x/login.aspxx

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

91.235.134.21 , Netherlands, ASN30286 (THM - ThreatMetrix Inc., US),

Reverse DNS

Software

Apache /

Resource Hash

fd3b3191c84b8089257035f5c12ed07e024beaf6934a338259687b84be0182a6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://content22.online.citi.com/fp/HP?session_id=d00039fdc1946ea1fda48026a8aeb1aec266508999ccf402cc3fdf6e85179bef&org_id=89oebq5k&nonce=99b8914f359a7962&mode=2&hp=.co-operativebank.co.uk/CBIBSWeb/login.do.co-operativebank.co.uk/CBIBSWeb/start.do.de/portal/portal/x.entropay.com/basemenu/prot/x.facebook.comx.nationet.com/x.netbank.commbank.com.au/netbank/bankmainx.npbs.co.uk/netmastergoldbanking/x.nwolb.xlogin.aspx?refereridentx.rbsdigital.xAccountSummaryx.smile.co.uk/SmileWeb/login.do.smile.co.uk/SmileWeb/start.do.yandex.rux/CapitalOne_Consumer/x/easypay.by/x/sbank.ru/x53.com/servlet/efsonlinex://online.wellsfargo.com/x://secure.assist.ru/assistid/protected/main.doxabbeynational.co.uk/EBAN_ENS/BtoChannelDriverxalliance-leicesterxaltergold.com/login.phpxamericanexpress.com/myca/intl/acctsumm/emea/accountSummaryxbancaintesa.it/xbankcardservices.co.ukxbankofamerica.com/xbanquepopulaire.fr/xbnpparibas.net/xcahoot.comxcapitaloneonline.co.uk/CapitalOne_Consumer/Transactionsxcbonline.co.uk/ralu/reglm-web/setupSecurityQuestionPagexcibc.comxPreSignOnxcibc.comxSignOnxcitibank.ru/xclient.uralsibbank.ruxco-operativebank.co.uk/CBIBSWeb/loginSpixcommerceonlinebanking.comxcoventrybuildingsociety.co.ukxdeutsche-bank.dexdiscovercard.com/cardmembersvcs/strongauth/app/sa_mainxebanking.bawag.comxebc_ebc1961xegg.com/customer/movemoneyxegg.com/customer/yourmoneyxfacebook.com/xhalifax-online.co.ukxMyAccountsxhalifax-online.co.uk/x/Mhalifax-online.co.uk/personalxhsbc.co.uk/1/2/personal/internet-banking/xhsbc.comxhttps://banking.postbank.de/app/finanzstatus.init.do;jsessionidxib.fineco.it/FinecoWeb/BonificiServletxib.fineco.it/FinecoWeb/jsp/Main/HBFineco.jspxib.fineco.it/FinecoWeb/jsp/Main/Principale.jspxibank.alfabank.ruxin-biz.it/xipko.plxlibertyreserve.com/x/historylibertyreserve.com/x/loginwww.libertyreserve.com/x/Core.jswww.libertyreserve.com/x/transfer.libertyreserve.com/x/commonscript.jslloydstsb.co.uk/personal/a/account_overview/xmbna.co.ukxmenyala.ruxmoney.yandex.ruxmoneybookers.com/app/login.plxmoneymail.ruxmy.ebay.co.uk/ws/eBayISAPI.dll?MyEbayxmy.ebay.com/ws/eBayISAPI.dll?MyEbayxmy.ebay.fr/ws/eBayISAPI.dll?MyEbayxmybusinessbank.co.ukxnationet.com/AppServices/SignOn/SignOnProcess/RcaSignOnxnpbs.co.ukxnwolb.com/AccountSummaryxnwolb.com/Statementsxnwolb.com/TransfersLandingPagexoltx.fidelity.com/x/x/ofsummary/summaryxonline.lloydstsb.co.ukxonlinebanking.mandtbank.com/summary/AccountSummaryxpassport.yandex.ruxpaypal.com/x/cgi-bin/webscr?cmd=_accountxpaypal.com/x/cgi-bin/webscr?cmd=_login-done&login_access=xpaypal.com/us/cgi-bin/webscr?cmd=_login-done&login_access=xposte.it/xpsk.co.at/xsecure.lloydstsb.co.uk/personal/a/account_overviewxsmile.co.uk/SmileWeb/passcodexusaa.com/xusbank.com/internetBanking/RequestRouter?requestCmdId=Gxwachovia.comxybonline.co.uk/ralu/reglm-web/setupSecurityQuestionPagex.amazon.fr/xhistory/orders/view.htmlx.banquepopulaire.frxShowPortal.dox.bnpparibasfortis.bexHome_Logon.aspx.cdiscount.com/Account/Home.aspxx.cmb.frxaccueil.jspx.credit-agricole.frxentreeBam?sessionSAGx.labanquepostale.fr/xreleveCPP-releve_ccp.eax.secure.bnpparibas.net/NSFR?Actionx.secure.lcl.frxAccueilxcredem.it/OneToOne/ebank/functionsxmijn.ing.nl/xonline.ybs.co.ukxwww.discover.com/xorder.cdiscount.comxCustomer.aspxxsealinfo.verisign.com/splash?form_filexvos-comptes.credit-du-nord.fr/CDC_TableauDeBord_0.asp?xvoscomptesenligne.labanquepostale.frxwww.x.caisse-epargne.fr/Portail.aspxxwww.exabanque.netxonglet.phpxdeutsche-bank.de/xnorisbank.de/xpostbank.de/xtargobank.de/x.x.de/portal/x.bankofamerica.com/x/commonscript.js.bmo.com/OLB?id=x.bmo.com/RMC?id=x.chase.com/x.aspxx.chase.com/js/Reporting.jsx.koodomobile.com/account/selfserve/x/xaccountId=x.payment.ru/x.scotiabank.com/portal/index.jsp?xbancopopular.es/empresasxcreval.it/login2007/loginSiciliano.aspxfirst-direct.com/xipko.plxmybusinessbank.co.ukxsanpaoloimi.com/xulsterbankanytimebanking.x/login.aspxx
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 17 Dec 2019 16:04:29 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Server: Apache
Strict-Transport-Security: max-age=31536000
Content-Type: text/javascript;charset=UTF-8
Cache-Control: no-cache, no-store, must-revalidate
Transfer-Encoding: chunked
tmx-nonce: 99b8914f359a7962
Connection: Keep-Alive, Keep-Alive
Vary: Accept-Encoding
X-XSS-Protection: 1; mode=block
Keep-Alive: timeout=2, max=95
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2 200 HP6166_H.jpg
online.citi.com/JRS/banners/hero_background/ 175 KB
176 KB 65ms
64ms Image
image/jpeg 104.111.239.33
Akamai Technologies

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://online.citi.com/JRS/banners/hero_background/HP6166_H.jpg

Requested by

Host: online.citi.com
URL: https://online.citi.com/CBOL/common/ui/ddl/theme/latest/scripts/vendor.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.111.239.33 , Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),

Reverse DNS

a104-111-239-33.deploy.static.akamaitechnologies.com

Software

Resource Hash

7e92449fbdaa05b3c40180fbc2df2c660ccddf2f5ba34c5ed53795721c1307d1

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

Referer: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jEDelivery_DocCenterLetters
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security: max-age=300
last-modified: Fri, 06 Dec 2019 20:25:42 GMT
x-akamai-citisite: GTDC
date: Tue, 17 Dec 2019 16:04:29 GMT
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
status: 200
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
accept-ranges: bytes
content-type: image/jpeg
content-length: 179135
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 200 HP_Hero_LazyLoad.jpg
online.citi.com/JRS/banners/modules/ 10 KB
10 KB 62ms
61ms Image
image/jpeg 104.111.239.33
Akamai Technologies

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://online.citi.com/JRS/banners/modules/HP_Hero_LazyLoad.jpg

Requested by

Host: online.citi.com
URL: https://online.citi.com/CBOL/common/ui/ddl/theme/latest/scripts/vendor.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.111.239.33 , Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),

