urlscan.io logo urlscan.io
SecurityTrails logo

citi-onlime.org Open in urlscan Pro
2a06:98c1:3120::3  Public Scan

Go To Rescan Add Verdict Report
URL: https://citi-onlime.org/
Submission: On April 06 via automatic, source certstream-suspicious — Scanned from NL
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 70 IPs in 9 countries across 59 domains to perform 166 HTTP transactions. The main IP is 2a06:98c1:3120::3, located in United States and belongs to CLOUDFLARENET, US. The main domain is citi-onlime.org.
TLS certificate: Issued by GTS CA 1P5 on April 6th 2023. Valid for: 3 months.
This is the only time citi-onlime.org was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
28 2a06:98c1:312... 13335 (CLOUDFLAR...)
8 104.18.14.6 13335 (CLOUDFLAR...)
1 2a00:1450:400... 15169 (GOOGLE)
1 35.80.101.90 16509 (AMAZON-02)
6 99.86.8.175 16509 (AMAZON-02)
1 2001:4860:480... 15169 (GOOGLE)
1 52.222.206.6 16509 (AMAZON-02)
4 2a00:1450:400... 15169 (GOOGLE)
1 172.217.16.194 15169 (GOOGLE)
14 151.101.193.44 54113 (FASTLY)
1 23.35.237.86 16625 (AKAMAI-AS)
1 146.75.116.157 54113 (FASTLY)
4 23.36.163.138 20940 (AKAMAI-ASN1)
1 2001:4860:480... 15169 (GOOGLE)
4 70.42.32.127 13789 (INTERNAP-...)
1 104.244.42.5 13414 (TWITTER)
1 104.244.42.195 13414 (TWITTER)
1 2 2a00:1450:400... 15169 (GOOGLE)
1 2 2a00:1450:400... 15169 (GOOGLE)
2 2a00:1450:400... 15169 (GOOGLE)
2 2606:4700:1::... 13335 (CLOUDFLAR...)
3 2620:1ec:c11:... 8068 (MICROSOFT...)
2 2a00:1288:80:... 203220 (YAHOO-DEB)
1 2a02:2638:3::3 44788 (ASN-CRITE...)
2 3.15.82.75 16509 (AMAZON-02)
2 130.211.141.45 396982 (GOOGLE-CL...)
2 4 199.127.207.180 26120 (RHYTHMONE)
6 6 213.19.147.44 3356 (LEVEL3)
1 52.54.206.209 14618 (AMAZON-AES)
1 50.19.90.90 14618 (AMAZON-AES)
1 72.251.245.179 32475 (SINGLEHOP...)
1 104.18.17.195 13335 (CLOUDFLAR...)
1 151.101.194.132 54113 (FASTLY)
1 2 142.250.186.166 15169 (GOOGLE)
2 2 142.250.186.70 15169 (GOOGLE)
2 2a00:1450:400... 15169 (GOOGLE)
4 5 2a02:2638:d::d 44788 (ASN-CRITE...)
1 178.250.1.11 44788 (ASN-CRITE...)
1 188.114.96.3 13335 (CLOUDFLAR...)
1 1 178.250.7.11 44788 (ASN-CRITE...)
1 74.119.119.150 19750 (AS-CRITEO)
1 212.82.100.181 34010 (YAHOO-IRD)
1 108.138.15.119 16509 (AMAZON-02)
2 2 151.101.130.49 54113 (FASTLY)
2 3 142.250.186.98 15169 (GOOGLE)
2 23.198.21.188 16625 (AKAMAI-AS)
1 35.71.131.137 16509 (AMAZON-02)
1 3 54.78.156.59 16509 (AMAZON-02)
1 2 52.28.222.35 16509 (AMAZON-02)
2 178.250.1.9 44788 (ASN-CRITE...)
2 2 185.89.211.12 29990 (ASN-APPNEX)
1 2 185.89.210.46 29990 (ASN-APPNEX)
1 2.18.235.93 16625 (AKAMAI-AS)
1 69.173.144.165 26667 (RUBICONPR...)
1 3.64.32.26 16509 (AMAZON-02)
1 185.86.139.93 201081 (SMARTADSE...)
25 141.226.228.48 200478 (TABOOLA-AS)
1 104.102.35.84 16625 (AKAMAI-AS)
1 13.248.245.213 16509 (AMAZON-02)
1 3.75.62.37 16509 (AMAZON-02)
1 37.157.3.30 198622 (ADFORM)
1 185.255.84.153 200271 (IGUANE-)
1 2 185.80.39.216 27381 (CASALE-MEDIA)
1 2 34.241.134.204 16509 (AMAZON-02)
1 141.95.98.65 16276 (OVH)
1 2 52.208.99.252 16509 (AMAZON-02)
1 34.117.157.22 396982 (GOOGLE-CL...)
1 52.58.211.21 16509 (AMAZON-02)
1 185.64.189.110 62713 (AS-PUBMATIC)
1 2600:1f18:612... 14618 (AMAZON-AES)
1 184.28.181.42 16625 (AKAMAI-AS)
1 63.32.242.157 16509 (AMAZON-02)
2 2 54.72.144.202 16509 (AMAZON-02)
1 52.213.74.200 16509 (AMAZON-02)
1 3.136.129.62 16509 (AMAZON-02)
166 70
28    2a06:98c1:3120::3 (United States)

ASN13335 (CLOUDFLARENET, US)
citi-onlime.org
8    104.18.14.6 (None, )

ASN13335 (CLOUDFLARENET, US)
www.nerdwallet.com
1    2a00:1450:4001:82f::200d (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
accounts.google.com
1    35.80.101.90 (Boardman, United States)

ASN16509 (AMAZON-02, US)
PTR: ec2-35-80-101-90.us-west-2.compute.amazonaws.com
ssl.kaptcha.com
6    99.86.8.175 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-99-86-8-175.fra6.r.cloudfront.net
cdn.segment.com
1    2001:4860:4802:38::178 (United States)

ASN15169 (GOOGLE, US)
www.google-analytics.com
1    52.222.206.6 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-52-222-206-6.fra56.r.cloudfront.net
cdn.amplitude.com
4    2a00:1450:4001:812::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.googletagmanager.com
1    172.217.16.194 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s65-in-f2.1e100.net
www.googleadservices.com
14    151.101.193.44 (United States)

ASN54113 (FASTLY, US)
cdn.taboola.com
trc.taboola.com
1    23.35.237.86 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a23-35-237-86.deploy.static.akamaitechnologies.com
amplify.outbrain.com
1    146.75.116.157 (Frankfurt am Main, Germany)

ASN54113 (FASTLY, US)
static.ads-twitter.com
4    23.36.163.138 (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)
PTR: a23-36-163-138.deploy.static.akamaitechnologies.com
analytics.tiktok.com
1    2001:4860:4802:34::36 (United States)

ASN15169 (GOOGLE, US)
region1.google-analytics.com
4    70.42.32.127 (United States)

ASN13789 (INTERNAP-BLK3, US)
PTR: ny.outbrain.com
tr.outbrain.com
sync.outbrain.com
1    104.244.42.5 (United States)

ASN13414 (TWITTER, US)
t.co
1    104.244.42.195 (United States)

ASN13414 (TWITTER, US)
analytics.twitter.com
2    2a00:1450:4001:827::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
googleads.g.doubleclick.net
2    2a00:1450:4001:806::2004 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.google.com
2    2a00:1450:4001:809::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.google.nl
2    2606:4700:1::6813:854e (United States)

ASN13335 (CLOUDFLARENET, US)
a.mgid.com
3    2620:1ec:c11::200 (United States)

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)
bat.bing.com
2    2a00:1288:80:807::1 (United Kingdom)

ASN203220 (YAHOO-DEB, GB)
s.yimg.com
1    2a02:2638:3::3 (France)

ASN44788 (ASN-CRITEO-EUROPE, FR)
static.criteo.net
2    3.15.82.75 (Columbus, United States)

ASN16509 (AMAZON-02, US)
PTR: ec2-3-15-82-75.us-east-2.compute.amazonaws.com
collector-26294.us.tvsquared.com
2    130.211.141.45 (Council Bluffs, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 45.141.211.130.bc.googleusercontent.com
js.adstk.io
conv-pix.adstk.io
4    199.127.207.180 (United States)

ASN26120 (RHYTHMONE, US)
pixel.videohub.tv
6    213.19.147.44 (Castricum, Netherlands)

ASN3356 (LEVEL3, US)
sync.1rx.io
sync.targeting.unrulymedia.com
1    52.54.206.209 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-52-54-206-209.compute-1.amazonaws.com
data.adxcel-ec2.com
1    50.19.90.90 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-50-19-90-90.compute-1.amazonaws.com
b.videoamp.com
1    72.251.245.179 (Amsterdam, Netherlands)

ASN32475 (SINGLEHOP-LLC, US)
rtb.adgrx.com
1    104.18.17.195 (None, )

ASN13335 (CLOUDFLARENET, US)
data.dianomi.com
1    151.101.194.132 (United States)

ASN54113 (FASTLY, US)
pt.ispot.tv
2    142.250.186.166 (United States)

ASN15169 (GOOGLE, US)
PTR: fra24s08-in-f6.1e100.net
9935087.fls.doubleclick.net
2    142.250.186.70 (United States)

ASN15169 (GOOGLE, US)
PTR: fra24s05-in-f6.1e100.net
ad.doubleclick.net
2    2a00:1450:4001:810::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
adservice.google.com
5    2a02:2638:d::d (France)

ASN44788 (ASN-CRITEO-EUROPE, FR)
gum.criteo.com
1    178.250.1.11 (France)

ASN44788 (ASN-CRITEO-EUROPE, FR)
mug.criteo.com
1    188.114.96.3 (Amsterdam, Netherlands)

ASN13335 (CLOUDFLARENET, US)
cdnstat.net
1    178.250.7.11 (France)

ASN44788 (ASN-CRITEO-EUROPE, FR)
sslwidget.criteo.com
1    74.119.119.150 (United States)

ASN19750 (AS-CRITEO, US)
widget.us.criteo.com
1    212.82.100.181 (Dublin, Ireland)

ASN34010 (YAHOO-IRD, GB)
PTR: spdc.pbp.vip.ir2.yahoo.com
sp.analytics.yahoo.com
1    108.138.15.119 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-108-138-15-119.fra56.r.cloudfront.net
js.adsrvr.org
2    151.101.130.49 (United States)

ASN54113 (FASTLY, US)
rtd-tm.everesttech.net
3    142.250.186.98 (United States)

ASN15169 (GOOGLE, US)
PTR: fra24s06-in-f2.1e100.net
cm.g.doubleclick.net
2    23.198.21.188 (Amsterdam, Netherlands)

ASN16625 (AKAMAI-AS, US)
PTR: a23-198-21-188.deploy.static.akamaitechnologies.com
www.everestjs.net
1    35.71.131.137 (United States)

ASN16509 (AMAZON-02, US)
PTR: a6370ebea231e0c9a.awsglobalaccelerator.com
insight.adsrvr.org
3    54.78.156.59 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-54-78-156-59.eu-west-1.compute.amazonaws.com
pixel.everesttech.net
2    52.28.222.35 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-52-28-222-35.eu-central-1.compute.amazonaws.com
x.bidswitch.net
2    178.250.1.9 (France)

ASN44788 (ASN-CRITEO-EUROPE, FR)
dis.criteo.com
2    185.89.211.12 (Frankfurt am Main, Germany)

ASN29990 (ASN-APPNEX, US)
PTR: 947.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net
ib.adnxs.com
2    185.89.210.46 (Frankfurt am Main, Germany)

ASN29990 (ASN-APPNEX, US)
PTR: 940.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net
secure.adnxs.com
1    2.18.235.93 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a2-18-235-93.deploy.static.akamaitechnologies.com
contextual.media.net
1    69.173.144.165 (Frankfurt am Main, Germany)

ASN26667 (RUBICONPROJECT, US)
pixel.rubiconproject.com
1    3.64.32.26 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-3-64-32-26.eu-central-1.compute.amazonaws.com
match.sharethrough.com
1    185.86.139.93 (France)

ASN201081 (SMARTADSERVER, FR)
rtb-csync.smartadserver.com
25    141.226.228.48 (Netherlands)

ASN200478 (TABOOLA-AS, IL)
sync-t1.taboola.com
trc-events.taboola.com
1    104.102.35.84 (Hamburg, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a104-102-35-84.deploy.static.akamaitechnologies.com
criteo-sync.teads.tv
1    13.248.245.213 (United States)

ASN16509 (AMAZON-02, US)
PTR: a0f671730127a0812.awsglobalaccelerator.com
eb2.3lift.com
1    3.75.62.37 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-3-75-62-37.eu-central-1.compute.amazonaws.com
ups.analytics.yahoo.com
1    37.157.3.30 (Denmark)

ASN198622 (ADFORM, DK)
cm.adform.net
1    185.255.84.153 (France)

ASN200271 (IGUANE-, FR)
visitor.omnitagjs.com
2    185.80.39.216 (Canada)

ASN27381 (CASALE-MEDIA, CA)
r.casalemedia.com
2    34.241.134.204 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-34-241-134-204.eu-west-1.compute.amazonaws.com
dpm.demdex.net
1    141.95.98.65 (France)

ASN16276 (OVH, FR)
PTR: ns3216659.ip-141-95-98.eu
id5-sync.com
2    52.208.99.252 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-52-208-99-252.eu-west-1.compute.amazonaws.com
ad.360yield.com
1    34.117.157.22 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 22.157.117.34.bc.googleusercontent.com
matching.ivitrack.com
1    52.58.211.21 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-52-58-211-21.eu-central-1.compute.amazonaws.com
exchange.mediavine.com
1    185.64.189.110 (United Kingdom)

ASN62713 (AS-PUBMATIC, US)
simage2.pubmatic.com
1    2600:1f18:612b:4232:d8df:442e:b8f5:5c88 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
criteo-partners.tremorhub.com
1    184.28.181.42 (Berlin, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a184-28-181-42.deploy.static.akamaitechnologies.com
ad.yieldlab.net
1    63.32.242.157 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-63-32-242-157.eu-west-1.compute.amazonaws.com
sync-criteo.ads.yieldmo.com
2    54.72.144.202 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-54-72-144-202.eu-west-1.compute.amazonaws.com
cm.everesttech.net
1    52.213.74.200 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-52-213-74-200.eu-west-1.compute.amazonaws.com
beacon.krxd.net
1    3.136.129.62 (Columbus, United States)

ASN16509 (AMAZON-02, US)
PTR: ec2-3-136-129-62.us-east-2.compute.amazonaws.com
s.thebrighttag.com
Apex Domain
Subdomains		 Transfer
39 taboola.com
cdn.taboola.com — Cisco Umbrella Rank: 958
trc.taboola.com — Cisco Umbrella Rank: 682
sync-t1.taboola.com — Cisco Umbrella Rank: 1246
trc-events.taboola.com — Cisco Umbrella Rank: 1954
60 KB
28 citi-onlime.org
citi-onlime.org
1 MB
10 criteo.com
gum.criteo.com — Cisco Umbrella Rank: 416
mug.criteo.com — Cisco Umbrella Rank: 2381
sslwidget.criteo.com — Cisco Umbrella Rank: 1825
widget.us.criteo.com — Cisco Umbrella Rank: 18056
dis.criteo.com — Cisco Umbrella Rank: 718
13 KB
9 doubleclick.net
googleads.g.doubleclick.net — Cisco Umbrella Rank: 41
9935087.fls.doubleclick.net — Cisco Umbrella Rank: 70404
ad.doubleclick.net — Cisco Umbrella Rank: 172
cm.g.doubleclick.net — Cisco Umbrella Rank: 228
6 KB
8 nerdwallet.com
www.nerdwallet.com — Cisco Umbrella Rank: 35731
100 KB
7 everesttech.net
rtd-tm.everesttech.net — Cisco Umbrella Rank: 2924
pixel.everesttech.net — Cisco Umbrella Rank: 4904
cm.everesttech.net — Cisco Umbrella Rank: 1165
3 KB
6 segment.com
cdn.segment.com — Cisco Umbrella Rank: 1553
44 KB
5 outbrain.com
amplify.outbrain.com — Cisco Umbrella Rank: 2602
tr.outbrain.com — Cisco Umbrella Rank: 2509
sync.outbrain.com — Cisco Umbrella Rank: 720
8 KB
5 google.com
accounts.google.com — Cisco Umbrella Rank: 87
www.google.com — Cisco Umbrella Rank: 2
adservice.google.com — Cisco Umbrella Rank: 90
79 KB
4 adnxs.com
ib.adnxs.com — Cisco Umbrella Rank: 230
secure.adnxs.com — Cisco Umbrella Rank: 429
4 KB
4 1rx.io
sync.1rx.io — Cisco Umbrella Rank: 549
2 KB
4 videohub.tv
pixel.videohub.tv — Cisco Umbrella Rank: 12394
2 KB
4 tiktok.com
analytics.tiktok.com — Cisco Umbrella Rank: 781
99 KB
4 googletagmanager.com
www.googletagmanager.com — Cisco Umbrella Rank: 62
279 KB
3 bing.com
bat.bing.com — Cisco Umbrella Rank: 407
12 KB
2 360yield.com
ad.360yield.com — Cisco Umbrella Rank: 676
879 B
2 demdex.net
dpm.demdex.net — Cisco Umbrella Rank: 215
2 KB
2 casalemedia.com
r.casalemedia.com — Cisco Umbrella Rank: 1416
2 KB
2 bidswitch.net
x.bidswitch.net — Cisco Umbrella Rank: 323
877 B
2 everestjs.net
www.everestjs.net — Cisco Umbrella Rank: 7513
9 KB
2 adsrvr.org
js.adsrvr.org — Cisco Umbrella Rank: 1592
insight.adsrvr.org — Cisco Umbrella Rank: 633
3 KB
2 yahoo.com
sp.analytics.yahoo.com — Cisco Umbrella Rank: 1221
ups.analytics.yahoo.com — Cisco Umbrella Rank: 302
1 KB
2 unrulymedia.com
sync.targeting.unrulymedia.com — Cisco Umbrella Rank: 1192
1 KB
2 adstk.io
js.adstk.io — Cisco Umbrella Rank: 49597
conv-pix.adstk.io — Cisco Umbrella Rank: 36089
6 KB
2 tvsquared.com
collector-26294.us.tvsquared.com — Cisco Umbrella Rank: 912948
9 KB
2 yimg.com
s.yimg.com — Cisco Umbrella Rank: 489
7 KB
2 mgid.com
a.mgid.com — Cisco Umbrella Rank: 22664
5 KB
2 google.nl
www.google.nl — Cisco Umbrella Rank: 8940
563 B
2 google-analytics.com
www.google-analytics.com — Cisco Umbrella Rank: 35
region1.google-analytics.com — Cisco Umbrella Rank: 2284
20 KB
1 thebrighttag.com
s.thebrighttag.com — Cisco Umbrella Rank: 1951
268 B
1 krxd.net
beacon.krxd.net — Cisco Umbrella Rank: 611
338 B
1 yieldmo.com
sync-criteo.ads.yieldmo.com — Cisco Umbrella Rank: 2254
38 B
1 yieldlab.net
ad.yieldlab.net — Cisco Umbrella Rank: 4239
235 B
1 tremorhub.com
criteo-partners.tremorhub.com — Cisco Umbrella Rank: 2368
407 B
1 pubmatic.com
simage2.pubmatic.com — Cisco Umbrella Rank: 733
581 B
1 mediavine.com
exchange.mediavine.com — Cisco Umbrella Rank: 1310
884 B
1 ivitrack.com
matching.ivitrack.com — Cisco Umbrella Rank: 2776
274 B
1 id5-sync.com
id5-sync.com — Cisco Umbrella Rank: 437
1 KB
1 omnitagjs.com
visitor.omnitagjs.com — Cisco Umbrella Rank: 935
235 B
1 adform.net
cm.adform.net — Cisco Umbrella Rank: 1297
163 B
1 3lift.com
eb2.3lift.com — Cisco Umbrella Rank: 387
140 B
1 teads.tv
criteo-sync.teads.tv — Cisco Umbrella Rank: 1982
172 B
1 smartadserver.com
rtb-csync.smartadserver.com — Cisco Umbrella Rank: 604
114 B
1 sharethrough.com
match.sharethrough.com — Cisco Umbrella Rank: 533
362 B
1 rubiconproject.com
pixel.rubiconproject.com — Cisco Umbrella Rank: 340
239 B
1 media.net
contextual.media.net — Cisco Umbrella Rank: 616
804 B
1 cdnstat.net
cdnstat.net
759 B
1 ispot.tv
pt.ispot.tv — Cisco Umbrella Rank: 2355
314 B
1 dianomi.com
data.dianomi.com — Cisco Umbrella Rank: 10297
448 B
1 adgrx.com
rtb.adgrx.com — Cisco Umbrella Rank: 5184
315 B
1 videoamp.com
b.videoamp.com — Cisco Umbrella Rank: 2756
312 B
1 adxcel-ec2.com
data.adxcel-ec2.com — Cisco Umbrella Rank: 4057
131 B
1 criteo.net
static.criteo.net — Cisco Umbrella Rank: 670
15 KB
1 twitter.com
analytics.twitter.com — Cisco Umbrella Rank: 687
726 B
1 t.co
t.co — Cisco Umbrella Rank: 525
375 B
1 ads-twitter.com
static.ads-twitter.com — Cisco Umbrella Rank: 701
15 KB
1 googleadservices.com
www.googleadservices.com — Cisco Umbrella Rank: 176
2 KB
1 amplitude.com
cdn.amplitude.com — Cisco Umbrella Rank: 3250
23 KB
1 kaptcha.com
ssl.kaptcha.com — Cisco Umbrella Rank: 9441
3 KB
166 59
Domain Requested by
28 citi-onlime.org citi-onlime.org
24 trc-events.taboola.com cdn.taboola.com
12 trc.taboola.com cdn.taboola.com
8 www.nerdwallet.com citi-onlime.org
6 cdn.segment.com citi-onlime.org
cdn.segment.com
5 gum.criteo.com 4 redirects static.criteo.net
4 sync.1rx.io 4 redirects
4 pixel.videohub.tv 2 redirects
4 analytics.tiktok.com citi-onlime.org
analytics.tiktok.com
4 www.googletagmanager.com citi-onlime.org
www.googletagmanager.com
3 pixel.everesttech.net 1 redirects
3 cm.g.doubleclick.net 2 redirects 9935087.fls.doubleclick.net
3 bat.bing.com citi-onlime.org
bat.bing.com
3 tr.outbrain.com amplify.outbrain.com
citi-onlime.org
2 cm.everesttech.net 2 redirects
2 ad.360yield.com 1 redirects
2 dpm.demdex.net 1 redirects
2 r.casalemedia.com 1 redirects
2 secure.adnxs.com 1 redirects
2 ib.adnxs.com 2 redirects
2 dis.criteo.com
2 x.bidswitch.net 1 redirects
2 www.everestjs.net 9935087.fls.doubleclick.net
www.everestjs.net
2 rtd-tm.everesttech.net 2 redirects
2 adservice.google.com 9935087.fls.doubleclick.net
2 ad.doubleclick.net 2 redirects
2 9935087.fls.doubleclick.net 1 redirects www.googletagmanager.com
2 sync.targeting.unrulymedia.com 2 redirects
2 collector-26294.us.tvsquared.com citi-onlime.org
2 s.yimg.com citi-onlime.org
s.yimg.com
2 a.mgid.com www.googletagmanager.com
2 www.google.nl citi-onlime.org
2 www.google.com 1 redirects
2 googleads.g.doubleclick.net 1 redirects www.googletagmanager.com
2 cdn.taboola.com www.googletagmanager.com
citi-onlime.org
1 s.thebrighttag.com
1 beacon.krxd.net
1 sync-criteo.ads.yieldmo.com
1 ad.yieldlab.net
1 criteo-partners.tremorhub.com
1 simage2.pubmatic.com
1 sync.outbrain.com
1 exchange.mediavine.com
1 matching.ivitrack.com
1 id5-sync.com
1 visitor.omnitagjs.com
1 cm.adform.net
1 ups.analytics.yahoo.com
1 eb2.3lift.com
1 criteo-sync.teads.tv
1 sync-t1.taboola.com
1 rtb-csync.smartadserver.com
1 match.sharethrough.com
1 pixel.rubiconproject.com
1 contextual.media.net
1 insight.adsrvr.org js.adsrvr.org
1 conv-pix.adstk.io
1 js.adsrvr.org 9935087.fls.doubleclick.net
1 sp.analytics.yahoo.com
1 widget.us.criteo.com
1 sslwidget.criteo.com 1 redirects
1 cdnstat.net citi-onlime.org
1 mug.criteo.com
1 pt.ispot.tv
1 data.dianomi.com
1 rtb.adgrx.com
1 b.videoamp.com
1 data.adxcel-ec2.com
1 js.adstk.io www.googletagmanager.com
1 static.criteo.net www.googletagmanager.com
1 analytics.twitter.com citi-onlime.org
1 t.co citi-onlime.org
1 region1.google-analytics.com www.googletagmanager.com
1 static.ads-twitter.com citi-onlime.org
1 amplify.outbrain.com citi-onlime.org
1 www.googleadservices.com www.googletagmanager.com
1 cdn.amplitude.com citi-onlime.org
1 www.google-analytics.com citi-onlime.org
1 ssl.kaptcha.com citi-onlime.org
1 accounts.google.com citi-onlime.org
166 80
Subject Issuer Validity Valid
*.citi-onlime.org
GTS CA 1P5		 2023-04-06 -
2023-07-05		 3 months crt.sh
sni.cloudflaressl.com
Cloudflare Inc ECC CA-3		 2023-03-08 -
2024-03-07		 a year crt.sh
accounts.google.com
GTS CA 1C3		 2023-03-20 -
2023-06-12		 3 months crt.sh
ssl.kaptcha.com
Sectigo RSA Organization Validation Secure Server CA		 2022-10-18 -
2023-10-18		 a year crt.sh
*.segment.com
Amazon RSA 2048 M01		 2023-02-24 -
2024-01-12		 a year crt.sh
*.google-analytics.com
GTS CA 1C3		 2023-03-13 -
2023-06-05		 3 months crt.sh
cdn.amplitude.com
Amazon RSA 2048 M01		 2023-01-12 -
2024-02-11		 a year crt.sh
www.googleadservices.com
GTS CA 1C3		 2023-03-20 -
2023-06-12		 3 months crt.sh
*.taboola.com
DigiCert TLS RSA SHA256 2020 CA1		 2022-12-08 -
2023-12-31		 a year crt.sh
*.outbrain.com
DigiCert TLS RSA SHA256 2020 CA1		 2023-02-09 -
2024-02-11		 a year crt.sh
ads-twitter.com
DigiCert TLS RSA SHA256 2020 CA1		 2022-07-22 -
2023-08-22		 a year crt.sh
*.tiktok.com
RapidSSL TLS ECC CA G1		 2023-03-13 -
2024-04-12		 a year crt.sh
t.co
DigiCert TLS Hybrid ECC SHA384 2020 CA1		 2023-02-05 -
2024-02-05		 a year crt.sh
*.twitter.com
DigiCert TLS Hybrid ECC SHA384 2020 CA1		 2023-02-05 -
2024-02-05		 a year crt.sh
www.bing.com
Microsoft RSA TLS CA 02		 2023-02-16 -
2023-08-16		 6 months crt.sh
*.api.fantasysports.yahoo.com
DigiCert SHA2 High Assurance Server CA		 2023-02-27 -
2023-04-19		 2 months crt.sh
*.criteo.net
DigiCert Global G2 TLS RSA SHA256 2020 CA1		 2023-03-24 -
2023-06-18		 3 months crt.sh
*.us.tvsquared.com
Amazon RSA 2048 M01		 2023-02-09 -
2023-07-27		 6 months crt.sh
adstk.io
DigiCert TLS Hybrid ECC SHA384 2020 CA1		 2023-02-17 -
2024-03-19		 a year crt.sh
adxcel-ec2.com
Amazon RSA 2048 M02		 2023-02-24 -
2023-11-16		 9 months crt.sh
*.videoamp.com
Amazon RSA 2048 M01		 2023-02-23 -
2023-10-04		 7 months crt.sh
public1.adgear.com
Sectigo RSA Domain Validation Secure Server CA		 2023-03-03 -
2024-03-31		 a year crt.sh
dianomi.com
Cloudflare Inc ECC CA-3		 2023-04-03 -
2024-04-02		 a year crt.sh
*.ispot.tv
R3		 2023-03-15 -
2023-06-13		 3 months crt.sh
*.g.doubleclick.net
GTS CA 1C3		 2023-03-20 -
2023-06-12		 3 months crt.sh
*.doubleclick.net
GTS CA 1C3		 2023-03-20 -
2023-06-12		 3 months crt.sh
*.criteo.com
DigiCert Global G2 TLS RSA SHA256 2020 CA1		 2023-03-09 -
2023-06-03		 3 months crt.sh
www.google.com
GTS CA 1C3		 2023-03-20 -
2023-06-12		 3 months crt.sh
*.google.nl
GTS CA 1C3		 2023-03-20 -
2023-06-12		 3 months crt.sh
*.cdnstat.net
R3		 2023-03-25 -
2023-06-23		 3 months crt.sh
real.sp.analytics.yahoo.com
DigiCert SHA2 High Assurance Server CA		 2023-01-03 -
2023-06-28		 6 months crt.sh
*.adsrvr.org
GlobalSign GCC R3 DV TLS CA 2020		 2022-03-31 -
2023-05-02		 a year crt.sh
*.google.com
GTS CA 1C3		 2023-03-20 -
2023-06-12		 3 months crt.sh
www.everestjs.net
DigiCert TLS RSA SHA256 2020 CA1		 2022-08-09 -
2023-09-09		 a year crt.sh
*.media.net
DigiCert TLS RSA SHA256 2020 CA1		 2023-02-10 -
2024-02-18		 a year crt.sh
*.rubiconproject.com
DigiCert TLS RSA SHA256 2020 CA1		 2023-03-05 -
2024-04-03		 a year crt.sh
*.sharethrough.com
Amazon RSA 2048 M02		 2023-02-10 -
2023-08-12		 6 months crt.sh
*.smartadserver.com
DigiCert TLS Hybrid ECC SHA384 2020 CA1		 2023-01-21 -
2024-01-23		 a year crt.sh
teads.tv
R3		 2023-02-21 -
2023-05-22		 3 months crt.sh
*.3lift.com
Amazon RSA 2048 M01		 2023-02-10 -
2023-06-11		 4 months crt.sh
ups.analytics.yahoo.com
DigiCert SHA2 High Assurance Server CA		 2023-02-21 -
2023-08-16		 6 months crt.sh
*.adform.net
DigiCert TLS RSA SHA256 2020 CA1		 2022-05-18 -
2023-06-16		 a year crt.sh
omnitagjs.com
Sectigo RSA Domain Validation Secure Server CA		 2022-06-21 -
2023-07-21		 a year crt.sh
*.id5-sync.com
R3		 2023-01-25 -
2023-04-25		 3 months crt.sh
itm.ivitrack.com
R3		 2023-04-04 -
2023-07-03		 3 months crt.sh
exchange.mediavine.com
Amazon RSA 2048 M01		 2023-02-11 -
2023-08-04		 6 months crt.sh
*.pubmatic.com
DigiCert Baltimore TLS RSA SHA256 2020 CA1		 2022-06-13 -
2023-07-14		 a year crt.sh
*.tremorhub.com
Amazon RSA 2048 M01		 2023-02-22 -
2024-03-23		 a year crt.sh
*.yieldlab.net
DigiCert TLS RSA SHA256 2020 CA1		 2022-11-16 -
2023-11-15		 a year crt.sh
*.ads.yieldmo.com
Amazon RSA 2048 M02		 2023-02-10 -
2023-07-01		 5 months crt.sh
*.tmogul.com
Amazon RSA 2048 M01		 2023-02-13 -
2023-07-15		 5 months crt.sh

This page contains 7 frames:

Primary Page: https://citi-onlime.org/
Frame ID: 35ABDBBDDC1CDFF07D15DCE3E5EC40B7
Requests: 134 HTTP requests in this frame

Frame: https://citi-onlime.org/cdn-cgi/challenge-platform/h/b/scripts/alpha/invisible.js?ts=1680811200
Frame ID: CC9AE336F6B595E0A86C5B84C761B79A
Requests: 3 HTTP requests in this frame

Frame: https://9935087.fls.doubleclick.net/activityi;dc_pre=CLOLvNCPlv4CFarKOwIdJecJCg;src=9935087;type=impre0;cat=nerdw0;ord=5339313899788;gtm=45fe3430;auiddc=1494340267.1680813876;~oref=https%3A%2F%2Fciti-onlime.org%2F
Frame ID: 92E12E6BC00F4CE550BC21371ABF4ED3
Requests: 7 HTTP requests in this frame

Frame: https://gum.criteo.com/syncframe?topUrl=citi-onlime.org&origin=onetag
Frame ID: 1194AE625162AE459C253F30D2B81B54
Requests: 2 HTTP requests in this frame

Frame: https://insight.adsrvr.org/track/up?adv=9v9ko6z&ref=https%3A%2F%2Fciti-onlime.org%2F&upid=r0jxhyd&upv=1.1.0
Frame ID: 36EA15C154F09016559AE1CA8179E9DA
Requests: 1 HTTP requests in this frame

Frame: https://www.everestjs.net/static/pixel_details.html
Frame ID: B83F60B2DE0D2AFAF594A9B8EEFBCE6A
Requests: 1 HTTP requests in this frame

Frame: https://x.bidswitch.net/ul_cb/sync?dsp_id=46&user_id=k-hdIa1rSm4WAVQbcVbGCQLdoUOynJbWM0ii8lMA&expires=30
Frame ID: 369E490A15A564138728DAFB2A3147F9
Requests: 27 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Citibank: Checking, Savings and CDs - NerdWalletNerdWallet Home PageNerdWallet Home Page

Detected technologies

Overall confidence: 100%
Detected patterns
  • accounts\.google\.com/gsi/client
Overall confidence: 100%
Detected patterns
  • cdn\.amplitude\.com
Overall confidence: 100%
Detected patterns
  • adnxs\.(?:net|com)
Overall confidence: 100%
Detected patterns
  • //static\.criteo\.net/js/ld/ld\.js
Overall confidence: 100%
Detected patterns
  • google-analytics\.com/(?:ga|urchin|analytics)\.js
Overall confidence: 100%
Detected patterns
  • googletagmanager\.com/gtm\.js
  • googletagmanager\.com/gtag/js
Overall confidence: 100%
Detected patterns
  • https?://[^/]*\.pubmatic\.com
Overall confidence: 100%
Detected patterns
  • https?://[^/]*\.rubiconproject\.com
Overall confidence: 100%
Detected patterns
  • cdn\.segment\.com/analytics\.js

