online.citi.com Open in urlscan Pro
104.111.238.178 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://email.homeloans.citi.com/click/348945348079/9b99e9ef95514c718de68d1de7482dcb
Effective URL:
https://online.citi.com/US/JRS/portal/template_lo.do?ID=surestart_preapproval&client_type=LO&client_id=1024024
Submission: On January 21 via api (January 21st 2021, 5:33:37 pm UTC) from US

Summary HTTP 164 Redirects Links 14 Behaviour Indicators

Summary

This website contacted 41 IPs in 7 countries across 32 domains to perform 164 HTTP transactions. The main IP is 104.111.238.178, located in Netherlands and belongs to AKAMAI-AS, US. The main domain is online.citi.com.
TLS certificate: Issued by DigiCert SHA2 Extended Validation Ser... on March 13th 2020. Valid for: 2 years.

This is the only time online.citi.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1 1	52.1.126.9 52.1.126.9	14618 (AMAZON-AES) (AMAZON-AES)
68	104.111.238.178 104.111.238.178	16625 (AKAMAI-AS) (AKAMAI-AS)
1	65.9.83.34 65.9.83.34	16509 (AMAZON-02) (AMAZON-02)
13	18.197.253.20 18.197.253.20	16509 (AMAZON-02) (AMAZON-02)
1 1	35.227.248.159 35.227.248.159	15169 (GOOGLE) (GOOGLE)
6 8	18.194.78.147 18.194.78.147	16509 (AMAZON-02) (AMAZON-02)
2 4	34.120.207.148 34.120.207.148	15169 (GOOGLE) (GOOGLE)
1 2	52.30.234.204 52.30.234.204	16509 (AMAZON-02) (AMAZON-02)
2	104.108.41.56 104.108.41.56	16625 (AKAMAI-AS) (AKAMAI-AS)
2 5	34.249.128.36 34.249.128.36	16509 (AMAZON-02) (AMAZON-02)
2	2a03:2880:f01... 2a03:2880:f01c:8004:face:b00c:0:8c	32934 (FACEBOOK) (FACEBOOK)
3	2a00:1450:400... 2a00:1450:4001:806::200e	15169 (GOOGLE) (GOOGLE)
1	54.171.106.172 54.171.106.172	16509 (AMAZON-02) (AMAZON-02)
2	15.237.136.106 15.237.136.106	16509 (AMAZON-02) (AMAZON-02)
1 1	54.171.42.33 54.171.42.33	16509 (AMAZON-02) (AMAZON-02)
8	2a00:1450:400... 2a00:1450:4001:802::2008	15169 (GOOGLE) (GOOGLE)
1	104.111.228.137 104.111.228.137	16625 (AKAMAI-AS) (AKAMAI-AS)
1	34.252.166.160 34.252.166.160	16509 (AMAZON-02) (AMAZON-02)
3 6	35.181.18.61 35.181.18.61	16509 (AMAZON-02) (AMAZON-02)
2	178.249.101.23 178.249.101.23	11054 (LIVEPERSON) (LIVEPERSON)
1 9	2a00:1450:400... 2a00:1450:4001:801::2004	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:825::200e	15169 (GOOGLE) (GOOGLE)
1 1	13.110.9.61 13.110.9.61	14340 (SALESFORCE) (SALESFORCE)
1	13.110.10.60 13.110.10.60	14340 (SALESFORCE) (SALESFORCE)
1	104.111.224.160 104.111.224.160	16625 (AKAMAI-AS) (AKAMAI-AS)
1 2	172.217.22.70 172.217.22.70	15169 (GOOGLE) (GOOGLE)
2 4	193.0.160.129 193.0.160.129	54312 (ROCKETFUEL) (ROCKETFUEL)
2	2a03:6400:10:... 2a03:6400:10:0:178:249:97:99	11054 (LIVEPERSON) (LIVEPERSON)
1	143.204.215.24 143.204.215.24	16509 (AMAZON-02) (AMAZON-02)
1	2606:4700::68... 2606:4700::6810:135e	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	65.9.83.19 65.9.83.19	16509 (AMAZON-02) (AMAZON-02)
3	151.101.14.133 151.101.14.133	54113 (FASTLY) (FASTLY)
1	35.244.245.222 35.244.245.222	15169 (GOOGLE) (GOOGLE)
1	65.9.78.118 65.9.78.118	16509 (AMAZON-02) (AMAZON-02)
1	143.204.215.103 143.204.215.103	16509 (AMAZON-02) (AMAZON-02)
1 1	13.225.80.50 13.225.80.50	16509 (AMAZON-02) (AMAZON-02)
1 2	172.217.22.2 172.217.22.2	15169 (GOOGLE) (GOOGLE)
1 6	2a00:1450:400... 2a00:1450:4001:801::2002	15169 (GOOGLE) (GOOGLE)
4	192.193.179.248 192.193.179.248	25883 (CITIGROUP) (CITIGROUP)
1	34.251.61.210 34.251.61.210	16509 (AMAZON-02) (AMAZON-02)
1	151.101.13.175 151.101.13.175	54113 (FASTLY) (FASTLY)
5	2a00:1450:400... 2a00:1450:4001:817::2003	15169 (GOOGLE) (GOOGLE)
1	35.241.45.82 35.241.45.82	15169 (GOOGLE) (GOOGLE)
1	2a03:6400:10:... 2a03:6400:10:0:178:249:97:98	11054 (LIVEPERSON) (LIVEPERSON)
4	208.89.12.87 208.89.12.87	11054 (LIVEPERSON) (LIVEPERSON)
164	41

1 52.1.126.9 (Ashburn, United States) 1 redirects

ASN14618 (AMAZON-AES, US)

email.homeloans.citi.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

68 104.111.238.178 (Netherlands)