Reverse DNS

a104-111-239-33.deploy.static.akamaitechnologies.com

Software

Resource Hash

b5b99c97960d130c44fad1acc54bba0644286e0fd6d3899e3027392ab7de9cc8

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

Referer: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jEDelivery_DocCenterLetters
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security: max-age=300
last-modified: Tue, 12 Sep 2017 17:22:45 GMT
x-akamai-citisite: GTDC
date: Tue, 17 Dec 2019 16:04:29 GMT
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
status: 200
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
accept-ranges: bytes
content-type: image/jpeg
content-length: 9859
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 200 arrow-btn-next-blue-sm-bold.svg
online.citi.com/CBOL/common/ui/ddl/theme/latest/images/icons/svgs/arrows/ 918 B
1000 B 235ms
234ms Image
image/svg+xml 104.111.239.33
Akamai Technologies

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://online.citi.com/CBOL/common/ui/ddl/theme/latest/images/icons/svgs/arrows/arrow-btn-next-blue-sm-bold.svg

Requested by

Host: online.citi.com
URL: https://online.citi.com/CBOL/common/ui/ddl/theme/latest/scripts/vendor.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.111.239.33 , Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),

Reverse DNS

a104-111-239-33.deploy.static.akamaitechnologies.com

Software

Resource Hash

e90fb0eba512ed6473f6fb8acf4cd09b38732f150f43c396246c12bb2aacbb67

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

Referer: https://online.citi.com/GFC/branding/responsivebranding/css/main.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security: max-age=300
content-encoding: gzip
last-modified: Tue, 12 Sep 2017 17:20:58 GMT
x-akamai-citisite: GTDC
date: Tue, 17 Dec 2019 16:04:30 GMT
vary: Accept-Encoding
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
status: 200
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
accept-ranges: bytes
content-type: image/svg+xml
content-length: 499
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 200 Citi-Branding-Sprite.png
online.citi.com/GFC/branding/img/ 5 KB
5 KB 79ms
79ms Image
image/png 104.111.239.33
Akamai Technologies

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://online.citi.com/GFC/branding/img/Citi-Branding-Sprite.png

Requested by

Host: online.citi.com
URL: https://online.citi.com/CBOL/common/ui/ddl/theme/latest/scripts/vendor.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.111.239.33 , Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),

Reverse DNS

a104-111-239-33.deploy.static.akamaitechnologies.com

Software

Resource Hash

3fca3de24621f0f10186594054444d608016297c2e853e548710b3521e42a609

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

Referer: https://online.citi.com/GFC/branding/responsivebranding/css/main_branding.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security: max-age=300
last-modified: Wed, 14 Jun 2017 18:29:01 GMT
x-akamai-citisite: GTDC
date: Tue, 17 Dec 2019 16:04:29 GMT
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
status: 200
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
accept-ranges: bytes
content-type: image/png
content-length: 4952
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 200 appStore_1px.png
online.citi.com/GFC/branding/responsivebranding/img/ 3 KB
4 KB 97ms
96ms Image
image/png 104.111.239.33
Akamai Technologies

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://online.citi.com/GFC/branding/responsivebranding/img/appStore_1px.png

Requested by

Host: online.citi.com
URL: https://online.citi.com/CBOL/common/ui/ddl/theme/latest/scripts/vendor.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.111.239.33 , Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),

Reverse DNS

a104-111-239-33.deploy.static.akamaitechnologies.com

Software

Resource Hash

f44e4692a52b6a382cb481e23f8bcb9a6d4c24eec8aa60143c7e2ca3a85758b2

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

Referer: https://online.citi.com/GFC/branding/responsivebranding/css/main_branding.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security: max-age=300
last-modified: Thu, 27 Sep 2018 21:19:09 GMT
x-akamai-citisite: GTDC
date: Tue, 17 Dec 2019 16:04:29 GMT
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
status: 200
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
accept-ranges: bytes
content-type: image/png
content-length: 3513
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 200 googlePlay_1px.png
online.citi.com/GFC/branding/responsivebranding/img/ 4 KB
4 KB 98ms
96ms Image
image/png 104.111.239.33
Akamai Technologies

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://online.citi.com/GFC/branding/responsivebranding/img/googlePlay_1px.png

Requested by

Host: online.citi.com
URL: https://online.citi.com/CBOL/common/ui/ddl/theme/latest/scripts/vendor.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.111.239.33 , Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),

Reverse DNS

a104-111-239-33.deploy.static.akamaitechnologies.com

Software

Resource Hash

1cc4ec61057f30cea6d47126e0444f119b2606720b1fe8d7e0deff1f5742a82b

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

Referer: https://online.citi.com/GFC/branding/responsivebranding/css/main_branding.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security: max-age=300
last-modified: Thu, 27 Sep 2018 21:21:52 GMT
x-akamai-citisite: GTDC
date: Tue, 17 Dec 2019 16:04:29 GMT
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
status: 200
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
accept-ranges: bytes
content-type: image/png
content-length: 3900
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 200 arrow-btn-next-white-sm-bold.svg
online.citi.com/CBOL/common/ui/ddl/theme/latest/images/icons/svgs/arrows/ 918 B
997 B 253ms
251ms Image
image/svg+xml 104.111.239.33
Akamai Technologies

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://online.citi.com/CBOL/common/ui/ddl/theme/latest/images/icons/svgs/arrows/arrow-btn-next-white-sm-bold.svg

Requested by

Host: online.citi.com
URL: https://online.citi.com/CBOL/common/ui/ddl/theme/latest/scripts/vendor.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.111.239.33 , Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),

Reverse DNS

a104-111-239-33.deploy.static.akamaitechnologies.com

Software

Resource Hash

4f918cd256712c03a1b88007176cabf623cc63740e919d35a217c18dc7ebe607

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

Referer: https://online.citi.com/loginpage/styles/homePage.min.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security: max-age=300
content-encoding: gzip
last-modified: Tue, 12 Sep 2017 17:22:45 GMT
x-akamai-citisite: GTDC
date: Tue, 17 Dec 2019 16:04:30 GMT
vary: Accept-Encoding
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
status: 200
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
accept-ranges: bytes
content-type: image/svg+xml
content-length: 496
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 200 oo_icon_retina.gif
online.citi.com/GFC/branding/olab/images/ 2 KB
3 KB 127ms
126ms Image
image/gif 104.111.239.33
Akamai Technologies

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://online.citi.com/GFC/branding/olab/images/oo_icon_retina.gif

Requested by

Host: online.citi.com
URL: https://online.citi.com/CBOL/common/ui/ddl/theme/latest/scripts/vendor.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.111.239.33 , Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),

Reverse DNS

a104-111-239-33.deploy.static.akamaitechnologies.com

Software

Resource Hash

701d2f9f02741b8429f4fb892b2b48c34a8a0f9189cb09013b2799031f22e484

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

Referer: https://online.citi.com/GFC/branding/responsivebranding/css/main_branding.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security: max-age=300
last-modified: Tue, 12 Sep 2017 17:12:07 GMT
x-akamai-citisite: GTDC
date: Tue, 17 Dec 2019 16:04:30 GMT
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
status: 200
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
accept-ranges: bytes
content-type: image/gif
content-length: 2204
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

POST
H2 200 metrics Show response
online.citi.com/gcgapi/prod/public/v1/digital/reporting/ 0
2 KB 379ms
379ms XHR
text/plain 104.111.239.33
Akamai Technologies

General

Check archive.org

Show headers Download Go to

Full URL

https://online.citi.com/gcgapi/prod/public/v1/digital/reporting/metrics

Requested by

Host: online.citi.com
URL: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jEDelivery_DocCenterLetters

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.111.239.33 , Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),

Reverse DNS

a104-111-239-33.deploy.static.akamaitechnologies.com

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

Origin: https://online.citi.com
Accept-Language: en-US
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: application/json
scope: VISITOR
Accept: application/json, text/javascript, */*; q=0.01
Referer: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jEDelivery_DocCenterLetters
countryCode: US
X-Requested-With: XMLHttpRequest
client_id: 4a51fb19-a1a7-4247-bc7e-18aa56dd1c40