Page Statistics

166
Requests

90 %
HTTPS

20 %
IPv6

59
Domains

80
Subdomains

70
IPs

9
Countries

2241 kB
Transfer

7506 kB
Size

71
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 63
  • https://googleads.g.doubleclick.net/pagead/viewthroughconversion/957893550/?random=1458607396&cv=11&fst=1680813876015&bg=ffffff&guid=ON&async=1&gtm=45He3430&u_w=1600&u_h=1200&url=https%3A%2F%2Fciti-onlime.org%2F&label=RVTxCPzMg9MBEK6X4cgD&hn=www.googleadservices.com&frm=0&tiba=Citibank%3A%20Checking%2C%20Savings%20and%20CDs%20-%20NerdWallet&value=0&auid=1494340267.1680813876&uamb=0&uaw=0&fmt=3&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&ocp_id=NC8vZMWxB9GhlQeAo4OYCg&sscte=1&crd=&eitems=ChAI8Nu5oQYQjdS33qGPl68vEh0Ag7fzJJBNoUjOu-uRBMErhHPsFxgU5JSwVeFXWA&pscrd=Ek9DaEVJOE51NW9RWVF6WUtDcjlTcjZPZk9BUkltQUR3cmN5R1Q0WktramxGMWRackxQUU9XcmFhS2RwOWRFSnhIVU9OX3hnVmNNSXJwaC13GlpDaEVJOE51NW9RWVFwbzNVLXRxQzI3Q3ZBUkl1QUpjblBCVHZ4NVdNRVdqcWk4VVlRNXpGMXU0cXNPQzZSaEVTbUl2Uk9uTVFRT3ZGTDkybWVEWGJfNzhiU0E HTTP 302
  • https://www.google.com/pagead/1p-conversion/957893550/?random=1458607396&cv=11&fst=1680813876015&bg=ffffff&guid=ON&async=1&gtm=45He3430&u_w=1600&u_h=1200&url=https%3A%2F%2Fciti-onlime.org%2F&label=RVTxCPzMg9MBEK6X4cgD&hn=www.googleadservices.com&frm=0&tiba=Citibank%3A%20Checking%2C%20Savings%20and%20CDs%20-%20NerdWallet&value=0&auid=1494340267.1680813876&uamb=0&uaw=0&fmt=3&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&sscte=1&crd=&pscrd=Ek9DaEVJOE51NW9RWVF6WUtDcjlTcjZPZk9BUkltQUR3cmN5R1Q0WktramxGMWRackxQUU9XcmFhS2RwOWRFSnhIVU9OX3hnVmNNSXJwaC13GlpDaEVJOE51NW9RWVFwbzNVLXRxQzI3Q3ZBUkl1QUpjblBCVHZ4NVdNRVdqcWk4VVlRNXpGMXU0cXNPQzZSaEVTbUl2Uk9uTVFRT3ZGTDkybWVEWGJfNzhiU0E&is_vtc=1&ocp_id=NC8vZMWxB9GhlQeAo4OYCg&eitems=ChAI8Nu5oQYQjdS33qGPl68vEh0Ag7fzJO17Myc7Kp4B_GMCS3S3ymVaKwh_1tkM8w&random=1727919454 HTTP 302
  • https://www.google.nl/pagead/1p-conversion/957893550/?random=1458607396&cv=11&fst=1680813876015&bg=ffffff&guid=ON&async=1&gtm=45He3430&u_w=1600&u_h=1200&url=https%3A%2F%2Fciti-onlime.org%2F&label=RVTxCPzMg9MBEK6X4cgD&hn=www.googleadservices.com&frm=0&tiba=Citibank%3A%20Checking%2C%20Savings%20and%20CDs%20-%20NerdWallet&value=0&auid=1494340267.1680813876&uamb=0&uaw=0&fmt=3&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&sscte=1&crd=&pscrd=Ek9DaEVJOE51NW9RWVF6WUtDcjlTcjZPZk9BUkltQUR3cmN5R1Q0WktramxGMWRackxQUU9XcmFhS2RwOWRFSnhIVU9OX3hnVmNNSXJwaC13GlpDaEVJOE51NW9RWVFwbzNVLXRxQzI3Q3ZBUkl1QUpjblBCVHZ4NVdNRVdqcWk4VVlRNXpGMXU0cXNPQzZSaEVTbUl2Uk9uTVFRT3ZGTDkybWVEWGJfNzhiU0E&is_vtc=1&ocp_id=NC8vZMWxB9GhlQeAo4OYCg&eitems=ChAI8Nu5oQYQjdS33qGPl68vEh0Ag7fzJO17Myc7Kp4B_GMCS3S3ymVaKwh_1tkM8w&random=1727919454&ipr=y&prhg=0
Request Chain 91
  • https://pixel.videohub.tv/event/img?trackcd=1638988369274&bvr_id=1340946&adv_id=468646&gtmcb=1657164805 HTTP 302
  • https://sync.1rx.io/usersync/tremor/CI-e757e26d5d9dc7025d64b9427751d8c7?dspret=1&redir=https%3A%2F%2Fpixel.videohub.tv%2Fevent%2Fimg%3Fgtmcb%3D1657164805%26UI%3D%5BRX_UUID%5D%26bvr_id%3D1340946%26trackcd%3D1638988369274%26adv_id%3D468646 HTTP 302
  • https://sync.1rx.io/usersync/tremor/CI-e757e26d5d9dc7025d64b9427751d8c7?zcc=1&redir=https%3A%2F%2Fpixel.videohub.tv%2Fevent%2Fimg%3Fgtmcb%3D1657164805%26UI%3D%5BRX_UUID%5D%26bvr_id%3D1340946%26trackcd%3D1638988369274%26adv_id%3D468646&cb=1680813876924 HTTP 302
  • https://sync.targeting.unrulymedia.com/csync/RX-ae42ec94-16a7-4dbd-ad4f-a0ee8943d593-003?redir=https%3A%2F%2Fpixel.videohub.tv%2Fevent%2Fimg%3Fgtmcb%3D1657164805%26UI%3DRX-ae42ec94-16a7-4dbd-ad4f-a0ee8943d593-003%26bvr_id%3D1340946%26trackcd%3D1638988369274%26adv_id%3D468646 HTTP 302
  • https://pixel.videohub.tv/event/img?gtmcb=1657164805&UI=RX-ae42ec94-16a7-4dbd-ad4f-a0ee8943d593-003&bvr_id=1340946&trackcd=1638988369274&adv_id=468646
Request Chain 95
  • https://pixel.videohub.tv/event/img?trackcd=1673021537695&bvr_id=1448736&adv_id=468646&gtmcb=388224746 HTTP 302
  • https://sync.1rx.io/usersync/tremor/CI-8e61c845f897ddbcee6e418bf2277a8f?dspret=1&redir=https%3A%2F%2Fpixel.videohub.tv%2Fevent%2Fimg%3Fgtmcb%3D388224746%26UI%3D%5BRX_UUID%5D%26bvr_id%3D1448736%26trackcd%3D1673021537695%26adv_id%3D468646 HTTP 302
  • https://sync.1rx.io/usersync/tremor/CI-8e61c845f897ddbcee6e418bf2277a8f?zcc=1&redir=https%3A%2F%2Fpixel.videohub.tv%2Fevent%2Fimg%3Fgtmcb%3D388224746%26UI%3D%5BRX_UUID%5D%26bvr_id%3D1448736%26trackcd%3D1673021537695%26adv_id%3D468646&cb=1680813876925 HTTP 302
  • https://sync.targeting.unrulymedia.com/csync/RX-ae42ec94-16a7-4dbd-ad4f-a0ee8943d593-003?redir=https%3A%2F%2Fpixel.videohub.tv%2Fevent%2Fimg%3Fgtmcb%3D388224746%26UI%3DRX-ae42ec94-16a7-4dbd-ad4f-a0ee8943d593-003%26bvr_id%3D1448736%26trackcd%3D1673021537695%26adv_id%3D468646 HTTP 302
  • https://pixel.videohub.tv/event/img?gtmcb=388224746&UI=RX-ae42ec94-16a7-4dbd-ad4f-a0ee8943d593-003&bvr_id=1448736&trackcd=1673021537695&adv_id=468646
Request Chain 100
  • https://9935087.fls.doubleclick.net/activityi;src=9935087;type=impre0;cat=nerdw0;ord=5339313899788;gtm=45fe3430;auiddc=1494340267.1680813876;~oref=https%3A%2F%2Fciti-onlime.org%2F HTTP 302
  • https://9935087.fls.doubleclick.net/activityi;dc_pre=CLOLvNCPlv4CFarKOwIdJecJCg;src=9935087;type=impre0;cat=nerdw0;ord=5339313899788;gtm=45fe3430;auiddc=1494340267.1680813876;~oref=https%3A%2F%2Fciti-onlime.org%2F
Request Chain 101
  • https://ad.doubleclick.net/ddm/activity/src=5777706;type=invmedia;cat=nerdw0;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;ord=1 HTTP 302
  • https://ad.doubleclick.net/ddm/activity/src=5777706;dc_pre=CML6vtCPlv4CFYWSmgodG2EEhQ;type=invmedia;cat=nerdw0;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;ord=1 HTTP 302
  • https://adservice.google.com/ddm/fls/z/src=5777706;dc_pre=CML6vtCPlv4CFYWSmgodG2EEhQ;type=invmedia;cat=nerdw0;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;ord=1
Request Chain 108
  • https://gum.criteo.com/sid/json?origin=onetag&domain=citi-onlime.org&sn=ChromeSyncframe&so=0&topUrl=citi-onlime.org&cw=1&lsw=1&topicsavail=0&fledgeavail=0 HTTP 302
  • https://mug.criteo.com/sid?cpp=eZXeRXxxaDJQOUtsU0dWb0t6dG5IYXh0RlQyMWJ4bUNBdkgvcmN0NXRDMC9HcnBJT3luQzltcUlCZWU2cG93ZEE2dmlSTHpUK3ZBc0I3MnlzbllUbnZ5dlh0YW1Gc0JHUFZYNkNiS2FTTldvN25oME5GdlpjUG1JOGtFeVNGSGNJbWFub1V5ZjFTQ1p0eVhRLzk4R0hldXE1RVNZTVhuN1RzWkMzWEFKejVRWTF0QmhkSExjbjFmRFNMd0dwYmZIZ0J2c0JUQlVNS08vNkRWN1U5Z1BPaDlZVW8wTzRTcG8vZGtNZnJ4aHUzQzl5OUJvQTlaczJablZmQitzZnhRajlFOEFXRHZlaVRWZlN0MDdDU2xKZmcxQW9EQT09fA&cppv=2
Request Chain 111
  • https://sslwidget.criteo.com/event?a=66132&v=5.15.0&p0=e%3Dexd%26site_type%3Dd&p1=e%3Dvp%26p%3D1&p2=e%3Ddis&adce=1&bundle=cpoa118lMkJrb2s3NzNqUFVCVE4lMkZYWm1ORm13Q0xpMjNMOFR4cEVvNTRrMGNTVEtNUUlNSWN6WEJwSHRuNHUzUjJOcjhwcTBWREdDNmV6QWdDQUZjU09maEM2ODhiZXc1Zmo4b2pTcHJFWkl2WFU5ME5TVTdKVjZkd0d6RkVMUWpKemdUQlRESW5yVHlxU2hhRVBEWVNYVkRLMiUyQlElM0QlM0Q&tld=citi-onlime.org&fu=https%253A%252F%252Fciti-onlime.org%252F&ceid=dcf4b76c-cf6b-47a2-a265-b1bdfd73b40f&dtycbr=30420 HTTP 302
  • https://widget.us.criteo.com/event?a=66132&v=5.15.0&p0=e%3Dexd%26site_type%3Dd&p1=e%3Dvp%26p%3D1&p2=e%3Ddis&adce=1&bundle=cpoa118lMkJrb2s3NzNqUFVCVE4lMkZYWm1ORm13Q0xpMjNMOFR4cEVvNTRrMGNTVEtNUUlNSWN6WEJwSHRuNHUzUjJOcjhwcTBWREdDNmV6QWdDQUZjU09maEM2ODhiZXc1Zmo4b2pTcHJFWkl2WFU5ME5TVTdKVjZkd0d6RkVMUWpKemdUQlRESW5yVHlxU2hhRVBEWVNYVkRLMiUyQlElM0QlM0Q&tld=citi-onlime.org&fu=https%253A%252F%252Fciti-onlime.org%252F&ceid=dcf4b76c-cf6b-47a2-a265-b1bdfd73b40f&dtycbr=30420
Request Chain 114
  • https://rtd-tm.everesttech.net/upi/?sid=cLo95ydYchhUBgxGDQQq&cs=1 HTTP 302
  • https://rtd-tm.everesttech.net/ct/upi/?sid=cLo95ydYchhUBgxGDQQq&cs=1&_test=ZC8vNQAE-STOuwBc HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=g8f47s39e399f3fe&google_push&google_sc&google_hm=WkM4dk5RQUUtU1RPdXdCYw
Request Chain 120
  • https://pixel.everesttech.net/10428/gr?ev_gb=0&url=https%3A%2F%2Fwww.everestjs.net%2Fstatic%2Fpixel_details.html%23google%3D__EFGCK__%26gsurfer%3D__EFGSURFER__%26imsId%3D__EFIMSORGID__%26optout%3D__EFOPTOUT__%26throttleCookie%3D__EFSYNC__%26time%3D__EFTIME__ HTTP 302
  • https://www.everestjs.net/static/pixel_details.html
Request Chain 121
  • https://x.bidswitch.net/sync?dsp_id=46&user_id=k-hdIa1rSm4WAVQbcVbGCQLdoUOynJbWM0ii8lMA&expires=30 HTTP 302
  • https://x.bidswitch.net/ul_cb/sync?dsp_id=46&user_id=k-hdIa1rSm4WAVQbcVbGCQLdoUOynJbWM0ii8lMA&expires=30
Request Chain 122
  • https://cm.g.doubleclick.net/pixel?google_nid=cjp&google_sc&google_ula=913071&CriteoUserId=k-Cfm6sbSm4WAVQbcVbGCQLdoUOymHBIWxSN4e2g&google_cm&google_hm=ay1DZm02c2JTbTRXQVZRYmNWYkdDUUxkb1VPeW1IQklXeFNONGUyZw HTTP 302
  • https://dis.criteo.com/dis/rtb/google/cookiematch.aspx?id=&CriteoUserId=k-Cfm6sbSm4WAVQbcVbGCQLdoUOymHBIWxSN4e2g&google_gid=CAESED3R3T7yVWTqBvET3FmWY6I&google_cver=1&google_ula=913071,0
Request Chain 123
  • https://ib.adnxs.com/getuid?https://dis.criteo.com/dis/rtb/appnexus/cookiematch.aspx?appnxsid=$UID HTTP 307
  • https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fdis.criteo.com%2Fdis%2Frtb%2Fappnexus%2Fcookiematch.aspx%3Fappnxsid%3D%24UID HTTP 302
  • https://dis.criteo.com/dis/rtb/appnexus/cookiematch.aspx?appnxsid=371551623866893865
Request Chain 124
  • https://secure.adnxs.com/setuid?entity=52&code=k-ENoMe7Sm4WAVQbcVbGCQLdoUOymTCXlY1cVCTQ HTTP 307
  • https://secure.adnxs.com/bounce?%2Fsetuid%3Fentity%3D52%26code%3Dk-ENoMe7Sm4WAVQbcVbGCQLdoUOymTCXlY1cVCTQ
Request Chain 135
  • https://r.casalemedia.com/rum?cm_dsp_id=20&external_user_id=k-A2-V1rSm4WAVQbcVbGCQLdoUOymjEEUkI0XYuQ HTTP 302
  • https://r.casalemedia.com/rum?cm_dsp_id=20&external_user_id=k-A2-V1rSm4WAVQbcVbGCQLdoUOymjEEUkI0XYuQ&C=1
Request Chain 136
  • https://gum.criteo.com/sync?c=8&r=1&a=1&u=https%3A%2F%2Fdpm.demdex.net%2Fibs%3Adpid%3D28645%26dpuuid%3D%40USERID%40 HTTP 302
  • https://dpm.demdex.net/ibs:dpid=28645&dpuuid=20_d5pgiE7y8vvnvRd8t9l30UweDixHT HTTP 302
  • https://dpm.demdex.net/demconf.jpg?et:ibs%7cdata:dpid=28645&dpuuid=20_d5pgiE7y8vvnvRd8t9l30UweDixHT
Request Chain 138
  • https://ad.360yield.com/match?publisher_dsp_id=38&external_user_id=k-iChjS7Sm4WAVQbcVbGCQLdoUOynYZIGk_PqUTw HTTP 302
  • https://ad.360yield.com/ul_cb/match?publisher_dsp_id=38&external_user_id=k-iChjS7Sm4WAVQbcVbGCQLdoUOynYZIGk_PqUTw
Request Chain 147
  • https://cm.everesttech.net/cm HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=everest&google_cm&google_sc&ev_rs=1&url=/1x1&google_hm=WkM4dk5RQUUtU1RPdXdCYw HTTP 302
  • https://cm.everesttech.net/cm/ax?cookieid=&ev_rs=1&url=/1x1&google_gid=CAESEC7k-7nSXgrxWjIv0i_a2HQ&google_cver=1 HTTP 302
  • https://pixel.everesttech.net/1x1
Request Chain 148
  • https://gum.criteo.com/sync?c=83&r=1&a=1&u=https%3A%2F%2Fbeacon.krxd.net%2Fusermatch.gif%3Fpartner%3Dcriteo%26partner_uid%3D%40USERID%40 HTTP 302
  • https://beacon.krxd.net/usermatch.gif?partner=criteo&partner_uid=6szFSK6wvyiIUPpo1Y4CTAauw6RrMhlq
Request Chain 161
  • https://gum.criteo.com/sync?c=10&r=1&u=https%3A%2F%2Fs.thebrighttag.com%2Fcs%3Fbtt%3D0%26tp%3Dcr%26uid%3D%40USERID%40 HTTP 302
  • https://s.thebrighttag.com/cs?btt=0&tp=cr&uid=jXB1fh-fROwsllvuGaPmKH9JjiW_7JeE

166 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request /
citi-onlime.org/ 		453 KB
65 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://citi-onlime.org/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
4fc274fb6c9f231239a4f7ebc01cfc592b1ed36787478a1f62d2a95e033d296a

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36
accept-language
nl-NL,nl;q=0.9

Response headers

alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
cf-cache-status
DYNAMIC
cf-ray
7b3cdea0683b1c81-AMS
content-encoding
br
content-type
text/html
date
Thu, 06 Apr 2023 20:44:35 GMT
last-modified
Thu, 06 Apr 2023 07:09:04 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=fO1tLjmWNjxdy8HBWjb4Er4oXzFLg%2BvJhZ2s8NM2qQFx%2FQ1Z30RoYHK%2B8G5xXDjwyenvMoFxOzZsSkXOtC8JXV3qGm%2BekElgppka31vUnIWMnk0%2FWLRIvrdu6gC2%2F%2FbmdmdPsnN37zdZufmROVg%3D"}],"group":"cf-nel","max_age":604800}
server
cloudflare
nds.442e2fa4527ba866940e.css
www.nerdwallet.com/cdn/apps/prod/global-markup/ 		59 KB
7 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www.nerdwallet.com/cdn/apps/prod/global-markup/nds.442e2fa4527ba866940e.css
Requested by
Host: citi-onlime.org
URL: https://citi-onlime.org/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.18.14.6 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
5a3cad9a6dc0a4a795f82ed45349aea9fd9d197d5c3fdc28f2d7f21f596db111

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://citi-onlime.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

date
Thu, 06 Apr 2023 20:44:35 GMT
x-amz-version-id
KA_90xVyvbVbEzbX2ctD.PhcYufcQyn4
content-encoding
br
cf-cache-status
HIT
x-amz-request-id
ZPDA7Q1FGAWJHG7D
age
270442
x-amz-server-side-encryption
AES256
content-security-policy-report-only
default-src * data: blob: filesystem: about: ws: wss: 'unsafe-inline' 'unsafe-eval';
x-amz-replication-status
COMPLETED
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-amz-id-2
Wrq6WgbdOvnmv1gEUpcfBcl8M0PUvuJXqNwLmJ+2qLFDQryK52um+Cj7K/iJ0PNQUBiHrL6FXvs=
last-modified
Mon, 03 Apr 2023 17:33:56 GMT
server
cloudflare
etag
W/"8c5e5b13a9be4a5d915feb2bd7556d28"
vary
Origin, Accept-Encoding
content-type
text/css
cache-control
public, max-age=31557600
cf-ray
7b3cdea14ac0922c-FRA
x-nerd
Edge
nav.442e2fa4527ba866940e.css
www.nerdwallet.com/cdn/apps/prod/global-markup/ 		181 KB
29 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www.nerdwallet.com/cdn/apps/prod/global-markup/nav.442e2fa4527ba866940e.css
Requested by
Host: citi-onlime.org
URL: https://citi-onlime.org/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.18.14.6 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
fef7987a2bad3e40dc6ad300a6b069f77d9e35a9c70b26f47f0429c29b1ba738

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://citi-onlime.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

date
Thu, 06 Apr 2023 20:44:35 GMT
x-amz-version-id
ytZC0Ci542Z7sM6STTzC8ubAr3U9Un9u
content-encoding
br
cf-cache-status
HIT
x-amz-request-id
ZPD4N68Y2GP46B12
age
270443
x-amz-server-side-encryption
AES256
content-security-policy-report-only
default-src * data: blob: filesystem: about: ws: wss: 'unsafe-inline' 'unsafe-eval';
x-amz-replication-status
COMPLETED
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-amz-id-2
e74nB3hDfA0Z+oShGZtRErH+/eqfeSfiLLKLKzpy7r8oO7bOTzSmAT2dqss9MTKQM+ZPpNqoCWs=
last-modified
Mon, 03 Apr 2023 17:33:55 GMT
server
cloudflare
etag
W/"3fa94911d79352e983df38d172f44f75"
vary
Origin, Accept-Encoding
content-type
text/css
cache-control
public, max-age=31557600
cf-ray
7b3cdea14ac2922c-FRA
x-nerd
Edge
app.107a83a68aa196efd345.css
www.nerdwallet.com/cdn/apps/prod/reviews-banking-client/build/css/ 		167 KB
32 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www.nerdwallet.com/cdn/apps/prod/reviews-banking-client/build/css/app.107a83a68aa196efd345.css
Requested by
Host: citi-onlime.org
URL: https://citi-onlime.org/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.18.14.6 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
45f4a1f256387a589bd172e13b7c9e5bb32135bb28f3748d4bc3c2c646b1fc1d

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://citi-onlime.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

date
Thu, 06 Apr 2023 20:44:35 GMT
x-amz-version-id
E619IsDZDAAAiKGvgkyx0yhM3R_MzzF2
content-encoding
br
cf-cache-status
HIT
x-amz-request-id
MDVBNSQVECFBQR72
age
74938
x-amz-server-side-encryption
AES256
content-security-policy-report-only
default-src * data: blob: filesystem: about: ws: wss: 'unsafe-inline' 'unsafe-eval';
x-amz-replication-status
COMPLETED
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-amz-id-2
97eqwkW74hYqteRqpZ7QXebVeSmi5ciJJeieR9vi9HfDGmjVBSpeQH9z9TsZWBJbAbLE/+5C9t0=
last-modified
Thu, 30 Mar 2023 17:17:08 GMT
server
cloudflare
etag
W/"0601443cbaef9ebc581c41209c637d93"
vary
Origin, Accept-Encoding
content-type
text/css
cache-control
public, max-age=31557600
cf-ray
7b3cdea14ac4922c-FRA
x-nerd
Edge
prequal-application-house-ad.68909ecec95952302cb6.css
www.nerdwallet.com/cdn/apps/prod/reviews-banking-client/build/css/chunks/chunks/core~components/ 		69 B
807 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www.nerdwallet.com/cdn/apps/prod/reviews-banking-client/build/css/chunks/chunks/core~components/prequal-application-house-ad.68909ecec95952302cb6.css
Requested by
Host: citi-onlime.org
URL: https://citi-onlime.org/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.18.14.6 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
6145beeee17e6b38b00c028be36ca6145d52760f52a6c3fb789ad1458f66a040

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://citi-onlime.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

date
Thu, 06 Apr 2023 20:44:35 GMT
x-amz-version-id
0xcRCX.DEEuFe76W5k2qBppHw0ossZ4J
content-encoding
br
cf-cache-status
HIT
x-amz-request-id
48HMXKJHKKTE70BK
age
2073088
x-amz-server-side-encryption
AES256
content-security-policy-report-only
default-src * data: blob: filesystem: about: ws: wss: 'unsafe-inline' 'unsafe-eval';
x-amz-replication-status
COMPLETED
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-amz-id-2
XpwH2sSQlDCz89z6TL/htpXDMa6eY9nZmgFdkp1BIfm9pYMCTMpyVM7xDT/dy6BLiuitoOJ2o64=
last-modified
Fri, 03 Mar 2023 16:29:15 GMT
server
cloudflare
etag
W/"6d0bfef135d721951736473474192f2b"
vary
Origin, Accept-Encoding
content-type
text/css
cache-control
public, max-age=31557600
cf-ray
7b3cdea14ac6922c-FRA
x-nerd
Edge
core.9cefb357c9c522c4799c.css
www.nerdwallet.com/cdn/apps/prod/reviews-banking-client/build/css/chunks/chunks/ 		67 B
506 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www.nerdwallet.com/cdn/apps/prod/reviews-banking-client/build/css/chunks/chunks/core.9cefb357c9c522c4799c.css
Requested by
Host: citi-onlime.org
URL: https://citi-onlime.org/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.18.14.6 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
dc3dfe7643f94c0468b4d965646bdcf5d8cb1bd21f0aef654df8ee5286db2457

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://citi-onlime.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

date
Thu, 06 Apr 2023 20:44:35 GMT
x-amz-version-id
4rVx7gY5.aqCU_5vbacK03SRaBLqg3ld
content-encoding
br
cf-cache-status
HIT
x-amz-request-id
EXX2CGX1RG2Y541H
age
2006394
x-amz-server-side-encryption
AES256
content-security-policy-report-only
default-src * data: blob: filesystem: about: ws: wss: 'unsafe-inline' 'unsafe-eval';
x-amz-replication-status
COMPLETED
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-amz-id-2
37EuC6Vzfb2t7vjuvohzl9wVohwYMFUeMDSmSS+6lHjdyUIP1mMCYp8K6dPucgI6lhl77TGfSn0=
last-modified
Tue, 14 Mar 2023 14:34:38 GMT
server
cloudflare
etag
W/"db3524abd4fd7d52c3797d8050103a61"
vary
Origin, Accept-Encoding
content-type
text/css
cache-control
public, max-age=31557600
cf-ray
7b3cdea14ac7922c-FRA
x-nerd
Edge
nds.442e2fa4527ba866940e.css
citi-onlime.org/css/ 		55 KB
7 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://citi-onlime.org/css/nds.442e2fa4527ba866940e.css
Requested by
Host: citi-onlime.org
URL: https://citi-onlime.org/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e2aa656bb817b2f3747d1759cc557646f703b90d6342ddc74095b5b1052457d5

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://citi-onlime.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

date
Thu, 06 Apr 2023 20:44:35 GMT
content-encoding
br
cf-cache-status
MISS
last-modified
Thu, 06 Apr 2023 14:05:26 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
etag
W/"642ed1a6-dd22"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=EyaL9D6QQxfnm2SvvDNOI9uKF3jcRPaKqdjZIm3ZARvi3AvTUCrm%2FsMMlNiTyEK%2BTmSfy%2BrQyVpH8DjKJIiVlgOHVkmvhcAr2fXpsFyJdzyy2JrQ7VmyGQzLSzErRmUG4z6fFlSHr0I%2FH8j13c8%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/css
cache-control
max-age=14400
cf-ray
7b3cdea0c8bb1c81-AMS
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
nav.442e2fa4527ba866940e.css
citi-onlime.org/css/ 		180 KB
29 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://citi-onlime.org/css/nav.442e2fa4527ba866940e.css
Requested by
Host: citi-onlime.org
URL: https://citi-onlime.org/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
6903e600934517da5296cf098f67aae302a052f8b85579152e8fbcb4960aed65

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://citi-onlime.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

date
Thu, 06 Apr 2023 20:44:35 GMT
content-encoding
br
cf-cache-status
MISS
last-modified
Thu, 06 Apr 2023 14:05:26 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
etag
W/"642ed1a6-2cf1a"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=cBrurt1%2Foj7z%2Fkdg3rvQFapOJlySmb9uE91l4poaq2Pj4%2FgOC76dsDwvQUPbChicnxwZfcXWolTmuj3s%2FYzl0Fge9v0pl71MeOIt%2BmVAlS1KEDdDdETTCOyeZpmBt7dLGPLfxsQrUSIdomz73g8%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/css
cache-control
max-age=14400
cf-ray
7b3cdea0c8bc1c81-AMS
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
app.107a83a68aa196efd345.css
citi-onlime.org/css/ 		167 KB
31 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://citi-onlime.org/css/app.107a83a68aa196efd345.css
Requested by
Host: citi-onlime.org
URL: https://citi-onlime.org/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
2b61b4c5dce751546693edc66704440f9a1870402bdad72eb2b27475a3668885

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://citi-onlime.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

date
Thu, 06 Apr 2023 20:44:35 GMT
content-encoding
br
cf-cache-status
MISS
last-modified
Thu, 06 Apr 2023 14:05:28 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
etag
W/"642ed1a8-29b03"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=MOKse%2FGU3aJtFQXvDE%2FWFx0QkQVdM9kngb%2FxSE2RYDpVLyCbqExp34NUW9rE6KsHO33WVyKBWrzpfhujZIuE2cx%2Bcs9l3l6rLeeF49P0q1jIZFN%2BEDh3vIXZ60X%2Fl0UwDmk0TACWwP95RJ2iV4I%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/css
cache-control
max-age=14400
cf-ray
7b3cdea0c8bd1c81-AMS
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
prequal-application-house-ad.68909ecec95952302cb6.css
citi-onlime.org/css/ 		69 B
363 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://citi-onlime.org/css/prequal-application-house-ad.68909ecec95952302cb6.css
Requested by
Host: citi-onlime.org
URL: https://citi-onlime.org/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
6145beeee17e6b38b00c028be36ca6145d52760f52a6c3fb789ad1458f66a040

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://citi-onlime.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

date
Thu, 06 Apr 2023 20:44:35 GMT
content-encoding
br
cf-cache-status
MISS
last-modified
Thu, 06 Apr 2023 14:05:26 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
etag
W/"642ed1a6-45"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=RbaBIFK7pRJWeVlFKRSwVX5I%2BSdzBQ8FAXSahx%2FAAhCUEd6JPv6ZoQ3ac9BAL75et44pPBIfAIC%2BQ1qEhZ6t3IGBBsEUxR6WVKtv0ahCMvhprSLYzVsWuLlJOJtqXaeOjXfk1AWGNH1Z1gp4jVk%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/css
cache-control
max-age=14400
cf-ray
7b3cdea0c8bf1c81-AMS
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
core.9cefb357c9c522c4799c.css
citi-onlime.org/css/ 		67 B
413 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://citi-onlime.org/css/core.9cefb357c9c522c4799c.css
Requested by
Host: citi-onlime.org
URL: https://citi-onlime.org/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
dc3dfe7643f94c0468b4d965646bdcf5d8cb1bd21f0aef654df8ee5286db2457

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://citi-onlime.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

date
Thu, 06 Apr 2023 20:44:35 GMT
content-encoding
br
cf-cache-status
MISS
last-modified
Thu, 06 Apr 2023 14:05:26 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
etag
W/"642ed1a6-43"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ifYbPoe9RM4iM32q5boyUt2cXb29tNC8l4w9mQnBOQJMB4SgYosjeBjmmuzo2t%2BpXgDWPihGg7KLaHBhNuhEIIQwHtaNkBV%2FFkapzoGmn96n5%2BnD4z8XvERexYzPolvHAVvQ%2FulXO5iNJUnNVik%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/css
cache-control
max-age=14400
cf-ray
7b3cdea0c8c21c81-AMS
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
Gotham-Book--critical.fdbad282be.woff2
www.nerdwallet.com/cdn/fonts/ 		9 KB
10 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://www.nerdwallet.com/cdn/fonts/Gotham-Book--critical.fdbad282be.woff2
Requested by
Host: citi-onlime.org
URL: https://citi-onlime.org/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.18.14.6 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
ba8be65746ca30fadff7deb639117ec587a44e0428f89218d70bc5e4888ac308

Request headers

Referer
https://citi-onlime.org/
Origin
https://citi-onlime.org
accept-language
nl-NL,nl;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

date
Thu, 06 Apr 2023 20:44:35 GMT
x-amz-version-id
YqixNq.3i6.6M4vrHwt_2_NRU9maJc4k
cf-cache-status
MISS
x-amz-request-id
03MQP79NSVDAQ110
content-security-policy-report-only
default-src * data: blob: filesystem: about: ws: wss: 'unsafe-inline' 'unsafe-eval';
x-amz-replication-status
COMPLETED
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
9492
x-amz-id-2
QTIqsZ82ES3VXYLWzTeVa0TWCou2vNfXzeKvO6ZjzzUqp1eQC3Jfju1qBWkoY7Aq4S8wpdxeADQ=
last-modified
Mon, 22 Mar 2021 20:57:29 GMT
server
cloudflare
etag
"fdbad282bee3da1c38146487b9c2f412"
access-control-max-age
3000
access-control-allow-methods
GET
content-type
application/font-woff2
access-control-allow-origin
*
vary
Origin, Access-Control-Request-Headers, Access-Control-Request-Method, Origin, Accept-Encoding
cache-control
public, max-age=31536000
accept-ranges
bytes
cf-ray
7b3cdea14fa43801-FRA
x-nerd
Edge
Gotham-Bold--critical.dcf83fb890.woff2
www.nerdwallet.com/cdn/fonts/ 		9 KB
10 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://www.nerdwallet.com/cdn/fonts/Gotham-Bold--critical.dcf83fb890.woff2
Requested by
Host: citi-onlime.org
URL: https://citi-onlime.org/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.18.14.6 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
4ae4bbc3bbd5733dcaf9302940b4115e5871733f71ab3f3e7250e693b4d05f6d

Request headers

Referer
https://citi-onlime.org/
Origin
https://citi-onlime.org
accept-language
nl-NL,nl;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

date
Thu, 06 Apr 2023 20:44:35 GMT
x-amz-version-id
csXDMdMerAERSVKnyZV8Lz_tNycn6X8X
cf-cache-status
MISS
x-amz-request-id
03MPNQCCSC5X5SAA
content-security-policy-report-only
default-src * data: blob: filesystem: about: ws: wss: 'unsafe-inline' 'unsafe-eval';
x-amz-replication-status
COMPLETED
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
9112
x-amz-id-2
VcXz4D3++yNq2rubdjHyqYOQ2e9KFAg6XCO+r50FwsI9Z90x4UCStgyT+KPAfJsdukcv5wU8rzc=
last-modified
Mon, 22 Mar 2021 20:57:29 GMT
server
cloudflare
etag
"dcf83fb8902adcc5fd75fdf6da548573"
access-control-max-age
3000
access-control-allow-methods
GET
content-type
application/font-woff2
access-control-allow-origin
*
vary
Origin, Access-Control-Request-Headers, Access-Control-Request-Method, Origin, Accept-Encoding
cache-control
public, max-age=31536000
accept-ranges
bytes
cf-ray
7b3cdea14fa63801-FRA
x-nerd
Edge
ChronicleDisplay-Semibold--critical.2c31edcaf3.woff2
www.nerdwallet.com/cdn/fonts/ 		11 KB
11 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://www.nerdwallet.com/cdn/fonts/ChronicleDisplay-Semibold--critical.2c31edcaf3.woff2
Requested by
Host: citi-onlime.org
URL: https://citi-onlime.org/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.18.14.6 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
c45992da4f0169a7651346ef0a4cb27efe93b28a3b80d230a6f428a0e242db65

Request headers

Referer
https://citi-onlime.org/
Origin
https://citi-onlime.org
accept-language
nl-NL,nl;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

date
Thu, 06 Apr 2023 20:44:35 GMT
x-amz-version-id
hxLS9BBjDUYsoPEtm4oIowkdM_ODkcgf
cf-cache-status
MISS
x-amz-request-id
03MHEXWX33NEEG5A
content-security-policy-report-only
default-src * data: blob: filesystem: about: ws: wss: 'unsafe-inline' 'unsafe-eval';
x-amz-replication-status
COMPLETED
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
11012
x-amz-id-2
csCpnSDALBajR2c0P0GZR4UMGDDtIz4DxsqJuZmMRJc4D5Xj/OCgUwFk2azoY40BTJ3SmknfDuA=
last-modified
Mon, 22 Mar 2021 20:57:29 GMT
server
cloudflare
etag
"2c31edcaf37bc7ca0ca1103d29b5f5f1"
access-control-max-age
3000
access-control-allow-methods
GET
content-type
application/font-woff2
access-control-allow-origin
*
vary
Origin, Access-Control-Request-Headers, Access-Control-Request-Method, Origin, Accept-Encoding
cache-control
public, max-age=31536000
accept-ranges
bytes
cf-ray
7b3cdea14fa73801-FRA
x-nerd
Edge
spencer-user-avatar-160x160_1.jpg
citi-onlime.org/images/ 		5 KB
6 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://citi-onlime.org/images/spencer-user-avatar-160x160_1.jpg
Requested by
Host: citi-onlime.org
URL: https://citi-onlime.org/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
94457f8e9b7528b3bcf317e690e131bf4ff7432fbfb8bb0fe9ef7d1b3e56d2fb

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://citi-onlime.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

date
Thu, 06 Apr 2023 20:44:35 GMT
cf-cache-status
MISS
last-modified
Thu, 06 Apr 2023 14:05:26 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
etag
"642ed1a6-14e6"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=9ItmLTBKt3%2BEPP%2F%2BDnhckBh7EJOcxCLlCSafrXS4fKASapKvOBHyLqx%2BGYIQV4aTy1ouaZb%2BKQ0z3xDF73pphnT3f3GL0qXCU1G0TNw0RT9Ptoitx4rZlfsM8ts%2FGJtQif1BcWSsjp5f9gRMVIo%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/jpeg
cache-control
max-age=14400
accept-ranges
bytes
cf-ray
7b3cdea168200a4d-AMS
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
5350
citi.png
citi-onlime.org/images/ 		3 KB
4 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://citi-onlime.org/images/citi.png
Requested by
Host: citi-onlime.org
URL: https://citi-onlime.org/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
3f4d80beede9162b3480e81f23ec170fb137dac7abf72d7344b20d04e0e2108c