ASN16625 (AKAMAI-AS, US)
PTR: a104-111-238-178.deploy.static.akamaitechnologies.com

online.citi.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 65.9.83.34 (Seattle, United States)

ASN16509 (AMAZON-02, US)

vt.myvisualiq.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

13 18.197.253.20 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-18-197-253-20.eu-central-1.compute.amazonaws.com

nexus.ensighten.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 35.227.248.159 (Mountain View, United States) 1 redirects

ASN15169 (GOOGLE, US)

tapestry.tapad.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 18.194.78.147 (Frankfurt am Main, Germany) 6 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-18-194-78-147.eu-central-1.compute.amazonaws.com

t.myvisualiq.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 34.120.207.148 (United States) 2 redirects

ASN15169 (GOOGLE, US)
PTR: 148.207.120.34.bc.googleusercontent.com

idsync.rlcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 52.30.234.204 (Dublin, Ireland) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-52-30-234-204.eu-west-1.compute.amazonaws.com

bcp.crwdcntrl.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 104.108.41.56 (Netherlands)

ASN16625 (AKAMAI-AS, US)
PTR: a104-108-41-56.deploy.static.akamaitechnologies.com

tags.bluekai.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
stags.bluekai.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 34.249.128.36 (Dublin, Ireland) 2 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-34-249-128-36.eu-west-1.compute.amazonaws.com

dpm.demdex.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a03:2880:f01c:8004:face:b00c:0:8c (Ireland)

ASN32934 (FACEBOOK, US)

ad.atdmt.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:806::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.youtube.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 54.171.106.172 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-54-171-106-172.eu-west-1.compute.amazonaws.com

citi.demdex.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 15.237.136.106 (Paris, France)

ASN16509 (AMAZON-02, US)
PTR: ec2-15-237-136-106.eu-west-3.compute.amazonaws.com

metrics1.citi.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 54.171.42.33 (Dublin, Ireland) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-54-171-42-33.eu-west-1.compute.amazonaws.com

cm.everesttech.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 2a00:1450:4001:802::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.111.228.137 (Netherlands)

ASN16625 (AKAMAI-AS, US)
PTR: a104-111-228-137.deploy.static.akamaitechnologies.com

tags.bkrtx.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 34.252.166.160 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-34-252-166-160.eu-west-1.compute.amazonaws.com

citicorpcreditservic.tt.omtrdc.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 35.181.18.61 (Paris, France) 3 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-35-181-18-61.eu-west-3.compute.amazonaws.com

metrics1.citibank.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 178.249.101.23 (Netherlands)

ASN11054 (LIVEPERSON, US)

lptag.liveperson.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

9 2a00:1450:4001:801::2004 (Frankfurt am Main, Germany) 1 redirects

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:825::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

cse.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.110.9.61 (United States) 1 redirects

ASN14340 (SALESFORCE, US)

citirel.my.salesforce.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.110.10.60 (United States)

ASN14340 (SALESFORCE, US)
PTR: dcl5-ncg0-iad3.na91-ia2.force.com

citirel--c.na91.content.force.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.111.224.160 (Netherlands)

ASN16625 (AKAMAI-AS, US)
PTR: a104-111-224-160.deploy.static.akamaitechnologies.com

c1.rfihub.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 172.217.22.70 (United States) 1 redirects

ASN15169 (GOOGLE, US)
PTR: fra15s17-in-f6.1e100.net

6256710.fls.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 193.0.160.129 (Netherlands) 2 redirects

ASN54312 (ROCKETFUEL, US)

a.rfihub.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
20766699p.rfihub.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
20822230p.rfihub.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
p.rfihub.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a03:6400:10:0:178:249:97:99 (United Kingdom)

ASN11054 (LIVEPERSON, US)

lp-01.chat.online.citi.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 143.204.215.24 (Seattle, United States)

ASN16509 (AMAZON-02, US)
PTR: server-143-204-215-24.fra53.r.cloudfront.net

static-assets.fs.liveperson.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6810:135e (United States)

ASN13335 (CLOUDFLARENET, US)

cdnjs.cloudflare.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 65.9.83.19 (Seattle, United States)

ASN16509 (AMAZON-02, US)

static-assets.dev.fs.liveperson.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 151.101.14.133 (Frankfurt am Main, Germany)

ASN54113 (FASTLY, US)

resources.digital-cloud-citi.medallia.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 35.244.245.222 (Mountain View, United States)

ASN15169 (GOOGLE, US)

sr.rlcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 65.9.78.118 (Seattle, United States)

ASN16509 (AMAZON-02, US)

js.adsrvr.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 143.204.215.103 (Seattle, United States)

ASN16509 (AMAZON-02, US)
PTR: server-143-204-215-103.fra53.r.cloudfront.net

cdn.pbbl.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.225.80.50 (Seattle, United States) 1 redirects

ASN16509 (AMAZON-02, US)

live.rezync.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 172.217.22.2 (United States) 1 redirects

ASN15169 (GOOGLE, US)
PTR: fra16s14-in-f2.1e100.net

cm.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
www.googleadservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 2a00:1450:4001:801::2002 (Frankfurt am Main, Germany) 1 redirects

ASN15169 (GOOGLE, US)

cm.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 192.193.179.248 (United States)

ASN25883 (CITIGROUP, US)

prod.report.nacustomerexperience.citi.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 34.251.61.210 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-34-251-61-210.eu-west-1.compute.amazonaws.com

insight.adsrvr.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 151.101.13.175 (Frankfurt am Main, Germany)

ASN54113 (FASTLY, US)

nebula-cdn.kampyle.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2a00:1450:4001:817::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 35.241.45.82 (Ascension Island)