Response headers

date: Tue, 17 Dec 2019 16:04:30 GMT
content-encoding: gzip
citiuuid: e6a416d8-25bd-4e30-bcac-183487214e867801438
router-host: api.citi.com
access-control-allow-origin: https://online.citi.com
biztoken: L+3YhoAfmlPCt4kca7fcu0M9aHGzuQexKAnkY6NX9ZJWQgweXRwOGiN4XnCe/MPvKwQ5fP/4soiUiL6t8SOOCZBbFUV+T/pNajAwUZa4Lss=
status: 200
access-control-max-age: 2147483647
x-global-transaction-id: 218734185df8fc8e1b43094d
uuid: b8f91d8b-9cf5-4a7a-ae19-4ebd9d908349
content-length: 0
pragma: no-cache
expires: -1
x-akamai-citisite: GTDC
dclocation: GT1
vary: Accept-Encoding
access-control-allow-methods: GET,PUT,POST,DELETE,HEAD,GET,POST,PUT,DELETE
content-type: text/plain
x-backside-transport: OK OK,OK OK,OK OK
x-vcap-request-id: df71eef2-c758-4f91-4a31-331053f8116a,91b7e53d-5761-4462-7dd0-476a0cedc6c8
access-control-expose-headers: action,challengeType,bizToken,eventid,Eventid,Eventidexpirytime,eventidexpirytime,accesstoken,Authorization,sid,SessionId,CCPToken,CFIToken,Accept,Accept-Language,Authorization,businessCode,client_id,content-type,countryCode,uuid,x-ibm-client-id,eventid,sessionID,bizToken,citiuuid,applicationId,channelId,Scope,blackBox,devicePrint,deviceTokenCookie,AMWResponse,action,challengeType,TMXSessionId,tenantName,TMXDigitalApplicationType,accessToken,familyIndicator,Otpid,deviceId,subscriberId,CitiProfOnly,digitalApplicationType,environmentId,BioCatchSessionId,X-Migration-Target,x-soz9htcz-a,x-soz9htcz-b,x-soz9htcz-c,x-soz9htcz-d,x-soz9htcz-e,x-soz9htcz-f,x-soz9htcz-z,x-soz9htcz-uniquestatekey,tenantId,appid,X-Akamai-CITISITE,Dclocation,Uuid,appVersion
cache-control: no-cache, no-store
access-control-allow-credentials: true
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
access-control-allow-headers: action,challengeType,accesstoken,,Content-Type,sid,CCPToken,CFIToken,countryCode,businessCode,channelId,uuid,client_id,environmentId,Accept,Accept-Language,Authorization,businessCode,client_id,content-type,countryCode,uuid,x-ibm-client-id,eventid,sessionID,bizToken,citiuuid,applicationId,channelId,Scope,blackBox,devicePrint,deviceTokenCookie,AMWResponse,action,challengeType,TMXSessionId,tenantName,TMXDigitalApplicationType,accessToken,familyIndicator,Otpid,deviceId,subscriberId,CitiProfOnly,digitalApplicationType,environmentId,BioCatchSessionId,X-Migration-Target,x-soz9htcz-a,x-soz9htcz-b,x-soz9htcz-c,x-soz9htcz-d,x-soz9htcz-e,x-soz9htcz-f,x-soz9htcz-z,x-soz9htcz-uniquestatekey,tenantId,appid,X-Akamai-CITISITE,Dclocation,Uuid,appVersion
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 200 HP_Hero_LazyLoad_1120x630.jpg
online.citi.com/JRS/banners/modules/ 12 KB
13 KB 167ms
166ms Image
image/jpeg 104.111.239.33
Akamai Technologies

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://online.citi.com/JRS/banners/modules/HP_Hero_LazyLoad_1120x630.jpg

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.111.239.33 , Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),

Reverse DNS

a104-111-239-33.deploy.static.akamaitechnologies.com

Software

Resource Hash

e18c28c95bea1af6b2187c6a35eb651dccabfb2212e529b6edd4a2e2f4c39ea8

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

Referer: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jEDelivery_DocCenterLetters
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security: max-age=300
last-modified: Tue, 12 Sep 2017 17:12:07 GMT
x-akamai-citisite: GTDC
date: Tue, 17 Dec 2019 16:04:30 GMT
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
status: 200
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
accept-ranges: bytes
content-type: image/jpeg
content-length: 12405
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 200 HP5821_M.jpg
online.citi.com/JRS/banners/modules/ 94 KB
95 KB 168ms
166ms Image
image/jpeg 104.111.239.33
Akamai Technologies

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://online.citi.com/JRS/banners/modules/HP5821_M.jpg

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.111.239.33 , Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),

Reverse DNS

a104-111-239-33.deploy.static.akamaitechnologies.com

Software

Resource Hash

7adf69580aead1321588b6f81a92518ac9724f3da846970c349fa91630145bfc

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

Referer: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jEDelivery_DocCenterLetters
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security: max-age=300
last-modified: Thu, 26 Sep 2019 14:15:43 GMT
x-akamai-citisite: GTDC
date: Tue, 17 Dec 2019 16:04:30 GMT
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
status: 200
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
accept-ranges: bytes
content-type: image/jpeg
content-length: 96259
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 200 M1-M7_Rewards.jpg
online.citi.com/JRS/banners/modules/ 99 KB
100 KB 193ms
192ms Image
image/jpeg 104.111.239.33
Akamai Technologies

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://online.citi.com/JRS/banners/modules/M1-M7_Rewards.jpg

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.111.239.33 , Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),

Reverse DNS

a104-111-239-33.deploy.static.akamaitechnologies.com

Software

Resource Hash

b7264725078e153ab3a4af37c52374b3a5d46b8fb5fc7b5f8af2e773364eef93

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

Referer: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jEDelivery_DocCenterLetters
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security: max-age=300
last-modified: Thu, 21 Nov 2019 18:59:04 GMT
x-akamai-citisite: GTDC
date: Tue, 17 Dec 2019 16:04:30 GMT
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
status: 200
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
accept-ranges: bytes
content-type: image/jpeg
content-length: 101509
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 200 HP2900_M.jpg
online.citi.com/JRS/banners/modules/ 537 KB
538 KB 200ms
199ms Image
image/jpeg 104.111.239.33
Akamai Technologies

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://online.citi.com/JRS/banners/modules/HP2900_M.jpg

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.111.239.33 , Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),

Reverse DNS

a104-111-239-33.deploy.static.akamaitechnologies.com

Software

Resource Hash

61eb6e3a621d1621e6fb229128f863795e9d9b7bf80fb76eec9a7d70fde09e41

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

Referer: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jEDelivery_DocCenterLetters
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security: max-age=300
last-modified: Tue, 16 Oct 2018 14:12:31 GMT
x-akamai-citisite: GTDC
date: Tue, 17 Dec 2019 16:04:30 GMT
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
status: 200
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
accept-ranges: bytes
content-type: image/jpeg
content-length: 549746
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 200 M1-M7_Simplicity.jpg
online.citi.com/JRS/banners/modules/ 58 KB
59 KB 231ms
230ms Image
image/jpeg 104.111.239.33
Akamai Technologies

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://online.citi.com/JRS/banners/modules/M1-M7_Simplicity.jpg

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.111.239.33 , Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),

Reverse DNS

a104-111-239-33.deploy.static.akamaitechnologies.com

Software

Resource Hash

8b9920ca91285fba330bf415bc1e74ec46aa0b84308fbc29e78a5c7d864c3544

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

Referer: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jEDelivery_DocCenterLetters
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security: max-age=300
last-modified: Thu, 21 Nov 2019 18:59:04 GMT
x-akamai-citisite: GTDC
date: Tue, 17 Dec 2019 16:04:30 GMT
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
status: 200
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
accept-ranges: bytes
content-type: image/jpeg
content-length: 59439
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H/1.1 200
OK ARF;CIS3SID=524AC2C648A7447184155DAA2354276B Show response
content22.online.citi.com/fp/ Frame 0530 35 B
557 B 26ms
25ms Script
text/javascript 91.235.134.21
ThreatMetrix Inc.