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://citi-onlime.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

date
Thu, 06 Apr 2023 20:44:35 GMT
cf-cache-status
MISS
last-modified
Thu, 06 Apr 2023 14:05:26 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
etag
"642ed1a6-d01"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=4Xl%2FTP0kZqEmJhRqcqY%2F0rIta32YzS4bsP4bR%2BL9KvLsuR87HfS9KnxOI25lvls65n%2BKit0IhIdH0gGmc9QIyhov2lzUsWG8xKnA40J%2F8d3YB3UDhVCGh4WwoVIrx0r1OWp7n2Dmc6SizCw0Ua0%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/png
cache-control
max-age=14400
accept-ranges
bytes
cf-ray
7b3cdea168220a4d-AMS
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
3329
lendingclub.png
citi-onlime.org/images/ 		14 KB
15 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://citi-onlime.org/images/lendingclub.png
Requested by
Host: citi-onlime.org
URL: https://citi-onlime.org/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
87b9e933f2e9e76ca60ca9107429d436415e316d283e135a705c108a023d7246

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://citi-onlime.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

date
Thu, 06 Apr 2023 20:44:35 GMT
cf-cache-status
MISS
last-modified
Thu, 06 Apr 2023 14:05:26 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
etag
"642ed1a6-3942"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=eKyfh30uhHTn%2BfB1ZfPHd39T%2BeTk6ASUNJvWVz87MWgC1I7GjO%2F7POvMmV%2BR%2BHsvpGELy5rNgQfO2lECMcKJ6%2BTobdD449iLBtDNRYx0xera4oUWzEGaFKKrTnn%2FZ6vMCXSl51ykrh%2FptRqKG1k%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/png
cache-control
max-age=14400
accept-ranges
bytes
cf-ray
7b3cdea168230a4d-AMS
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
14658
sofi.png
citi-onlime.org/images/ 		9 KB
10 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://citi-onlime.org/images/sofi.png
Requested by
Host: citi-onlime.org
URL: https://citi-onlime.org/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
d2a3583c514ca9c902713fbd7491ead9a31fd5f255f98b2a966c227ba973e042

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://citi-onlime.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

date
Thu, 06 Apr 2023 20:44:35 GMT
cf-cache-status
MISS
last-modified
Thu, 06 Apr 2023 14:05:26 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
etag
"642ed1a6-2476"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=rK%2Bhpk5fOJyTRv8HwJsGgiLOsuQT2qtX5EuhuuJvHKEKyiH2hQYjCTmlpoclRkdGlNgJIISsfWRjbuMVIgRFyjkCyWEq%2BxNgfsaU7v%2FR1SYqNaZexbwcUsTvGVvbZcekdSeZ4%2F8GFA1Z8jZPLHU%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/png
cache-control
max-age=14400
accept-ranges
bytes
cf-ray
7b3cdea168250a4d-AMS
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
9334
1010_L2.jpg
citi-onlime.org/images/ 		6 KB
6 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://citi-onlime.org/images/1010_L2.jpg
Requested by
Host: citi-onlime.org
URL: https://citi-onlime.org/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
43d219298916f9740ca1db4f20365d13c09ee5e4d0dfc2507e3b9775baa7d584

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://citi-onlime.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

date
Thu, 06 Apr 2023 20:44:35 GMT
cf-cache-status
MISS
last-modified
Thu, 06 Apr 2023 14:05:26 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
etag
"642ed1a6-16be"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ihdNp%2FxqgBTJukCO9yJFIA2MOEAQuJ03OlBVFMTtSIy%2FI6LFMzQzfYxmiJLZZH0VW6TqT6K%2FydRuBUWThyw%2FKIghwqpS3rQL9T8aCn%2Fw2ht8rB8GbIV32vFNYIgOhP6OyjFSTyeMw0r%2BWKl47OY%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/jpeg
cache-control
max-age=14400
accept-ranges
bytes
cf-ray
7b3cdea168260a4d-AMS
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
5822
spencer-user-avatar-160x160.jpg
citi-onlime.org/images/ 		6 KB
6 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://citi-onlime.org/images/spencer-user-avatar-160x160.jpg
Requested by
Host: citi-onlime.org
URL: https://citi-onlime.org/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
8647d6e77acb2c194a10878e3a5980cc2614c8c6524357ac1cc5c31a23f3a5a4

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://citi-onlime.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

date
Thu, 06 Apr 2023 20:44:35 GMT
cf-cache-status
MISS
last-modified
Thu, 06 Apr 2023 14:05:26 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
etag
"642ed1a6-17b0"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=0mTVSuzoWAfv%2BoPr3Wzdwa45CZLIj0Al1%2BgKh%2BaV41lN6RpXidxd69GIEm%2F3f7x1gDcuoNYihJgppN2ury57aOfqb3kZi88sEFqGR%2F%2BJCFYfheJudTq3Q4q1ZwkF2TRQU0CtMWPXJHZel3JJzBI%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/jpeg
cache-control
max-age=14400
accept-ranges
bytes
cf-ray
7b3cdea168280a4d-AMS
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
6064
email-decode.min.js
citi-onlime.org/js/ 		1 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://citi-onlime.org/js/email-decode.min.js
Requested by
Host: citi-onlime.org
URL: https://citi-onlime.org/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
17a50e04066af45be95364f939988005fd0cb7bb6c9128f1e6a74018ce3db292

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://citi-onlime.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

date
Thu, 06 Apr 2023 20:44:35 GMT
content-encoding
br
cf-cache-status
MISS
last-modified
Thu, 06 Apr 2023 14:06:12 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
etag
W/"642ed1d4-4cc"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=BlM6VanCyr04eBitwuAn%2FBeLe85Op2zKrH8BM7%2F87XrPUo6l2esHE8MBiqU8x0LCwweHShkEzLQRT%2FmqUbeOlPKC9v%2F5geYUvauwF8K8lY9IRfpmH%2Be6dRrGRmdNDzuTBagfdC8xTyh2nCmGQHI%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
cache-control
max-age=14400
cf-ray
7b3cdea168180a4d-AMS
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
nav.442e2fa4527ba866940e.js
citi-onlime.org/js/ 		1 MB
411 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://citi-onlime.org/js/nav.442e2fa4527ba866940e.js
Requested by
Host: citi-onlime.org
URL: https://citi-onlime.org/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
cd7de82e28c6200eb4668c90c0341a2737e9de46859902438ce710a9ede910e7

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://citi-onlime.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

date
Thu, 06 Apr 2023 20:44:35 GMT
content-encoding
br
cf-cache-status
MISS
last-modified
Thu, 06 Apr 2023 14:06:32 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
etag
W/"642ed1e8-15b309"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=S9aQsgBWw851dIsYTIObDkajGQw7bArUwJlXd36nUcjcH6Mq3bvKPwpD9qx1i70loeX0ip%2FUdBo%2FqlI6L2CwNIsIP%2FK%2BJBxATWDUb1s7KhrNi0h9Lnz3KY%2BvWhimd%2B7%2BPpQ8ZYnkJOk5urgdTQ0%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
cache-control
max-age=14400
cf-ray
7b3cdea168290a4d-AMS
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
nwa.82111af19f6e130e9095.js
citi-onlime.org/js/ 		85 KB
27 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://citi-onlime.org/js/nwa.82111af19f6e130e9095.js
Requested by
Host: citi-onlime.org
URL: https://citi-onlime.org/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
6aad6619d1de9d066a236e3323ba5411ed807354ebe60abd3b9efdae6076260d

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://citi-onlime.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

date
Thu, 06 Apr 2023 20:44:35 GMT
content-encoding
br
cf-cache-status
MISS
last-modified
Thu, 06 Apr 2023 14:06:34 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
etag
W/"642ed1ea-1523c"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=5c8Vx1VFAAheiKXc1kMuKpF9jOLU6OstOn2Ypyco9CRrkidV%2FeV6bvT1Uj7BE0ynuYlX2SxZVjul83jEG5Jax6XRiDmjlhxgeeMUw67lXNsbY74zK6yvRaeQXe1u8ie2yR97irKPRJct3fsty%2Fk%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
cache-control
max-age=14400
cf-ray
7b3cdea1682a0a4d-AMS
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
document.141f338657f9cfeeb903.js
citi-onlime.org/js/ 		274 B
661 B 		Script
General
Check archive.org
Download Go to
Full URL
https://citi-onlime.org/js/document.141f338657f9cfeeb903.js
Requested by
Host: citi-onlime.org
URL: https://citi-onlime.org/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
bd8f6e7c5f1fa875669062c4dcd37f54946e5bf7c7c35988ed48fe427989e7f7

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://citi-onlime.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

date
Thu, 06 Apr 2023 20:44:35 GMT
content-encoding
br
cf-cache-status
MISS
last-modified
Thu, 06 Apr 2023 14:06:12 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
etag
W/"642ed1d4-112"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=o4yGxqtQ0IWx3uLEh2XYELUym1M3LuxRZMXEKQirpOD0SZl%2FjYC%2BdYC4PhMAPDN6As2fNcLhnhrl%2BAT3KJVJCtu3VZ6OtAjCDw7cUX9rMt6r1uo4M7EyujJQ0atOsifv6WXPErrUyeZKx7f9hvI%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
cache-control
max-age=14400
cf-ray
7b3cdea1682c0a4d-AMS
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
prequal-application-house-ad.f89a881b5c75d7b0410d.js
citi-onlime.org/js/ 		13 KB
5 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://citi-onlime.org/js/prequal-application-house-ad.f89a881b5c75d7b0410d.js
Requested by
Host: citi-onlime.org
URL: https://citi-onlime.org/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
08d9a2fd2156a43edf920c08ea5550e98cb32d1ad0b51c9ee5f58833c7d20570

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://citi-onlime.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

date
Thu, 06 Apr 2023 20:44:35 GMT
content-encoding
br
cf-cache-status
MISS
last-modified
Thu, 06 Apr 2023 14:06:34 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
etag
W/"642ed1ea-3565"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=GapMk9IGsws%2FJGDT4hMt7jRvPI0ci0E0tHwxDhEeLT7rK%2Fiotenzc%2FYbefjSFLUfBNoClnIx2H3E9nM4Oy09yQR4ETtTgPAj7T3E6165d0DOfm1yiP1R%2FCHpNc5RwP6Cqbevr02NaSZDBgfU2rc%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
cache-control
max-age=14400
cf-ray
7b3cdea1682d0a4d-AMS
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
core.e131de4d9a8e07744f6a.js
citi-onlime.org/js/ 		3 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://citi-onlime.org/js/core.e131de4d9a8e07744f6a.js
Requested by
Host: citi-onlime.org
URL: https://citi-onlime.org/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
685eac6835d2df1aa86042f9bdf015559234657756a07b3e3c584c9fb17e3b8d

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://citi-onlime.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

date
Thu, 06 Apr 2023 20:44:35 GMT
content-encoding
br
cf-cache-status
MISS
last-modified
Thu, 06 Apr 2023 14:06:10 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
etag
W/"642ed1d2-cb0"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=W2VyUn3i3s6sZnPg5K1EDBIMcF59RT6Ay3R5Ejz2YQE7GtYqy9oq5PEn%2FqMJ9lSooeB5%2BNvmsEdv7S3sJq1IP%2FMECuxgKOBXC%2FeZEHJ9X16CpU42BJVYO8BORMS0%2BjynStc%2Bg0mYQaht%2F4wHYJc%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
cache-control
max-age=14400
cf-ray
7b3cdea1682e0a4d-AMS
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
app.d921ccbf89f766cd2f7b.js
citi-onlime.org/js/ 		2 MB
690 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://citi-onlime.org/js/app.d921ccbf89f766cd2f7b.js
Requested by
Host: citi-onlime.org
URL: https://citi-onlime.org/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
248f25fc150ddf2c6b312aee59ad8aa00ce8d40d9245310048c9b40b9330d6ad

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://citi-onlime.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

date
Thu, 06 Apr 2023 20:44:35 GMT
content-encoding
br
cf-cache-status
MISS
last-modified
Thu, 06 Apr 2023 14:06:34 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
etag
W/"642ed1ea-25ebc4"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=wrQrwmwPEdCQgL0AfPdnOdWNTPNxorqvE1LmOJ111RxJzcP%2BfbwOxz%2B8LXtf%2BknJdL3Vk9Qq92n%2BmW5YkByF1hpgyqq1IcY2T5WNgqvy0aRBm8OLSZ36o2BNlxiIcEdmFARWFyl9bISUaIIWMFk%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
cache-control
max-age=14400
cf-ray
7b3cdea1682f0a4d-AMS
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
client
accounts.google.com/gsi/ 		194 KB
77 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://accounts.google.com/gsi/client
Requested by
Host: citi-onlime.org
URL: https://citi-onlime.org/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82f::200d Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
efe905d14d331dbbf606e5c7aa32b174ef2e63b9e54c67854595c94734a57b82
Security Headers
Name Value
Content-Security-Policy script-src 'report-sample' 'nonce-TLizuxNn7gHQ620QbdfyGQ' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/identity-sign-in-google-http, require-trusted-types-for 'script';report-uri https://csp.withgoogle.com/csp/identity-sign-in-google-http
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://citi-onlime.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

date
Thu, 06 Apr 2023 20:44:35 GMT
content-security-policy
script-src 'report-sample' 'nonce-TLizuxNn7gHQ620QbdfyGQ' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/identity-sign-in-google-http, require-trusted-types-for 'script';report-uri https://csp.withgoogle.com/csp/identity-sign-in-google-http
content-encoding
gzip
x-content-type-options
nosniff
server
ESF
x-frame-options
SAMEORIGIN
report-to
{"group":"coop_dd7de8473bddc59c6b748810a67a39b1","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/dd7de8473bddc59c6b748810a67a39b1"}]}
content-type
application/javascript; charset=utf-8
cache-control
private, max-age=1800
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection
0
cross-origin-opener-policy-report-only
same-origin; report-to="coop_dd7de8473bddc59c6b748810a67a39b1"
expires
Thu, 06 Apr 2023 20:44:35 GMT
sdk
ssl.kaptcha.com/collect/ 		2 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://ssl.kaptcha.com/collect/sdk?m=171456&s=e3ee823f73cd49dda7065d505772ba7b
Requested by
Host: citi-onlime.org
URL: https://citi-onlime.org/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
35.80.101.90 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-35-80-101-90.us-west-2.compute.amazonaws.com
Software
/
Resource Hash
a6af1ef4a96a76bb0892e0cd0cc837eaac674c6f44d4833801d074625f70de55

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://citi-onlime.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

Pragma
no-cache
Date
Thu, 06 Apr 2023 20:44:35 GMT
X-Correlation-Id
c58a123c-ec9f-4095-9b10-b803a0763220
Transfer-Encoding
chunked
Content-Type
text/javascript
Access-Control-Allow-Origin
*
P3p
CP=CAO PSA OUR
Cache-Control
no-cache, no-store, must-revalidate, private
Expires
0
analytics.min.js
cdn.segment.com/analytics.js/v1/DdHLV8IoKV9qg7SdnKHOoprOG39cGlhf/ 		103 KB
28 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.segment.com/analytics.js/v1/DdHLV8IoKV9qg7SdnKHOoprOG39cGlhf/analytics.min.js
Requested by
Host: citi-onlime.org
URL: https://citi-onlime.org/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
99.86.8.175 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-99-86-8-175.fra6.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
32248911f632a2c320d6d247ded3b4699c52fbf8ff298ed05d98a44b07f5ef66

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://citi-onlime.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

x-amz-version-id
8JvLNTwQ2av2eT5zMrRJjMLEA_9mqCzt
content-encoding
br
via
1.1 7ed7afde326861e358c3c83359e99894.cloudfront.net (CloudFront)
date
Thu, 06 Apr 2023 20:44:37 GMT
x-amz-cf-pop
FRA6-C1
x-amz-server-side-encryption
AES256
x-cache
RefreshHit from cloudfront
x-amz-replication-status
COMPLETED
last-modified
Fri, 27 Jan 2023 02:31:16 GMT
server
AmazonS3
etag
W/"a2b7429cb2f41ec9959698dd20b2f59d"
access-control-max-age
3000
access-control-allow-methods
GET, HEAD
content-type
text/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
public, max-age=120
vary
Accept-Encoding
x-amz-cf-id
PR8Vtl7gHp6P9vSbO8w57P5neKG0n8INPWN6Kz8IS8Emp7VpaLCMjg==
Gotham-Book--critical.fdbad282be.woff2
citi-onlime.org/fonts/ 		9 KB
10 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://citi-onlime.org/fonts/Gotham-Book--critical.fdbad282be.woff2
Requested by
Host: citi-onlime.org
URL: https://citi-onlime.org/css/nds.442e2fa4527ba866940e.css
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
ba8be65746ca30fadff7deb639117ec587a44e0428f89218d70bc5e4888ac308

Request headers

Referer
https://citi-onlime.org/css/nds.442e2fa4527ba866940e.css
Origin
https://citi-onlime.org
accept-language
nl-NL,nl;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

date
Thu, 06 Apr 2023 20:44:35 GMT
cf-cache-status
MISS
last-modified
Thu, 06 Apr 2023 14:05:28 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
etag
W/"642ed1a8-2514"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=oKUwJxBNP49jXgFx3jZqde5UbZI2UEsmRCsVyVgKaBAiGptGWbfblSmbjIyG1UQw1lkEK%2FNjb8%2BSDyc%2Fe32l3bA8w%2BwqKamEdiSd3wNr5XyahX7nNhrR8pOKS2PTPWWzD8x4BX9i93HiYTrjSEQ%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/octet-stream
cache-control
max-age=14400
cf-ray
7b3cdea178440a4d-AMS
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
Gotham-Bold--critical.dcf83fb890.woff2
citi-onlime.org/fonts/ 		9 KB
9 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://citi-onlime.org/fonts/Gotham-Bold--critical.dcf83fb890.woff2
Requested by
Host: citi-onlime.org
URL: https://citi-onlime.org/css/nds.442e2fa4527ba866940e.css
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
4ae4bbc3bbd5733dcaf9302940b4115e5871733f71ab3f3e7250e693b4d05f6d

Request headers

Referer
https://citi-onlime.org/css/nds.442e2fa4527ba866940e.css
Origin
https://citi-onlime.org
accept-language
nl-NL,nl;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

date
Thu, 06 Apr 2023 20:44:35 GMT
cf-cache-status
MISS
last-modified
Thu, 06 Apr 2023 14:05:28 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
etag
W/"642ed1a8-2398"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=6OsLCVHqEneBUDI28OlSQgC9bwBBVnDChD4JcHXWaEsHFgnbMx20u6%2FpnFnbPao6s28NzDujeqOONKcigASsbiUvpxlOj6ihxLzYNL6dY8uwXnI9XNHa26RgH%2Bvy4kAH%2F4QRnhcNXuZJGD0R0gI%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/octet-stream
cache-control
max-age=14400
cf-ray
7b3cdea188490a4d-AMS
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
ChronicleDisplay-Roman--critical.835fdb1566.woff2
citi-onlime.org/fonts/ 		10 KB
10 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://citi-onlime.org/fonts/ChronicleDisplay-Roman--critical.835fdb1566.woff2
Requested by
Host: citi-onlime.org
URL: https://citi-onlime.org/css/nds.442e2fa4527ba866940e.css
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
159c6b1e9f2d3b4d2fc9530c5da40152f37a34551bd0a7fb528f7ff6e3d9d83a

Request headers

Referer
https://citi-onlime.org/css/nds.442e2fa4527ba866940e.css
Origin
https://citi-onlime.org
accept-language
nl-NL,nl;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

date
Thu, 06 Apr 2023 20:44:35 GMT
cf-cache-status
MISS
last-modified
Thu, 06 Apr 2023 14:05:28 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
etag
W/"642ed1a8-2800"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=p0BD6WXnW5wZFxsR7wZV77qIlu488ZZLC%2FFAWvSOLEasjPe2Hz58oUhvuJcSwdASiIE2xr%2FdAoCEdNEAeBP4SZYPPvUBXJTpUUkhtDKzLJ%2BR7iP8JyH5dY%2F8lsldVysifDEFO%2FYfW5e83F22UNw%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/octet-stream
cache-control
max-age=14400
cf-ray
7b3cdea1884a0a4d-AMS
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
Gotham-Book--full.a4076b3a82.woff2
citi-onlime.org/fonts/ 		23 KB
24 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://citi-onlime.org/fonts/Gotham-Book--full.a4076b3a82.woff2
Requested by
Host: citi-onlime.org
URL: https://citi-onlime.org/css/nds.442e2fa4527ba866940e.css
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
f401f2c4bc899ffa4b58f48aaac0be082b23132b07b056b3bb44f59cbcc9381f

Request headers

Referer
https://citi-onlime.org/css/nds.442e2fa4527ba866940e.css
Origin
https://citi-onlime.org
accept-language
nl-NL,nl;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

date
Thu, 06 Apr 2023 20:44:35 GMT
cf-cache-status
MISS
last-modified
Thu, 06 Apr 2023 14:05:28 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
etag
W/"642ed1a8-5cf8"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=83Ie9KyEEI7CvV0VFhOj2gNKiqHwXe5SSKfoU1e7bFlS3%2BXYdzMxofEz0Q%2FEd66g0LOZpvi4BNhfr5qpfp9MepsPsqMqKKPsVagPSR7IGDGr8mNfDEgfWty6ZIjKmCh%2Bvw8wrh7NkSNCGc%2F1wU8%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/octet-stream
cache-control
max-age=14400
cf-ray
7b3cdea1884c0a4d-AMS
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
Gotham-Medium--critical.ee5c613487.woff2
citi-onlime.org/fonts/ 		9 KB
10 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://citi-onlime.org/fonts/Gotham-Medium--critical.ee5c613487.woff2
Requested by
Host: citi-onlime.org
URL: https://citi-onlime.org/css/nds.442e2fa4527ba866940e.css
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
18157870a65e487555dce9077bd3351b73a34fbdb844c4619b6fb5c530d58273

Request headers

Referer
https://citi-onlime.org/css/nds.442e2fa4527ba866940e.css
Origin
https://citi-onlime.org
accept-language
nl-NL,nl;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

date
Thu, 06 Apr 2023 20:44:35 GMT
cf-cache-status
MISS
last-modified
Thu, 06 Apr 2023 14:05:28 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
etag
W/"642ed1a8-24dc"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2BAON00MRYrY218I18qdip%2BU4z9DyJJ1KoBdeimdDBRx%2FJZ04Ts5CbLTDMAqAT6PRGlwTS9OEOt1LtqLdeJz58u7pHNjLuS%2BsVoXKLWGvO7NclkD572nt9%2FrtcO7zt%2BYclxmup5Q%2FYELLMpkTfZc%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/octet-stream
cache-control
max-age=14400
cf-ray
7b3cdea1884f0a4d-AMS
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
ss-social-regular.woff
citi-onlime.org/fonts/ 		16 KB
17 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://citi-onlime.org/fonts/ss-social-regular.woff
Requested by
Host: citi-onlime.org
URL: https://citi-onlime.org/css/nds.442e2fa4527ba866940e.css
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
3d5629a5cbadabfd67e7c99b9e71569f356ebf7fddabd5b3c24e37b49a48c605

Request headers

Referer
https://citi-onlime.org/css/nds.442e2fa4527ba866940e.css
Origin
https://citi-onlime.org
accept-language
nl-NL,nl;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

date
Thu, 06 Apr 2023 20:44:35 GMT
content-encoding
br
cf-cache-status
MISS
last-modified
Thu, 06 Apr 2023 14:05:28 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
etag
W/"642ed1a8-41a4"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=CXIZ0zaz5ZYA6GtQr0denXu5vkc5cHPJ6XT7bdS6oprhjorPun7csV4UvTmuVYutVf0zddCeiUZHjFU5F%2FKu0FFT0aFd5Fid7QIgRPWOCl1ZP%2Fvf7VcmJId%2BfP9Zi8jh1%2FDm6G0w5p%2FISzbJzw0%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/font-woff
cache-control
max-age=14400
cf-ray
7b3cdea1b8850a4d-AMS
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
truncated
/ 		10 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
6e3693188626d6ec8d994ec8aa2cbde1d8307efff1124dcba25db100595db9e8

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

Content-Type
image/svg+xml
truncated
/ 		8 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
0d1fdae07fffe476b9e43746299b2d858559b9f9ab80f4ce1989215b6d0a7f21

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

Content-Type
image/svg+xml
truncated
/ 		9 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
ed632fce6f4a116f4968bb22d7fa176c78d6c6d3c2a8a64197c895d7e3f538b6

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

Content-Type
image/svg+xml
truncated
/ 		1 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
dcd13be5b934f122440a0b2ed6418fbe4acf9fa1d3e8bf1229bb98e0e4051854

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

Content-Type
image/svg+xml
truncated
/ 		2 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
826c22116b682265b20f1044ef7e0558fbd2cd1e48522ead7dd00c13de9d55d6

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

Content-Type
image/svg+xml
truncated
/ 		1 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
2f159357989135419d5f01ed218f7f9593b2f9ca434e00734fc1f9ec6a56c0fe

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

Content-Type
image/svg+xml
truncated
/ 		1 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
edea67791d8b4efdc7f2b85dacb2998ff15527736a1eeb15aad3811bebe4f9ae

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

Content-Type
image/svg+xml
truncated
/ 		454 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
386f59cb329bf874ad81feb3ca5d7dd53484ebe38304a5ae6b30544ce091900c

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

Content-Type
image/svg+xml
truncated
/ 		3 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
5bbc4032bb9938a6b871c91f974974f97e206ddeb4a83f901c02068e5ce2fe58

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

Content-Type
image/svg+xml
analytics.js
www.google-analytics.com/ 		49 KB
20 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.google-analytics.com/analytics.js
Requested by
Host: citi-onlime.org
URL: https://citi-onlime.org/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2001:4860:4802:38::178 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
5971b095cff574a66d35ada016d4c077c86e2dea62e9c0f14cf7c94b258619de
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://citi-onlime.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

strict-transport-security
max-age=10886400; includeSubDomains; preload
content-encoding
gzip
x-content-type-options
nosniff
date
Thu, 06 Apr 2023 20:43:15 GMT
last-modified
Tue, 10 Jan 2023 21:29:14 GMT
server
Golfe2
age
80
vary
Accept-Encoding
content-type
text/javascript
cache-control
public, max-age=7200
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
20085
expires
Thu, 06 Apr 2023 22:43:15 GMT
amplitude-4.1.1-min.gz.js
cdn.amplitude.com/libs/ 		68 KB
23 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.amplitude.com/libs/amplitude-4.1.1-min.gz.js
Requested by
Host: citi-onlime.org
URL: https://citi-onlime.org/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
52.222.206.6 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-52-222-206-6.fra56.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
96405d7546b6c0c499bd3d652b75781d36f3b0062d77afdbf3230bba7842bcfc

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://citi-onlime.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

date
Sun, 19 Feb 2023 17:00:56 GMT
content-encoding
gzip
via
1.1 7abd55cee48606340f570b45718202b6.cloudfront.net (CloudFront)
x-amz-version-id
DHnR8D2Yp1kNVJK0Nr9zflpOyn7y1rWM
x-amz-cf-pop
FRA56-P3
age
3987820
x-cache
Hit from cloudfront
content-length
23391
last-modified
Mon, 21 Oct 2019 15:45:35 GMT
server
AmazonS3
etag
"75a5b1a43b9d11cb8fc66b0b63293343"
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=31536000
accept-ranges
bytes
x-amz-cf-id
66XcwljdgukzxT0Phx74PyAAXZKDe4QetbdnQYksJybenvZGjrVmOw==
gtm.js
www.googletagmanager.com/ 		390 KB
105 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagmanager.com/gtm.js?id=GTM-NVWSKF5
Requested by
Host: citi-onlime.org
URL: https://citi-onlime.org/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:812::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
2acda7411fdd502f60ffca7ee40bb7db733dfbd6d2ee8339565d00243799384f
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://citi-onlime.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

date
Thu, 06 Apr 2023 20:44:35 GMT
content-encoding
br
strict-transport-security
max-age=31536000; includeSubDomains
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
106950
x-xss-protection
0
last-modified
Thu, 06 Apr 2023 18:28:38 GMT
server
Google Tag Manager
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
access-control-allow-headers
Cache-Control
expires
Thu, 06 Apr 2023 20:44:35 GMT
invisible.js
citi-onlime.org/cdn-cgi/challenge-platform/h/b/scripts/alpha/ Frame CC9A 		29 KB
13 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://citi-onlime.org/cdn-cgi/challenge-platform/h/b/scripts/alpha/invisible.js?ts=1680811200
Requested by
Host: citi-onlime.org
URL: https://citi-onlime.org/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
6008321fd1f3d30bc94880994e2d25daed3469bf9f6b5fcf0b24baa54e6139bc

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

date
Thu, 06 Apr 2023 20:44:35 GMT
content-encoding
br
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
accept-encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=h6SiW2WZsSZ2srzOnyzKAoNtYGjcMQ%2F1dIPEtej3Pais41Hx5eHIRlfOp9GC07fhr3rD%2B8yUTsjnxezMWFd%2F4ZAdNjKQCEEwKw4KsN9hdX%2FSPgZen%2BrV98jLsVyL1utqMv9dY0BJd8Um85iRXHU%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript; charset=UTF-8
cache-control
max-age=14400, public
x-control-type-options
nosniff
cf-ray
7b3cdea34ac50a4d-AMS
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
pica.js
citi-onlime.org/cdn-cgi/challenge-platform/h/b/scripts/ Frame CC9A 		7 KB
4 KB 		Other
General
Check archive.org
Download Go to
Full URL
https://citi-onlime.org/cdn-cgi/challenge-platform/h/b/scripts/pica.js
Requested by
Host: citi-onlime.org
URL: https://citi-onlime.org/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e5c68542ce32a5a479f14a81034e0377fce3114a6525a0a7042bda9d24ddc898

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

date
Thu, 06 Apr 2023 20:44:35 GMT
content-encoding
br
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
accept-encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=fLNOl7ScM41o2TQZsuQ%2BGIfPyQTe%2BF3WMAO0TOCfarUiSxZcRz373PLxDCSET4OrXWrlzC%2BK6cSOKfuHHMO2MrabHaqlxNiVAN4ZpgJ5P5I%2BlMKCIel0VN%2B5UP6Ej7Qy5tfrUt24%2FEKkinN02V4%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript; charset=UTF-8
cache-control
max-age=14400, public
x-control-type-options
nosniff
cf-ray
7b3cdea37b060a4d-AMS
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
7b3b9d7f9ad60a6b
citi-onlime.org/cdn-cgi/challenge-platform/h/b/cv/result/ Frame CC9A 		2 B
623 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://citi-onlime.org/cdn-cgi/challenge-platform/h/b/cv/result/7b3b9d7f9ad60a6b
Requested by
Host: citi-onlime.org
URL: https://citi-onlime.org/cdn-cgi/challenge-platform/h/b/scripts/alpha/invisible.js?ts=1680811200
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a06:98c1:3120::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
2689367b205c16ce32ed4200942b8b8b1e262dfc70d9bc9fbc77c49699a4f1df

Request headers

Referer
accept-language
nl-NL,nl;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36
Content-Type
application/json

Response headers

date
Thu, 06 Apr 2023 20:44:35 GMT
content-encoding
br
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Cay2IMRxkqGknY9C90wnoNDTgwBlzw3bvDsaCcxM8AHaQZ%2FRVEl2%2Ba5MLxRWXHJrfFcPYTRQ8vNjTp216NEfTHESzkoo3IJwt2dJTt6uudqYOMjZ8J3VIPUnYB%2FFjhb74cyCHCmkK9Gw03ZTBQs%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/plain; charset=UTF-8
cf-ray
7b3cdea4ac7d0a4d-AMS
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
/
www.googleadservices.com/pagead/conversion/957893550/ 		3 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googleadservices.com/pagead/conversion/957893550/?random=1680813876015&cv=11&fst=1680813876015&bg=ffffff&guid=ON&async=1&gtm=45He3430&u_w=1600&u_h=1200&url=https%3A%2F%2Fciti-onlime.org%2F&label=RVTxCPzMg9MBEK6X4cgD&hn=www.googleadservices.com&frm=0&tiba=Citibank%3A%20Checking%2C%20Savings%20and%20CDs%20-%20NerdWallet&value=0&bttype=purchase&auid=1494340267.1680813876&uamb=0&uaw=0&rfmt=3&fmt=4
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-NVWSKF5
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.217.16.194 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra16s65-in-f2.1e100.net
Software
cafe /
Resource Hash
ddeee024f4ecaddc0549cc11300e8b2bbb23e4f52b0387c3fb14a4bd3d2c6bba
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://citi-onlime.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 06 Apr 2023 20:44:36 GMT
content-encoding
br
x-content-type-options
nosniff
server
cafe
content-type
text/javascript; charset=UTF-8
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
1616
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
tfa.js
cdn.taboola.com/libtrc/unip/1427379/ 		58 KB
18 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.taboola.com/libtrc/unip/1427379/tfa.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-NVWSKF5
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.193.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
ed9a937b75dd44a90a8b43cdeb00d876862b396ac8dee570d0e5e34d31771994

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://citi-onlime.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

x-amz-version-id
FLNNT762d.2UOTEahAxAbJQ.EeTBrLdX
content-encoding
gzip
via
1.1 varnish
date
Thu, 06 Apr 2023 20:44:36 GMT
x-amz-request-id
HFTJ6FYM0J2RY5S7
age
27
x-amz-server-side-encryption
AES256
x-cache
HIT
x-amz-replication-status
COMPLETED
content-length
18197
x-amz-id-2
LPfTvJTpVXM51EFzu3ovzBDxj8T03QVzOpikwNKWdfSb+qWUAT3m2msUn87MzqiCJM8fpZWyJ94=
x-served-by
cache-ams21081-AMS
last-modified
Sun, 02 Apr 2023 11:10:18 GMT
server
AmazonS3
x-timer
S1680813876.077650,VS0,VE1
etag
"c7533ddc638fa0e50ae1fdfd5c80bd54"
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
abp
41
access-control-allow-origin
*
cache-control
private,max-age=14401
accept-ranges
bytes
x-cache-hits
1
obtp.js
amplify.outbrain.com/cp/ 		22 KB
7 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://amplify.outbrain.com/cp/obtp.js
Requested by
Host: citi-onlime.org
URL: https://citi-onlime.org/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.35.237.86 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-35-237-86.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
5a62982f68f482f811e87d3bdeb4785ddf70e787def294f21e0a5748a27179d5

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://citi-onlime.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

Date
Thu, 06 Apr 2023 20:44:36 GMT
Content-Encoding
gzip
Last-Modified
Tue, 04 Apr 2023 09:41:56 GMT
Server
AkamaiNetStorage
ETag
"838e9c2ec6e148b2af141d9d77d0f660:1680601866.61769"
Vary
Accept-Encoding
Content-Type
application/x-javascript
X-RG
EU
Cache-Control
max-age=1200
X-CC
NL
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
6771
Expires
Thu, 06 Apr 2023 21:04:36 GMT
uwt.js
static.ads-twitter.com/ 		56 KB
15 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://static.ads-twitter.com/uwt.js
Requested by
Host: citi-onlime.org
URL: https://citi-onlime.org/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
146.75.116.157 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
cf7fcc9f75c8717897bfaef72f303fab423ce1b70c98512aeb3677e4af988dee

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://citi-onlime.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

date
Thu, 06 Apr 2023 20:44:36 GMT
content-encoding
gzip
last-modified
Thu, 27 Oct 2022 18:55:37 GMT
x-amz-server-side-encryption
AES256
etag
"32ad004436155ec972bc50e6238b5b67+gzip+gzip"
vary
Accept-Encoding,Host
x-cache
HIT, HIT
content-type
application/javascript; charset=utf-8
p3p
CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
x-tw-cdn
FT
cache-control
no-cache
accept-ranges
bytes
content-length
15375
x-served-by
cache-iad-kjyo7100147-IAD, cache-fra-eddf8230125-FRA
events.js
analytics.tiktok.com/i18n/pixel/ 		3 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://analytics.tiktok.com/i18n/pixel/events.js?sdkid=CFE2FNBC77U208RTD9TG&lib=ttq
Requested by
Host: citi-onlime.org
URL: https://citi-onlime.org/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.36.163.138 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a23-36-163-138.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
0e9fae93ffc209084400e7340f5cd3bc23aafe057b74ab42278294216a383bbc