ASN15169 (GOOGLE, US)

udc-neb.kampyle.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a03:6400:10:0:178:249:97:98 (United Kingdom)

ASN11054 (LIVEPERSON, US)

lpcdn.chat.online.citi.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 208.89.12.87 (United States)

ASN11054 (LIVEPERSON, US)
PTR: va.v.liveperson.net

lp-03.chat.online.citi.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
82	citi.com 1 redirects email.homeloans.citi.com online.citi.com metrics1.citi.com lp-01.chat.online.citi.com prod.report.nacustomerexperience.citi.com lpcdn.chat.online.citi.com lp-03.chat.online.citi.com	3 MB
13	ensighten.com nexus.ensighten.com	261 KB
10	google.com 1 redirects www.google.com cse.google.com	106 KB
9	doubleclick.net 3 redirects 6256710.fls.doubleclick.net cm.g.doubleclick.net googleads.g.doubleclick.net	7 KB
9	myvisualiq.net 6 redirects vt.myvisualiq.net t.myvisualiq.net	7 KB
8	googletagmanager.com www.googletagmanager.com	310 KB
6	citibank.com 3 redirects metrics1.citibank.com	4 KB
6	demdex.net 2 redirects dpm.demdex.net citi.demdex.net	5 KB
5	google.de www.google.de	1 KB
5	rlcdn.com 2 redirects idsync.rlcdn.com sr.rlcdn.com	1 KB
4	rfihub.com 2 redirects a.rfihub.com 20766699p.rfihub.com 20822230p.rfihub.com p.rfihub.com	2 KB
3	medallia.com resources.digital-cloud-citi.medallia.com	65 KB
3	youtube.com www.youtube.com	38 KB
2	kampyle.com nebula-cdn.kampyle.com udc-neb.kampyle.com	6 KB
2	adsrvr.org js.adsrvr.org insight.adsrvr.org	2 KB
2	liveperson.com static-assets.fs.liveperson.com static-assets.dev.fs.liveperson.com	8 KB
2	liveperson.net lptag.liveperson.net	112 KB
2	atdmt.com ad.atdmt.com	751 B
2	bluekai.com tags.bluekai.com stags.bluekai.com	753 B
2	crwdcntrl.net 1 redirects bcp.crwdcntrl.net	976 B
1	googleadservices.com www.googleadservices.com	13 KB
1	rezync.com 1 redirects live.rezync.com	786 B
1	pbbl.co cdn.pbbl.co
1	cloudflare.com cdnjs.cloudflare.com	11 KB
1	rfihub.net c1.rfihub.net	7 KB
1	force.com citirel--c.na91.content.force.com	32 KB
1	salesforce.com 1 redirects citirel.my.salesforce.com	1 KB
1	omtrdc.net citicorpcreditservic.tt.omtrdc.net	1 KB
1	bkrtx.com tags.bkrtx.com	16 KB
1	everesttech.net 1 redirects cm.everesttech.net	517 B
1	tapad.com 1 redirects tapestry.tapad.com	466 B
0	Failed function sub() { [native code] }. Failed
164	32

	Domain	Requested by
68	online.citi.com	online.citi.com nexus.ensighten.com
13	nexus.ensighten.com	online.citi.com nexus.ensighten.com
9	www.google.com	1 redirects www.google.com
8	www.googletagmanager.com	nexus.ensighten.com www.googletagmanager.com
8	t.myvisualiq.net	6 redirects online.citi.com
6	metrics1.citibank.com	3 redirects online.citi.com
5	www.google.de
5	googleads.g.doubleclick.net	www.googleadservices.com
5	dpm.demdex.net	2 redirects online.citi.com nexus.ensighten.com
4	lp-03.chat.online.citi.com	lptag.liveperson.net
4	prod.report.nacustomerexperience.citi.com	nexus.ensighten.com
4	idsync.rlcdn.com	2 redirects online.citi.com
3	resources.digital-cloud-citi.medallia.com	nexus.ensighten.com resources.digital-cloud-citi.medallia.com
3	www.youtube.com	online.citi.com www.youtube.com
2	cm.g.doubleclick.net	2 redirects
2	lp-01.chat.online.citi.com	lptag.liveperson.net
2	6256710.fls.doubleclick.net	1 redirects nexus.ensighten.com
2	lptag.liveperson.net	online.citi.com
2	metrics1.citi.com	nexus.ensighten.com
2	ad.atdmt.com	online.citi.com
2	bcp.crwdcntrl.net	1 redirects online.citi.com
1	lpcdn.chat.online.citi.com	lptag.liveperson.net
1	udc-neb.kampyle.com
1	nebula-cdn.kampyle.com	resources.digital-cloud-citi.medallia.com
1	insight.adsrvr.org	js.adsrvr.org
1	www.googleadservices.com	www.googletagmanager.com
1	stags.bluekai.com	tags.bkrtx.com
1	p.rfihub.com	1 redirects
1	live.rezync.com	1 redirects
1	20822230p.rfihub.com	1 redirects
1	cdn.pbbl.co	nexus.ensighten.com
1	js.adsrvr.org	nexus.ensighten.com
1	sr.rlcdn.com	nexus.ensighten.com
1	20766699p.rfihub.com	c1.rfihub.net
1	static-assets.dev.fs.liveperson.com	static-assets.fs.liveperson.com
1	cdnjs.cloudflare.com	static-assets.fs.liveperson.com
1	static-assets.fs.liveperson.com	lptag.liveperson.net
1	a.rfihub.com	c1.rfihub.net
1	c1.rfihub.net	nexus.ensighten.com
1	citirel--c.na91.content.force.com	online.citi.com
1	citirel.my.salesforce.com	1 redirects
1	cse.google.com	online.citi.com
1	citicorpcreditservic.tt.omtrdc.net	nexus.ensighten.com
1	tags.bkrtx.com	nexus.ensighten.com
1	cm.everesttech.net	1 redirects
1	citi.demdex.net	nexus.ensighten.com
1	tags.bluekai.com	online.citi.com
1	tapestry.tapad.com	1 redirects
1	vt.myvisualiq.net	online.citi.com
1	email.homeloans.citi.com	1 redirects
0	track Failed	online.citi.com
164	51

This site contains links to these domains. Also see Links.