General

Check archive.org

Show headers Download Go to

Full URL

https://content22.online.citi.com/fp/ARF;CIS3SID=524AC2C648A7447184155DAA2354276B?org_id=89oebq5k&session_id=d00039fdc1946ea1fda48026a8aeb1aec266508999ccf402cc3fdf6e85179bef&nonce=99b8914f359a7962&pageid=99998&sera_parametere=X0lfCAoIBVIFBg9XVAsGCgBYBFsOUwVUUFQBBwANUApcCVcACgRRVAICXUdESgtbV0kXTEoUByIWAntEAH0TAAlTEV1VVFkDXUFKRAR9EwV7CUcPfRQGVltaShVEHAV2HA4gHQ51EgJaCFtXAQAHAQsLAVwBUwxXVgwBVlIJUlEAWgEKDgRRVQAMCwJRDQIDAQhEVlZfVwMODAADDwAHBl8KVwFYBg1QARNTEgoJTgoMXVUNAAMMBVBUAVZTXFAACQwHCAoDUl8FUwAFUQ4DCl8KVwAPB1dAUlwEUwIOBRRQUF8VCBdEDw4MAFgOARBaUgREWgRyXBRcWFxHVU8LBQ0fAFdKDHgPXUBBR1RbC0ZdQz1bWF1YBFJWUkdSTQsDCA4%3D&count=0&max=0

Requested by

Host: content22.online.citi.com
URL: https://content22.online.citi.com/fp/check.js?&pageid=99998&session_id=d00039fdc1946ea1fda48026a8aeb1aec266508999ccf402cc3fdf6e85179bef&org_id=89oebq5k&nonce=99b8914f359a7962

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

91.235.134.21 , Netherlands, ASN30286 (THM - ThreatMetrix Inc., US),

Reverse DNS

Software

Apache /

Resource Hash

ead2056c5689a3c759205fbe7259929e693f0cce04e8a70e02e0e2339e95ee9f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://content22.online.citi.com/fp/HP?session_id=d00039fdc1946ea1fda48026a8aeb1aec266508999ccf402cc3fdf6e85179bef&org_id=89oebq5k&nonce=99b8914f359a7962&mode=2&hp=.co-operativebank.co.uk/CBIBSWeb/login.do.co-operativebank.co.uk/CBIBSWeb/start.do.de/portal/portal/x.entropay.com/basemenu/prot/x.facebook.comx.nationet.com/x.netbank.commbank.com.au/netbank/bankmainx.npbs.co.uk/netmastergoldbanking/x.nwolb.xlogin.aspx?refereridentx.rbsdigital.xAccountSummaryx.smile.co.uk/SmileWeb/login.do.smile.co.uk/SmileWeb/start.do.yandex.rux/CapitalOne_Consumer/x/easypay.by/x/sbank.ru/x53.com/servlet/efsonlinex://online.wellsfargo.com/x://secure.assist.ru/assistid/protected/main.doxabbeynational.co.uk/EBAN_ENS/BtoChannelDriverxalliance-leicesterxaltergold.com/login.phpxamericanexpress.com/myca/intl/acctsumm/emea/accountSummaryxbancaintesa.it/xbankcardservices.co.ukxbankofamerica.com/xbanquepopulaire.fr/xbnpparibas.net/xcahoot.comxcapitaloneonline.co.uk/CapitalOne_Consumer/Transactionsxcbonline.co.uk/ralu/reglm-web/setupSecurityQuestionPagexcibc.comxPreSignOnxcibc.comxSignOnxcitibank.ru/xclient.uralsibbank.ruxco-operativebank.co.uk/CBIBSWeb/loginSpixcommerceonlinebanking.comxcoventrybuildingsociety.co.ukxdeutsche-bank.dexdiscovercard.com/cardmembersvcs/strongauth/app/sa_mainxebanking.bawag.comxebc_ebc1961xegg.com/customer/movemoneyxegg.com/customer/yourmoneyxfacebook.com/xhalifax-online.co.ukxMyAccountsxhalifax-online.co.uk/x/Mhalifax-online.co.uk/personalxhsbc.co.uk/1/2/personal/internet-banking/xhsbc.comxhttps://banking.postbank.de/app/finanzstatus.init.do;jsessionidxib.fineco.it/FinecoWeb/BonificiServletxib.fineco.it/FinecoWeb/jsp/Main/HBFineco.jspxib.fineco.it/FinecoWeb/jsp/Main/Principale.jspxibank.alfabank.ruxin-biz.it/xipko.plxlibertyreserve.com/x/historylibertyreserve.com/x/loginwww.libertyreserve.com/x/Core.jswww.libertyreserve.com/x/transfer.libertyreserve.com/x/commonscript.jslloydstsb.co.uk/personal/a/account_overview/xmbna.co.ukxmenyala.ruxmoney.yandex.ruxmoneybookers.com/app/login.plxmoneymail.ruxmy.ebay.co.uk/ws/eBayISAPI.dll?MyEbayxmy.ebay.com/ws/eBayISAPI.dll?MyEbayxmy.ebay.fr/ws/eBayISAPI.dll?MyEbayxmybusinessbank.co.ukxnationet.com/AppServices/SignOn/SignOnProcess/RcaSignOnxnpbs.co.ukxnwolb.com/AccountSummaryxnwolb.com/Statementsxnwolb.com/TransfersLandingPagexoltx.fidelity.com/x/x/ofsummary/summaryxonline.lloydstsb.co.ukxonlinebanking.mandtbank.com/summary/AccountSummaryxpassport.yandex.ruxpaypal.com/x/cgi-bin/webscr?cmd=_accountxpaypal.com/x/cgi-bin/webscr?cmd=_login-done&login_access=xpaypal.com/us/cgi-bin/webscr?cmd=_login-done&login_access=xposte.it/xpsk.co.at/xsecure.lloydstsb.co.uk/personal/a/account_overviewxsmile.co.uk/SmileWeb/passcodexusaa.com/xusbank.com/internetBanking/RequestRouter?requestCmdId=Gxwachovia.comxybonline.co.uk/ralu/reglm-web/setupSecurityQuestionPagex.amazon.fr/xhistory/orders/view.htmlx.banquepopulaire.frxShowPortal.dox.bnpparibasfortis.bexHome_Logon.aspx.cdiscount.com/Account/Home.aspxx.cmb.frxaccueil.jspx.credit-agricole.frxentreeBam?sessionSAGx.labanquepostale.fr/xreleveCPP-releve_ccp.eax.secure.bnpparibas.net/NSFR?Actionx.secure.lcl.frxAccueilxcredem.it/OneToOne/ebank/functionsxmijn.ing.nl/xonline.ybs.co.ukxwww.discover.com/xorder.cdiscount.comxCustomer.aspxxsealinfo.verisign.com/splash?form_filexvos-comptes.credit-du-nord.fr/CDC_TableauDeBord_0.asp?xvoscomptesenligne.labanquepostale.frxwww.x.caisse-epargne.fr/Portail.aspxxwww.exabanque.netxonglet.phpxdeutsche-bank.de/xnorisbank.de/xpostbank.de/xtargobank.de/x.x.de/portal/x.bankofamerica.com/x/commonscript.js.bmo.com/OLB?id=x.bmo.com/RMC?id=x.chase.com/x.aspxx.chase.com/js/Reporting.jsx.koodomobile.com/account/selfserve/x/xaccountId=x.payment.ru/x.scotiabank.com/portal/index.jsp?xbancopopular.es/empresasxcreval.it/login2007/loginSiciliano.aspxfirst-direct.com/xipko.plxmybusinessbank.co.ukxsanpaoloimi.com/xulsterbankanytimebanking.x/login.aspxx
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 17 Dec 2019 16:04:30 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Server: Apache
Strict-Transport-Security: max-age=31536000
Content-Type: text/javascript;charset=UTF-8
Cache-Control: no-cache, no-store, must-revalidate
Transfer-Encoding: chunked
Connection: Keep-Alive, Keep-Alive
Vary: Accept-Encoding
X-XSS-Protection: 1; mode=block
Keep-Alive: timeout=2, max=94
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H/1.1 204
No Content clear.png Show response
content22.online.citi.com/fp/ Frame 5690 0
387 B 23ms
22ms Script
text/javascript 91.235.134.21
ThreatMetrix Inc.