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://citi-onlime.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

x-akamai-request-id
117928d0
date
Thu, 06 Apr 2023 20:44:36 GMT
content-encoding
gzip
x-tt-trace-tag
id=16;cdn-cache=miss;type=dyn
x-cache
TCP_MISS from a23-36-161-138.deploy.akamaitechnologies.com (AkamaiGHost/11.0.3-47547230) (-)
server-timing
inner; dur=4, cdn-cache; desc=MISS, edge; dur=0, origin; dur=93
content-length
1144
pragma
no-cache
server
nginx
x-tt-logid
20230406204436D90BCC75794F039087E2
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
cache-control
max-age=0, no-cache, no-store
x-origin-response-time
93,23.36.161.138
x-tt-trace-host
01585a308430562856cea22c8412031c59c83626b331dccc0a59b4f0eec1a0d95dfc01daecf55a32f0150b066bd0d47067023612c1d76d5caaf61b981b43593ccc06f831565daa8227fe7bc4a193b36b56935bee384e4366cdcffab14d69c96ab6
expires
Thu, 06 Apr 2023 20:44:36 GMT
js
www.googletagmanager.com/gtag/ 		229 KB
79 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagmanager.com/gtag/js?id=G-CNTR275F69&l=dataLayer&cx=c
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-NVWSKF5
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:812::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
e9ccb7921443e4b41f103b2a5f2aff4608e59e96d605c9d366f78f3ebe00fda2
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://citi-onlime.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

date
Thu, 06 Apr 2023 20:44:36 GMT
content-encoding
br
strict-transport-security
max-age=31536000; includeSubDomains
server
Google Tag Manager
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
access-control-allow-headers
Cache-Control
content-length
81053
x-xss-protection
0
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires
Thu, 06 Apr 2023 20:44:36 GMT
collect
region1.google-analytics.com/g/ 		0
253 B 		Ping
General
Check archive.org
Download Go to
Full URL
https://region1.google-analytics.com/g/collect?v=2&tid=G-CNTR275F69&gtm=45je3430&_p=1313170742&cid=1968545696.1680813876&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&_s=1&sid=1680813876&sct=1&seg=0&dl=https%3A%2F%2Fciti-onlime.org%2F&dt=Citibank%3A%20Checking%2C%20Savings%20and%20CDs%20-%20NerdWallet&en=page_view&_fv=1&_ss=1
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-CNTR275F69&l=dataLayer&cx=c
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2001:4860:4802:34::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://citi-onlime.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 06 Apr 2023 20:44:36 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://citi-onlime.org
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
cachedClickId
tr.outbrain.com/ 		35 B
194 B 		Script
General
Check archive.org
Download Go to
Full URL
https://tr.outbrain.com/cachedClickId?marketerId=00db0f99f5dc3c57f5effbd42aeff759ae
Requested by
Host: amplify.outbrain.com
URL: https://amplify.outbrain.com/cp/obtp.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
70.42.32.127 , United States, ASN13789 (INTERNAP-BLK3, US),
Reverse DNS
ny.outbrain.com
Software
/
Resource Hash
1d348f9f803c95305f63def9d75fd50e79e54a375e1a4a888edbbea366845580

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://citi-onlime.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

Date
Thu, 06 Apr 2023 20:44:36 GMT
X-TraceId
cb52cdbb911728acaad0f2fd48f2fd50
Content-Length
35
Content-Type
application/javascript
unifiedPixel
tr.outbrain.com/ 		53 B
225 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://tr.outbrain.com/unifiedPixel?optOut=false&bust=07188507742865953&referrer=&cht=gtm&marketerId=00db0f99f5dc3c57f5effbd42aeff759ae&name=PAGE_VIEW&dl=https%3A%2F%2Fciti-onlime.org%2F&g=1&obApiVersion=1.1&obtpVersion=2.0.5
Requested by
Host: citi-onlime.org
URL: https://citi-onlime.org/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
70.42.32.127 , United States, ASN13789 (INTERNAP-BLK3, US),
Reverse DNS
ny.outbrain.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://citi-onlime.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

Date
Thu, 06 Apr 2023 20:44:36 GMT
Cache-Control
no-cache
X-TraceId
64fe064f011f5971dd4c20333ea6fee5
Content-Length
53
Content-Type
image/gif;
json
trc.taboola.com/1427379/trc/3/ 		3 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://trc.taboola.com/1427379/trc/3/json?tim=1680813876116&data=%7B%22id%22%3A206%2C%22ii%22%3A%22%2Freviews%2Fbanking%2Fcitibank%22%2C%22it%22%3A%22video%22%2C%22sd%22%3Anull%2C%22ui%22%3Anull%2C%22vi%22%3A1680813876112%2C%22cv%22%3A%2220230330-9-RELEASE%22%2C%22uiv%22%3A%22default%22%2C%22u%22%3A%22https%3A%2F%2Fwww.nerdwallet.com%2Freviews%2Fbanking%2Fcitibank%22%2C%22e%22%3Anull%2C%22cb%22%3A%22TFASC.trkCallback%22%2C%22qs%22%3A%22%22%2C%22r%22%3A%5B%7B%22li%22%3A%22rbox-tracking%22%2C%22s%22%3A0%2C%22uim%22%3A%22rbox-tracking%3Apub%3Dnerdwallet-content-sc%3Aabp%3D0%22%2C%22uip%22%3A%22rbox-tracking%22%2C%22orig_uip%22%3A%22rbox-tracking%22%7D%5D%2C%22mpv%22%3Atrue%2C%22supv%22%3Atrue%2C%22mpvd%22%3A%7B%22en%22%3A%22page_view%22%2C%22tim%22%3A1680813876116%2C%22ref%22%3Anull%2C%22item-url%22%3A%22https%3A%2F%2Fciti-onlime.org%2F%22%2C%22tos%22%3A1%2C%22ssd%22%3A1%2C%22scd%22%3A0%2C%22supv%22%3Atrue%7D%7D&pubit=i
Requested by
Host: cdn.taboola.com
URL: https://cdn.taboola.com/libtrc/unip/1427379/tfa.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.193.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
fcf724f0e0e21774c80273aab93788496b94cfb8f8712d427697947b96e7f2fd

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://citi-onlime.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

x-vcl-time-ms
11
date
Thu, 06 Apr 2023 20:44:36 GMT
content-encoding
gzip
via
1.1 varnish
x-served-by
cache-ams21081-AMS
server
nginx
x-timer
S1680813876.134354,VS0,VE11
vary
Accept-Encoding
x-cache
MISS
p3p
policyref="http://trc.taboola.com/p3p.xml", CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM"
access-control-allow-origin
*
content-type
application/javascript; charset=utf-8
access-control-allow-credentials
true
accept-ranges
bytes
x-cache-hits
0
adsct
t.co/1/i/ 		43 B
375 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://t.co/1/i/adsct?bci=4&eci=3&event=%7B%7D&event_id=9c7697a6-f993-4092-84e1-135e461415d4&integration=advertiser&p_id=Twitter&p_user_id=0&pl_id=6aebff47-7aa1-442e-8932-9b820e1d42a4&tw_document_href=https%3A%2F%2Fciti-onlime.org%2F&tw_iframe_status=0&txn_id=obhjd&type=javascript&version=2.3.29
Requested by
Host: citi-onlime.org
URL: https://citi-onlime.org/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.244.42.5 , United States, ASN13414 (TWITTER, US),
Reverse DNS
Software
tsa_o /
Resource Hash
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
Security Headers
Name Value
Strict-Transport-Security max-age=0

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://citi-onlime.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

x-response-time
112
date
Thu, 06 Apr 2023 20:44:35 GMT
strict-transport-security
max-age=0
server
tsa_o
content-type
image/gif;charset=utf-8
x-transaction-id
d52b48dc002415ac
cache-control
no-cache, no-store, max-age=0
perf
7626143928
x-connection-hash
17d722723bc26b2a76efd9d6fee0194346d272721e9b87a16b70ea8f57a2b50b
content-length
43
adsct
analytics.twitter.com/1/i/ 		43 B
726 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://analytics.twitter.com/1/i/adsct?bci=4&eci=3&event=%7B%7D&event_id=9c7697a6-f993-4092-84e1-135e461415d4&integration=advertiser&p_id=Twitter&p_user_id=0&pl_id=6aebff47-7aa1-442e-8932-9b820e1d42a4&tw_document_href=https%3A%2F%2Fciti-onlime.org%2F&tw_iframe_status=0&txn_id=obhjd&type=javascript&version=2.3.29
Requested by
Host: citi-onlime.org
URL: https://citi-onlime.org/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.244.42.195 , United States, ASN13414 (TWITTER, US),
Reverse DNS
Software
tsa_o /
Resource Hash
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
Security Headers
Name Value
Strict-Transport-Security max-age=631138519

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://citi-onlime.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

x-response-time
111
date
Thu, 06 Apr 2023 20:44:35 GMT
strict-transport-security
max-age=631138519
server
tsa_o
content-type
image/gif;charset=utf-8
x-transaction-id
f72f8caeab3402ac
cache-control
no-cache, no-store, max-age=0
perf
7626143928
x-connection-hash
a87378cfaf6be38d77b0cd0a0b5e6d3f340e54b8fd810b83b83174871753ba35
content-length
43
settings
cdn.segment.com/v1/projects/DdHLV8IoKV9qg7SdnKHOoprOG39cGlhf/ 		973 B
1 KB 		Fetch
General
Check archive.org
Download Go to
Full URL
https://cdn.segment.com/v1/projects/DdHLV8IoKV9qg7SdnKHOoprOG39cGlhf/settings
Requested by
Host: cdn.segment.com
URL: https://cdn.segment.com/analytics.js/v1/DdHLV8IoKV9qg7SdnKHOoprOG39cGlhf/analytics.min.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
99.86.8.175 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-99-86-8-175.fra6.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
d72767816f9e0e1eb84b5e68565750621259ef66650230d31b7f724b333e66c8

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://citi-onlime.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

x-amz-version-id
zm45WPO.3bQsY1s0ZfirjEeKcfrhYeFC
date
Thu, 06 Apr 2023 17:49:19 GMT
via
1.1 7ed7afde326861e358c3c83359e99894.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA6-C1
age
10518
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
x-amz-replication-status
COMPLETED
content-length
973
last-modified
Wed, 05 Apr 2023 21:43:33 GMT
server
AmazonS3
etag
"aa4297c41c5b722560e37a6ab4a9b402"
access-control-max-age
3000
access-control-allow-methods
GET, HEAD
content-type
application/json; charset=utf-8
access-control-allow-origin
*
cache-control
public, max-age=10800
vary
Accept-Encoding
accept-ranges
bytes
x-amz-cf-id
HReXmU0NL243RpeX1DkxCKoi1SPAVY958aMxHZlQ-6nlPyKZls8joA==
/
www.google.nl/pagead/1p-conversion/957893550/
Redirect Chain
  • https://googleads.g.doubleclick.net/pagead/viewthroughconversion/957893550/?random=1458607396&cv=11&fst=1680813876015&bg=ffffff&guid=ON&async=1&gtm=45He3430&u_w=1600&u_h=1200&url=https%3A%2F%2Fciti...
  • https://www.google.com/pagead/1p-conversion/957893550/?random=1458607396&cv=11&fst=1680813876015&bg=ffffff&guid=ON&async=1&gtm=45He3430&u_w=1600&u_h=1200&url=https%3A%2F%2Fciti-onlime.org%2F&label=...
  • https://www.google.nl/pagead/1p-conversion/957893550/?random=1458607396&cv=11&fst=1680813876015&bg=ffffff&guid=ON&async=1&gtm=45He3430&u_w=1600&u_h=1200&url=https%3A%2F%2Fciti-onlime.org%2F&label=R...
42 B
455 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.nl/pagead/1p-conversion/957893550/?random=1458607396&cv=11&fst=1680813876015&bg=ffffff&guid=ON&async=1&gtm=45He3430&u_w=1600&u_h=1200&url=https%3A%2F%2Fciti-onlime.org%2F&label=RVTxCPzMg9MBEK6X4cgD&hn=www.googleadservices.com&frm=0&tiba=Citibank%3A%20Checking%2C%20Savings%20and%20CDs%20-%20NerdWallet&value=0&auid=1494340267.1680813876&uamb=0&uaw=0&fmt=3&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&sscte=1&crd=&pscrd=Ek9DaEVJOE51NW9RWVF6WUtDcjlTcjZPZk9BUkltQUR3cmN5R1Q0WktramxGMWRackxQUU9XcmFhS2RwOWRFSnhIVU9OX3hnVmNNSXJwaC13GlpDaEVJOE51NW9RWVFwbzNVLXRxQzI3Q3ZBUkl1QUpjblBCVHZ4NVdNRVdqcWk4VVlRNXpGMXU0cXNPQzZSaEVTbUl2Uk9uTVFRT3ZGTDkybWVEWGJfNzhiU0E&is_vtc=1&ocp_id=NC8vZMWxB9GhlQeAo4OYCg&eitems=ChAI8Nu5oQYQjdS33qGPl68vEh0Ag7fzJO17Myc7Kp4B_GMCS3S3ymVaKwh_1tkM8w&random=1727919454&ipr=y&prhg=0
Requested by
Host: citi-onlime.org
URL: https://citi-onlime.org/
Protocol
H2
Server
2a00:1450:4001:809::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://citi-onlime.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 06 Apr 2023 20:44:36 GMT
content-security-policy
script-src 'none'; object-src 'none'
x-content-type-options
nosniff
server
cafe
content-type
image/gif
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma
no-cache
date
Thu, 06 Apr 2023 20:44:36 GMT
content-security-policy
script-src 'none'; object-src 'none'
x-content-type-options
nosniff
server
cafe
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
location
https://www.google.nl/pagead/1p-conversion/957893550/?random=1458607396&cv=11&fst=1680813876015&bg=ffffff&guid=ON&async=1&gtm=45He3430&u_w=1600&u_h=1200&url=https%3A%2F%2Fciti-onlime.org%2F&label=RVTxCPzMg9MBEK6X4cgD&hn=www.googleadservices.com&frm=0&tiba=Citibank%3A%20Checking%2C%20Savings%20and%20CDs%20-%20NerdWallet&value=0&auid=1494340267.1680813876&uamb=0&uaw=0&fmt=3&ctc_id=CAIVAgAAAB0CAAAA&ct_cookie_present=false&sscte=1&crd=&pscrd=Ek9DaEVJOE51NW9RWVF6WUtDcjlTcjZPZk9BUkltQUR3cmN5R1Q0WktramxGMWRackxQUU9XcmFhS2RwOWRFSnhIVU9OX3hnVmNNSXJwaC13GlpDaEVJOE51NW9RWVFwbzNVLXRxQzI3Q3ZBUkl1QUpjblBCVHZ4NVdNRVdqcWk4VVlRNXpGMXU0cXNPQzZSaEVTbUl2Uk9uTVFRT3ZGTDkybWVEWGJfNzhiU0E&is_vtc=1&ocp_id=NC8vZMWxB9GhlQeAo4OYCg&eitems=ChAI8Nu5oQYQjdS33qGPl68vEh0Ag7fzJO17Myc7Kp4B_GMCS3S3ymVaKwh_1tkM8w&random=1727919454&ipr=y&prhg=0
content-type
image/gif
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
ajs-destination.bundle.2cd9e450202b69d545a3.js
cdn.segment.com/analytics-next/bundles/ 		9 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.segment.com/analytics-next/bundles/ajs-destination.bundle.2cd9e450202b69d545a3.js
Requested by
Host: cdn.segment.com
URL: https://cdn.segment.com/analytics.js/v1/DdHLV8IoKV9qg7SdnKHOoprOG39cGlhf/analytics.min.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
99.86.8.175 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-99-86-8-175.fra6.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
27cf59f2f5b8446bbf81f4ed9bbea4fcbbece316e3655ade51da075cdc9962d4

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://citi-onlime.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

date
Tue, 07 Mar 2023 01:16:11 GMT
x-amz-version-id
jZ2L92raJDMf08tukXqdJ6aGBdPFzdTy
content-encoding
br
via
1.1 7ed7afde326861e358c3c83359e99894.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA6-C1
age
2662106
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
x-amz-replication-status
COMPLETED
last-modified
Thu, 26 Jan 2023 20:14:52 GMT
server
AmazonS3
etag
W/"cc39e85781964199cd0d9501c897e385"
access-control-max-age
3000
access-control-allow-methods
GET, HEAD
content-type
application/javascript
access-control-allow-origin
*
cache-control
public,max-age=31536000,immutable
vary
Accept-Encoding
x-amz-cf-id
eq0BPKFG0fjI6t_icJ0TusQcXWMbNhVpiruMYmsRA__DWqYuqvBTYg==
schemaFilter.bundle.d0fc84c62e956d168cce.js
cdn.segment.com/analytics-next/bundles/ 		2 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.segment.com/analytics-next/bundles/schemaFilter.bundle.d0fc84c62e956d168cce.js
Requested by
Host: cdn.segment.com
URL: https://cdn.segment.com/analytics.js/v1/DdHLV8IoKV9qg7SdnKHOoprOG39cGlhf/analytics.min.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
99.86.8.175 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-99-86-8-175.fra6.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
6ac404a65bffee85a15718f669a44f5a034c94116661e6e0e48b1609f4a8617a

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://citi-onlime.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

date
Mon, 16 Jan 2023 02:25:35 GMT
x-amz-version-id
VLQuST3Rg1zoSyN.SWag4b2R93Pv7oyc
content-encoding
br
via
1.1 7ed7afde326861e358c3c83359e99894.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA6-C1
age
6977942
x-cache
Hit from cloudfront
x-amz-replication-status
COMPLETED
last-modified
Mon, 16 Jan 2023 00:06:36 GMT
server
AmazonS3
etag
W/"d6985af1d6ad9e8c2f97f24f7b27306e"
access-control-max-age
3000
access-control-allow-methods
GET, HEAD
content-type
application/javascript
access-control-allow-origin
*
cache-control
public,max-age=31536000,immutable
vary
Accept-Encoding
x-amz-cf-id
BI3WHzk1FBjX-kSbhzkSkyIyAr4s8X7RwMNUf9Co_le7h10T1sfHoQ==
9c0a30c1e681099b075d.js
cdn.segment.com/next-integrations/actions/amplitude-plugins/ 		4 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.segment.com/next-integrations/actions/amplitude-plugins/9c0a30c1e681099b075d.js
Requested by
Host: cdn.segment.com
URL: https://cdn.segment.com/analytics.js/v1/DdHLV8IoKV9qg7SdnKHOoprOG39cGlhf/analytics.min.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
99.86.8.175 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-99-86-8-175.fra6.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
065fc21fd5679888c39c8463bcc149a4d561f8249b51c506cad65c7d421ae799

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://citi-onlime.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

x-amz-version-id
24mZshQ547goEKa_CXq8mzxLivJ.cUiA
content-encoding
gzip
via
1.1 7ed7afde326861e358c3c83359e99894.cloudfront.net (CloudFront)
date
Wed, 05 Apr 2023 22:35:57 GMT
x-amz-cf-pop
FRA6-C1
age
79720
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
last-modified
Mon, 27 Mar 2023 21:50:43 GMT
server
AmazonS3
etag
W/"f33755a3cade917eb62fa5674ab8ffdf"
access-control-max-age
3000
access-control-allow-methods
GET, HEAD
content-type
application/javascript
access-control-allow-origin
*
vary
Accept-Encoding
x-amz-cf-id
pNdPG4eF9zEaQ2FN3sED_Y0FBsAKHkbae7fhv42XpBe8sjSSkDhrfw==
main.MTZiZDQ3NTA5MA.js
analytics.tiktok.com/i18n/pixel/static/ 		241 KB
66 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://analytics.tiktok.com/i18n/pixel/static/main.MTZiZDQ3NTA5MA.js
Requested by
Host: analytics.tiktok.com
URL: https://analytics.tiktok.com/i18n/pixel/events.js?sdkid=CFE2FNBC77U208RTD9TG&lib=ttq
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.36.163.138 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a23-36-163-138.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
2f979dde1b99a98cbbd7d4040e176b20fe3b84ea0445bbfff507218c6a0f91a6

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://citi-onlime.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

x-akamai-request-id
11792b3f
date
Thu, 06 Apr 2023 20:44:36 GMT
content-encoding
gzip
x-tt-trace-tag
id=16;cdn-cache=hit;type=static
server
nginx
x-tt-logid
20230406144417BE5D48AFEE579D0FF33F
vary
Accept-Encoding
x-cache
TCP_MEM_HIT from a23-36-161-138.deploy.akamaitechnologies.com (AkamaiGHost/11.0.3-47547230) (-)
content-type
application/javascript; charset=UTF-8
cache-control
public, max-age=31536000, immutable
x-tt-trace-host
01c42089b19e2e75401fb1cdd03d9cfdac453a5effef3a28ef1b4d3fe0ca984d5c49891cebc190fba292664db237d12ae27e11a10366774d8862f7000d07ebef42ce3973802624714e7c1a3b494faaabd94035b9cebf3910b058b59566dc84b29f
server-timing
cdn-cache; desc=HIT, edge; dur=0, inner; dur=3
content-length
67196
688.js
cdn.segment.com/next-integrations/actions/ 		23 KB
8 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.segment.com/next-integrations/actions/688.js
Requested by
Host: cdn.segment.com
URL: https://cdn.segment.com/next-integrations/actions/amplitude-plugins/9c0a30c1e681099b075d.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
99.86.8.175 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-99-86-8-175.fra6.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
1550083a7d2918456da85c63e00c47a6e728af4ec83e68d06b0596e3967db74a

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://citi-onlime.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

x-amz-version-id
QeDpLiGFKDZN5LWR2jGS.zEI.Vdc5PLj
content-encoding
gzip
via
1.1 7ed7afde326861e358c3c83359e99894.cloudfront.net (CloudFront)
date
Wed, 05 Apr 2023 22:35:17 GMT
x-amz-cf-pop
FRA6-C1
age
79760
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
last-modified
Mon, 27 Mar 2023 21:50:42 GMT
server
AmazonS3
etag
W/"91eece0e692a978c21382312ddd7c574"
access-control-max-age
3000
access-control-allow-methods
GET, HEAD
content-type
application/javascript
access-control-allow-origin
*
vary
Accept-Encoding
x-amz-cf-id
O_4GlH6imfsSD1vKjiPVmBGC1egESgDNUqUcfUCVZXGUSHhUsaiFYw==
identify_821f6.js
analytics.tiktok.com/i18n/pixel/static/ 		114 KB
30 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://analytics.tiktok.com/i18n/pixel/static/identify_821f6.js
Requested by
Host: analytics.tiktok.com
URL: https://analytics.tiktok.com/i18n/pixel/static/main.MTZiZDQ3NTA5MA.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.36.163.138 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a23-36-163-138.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
cef0a3ffb6993fc1ec7b5b67a16377ec1ec0a858b3cabb834033d7458ff0e4bc

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://citi-onlime.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

x-akamai-request-id
11792cc7
date
Thu, 06 Apr 2023 20:44:36 GMT
content-encoding
gzip
x-tt-trace-tag
id=16;cdn-cache=hit;type=static
server
nginx
x-tt-logid
20230406144417BE5D48AFEE579D0FF364
vary
Accept-Encoding
x-cache
TCP_MEM_HIT from a23-36-161-138.deploy.akamaitechnologies.com (AkamaiGHost/11.0.3-47547230) (-)
content-type
application/javascript; charset=UTF-8
cache-control
public, max-age=31536000, immutable
x-tt-trace-host
01c42089b19e2e75401fb1cdd03d9cfdac453a5effef3a28ef1b4d3fe0ca984d5c49891cebc190fba292664db237d12ae2f314d234e3503d678e1002e45cf0b35ad5351c7ba488b2f92b90f6f69d7797fe4dec0893d06f4b9174849e1eb04250dd
server-timing
cdn-cache; desc=HIT, edge; dur=0, inner; dur=3
content-length
30547
pixel
analytics.tiktok.com/api/v2/ 		0
697 B 		Ping
General
Check archive.org
Download Go to
Full URL
https://analytics.tiktok.com/api/v2/pixel
Requested by
Host: analytics.tiktok.com
URL: https://analytics.tiktok.com/i18n/pixel/static/main.MTZiZDQ3NTA5MA.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.36.163.138 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a23-36-163-138.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://citi-onlime.org/
accept-language
nl-NL,nl;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

x-akamai-request-id
f4889d48.11792dac
date
Thu, 06 Apr 2023 20:44:36 GMT
x-tt-trace-tag
id=16;cdn-cache=miss;type=dyn
x-cache
TCP_MISS from a23-36-161-138.deploy.akamaitechnologies.com (AkamaiGHost/11.0.3-47547230) (-)
x-parent-response-time
113,23.36.161.138
server-timing
cdn-cache; desc=MISS, edge; dur=93, origin; dur=26, inner; dur=23
content-length
0
pragma
no-cache
server
nginx
x-tt-logid
202304062044362EEECE7BEEBAD79489C4
x-cache-remote
TCP_MISS from a23-220-104-19.deploy.akamaitechnologies.com (AkamaiGHost/11.0.2.2-47519392) (-)
access-control-allow-origin
*
cache-control
max-age=0, no-cache, no-store
x-origin-response-time
26,23.220.104.19
x-tt-trace-host
01585a308430562856cea22c8412031c5948d854451f495c2c03e1d3fea984c631aa99576b65d43d612e459c99f58806b47fc9c635a22c2d6b07d9e5ccd6dff771b3b0b2b5b7e4c9e4a579f6ace19fcf97a0aa929783fe60eb3f54722b1929c3b672e12e1fa797cbc7ec24d5241d8e9726
expires
Thu, 06 Apr 2023 20:44:36 GMT
js
www.googletagmanager.com/gtag/ 		131 KB
51 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagmanager.com/gtag/js?id=AW-829289198
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-NVWSKF5
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:812::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
6c351725474c23cfc2b6b9041003b8381572c7c483e073bbcacf62312776d899
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://citi-onlime.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

date
Thu, 06 Apr 2023 20:44:36 GMT
content-encoding
br
strict-transport-security
max-age=31536000; includeSubDomains
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
51709
x-xss-protection
0
last-modified
Thu, 06 Apr 2023 18:28:38 GMT
server
Google Tag Manager
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
access-control-allow-headers
Cache-Control
expires
Thu, 06 Apr 2023 20:44:36 GMT
mgsensor.js
a.mgid.com/ 		15 KB
5 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://a.mgid.com/mgsensor.js?d=1680813876501&source=gtm
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-NVWSKF5
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:1::6813:854e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
dcc6b633543bcc378409b05b180dd30d3d8104624c0948612f7ea501b103fe25

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://citi-onlime.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

date
Thu, 06 Apr 2023 20:44:36 GMT
content-encoding
br
cf-cache-status
DYNAMIC
x-mg-request-uuid
2a0ab3e3-d456-4987-8573-d85dfc71a6f7
server
cloudflare
vary
Accept-Encoding
content-type
application/javascript
cf-ray
7b3cdea89d600b52-AMS
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
bat.js
bat.bing.com/ 		40 KB
12 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://bat.bing.com/bat.js
Requested by
Host: citi-onlime.org
URL: https://citi-onlime.org/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
a2137ebfe2b9ff55e1f280dbb1eef301290c50db609c5d6a0494ae8f3c98c253
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://citi-onlime.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
content-encoding
gzip
date
Thu, 06 Apr 2023 20:44:36 GMT
last-modified
Thu, 16 Feb 2023 18:31:53 GMT
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref
Ref A: E1AF5601FB3049EAB1B506D8A48540FB Ref B: AMS04EDGE3619 Ref C: 2023-04-06T20:44:36Z
etag
"8072cff03442d91:0"
vary
Accept-Encoding
x-cache
CONFIG_NOCACHE
content-type
application/javascript
cache-control
private,max-age=1800
accept-ranges
bytes
content-length
11894
ytc.js
s.yimg.com/wi/ 		16 KB
6 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://s.yimg.com/wi/ytc.js
Requested by
Host: citi-onlime.org
URL: https://citi-onlime.org/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1288:80:807::1 , United Kingdom, ASN203220 (YAHOO-DEB, GB),
Reverse DNS
Software
ATS /
Resource Hash
249c4eba880cfb74e1b6e1d1048def310636dc3b1ce5b3fe525703fd4025238f
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://citi-onlime.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

date
Thu, 06 Apr 2023 20:44:27 GMT
x-amz-version-id
.QD3nDfK79S8_ikLSJXTL23Tdis9tg0C
content-encoding
gzip
strict-transport-security
max-age=31536000
x-content-type-options
nosniff
x-amz-request-id
5V78ZS6ENE098NZW
age
10
x-amz-server-side-encryption
AES256
x-amz-id-2
F9/t0p/EHJuKS7DDTi1DnkadynqccWbTjD5i5pTAyUL2xPIZeJkrv0pimG2scu/jyXvhLAo7zdg=
x-xss-protection
1; mode=block
referrer-policy
no-referrer-when-downgrade
x-amz-expiration
expiry-date="Thu, 20 Jul 2023 00:00:00 GMT", rule-id="oath-standard-lifecycle"
last-modified
Tue, 14 Jun 2022 12:21:31 GMT
server
ATS
etag
"6a624022b5d271dcefb070b0b6670abc-df"
expect-ct
max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
vary
Origin, Accept-Encoding
content-type
application/javascript
cache-control
public,max-age=3600
accept-ranges
bytes
json
trc.taboola.com/1040862/trc/3/ 		3 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://trc.taboola.com/1040862/trc/3/json?tim=1680813876504&data=%7B%22id%22%3A923%2C%22ii%22%3A%22%2Freviews%2Fbanking%2Fcitibank%22%2C%22it%22%3A%22video%22%2C%22sd%22%3Anull%2C%22ui%22%3Anull%2C%22vi%22%3A1680813876112%2C%22cv%22%3A%2220230330-9-RELEASE%22%2C%22uiv%22%3A%22default%22%2C%22u%22%3A%22https%3A%2F%2Fwww.nerdwallet.com%2Freviews%2Fbanking%2Fcitibank%22%2C%22e%22%3Anull%2C%22cb%22%3A%22TFASC.trkCallback1%22%2C%22qs%22%3A%22%22%2C%22r%22%3A%5B%7B%22li%22%3A%22rbox-tracking%22%2C%22s%22%3A0%2C%22uim%22%3A%22rbox-tracking%3Apub%3Dnerdwallet-content-sc%3Aabp%3D0%22%2C%22uip%22%3A%22rbox-tracking%22%2C%22orig_uip%22%3A%22rbox-tracking%22%7D%5D%2C%22mpv%22%3Atrue%2C%22supv%22%3Atrue%2C%22mpvd%22%3A%7B%22en%22%3A%22page_view%22%2C%22tim%22%3A1680813876504%2C%22ref%22%3Anull%2C%22item-url%22%3A%22https%3A%2F%2Fciti-onlime.org%2F%22%2C%22tos%22%3A389%2C%22ssd%22%3A1%2C%22scd%22%3A0%2C%22supv%22%3Atrue%7D%7D&pubit=i
Requested by
Host: cdn.taboola.com
URL: https://cdn.taboola.com/libtrc/unip/1427379/tfa.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.193.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
f550b8aec0360c21d3b8b9adc386a7f881f3726ac6c8c375241b1c3157e44860

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://citi-onlime.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

x-vcl-time-ms
25
date
Thu, 06 Apr 2023 20:44:36 GMT
content-encoding
gzip
via
1.1 varnish
x-served-by
cache-ams21081-AMS
server
nginx
x-timer
S1680813877.513048,VS0,VE25
vary
Accept-Encoding
x-cache
MISS
p3p
policyref="http://trc.taboola.com/p3p.xml", CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM"
access-control-allow-origin
*
content-type
application/javascript; charset=utf-8
access-control-allow-credentials
true
accept-ranges
bytes
x-cache-hits
0
json
trc.taboola.com/1066025/trc/3/ 		2 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://trc.taboola.com/1066025/trc/3/json?tim=1680813876505&data=%7B%22id%22%3A508%2C%22ii%22%3A%22%2Freviews%2Fbanking%2Fcitibank%22%2C%22it%22%3A%22video%22%2C%22sd%22%3Anull%2C%22ui%22%3Anull%2C%22vi%22%3A1680813876112%2C%22cv%22%3A%2220230330-9-RELEASE%22%2C%22uiv%22%3A%22default%22%2C%22u%22%3A%22https%3A%2F%2Fwww.nerdwallet.com%2Freviews%2Fbanking%2Fcitibank%22%2C%22e%22%3Anull%2C%22cb%22%3A%22TFASC.trkCallback2%22%2C%22qs%22%3A%22%22%2C%22r%22%3A%5B%7B%22li%22%3A%22rbox-tracking%22%2C%22s%22%3A0%2C%22uim%22%3A%22rbox-tracking%3Apub%3Dnerdwallet-content-sc%3Aabp%3D0%22%2C%22uip%22%3A%22rbox-tracking%22%2C%22orig_uip%22%3A%22rbox-tracking%22%7D%5D%2C%22mpv%22%3Atrue%2C%22supv%22%3Atrue%2C%22mpvd%22%3A%7B%22en%22%3A%22page_view%22%2C%22tim%22%3A1680813876505%2C%22ref%22%3Anull%2C%22item-url%22%3A%22https%3A%2F%2Fciti-onlime.org%2F%22%2C%22tos%22%3A390%2C%22ssd%22%3A1%2C%22scd%22%3A0%2C%22supv%22%3Atrue%7D%7D&pubit=i
Requested by
Host: cdn.taboola.com
URL: https://cdn.taboola.com/libtrc/unip/1427379/tfa.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.193.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
2c1d1207bc7754f4424017e428412c78c58b40b8c8824249eac8df083fda4325

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://citi-onlime.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

x-vcl-time-ms
13
date
Thu, 06 Apr 2023 20:44:36 GMT
content-encoding
gzip
via
1.1 varnish
x-served-by
cache-ams21081-AMS
server
nginx
x-timer
S1680813877.514564,VS0,VE13
vary
Accept-Encoding
x-cache
MISS
p3p
policyref="http://trc.taboola.com/p3p.xml", CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM"
access-control-allow-origin
*
content-type
application/javascript; charset=utf-8
access-control-allow-credentials
true
accept-ranges
bytes
x-cache-hits
0
json
trc.taboola.com/1013989/trc/3/ 		2 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://trc.taboola.com/1013989/trc/3/json?tim=1680813876506&data=%7B%22id%22%3A543%2C%22ii%22%3A%22%2Freviews%2Fbanking%2Fcitibank%22%2C%22it%22%3A%22video%22%2C%22sd%22%3Anull%2C%22ui%22%3Anull%2C%22vi%22%3A1680813876112%2C%22cv%22%3A%2220230330-9-RELEASE%22%2C%22uiv%22%3A%22default%22%2C%22u%22%3A%22https%3A%2F%2Fwww.nerdwallet.com%2Freviews%2Fbanking%2Fcitibank%22%2C%22e%22%3Anull%2C%22cb%22%3A%22TFASC.trkCallback3%22%2C%22qs%22%3A%22%22%2C%22r%22%3A%5B%7B%22li%22%3A%22rbox-tracking%22%2C%22s%22%3A0%2C%22uim%22%3A%22rbox-tracking%3Apub%3Dnerdwallet-content-sc%3Aabp%3D0%22%2C%22uip%22%3A%22rbox-tracking%22%2C%22orig_uip%22%3A%22rbox-tracking%22%7D%5D%2C%22mpv%22%3Atrue%2C%22supv%22%3Atrue%2C%22mpvd%22%3A%7B%22en%22%3A%22page_view%22%2C%22tim%22%3A1680813876506%2C%22ref%22%3Anull%2C%22item-url%22%3A%22https%3A%2F%2Fciti-onlime.org%2F%22%2C%22tos%22%3A391%2C%22ssd%22%3A1%2C%22scd%22%3A0%2C%22supv%22%3Atrue%7D%7D&pubit=i
Requested by
Host: cdn.taboola.com
URL: https://cdn.taboola.com/libtrc/unip/1427379/tfa.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.193.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
6d59f3b65fce6fa1718ff4319b28f31936c892af629e30429f46a319bb4cdb37