Domain
www.myhomeequity.com
www.facebook.com
www.twitter.com
www.youtube.com
www.citigroup.com
jobs.citi.com
citieasydeals.com
www.citiprivatepass.com
www.privatebank.citibank.com
www.citi.com
www.citibank.com
www.citigoldinternational.citi.com

Subject Issuer	Validity	Valid
online.citibank.com DigiCert SHA2 Extended Validation Server CA	`2020-03-13` - `2022-05-14`	2 years	crt.sh
*.myvisualiq.net Amazon	`2020-10-16` - `2021-11-15`	a year	crt.sh
nexus.ensighten.com DigiCert SHA2 Secure Server CA	`2020-09-09` - `2021-10-11`	a year	crt.sh
*.rlcdn.com Sectigo RSA Domain Validation Secure Server CA	`2020-04-14` - `2021-04-23`	a year	crt.sh
*.crwdcntrl.net Go Daddy Secure Certificate Authority - G2	`2019-06-13` - `2021-06-28`	2 years	crt.sh
odc-prod-01.oracle.com DigiCert Secure Site ECC CA-1	`2020-10-15` - `2021-04-09`	6 months	crt.sh
*.atlassolutions.com DigiCert SHA2 High Assurance Server CA	`2020-12-04` - `2021-03-03`	3 months	crt.sh
*.demdex.net DigiCert TLS RSA SHA256 2020 CA1	`2020-12-02` - `2022-01-02`	a year	crt.sh
*.google.com GTS CA 1O1	`2021-01-05` - `2021-03-30`	3 months	crt.sh
metrics1.citi.com DigiCert SHA2 Extended Validation Server CA	`2020-07-02` - `2022-08-30`	2 years	crt.sh
*.google-analytics.com GTS CA 1O1	`2020-12-15` - `2021-03-09`	3 months	crt.sh
*.bkrtx.com DigiCert SHA2 Secure Server CA	`2020-02-28` - `2021-05-29`	a year	crt.sh
*.tt.omtrdc.net DigiCert SHA2 Secure Server CA	`2020-11-02` - `2021-11-09`	a year	crt.sh
metrics1.citibank.com DigiCert SHA2 High Assurance Server CA	`2020-01-20` - `2021-04-22`	a year	crt.sh
*.liveperson.net Sectigo RSA Organization Validation Secure Server CA	`2020-05-30` - `2022-05-30`	2 years	crt.sh
*.na91.force.com DigiCert SHA2 Secure Server CA	`2020-02-07` - `2021-02-07`	a year	crt.sh
*.rfihub.net DigiCert SHA2 Secure Server CA	`2020-04-01` - `2021-07-01`	a year	crt.sh
*.doubleclick.net GTS CA 1O1	`2021-01-05` - `2021-03-30`	3 months	crt.sh
*.rfihub.com Sectigo RSA Domain Validation Secure Server CA	`2020-06-18` - `2022-06-18`	2 years	crt.sh
chat.online.citi.com DigiCert SHA2 Extended Validation Server CA	`2019-11-01` - `2022-01-25`	2 years	crt.sh
fs.liveperson.com Amazon	`2020-08-23` - `2021-09-23`	a year	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2020-10-21` - `2021-10-20`	a year	crt.sh
dev.fs.liveperson.com Amazon	`2020-08-23` - `2021-09-23`	a year	crt.sh
*.digital-cloud-citi.medallia.com SSL.com RSA SSL subCA	`2020-10-21` - `2021-11-21`	a year	crt.sh
*.adsrvr.org Trustwave Organization Validation SHA256 CA, Level 1	`2019-03-07` - `2021-04-19`	2 years	crt.sh
*.pbbl.co Amazon	`2020-12-04` - `2022-01-02`	a year	crt.sh
prod.report.nacustomerexperience.citi.com DigiCert SHA2 Extended Validation Server CA	`2020-05-05` - `2022-07-04`	2 years	crt.sh
www.googleadservices.com GTS CA 1O1	`2020-12-15` - `2021-03-09`	3 months	crt.sh
j.ssl.fastly.net GlobalSign Organization Validation CA - SHA256 - G2	`2020-10-01` - `2021-11-02`	a year	crt.sh
*.g.doubleclick.net GTS CA 1O1	`2020-12-15` - `2021-03-09`	3 months	crt.sh
www.google.de GTS CA 1O1	`2021-01-05` - `2021-03-30`	3 months	crt.sh
*.kampyle.com RapidSSL RSA CA 2018	`2020-02-11` - `2022-03-06`	2 years	crt.sh
*.google.de GTS CA 1O1	`2021-01-05` - `2021-03-30`	3 months	crt.sh

This page contains 9 frames:

Primary Page: https://online.citi.com/US/JRS/portal/template_lo.do?ID=surestart_preapproval&client_type=LO&client_id=1024024
Frame ID: 3B2D806D326AB2CF84B67B92C60CD6BF
Requests: 156 HTTP requests in this frame