General

Check archive.org

Show headers Download Go to

Full URL

https://content22.online.citi.com/fp/clear.png?org_id=89oebq5k&session_id=d00039fdc1946ea1fda48026a8aeb1aec266508999ccf402cc3fdf6e85179bef&nonce=99b8914f359a7962&pageid=1&jac=1&je=32343926247f676270746b5f6b6e7465706e616c5769723f39316237373832622f3b3366652d3c31313e2f633461372f643a6330373b303539343331266e6f61616c2c36603f3a3166366e2d603932322f3463656d2d603b66302d30373930636133613434333f26646761636e267767607076615f677a746d726e63645d69723d3139332c312c31333326313337266263747374357b206e657e656c203a312e32322e207374697c7d7b20382063686370656b6c67207f266975646a3566646065336363343d313263326d6631653537376632666d356660313f37333261653737373332613738386e6963333565376133313031353030343f3066366e

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

91.235.134.21 , Netherlands, ASN30286 (THM - ThreatMetrix Inc., US),

Reverse DNS

Software

Apache /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jEDelivery_DocCenterLetters
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 17 Dec 2019 16:04:30 GMT
X-Content-Type-Options: nosniff
Server: Apache
Strict-Transport-Security: max-age=31536000
Content-Type: text/javascript
Cache-Control: no-cache, no-store, must-revalidate
Connection: Keep-Alive
Keep-Alive: timeout=2, max=97
X-XSS-Protection: 1; mode=block
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2 200 s18600052892806
metrics1.citi.com/b/ss/citinaprod/1/JS-2.0.0/ 43 B
317 B 25ms
24ms Image
image/gif 15.188.31.119
Amazon.com

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://metrics1.citi.com/b/ss/citinaprod/1/JS-2.0.0/s18600052892806?AQB=1&ndh=1&pf=1&t=17%2F11%2F2019%2017%3A4%3A30%202%20-60&fid=6DD56DCCD819679C-2CE8AA41689E2672&ce=UTF-8&pageName=Non%20Cookied%20Username%20Password&g=https%3A%2F%2Fonline.citi.com%2FUS%2FJRS%2Finfrastructure%2Ftarget.do%3Fnext_page%3Djfp%7CjEDelivery_DocCenterLetters&r=https%3A%2F%2Ffm.info6.citi.com%2Fats%2Furl.aspx%3Fcr%3D617%26wu%3D1%26we%3D1%26url%3Dhttps%253A%252F%252Fwww.accountonline.com%252Fcards%252Fsvc%252FLogin.do%253FNEXT_SCREEN%253D%252FDocctr%2526siteId%253DCB%2526accountIndex%253D%2526enid%253D06895BACB5C94FD6EC024F9CBFC462EE62C6%26linkName%3DCN_ECOMM_CENTER_URL%26transId%3DI2019121500064199&c.&visitStart=1&.c&cc=USD&ch=CBOL&c1=Public&h1=CBOL%2FPublic%2FSignOn%2F%2F&c2=SignOn&l3=1%3AHYCA_NoATMFee%7Cundefined%3A3up%7C5%3Asim_citicomREDPE_oct2016%7C6%3Ampc_citicom_may2016%7C7%3ACWWN%7C&c8=pre-login%20Sign%20on%20page&c9=US&v9=52283f6a93b84d2b9d38f83b28b86e08%7CPRD%7CB178_01%7CI000&c11=english&v12=82456e03c67649bfb34ce128dabdebd9.26_62&c25=%5BCS%5Dv1%7C2EFC7E468515FBE7-600009755789AF71%5BCE%5D&c26=success%7C66823423&c27=52283f6a93b84d2b9d38f83b28b86e08%7CPRD%7CB178_01%7CI000&c37=na_prod&v38=Non%20Cookied%20Username%20Password&v42=en_US_USPTL&v52=HYCA_NoATMFee%7C1%7Chero-one%2CCheckQ419_700SA%7C2%7Cmod-two%2CCITI_RewardsPlus_18%7C3%7Cmod-two%2CCOSTCOCONSUMER_CITICOM_OCT2018%7C4%7Cmod-two%2Csim_citicomREDPE_oct2016%7C5%7Cmod-seven%2Cmpc_citicom_may2016%7C6%7Cmod-one%2CCWWN%7C7%7Cmod-three%7EN&c59=jUSCBOL_Loginpage_Uncookied&c61=21&v62=e1390b51-81ee-4217-91ac-54c805fa3786&c63=https%3A%2F%2Fonline.citi.com%2FUS%2FJRS%2Finfrastructure%2Ftarget.do%3Fnext_page%3Djfp%7CjEDelivery_DocCenterLetters&c64=11%3A04AM&v64=11%3A04AM&c65=Tuesday&v65=Tuesday&c66=Tuesday%7C11%3A04AM&v67=New&v68=1&c69=not%20logged%20in&c73=624610%2C358910%2C354602%2C373773%2C490004%2C622672%2C582775%2C593700%2C495376%2C495377%2C584566%2C495374%2C542251%2C495375%2C573017%2C522574%2C552021%2C588511%2C522572%2C578269%2C490141%2C580663%2C626438%2C515853%2C522576%2C562734%2C551962%2C600937%2C507276%2C555592%2C551970%2C571630%2C385436%2C572752%2C583873%2C531459%2C512346%2C578262%2C521100%2C574962%2C613371%2C578343%2C606935%2C569456%2C565689%2C609396%2C609397%2C494437%2C388219%2C492646%2C567637%2C359218%2C528144%2C488122%2C572750%2C359214%2C486892%2C510670%2C369351&v73=medium%7C1600&v78=Yes&v79=c3ca17be-2ed8-4524-bf48-d504467ef50e&v87=online.citi.com&v96=sv%7Cbos%3A1%7Cdsa%3A1%7Cax%3A1%7Cdsr%3A1%7Crf%3A1%7Ccms%3A1&s=1600x1200&c=24&j=1.6&v=N&k=Y&bw=1600&bh=1200&AQE=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

15.188.31.119 Paris, France, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),

Reverse DNS

ec2-15-188-31-119.eu-west-3.compute.amazonaws.com

Software

jag /

Resource Hash

a1ecbaed793a1f564c49c671f2dd0ce36f858534ef6d26b55783a06b884cc506

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jEDelivery_DocCenterLetters
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Tue, 17 Dec 2019 16:04:29 GMT
x-content-type-options: nosniff
x-c: master-1061.Iecc33a.M0-311
p3p: CP="This is not a P3P policy"
status: 200
content-length: 43
x-xss-protection: 1; mode=block
pragma: no-cache
last-modified: Wed, 18 Dec 2019 16:04:30 GMT
server: jag
xserver: anedge-5fc496b8d4-s4s7x
etag: 3385719863368843264-4614369274407741205
vary: *
content-type: image/gif;charset=utf-8
access-control-allow-origin: *
cache-control: no-cache, no-store, max-age=0, no-transform, private
expires: Mon, 16 Dec 2019 16:04:30 GMT

GET
H/1.1 200
OK cls_report Show response
prod.report.nacustomerexperience.citi.com/glassbox/reporting/ 0
614 B 657ms
121ms XHR
text/plain 192.193.200.243
Citigroup

General

Check archive.org

Show headers Download Go to

Full URL

https://prod.report.nacustomerexperience.citi.com/glassbox/reporting/cls_report?_cls_s=7c8ac18f-3d6e-498d-8ffb-f2e95d6be8a9%3A0&_cls_v=4a6aa79b-99f3-45d4-9bc7-69f2e3e2e497