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://citi-onlime.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

x-vcl-time-ms
11
date
Thu, 06 Apr 2023 20:44:36 GMT
content-encoding
gzip
via
1.1 varnish
x-served-by
cache-ams21081-AMS
server
nginx
x-timer
S1680813877.515507,VS0,VE11
vary
Accept-Encoding
x-cache
MISS
p3p
policyref="http://trc.taboola.com/p3p.xml", CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM"
access-control-allow-origin
*
content-type
application/javascript; charset=utf-8
access-control-allow-credentials
true
accept-ranges
bytes
x-cache-hits
0
json
trc.taboola.com/1077523/trc/3/ 		2 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://trc.taboola.com/1077523/trc/3/json?tim=1680813876507&data=%7B%22id%22%3A538%2C%22ii%22%3A%22%2Freviews%2Fbanking%2Fcitibank%22%2C%22it%22%3A%22video%22%2C%22sd%22%3Anull%2C%22ui%22%3Anull%2C%22vi%22%3A1680813876112%2C%22cv%22%3A%2220230330-9-RELEASE%22%2C%22uiv%22%3A%22default%22%2C%22u%22%3A%22https%3A%2F%2Fwww.nerdwallet.com%2Freviews%2Fbanking%2Fcitibank%22%2C%22e%22%3Anull%2C%22cb%22%3A%22TFASC.trkCallback4%22%2C%22qs%22%3A%22%22%2C%22r%22%3A%5B%7B%22li%22%3A%22rbox-tracking%22%2C%22s%22%3A0%2C%22uim%22%3A%22rbox-tracking%3Apub%3Dnerdwallet-content-sc%3Aabp%3D0%22%2C%22uip%22%3A%22rbox-tracking%22%2C%22orig_uip%22%3A%22rbox-tracking%22%7D%5D%2C%22mpv%22%3Atrue%2C%22supv%22%3Atrue%2C%22mpvd%22%3A%7B%22en%22%3A%22page_view%22%2C%22tim%22%3A1680813876507%2C%22ref%22%3Anull%2C%22item-url%22%3A%22https%3A%2F%2Fciti-onlime.org%2F%22%2C%22tos%22%3A392%2C%22ssd%22%3A1%2C%22scd%22%3A0%2C%22supv%22%3Atrue%7D%7D&pubit=i
Requested by
Host: cdn.taboola.com
URL: https://cdn.taboola.com/libtrc/unip/1427379/tfa.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.193.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
62258b8ada9f3a9f0e3366ad39a7fe957a376b186ae8e6384928fb38c04db4f1

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://citi-onlime.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

x-vcl-time-ms
12
date
Thu, 06 Apr 2023 20:44:36 GMT
content-encoding
gzip
via
1.1 varnish
x-served-by
cache-ams21081-AMS
server
nginx
x-timer
S1680813877.516672,VS0,VE12
vary
Accept-Encoding
x-cache
MISS
p3p
policyref="http://trc.taboola.com/p3p.xml", CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM"
access-control-allow-origin
*
content-type
application/javascript; charset=utf-8
access-control-allow-credentials
true
accept-ranges
bytes
x-cache-hits
0
json
trc.taboola.com/1236271/trc/3/ 		3 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://trc.taboola.com/1236271/trc/3/json?tim=1680813876508&data=%7B%22id%22%3A398%2C%22ii%22%3A%22%2Freviews%2Fbanking%2Fcitibank%22%2C%22it%22%3A%22video%22%2C%22sd%22%3Anull%2C%22ui%22%3Anull%2C%22vi%22%3A1680813876112%2C%22cv%22%3A%2220230330-9-RELEASE%22%2C%22uiv%22%3A%22default%22%2C%22u%22%3A%22https%3A%2F%2Fwww.nerdwallet.com%2Freviews%2Fbanking%2Fcitibank%22%2C%22e%22%3Anull%2C%22cb%22%3A%22TFASC.trkCallback5%22%2C%22qs%22%3A%22%22%2C%22r%22%3A%5B%7B%22li%22%3A%22rbox-tracking%22%2C%22s%22%3A0%2C%22uim%22%3A%22rbox-tracking%3Apub%3Dnerdwallet-content-sc%3Aabp%3D0%22%2C%22uip%22%3A%22rbox-tracking%22%2C%22orig_uip%22%3A%22rbox-tracking%22%7D%5D%2C%22mpv%22%3Atrue%2C%22supv%22%3Atrue%2C%22mpvd%22%3A%7B%22en%22%3A%22page_view%22%2C%22tim%22%3A1680813876508%2C%22ref%22%3Anull%2C%22item-url%22%3A%22https%3A%2F%2Fciti-onlime.org%2F%22%2C%22tos%22%3A393%2C%22ssd%22%3A1%2C%22scd%22%3A0%2C%22supv%22%3Atrue%7D%7D&pubit=i
Requested by
Host: cdn.taboola.com
URL: https://cdn.taboola.com/libtrc/unip/1427379/tfa.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.193.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
9b56fe1f28c70ee8a8b879377498e9660695e957dbc9f28b49cb0495586556e3

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://citi-onlime.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

x-vcl-time-ms
13
date
Thu, 06 Apr 2023 20:44:36 GMT
content-encoding
gzip
via
1.1 varnish
x-served-by
cache-ams21081-AMS
server
nginx
x-timer
S1680813877.517782,VS0,VE13
vary
Accept-Encoding
x-cache
MISS
p3p
policyref="http://trc.taboola.com/p3p.xml", CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM"
access-control-allow-origin
*
content-type
application/javascript; charset=utf-8
access-control-allow-credentials
true
accept-ranges
bytes
x-cache-hits
0
json
trc.taboola.com/1248680/trc/3/ 		3 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://trc.taboola.com/1248680/trc/3/json?tim=1680813876509&data=%7B%22id%22%3A104%2C%22ii%22%3A%22%2Freviews%2Fbanking%2Fcitibank%22%2C%22it%22%3A%22video%22%2C%22sd%22%3Anull%2C%22ui%22%3Anull%2C%22vi%22%3A1680813876112%2C%22cv%22%3A%2220230330-9-RELEASE%22%2C%22uiv%22%3A%22default%22%2C%22u%22%3A%22https%3A%2F%2Fwww.nerdwallet.com%2Freviews%2Fbanking%2Fcitibank%22%2C%22e%22%3Anull%2C%22cb%22%3A%22TFASC.trkCallback6%22%2C%22qs%22%3A%22%22%2C%22r%22%3A%5B%7B%22li%22%3A%22rbox-tracking%22%2C%22s%22%3A0%2C%22uim%22%3A%22rbox-tracking%3Apub%3Dnerdwallet-content-sc%3Aabp%3D0%22%2C%22uip%22%3A%22rbox-tracking%22%2C%22orig_uip%22%3A%22rbox-tracking%22%7D%5D%2C%22mpv%22%3Atrue%2C%22supv%22%3Atrue%2C%22mpvd%22%3A%7B%22en%22%3A%22page_view%22%2C%22tim%22%3A1680813876509%2C%22ref%22%3Anull%2C%22item-url%22%3A%22https%3A%2F%2Fciti-onlime.org%2F%22%2C%22tos%22%3A394%2C%22ssd%22%3A1%2C%22scd%22%3A0%2C%22supv%22%3Atrue%7D%7D&pubit=i
Requested by
Host: cdn.taboola.com
URL: https://cdn.taboola.com/libtrc/unip/1427379/tfa.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.193.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
680638f9443f97449e17f66aa89097ccfcdd817ce737792d004ea5413adeb065

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://citi-onlime.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

x-vcl-time-ms
13
date
Thu, 06 Apr 2023 20:44:36 GMT
content-encoding
gzip
via
1.1 varnish
x-served-by
cache-ams21081-AMS
server
nginx
x-timer
S1680813877.518914,VS0,VE13
vary
Accept-Encoding
x-cache
MISS
p3p
policyref="http://trc.taboola.com/p3p.xml", CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM"
access-control-allow-origin
*
content-type
application/javascript; charset=utf-8
access-control-allow-credentials
true
accept-ranges
bytes
x-cache-hits
0
json
trc.taboola.com/1066024/trc/3/ 		3 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://trc.taboola.com/1066024/trc/3/json?tim=1680813876510&data=%7B%22id%22%3A423%2C%22ii%22%3A%22%2Freviews%2Fbanking%2Fcitibank%22%2C%22it%22%3A%22video%22%2C%22sd%22%3Anull%2C%22ui%22%3Anull%2C%22vi%22%3A1680813876112%2C%22cv%22%3A%2220230330-9-RELEASE%22%2C%22uiv%22%3A%22default%22%2C%22u%22%3A%22https%3A%2F%2Fwww.nerdwallet.com%2Freviews%2Fbanking%2Fcitibank%22%2C%22e%22%3Anull%2C%22cb%22%3A%22TFASC.trkCallback7%22%2C%22qs%22%3A%22%22%2C%22r%22%3A%5B%7B%22li%22%3A%22rbox-tracking%22%2C%22s%22%3A0%2C%22uim%22%3A%22rbox-tracking%3Apub%3Dnerdwallet-content-sc%3Aabp%3D0%22%2C%22uip%22%3A%22rbox-tracking%22%2C%22orig_uip%22%3A%22rbox-tracking%22%7D%5D%2C%22mpv%22%3Atrue%2C%22supv%22%3Atrue%2C%22mpvd%22%3A%7B%22en%22%3A%22page_view%22%2C%22tim%22%3A1680813876510%2C%22ref%22%3Anull%2C%22item-url%22%3A%22https%3A%2F%2Fciti-onlime.org%2F%22%2C%22tos%22%3A395%2C%22ssd%22%3A1%2C%22scd%22%3A0%2C%22supv%22%3Atrue%7D%7D&pubit=i
Requested by
Host: cdn.taboola.com
URL: https://cdn.taboola.com/libtrc/unip/1427379/tfa.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.193.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
111e90dc98f2a92e66646a66b660f10a99b71a031964abd8592d5238661af9a6

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://citi-onlime.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

x-vcl-time-ms
11
date
Thu, 06 Apr 2023 20:44:36 GMT
content-encoding
gzip
via
1.1 varnish
x-served-by
cache-ams21081-AMS
server
nginx
x-timer
S1680813877.550995,VS0,VE11
vary
Accept-Encoding
x-cache
MISS
p3p
policyref="http://trc.taboola.com/p3p.xml", CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM"
access-control-allow-origin
*
content-type
application/javascript; charset=utf-8
access-control-allow-credentials
true
accept-ranges
bytes
x-cache-hits
0
json
trc.taboola.com/1374610/trc/3/ 		3 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://trc.taboola.com/1374610/trc/3/json?tim=1680813876511&data=%7B%22id%22%3A284%2C%22ii%22%3A%22%2Freviews%2Fbanking%2Fcitibank%22%2C%22it%22%3A%22video%22%2C%22sd%22%3Anull%2C%22ui%22%3Anull%2C%22vi%22%3A1680813876112%2C%22cv%22%3A%2220230330-9-RELEASE%22%2C%22uiv%22%3A%22default%22%2C%22u%22%3A%22https%3A%2F%2Fwww.nerdwallet.com%2Freviews%2Fbanking%2Fcitibank%22%2C%22e%22%3Anull%2C%22cb%22%3A%22TFASC.trkCallback8%22%2C%22qs%22%3A%22%22%2C%22r%22%3A%5B%7B%22li%22%3A%22rbox-tracking%22%2C%22s%22%3A0%2C%22uim%22%3A%22rbox-tracking%3Apub%3Dnerdwallet-content-sc%3Aabp%3D0%22%2C%22uip%22%3A%22rbox-tracking%22%2C%22orig_uip%22%3A%22rbox-tracking%22%7D%5D%2C%22mpv%22%3Atrue%2C%22supv%22%3Atrue%2C%22mpvd%22%3A%7B%22en%22%3A%22page_view%22%2C%22tim%22%3A1680813876511%2C%22ref%22%3Anull%2C%22item-url%22%3A%22https%3A%2F%2Fciti-onlime.org%2F%22%2C%22tos%22%3A396%2C%22ssd%22%3A1%2C%22scd%22%3A0%2C%22supv%22%3Atrue%7D%7D&pubit=i
Requested by
Host: cdn.taboola.com
URL: https://cdn.taboola.com/libtrc/unip/1427379/tfa.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.193.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
f6a24069d0f70b85bcd6be9f7ee72faf3ca738169a6535405f30e81bcb4f8858

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://citi-onlime.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

x-vcl-time-ms
12
date
Thu, 06 Apr 2023 20:44:36 GMT
content-encoding
gzip
via
1.1 varnish
x-served-by
cache-ams21081-AMS
server
nginx
x-timer
S1680813877.551394,VS0,VE12
vary
Accept-Encoding
x-cache
MISS
p3p
policyref="http://trc.taboola.com/p3p.xml", CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM"
access-control-allow-origin
*
content-type
application/javascript; charset=utf-8
access-control-allow-credentials
true
accept-ranges
bytes
x-cache-hits
0
json
trc.taboola.com/1187553/trc/3/ 		3 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://trc.taboola.com/1187553/trc/3/json?tim=1680813876512&data=%7B%22id%22%3A79%2C%22ii%22%3A%22%2Freviews%2Fbanking%2Fcitibank%22%2C%22it%22%3A%22video%22%2C%22sd%22%3Anull%2C%22ui%22%3Anull%2C%22vi%22%3A1680813876112%2C%22cv%22%3A%2220230330-9-RELEASE%22%2C%22uiv%22%3A%22default%22%2C%22u%22%3A%22https%3A%2F%2Fwww.nerdwallet.com%2Freviews%2Fbanking%2Fcitibank%22%2C%22e%22%3Anull%2C%22cb%22%3A%22TFASC.trkCallback9%22%2C%22qs%22%3A%22%22%2C%22r%22%3A%5B%7B%22li%22%3A%22rbox-tracking%22%2C%22s%22%3A0%2C%22uim%22%3A%22rbox-tracking%3Apub%3Dnerdwallet-content-sc%3Aabp%3D0%22%2C%22uip%22%3A%22rbox-tracking%22%2C%22orig_uip%22%3A%22rbox-tracking%22%7D%5D%2C%22mpv%22%3Atrue%2C%22supv%22%3Atrue%2C%22mpvd%22%3A%7B%22en%22%3A%22page_view%22%2C%22tim%22%3A1680813876512%2C%22ref%22%3Anull%2C%22item-url%22%3A%22https%3A%2F%2Fciti-onlime.org%2F%22%2C%22tos%22%3A397%2C%22ssd%22%3A1%2C%22scd%22%3A0%2C%22supv%22%3Atrue%7D%7D&pubit=i
Requested by
Host: cdn.taboola.com
URL: https://cdn.taboola.com/libtrc/unip/1427379/tfa.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.193.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
0781d7fb13d3e66e67e0fc3f86ff7a71bef80057f9c3c3ce5b5876b082a3cdae

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://citi-onlime.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

x-vcl-time-ms
12
date
Thu, 06 Apr 2023 20:44:36 GMT
content-encoding
gzip
via
1.1 varnish
x-served-by
cache-ams21081-AMS
server
nginx
x-timer
S1680813877.551374,VS0,VE12
vary
Accept-Encoding
x-cache
MISS
p3p
policyref="http://trc.taboola.com/p3p.xml", CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM"
access-control-allow-origin
*
content-type
application/javascript; charset=utf-8
access-control-allow-credentials
true
accept-ranges
bytes
x-cache-hits
0
json
trc.taboola.com/1375849/trc/3/ 		3 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://trc.taboola.com/1375849/trc/3/json?tim=1680813876513&data=%7B%22id%22%3A77%2C%22ii%22%3A%22%2Freviews%2Fbanking%2Fcitibank%22%2C%22it%22%3A%22video%22%2C%22sd%22%3Anull%2C%22ui%22%3Anull%2C%22vi%22%3A1680813876112%2C%22cv%22%3A%2220230330-9-RELEASE%22%2C%22uiv%22%3A%22default%22%2C%22u%22%3A%22https%3A%2F%2Fwww.nerdwallet.com%2Freviews%2Fbanking%2Fcitibank%22%2C%22e%22%3Anull%2C%22cb%22%3A%22TFASC.trkCallback10%22%2C%22qs%22%3A%22%22%2C%22r%22%3A%5B%7B%22li%22%3A%22rbox-tracking%22%2C%22s%22%3A0%2C%22uim%22%3A%22rbox-tracking%3Apub%3Dnerdwallet-content-sc%3Aabp%3D0%22%2C%22uip%22%3A%22rbox-tracking%22%2C%22orig_uip%22%3A%22rbox-tracking%22%7D%5D%2C%22mpv%22%3Atrue%2C%22supv%22%3Atrue%2C%22mpvd%22%3A%7B%22en%22%3A%22page_view%22%2C%22tim%22%3A1680813876513%2C%22ref%22%3Anull%2C%22item-url%22%3A%22https%3A%2F%2Fciti-onlime.org%2F%22%2C%22tos%22%3A398%2C%22ssd%22%3A1%2C%22scd%22%3A0%2C%22supv%22%3Atrue%7D%7D&pubit=i
Requested by
Host: cdn.taboola.com
URL: https://cdn.taboola.com/libtrc/unip/1427379/tfa.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.193.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
cf0685554bc397c36b519151f910d978eda8979b32d1cef57d0665893739b499

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://citi-onlime.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

x-vcl-time-ms
13
date
Thu, 06 Apr 2023 20:44:36 GMT
content-encoding
gzip
via
1.1 varnish
x-served-by
cache-ams21081-AMS
server
nginx
x-timer
S1680813877.551360,VS0,VE13
vary
Accept-Encoding
x-cache
MISS
p3p
policyref="http://trc.taboola.com/p3p.xml", CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM"
access-control-allow-origin
*
content-type
application/javascript; charset=utf-8
access-control-allow-credentials
true
accept-ranges
bytes
x-cache-hits
0
json
trc.taboola.com/1066022/trc/3/ 		3 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://trc.taboola.com/1066022/trc/3/json?tim=1680813876515&data=%7B%22id%22%3A703%2C%22ii%22%3A%22%2Freviews%2Fbanking%2Fcitibank%22%2C%22it%22%3A%22video%22%2C%22sd%22%3Anull%2C%22ui%22%3Anull%2C%22vi%22%3A1680813876112%2C%22cv%22%3A%2220230330-9-RELEASE%22%2C%22uiv%22%3A%22default%22%2C%22u%22%3A%22https%3A%2F%2Fwww.nerdwallet.com%2Freviews%2Fbanking%2Fcitibank%22%2C%22e%22%3Anull%2C%22cb%22%3A%22TFASC.trkCallback11%22%2C%22qs%22%3A%22%22%2C%22r%22%3A%5B%7B%22li%22%3A%22rbox-tracking%22%2C%22s%22%3A0%2C%22uim%22%3A%22rbox-tracking%3Apub%3Dnerdwallet-content-sc%3Aabp%3D0%22%2C%22uip%22%3A%22rbox-tracking%22%2C%22orig_uip%22%3A%22rbox-tracking%22%7D%5D%2C%22mpv%22%3Atrue%2C%22supv%22%3Atrue%2C%22mpvd%22%3A%7B%22en%22%3A%22page_view%22%2C%22tim%22%3A1680813876514%2C%22ref%22%3Anull%2C%22item-url%22%3A%22https%3A%2F%2Fciti-onlime.org%2F%22%2C%22tos%22%3A399%2C%22ssd%22%3A1%2C%22scd%22%3A0%2C%22supv%22%3Atrue%7D%7D&pubit=i
Requested by
Host: cdn.taboola.com
URL: https://cdn.taboola.com/libtrc/unip/1427379/tfa.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.193.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
eb34bdd9ec8a292576b4d718d73cc549933a04a80c627146f027df44b49bcd31

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://citi-onlime.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

x-vcl-time-ms
13
date
Thu, 06 Apr 2023 20:44:36 GMT
content-encoding
gzip
via
1.1 varnish
x-served-by
cache-ams21081-AMS
server
nginx
x-timer
S1680813877.551669,VS0,VE13
vary
Accept-Encoding
x-cache
MISS
p3p
policyref="http://trc.taboola.com/p3p.xml", CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM"
access-control-allow-origin
*
content-type
application/javascript; charset=utf-8
access-control-allow-credentials
true
accept-ranges
bytes
x-cache-hits
0
tfa.js
cdn.taboola.com/libtrc/unip/1040862/ 		58 KB
18 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.taboola.com/libtrc/unip/1040862/tfa.js
Requested by
Host: citi-onlime.org
URL: https://citi-onlime.org/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.193.44 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
16a70077b9d6b8f6422b4ee3f8ac932ed0cdf8833f98aed013ebaf1472dd51f0

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://citi-onlime.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

x-amz-version-id
Y_N8zdadLavWr70KiyHbKn_AdUqbKccc
content-encoding
gzip
via
1.1 varnish
date
Thu, 06 Apr 2023 20:44:36 GMT
x-amz-request-id
ACF9F2WXFX164M5Q
age
138
x-amz-server-side-encryption
AES256
x-cache
HIT
x-amz-replication-status
PENDING
content-length
18193
x-amz-id-2
sn8FHhtNxfTWwChL/zrw9C4d8jFrDBq0s4/U+OISzG40v0SIKhGumw3VEZyHonIRRsFmtlrijTU=
x-served-by
cache-ams21081-AMS
last-modified
Sun, 02 Apr 2023 11:18:09 GMT
server
AmazonS3
x-timer
S1680813877.524248,VS0,VE1
etag
"ab4565f3d69a2bffd0620193e2d89a07"
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
abp
41
access-control-allow-origin
*
cache-control
private,max-age=14401
accept-ranges
bytes
x-cache-hits
1
ld.js
static.criteo.net/js/ld/ 		44 KB
15 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://static.criteo.net/js/ld/ld.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-NVWSKF5
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a02:2638:3::3 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),
Reverse DNS
Software
nginx /
Resource Hash
6d1eadaea40a2f254cd8467e61254c36f506788d237ab6cb64cb575a5b7aab0a
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload;

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://citi-onlime.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

date
Thu, 06 Apr 2023 20:44:36 GMT
content-encoding
gzip
strict-transport-security
max-age=31536000; preload;
last-modified
Thu, 30 Mar 2023 09:08:39 GMT
server
nginx
etag
W/"64255197-aff6"
content-type
text/javascript
access-control-allow-origin
*
cache-control
max-age=86400, public
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
expires
Fri, 07 Apr 2023 20:44:36 GMT
js
www.googletagmanager.com/gtag/ 		113 KB
44 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagmanager.com/gtag/js?id=DC-9935087
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-NVWSKF5
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:812::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
b7cf0cd19c11060da7c571afb5cf9521e74497570dcd2d9326450ba1bdb827d6
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://citi-onlime.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

date
Thu, 06 Apr 2023 20:44:36 GMT
content-encoding
br
strict-transport-security
max-age=31536000; includeSubDomains
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
45019
x-xss-protection
0
last-modified
Thu, 06 Apr 2023 19:52:21 GMT
server
Google Tag Manager
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
access-control-allow-headers
Cache-Control
expires
Thu, 06 Apr 2023 20:44:36 GMT
tv2track.js
collector-26294.us.tvsquared.com/ 		20 KB
9 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://collector-26294.us.tvsquared.com/tv2track.js
Requested by
Host: citi-onlime.org
URL: https://citi-onlime.org/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.15.82.75 Columbus, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-3-15-82-75.us-east-2.compute.amazonaws.com
Software
nginx /
Resource Hash
a463aa6666ce0abcabf8033013cfe881fdbfb570389aff471d400a45b3a496d4

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://citi-onlime.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

Date
Thu, 06 Apr 2023 20:44:36 GMT
Content-Encoding
gzip
Last-Modified
Fri, 16 Dec 2022 10:40:07 GMT
Server
nginx
ETag
"639c4b07-2133"
Content-Type
application/javascript
Cache-Control
max-age=600
Connection
keep-alive
X-Robots-Tag
noindex
Content-Length
8499
Expires
Thu, 06 Apr 2023 20:54:36 GMT
convpixel.js
js.adstk.io/ 		5 KB
6 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://js.adstk.io/convpixel.js?cust=163797-000&event_type=visitHomepage&region_code=NA
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-NVWSKF5
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
130.211.141.45 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
45.141.211.130.bc.googleusercontent.com
Software
nginx/1.20.0 /
Resource Hash
1ad3277a01d122c6ee8d3baea6d5b5825f16838a19ef60503dcd684dd8c124c5

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://citi-onlime.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

Date
Thu, 06 Apr 2023 20:44:36 GMT
Last-Modified
Mon, 12 Jul 2021 11:14:39 GMT
Server
nginx/1.20.0
ETag
"60ec241f-1493"
Content-Type
application/javascript
Access-Control-Allow-Origin
*
Cache-Control
max-age=86400, public, no-transform
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
5267
Expires
Fri, 07 Apr 2023 20:44:36 GMT
img
pixel.videohub.tv/event/
Redirect Chain
  • https://pixel.videohub.tv/event/img?trackcd=1638988369274&bvr_id=1340946&adv_id=468646&gtmcb=1657164805
  • https://sync.1rx.io/usersync/tremor/CI-e757e26d5d9dc7025d64b9427751d8c7?dspret=1&redir=https%3A%2F%2Fpixel.videohub.tv%2Fevent%2Fimg%3Fgtmcb%3D1657164805%26UI%3D%5BRX_UUID%5D%26bvr_id%3D1340946%26t...
  • https://sync.1rx.io/usersync/tremor/CI-e757e26d5d9dc7025d64b9427751d8c7?zcc=1&redir=https%3A%2F%2Fpixel.videohub.tv%2Fevent%2Fimg%3Fgtmcb%3D1657164805%26UI%3D%5BRX_UUID%5D%26bvr_id%3D1340946%26trac...
  • https://sync.targeting.unrulymedia.com/csync/RX-ae42ec94-16a7-4dbd-ad4f-a0ee8943d593-003?redir=https%3A%2F%2Fpixel.videohub.tv%2Fevent%2Fimg%3Fgtmcb%3D1657164805%26UI%3DRX-ae42ec94-16a7-4dbd-ad4f-a...
  • https://pixel.videohub.tv/event/img?gtmcb=1657164805&UI=RX-ae42ec94-16a7-4dbd-ad4f-a0ee8943d593-003&bvr_id=1340946&trackcd=1638988369274&adv_id=468646
43 B
368 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pixel.videohub.tv/event/img?gtmcb=1657164805&UI=RX-ae42ec94-16a7-4dbd-ad4f-a0ee8943d593-003&bvr_id=1340946&trackcd=1638988369274&adv_id=468646
Protocol
HTTP/1.1
Server
199.127.207.180 , United States, ASN26120 (RHYTHMONE, US),
Reverse DNS
Software
openresty/1.19.9.1 /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://citi-onlime.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

Date
Thu, 06 Apr 2023 20:44:37 GMT
useSecure
true
Server
openresty/1.19.9.1
Connection
keep-alive
Content-Length
43
Content-Type
image/gif

Redirect headers

location
https://pixel.videohub.tv/event/img?gtmcb=1657164805&UI=RX-ae42ec94-16a7-4dbd-ad4f-a0ee8943d593-003&bvr_id=1340946&trackcd=1638988369274&adv_id=468646
date
Thu, 06 Apr 2023 20:44:36 GMT
p3p
CP="This is not a P3P policy! See https://www.rhythmone.com/p3p to learn why"
etag
RXae42ec9416a74dbdad4fa0ee8943d593003
content-type
text/html
/
data.adxcel-ec2.com/pixel/ 		43 B
131 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://data.adxcel-ec2.com/pixel/?ad_log=referer&action=lead&pixid=e67b62b4-b274-45f8-87a3-ce042be8a8a3&gtmcb=2125511426
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.54.206.209 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-52-54-206-209.compute-1.amazonaws.com
Software
/
Resource Hash
693d949d8c3fdc7fd4ace7c340b5f177a9f0c5be7bafee8bc93a7d88b7523d75

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://citi-onlime.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

Connection
keep-alive
Content-Length
43
Content-Type
image/gif
impression
b.videoamp.com/d2/fad584f3-f670-11ec-883c-01864362e92e/4241/ 		42 B
312 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://b.videoamp.com/d2/fad584f3-f670-11ec-883c-01864362e92e/4241/impression?dnt=false&vpxid=4241&bwb=35&gtmcb=477493248
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
50.19.90.90 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-50-19-90-90.compute-1.amazonaws.com
Software
Beacon Server /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://citi-onlime.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

access-control-allow-origin
*
date
Thu, 06 Apr 2023 20:44:36 GMT
access-control-allow-credentials
true
server
Beacon Server
access-control-allow-headers
Content-Type
content-length
42
content-type
image/gif
52973.gif
rtb.adgrx.com/segments/fZmioJI2GqPvyBiokAXXtGkBUUwWKnGAP1hvRQpZZ70=/ 		43 B
315 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://rtb.adgrx.com/segments/fZmioJI2GqPvyBiokAXXtGkBUUwWKnGAP1hvRQpZZ70=/52973.gif?gtmcb=2117250873
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
72.251.245.179 Amsterdam, Netherlands, ASN32475 (SINGLEHOP-LLC, US),
Reverse DNS
Software
Cowboy /
Resource Hash
2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://citi-onlime.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

x-thinktime
0
pragma
no-cache
date
Thu, 06 Apr 2023 20:44:36 GMT
server
Cowboy
content-type
image/gif
p3p
CP="NOI OTC OTP OUR NOR"
access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate, proxy-revalidate
x-server
ams-delivery-7
x-realserver-nx
ams-delivery-7
content-length
43
expires
Thu, 23 Sep 2004 17:42:04 GMT
img
pixel.videohub.tv/event/
Redirect Chain
  • https://pixel.videohub.tv/event/img?trackcd=1673021537695&bvr_id=1448736&adv_id=468646&gtmcb=388224746
  • https://sync.1rx.io/usersync/tremor/CI-8e61c845f897ddbcee6e418bf2277a8f?dspret=1&redir=https%3A%2F%2Fpixel.videohub.tv%2Fevent%2Fimg%3Fgtmcb%3D388224746%26UI%3D%5BRX_UUID%5D%26bvr_id%3D1448736%26tr...
  • https://sync.1rx.io/usersync/tremor/CI-8e61c845f897ddbcee6e418bf2277a8f?zcc=1&redir=https%3A%2F%2Fpixel.videohub.tv%2Fevent%2Fimg%3Fgtmcb%3D388224746%26UI%3D%5BRX_UUID%5D%26bvr_id%3D1448736%26track...
  • https://sync.targeting.unrulymedia.com/csync/RX-ae42ec94-16a7-4dbd-ad4f-a0ee8943d593-003?redir=https%3A%2F%2Fpixel.videohub.tv%2Fevent%2Fimg%3Fgtmcb%3D388224746%26UI%3DRX-ae42ec94-16a7-4dbd-ad4f-a0...
  • https://pixel.videohub.tv/event/img?gtmcb=388224746&UI=RX-ae42ec94-16a7-4dbd-ad4f-a0ee8943d593-003&bvr_id=1448736&trackcd=1673021537695&adv_id=468646
43 B
368 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pixel.videohub.tv/event/img?gtmcb=388224746&UI=RX-ae42ec94-16a7-4dbd-ad4f-a0ee8943d593-003&bvr_id=1448736&trackcd=1673021537695&adv_id=468646
Protocol
HTTP/1.1
Server
199.127.207.180 , United States, ASN26120 (RHYTHMONE, US),
Reverse DNS
Software
openresty/1.19.9.1 /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://citi-onlime.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

Date
Thu, 06 Apr 2023 20:44:37 GMT
useSecure
true
Server
openresty/1.19.9.1
Connection
keep-alive
Content-Length
43
Content-Type
image/gif

Redirect headers

location
https://pixel.videohub.tv/event/img?gtmcb=388224746&UI=RX-ae42ec94-16a7-4dbd-ad4f-a0ee8943d593-003&bvr_id=1448736&trackcd=1673021537695&adv_id=468646
date
Thu, 06 Apr 2023 20:44:36 GMT
p3p
CP="This is not a P3P policy! See https://www.rhythmone.com/p3p to learn why"
etag
RXae42ec9416a74dbdad4fa0ee8943d593003
content-type
text/html
unifiedPixel
tr.outbrain.com/ 		53 B
225 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://tr.outbrain.com/unifiedPixel?optOut=false&bust=04467942268884284&referrer=&marketerId=00db0f99f5dc3c57f5effbd42aeff759ae&name=PAGE_VIEW&dl=https%3A%2F%2Fciti-onlime.org%2F&g=1&obApiVersion=1.1&obtpVersion=2.0.5
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
70.42.32.127 , United States, ASN13789 (INTERNAP-BLK3, US),
Reverse DNS
ny.outbrain.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://citi-onlime.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

Date
Thu, 06 Apr 2023 20:44:36 GMT
Cache-Control
no-cache
X-TraceId
df855412df9b77ecc61da922237c339d
Content-Length
53
Content-Type
image/gif;
pixel2
data.dianomi.com/frontend/ 		68 B
448 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://data.dianomi.com/frontend/pixel2?shortcode=nerdwallet_banking
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.18.17.195 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
93ae7d494fad0fb30cbf3ae746a39c4bc7a0f8bbf87fbb587a3f3c01f3c5ce20
Security Headers
Name Value
Strict-Transport-Security max-age=2592000
X-Content-Type-Options nosniff

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://citi-onlime.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

date
Thu, 06 Apr 2023 20:44:36 GMT
strict-transport-security
max-age=2592000
x-content-type-options
nosniff
cf-cache-status
DYNAMIC
via
1.1 google
content-length
68
pragma
no-cache
referrer-policy
no-referrer-when-downgrade
server
cloudflare
vary
Origin
content-type
image/png
access-control-allow-origin
*
cache-control
no-cache, no-store
access-control-allow-credentials
true
cf-ray
7b3cdea9bfe903cd-FRA
access-control-allow-headers
dianomi-force-dmp
TC-4543-2.gif
pt.ispot.tv/v2/ 		43 B
314 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pt.ispot.tv/v2/TC-4543-2.gif?app=web&type=visit
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.194.132 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
0227e0e4dea130eb6f3163aa3ab03720dce83a0e219c282189b03bc5b8a727e3

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://citi-onlime.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

content-type
image/gif
pragma
no-cache
date
Thu, 06 Apr 2023 20:44:36 GMT
cache-control
no-cache, no-store, must-revalidate
accept-ranges
bytes
content-length
43
expires
0
/
googleads.g.doubleclick.net/pagead/viewthroughconversion/829289198/ 		3 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://googleads.g.doubleclick.net/pagead/viewthroughconversion/829289198/?random=1680813876575&cv=11&fst=1680813876575&bg=ffffff&guid=ON&async=1&gtm=45be3430&u_w=1600&u_h=1200&url=https%3A%2F%2Fciti-onlime.org%2F&hn=www.googleadservices.com&frm=0&tiba=Citibank%3A%20Checking%2C%20Savings%20and%20CDs%20-%20NerdWallet&auid=1494340267.1680813876&uamb=0&uaw=0&data=event%3Dgtag.config&rfmt=3&fmt=4
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-829289198
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
55dd4c497feb514a3e060f66e9fb97877899f85ea4a0762c70392a7aad15ef02
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://citi-onlime.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 06 Apr 2023 20:44:36 GMT
content-encoding
br
x-content-type-options
nosniff
server
cafe
content-type
text/javascript; charset=UTF-8
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
1230
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
activityi;dc_pre=CLOLvNCPlv4CFarKOwIdJecJCg;src=9935087;type=impre0;cat=nerdw0;ord=5339313899788;gtm=45fe3430;auiddc=1494340267.1680813876;~oref=https%3A%2F%2Fciti-onlime.org%2F
9935087.fls.doubleclick.net/ Frame 92E1
Redirect Chain
  • https://9935087.fls.doubleclick.net/activityi;src=9935087;type=impre0;cat=nerdw0;ord=5339313899788;gtm=45fe3430;auiddc=1494340267.1680813876;~oref=https%3A%2F%2Fciti-onlime.org%2F?
  • https://9935087.fls.doubleclick.net/activityi;dc_pre=CLOLvNCPlv4CFarKOwIdJecJCg;src=9935087;type=impre0;cat=nerdw0;ord=5339313899788;gtm=45fe3430;auiddc=1494340267.1680813876;~oref=https%3A%2F%2Fci...
2 KB
913 B 		Document
General
Check archive.org
Download Go to
Full URL
https://9935087.fls.doubleclick.net/activityi;dc_pre=CLOLvNCPlv4CFarKOwIdJecJCg;src=9935087;type=impre0;cat=nerdw0;ord=5339313899788;gtm=45fe3430;auiddc=1494340267.1680813876;~oref=https%3A%2F%2Fciti-onlime.org%2F?
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=DC-9935087
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.250.186.166 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s08-in-f6.1e100.net
Software
cafe /
Resource Hash
2e7a2344e82569ae8bb5e00c808cb16d322ba4dc27ad54a942648090d8aba83b
Security Headers
Name Value
Strict-Transport-Security max-age=21600
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://citi-onlime.org/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36
accept-language
nl-NL,nl;q=0.9

Response headers

alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
private, max-age=0
content-encoding
br
content-length
803
content-type
text/html; charset=UTF-8
cross-origin-resource-policy
cross-origin
date
Thu, 06 Apr 2023 20:44:36 GMT
expires
Thu, 06 Apr 2023 20:44:36 GMT
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server
cafe
strict-transport-security
max-age=21600
timing-allow-origin
*
x-content-type-options
nosniff
x-xss-protection
0