Frame: https://citi.demdex.net/dest5.html?d_nsid=0
Frame ID: C6CAE04851F76BB7ECC6E47133751A77
Requests: 1 HTTP requests in this frame

Frame: https://www.youtube.com/embed/OOJvvDAVPKg?version=3&enablejsapi=1&rel=0
Frame ID: 4D136B1BEF7D8C30480E68D1E5D72875
Requests: 1 HTTP requests in this frame

Frame: https://6256710.fls.doubleclick.net/activityi;dc_pre=CIf0vbzHre4CFVqKsgod7cgJ4A;src=6256710;type=drsog0;cat=mortg002;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;ord=5676426202304
Frame ID: BDDFAE11A154EFF9B9025235E6351A8D
Requests: 1 HTTP requests in this frame

Frame: https://20766699p.rfihub.com/ca.html?rfiidc=1870471591774814639&rfiaid=aa45adb1a2b249378e3c365b7010c65d&ver=9&ra=246&rb=648&ca=20766699&_o=17169175&_t=purchgetpreapprovedpurchrequestcallbackform&ssv_cuuid=&ssv_package=null&ssv_prodlist=null&ssv_pagename=purchgetpreapprovedpurchrequestcallbackform&pe=https%3A%2F%2Fonline.citi.com%2FUS%2FJRS%2Fportal%2Ftemplate_lo.do%3FID%3Dsurestart_preapproval%26client_type%3DLO%26client_id%3D1024024&pf=&ra=8810443171021525
Frame ID: B8FC8427ED001DF3475262D06B529848
Requests: 1 HTTP requests in this frame

Frame: https://sr.rlcdn.com/425466.html?es=80676&u=da39a3ee5e6b4b0d3255bfef95601890afd80709
Frame ID: 2B824F66936BB2EDBDEC123172CFBCA1
Requests: 1 HTTP requests in this frame

Frame: https://stags.bluekai.com/site/63068?ret=html&phint=language&phint=product&phint=event&phint=category&phint=page&phint=section1&phint=section2&phint=section3&phint=section4&phint=bankappstatus&phint=productID&phint=__bk_t%3DSurestart%C2%AE%20Mortgage%20Pre-approval%20-%20Citi.com&phint=__bk_k%3D&phint=__bk_l%3Dhttps%3A%2F%2Fonline.citi.com%2FUS%2FJRS%2Fportal%2Ftemplate_lo.do%3FID%3Dsurestart_preapproval%26client_type%3DLO%26client_id%3D1024024&phint=__bk_v%3D3.1.8&limit=10&r=25475429
Frame ID: 612A3FA22B4394ACD27BD9718A544F45
Requests: 1 HTTP requests in this frame

Frame: https://insight.adsrvr.org/track/up?adv=1jw5cvl&ref=https%3A%2F%2Fonline.citi.com%2FUS%2FJRS%2Fportal%2Ftemplate_lo.do%3FID%3Dsurestart_preapproval%26client_type%3DLO%26client_id%3D1024024&upid=t1sl5ty&upv=1.1.0&orderid={orderid}&v={v}&vf={vf}&td1=undefined&td2=undefined&td3=undefined&td4=undefined&td5=https://online.citi.com/US/JRS/portal/template_lo.do?ID=surestart_preapproval&client_type=LO&client_id=1024024&td6={td6}&td7={td7}&td8={td8}&td9={td9}&td10={td10}
Frame ID: 100469C105F2CC386D96F54FC1013F2E
Requests: 1 HTTP requests in this frame

Frame: https://lpcdn.chat.online.citi.com/le_secure_storage/3.12.0.0-release_5037/storage.secure.min.html?loc=https%3A%2F%2Fonline.citi.com&site=50929468&env=prod
Frame ID: 81F6B9C6DD8CDA3CF95CB2B204CA1C82
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

http://email.homeloans.citi.com/click/348945348079/9b99e9ef95514c718de68d1de7482dcb HTTP 302
https://online.citi.com/US/JRS/portal/template_lo.do?ID=surestart_preapproval&client_type=LO&client_... Page URL

Page Statistics

164
Requests

99 %
HTTPS

22 %
IPv6

32
Domains

51
Subdomains

41
IPs

7
Countries

3925 kB
Transfer

10948 kB
Size

31
Cookies

14 Outgoing links

These are links going to different origins than the main page.

URL: https://www.myhomeequity.com/MHE/home.do?sc=0
Title: Check Your Application Status

Search URL Search Domain Scan URL

URL: https://www.facebook.com/citi
Title:

Search URL Search Domain Scan URL

URL: https://www.twitter.com/citi
Title:

Search URL Search Domain Scan URL

URL: https://www.youtube.com/citi
Title:

Search URL Search Domain Scan URL

URL: http://www.citigroup.com/citi/
Title: Our Story

Search URL Search Domain Scan URL

URL: https://jobs.citi.com/
Title: Careers

Search URL Search Domain Scan URL

URL: https://citieasydeals.com/
Title: Citi Easy DealsSM

Search URL Search Domain Scan URL

URL: http://www.citiprivatepass.com/
Title: Citi EntertainmentSM

Search URL Search Domain Scan URL

URL: https://www.privatebank.citibank.com/
Title: Citi Private Bank

Search URL Search Domain Scan URL

URL: https://www.citi.com/credit-cards/compare/view-all-credit-cards
Title: Credit Cards

Search URL Search Domain Scan URL

URL: http://www.citibank.com/citigoldprivateclient/homepage/content/english/index.html
Title: Citigold Private Client

Search URL Search Domain Scan URL

URL: http://www.citigoldinternational.citi.com/citigoldinternational/homepage/content/english/index.htm
Title: Citigold International