Requested by

Host: online.citi.com
URL: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jEDelivery_DocCenterLetters

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

192.193.200.243 , United States, ASN32287 (SOLANA-CITIPLEX - Citigroup, US),

Reverse DNS

Software

GlassBox Cligate /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubdomains;
X-Frame-Options	SAMEORIGIN

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp|jEDelivery_DocCenterLetters
Origin: https://online.citi.com

Response headers

Strict-Transport-Security: max-age=63072000; includeSubdomains;
Vary: Origin
Server: GlassBox Cligate
X-Akamai-CITISITE: SWDC
Date: Tue, 17 Dec 2019 16:04:39 GMT
X-Frame-Options: SAMEORIGIN
Content-Type: text/plain; charset=utf-8
Access-Control-Allow-Origin: https://online.citi.com
Access-Control-Allow-Credentials: true
Connection: close
Content-Length: 0

POST cls_report
prod.report.nacustomerexperience.citi.com/glassbox/reporting/ 0
0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: prod.report.nacustomerexperience.citi.com
URL: https://prod.report.nacustomerexperience.citi.com/glassbox/reporting/cls_report?clsjsv=6.2.78B29&_cls_s=7c8ac18f-3d6e-498d-8ffb-f2e95d6be8a9:0&_cls_v=4a6aa79b-99f3-45d4-9bc7-69f2e3e2e497&pid=d1c301ef-8ee2-4364-80a2-c1535a020e4a&sn=1

Verdicts & Comments Add Verdict or Comment

548 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

31 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
online.citi.com/	1970-01-19 14:42:14	Name: kampyleSessionPageCounter Value: 1
online.citi.com/	1970-01-19 14:42:14	Name: kampyle_userid Value: aba7-8ac6-3894-8399-2d10-1473-8dbe-68b7
.citi.com/	1969-12-31 23:59:59	Name: s_cc Value: true
online.citi.com/	1970-01-19 14:42:14	Name: kampyleUserSessionsCount Value: 1
.citi.com/	1970-01-19 05:56:40	Name: gpv_pn Value: public%7Cmarketing%7Chome%7Cciti
.citi.com/	1970-01-19 06:39:50	Name: s_nr Value: 1576598669235-New
.citi.com/	1970-01-21 01:47:31	Name: s_fid Value: 6DD56DCCD819679C-2CE8AA41689E2672
online.citi.com/	1970-01-19 14:42:14	Name: kampyleUserSession Value: 1576598669358
.citi.com/	1969-12-31 23:59:59	Name: tmx_sessionid Value: d00039fdc1946ea1fda48026a8aeb1aec266508999ccf402cc3fdf6e85179bef
.citi.com/	1969-12-31 23:59:59	Name: _cls_s Value: 7c8ac18f-3d6e-498d-8ffb-f2e95d6be8a9:0
.online.citi.com/	1970-01-19 10:15:50	Name: popSplit Value: 90
.citi.com/	1969-12-31 23:59:59	Name: BKDMP Value:
.citi.com/	1970-01-19 06:16:48	Name: mbox Value: check#true#1576598728\|session#82456e03c67649bfb34ce128dabdebd9#1576600528\|PC#82456e03c67649bfb34ce128dabdebd9.26_62#1577808269
.citi.com/	1970-01-19 05:57:00	Name: cdSNum Value: 1576598668567-sjn0000696-d2136492-03a2-4c0c-905d-468027b1ea86
.citi.com/	1970-01-19 14:42:14	Name: bmuid Value: 1576598668132-6A0D02A6-9D9C-49C8-93EE-4DCCD43204CA
online.citi.com/	1970-01-19 05:56:40	Name: 7018 Value: e1390b51-81ee-4217-91ac-54c805fa3786
online.citi.com/	1970-01-19 05:56:40	Name: 7830 Value: error
online.citi.com/	1969-12-31 23:59:59	Name: JSESSIONID Value: 0000LLe_qCRdMHxHAjPJunQ3nBW:gt07p-srv3
.citi.com/	1969-12-31 23:59:59	Name: tmx_digitalApptype Value: PC_BROWSER
.online.citi.com/	1969-12-31 23:59:59	Name: AOSDMPRF Value:
.online.citi.com/	1969-12-31 23:59:59	Name: experience Value: Uncookied
.citi.com/	1969-12-31 23:59:59	Name: cdContextId Value: 2
online.citi.com/	1970-01-19 14:42:14	Name: count Value: 1
.citi.com/	1970-01-19 14:42:14	Name: CUUID Value: e1390b51-81ee-4217-91ac-54c805fa3786
.citi.com/	1969-12-31 23:59:59	Name: CITI_SITE Value: gtdc
.citi.com/	1970-01-21 01:44:38	Name: _cls_v Value: 4a6aa79b-99f3-45d4-9bc7-69f2e3e2e497
.citi.com/	1969-12-31 23:59:59	Name: bcsid Value: 6880189E9231A34F3593DF566737AF59
.citi.com/	1969-12-31 23:59:59	Name: TLTSID Value: ad405dcda4e12aabd8d1ab8d1ac087e1e4af67e81eaf03cb9f5829d68bab0f4b
.citi.com/	1970-01-19 05:56:45	Name: ak_bmsc Value: DB5C439E6D89D4180D939708568EB79B021484524C7400008BFCF85D7CA2C776~plOG0ApshZqrOyqWoSEPqoXeB5hJS27HKTSF8ROoES7KOGeSvZmE6Wl2gDaa9ZowzGTKoIEOAGcwVBVYrrVZM403a4lzI4qPHPDD/GzMh2hmxvSpMto5TfARkO9PcXCUAm0yPHo8ce7Mgx6rn0JgtPyBiwmtDBY9prDqrlTEYjQ7lCmKztzLJB1HIaSR81kShA+nnPhKMwHmU+yc5n96Ea7ZU2e94hDbEMU8PUQxJ/kGk=
.citi.com/	1969-12-31 23:59:59	Name: AKMTLTSID Value: 494EAE64222CE5E8103B223BB5542315
.citi.com/	1970-01-19 06:06:43	Name: xyz_cr_617_et_100 Value: cr=617&et=100&ap=

17 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
console-api	log	URL: https://online.citi.com/CBOL/taggingTransformation/tagging.js(Line 317) Message: Started tagging.js core
console-api	log	URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js(Line 126) Message: addMbox_tnt_cards value is false
console-api	log	URL: https://online.citi.com/passivebio/bcsid.js(Line 5) Message: Setting new bcsid Cookie
console-api	log	URL: https://online.citi.com/US/JRS/infrastructure/target.do?next_page=jfp\|jEDelivery_DocCenterLetters(Line 1581) Message: isDCAFallback flag value is : false
console-api	log	URL: https://online.citi.com/TMX/TMXProfiling.js(Line 4) Message: start tmxProfiling.js
console-api	log	URL: https://online.citi.com/JEA/CitiSearch/nexus-platform/js/citilive-search.js(Line 1) Message: >>>>>>>>>>>>>Smart Search init>>>>>>>>>>>>>>>>>>>>>> pageId: jUSCBOL_Loginpage_Uncookied userRole: VISITOR isLoggedIn: false language: en
console-api	log	URL: https://online.citi.com/CBOL/taggingTransformation/tagging.js(Line 1236) Message: key external campaign tracking code is not available
console-api	log	URL: https://online.citi.com/CBOL/taggingTransformation/tagging.js(Line 1251) Message: key internal campaign tracking code is not available
console-api	log	URL: https://online.citi.com/CBOL/taggingTransformation/tagging.js(Line 712) Message: Load data...[object Object]
console-api	log	URL: https://online.citi.com/CBOL/taggingTransformation/tagging.js(Line 715) Message: [object Object]
console-api	log	URL: https://online.citi.com/TMX/TMXProfiling.js(Line 6) Message: tmxProfiling js execute
console-api	log	URL: https://online.citi.com/TMX/TMXProfiling.js(Line 12) Message: successfalsePC_BROWSERd00039fdc1946ea1fda48026a8aeb1aec266508999ccf402cc3fdf6e85179bef89oebq5khttps://content22.online.citi.com/fp/tags.js
console-api	log	URL: https://online.citi.com/TMX/TMXProfiling.js(Line 14) Message: tmxfallback
console-api	log	URL: https://online.citi.com/TMX/TMXProfiling.js(Line 16) Message: get everyparams89oebq5kPC_BROWSERd00039fdc1946ea1fda48026a8aeb1aec266508999ccf402cc3fdf6e85179bef
console-api	log	URL: https://nexus.ensighten.com/citi/na_prod/code/33848276fda6dd0b45329f6aaea4158e.js?conditionId0=421908(Line 26) Message: site_events detected
console-api	log	URL: https://nexus.ensighten.com/citi/na_prod/code/33848276fda6dd0b45329f6aaea4158e.js?conditionId0=421908(Line 362) Message: Tagging Event Listener fired - _dl value changed
console-api	log	(Line 11) Message: test 12