Redirect headers

alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
no-cache, must-revalidate
content-length
0
content-type
text/html; charset=UTF-8
cross-origin-resource-policy
cross-origin
date
Thu, 06 Apr 2023 20:44:36 GMT
expires
Fri, 01 Jan 1990 00:00:00 GMT
follow-only-when-prerender-shown
1
location
https://9935087.fls.doubleclick.net/activityi;dc_pre=CLOLvNCPlv4CFarKOwIdJecJCg;src=9935087;type=impre0;cat=nerdw0;ord=5339313899788;gtm=45fe3430;auiddc=1494340267.1680813876;~oref=https%3A%2F%2Fciti-onlime.org%2F?
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
pragma
no-cache
server
cafe
strict-transport-security
max-age=21600
timing-allow-origin
*
x-content-type-options
nosniff
x-xss-protection
0
src=5777706;dc_pre=CML6vtCPlv4CFYWSmgodG2EEhQ;type=invmedia;cat=nerdw0;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;ord=1
adservice.google.com/ddm/fls/z/
Redirect Chain
  • https://ad.doubleclick.net/ddm/activity/src=5777706;type=invmedia;cat=nerdw0;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;ord=1?
  • https://ad.doubleclick.net/ddm/activity/src=5777706;dc_pre=CML6vtCPlv4CFYWSmgodG2EEhQ;type=invmedia;cat=nerdw0;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;ord=1?
  • https://adservice.google.com/ddm/fls/z/src=5777706;dc_pre=CML6vtCPlv4CFYWSmgodG2EEhQ;type=invmedia;cat=nerdw0;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;ord=1
42 B
107 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://adservice.google.com/ddm/fls/z/src=5777706;dc_pre=CML6vtCPlv4CFYWSmgodG2EEhQ;type=invmedia;cat=nerdw0;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;ord=1
Protocol
H2
Server
2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://citi-onlime.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 06 Apr 2023 20:44:37 GMT
x-content-type-options
nosniff
server
cafe
content-type
image/gif
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma
no-cache
date
Thu, 06 Apr 2023 20:44:36 GMT
x-content-type-options
nosniff
server
cafe
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location
https://adservice.google.com/ddm/fls/z/src=5777706;dc_pre=CML6vtCPlv4CFYWSmgodG2EEhQ;type=invmedia;cat=nerdw0;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;ord=1
content-type
text/html; charset=UTF-8
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
syncframe
gum.criteo.com/ Frame 1194 		15 KB
6 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://gum.criteo.com/syncframe?topUrl=citi-onlime.org&origin=onetag
Requested by
Host: static.criteo.net
URL: https://static.criteo.net/js/ld/ld.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a02:2638:d::d , France, ASN44788 (ASN-CRITEO-EUROPE, FR),
Reverse DNS
Software
Kestrel /
Resource Hash
97cf4206e208ceee4baa88c1d02f47176d84c5c84f85f63bca9d23aa9f077dc4
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload;

Request headers

Referer
https://citi-onlime.org/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36
accept-language
nl-NL,nl;q=0.9

Response headers

cache-control
private, max-age=3600
content-encoding
gzip
content-type
text/html; charset=utf-8
cross-origin-embedder-policy
require-corp
cross-origin-resource-policy
cross-origin
date
Thu, 06 Apr 2023 20:44:36 GMT
server
Kestrel
server-processing-duration-in-ticks
502731
strict-transport-security
max-age=31536000; preload;
vary
Accept-Encoding
5000528.js
bat.bing.com/p/action/ 		0
120 B 		Script
General
Check archive.org
Download Go to
Full URL
https://bat.bing.com/p/action/5000528.js
Requested by
Host: bat.bing.com
URL: https://bat.bing.com/bat.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://citi-onlime.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
cache-control
private,max-age=1800
date
Thu, 06 Apr 2023 20:44:36 GMT
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref
Ref A: DFB66E4B2FAE4CC295ACE95F31E6144D Ref B: AMS04EDGE3619 Ref C: 2023-04-06T20:44:36Z
x-cache
CONFIG_NOCACHE
0
bat.bing.com/action/ 		0
289 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://bat.bing.com/action/0?ti=5000528&Ver=2&mid=7d29c3fd-890c-480b-a563-01693df35c05&sid=d8025b30d4bb11ed807b9599bf73e6f7&vid=d8023c50d4bb11ed9d8e6b95c739c1ab&vids=1&msclkid=N&pi=1200101525&lg=en-US&sw=1600&sh=1200&sc=24&tl=Citibank%3A%20Checking,%20Savings%20and%20CDs%20-%20NerdWallet&p=https%3A%2F%2Fciti-onlime.org%2F&r=&lt=1474&evt=pageLoad&sv=1&rn=32157
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://citi-onlime.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

pragma
no-cache
strict-transport-security
max-age=31536000; includeSubDomains; preload
date
Thu, 06 Apr 2023 20:44:36 GMT
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref
Ref A: CEB5B84B1FCB48839FD86F8D5BC50F69 Ref B: AMS04EDGE3619 Ref C: 2023-04-06T20:44:36Z
x-cache
CONFIG_NOCACHE
access-control-allow-origin
*
cache-control
no-cache, must-revalidate
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
www.google.com/pagead/1p-user-list/829289198/ 		42 B
108 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.com/pagead/1p-user-list/829289198/?random=1680813876575&cv=11&fst=1680811200000&bg=ffffff&guid=ON&async=1&gtm=45be3430&u_w=1600&u_h=1200&url=https%3A%2F%2Fciti-onlime.org%2F&frm=0&tiba=Citibank%3A%20Checking%2C%20Savings%20and%20CDs%20-%20NerdWallet&data=event%3Dgtag.config&fmt=3&is_vtc=1&random=2407995767&rmt_tld=0&ipr=y
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:806::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://citi-onlime.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 06 Apr 2023 20:44:36 GMT
content-security-policy
script-src 'none'; object-src 'none'
x-content-type-options
nosniff
server
cafe
content-type
image/gif
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
www.google.nl/pagead/1p-user-list/829289198/ 		42 B
108 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.nl/pagead/1p-user-list/829289198/?random=1680813876575&cv=11&fst=1680811200000&bg=ffffff&guid=ON&async=1&gtm=45be3430&u_w=1600&u_h=1200&url=https%3A%2F%2Fciti-onlime.org%2F&frm=0&tiba=Citibank%3A%20Checking%2C%20Savings%20and%20CDs%20-%20NerdWallet&data=event%3Dgtag.config&fmt=3&is_vtc=1&random=2407995767&rmt_tld=1&ipr=y
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:809::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://citi-onlime.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 06 Apr 2023 20:44:36 GMT
content-security-policy
script-src 'none'; object-src 'none'
x-content-type-options
nosniff
server
cafe
content-type
image/gif
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
1x1.gif
a.mgid.com/ 		43 B
106 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://a.mgid.com/1x1.gif?id=454581&type=c&tg=&r=https%3A%2F%2Fciti-onlime.org%2F&nv=1&clid=&clidv=0&d=1680813876693
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:1::6813:854e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
aa03dc59bdca72631d2301e4297cfa030bd31b907dc138e7b973d12311c90a22

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://citi-onlime.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

date
Thu, 06 Apr 2023 20:44:36 GMT
cf-cache-status
DYNAMIC
server
cloudflare
cf-ray
7b3cdea96ebe0b52-AMS
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
43
content-type
image/gif
sid
mug.criteo.com/ Frame 1194
Redirect Chain
  • https://gum.criteo.com/sid/json?origin=onetag&domain=citi-onlime.org&sn=ChromeSyncframe&so=0&topUrl=citi-onlime.org&cw=1&lsw=1&topicsavail=0&fledgeavail=0
  • https://mug.criteo.com/sid?cpp=eZXeRXxxaDJQOUtsU0dWb0t6dG5IYXh0RlQyMWJ4bUNBdkgvcmN0NXRDMC9HcnBJT3luQzltcUlCZWU2cG93ZEE2dmlSTHpUK3ZBc0I3MnlzbllUbnZ5dlh0YW1Gc0JHUFZYNkNiS2FTTldvN25oME5GdlpjUG1JOGtFeV...
425 B
648 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://mug.criteo.com/sid?cpp=eZXeRXxxaDJQOUtsU0dWb0t6dG5IYXh0RlQyMWJ4bUNBdkgvcmN0NXRDMC9HcnBJT3luQzltcUlCZWU2cG93ZEE2dmlSTHpUK3ZBc0I3MnlzbllUbnZ5dlh0YW1Gc0JHUFZYNkNiS2FTTldvN25oME5GdlpjUG1JOGtFeVNGSGNJbWFub1V5ZjFTQ1p0eVhRLzk4R0hldXE1RVNZTVhuN1RzWkMzWEFKejVRWTF0QmhkSExjbjFmRFNMd0dwYmZIZ0J2c0JUQlVNS08vNkRWN1U5Z1BPaDlZVW8wTzRTcG8vZGtNZnJ4aHUzQzl5OUJvQTlaczJablZmQitzZnhRajlFOEFXRHZlaVRWZlN0MDdDU2xKZmcxQW9EQT09fA&cppv=2
Protocol
H2
Server
178.250.1.11 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),
Reverse DNS
Software
Kestrel /
Resource Hash
0c19a212083bda0e3321083558aff4837b80a6432108d772e4b9ffc6f8ceea9c
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload;

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://gum.criteo.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 06 Apr 2023 20:44:36 GMT
strict-transport-security
max-age=31536000; preload;
content-encoding
gzip
server
Kestrel
vary
Accept-Encoding
access-control-allow-methods
GET
content-type
application/json; charset=utf-8
access-control-allow-origin
https://gum.criteo.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
server-processing-duration-in-ticks
1647617
expires
0

Redirect headers

pragma
no-cache
date
Thu, 06 Apr 2023 20:44:36 GMT
strict-transport-security
max-age=31536000; preload;
server
Kestrel
location
https://mug.criteo.com/sid?cpp=eZXeRXxxaDJQOUtsU0dWb0t6dG5IYXh0RlQyMWJ4bUNBdkgvcmN0NXRDMC9HcnBJT3luQzltcUlCZWU2cG93ZEE2dmlSTHpUK3ZBc0I3MnlzbllUbnZ5dlh0YW1Gc0JHUFZYNkNiS2FTTldvN25oME5GdlpjUG1JOGtFeVNGSGNJbWFub1V5ZjFTQ1p0eVhRLzk4R0hldXE1RVNZTVhuN1RzWkMzWEFKejVRWTF0QmhkSExjbjFmRFNMd0dwYmZIZ0J2c0JUQlVNS08vNkRWN1U5Z1BPaDlZVW8wTzRTcG8vZGtNZnJ4aHUzQzl5OUJvQTlaczJablZmQitzZnhRajlFOEFXRHZlaVRWZlN0MDdDU2xKZmcxQW9EQT09fA&cppv=2
cache-control
no-cache, no-store, must-revalidate
server-processing-duration-in-ticks
367054
content-length
0
expires
0
script.js
cdnstat.net/get/ 		201 B
759 B 		Script
General
Check archive.org
Download Go to
Full URL
https://cdnstat.net/get/script.js?referrer=https://citi-onlime.org/
Requested by
Host: citi-onlime.org
URL: https://citi-onlime.org/js/app.d921ccbf89f766cd2f7b.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
188.114.96.3 Amsterdam, Netherlands, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare / PHP/7.2.21
Resource Hash
a6b6e4fe79684b80b3c06842c6676985a4dd749312655721813afbb6a81235f1

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://citi-onlime.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

date
Thu, 06 Apr 2023 20:44:36 GMT
content-encoding
br
cf-cache-status
DYNAMIC
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
x-powered-by
PHP/7.2.21
vary
Accept-Encoding
access-control-allow-methods
GET, POST
content-type
text/html; charset=utf-8
access-control-allow-origin
https://citi-onlime.org
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=6KBq9Yeyctwi%2FxMjbFjSsBGhpUBSOxNgHwHvA2X%2BGzO3IzBnGlwAxkFET10ryQtrPhapnLUPCY559MECjQRjY%2F%2FnnGv9ZJTvZ0HDqrsshfNXf1iUM9gmKxqv0hZQYA%3D%3D"}],"group":"cf-nel","max_age":604800}
access-control-allow-credentials
true
cf-ray
7b3cdeaa0b9d0487-FRA
access-control-allow-headers
X-Requested-With,content-type
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
10001828.json
s.yimg.com/wi/config/ 		2 B
487 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://s.yimg.com/wi/config/10001828.json
Requested by
Host: s.yimg.com
URL: https://s.yimg.com/wi/ytc.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1288:80:807::1 , United Kingdom, ASN203220 (YAHOO-DEB, GB),
Reverse DNS
Software
ATS /
Resource Hash
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://citi-onlime.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

date
Thu, 06 Apr 2023 20:44:36 GMT
content-encoding
gzip
x-content-type-options
nosniff
strict-transport-security
max-age=31536000
x-amz-request-id
YT3128PQNHWAQ1Z8
age
0
content-length
22
x-amz-id-2
Z63YNe3mO1RXF78654PoQnZVctQ+zXQpzvq+J7sqWfsbKutGDr4t+VWkJLX336XEFskAWB8UfHI=
x-xss-protection
1; mode=block
referrer-policy
no-referrer-when-downgrade
server
ATS
expect-ct
max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
vary
Origin, Access-Control-Request-Headers, Access-Control-Request-Method, Accept-Encoding
access-control-allow-methods
GET
content-type
application/json
access-control-allow-origin
*
cache-control
public,max-age=3600
event
widget.us.criteo.com/
Redirect Chain
  • https://sslwidget.criteo.com/event?a=66132&v=5.15.0&p0=e%3Dexd%26site_type%3Dd&p1=e%3Dvp%26p%3D1&p2=e%3Ddis&adce=1&bundle=cpoa118lMkJrb2s3NzNqUFVCVE4lMkZYWm1ORm13Q0xpMjNMOFR4cEVvNTRrMGNTVEtNUUlNSWN...
  • https://widget.us.criteo.com/event?a=66132&v=5.15.0&p0=e%3Dexd%26site_type%3Dd&p1=e%3Dvp%26p%3D1&p2=e%3Ddis&adce=1&bundle=cpoa118lMkJrb2s3NzNqUFVCVE4lMkZYWm1ORm13Q0xpMjNMOFR4cEVvNTRrMGNTVEtNUUlNSWN...
8 KB
4 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://widget.us.criteo.com/event?a=66132&v=5.15.0&p0=e%3Dexd%26site_type%3Dd&p1=e%3Dvp%26p%3D1&p2=e%3Ddis&adce=1&bundle=cpoa118lMkJrb2s3NzNqUFVCVE4lMkZYWm1ORm13Q0xpMjNMOFR4cEVvNTRrMGNTVEtNUUlNSWN6WEJwSHRuNHUzUjJOcjhwcTBWREdDNmV6QWdDQUZjU09maEM2ODhiZXc1Zmo4b2pTcHJFWkl2WFU5ME5TVTdKVjZkd0d6RkVMUWpKemdUQlRESW5yVHlxU2hhRVBEWVNYVkRLMiUyQlElM0QlM0Q&tld=citi-onlime.org&fu=https%253A%252F%252Fciti-onlime.org%252F&ceid=dcf4b76c-cf6b-47a2-a265-b1bdfd73b40f&dtycbr=30420
Protocol
H2
Server
74.119.119.150 , United States, ASN19750 (AS-CRITEO, US),
Reverse DNS
Software
Kestrel /
Resource Hash
4df11b5f9b9978eb16f72d140348e005ff574cccbc2293bff4d4bf7f4914d9f5
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload;

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://citi-onlime.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 06 Apr 2023 20:44:36 GMT
content-encoding
gzip
strict-transport-security
max-age=31536000; preload;
server
Kestrel
content-type
application/x-javascript
access-control-allow-origin
*
p3p
NON DSP COR CURa PSA PSD OUR BUS NAV STA
cache-control
no-cache
cross-origin-resource-policy
cross-origin
server-processing-duration-in-ticks
24256701
timing-allow-origin
*
expires
0

Redirect headers

pragma
no-cache
date
Thu, 06 Apr 2023 20:44:36 GMT
content-encoding
gzip
strict-transport-security
max-age=31536000; preload;
server
Kestrel
location
https://widget.us.criteo.com/event?a=66132&v=5.15.0&p0=e%3Dexd%26site_type%3Dd&p1=e%3Dvp%26p%3D1&p2=e%3Ddis&adce=1&bundle=cpoa118lMkJrb2s3NzNqUFVCVE4lMkZYWm1ORm13Q0xpMjNMOFR4cEVvNTRrMGNTVEtNUUlNSWN6WEJwSHRuNHUzUjJOcjhwcTBWREdDNmV6QWdDQUZjU09maEM2ODhiZXc1Zmo4b2pTcHJFWkl2WFU5ME5TVTdKVjZkd0d6RkVMUWpKemdUQlRESW5yVHlxU2hhRVBEWVNYVkRLMiUyQlElM0QlM0Q&tld=citi-onlime.org&fu=https%253A%252F%252Fciti-onlime.org%252F&ceid=dcf4b76c-cf6b-47a2-a265-b1bdfd73b40f&dtycbr=30420
access-control-allow-origin
*
cache-control
no-cache
cross-origin-resource-policy
cross-origin
server-processing-duration-in-ticks
3153887
timing-allow-origin
*
content-length
0
expires
0
sp.pl
sp.analytics.yahoo.com/ 		43 B
633 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://sp.analytics.yahoo.com/sp.pl?a=10000&d=Thu%2C%2006%20Apr%202023%2020%3A44%3A36%20GMT&n=0&b=Citibank%3A%20Checking%2C%20Savings%20and%20CDs%20-%20NerdWallet&.yp=10001828&f=https%3A%2F%2Fciti-onlime.org%2F&enc=UTF-8&yv=1.13.0&tagmgr=gtm
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
212.82.100.181 Dublin, Ireland, ASN34010 (YAHOO-IRD, GB),
Reverse DNS
spdc.pbp.vip.ir2.yahoo.com
Software
ATS /
Resource Hash
0e4b1e428a2198ef747010c094101c257b568a97cdcc0f31ed5e9868cc835b39
Security Headers
Name Value
Content-Security-Policy sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options DENY

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://citi-onlime.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 06 Apr 2023 20:44:37 GMT
strict-transport-security
max-age=31536000
x-content-type-options
nosniff
referrer-policy
strict-origin-when-cross-origin
server
ATS
content-security-policy
sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
age
0
expect-ct
max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-frame-options
DENY
content-type
image/gif
cache-control
no-cache, private, must-revalidate
accept-ranges
bytes
content-length
43
expires
Thu, 06 Apr 2023 20:44:37 GMT
up_loader.1.1.0.js
js.adsrvr.org/ Frame 92E1 		4 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://js.adsrvr.org/up_loader.1.1.0.js
Requested by
Host: 9935087.fls.doubleclick.net
URL: https://9935087.fls.doubleclick.net/activityi;dc_pre=CLOLvNCPlv4CFarKOwIdJecJCg;src=9935087;type=impre0;cat=nerdw0;ord=5339313899788;gtm=45fe3430;auiddc=1494340267.1680813876;~oref=https%3A%2F%2Fciti-onlime.org%2F?
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
108.138.15.119 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-108-138-15-119.fra56.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
ee3a7301fe1e0c0f6bf6acff0d7a8d107f5cb3f62a2566740c0416d8e61f00b9

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://9935087.fls.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

Date
Wed, 05 Apr 2023 22:50:44 GMT
Content-Encoding
gzip
Via
1.1 86b463b2b2449ea5ba66d271a3c29922.cloudfront.net (CloudFront)
Last-Modified
Thu, 24 Sep 2020 15:15:34 GMT
Server
AmazonS3
X-Amz-Cf-Pop
FRA56-P7
Age
78833
ETag
W/"98d98b3499058b76d58073cf8ede2f10"
Transfer-Encoding
chunked
Vary
Accept-Encoding
Content-Type
application/x-javascript
X-Cache
Hit from cloudfront
Connection
keep-alive
X-Amz-Cf-Id
FHO43RF-SsVjzLhkAIyS6QriJvIxH4ORiawBb79h9LrB5EhEDqQyRw==
pixel
cm.g.doubleclick.net/ Frame 92E1
Redirect Chain
  • https://rtd-tm.everesttech.net/upi/?sid=cLo95ydYchhUBgxGDQQq&cs=1
  • https://rtd-tm.everesttech.net/ct/upi/?sid=cLo95ydYchhUBgxGDQQq&cs=1&_test=ZC8vNQAE-STOuwBc
  • https://cm.g.doubleclick.net/pixel?google_nid=g8f47s39e399f3fe&google_push&google_sc&google_hm=WkM4dk5RQUUtU1RPdXdCYw
170 B
409 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=g8f47s39e399f3fe&google_push&google_sc&google_hm=WkM4dk5RQUUtU1RPdXdCYw
Requested by
Host: 9935087.fls.doubleclick.net
URL: https://9935087.fls.doubleclick.net/activityi;dc_pre=CLOLvNCPlv4CFarKOwIdJecJCg;src=9935087;type=impre0;cat=nerdw0;ord=5339313899788;gtm=45fe3430;auiddc=1494340267.1680813876;~oref=https%3A%2F%2Fciti-onlime.org%2F?
Protocol
H2
Server
142.250.186.98 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s06-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://9935087.fls.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 06 Apr 2023 20:44:37 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

x-served-by
cache-ams21070-AMS
pragma
no-cache
date
Thu, 06 Apr 2023 20:44:37 GMT
via
1.1 varnish
server
Jetty(9.4.35.v20201120)
x-timer
S1680813877.076331,VS0,VE91
x-cache
MISS
p3p
CP="NOI DSP COR LAW PSAo PSDo IVAo IVDo OUR BUS UNI DEM"
access-control-allow-origin
*
location
https://cm.g.doubleclick.net/pixel?google_nid=g8f47s39e399f3fe&google_push&google_sc&google_hm=WkM4dk5RQUUtU1RPdXdCYw
cache-control
no-cache
accept-ranges
bytes
content-length
0
x-cache-hits
0
dc_pre=CLOLvNCPlv4CFarKOwIdJecJCg;src=9935087;type=impre0;cat=nerdw0;ord=5339313899788;gtm=45fe3430;auiddc=*;~oref=https%3A%2F%2Fciti-onlime.org%2F
adservice.google.com/ddm/fls/z/ Frame 92E1 		42 B
401 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://adservice.google.com/ddm/fls/z/dc_pre=CLOLvNCPlv4CFarKOwIdJecJCg;src=9935087;type=impre0;cat=nerdw0;ord=5339313899788;gtm=45fe3430;auiddc=*;~oref=https%3A%2F%2Fciti-onlime.org%2F
Requested by
Host: 9935087.fls.doubleclick.net
URL: https://9935087.fls.doubleclick.net/activityi;dc_pre=CLOLvNCPlv4CFarKOwIdJecJCg;src=9935087;type=impre0;cat=nerdw0;ord=5339313899788;gtm=45fe3430;auiddc=1494340267.1680813876;~oref=https%3A%2F%2Fciti-onlime.org%2F?
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:810::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://9935087.fls.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 06 Apr 2023 20:44:36 GMT
x-content-type-options
nosniff
server
cafe
content-type
image/gif
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
st.v3.js
www.everestjs.net/static/ Frame 92E1 		27 KB
8 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.everestjs.net/static/st.v3.js
Requested by
Host: 9935087.fls.doubleclick.net
URL: https://9935087.fls.doubleclick.net/activityi;dc_pre=CLOLvNCPlv4CFarKOwIdJecJCg;src=9935087;type=impre0;cat=nerdw0;ord=5339313899788;gtm=45fe3430;auiddc=1494340267.1680813876;~oref=https%3A%2F%2Fciti-onlime.org%2F?
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
23.198.21.188 Amsterdam, Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-198-21-188.deploy.static.akamaitechnologies.com
Software
AmazonS3 /
Resource Hash
320404733f17617bd684063804b1843c3ee3e382310d8fdabdd06e13abd88ee8

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://9935087.fls.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

x-amz-version-id
null
Content-Encoding
gzip
Date
Thu, 06 Apr 2023 20:44:37 GMT
Last-Modified
Mon, 30 May 2022 07:20:57 GMT
Server
AmazonS3
x-amz-request-id
9QHF3WC07RHQDFYV
ETag
"3208570253e686b6b7b790e15c02caf7"
Vary
Accept-Encoding
Content-Type
text/javascript
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
7809
x-amz-id-2
qH829yVH3bjINltr/5T6Jw0erDtYkp7D7COwtbadxDUMx70rLcbOspfTRCsU3NWohnY0rf2XueM=
tv2track.php
collector-26294.us.tvsquared.com/ 		42 B
276 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://collector-26294.us.tvsquared.com/tv2track.php?action_name=Citibank%3A%20Checking%2C%20Savings%20and%20CDs%20-%20NerdWallet&idsite=TV-7236720954-1&rec=1&r=485394&h=20&m=44&s=37&url=https%3A%2F%2Fciti-onlime.org%2F&_id=b67663bf07ad8e93&_idts=1680813877&_idvc=0&_idn=1&_viewts=&pdf=1&qt=0&realp=0&wma=0&dir=0&fla=0&java=0&gears=0&ag=0&cookie=1&res=1600x1200&gt_ms=91
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.15.82.75 Columbus, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-3-15-82-75.us-east-2.compute.amazonaws.com
Software
nginx /
Resource Hash
f0c71e3da5b3fcab3c66af1cf0cdbf262c97b9330b7b37116f1ae2ab18bdc660

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://citi-onlime.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

P3p
CP='OTI DSP COR NID STP UNI OTPa OUR'
Date
Thu, 06 Apr 2023 20:44:37 GMT
Server
nginx
Connection
keep-alive
Request-Id
ec22cfde-f98d-4076-8885-33b477efa0c3
Content-Length
42
Content-Type
image/gif
ord=1680813877158
conv-pix.adstk.io/ad/ 		35 B
271 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://conv-pix.adstk.io/ad/ord=1680813877158?prd=web&cust=163797-000&event_type=visitHomepage&region_code=NA&version=0.2.0&utm_source=unk&utm_mdm=unk&url=https%3A%2F%2Fciti-onlime.org%2F&title=Citibank%3A%20Checking%2C%20Savings%20and%20CDs%20-%20NerdWallet&sess_status=st&sess=1680813976175&ref=
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
130.211.141.45 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
45.141.211.130.bc.googleusercontent.com
Software
nginx/1.20.0 /
Resource Hash
3992b901546ef4e2685680badcd372d0834724caf9b1c95ea0f1e7c4ce6e5bc8

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://citi-onlime.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

Date
Thu, 06 Apr 2023 20:44:37 GMT
Server
nginx/1.20.0
ETag
"560c609e-23"
Vary
Origin
Content-Type
image/gif
Access-Control-Allow-Origin
*
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
35
up
insight.adsrvr.org/track/ Frame 36EA 		0
182 B 		Document
General
Check archive.org
Download Go to
Full URL
https://insight.adsrvr.org/track/up?adv=9v9ko6z&ref=https%3A%2F%2Fciti-onlime.org%2F&upid=r0jxhyd&upv=1.1.0
Requested by
Host: js.adsrvr.org
URL: https://js.adsrvr.org/up_loader.1.1.0.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.71.131.137 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
a6370ebea231e0c9a.awsglobalaccelerator.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://9935087.fls.doubleclick.net/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36
accept-language
nl-NL,nl;q=0.9

Response headers

cache-control
private,no-cache, must-revalidate
content-type
text/html
date
Thu, 06 Apr 2023 20:44:37 GMT
p3p
CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
pragma
no-cache
x-aspnet-version
4.0.30319
pixel_details.html
www.everestjs.net/static/ Frame B83F
Redirect Chain
  • https://pixel.everesttech.net/10428/gr?ev_gb=0&url=https%3A%2F%2Fwww.everestjs.net%2Fstatic%2Fpixel_details.html%23google%3D__EFGCK__%26gsurfer%3D__EFGSURFER__%26imsId%3D__EFIMSORGID__%26optout%3D_...
  • https://www.everestjs.net/static/pixel_details.html
166 B
597 B 		Document
General
Check archive.org
Download Go to
Full URL
https://www.everestjs.net/static/pixel_details.html
Requested by
Host: www.everestjs.net
URL: https://www.everestjs.net/static/st.v3.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
23.198.21.188 Amsterdam, Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-198-21-188.deploy.static.akamaitechnologies.com
Software
AmazonS3 /
Resource Hash
769254457b771e41802cfbc21371888c7b2485ad5baddaacae3b25cd428e428a

Request headers

Referer
https://9935087.fls.doubleclick.net/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36
accept-language
nl-NL,nl;q=0.9

Response headers

Accept-Ranges
bytes
Connection
keep-alive
Content-Encoding
gzip
Content-Length
146
Content-Type
text/html
Date
Thu, 06 Apr 2023 20:44:37 GMT
ETag
"003ecf27f0c456effed26f884130b077"
Last-Modified
Mon, 15 Mar 2021 04:37:06 GMT
Server
AmazonS3
Vary
Accept-Encoding
x-amz-id-2
IvNkvGtM1Nnb4Y4CekiLJfFrL677BoFCfaLORDMftV1zKy0Jv/BeeSj5NWhUFiicAXf5L+Dwcq8=
x-amz-request-id
V3ZGP68NPCS5WKAV
x-amz-version-id
null

Redirect headers

Cache-Control
no-cache
Connection
keep-alive
Content-Length
356
Content-Type
text/html; charset=iso-8859-1
Date
Thu, 06 Apr 2023 20:44:37 GMT
Location
https://www.everestjs.net/static/pixel_details.html#google=ZC8vNQAE-STOuwBc&gsurfer=ZC8vNQAE-STOuwBc&imsId=&optout=0&throttleCookie=&time=20230406204437
P3P
CP="NOI DEVa TAIa PSAa PSDa OUR IND UNI COM NAV INT"
Server
Apache
sync
x.bidswitch.net/ul_cb/ Frame 369E
Redirect Chain
  • https://x.bidswitch.net/sync?dsp_id=46&user_id=k-hdIa1rSm4WAVQbcVbGCQLdoUOynJbWM0ii8lMA&expires=30
  • https://x.bidswitch.net/ul_cb/sync?dsp_id=46&user_id=k-hdIa1rSm4WAVQbcVbGCQLdoUOynJbWM0ii8lMA&expires=30
43 B
344 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://x.bidswitch.net/ul_cb/sync?dsp_id=46&user_id=k-hdIa1rSm4WAVQbcVbGCQLdoUOynJbWM0ii8lMA&expires=30
Protocol
H2
Server
52.28.222.35 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-52-28-222-35.eu-central-1.compute.amazonaws.com
Software
/
Resource Hash
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

date
Thu, 06 Apr 2023 20:44:37 GMT
cache-control
no-cache, no-store, must-revalidate
content-length
43
content-type
image/gif

Redirect headers

location
https://x.bidswitch.net/ul_cb/sync?dsp_id=46&user_id=k-hdIa1rSm4WAVQbcVbGCQLdoUOynJbWM0ii8lMA&expires=30
date
Thu, 06 Apr 2023 20:44:37 GMT
cache-control
no-cache, no-store, must-revalidate
content-length
0
cookiematch.aspx
dis.criteo.com/dis/rtb/google/ Frame 369E
Redirect Chain
  • https://cm.g.doubleclick.net/pixel?google_nid=cjp&google_sc&google_ula=913071&CriteoUserId=k-Cfm6sbSm4WAVQbcVbGCQLdoUOymHBIWxSN4e2g&google_cm&google_hm=ay1DZm02c2JTbTRXQVZRYmNWYkdDUUxkb1VPeW1IQklXe...
  • https://dis.criteo.com/dis/rtb/google/cookiematch.aspx?id=&CriteoUserId=k-Cfm6sbSm4WAVQbcVbGCQLdoUOymHBIWxSN4e2g&google_gid=CAESED3R3T7yVWTqBvET3FmWY6I&google_cver=1&google_ula=913071,0
43 B
370 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://dis.criteo.com/dis/rtb/google/cookiematch.aspx?id=&CriteoUserId=k-Cfm6sbSm4WAVQbcVbGCQLdoUOymHBIWxSN4e2g&google_gid=CAESED3R3T7yVWTqBvET3FmWY6I&google_cver=1&google_ula=913071,0
Protocol
H2
Server
178.250.1.9 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),
Reverse DNS
Software
Kestrel /
Resource Hash
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload;

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 06 Apr 2023 20:44:36 GMT
strict-transport-security
max-age=31536000; preload;
server
Kestrel
p3p
CP='NON DSP COR CURa PSA PSD OUR BUS NAV STA'
content-type
image/gif
cache-control
no-cache
cross-origin-resource-policy
cross-origin
server-processing-duration-in-ticks
841157
timing-allow-origin
*
expires
Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

pragma
no-cache
date
Thu, 06 Apr 2023 20:44:37 GMT
server
HTTP server (unknown)
content-type
text/html; charset=UTF-8
location
https://dis.criteo.com/dis/rtb/google/cookiematch.aspx?id=&CriteoUserId=k-Cfm6sbSm4WAVQbcVbGCQLdoUOymHBIWxSN4e2g&google_gid=CAESED3R3T7yVWTqBvET3FmWY6I&google_cver=1&google_ula=913071,0
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
398
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
cookiematch.aspx
dis.criteo.com/dis/rtb/appnexus/ Frame 369E
Redirect Chain
  • https://ib.adnxs.com/getuid?https://dis.criteo.com/dis/rtb/appnexus/cookiematch.aspx?appnxsid=$UID
  • https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fdis.criteo.com%2Fdis%2Frtb%2Fappnexus%2Fcookiematch.aspx%3Fappnxsid%3D%24UID
  • https://dis.criteo.com/dis/rtb/appnexus/cookiematch.aspx?appnxsid=371551623866893865
43 B
370 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://dis.criteo.com/dis/rtb/appnexus/cookiematch.aspx?appnxsid=371551623866893865
Protocol
H2
Server
178.250.1.9 , France, ASN44788 (ASN-CRITEO-EUROPE, FR),
Reverse DNS
Software
Kestrel /
Resource Hash
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload;

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 06 Apr 2023 20:44:36 GMT
strict-transport-security
max-age=31536000; preload;
server
Kestrel
p3p
CP='NON DSP COR CURa PSA PSD OUR BUS NAV STA'
content-type
image/gif
cache-control
no-cache
cross-origin-resource-policy
cross-origin
server-processing-duration-in-ticks
1460949
timing-allow-origin
*
expires
Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

Date
Thu, 06 Apr 2023 20:44:37 GMT
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Connection
keep-alive
X-Proxy-Origin
95.211.95.247; 95.211.95.247; 947.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
Content-Length
0
X-XSS-Protection
0
Pragma
no-cache
AN-X-Request-Uuid
aabbc666-9d05-4fde-87ca-c91564ae28c1
Server
nginx/1.21.3
Accept-CH
Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type
text/html; charset=utf-8
Access-Control-Allow-Origin
*
Location
https://dis.criteo.com/dis/rtb/appnexus/cookiematch.aspx?appnxsid=371551623866893865
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Expires
Sat, 15 Nov 2008 16:00:00 GMT
bounce
secure.adnxs.com/ Frame 369E
Redirect Chain
  • https://secure.adnxs.com/setuid?entity=52&code=k-ENoMe7Sm4WAVQbcVbGCQLdoUOymTCXlY1cVCTQ
  • https://secure.adnxs.com/bounce?%2Fsetuid%3Fentity%3D52%26code%3Dk-ENoMe7Sm4WAVQbcVbGCQLdoUOymTCXlY1cVCTQ
43 B
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://secure.adnxs.com/bounce?%2Fsetuid%3Fentity%3D52%26code%3Dk-ENoMe7Sm4WAVQbcVbGCQLdoUOymTCXlY1cVCTQ
Protocol
HTTP/1.1
Server
185.89.210.46 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),
Reverse DNS
940.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net
Software
nginx/1.23.2 /
Resource Hash
4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

Pragma
no-cache
Date
Thu, 06 Apr 2023 20:44:37 GMT
AN-X-Request-Uuid
af45cc32-9eb8-417c-b45e-5d6f07b1d83f
Server
nginx/1.23.2
Accept-CH
Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type
image/gif
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin
*
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
X-Proxy-Origin
95.211.95.247; 95.211.95.247; 940.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
Content-Length
43
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