Search URL Search Domain Scan URL

URL: http://www.citibank.com/ipb-global/homepage/content/english/index.html
Title: International Personal Banking

Search URL Search Domain Scan URL

URL: http://www.citibank.com/us/geb/content/english/index.html
Title: Global Executive Banking

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://email.homeloans.citi.com/click/348945348079/9b99e9ef95514c718de68d1de7482dcb HTTP 302
https://online.citi.com/US/JRS/portal/template_lo.do?ID=surestart_preapproval&client_type=LO&client_id=1024024 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 54

https://tapestry.tapad.com/tapestry/1?ta_partner_id=950&ta_redirect=https%3A%2F%2Ft.myvisualiq.net%2Fsync%3Fprid%3D1001%26ao%3D0%26pruuid%3DTAPAD_%24%7BIDS%3Akey%7D HTTP 302
https://t.myvisualiq.net/sync?prid=1001&ao=0&pruuid=TAPAD_be6e9db0-5c0e-11eb-a3c6-2e5955ce7e7f

Request Chain 55

https://t.myvisualiq.net/sync?prid=1002&ao=0&red=https://idsync.rlcdn.com/420356.gif?partner_uid=${UUID} HTTP 302
https://t.myvisualiq.net/ul_cb/sync?prid=1002&ao=0&red=https://idsync.rlcdn.com/420356.gif?partner_uid=${UUID} HTTP 302
https://idsync.rlcdn.com/420356.gif?partner_uid=80a5d61a-bcec-44f4-b7b0-19640b619062

Request Chain 56

https://t.myvisualiq.net/sync?prid=LOAEPNR1&ao=0&red=https%3a%2f%2fbcp.crwdcntrl.net%2fmap%2fc%3d10105%2ftp%3dVSIQ%2ftpid%3d%24%7bUUID%7d HTTP 302
https://t.myvisualiq.net/ul_cb/sync?prid=LOAEPNR1&ao=0&red=https%3a%2f%2fbcp.crwdcntrl.net%2fmap%2fc%3d10105%2ftp%3dVSIQ%2ftpid%3d%24%7bUUID%7d HTTP 302
https://bcp.crwdcntrl.net/map/c=10105/tp=VSIQ/tpid=80a5d61a-bcec-44f4-b7b0-19640b619062 HTTP 302
https://bcp.crwdcntrl.net/map/ct=y/c=10105/tp=VSIQ/tpid=80a5d61a-bcec-44f4-b7b0-19640b619062

Request Chain 57

https://t.myvisualiq.net/sync?prid=BUKIPNR1&red=https://tags.bluekai.com/site/21398?id=$%7BUUID%7D HTTP 302
https://tags.bluekai.com/site/21398?id=0-9f3b6ee6-cb31-4675-8798-99d0d3413abe

Request Chain 58

https://t.myvisualiq.net/sync?prid=AOEPNR1&ao=0&red=https%3A%2F%2Fdpm.demdex.net%2Fibs%3Adpid%3D125310%26dpuuid%3D%24%7BUUID%7D%26redir%3Dhttps%253A%252F%252Ft.myvisualiq.net%252Fsync%253Fprid%253DAOEPNR1%2526ao%253D0%2526pruuid%253D%2524%257BDD_UUID%257D%250A HTTP 302
https://dpm.demdex.net/ibs:dpid=125310&dpuuid=0-c905b2b7-9da9-4a95-a071-dee5b3cd62e4&redir=https%3A%2F%2Ft.myvisualiq.net%2Fsync%3Fprid%3DAOEPNR1%26ao%3D0%26pruuid%3D%24%7BDD_UUID%7D HTTP 302
https://t.myvisualiq.net/sync?prid=AOEPNR1&ao=0&pruuid=64280508413371541693315245438415847381

Request Chain 62

https://dpm.demdex.net/id?d_visid_ver=3.1.2&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=61834D9B5228A7430A490D45%40AdobeOrg&d_nsid=0&ts=1611250395538 HTTP 302
https://dpm.demdex.net/id/rd?d_visid_ver=3.1.2&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=61834D9B5228A7430A490D45%40AdobeOrg&d_nsid=0&ts=1611250395538

Request Chain 81

https://cm.everesttech.net/cm/dd?d_uuid=64280508413371541693315245438415847381 HTTP 302
https://dpm.demdex.net/ibs:dpid=411&dpuuid=YAm63AAAAEdm-R__