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

20766699p.rfihub.com
89oebq5k-c07bbe33d778db1fd73c370c39db9ec49a55a8b2-am1.e.aa.online-metrix.net
a.rfihub.com
aa.agkn.com
accountonline.citi.com
ajax.googleapis.com
api.citi.com
api.rlcdn.com
c1.rfihub.net
cdn.pbbl.co
cdn.tt.omtrdc.net
cfr.us.v2.we-stats.com
citicorpcreditservic.tt.omtrdc.net
content22.online.citi.com
cse.google.com
di.rlcdn.com
fm.info6.citi.com
googleads.g.doubleclick.net
h.online-metrix.net
insight.adsrvr.org
js.adsrvr.org
l.info6.citi.com
metrics1.citi.com
mpsnare.iesnare.com
nebula-cdn.kampyle.com
nexus.ensighten.com
online.citi.com
p.rfihub.com
prod.report.nacustomerexperience.citi.com
px0.pbbl.co
resources.digital-cloud-citi.medallia.com
s.ytimg.com
sr.rlcdn.com
stags.bluekai.com
sts.eccmp.com
tags.bkrtx.com
udc-neb.kampyle.com
www.accountonline.citibank.com
www.accountonline.com
www.citi.com
www.google.com
www.google.de
www.googleadservices.com
www.googletagmanager.com
www.youtube.com
prod.report.nacustomerexperience.citi.com
104.103.83.50
104.108.41.26
104.111.239.33
13.225.78.100
143.204.97.29
15.188.31.119
151.101.13.175
151.101.14.133
172.217.22.34
173.213.4.17
18.195.42.228
184.30.216.237
192.193.200.243
193.0.160.128
193.0.160.129
2.19.42.73
2.20.23.178
2.20.23.179
23.38.55.47
2a00:1450:4001:806::200e
2a00:1450:4001:814::2008
2a00:1450:4001:818::200e
2a00:1450:4001:818::2013
2a00:1450:4001:819::2002
2a00:1450:4001:819::200a
2a00:1450:4001:81f::200e
2a00:1450:4001:824::2003
2a00:1450:4001:824::2004
3.122.45.35
34.248.255.146
35.176.204.252
35.190.72.21
35.241.45.82
35.244.174.68
40.122.110.249
63.148.46.76
66.117.29.6
91.235.132.130
91.235.134.131
91.235.134.21
03c736ca1c90e26743865ed80c9766f84ca237b0dc572fab630737aaef70d171
05cdf4be90754d75c60f6e945e97f7b978e037666d11ac617422cc746b42e0ba
06dfb367edf9bbff810def9f75f8695b3ccfbcb2813306609fc6e18fcacfc17e
0a0fcf460d3adf526db40dac99fbfb02334557efc728b0acbae0952a37ac973f
0c40d0fb48b8cb2b2eda64813daa9d9d6c38e8b9c2f01b00d02b93285ede4eb9
13e2dff1daeca230d4baec00e9e8766b54d3e7f408e788f5e7c0fed85220d275
147d5785b25331ac266f34841b05b4401ec78b0e0de6f85d63993ab0a9b5a253
157430093a6d2ee63082eae5dabf826926d3b6259d33482aa6713c48728e82fa
199dc414e8c9a0c2f74b1ee8896a1496015ce209c0d9a2c1ee0d32a588c4a31c
1cc4ec61057f30cea6d47126e0444f119b2606720b1fe8d7e0deff1f5742a82b
1f2a0e7aa3dabf73dae3cc7c1e53a70ec51145b39b027bdc1ecae9223c0c80d2
2233a44f005e8d416636e52aca33bc7ce726c1ab4d0801865162829d762c6de2
23050e3fd8c06313e53fc51fe03ebd265a5b60dec3ba8943b79a50c2f2b46e6f
2a569aacb76cda50443d05293e35ec319b8dee59d12d194853611c6bfcb5ea48
31b00ff4929696dfca06885da68e58c3e09f6ecb4ae0fe1ae287e99a3fd1f716
33bb1e463cfdb062ef2c037beac1ec6f65b7b359be2ae19358d6fbcf66871504
3c765e4a45a7befbfdf86c188a45a0ccde59bec375cffa6a1c3ac0b23818bcde
3e72de5de67d6d80b65a114af684eaf880c53c250155a663cb17d677ff064bc1
3facb0fb4999f0b5d8116ce812c1d68d07b17782afb8cc480ae472ea6c5094fe
3fca3de24621f0f10186594054444d608016297c2e853e548710b3521e42a609
40a20291f9b526cba58796a4bbd0256d5663313e02c9d5ab5a842476562b3108
429d8af3190c76d5fcb9b1cad2aa6eb555684921323da905d62017fbdbf557c6
462d648e4436dad29b20ca8243faa99762069924d0d3b86a60213f8274a6e676
47cc30597372e369ba12ab37f11a90ce3203edbf8c7d444f0ceaeae924918c66
49d10b4e23ea6f98eecba90454ab5efe8415a4c63bd34b49cf89f60be55b028c
4b82af8c550f11aa8553e8793e13d0201852d39d0d31b8b4c087f48665674278
4ee320d0865d9d6f8e1f3ae5dd4bbe0d49ce0455d4fda4c51271e484b169b616
4f918cd256712c03a1b88007176cabf623cc63740e919d35a217c18dc7ebe607
506575b752d10714465811aec4dd67a7bfb471fcbc2e9619c1faad68c110759e
5407ad372944d2599b86775c628e963429af523c48f5c80b70ea587a8ed12fa8
55e066703c69d4d89a1f4d66794d474aa93d710624d8f807096bac17a7867b17
59cff644f53180594b862041f52c4e5e7018e4d3307ddabcd9cec541f53addfb
5cc280e965102224e1c7c0bd1df536c524c3a6fc9762205f4d7f7b345382c724
611fd3e72460fd66a5e6cd3857ab8b7d2099d16e8769854d3273728ba8da5609
61339a21fa71d17d0dfebceba08dc76ce605e73f65a88438397483478d953aae
6177c6163dc1ad67fb596a94ef3d18a277bfd437dbb3c1a928cd6caacefeff2e
61e114badfc7677a5ed175cf71afd46968ef8262cd4e5ec64ba0c743daae8e11
61eb6e3a621d1621e6fb229128f863795e9d9b7bf80fb76eec9a7d70fde09e41
629b48196dcc270143a42ce57535b251c655617f8d510277d4a05306c426fd38
64cadd481b641499d348f998f2c216bbdf3dfc14eea25ef621e3db1f5d507e62
64f93991b9aaca349db64f6de9a12126617e6e2162a6712a910ff2fac2005255
65fc5c6745434f69c925a8e7f7ff7be5ea794562bab1ebab878236cdff4628cb
682d047ea5deb2980824cee46de07619f600bc8f3193dc535222be3fb0217b8e
6abcda99c0a48d8eb3996a4c0651257bae8cbbba77538baeb4be33b0ccb9ff42
6d3001c9deac8cb1f88ea5254105f8d678de5532f1998a24eab1b59906eaf86b
6fc675ff6586c6f4716748c80a62681d461c0b46e2a62c06f4e8f37b0be5f8eb
701d2f9f02741b8429f4fb892b2b48c34a8a0f9189cb09013b2799031f22e484
766cc064fbabfd3bfff9c2a58c721cf28006076f642211778650f744057a9a1b
771c92ecc9167287111bc793f6392bfb0dc8a51a830b497f7591e6d3493fc1fc