Pragma
no-cache
Date
Thu, 06 Apr 2023 20:44:37 GMT
AN-X-Request-Uuid
335193b5-80b9-4cd7-bfd7-f999460fcd01
Server
nginx/1.23.2
Accept-CH
Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type
text/html; charset=utf-8
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location
https://secure.adnxs.com/bounce?%2Fsetuid%3Fentity%3D52%26code%3Dk-ENoMe7Sm4WAVQbcVbGCQLdoUOymTCXlY1cVCTQ
Cache-Control
no-store, no-cache, private
Connection
keep-alive
X-Proxy-Origin
95.211.95.247; 95.211.95.247; 940.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
cksync.php
contextual.media.net/ Frame 369E 		61 B
804 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://contextual.media.net/cksync.php?cs=3&type=crt&ovsid=k-RK1_z7Sm4WAVQbcVbGCQLdoUOykOwwfJuzhRxQ
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2.18.235.93 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a2-18-235-93.deploy.static.akamaitechnologies.com
Software
Apache /
Resource Hash
cc0e716595a20cd577f4cba25c11b4b54d92311f5f4bf22b992af281cabbc0c7
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

pragma
no-cache
strict-transport-security
max-age=31536000
date
Thu, 06 Apr 2023 20:44:37 GMT
server
Apache
p3p
CP="NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA", CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA, CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA, CP: NON DSP COR NID CUR ADMa DEVo TAI PSA PSDo HIS OUR BUS COM NAV INT STA
content-type
image/gif
cache-control
max-age=0, no-cache, no-store
content-length
61
x-mnet-hl2
E
expires
Thu, 06 Apr 2023 20:44:37 GMT
tap.php
pixel.rubiconproject.com/ Frame 369E 		0
239 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pixel.rubiconproject.com/tap.php?v=6434&nid=2149&put=k-6i_5o7Sm4WAVQbcVbGCQLdoUOykEvPTa4IlTcg&expires=30
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_CBC
Server
69.173.144.165 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

Content-Type
image/gif
Pragma
no-cache
Expires
0
Cache-Control
no-cache,no-store,must-revalidate
X-RPHost
4cdacfaa68e4ab216fffbcc107c5b898
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
v1
match.sharethrough.com/sync/ Frame 369E 		0
362 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://match.sharethrough.com/sync/v1?source_id=7658cb1d77a660882b48db06&source_user_id=k-LuGBI7Sm4WAVQbcVbGCQLdoUOyl6V2jVoQh0rw
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.64.32.26 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-3-64-32-26.eu-central-1.compute.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

date
Thu, 06 Apr 2023 20:44:37 GMT
/
rtb-csync.smartadserver.com/redir/ Frame 369E 		43 B
114 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://rtb-csync.smartadserver.com/redir/?partnerid=79&partneruserid=k-iTrh3bSm4WAVQbcVbGCQLdoUOylqxNWECCd-bQ
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
185.86.139.93 , France, ASN201081 (SMARTADSERVER, FR),
Reverse DNS
Software
/
Resource Hash
89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

date
Thu, 06 Apr 2023 20:44:36 GMT
content-type
image/gif
/
sync-t1.taboola.com/sg/criteortb-network/1/rtb-h/ Frame 369E 		0
99 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://sync-t1.taboola.com/sg/criteortb-network/1/rtb-h/?taboola_hm=k-IQFWgrSm4WAVQbcVbGCQLdoUOymJcPYuRyezGQ
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
141.226.228.48 , Netherlands, ASN200478 (TABOOLA-AS, IL),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

date
Thu, 06 Apr 2023 20:44:37 GMT
access-control-allow-credentials
true
server
nginx
x-fastly-to-nlb-rtt
12574
um
criteo-sync.teads.tv/ Frame 369E 		23 B
172 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://criteo-sync.teads.tv/um?eid=80&uid=k-orcU8rSm4WAVQbcVbGCQLdoUOyntTJqP8qyeLg
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.102.35.84 Hamburg, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-102-35-84.deploy.static.akamaitechnologies.com
Software
akka-http/10.2.10 /
Resource Hash
328e90a318268aea96180cc31666ae6d6f79d90d078c123bc3d98ee08a192fb7

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

expires
Thu, 06 Apr 2023 20:44:37 GMT
pragma
no-cache
date
Thu, 06 Apr 2023 20:44:37 GMT
cache-control
max-age=0, no-cache, no-store
server
akka-http/10.2.10
content-length
23
content-type
image/gif
xuid
eb2.3lift.com/ Frame 369E 		37 B
140 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://eb2.3lift.com/xuid?mid=2711&xuid=k-KKoJHLSm4WAVQbcVbGCQLdoUOymwUTC3Zb40oQ&dongle=013b
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
13.248.245.213 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
a0f671730127a0812.awsglobalaccelerator.com
Software
/
Resource Hash
bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

date
Thu, 06 Apr 2023 20:44:37 GMT
cache-control
no-cache, no-store, must-revalidate
content-length
37
content-type
image/gif
sync
ups.analytics.yahoo.com/ups/58301/ Frame 369E 		0
399 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ups.analytics.yahoo.com/ups/58301/sync?_origin=1&uid=k-Y2c4ebSm4WAVQbcVbGCQLdoUOylHU8oO0hFUAg
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
3.75.62.37 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-3-75-62-37.eu-central-1.compute.amazonaws.com
Software
ATS/9.1.10.25 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

date
Thu, 06 Apr 2023 20:44:37 GMT
strict-transport-security
max-age=31536000
server
ATS/9.1.10.25
age
0
p3p
CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV
pixel
cm.adform.net/ Frame 369E 		43 B
163 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cm.adform.net/pixel?adform_pid=15&adform_pc=k-geDVQbSm4WAVQbcVbGCQLdoUOyketeHFllESBQ
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
37.157.3.30 , Denmark, ASN198622 (ADFORM, DK),
Reverse DNS
Software
nginx /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

date
Thu, 06 Apr 2023 20:44:37 GMT
last-modified
Fri, 07 Feb 2020 08:03:24 GMT
server
nginx
accept-ranges
bytes
etag
"5e3d19cc-2b"
content-length
43
content-type
image/gif
sync
visitor.omnitagjs.com/visitor/ Frame 369E 		49 B
235 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://visitor.omnitagjs.com/visitor/sync?uid=732efe97317e6352de4c1caf24b5064b&name=CRITEO&visitor=k-x1cMH7Sm4WAVQbcVbGCQLdoUOynBE0Qbi0IdnA
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
185.255.84.153 , France, ASN200271 (IGUANE-, FR),
Reverse DNS
Software
ayl-lb-fra02 /
Resource Hash
d1371feb0512d700cf724b05a588ce79f8d8dfbb0991ae5f45ecd3ab08983a38
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 06 Apr 2023 20:44:37 GMT
x-content-type-options
nosniff
server
ayl-lb-fra02
vary
Accept-Encoding
content-type
image/gif
cache-control
no-cache, no-store, must-revalidate
x-envoy-upstream-service-time
1
content-length
49
expires
0
rum
r.casalemedia.com/ Frame 369E
Redirect Chain
  • https://r.casalemedia.com/rum?cm_dsp_id=20&external_user_id=k-A2-V1rSm4WAVQbcVbGCQLdoUOymjEEUkI0XYuQ
  • https://r.casalemedia.com/rum?cm_dsp_id=20&external_user_id=k-A2-V1rSm4WAVQbcVbGCQLdoUOymjEEUkI0XYuQ&C=1
43 B
766 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://r.casalemedia.com/rum?cm_dsp_id=20&external_user_id=k-A2-V1rSm4WAVQbcVbGCQLdoUOymjEEUkI0XYuQ&C=1
Protocol
HTTP/1.1
Server
185.80.39.216 , Canada, ASN27381 (CASALE-MEDIA, CA),
Reverse DNS
Software
Apache /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

Pragma
no-cache
Date
Thu, 06 Apr 2023 20:44:37 GMT
Server
Apache
P3p
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Content-Type
image/gif
Cache-Control
no-cache
Connection
Keep-Alive
Keep-Alive
timeout=1, max=499
Content-Length
43
Expires
0

Redirect headers

Pragma
no-cache
Date
Thu, 06 Apr 2023 20:44:37 GMT
Server
Apache
P3p
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Location
/rum?cm_dsp_id=20&external_user_id=k-A2-V1rSm4WAVQbcVbGCQLdoUOymjEEUkI0XYuQ&C=1
Cache-Control
no-cache
Connection
Keep-Alive
Keep-Alive
timeout=1, max=500
Content-Length
0
Expires
0
demconf.jpg
dpm.demdex.net/ Frame 369E
Redirect Chain
  • https://gum.criteo.com/sync?c=8&r=1&a=1&u=https%3A%2F%2Fdpm.demdex.net%2Fibs%3Adpid%3D28645%26dpuuid%3D%40USERID%40
  • https://dpm.demdex.net/ibs:dpid=28645&dpuuid=20_d5pgiE7y8vvnvRd8t9l30UweDixHT
  • https://dpm.demdex.net/demconf.jpg?et:ibs%7cdata:dpid=28645&dpuuid=20_d5pgiE7y8vvnvRd8t9l30UweDixHT
42 B
942 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://dpm.demdex.net/demconf.jpg?et:ibs%7cdata:dpid=28645&dpuuid=20_d5pgiE7y8vvnvRd8t9l30UweDixHT
Protocol
HTTP/1.1
Server
34.241.134.204 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-34-241-134-204.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

DCS
dcs-prod-irl1-2-v046-04caab9e7.edge-irl1.demdex.com 4 ms
Pragma
no-cache
Strict-Transport-Security
max-age=31536000; includeSubDomains
content-encoding
gzip
X-Content-Type-Options
nosniff
X-TID
6Efqp2gBRvI=
P3P
policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Content-Type
image/gif
Cache-Control
no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection
keep-alive
Content-Length
59
Expires
Thu, 01 Jan 1970 00:00:00 UTC

Redirect headers

DCS
dcs-prod-irl1-1-v046-06ab52116.edge-irl1.demdex.com 0 ms
Pragma
no-cache
Strict-Transport-Security
max-age=31536000; includeSubDomains
X-TID
dFehurOTR5Y=
P3P
policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Location
https://dpm.demdex.net/demconf.jpg?et:ibs%7cdata:dpid=28645&dpuuid=20_d5pgiE7y8vvnvRd8t9l30UweDixHT
Cache-Control
no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection
keep-alive
Content-Length
0
Expires
Thu, 01 Jan 1970 00:00:00 UTC
9.gif
id5-sync.com/s/966/ Frame 369E 		43 B
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://id5-sync.com/s/966/9.gif?puid=k-5mpFHLSm4WAVQbcVbGCQLdoUOykh1Xh-e9BQAQ
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
141.95.98.65 , France, ASN16276 (OVH, FR),
Reverse DNS
ns3216659.ip-141-95-98.eu
Software
/
Resource Hash
a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubDomains; preload

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

content-type
image/gif;charset=UTF-8
date
Thu, 06 Apr 2023 20:44:36 GMT
strict-transport-security
max-age=63072000; includeSubDomains; preload
vary
Origin, Access-Control-Request-Method, Access-Control-Request-Headers
transfer-encoding
chunked
p3p
CP="CAO PSA OUR"
match
ad.360yield.com/ul_cb/ Frame 369E
Redirect Chain
  • https://ad.360yield.com/match?publisher_dsp_id=38&external_user_id=k-iChjS7Sm4WAVQbcVbGCQLdoUOynYZIGk_PqUTw
  • https://ad.360yield.com/ul_cb/match?publisher_dsp_id=38&external_user_id=k-iChjS7Sm4WAVQbcVbGCQLdoUOynYZIGk_PqUTw
43 B
448 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ad.360yield.com/ul_cb/match?publisher_dsp_id=38&external_user_id=k-iChjS7Sm4WAVQbcVbGCQLdoUOynYZIGk_PqUTw
Protocol
H2
Server
52.208.99.252 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-52-208-99-252.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

access-control-allow-origin
*
date
Thu, 06 Apr 2023 20:44:37 GMT
content-type
image/gif
content-length
43
p3p
CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"

Redirect headers

location
https://ad.360yield.com/ul_cb/match?publisher_dsp_id=38&external_user_id=k-iChjS7Sm4WAVQbcVbGCQLdoUOynYZIGk_PqUTw
access-control-allow-origin
*
date
Thu, 06 Apr 2023 20:44:37 GMT
content-type
text/plain
content-length
0
p3p
CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
sync
matching.ivitrack.com/ Frame 369E 		42 B
274 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://matching.ivitrack.com/sync?realm=criteo&uid=k-yHppFLSm4WAVQbcVbGCQLdoUOyniXV-QuACepg
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.117.157.22 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
22.157.117.34.bc.googleusercontent.com
Software
istio-envoy /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

date
Thu, 06 Apr 2023 20:44:37 GMT
x-envoy-decorator-operation
tag-manager.programmatic.svc.cluster.local:3000/*
via
1.1 google
server
istio-envoy
content-type
image/gif
cache-control
public, max-age=86400
x-envoy-upstream-service-time
0
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
42
push
exchange.mediavine.com/usersync/ Frame 369E 		0
884 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://exchange.mediavine.com/usersync/push?partner=criteo&partnerId=k-lrGAprSm4WAVQbcVbGCQLdoUOyl94xpl6CG3tw
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.58.211.21 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-52-58-211-21.eu-central-1.compute.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

date
Thu, 06 Apr 2023 20:44:37 GMT
cache-control
private, no-cache
access-control-allow-credentials
true
content-encoding
gzip
vary
Origin, Accept-Encoding
content-type
text/html; charset=utf-8
cookie-sync
sync.outbrain.com/ Frame 369E 		0
145 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://sync.outbrain.com/cookie-sync?p=criteo&uid=k-ZTN-4bSm4WAVQbcVbGCQLdoUOyknAoU35DgJsQ&initiator=partner
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
70.42.32.127 , United States, ASN13789 (INTERNAP-BLK3, US),
Reverse DNS
ny.outbrain.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

Date
Thu, 06 Apr 2023 20:44:37 GMT
Cache-Control
no-cache
X-TraceId
92fe6b3b058d4f41f72b3d34fb98936e
Content-Length
0
Pug
simage2.pubmatic.com/AdServer/ Frame 369E 		42 B
581 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTE5MjgmdGw9NDMyMDA=&piggybackCookie=uid:k-adAz-7Sm4WAVQbcVbGCQLdoUOymBlP33_XHHfQ
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
185.64.189.110 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
nginx /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

content-type
image/gif; charset=utf-8
date
Thu, 06 Apr 2023 20:44:37 GMT
cache-control
no-store, no-cache, private
server
nginx
content-length
42
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
sync
criteo-partners.tremorhub.com/ Frame 369E 		43 B
407 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://criteo-partners.tremorhub.com/sync?UICR=k-AbhLT7Sm4WAVQbcVbGCQLdoUOymjVqfhb1U4vg
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2600:1f18:612b:4232:d8df:442e:b8f5:5c88 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software
Apache-Coyote/1.1 /
Resource Hash
a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

p3p
CP='This is not a P3P policy. See https://telaria.com/privacy-policy/'
date
Thu, 06 Apr 2023 20:44:38 GMT
server
Apache-Coyote/1.1
content-type
image/gif
m
ad.yieldlab.net/ Frame 369E 		0
235 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ad.yieldlab.net/m?dt_id=8664&ext_id=k--eSDDLSm4WAVQbcVbGCQLdoUOykDR-aHV3DRMA
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
184.28.181.42 Berlin, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a184-28-181-42.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

Pragma
no-cache
Date
Thu, 06 Apr 2023 20:44:37 GMT
Cache-Control
no-store,no-cache,max-age=-3600,must-revalidate,post-check=0,pre-check=0
Connection
keep-alive
Expires
Wed, 05 Apr 2023 20:44:37 GMT
sync
sync-criteo.ads.yieldmo.com/ Frame 369E 		0
38 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://sync-criteo.ads.yieldmo.com/sync?id=k-vUSy2rSm4WAVQbcVbGCQLdoUOykxuUaJU1D9xg&pn_id=criteo&ext=1
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
63.32.242.157 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-63-32-242-157.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

date
Thu, 06 Apr 2023 20:44:37 GMT
content-length
0
t
pixel.everesttech.net/10428/ Frame 92E1 		128 B
705 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pixel.everesttech.net/10428/t?ev_NW_universal%20LP=1&ev_transid=
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.78.156.59 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-54-78-156-59.eu-west-1.compute.amazonaws.com
Software
Apache /
Resource Hash
bf94db5c7d218f9a2a2edfff6c01bf65f5946a32000cd41835fee5b564efa62f

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://9935087.fls.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

Date
Thu, 06 Apr 2023 20:44:37 GMT
Last-Modified
Mon, 19 Jul 2021 07:56:25 GMT
Server
Apache
ETag
"b3b521-80-5c775461d9c40"
Vary
Cookie
P3P
CP="NOI DEVa TAIa PSAa PSDa OUR IND UNI COM NAV INT", CP="NOI NID DEVa PSAa PSDa OUR IND PUR COM NAV INT DEM"
Content-Type
image/png
Cache-Control
no-cache, no-cache
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
128
1x1
pixel.everesttech.net/ Frame 92E1
Redirect Chain
  • https://cm.everesttech.net/cm
  • https://cm.g.doubleclick.net/pixel?google_nid=everest&google_cm&google_sc&ev_rs=1&url=/1x1&google_hm=WkM4dk5RQUUtU1RPdXdCYw
  • https://cm.everesttech.net/cm/ax?cookieid=&ev_rs=1&url=/1x1&google_gid=CAESEC7k-7nSXgrxWjIv0i_a2HQ&google_cver=1
  • https://pixel.everesttech.net/1x1
128 B
691 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pixel.everesttech.net/1x1
Protocol
HTTP/1.1
Server
54.78.156.59 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-54-78-156-59.eu-west-1.compute.amazonaws.com
Software
Apache /
Resource Hash
bf94db5c7d218f9a2a2edfff6c01bf65f5946a32000cd41835fee5b564efa62f

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://9935087.fls.doubleclick.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

Date
Thu, 06 Apr 2023 20:44:37 GMT
Last-Modified
Mon, 19 Jul 2021 07:56:25 GMT
Server
Apache
ETag
"36b521-80-5c775461d9c40"
P3P
CP="NOI DEVa TAIa PSAa PSDa OUR IND UNI COM NAV INT", CP="NOI NID DEVa PSAa PSDa OUR IND PUR COM NAV INT DEM"
Content-Type
image/png
Cache-Control
no-cache, no-cache
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
128

Redirect headers

Location
https://pixel.everesttech.net/1x1
Date
Thu, 06 Apr 2023 20:44:37 GMT
Cache-Control
no-cache
Server
AMO-cookiemap/1.1
Connection
keep-alive
Content-Length
0
P3P
CP="NOI NID DEVa PSAa PSDa OUR IND PUR COM NAV INT DEM"
usermatch.gif
beacon.krxd.net/ Frame 369E
Redirect Chain
  • https://gum.criteo.com/sync?c=83&r=1&a=1&u=https%3A%2F%2Fbeacon.krxd.net%2Fusermatch.gif%3Fpartner%3Dcriteo%26partner_uid%3D%40USERID%40
  • https://beacon.krxd.net/usermatch.gif?partner=criteo&partner_uid=6szFSK6wvyiIUPpo1Y4CTAauw6RrMhlq
0
338 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://beacon.krxd.net/usermatch.gif?partner=criteo&partner_uid=6szFSK6wvyiIUPpo1Y4CTAauw6RrMhlq
Protocol
H2
Server
52.213.74.200 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-52-213-74-200.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

x-served-by
beacon-n010-dub-prod.krxd.net
date
Thu, 06 Apr 2023 20:44:37 GMT
cache-control
private, no-cache, no-store
x-request-time
D=31 t=1680813877
p3p
policyref="https://cdn.krxd.net/kruxcontent/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

Redirect headers

location
https://beacon.krxd.net/usermatch.gif?partner=criteo&partner_uid=6szFSK6wvyiIUPpo1Y4CTAauw6RrMhlq
date
Thu, 06 Apr 2023 20:44:37 GMT
cache-control
private, max-age=0, no-cache, no-store, must-revalidate
strict-transport-security
max-age=31536000; preload;
server
Kestrel
server-processing-duration-in-ticks
1347167
content-length
0
unip
trc-events.taboola.com/1013989/log/3/ 		0
245 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://trc-events.taboola.com/1013989/log/3/unip?en=pre_d_eng_tb&tos=1552&scd=0&ssd=1&est=1680813876115&ver=36&isls=true&src=i&invt=1500&msa=4671&rv=1&tim=1680813877666&vi=1680813876112&ri=7d4e74569b6e673a7f5344027c5a3f7b&ref=null&cv=20230330-9-RELEASE&item-url=https%3A%2F%2Fciti-onlime.org%2F
Requested by
Host: cdn.taboola.com
URL: https://cdn.taboola.com/libtrc/unip/1040862/tfa.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
141.226.228.48 , Netherlands, ASN200478 (TABOOLA-AS, IL),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://citi-onlime.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

access-control-allow-origin
https://citi-onlime.org
pragma
no-cache
date
Thu, 06 Apr 2023 20:44:37 GMT
cache-control
no-cache
access-control-allow-credentials
true
server
nginx
p3p
policyref="http://trc.taboola.com/p3p.xml", CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM"
unip
trc-events.taboola.com/1040862/log/3/ 		0
245 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://trc-events.taboola.com/1040862/log/3/unip?en=pre_d_eng_tb&tos=1553&scd=0&ssd=1&est=1680813876115&ver=36&isls=true&src=i&invt=1500&msa=4671&rv=1&tim=1680813877668&vi=1680813876112&ri=f5464b4cd1787b1b2dd8df99666ed3b6&ref=null&cv=20230330-9-RELEASE&item-url=https%3A%2F%2Fciti-onlime.org%2F
Requested by
Host: cdn.taboola.com
URL: https://cdn.taboola.com/libtrc/unip/1040862/tfa.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
141.226.228.48 , Netherlands, ASN200478 (TABOOLA-AS, IL),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://citi-onlime.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

access-control-allow-origin
https://citi-onlime.org
pragma
no-cache
date
Thu, 06 Apr 2023 20:44:37 GMT
cache-control
no-cache
access-control-allow-credentials
true
server
nginx
p3p
policyref="http://trc.taboola.com/p3p.xml", CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM"
unip
trc-events.taboola.com/1066022/log/3/ 		0
245 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://trc-events.taboola.com/1066022/log/3/unip?en=pre_d_eng_tb&tos=1553&scd=0&ssd=1&est=1680813876115&ver=36&isls=true&src=i&invt=1500&msa=4671&rv=1&tim=1680813877668&vi=1680813876112&ri=ac7652aebb97ca2865fb8601f75cad52&ref=null&cv=20230330-9-RELEASE&item-url=https%3A%2F%2Fciti-onlime.org%2F
Requested by
Host: cdn.taboola.com
URL: https://cdn.taboola.com/libtrc/unip/1040862/tfa.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
141.226.228.48 , Netherlands, ASN200478 (TABOOLA-AS, IL),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://citi-onlime.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

access-control-allow-origin
https://citi-onlime.org
pragma
no-cache
date
Thu, 06 Apr 2023 20:44:37 GMT
cache-control
no-cache
access-control-allow-credentials
true
server
nginx
p3p
policyref="http://trc.taboola.com/p3p.xml", CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM"
unip
trc-events.taboola.com/1066024/log/3/ 		0
245 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://trc-events.taboola.com/1066024/log/3/unip?en=pre_d_eng_tb&tos=1553&scd=0&ssd=1&est=1680813876115&ver=36&isls=true&src=i&invt=1500&msa=4671&rv=1&tim=1680813877668&vi=1680813876112&ri=e5231f9b2a60682d190cb000877d4e19&ref=null&cv=20230330-9-RELEASE&item-url=https%3A%2F%2Fciti-onlime.org%2F
Requested by
Host: cdn.taboola.com
URL: https://cdn.taboola.com/libtrc/unip/1040862/tfa.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
141.226.228.48 , Netherlands, ASN200478 (TABOOLA-AS, IL),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://citi-onlime.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

access-control-allow-origin
https://citi-onlime.org
pragma
no-cache
date
Thu, 06 Apr 2023 20:44:37 GMT
cache-control
no-cache
access-control-allow-credentials
true
server
nginx
p3p
policyref="http://trc.taboola.com/p3p.xml", CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM"
unip
trc-events.taboola.com/1066025/log/3/ 		0
245 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://trc-events.taboola.com/1066025/log/3/unip?en=pre_d_eng_tb&tos=1553&scd=0&ssd=1&est=1680813876115&ver=36&isls=true&src=i&invt=1500&msa=4671&rv=1&tim=1680813877668&vi=1680813876112&ri=d46985642326bce13feb413766f60774&ref=null&cv=20230330-9-RELEASE&item-url=https%3A%2F%2Fciti-onlime.org%2F
Requested by
Host: cdn.taboola.com
URL: https://cdn.taboola.com/libtrc/unip/1040862/tfa.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
141.226.228.48 , Netherlands, ASN200478 (TABOOLA-AS, IL),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://citi-onlime.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

access-control-allow-origin
https://citi-onlime.org
pragma
no-cache
date
Thu, 06 Apr 2023 20:44:37 GMT
cache-control
no-cache
access-control-allow-credentials
true
server
nginx
p3p
policyref="http://trc.taboola.com/p3p.xml", CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM"
unip
trc-events.taboola.com/1077523/log/3/ 		0
245 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://trc-events.taboola.com/1077523/log/3/unip?en=pre_d_eng_tb&tos=1554&scd=0&ssd=1&est=1680813876115&ver=36&isls=true&src=i&invt=1500&msa=4671&rv=1&tim=1680813877669&vi=1680813876112&ri=ee3f82aba222778f717eb800a53d7af4&ref=null&cv=20230330-9-RELEASE&item-url=https%3A%2F%2Fciti-onlime.org%2F
Requested by
Host: cdn.taboola.com
URL: https://cdn.taboola.com/libtrc/unip/1040862/tfa.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
141.226.228.48 , Netherlands, ASN200478 (TABOOLA-AS, IL),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://citi-onlime.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

access-control-allow-origin
https://citi-onlime.org
pragma
no-cache
date
Thu, 06 Apr 2023 20:44:37 GMT
cache-control
no-cache
access-control-allow-credentials
true
server
nginx
p3p
policyref="http://trc.taboola.com/p3p.xml", CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM"
unip
trc-events.taboola.com/1187553/log/3/ 		0
245 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://trc-events.taboola.com/1187553/log/3/unip?en=pre_d_eng_tb&tos=1554&scd=0&ssd=1&est=1680813876115&ver=36&isls=true&src=i&invt=1500&msa=4671&rv=1&tim=1680813877669&vi=1680813876112&ri=6d2ac62ecfd5f279f2305a472e232814&ref=null&cv=20230330-9-RELEASE&item-url=https%3A%2F%2Fciti-onlime.org%2F
Requested by
Host: cdn.taboola.com
URL: https://cdn.taboola.com/libtrc/unip/1040862/tfa.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
141.226.228.48 , Netherlands, ASN200478 (TABOOLA-AS, IL),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://citi-onlime.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

access-control-allow-origin
https://citi-onlime.org
pragma
no-cache
date
Thu, 06 Apr 2023 20:44:37 GMT
cache-control
no-cache
access-control-allow-credentials
true
server
nginx
p3p
policyref="http://trc.taboola.com/p3p.xml", CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM"
unip
trc-events.taboola.com/1236271/log/3/ 		0
245 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://trc-events.taboola.com/1236271/log/3/unip?en=pre_d_eng_tb&tos=1554&scd=0&ssd=1&est=1680813876115&ver=36&isls=true&src=i&invt=1500&msa=4671&rv=1&tim=1680813877669&vi=1680813876112&ri=9a97635eb0ce907099e9e427d38d2ac5&ref=null&cv=20230330-9-RELEASE&item-url=https%3A%2F%2Fciti-onlime.org%2F
Requested by
Host: cdn.taboola.com
URL: https://cdn.taboola.com/libtrc/unip/1040862/tfa.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
141.226.228.48 , Netherlands, ASN200478 (TABOOLA-AS, IL),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://citi-onlime.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

access-control-allow-origin
https://citi-onlime.org
pragma
no-cache
date
Thu, 06 Apr 2023 20:44:37 GMT
cache-control
no-cache
access-control-allow-credentials
true
server
nginx
p3p
policyref="http://trc.taboola.com/p3p.xml", CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM"
unip
trc-events.taboola.com/1248680/log/3/ 		0
245 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://trc-events.taboola.com/1248680/log/3/unip?en=pre_d_eng_tb&tos=1554&scd=0&ssd=1&est=1680813876115&ver=36&isls=true&src=i&invt=1500&msa=4671&rv=1&tim=1680813877669&vi=1680813876112&ri=67bd45c2c57092bf032aa45f5d589059&ref=null&cv=20230330-9-RELEASE&item-url=https%3A%2F%2Fciti-onlime.org%2F
Requested by
Host: cdn.taboola.com
URL: https://cdn.taboola.com/libtrc/unip/1040862/tfa.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
141.226.228.48 , Netherlands, ASN200478 (TABOOLA-AS, IL),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://citi-onlime.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

access-control-allow-origin
https://citi-onlime.org
pragma
no-cache
date
Thu, 06 Apr 2023 20:44:37 GMT
cache-control
no-cache
access-control-allow-credentials
true
server
nginx
p3p
policyref="http://trc.taboola.com/p3p.xml", CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM"
unip
trc-events.taboola.com/1374610/log/3/ 		0
245 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://trc-events.taboola.com/1374610/log/3/unip?en=pre_d_eng_tb&tos=1554&scd=0&ssd=1&est=1680813876115&ver=36&isls=true&src=i&invt=1500&msa=4671&rv=1&tim=1680813877669&vi=1680813876112&ri=2cad262287ef2dd848af1a5e13d83fc0&ref=null&cv=20230330-9-RELEASE&item-url=https%3A%2F%2Fciti-onlime.org%2F
Requested by
Host: cdn.taboola.com
URL: https://cdn.taboola.com/libtrc/unip/1040862/tfa.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
141.226.228.48 , Netherlands, ASN200478 (TABOOLA-AS, IL),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://citi-onlime.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

access-control-allow-origin
https://citi-onlime.org
pragma
no-cache
date
Thu, 06 Apr 2023 20:44:37 GMT
cache-control
no-cache
access-control-allow-credentials
true
server
nginx
p3p
policyref="http://trc.taboola.com/p3p.xml", CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM"
unip
trc-events.taboola.com/1375849/log/3/ 		0
245 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://trc-events.taboola.com/1375849/log/3/unip?en=pre_d_eng_tb&tos=1555&scd=0&ssd=1&est=1680813876115&ver=36&isls=true&src=i&invt=1500&msa=4671&rv=1&tim=1680813877670&vi=1680813876112&ri=1ce15c6763ce0ffc56730bb63e56b1e0&ref=null&cv=20230330-9-RELEASE&item-url=https%3A%2F%2Fciti-onlime.org%2F
Requested by
Host: cdn.taboola.com
URL: https://cdn.taboola.com/libtrc/unip/1040862/tfa.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
141.226.228.48 , Netherlands, ASN200478 (TABOOLA-AS, IL),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://citi-onlime.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

access-control-allow-origin
https://citi-onlime.org
pragma
no-cache
date
Thu, 06 Apr 2023 20:44:37 GMT
cache-control
no-cache
access-control-allow-credentials
true
server
nginx
p3p
policyref="http://trc.taboola.com/p3p.xml", CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM"
unip
trc-events.taboola.com/1427379/log/3/ 		0
245 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://trc-events.taboola.com/1427379/log/3/unip?en=pre_d_eng_tb&tos=1555&scd=0&ssd=1&est=1680813876115&ver=36&isls=true&src=i&invt=1500&msa=4671&rv=1&tim=1680813877670&vi=1680813876112&ri=0d2bb20221049e647d1f6adde31dbb1c&ref=null&cv=20230330-9-RELEASE&item-url=https%3A%2F%2Fciti-onlime.org%2F
Requested by
Host: cdn.taboola.com
URL: https://cdn.taboola.com/libtrc/unip/1040862/tfa.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
141.226.228.48 , Netherlands, ASN200478 (TABOOLA-AS, IL),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://citi-onlime.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

access-control-allow-origin
https://citi-onlime.org
pragma
no-cache
date
Thu, 06 Apr 2023 20:44:37 GMT
cache-control
no-cache
access-control-allow-credentials
true
server
nginx
p3p
policyref="http://trc.taboola.com/p3p.xml", CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM"
cs
s.thebrighttag.com/ Frame 369E
Redirect Chain
  • https://gum.criteo.com/sync?c=10&r=1&u=https%3A%2F%2Fs.thebrighttag.com%2Fcs%3Fbtt%3D0%26tp%3Dcr%26uid%3D%40USERID%40
  • https://s.thebrighttag.com/cs?btt=0&tp=cr&uid=jXB1fh-fROwsllvuGaPmKH9JjiW_7JeE
35 B
268 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://s.thebrighttag.com/cs?btt=0&tp=cr&uid=jXB1fh-fROwsllvuGaPmKH9JjiW_7JeE
Protocol
H2
Server
3.136.129.62 Columbus, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-3-136-129-62.us-east-2.compute.amazonaws.com
Software
nginx /
Resource Hash
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 06 Apr 2023 20:44:38 GMT
x-bt-requestid
d8dbcdd0-d4bb-11ed-b0ac-0000ac1702a8
server
nginx
content-type
image/gif
access-control-allow-origin
p3p
CP=NOI DSP COR NID
cache-control
private, must-revalidate
content-length
35
expires
Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

location
https://s.thebrighttag.com/cs?btt=0&tp=cr&uid=jXB1fh-fROwsllvuGaPmKH9JjiW_7JeE
date
Thu, 06 Apr 2023 20:44:37 GMT
cache-control
private, max-age=0, no-cache, no-store, must-revalidate
strict-transport-security
max-age=31536000; preload;
server
Kestrel
server-processing-duration-in-ticks
595021
content-length
0
unip
trc-events.taboola.com/1013989/log/3/ 		0
245 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://trc-events.taboola.com/1013989/log/3/unip?en=pre_d_eng_tb&tos=4556&scd=0&ssd=1&est=1680813876115&ver=36&isls=true&src=i&invt=3000&msa=4671&rv=1&tim=1680813880671&vi=1680813876112&ri=7d4e74569b6e673a7f5344027c5a3f7b&ref=null&cv=20230330-9-RELEASE&item-url=https%3A%2F%2Fciti-onlime.org%2F
Requested by
Host: cdn.taboola.com
URL: https://cdn.taboola.com/libtrc/unip/1040862/tfa.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
141.226.228.48 , Netherlands, ASN200478 (TABOOLA-AS, IL),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://citi-onlime.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

access-control-allow-origin
https://citi-onlime.org
pragma
no-cache
date
Thu, 06 Apr 2023 20:44:40 GMT
cache-control
no-cache
access-control-allow-credentials
true
server
nginx
p3p
policyref="http://trc.taboola.com/p3p.xml", CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM"
unip
trc-events.taboola.com/1040862/log/3/ 		0
245 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://trc-events.taboola.com/1040862/log/3/unip?en=pre_d_eng_tb&tos=4556&scd=0&ssd=1&est=1680813876115&ver=36&isls=true&src=i&invt=3000&msa=4671&rv=1&tim=1680813880671&vi=1680813876112&ri=f5464b4cd1787b1b2dd8df99666ed3b6&ref=null&cv=20230330-9-RELEASE&item-url=https%3A%2F%2Fciti-onlime.org%2F
Requested by
Host: cdn.taboola.com
URL: https://cdn.taboola.com/libtrc/unip/1040862/tfa.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
141.226.228.48 , Netherlands, ASN200478 (TABOOLA-AS, IL),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://citi-onlime.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

access-control-allow-origin
https://citi-onlime.org
pragma
no-cache
date
Thu, 06 Apr 2023 20:44:40 GMT
cache-control
no-cache
access-control-allow-credentials
true
server
nginx
p3p
policyref="http://trc.taboola.com/p3p.xml", CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM"
unip
trc-events.taboola.com/1066022/log/3/ 		0
245 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://trc-events.taboola.com/1066022/log/3/unip?en=pre_d_eng_tb&tos=4557&scd=0&ssd=1&est=1680813876115&ver=36&isls=true&src=i&invt=3000&msa=4671&rv=1&tim=1680813880671&vi=1680813876112&ri=ac7652aebb97ca2865fb8601f75cad52&ref=null&cv=20230330-9-RELEASE&item-url=https%3A%2F%2Fciti-onlime.org%2F
Requested by
Host: cdn.taboola.com
URL: https://cdn.taboola.com/libtrc/unip/1040862/tfa.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
141.226.228.48 , Netherlands, ASN200478 (TABOOLA-AS, IL),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://citi-onlime.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