Request Chain 93

https://metrics1.citibank.com/b/ss/citinaprod/1/JS-1.4/s99394056880722?AQB=1&ndh=1&pf=1&t=21%2F0%2F2021%2018%3A33%3A16%204%20-60&fid=262D8E5D69FA491C-3C828004B48A5FE0&ce=UTF-8&pageName=Purch%7CGetPreApproved%7CPurch%7CRequestCallback%7CForm&g=https%3A%2F%2Fonline.citi.com%2FUS%2FJRS%2Fportal%2Ftemplate_lo.do%3FID%3Dsurestart_preapproval%26client_type%3DLO%26client_id%3D1024024&c.&visitStart=1&.c&cc=USD&ch=CMIWebEnglish&events=event76&c1=CBOL_Lending&h1=BANKRIAWebEnglish%2FCBOL_Lending%2FPurch%2FGetPreApproved%7CHUCY%7CPurch%2FForm&c2=Purch&c3=GetPreApproved%7CHUCY%7CPurch&c4=Form&v6=%2A%2ASENSITIVE%20DATA%20REPLACED%2A%2A&v20=LO1024024&c25=%5BCS%5Dv1%7C3004DD6E1518937A-6000183F9BF79136%5BCE%5D&v30=REL&v38=Purch%7CGetPreApproved%7CPurch%7CRequestCallback%7CForm&c47=%2A%2ASENSITIVE%20DATA%20REPLACED%2A%2A&c48=%2A%2ASENSITIVE%20DATA%20REPLACED%2A%2A&c59=USCBOL_surestart_preapproval&v60=Purch%7CCallback&c61=26&c63=https%3A%2F%2Fonline.citi.com%2FUS%2FJRS%2Fportal%2Ftemplate_lo.do%3FID%3Dsurestart_preapproval%26client_type%3DLO%26client_id%3D1024024&c64=12%3A30PM&v64=12%3A30PM&c65=Thursday&v65=Thursday&c66=Thursday%7C12%3A30PM&v67=New&v68=1&v69=UnAuth&c72=REL&c73=null&s=1600x1200&c=24&j=1.6&v=N&k=Y&bw=1600&bh=1200&AQE=1 HTTP 302
https://metrics1.citibank.com/b/ss/citinaprod/1/JS-1.4/s99394056880722?AQB=1&pccr=true&vidn=3004DD6E7A34589D-40001B421AD99043&ndh=1&pf=1&t=21%2F0%2F2021%2018%3A33%3A16%204%20-60&fid=262D8E5D69FA491C-3C828004B48A5FE0&ce=UTF-8&pageName=Purch%7CGetPreApproved%7CPurch%7CRequestCallback%7CForm&g=https%3A%2F%2Fonline.citi.com%2FUS%2FJRS%2Fportal%2Ftemplate_lo.do%3FID%3Dsurestart_preapproval%26client_type%3DLO%26client_id%3D1024024&c.&visitStart=1&.c&cc=USD&ch=CMIWebEnglish&events=event76&c1=CBOL_Lending&h1=BANKRIAWebEnglish%2FCBOL_Lending%2FPurch%2FGetPreApproved%7CHUCY%7CPurch%2FForm&c2=Purch&c3=GetPreApproved%7CHUCY%7CPurch&c4=Form&v6=%2A%2ASENSITIVE%20DATA%20REPLACED%2A%2A&v20=LO1024024&c25=%5BCS%5Dv1%7C3004DD6E1518937A-6000183F9BF79136%5BCE%5D&v30=REL&v38=Purch%7CGetPreApproved%7CPurch%7CRequestCallback%7CForm&c47=%2A%2ASENSITIVE%20DATA%20REPLACED%2A%2A&c48=%2A%2ASENSITIVE%20DATA%20REPLACED%2A%2A&c59=USCBOL_surestart_preapproval&v60=Purch%7CCallback&c61=26&c63=https%3A%2F%2Fonline.citi.com%2FUS%2FJRS%2Fportal%2Ftemplate_lo.do%3FID%3Dsurestart_preapproval%26client_type%3DLO%26client_id%3D1024024&c64=12%3A30PM&v64=12%3A30PM&c65=Thursday&v65=Thursday&c66=Thursday%7C12%3A30PM&v67=New&v68=1&v69=UnAuth&c72=REL&c73=null&s=1600x1200&c=24&j=1.6&v=N&k=Y&bw=1600&bh=1200&AQE=1

Request Chain 97

https://www.google.com/cse/cse.js?cx=009695499870347544712:e3dyicpbrwu HTTP 301
https://cse.google.com/cse/cse.js?cx=009695499870347544712:e3dyicpbrwu

Request Chain 104

https://citirel.my.salesforce.com/servlet/servlet.ImageServer?id=0152E000001TtDQQA0&oid=00D300000005om9EAA HTTP 301
https://citirel--c.na91.content.force.com/servlet/servlet.ImageServer?id=0152E000001TtDQQA0&oid=00D300000005om9EAA

Request Chain 106

https://6256710.fls.doubleclick.net/activityi;src=6256710;type=drsog0;cat=mortg002;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;ord=5676426202304 HTTP 302
https://6256710.fls.doubleclick.net/activityi;dc_pre=CIf0vbzHre4CFVqKsgod7cgJ4A;src=6256710;type=drsog0;cat=mortg002;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;ord=5676426202304