77ce0ec2a02b410eee12285bd7487b2599970ac39b6ff58c0b748b6e2df36f3c
7adf69580aead1321588b6f81a92518ac9724f3da846970c349fa91630145bfc
7cb24e06c00e47bb6bc6c38b935d6bc62817f656703387e4fb7591add96c7454
7d481eb36581746fd3662c7c452856b695df90cdce24664c48f565aa119c8b16
7df13706eaab8ce9a3dcd2a501f60bc66987c83834d07dfaf07ae56ef814c110
7e92449fbdaa05b3c40180fbc2df2c660ccddf2f5ba34c5ed53795721c1307d1
7e9cb68deaf125403ba6bf1fa5b9e079e2c78017178b6eccdb3ad7203aae6060
7ecf3bf86151cd72036fb67feb8fcbd8c80359e0ca871e1aeb955428ed43c26d
8af93bd675e1cfd9ecc850e862819fdac6e3ad1f5d761f970e409c7d9c63bdc3
8b9920ca91285fba330bf415bc1e74ec46aa0b84308fbc29e78a5c7d864c3544
95518cbec0d55a574a9c8ef72a2a7d62ac0d40a4de5dfe67a76a7d214dc8b743
99c2917ee5b2a01459a923bdd1c676f15ee73b62b87f696e6735312d26f51e12
9c6ce416f52fff5a68c6f1fdde48915832ca3402d24261dcc968df68aed50a5d
9c6d485ae01a594ef22b3c44e1eca5314259061faacdcdfc51569aba58a4fc2b
9ca747861c2e2787351bc177db2b022c378d21b1f1057643764562ac5f4c23e9
9ceaa25ec7654a66294c16e28989fbf1ecb9cebc9debe96ec597529465c7cd50
9dad502247a8488c21ef5beb32aed1a78b17b748711bec817c472911f76b4ead
a02f30b62ee7f38208f15141e9539310c035396b03320970bb36782d08d78b37
a1ecbaed793a1f564c49c671f2dd0ce36f858534ef6d26b55783a06b884cc506
a3910f4f1869b40c11bf01cc863271e22da872f4b68593e4ad56588d09ce9be8
a612a8f640434c7aaee47569897c1fee79df6f146ec26115e2a8c9be645592b7
a6b0008d4387ae103ceda17bbf0506d4aa06ee7e06a0f523e27eb10ea33b4151
a9623118fb6ec3944d1312cd0d492c3f32455e89bc1e01eafa67628a309d9c60
a9cebaefb3003c4944d0d59f71afdca3509d3975af5ff213d2750fdf8f719146
b0f51bae22380b27abb7624d21db9815159b3c5ec970e9b9f32392e8c173eaf4
b26b012a661b8a5d50e672f209c9afb8189be7bc63621999dadff862355dd929
b27ce24dd8e47dc2a6786c29571b915ece9b640ace598d7c55736a90f12908c2
b304ca37413007bd278d5932508cd4d380d14dd8a3b3a592e370c87d72c2eb2c
b4d03a0e8edfd600ead0f5c14b0c8466f9e2672ef792505123d5677b70baada9
b5b99c97960d130c44fad1acc54bba0644286e0fd6d3899e3027392ab7de9cc8
b7264725078e153ab3a4af37c52374b3a5d46b8fb5fc7b5f8af2e773364eef93
bcd5dbc93689dadb8a39793965b6e8ecbd485fbd0860c663287438eb1e8a2f3d
c168a0461a7b4b6433efacdbde53ebb7f4e6a23afe0d2e056afe7fb8acf55c3a
c3c994c3fe9bd4e055f6d0eb42067ecd6bdd3247e136bc22835b9882cfe77c61
c41fd424900c92595986687d069149fbd35edf49c94cc3d1b09426e1023ad295
c4aa5f75b54d39ff9780c3a5622efee6234b1657dd90d1777529e68bd06ad275
c8fe5355de63175b075e146aa0a789670eac062523f7bf228eb62d19d6bd0f1d
cb2bb21705b9cce9781d02c9223f3344a65bd5314027d11c5a8518ad4bd84e84
cbc1399b82e42018fbc8b8b9277200665d6367c9134ead9308ea5e568b00e459
cbf569977293d3a9fee6a398651ef879fe6346c14701cee0a81999f5f53624bf
cd3d25348d488d5a2a845da6e0b5fabbd42696ed66bcd4a375ecd56d9e65878a
ce8e126fb9b428395f0be1ff5486bb1da6520f12d778e9cece1581cfa411c440
d2fad3207cd7cfc62b3808a7f284bf130e116bb629df4e4dbb9fda4edd439493
d3b185500fba0119d71908437d441076f8fdf7cf3eecca245d6561e19e3891a8
d57c8034f9c12aa3ce626c9ed1d61a4bb0941c3ef320bb59346f20496fb0096a
d85a9020926832ea078812001b1039073f687892ad9c2faaf9f832d847aa8632
dc60cdde3c214f41bf22ce5166544f880d07dbdad1a2c7d6d468c0fb4f7e6540
e17da319eba14bc5a5677abdac48f8ef973597cca0c9733f8d3dd68bbc6faf81
e18c28c95bea1af6b2187c6a35eb651dccabfb2212e529b6edd4a2e2f4c39ea8
e2812b1e3529e5f39e3b0586e82c7ad0dfc3fc61cfa0107edfac16483d0547d7
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e5168b3d0c8f929a1b8c4c1b4e4ebac60ee0e1ecfd759aeb4be4c2b15e3fc097
e90fb0eba512ed6473f6fb8acf4cd09b38732f150f43c396246c12bb2aacbb67
e9e9a67395a0d83b584208a19b95af203df8e8e6c6952fe76c690d60ea9381c7
ead2056c5689a3c759205fbe7259929e693f0cce04e8a70e02e0e2339e95ee9f
ed48ae9c1a324d49404d9fb4c508b880ca97a65f8fd21d352e241d1e4dfc50e2
eec5cc477e7cb4f1eee1f26dce3eb411a63716d89a9b659c7d5559571c837ccb
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f1821b3865a1008ba0c088f7dc5c7eeb6b81e414461885c40b8d0f48fcbc9341
f2adfd83f8e9c7f3b092921eb5a59d4463041b2be8386a17ec7ac29d8d588470
f327a0ba3e41b1e8154e1c18fc114baff0bd057151e3afe7fa6f33cc0cb18296
f44e4692a52b6a382cb481e23f8bcb9a6d4c24eec8aa60143c7e2ca3a85758b2
f6293fa8c399fd492fb1d40068afee4415acd29c573e7b8661d9c49b1aecea95
fb932909daac7eff47f2a458fb47760bfd0924191bcd477f2366dd31e3ee73a4
fd3b3191c84b8089257035f5c12ed07e024beaf6934a338259687b84be0182a6
ff044e181bbfe5f306363754dfdd304da3fe18c1bec9e7436d4446d0b86858e9

online.citi.com Open in urlscan Pro 104.111.239.33 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

155 Requests

99 %HTTPS

23 %IPv6

27 Domains

45 Subdomains

39 IPs

7 Countries

2579 kBTransfer

6581 kBSize

31 Cookies

26 Outgoing links

Page URL History

Redirected requests

155 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

online.citi.com Open in urlscan Pro
104.111.239.33 Public Scan

Screenshot
Live screenshot

Full Image

155
Requests

99 %
HTTPS

23 %
IPv6

27
Domains

45
Subdomains

39
IPs

7
Countries

2579 kB
Transfer

6581 kB
Size

31
Cookies

155 HTTP transactions
0 data transactions