access-control-allow-origin
https://citi-onlime.org
pragma
no-cache
date
Thu, 06 Apr 2023 20:44:40 GMT
cache-control
no-cache
access-control-allow-credentials
true
server
nginx
p3p
policyref="http://trc.taboola.com/p3p.xml", CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM"
unip
trc-events.taboola.com/1066024/log/3/ 		0
245 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://trc-events.taboola.com/1066024/log/3/unip?en=pre_d_eng_tb&tos=4557&scd=0&ssd=1&est=1680813876115&ver=36&isls=true&src=i&invt=3000&msa=4671&rv=1&tim=1680813880672&vi=1680813876112&ri=e5231f9b2a60682d190cb000877d4e19&ref=null&cv=20230330-9-RELEASE&item-url=https%3A%2F%2Fciti-onlime.org%2F
Requested by
Host: cdn.taboola.com
URL: https://cdn.taboola.com/libtrc/unip/1040862/tfa.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
141.226.228.48 , Netherlands, ASN200478 (TABOOLA-AS, IL),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://citi-onlime.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

access-control-allow-origin
https://citi-onlime.org
pragma
no-cache
date
Thu, 06 Apr 2023 20:44:40 GMT
cache-control
no-cache
access-control-allow-credentials
true
server
nginx
p3p
policyref="http://trc.taboola.com/p3p.xml", CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM"
unip
trc-events.taboola.com/1066025/log/3/ 		0
245 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://trc-events.taboola.com/1066025/log/3/unip?en=pre_d_eng_tb&tos=4557&scd=0&ssd=1&est=1680813876115&ver=36&isls=true&src=i&invt=3000&msa=4671&rv=1&tim=1680813880672&vi=1680813876112&ri=d46985642326bce13feb413766f60774&ref=null&cv=20230330-9-RELEASE&item-url=https%3A%2F%2Fciti-onlime.org%2F
Requested by
Host: cdn.taboola.com
URL: https://cdn.taboola.com/libtrc/unip/1040862/tfa.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
141.226.228.48 , Netherlands, ASN200478 (TABOOLA-AS, IL),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://citi-onlime.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

access-control-allow-origin
https://citi-onlime.org
pragma
no-cache
date
Thu, 06 Apr 2023 20:44:40 GMT
cache-control
no-cache
access-control-allow-credentials
true
server
nginx
p3p
policyref="http://trc.taboola.com/p3p.xml", CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM"
unip
trc-events.taboola.com/1077523/log/3/ 		0
245 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://trc-events.taboola.com/1077523/log/3/unip?en=pre_d_eng_tb&tos=4558&scd=0&ssd=1&est=1680813876115&ver=36&isls=true&src=i&invt=3000&msa=4671&rv=1&tim=1680813880673&vi=1680813876112&ri=ee3f82aba222778f717eb800a53d7af4&ref=null&cv=20230330-9-RELEASE&item-url=https%3A%2F%2Fciti-onlime.org%2F
Requested by
Host: cdn.taboola.com
URL: https://cdn.taboola.com/libtrc/unip/1040862/tfa.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
141.226.228.48 , Netherlands, ASN200478 (TABOOLA-AS, IL),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://citi-onlime.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

access-control-allow-origin
https://citi-onlime.org
pragma
no-cache
date
Thu, 06 Apr 2023 20:44:40 GMT
cache-control
no-cache
access-control-allow-credentials
true
server
nginx
p3p
policyref="http://trc.taboola.com/p3p.xml", CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM"
unip
trc-events.taboola.com/1187553/log/3/ 		0
245 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://trc-events.taboola.com/1187553/log/3/unip?en=pre_d_eng_tb&tos=4558&scd=0&ssd=1&est=1680813876115&ver=36&isls=true&src=i&invt=3000&msa=4671&rv=1&tim=1680813880673&vi=1680813876112&ri=6d2ac62ecfd5f279f2305a472e232814&ref=null&cv=20230330-9-RELEASE&item-url=https%3A%2F%2Fciti-onlime.org%2F
Requested by
Host: cdn.taboola.com
URL: https://cdn.taboola.com/libtrc/unip/1040862/tfa.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
141.226.228.48 , Netherlands, ASN200478 (TABOOLA-AS, IL),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://citi-onlime.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

access-control-allow-origin
https://citi-onlime.org
pragma
no-cache
date
Thu, 06 Apr 2023 20:44:40 GMT
cache-control
no-cache
access-control-allow-credentials
true
server
nginx
p3p
policyref="http://trc.taboola.com/p3p.xml", CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM"
unip
trc-events.taboola.com/1236271/log/3/ 		0
245 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://trc-events.taboola.com/1236271/log/3/unip?en=pre_d_eng_tb&tos=4558&scd=0&ssd=1&est=1680813876115&ver=36&isls=true&src=i&invt=3000&msa=4671&rv=1&tim=1680813880673&vi=1680813876112&ri=9a97635eb0ce907099e9e427d38d2ac5&ref=null&cv=20230330-9-RELEASE&item-url=https%3A%2F%2Fciti-onlime.org%2F
Requested by
Host: cdn.taboola.com
URL: https://cdn.taboola.com/libtrc/unip/1040862/tfa.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
141.226.228.48 , Netherlands, ASN200478 (TABOOLA-AS, IL),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://citi-onlime.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

access-control-allow-origin
https://citi-onlime.org
pragma
no-cache
date
Thu, 06 Apr 2023 20:44:40 GMT
cache-control
no-cache
access-control-allow-credentials
true
server
nginx
p3p
policyref="http://trc.taboola.com/p3p.xml", CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM"
unip
trc-events.taboola.com/1248680/log/3/ 		0
245 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://trc-events.taboola.com/1248680/log/3/unip?en=pre_d_eng_tb&tos=4558&scd=0&ssd=1&est=1680813876115&ver=36&isls=true&src=i&invt=3000&msa=4671&rv=1&tim=1680813880673&vi=1680813876112&ri=67bd45c2c57092bf032aa45f5d589059&ref=null&cv=20230330-9-RELEASE&item-url=https%3A%2F%2Fciti-onlime.org%2F
Requested by
Host: cdn.taboola.com
URL: https://cdn.taboola.com/libtrc/unip/1040862/tfa.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
141.226.228.48 , Netherlands, ASN200478 (TABOOLA-AS, IL),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://citi-onlime.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

access-control-allow-origin
https://citi-onlime.org
pragma
no-cache
date
Thu, 06 Apr 2023 20:44:40 GMT
cache-control
no-cache
access-control-allow-credentials
true
server
nginx
p3p
policyref="http://trc.taboola.com/p3p.xml", CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM"
unip
trc-events.taboola.com/1374610/log/3/ 		0
245 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://trc-events.taboola.com/1374610/log/3/unip?en=pre_d_eng_tb&tos=4559&scd=0&ssd=1&est=1680813876115&ver=36&isls=true&src=i&invt=3000&msa=4671&rv=1&tim=1680813880674&vi=1680813876112&ri=2cad262287ef2dd848af1a5e13d83fc0&ref=null&cv=20230330-9-RELEASE&item-url=https%3A%2F%2Fciti-onlime.org%2F
Requested by
Host: cdn.taboola.com
URL: https://cdn.taboola.com/libtrc/unip/1040862/tfa.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
141.226.228.48 , Netherlands, ASN200478 (TABOOLA-AS, IL),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://citi-onlime.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

access-control-allow-origin
https://citi-onlime.org
pragma
no-cache
date
Thu, 06 Apr 2023 20:44:40 GMT
cache-control
no-cache
access-control-allow-credentials
true
server
nginx
p3p
policyref="http://trc.taboola.com/p3p.xml", CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM"
unip
trc-events.taboola.com/1375849/log/3/ 		0
245 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://trc-events.taboola.com/1375849/log/3/unip?en=pre_d_eng_tb&tos=4559&scd=0&ssd=1&est=1680813876115&ver=36&isls=true&src=i&invt=3000&msa=4671&rv=1&tim=1680813880674&vi=1680813876112&ri=1ce15c6763ce0ffc56730bb63e56b1e0&ref=null&cv=20230330-9-RELEASE&item-url=https%3A%2F%2Fciti-onlime.org%2F
Requested by
Host: cdn.taboola.com
URL: https://cdn.taboola.com/libtrc/unip/1040862/tfa.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
141.226.228.48 , Netherlands, ASN200478 (TABOOLA-AS, IL),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://citi-onlime.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

access-control-allow-origin
https://citi-onlime.org
pragma
no-cache
date
Thu, 06 Apr 2023 20:44:40 GMT
cache-control
no-cache
access-control-allow-credentials
true
server
nginx
p3p
policyref="http://trc.taboola.com/p3p.xml", CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM"
unip
trc-events.taboola.com/1427379/log/3/ 		0
245 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://trc-events.taboola.com/1427379/log/3/unip?en=pre_d_eng_tb&tos=4559&scd=0&ssd=1&est=1680813876115&ver=36&isls=true&src=i&invt=3000&msa=4671&rv=1&tim=1680813880674&vi=1680813876112&ri=0d2bb20221049e647d1f6adde31dbb1c&ref=null&cv=20230330-9-RELEASE&item-url=https%3A%2F%2Fciti-onlime.org%2F
Requested by
Host: cdn.taboola.com
URL: https://cdn.taboola.com/libtrc/unip/1040862/tfa.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
141.226.228.48 , Netherlands, ASN200478 (TABOOLA-AS, IL),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
nl-NL,nl;q=0.9
Referer
https://citi-onlime.org/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.146 Safari/537.36

Response headers

access-control-allow-origin
https://citi-onlime.org
pragma
no-cache
date
Thu, 06 Apr 2023 20:44:40 GMT
cache-control
no-cache
access-control-allow-credentials
true
server
nginx
p3p
policyref="http://trc.taboola.com/p3p.xml", CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM"

Verdicts & Comments Add Verdict or Comment

108 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| 1 object| 2 object| 3 object| 4 object| 5 object| 6 object| 7 object| 8 boolean| credentialless object| analytics object| __NW_APP_CONFIG--GLOBAL-MARKUP__ object| __GLOBAL_MARKUP_INITIAL_STATE__ object| __CSS_CHUNKS__ object| __NW_APP_CONFIG--REVIEWS-BANKING-CLIENT__ object| __INITIAL_STATE__ object| __APOLLO_STATE--REVIEWS-BANKING-CLIENT__ object| __STRUCTURED_CONTENT_STATE__ object| nwPageTaxonomy object| nwWPData string| GoogleAnalyticsObject function| ga object| amplitude object| nwapi object| dataLayer string| __KOUNT_SESSION_ID__ object| google_tag_data object| gaplugins object| gaGlobal object| gaData object| __core-js_shared__ object| core object| nerdwallet object| regeneratorRuntime object| NWA object| nwa object| NW object| webpackJsonp object| default_gsi object| google object| closure_lm_274930 undefined| myUndefined string| typeUndefined object| ka object| google_tag_manager function| postscribe object| google_tag_manager_external object| GooglebQhCsO object| __tfa_pixel_init object| _tfa function| obApi function| twq string| TiktokAnalyticsObject object| ttq function| createHreflangTag function| addHrefLangTags function| onYouTubeIframeAPIReady function| apiObj function| _typeof object| TFASC object| TRC object| _taboola number| taboola_view_id object| TRCImpl function| __trcError object| twttr object| webpackChunk_segment_analytics_next string| analyticsWriteKey object| __SEGMENT_INSPECTOR__ object| AnalyticsNext object| webpackChunk_name_Destination function| amplitude-pluginsDestination object| webpackJsonp.TiktTokAnalytics object| JSBridge object| Native2JSBridge object| ToutiaoJSBridge function| TiktokJelly object| _jelly_sdks object| MGIDFuncCalls object| MgSensorData number| MGIDSensorInjected object| uetq object| dotq object| _tvq function| gtag object| criteo_q string| deviceType function| UET function| UET_init function| UET_push object| ueto_23b278f14e object| MgSensor function| MgSensorInvoke function| MgSensorInvoke0 object| _mgq function| _mgqp number| _mgqt number| _mgqi object| _mgr object| _mghl number| MGIDSensorLoaded object| YAHOO string| qq string| qw object| JSON2 object| TV2Track function| alphFunction object| param

71 Cookies

Domain/Path Name / Value
.www.nerdwallet.com/ Name: __cf_bm
Value: rIPYBr3f2OhOTMszYuAP1nLndLKQtZMcskdPskmltbU-1680813875-0-AVjfB40VfXmZQAFwCoM76+yNHcE7Dgx23dQQkNXTAjuU8ZOmRscimUVbuFSbSwvEnM83BuKZ1Dn+xJOvD/CftmNDGTw02VrHZnKPt52rRGjU
.citi-onlime.org/ Name: _gid
Value: GA1.2.542738699.1680813876
citi-onlime.org/ Name: PHPREFS
Value: full
.citi-onlime.org/ Name: __cf_bm
Value: pfiWpwudtRjVqsnF0FcNr9Z0kg0ZfMRk8wTXh9HDC2M-1680813875-0-AVy1m/bK7ZwG7OjkyOreP1pbSCegu7153Chr6lP9m4kjzde0gF3ie8PV+RfTtXYjvXoQdrJVVfXPmVp41+7lPQ4=
ssl.kaptcha.com/ Name: k
Value: 75b1e535a0df457fa98a1c36fdf33967
.citi-onlime.org/ Name: _gcl_au
Value: 1.1.1494340267.1680813876
.citi-onlime.org/ Name: _ga_CNTR275F69
Value: GS1.1.1680813876.1.0.1680813876.0.0.0
.citi-onlime.org/ Name: _ga
Value: GA1.1.1968545696.1680813876
.tiktok.com/ Name: _ttp
Value: 2O4JMyCL3KPDhv8R08mdkowWxy1
.t.co/ Name: muc_ads
Value: f79b0a5d-f379-4612-ac11-8bcca40977c6
.twitter.com/ Name: guest_id_marketing
Value: v1%3A168081387625817269
.twitter.com/ Name: guest_id_ads
Value: v1%3A168081387625817269
.twitter.com/ Name: personalization_id
Value: "v1_xXwnvoRUFZoW5uGkjtCmSQ=="
.twitter.com/ Name: guest_id
Value: v1%3A168081387625817269
.citi-onlime.org/ Name: _tt_enable_cookie
Value: 1
.citi-onlime.org/ Name: _ttp
Value: SuNuvEbcNke5qMitiGv0__zij6s
citi-onlime.org/ Name: outbrain_cid_fetch
Value: true
.citi-onlime.org/ Name: _uetsid
Value: d8025b30d4bb11ed807b9599bf73e6f7
.citi-onlime.org/ Name: _uetvid
Value: d8023c50d4bb11ed9d8e6b95c739c1ab
.doubleclick.net/ Name: IDE
Value: AHWqTUmTvFz3z1OnhhIYe16K4LTv_qezaKrQw8NyckxO_IOnpEh-rRq79_s_A6ZA
.bing.com/ Name: MUID
Value: 2B907C5734AC6EB711296EBC35416FC5
.mgid.com/ Name: __cf_bm
Value: YtxWIBM49F9J8Md.XvaTkT5QROZrAce_oVGm0ygANy0-1680813876-0-AYM0fr5Y9RGHCVNIEfD4igAQgErNnRw4ob1zRw7fS5lJl2DF1h9AIb7IhYRIEqlrsw+YrY+89QKea7Umf0sRUy4=
citi-onlime.org/ Name: MgidSensorNVis
Value: 1
citi-onlime.org/ Name: MgidSensorHref
Value: https://citi-onlime.org/
.criteo.com/ Name: uid
Value: 8127c982-e72f-4377-8803-904030a504db
.ispot.tv/ Name: pt
Value: v2:020b98c8692a80b91803b87d42a532aad60fa24e5641550f9434b32a556eb86f|1ec01c3eec04f44e6ebe43f8320da9296c221c37817553447574a8480f161d4b
.dianomi.com/ Name: session
Value: 2e0e4404d6462da6f142c3e1c2fc5663
.citi-onlime.org/ Name: cto_bundle
Value: cpoa118lMkJrb2s3NzNqUFVCVE4lMkZYWm1ORm13Q0xpMjNMOFR4cEVvNTRrMGNTVEtNUUlNSWN6WEJwSHRuNHUzUjJOcjhwcTBWREdDNmV6QWdDQUZjU09maEM2ODhiZXc1Zmo4b2pTcHJFWkl2WFU5ME5TVTdKVjZkd0d6RkVMUWpKemdUQlRESW5yVHlxU2hhRVBEWVNYVkRLMiUyQlElM0QlM0Q
.1rx.io/ Name: _rxuuid
Value: %7B%22rx_uuid%22%3A%22RX-ae42ec94-16a7-4dbd-ad4f-a0ee8943d593-003%22%7D
.targeting.unrulymedia.com/ Name: _rxuuid
Value: %7B%22rx_uuid%22%3A%22RX-ae42ec94-16a7-4dbd-ad4f-a0ee8943d593-003%22%7D
.yahoo.com/ Name: A3
Value: d=AQABBDUvL2QCEM2eKDrE9ytCUIvamQ9hxRUFEgEBAQGAMGQ5ZAAAAAAA_eMAAA&S=AQAAAp_RQQvMEIl8-H2WGlUnxpI
citi-onlime.org/ Name: _tq_id.TV-7236720954-1.ad26
Value: b67663bf07ad8e93.1680813877.0.1680813877..
.everesttech.net/ Name: everest_g_v2
Value: g_surferid~ZC8vNQAE-STOuwBc
.videohub.tv/ Name: uid
Value: RX-ae42ec94-16a7-4dbd-ad4f-a0ee8943d593-003
.adnxs.com/ Name: uuid2
Value: 6313674422341199947
.adnxs.com/ Name: anj
Value: dTM7k!M4/rCxrEQF']wIg2Ilghi.xD!]tbPl@/D!9hy6]/CwiQ3EjdA7C4v@lgGC9192x%m+[m3/xXst4/r06.y*jr6UxO2>lnZ(7Ybul*bpRz*qF1`*bd7c+ldTg
match.sharethrough.com/ Name: AWSALBCORS
Value: 1DYRrzNUmHgPYgx2Lc1Wzcc6O8s8vyMA1ZJPi6niAUZV0fPEtfCbIcnoHEWdBDWw9jPr1K22J3zJgHd8Td0iL7yOjRJKvFkOsZMobMDLLBr+cLgAZdVMyApqMvQS
.media.net/ Name: visitor-id
Value: 3238154778818355000V10
.media.net/ Name: data-c-ts
Value: 1680813877
.media.net/ Name: data-c
Value: k-RK1_z7Sm4WAVQbcVbGCQLdoUOykOwwfJuzhRxQ~~3
.everesttech.net/ Name: everest_session_v2
Value: ZC8vNQAABXQeIUTB
.demdex.net/ Name: demdex
Value: 12753697191508217482879393421617535390
.id5-sync.com/ Name: cf
Value:
.id5-sync.com/ Name: cip
Value:
.id5-sync.com/ Name: cnac
Value:
.id5-sync.com/ Name: car
Value:
.id5-sync.com/ Name: gdpr
Value:
.id5-sync.com/ Name: callback
Value:
.analytics.yahoo.com/ Name: IDSYNC
Value: 18zh~2axw
.dpm.demdex.net/ Name: dpm
Value: 12753697191508217482879393421617535390
.bidswitch.net/ Name: tuuid
Value: 7ba0a64c-bd69-41a4-a2f2-10114b28726a
.bidswitch.net/ Name: c
Value: 1680813877
.bidswitch.net/ Name: tuuid_lu
Value: 1680813877
.casalemedia.com/ Name: CMID
Value: ZC8vNeMBo0SgzkpE-cvmLAAA
.casalemedia.com/ Name: CMPS
Value: 5185
.casalemedia.com/ Name: CMPRO
Value: 5185
exchange.mediavine.com/ Name: mv_tokens
Value: %7B%22mv_uuid%22%3A%22d89500d0-d4bb-11ed-ada8-113488277681%22%2C%22version%22%3A%22eu-v1%22%7D
exchange.mediavine.com/ Name: mv_tokens_eu-v1
Value: %7B%22mv_uuid%22%3A%22d89500d0-d4bb-11ed-ada8-113488277681%22%2C%22version%22%3A%22eu-v1%22%7D
exchange.mediavine.com/ Name: am_tokens
Value: %7B%22mv_uuid%22%3A%22d89500d0-d4bb-11ed-ada8-113488277681%22%2C%22version%22%3A%22eu-v1%22%7D
exchange.mediavine.com/ Name: am_tokens_eu-v1
Value: %7B%22mv_uuid%22%3A%22d89500d0-d4bb-11ed-ada8-113488277681%22%2C%22version%22%3A%22eu-v1%22%7D
exchange.mediavine.com/ Name: criteo
Value: %7B%22id%22%3A%22k-lrGAprSm4WAVQbcVbGCQLdoUOyl94xpl6CG3tw%22%2C%22version%22%3A%22criteo%22%7D
.360yield.com/ Name: tuuid
Value: 6092323d-84e9-4e43-94ab-9d3f722399d1
.360yield.com/ Name: tuuid_lu
Value: 1680813877
.pubmatic.com/ Name: KRTBCOOKIE_97
Value: 3385-uid:k-adAz-7Sm4WAVQbcVbGCQLdoUOymBlP33_XHHfQ&KRTB&23144-uid:k-adAz-7Sm4WAVQbcVbGCQLdoUOymBlP33_XHHfQ&KRTB&23286-uid:k-adAz-7Sm4WAVQbcVbGCQLdoUOymBlP33_XHHfQ&KRTB&23287-uid:k-adAz-7Sm4WAVQbcVbGCQLdoUOymBlP33_XHHfQ
.pubmatic.com/ Name: PugT
Value: 1680813877
.360yield.com/ Name: um
Value: !38,oOzQfDuVcukxhjofjToquLqyNESeBTD4mt7Nrev9.MmmK7V8oYrJIQxyomvomnq8PcsjRoLB,1688589877
.360yield.com/ Name: umeh
Value: !38,0,1743021877,-1
.everesttech.net/ Name: ev_sync_ax
Value: 20230406
.krxd.net/ Name: _kuid_
Value: Petu7xiC
.tremorhub.com/ Name: tvid
Value: 46b7d53a0f8649b4984b196702b65d2b
.tremorhub.com/ Name: tv_UICR
Value: k-AbhLT7Sm4WAVQbcVbGCQLdoUOymjVqfhb1U4vg

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

9935087.fls.doubleclick.net
a.mgid.com
accounts.google.com
ad.360yield.com
ad.doubleclick.net
ad.yieldlab.net
adservice.google.com
amplify.outbrain.com
analytics.tiktok.com
analytics.twitter.com
b.videoamp.com
bat.bing.com
beacon.krxd.net
cdn.amplitude.com
cdn.segment.com
cdn.taboola.com
cdnstat.net
citi-onlime.org
cm.adform.net
cm.everesttech.net
cm.g.doubleclick.net
collector-26294.us.tvsquared.com
contextual.media.net
conv-pix.adstk.io
criteo-partners.tremorhub.com
criteo-sync.teads.tv
data.adxcel-ec2.com
data.dianomi.com
dis.criteo.com
dpm.demdex.net
eb2.3lift.com
exchange.mediavine.com
googleads.g.doubleclick.net
gum.criteo.com
ib.adnxs.com
id5-sync.com
insight.adsrvr.org
js.adsrvr.org
js.adstk.io
match.sharethrough.com
matching.ivitrack.com
mug.criteo.com
pixel.everesttech.net
pixel.rubiconproject.com
pixel.videohub.tv
pt.ispot.tv
r.casalemedia.com
region1.google-analytics.com
rtb-csync.smartadserver.com
rtb.adgrx.com
rtd-tm.everesttech.net
s.thebrighttag.com
s.yimg.com
secure.adnxs.com
simage2.pubmatic.com
sp.analytics.yahoo.com
ssl.kaptcha.com
sslwidget.criteo.com
static.ads-twitter.com
static.criteo.net
sync-criteo.ads.yieldmo.com
sync-t1.taboola.com
sync.1rx.io
sync.outbrain.com
sync.targeting.unrulymedia.com
t.co
tr.outbrain.com
trc-events.taboola.com
trc.taboola.com
ups.analytics.yahoo.com
visitor.omnitagjs.com
widget.us.criteo.com
www.everestjs.net
www.google-analytics.com
www.google.com
www.google.nl
www.googleadservices.com
www.googletagmanager.com
www.nerdwallet.com
x.bidswitch.net
104.102.35.84
104.18.14.6
104.18.17.195
104.244.42.195
104.244.42.5
108.138.15.119
13.248.245.213
130.211.141.45
141.226.228.48
141.95.98.65
142.250.186.166
142.250.186.70
142.250.186.98
146.75.116.157
151.101.130.49
151.101.193.44
151.101.194.132
172.217.16.194
178.250.1.11
178.250.1.9
178.250.7.11
184.28.181.42
185.255.84.153
185.64.189.110
185.80.39.216
185.86.139.93
185.89.210.46
185.89.211.12
188.114.96.3
199.127.207.180
2.18.235.93
2001:4860:4802:34::36
2001:4860:4802:38::178
212.82.100.181
213.19.147.44
23.198.21.188
23.35.237.86
23.36.163.138
2600:1f18:612b:4232:d8df:442e:b8f5:5c88
2606:4700:1::6813:854e
2620:1ec:c11::200
2a00:1288:80:807::1
2a00:1450:4001:806::2004
2a00:1450:4001:809::2003
2a00:1450:4001:810::2002
2a00:1450:4001:812::2008
2a00:1450:4001:827::2002
2a00:1450:4001:82f::200d
2a02:2638:3::3
2a02:2638:d::d
2a06:98c1:3120::3
3.136.129.62
3.15.82.75
3.64.32.26
3.75.62.37
34.117.157.22
34.241.134.204
35.71.131.137
35.80.101.90
37.157.3.30
50.19.90.90
52.208.99.252
52.213.74.200
52.222.206.6
52.28.222.35
52.54.206.209
52.58.211.21
54.72.144.202
54.78.156.59
63.32.242.157
69.173.144.165
70.42.32.127
72.251.245.179
74.119.119.150
99.86.8.175
0227e0e4dea130eb6f3163aa3ab03720dce83a0e219c282189b03bc5b8a727e3
065fc21fd5679888c39c8463bcc149a4d561f8249b51c506cad65c7d421ae799
0781d7fb13d3e66e67e0fc3f86ff7a71bef80057f9c3c3ce5b5876b082a3cdae
08d9a2fd2156a43edf920c08ea5550e98cb32d1ad0b51c9ee5f58833c7d20570
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
0c19a212083bda0e3321083558aff4837b80a6432108d772e4b9ffc6f8ceea9c
0d1fdae07fffe476b9e43746299b2d858559b9f9ab80f4ce1989215b6d0a7f21
0e4b1e428a2198ef747010c094101c257b568a97cdcc0f31ed5e9868cc835b39
0e9fae93ffc209084400e7340f5cd3bc23aafe057b74ab42278294216a383bbc
111e90dc98f2a92e66646a66b660f10a99b71a031964abd8592d5238661af9a6
1550083a7d2918456da85c63e00c47a6e728af4ec83e68d06b0596e3967db74a
159c6b1e9f2d3b4d2fc9530c5da40152f37a34551bd0a7fb528f7ff6e3d9d83a
16a70077b9d6b8f6422b4ee3f8ac932ed0cdf8833f98aed013ebaf1472dd51f0
17a50e04066af45be95364f939988005fd0cb7bb6c9128f1e6a74018ce3db292
18157870a65e487555dce9077bd3351b73a34fbdb844c4619b6fb5c530d58273
1ad3277a01d122c6ee8d3baea6d5b5825f16838a19ef60503dcd684dd8c124c5
1d348f9f803c95305f63def9d75fd50e79e54a375e1a4a888edbbea366845580
248f25fc150ddf2c6b312aee59ad8aa00ce8d40d9245310048c9b40b9330d6ad
249c4eba880cfb74e1b6e1d1048def310636dc3b1ce5b3fe525703fd4025238f
2689367b205c16ce32ed4200942b8b8b1e262dfc70d9bc9fbc77c49699a4f1df
27cf59f2f5b8446bbf81f4ed9bbea4fcbbece316e3655ade51da075cdc9962d4
2acda7411fdd502f60ffca7ee40bb7db733dfbd6d2ee8339565d00243799384f
2b61b4c5dce751546693edc66704440f9a1870402bdad72eb2b27475a3668885
2c1d1207bc7754f4424017e428412c78c58b40b8c8824249eac8df083fda4325
2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363
2e7a2344e82569ae8bb5e00c808cb16d322ba4dc27ad54a942648090d8aba83b
2f159357989135419d5f01ed218f7f9593b2f9ca434e00734fc1f9ec6a56c0fe
2f979dde1b99a98cbbd7d4040e176b20fe3b84ea0445bbfff507218c6a0f91a6
320404733f17617bd684063804b1843c3ee3e382310d8fdabdd06e13abd88ee8
32248911f632a2c320d6d247ded3b4699c52fbf8ff298ed05d98a44b07f5ef66
328e90a318268aea96180cc31666ae6d6f79d90d078c123bc3d98ee08a192fb7
386f59cb329bf874ad81feb3ca5d7dd53484ebe38304a5ae6b30544ce091900c
3992b901546ef4e2685680badcd372d0834724caf9b1c95ea0f1e7c4ce6e5bc8
3d5629a5cbadabfd67e7c99b9e71569f356ebf7fddabd5b3c24e37b49a48c605
3f4d80beede9162b3480e81f23ec170fb137dac7abf72d7344b20d04e0e2108c
43d219298916f9740ca1db4f20365d13c09ee5e4d0dfc2507e3b9775baa7d584
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
45f4a1f256387a589bd172e13b7c9e5bb32135bb28f3748d4bc3c2c646b1fc1d
4ae4bbc3bbd5733dcaf9302940b4115e5871733f71ab3f3e7250e693b4d05f6d
4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef
4df11b5f9b9978eb16f72d140348e005ff574cccbc2293bff4d4bf7f4914d9f5
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49
4fc274fb6c9f231239a4f7ebc01cfc592b1ed36787478a1f62d2a95e033d296a
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87
55dd4c497feb514a3e060f66e9fb97877899f85ea4a0762c70392a7aad15ef02
5971b095cff574a66d35ada016d4c077c86e2dea62e9c0f14cf7c94b258619de
5a3cad9a6dc0a4a795f82ed45349aea9fd9d197d5c3fdc28f2d7f21f596db111
5a62982f68f482f811e87d3bdeb4785ddf70e787def294f21e0a5748a27179d5
5bbc4032bb9938a6b871c91f974974f97e206ddeb4a83f901c02068e5ce2fe58
6008321fd1f3d30bc94880994e2d25daed3469bf9f6b5fcf0b24baa54e6139bc
6145beeee17e6b38b00c028be36ca6145d52760f52a6c3fb789ad1458f66a040
62258b8ada9f3a9f0e3366ad39a7fe957a376b186ae8e6384928fb38c04db4f1
680638f9443f97449e17f66aa89097ccfcdd817ce737792d004ea5413adeb065
685eac6835d2df1aa86042f9bdf015559234657756a07b3e3c584c9fb17e3b8d
6903e600934517da5296cf098f67aae302a052f8b85579152e8fbcb4960aed65
693d949d8c3fdc7fd4ace7c340b5f177a9f0c5be7bafee8bc93a7d88b7523d75
6aad6619d1de9d066a236e3323ba5411ed807354ebe60abd3b9efdae6076260d
6ac404a65bffee85a15718f669a44f5a034c94116661e6e0e48b1609f4a8617a
6c351725474c23cfc2b6b9041003b8381572c7c483e073bbcacf62312776d899
6d1eadaea40a2f254cd8467e61254c36f506788d237ab6cb64cb575a5b7aab0a
6d59f3b65fce6fa1718ff4319b28f31936c892af629e30429f46a319bb4cdb37
6e3693188626d6ec8d994ec8aa2cbde1d8307efff1124dcba25db100595db9e8
769254457b771e41802cfbc21371888c7b2485ad5baddaacae3b25cd428e428a
826c22116b682265b20f1044ef7e0558fbd2cd1e48522ead7dd00c13de9d55d6
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
8647d6e77acb2c194a10878e3a5980cc2614c8c6524357ac1cc5c31a23f3a5a4
87b9e933f2e9e76ca60ca9107429d436415e316d283e135a705c108a023d7246
89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7
93ae7d494fad0fb30cbf3ae746a39c4bc7a0f8bbf87fbb587a3f3c01f3c5ce20
94457f8e9b7528b3bcf317e690e131bf4ff7432fbfb8bb0fe9ef7d1b3e56d2fb
96405d7546b6c0c499bd3d652b75781d36f3b0062d77afdbf3230bba7842bcfc
97cf4206e208ceee4baa88c1d02f47176d84c5c84f85f63bca9d23aa9f077dc4
9b56fe1f28c70ee8a8b879377498e9660695e957dbc9f28b49cb0495586556e3
a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7
a2137ebfe2b9ff55e1f280dbb1eef301290c50db609c5d6a0494ae8f3c98c253
a463aa6666ce0abcabf8033013cfe881fdbfb570389aff471d400a45b3a496d4
a6af1ef4a96a76bb0892e0cd0cc837eaac674c6f44d4833801d074625f70de55
a6b6e4fe79684b80b3c06842c6676985a4dd749312655721813afbb6a81235f1
aa03dc59bdca72631d2301e4297cfa030bd31b907dc138e7b973d12311c90a22
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
b7cf0cd19c11060da7c571afb5cf9521e74497570dcd2d9326450ba1bdb827d6
ba8be65746ca30fadff7deb639117ec587a44e0428f89218d70bc5e4888ac308
bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96
bd8f6e7c5f1fa875669062c4dcd37f54946e5bf7c7c35988ed48fe427989e7f7
bf94db5c7d218f9a2a2edfff6c01bf65f5946a32000cd41835fee5b564efa62f
c45992da4f0169a7651346ef0a4cb27efe93b28a3b80d230a6f428a0e242db65
cc0e716595a20cd577f4cba25c11b4b54d92311f5f4bf22b992af281cabbc0c7
cd7de82e28c6200eb4668c90c0341a2737e9de46859902438ce710a9ede910e7
cef0a3ffb6993fc1ec7b5b67a16377ec1ec0a858b3cabb834033d7458ff0e4bc
cf0685554bc397c36b519151f910d978eda8979b32d1cef57d0665893739b499
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda
cf7fcc9f75c8717897bfaef72f303fab423ce1b70c98512aeb3677e4af988dee
d1371feb0512d700cf724b05a588ce79f8d8dfbb0991ae5f45ecd3ab08983a38
d2a3583c514ca9c902713fbd7491ead9a31fd5f255f98b2a966c227ba973e042
d72767816f9e0e1eb84b5e68565750621259ef66650230d31b7f724b333e66c8
dc3dfe7643f94c0468b4d965646bdcf5d8cb1bd21f0aef654df8ee5286db2457
dcc6b633543bcc378409b05b180dd30d3d8104624c0948612f7ea501b103fe25
dcd13be5b934f122440a0b2ed6418fbe4acf9fa1d3e8bf1229bb98e0e4051854
ddeee024f4ecaddc0549cc11300e8b2bbb23e4f52b0387c3fb14a4bd3d2c6bba
e2aa656bb817b2f3747d1759cc557646f703b90d6342ddc74095b5b1052457d5
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e5c68542ce32a5a479f14a81034e0377fce3114a6525a0a7042bda9d24ddc898
e9ccb7921443e4b41f103b2a5f2aff4608e59e96d605c9d366f78f3ebe00fda2
eb34bdd9ec8a292576b4d718d73cc549933a04a80c627146f027df44b49bcd31
ed632fce6f4a116f4968bb22d7fa176c78d6c6d3c2a8a64197c895d7e3f538b6
ed9a937b75dd44a90a8b43cdeb00d876862b396ac8dee570d0e5e34d31771994
edea67791d8b4efdc7f2b85dacb2998ff15527736a1eeb15aad3811bebe4f9ae
ee3a7301fe1e0c0f6bf6acff0d7a8d107f5cb3f62a2566740c0416d8e61f00b9
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
efe905d14d331dbbf606e5c7aa32b174ef2e63b9e54c67854595c94734a57b82
f0c71e3da5b3fcab3c66af1cf0cdbf262c97b9330b7b37116f1ae2ab18bdc660
f401f2c4bc899ffa4b58f48aaac0be082b23132b07b056b3bb44f59cbcc9381f
f550b8aec0360c21d3b8b9adc386a7f881f3726ac6c8c375241b1c3157e44860
f6a24069d0f70b85bcd6be9f7ee72faf3ca738169a6535405f30e81bcb4f8858
fcf724f0e0e21774c80273aab93788496b94cfb8f8712d427697947b96e7f2fd
fef7987a2bad3e40dc6ad300a6b069f77d9e35a9c70b26f47f0429c29b1ba738