Request Chain 111

https://metrics1.citibank.com/b/ss/citinaprod/1/JS-1.4/s94755139168289?AQB=1&ndh=1&pf=1&t=21%2F0%2F2021%2018%3A33%3A16%204%20-60&fid=262D8E5D69FA491C-3C828004B48A5FE0&ce=UTF-8&pageName=Purch%7CGetPreApproved&g=https%3A%2F%2Fonline.citi.com%2FUS%2FJRS%2Fportal%2Ftemplate_lo.do%3FID%3Dsurestart_preapproval%26client_type%3DLO%26client_id%3D1024024&cc=USD&ch=CMIWebEnglish&events=event76&c1=CBOL_Lending&h1=BANKRIAWebEnglish%2FCBOL_Lending%2FPurch%2FGetPreApproved%7CHUCY%7CPurch%2FForm&c2=Purch&c3=GetPreApproved&c4=Form&v6=%2A%2ASENSITIVE%20DATA%20REPLACED%2A%2A&v7=Purch%7CGetPreApproved%7CPurch%7CRequestCallback%7CForm&v20=LO1024024&c25=%5BCS%5Dv1%7C3004DD6E1518937A-6000183F9BF79136%5BCE%5D&v30=REL&v38=Purch%7CGetPreApproved&c47=%2A%2ASENSITIVE%20DATA%20REPLACED%2A%2A&c48=%2A%2ASENSITIVE%20DATA%20REPLACED%2A%2A&c59=USCBOL_surestart_preapproval&v60=Purch%7CCallback&c61=26&c63=https%3A%2F%2Fonline.citi.com%2FUS%2FJRS%2Fportal%2Ftemplate_lo.do%3FID%3Dsurestart_preapproval%26client_type%3DLO%26client_id%3D1024024&c64=12%3A30PM&v64=12%3A30PM&c65=Thursday&v65=Thursday&c66=Thursday%7C12%3A30PM&v67=New&v68=1&v69=UnAuth&c72=REL&c73=null&s=1600x1200&c=24&j=1.6&v=N&k=Y&bw=1600&bh=1200&AQE=1 HTTP 302
https://metrics1.citibank.com/b/ss/citinaprod/1/JS-1.4/s94755139168289?AQB=1&pccr=true&vidn=3004DD6EB0BD1A93-40001F0C5ADF976F&ndh=1&pf=1&t=21%2F0%2F2021%2018%3A33%3A16%204%20-60&fid=262D8E5D69FA491C-3C828004B48A5FE0&ce=UTF-8&pageName=Purch%7CGetPreApproved&g=https%3A%2F%2Fonline.citi.com%2FUS%2FJRS%2Fportal%2Ftemplate_lo.do%3FID%3Dsurestart_preapproval%26client_type%3DLO%26client_id%3D1024024&cc=USD&ch=CMIWebEnglish&events=event76&c1=CBOL_Lending&h1=BANKRIAWebEnglish%2FCBOL_Lending%2FPurch%2FGetPreApproved%7CHUCY%7CPurch%2FForm&c2=Purch&c3=GetPreApproved&c4=Form&v6=%2A%2ASENSITIVE%20DATA%20REPLACED%2A%2A&v7=Purch%7CGetPreApproved%7CPurch%7CRequestCallback%7CForm&v20=LO1024024&c25=%5BCS%5Dv1%7C3004DD6E1518937A-6000183F9BF79136%5BCE%5D&v30=REL&v38=Purch%7CGetPreApproved&c47=%2A%2ASENSITIVE%20DATA%20REPLACED%2A%2A&c48=%2A%2ASENSITIVE%20DATA%20REPLACED%2A%2A&c59=USCBOL_surestart_preapproval&v60=Purch%7CCallback&c61=26&c63=https%3A%2F%2Fonline.citi.com%2FUS%2FJRS%2Fportal%2Ftemplate_lo.do%3FID%3Dsurestart_preapproval%26client_type%3DLO%26client_id%3D1024024&c64=12%3A30PM&v64=12%3A30PM&c65=Thursday&v65=Thursday&c66=Thursday%7C12%3A30PM&v67=New&v68=1&v69=UnAuth&c72=REL&c73=null&s=1600x1200&c=24&j=1.6&v=N&k=Y&bw=1600&bh=1200&AQE=1

Request Chain 116

https://metrics1.citibank.com/b/ss/citinaprod/1/JS-1.4/s93554276062718?AQB=1&ndh=1&pf=1&t=21%2F0%2F2021%2018%3A33%3A16%204%20-60&fid=262D8E5D69FA491C-3C828004B48A5FE0&ce=UTF-8&pageName=%7CRequestCallback%7CForm&g=https%3A%2F%2Fonline.citi.com%2FUS%2FJRS%2Fportal%2Ftemplate_lo.do%3FID%3Dsurestart_preapproval%26client_type%3DLO%26client_id%3D1024024&cc=USD&ch=CMIWebEnglish&events=event76&c1=CBOL_Lending&h1=BANKRIAWebEnglish%2FCBOL_Lending%2FPurch%2FGetPreApproved%7CHUCY%7CPurch%2FForm&c2=Purch&c3=RequestCallback%7C&c4=Form&v6=%2A%2ASENSITIVE%20DATA%20REPLACED%2A%2A&v7=Purch%7CGetPreApproved&v20=LO1024024&c25=%5BCS%5Dv1%7C3004DD6E1518937A-6000183F9BF79136%5BCE%5D&v30=REL&v38=%7CRequestCallback%7CForm&c46=Purch%7CGetPreApproved&c47=%2A%2ASENSITIVE%20DATA%20REPLACED%2A%2A&c48=%2A%2ASENSITIVE%20DATA%20REPLACED%2A%2A&c59=jUSCBOL_surestart_preapproval&v60=%7CCallback&c61=26&c63=https%3A%2F%2Fonline.citi.com%2FUS%2FJRS%2Fportal%2Ftemplate_lo.do%3FID%3Dsurestart_preapproval%26client_type%3DLO%26client_id%3D1024024&c64=12%3A30PM&v64=12%3A30PM&c65=Thursday&v65=Thursday&c66=Thursday%7C12%3A30PM&v66=None&v67=New&v68=1&v69=UnAuth&c72=REL&c73=null&s=1600x1200&c=24&j=1.6&v=N&k=Y&bw=1600&bh=1200&AQE=1 HTTP 302
https://metrics1.citibank.com/b/ss/citinaprod/1/JS-1.4/s93554276062718?AQB=1&pccr=true&vidn=3004DD6EE56A3739-40001B92FADB0BAB&ndh=1&pf=1&t=21%2F0%2F2021%2018%3A33%3A16%204%20-60&fid=262D8E5D69FA491C-3C828004B48A5FE0&ce=UTF-8&pageName=%7CRequestCallback%7CForm&g=https%3A%2F%2Fonline.citi.com%2FUS%2FJRS%2Fportal%2Ftemplate_lo.do%3FID%3Dsurestart_preapproval%26client_type%3DLO%26client_id%3D1024024&cc=USD&ch=CMIWebEnglish&events=event76&c1=CBOL_Lending&h1=BANKRIAWebEnglish%2FCBOL_Lending%2FPurch%2FGetPreApproved%7CHUCY%7CPurch%2FForm&c2=Purch&c3=RequestCallback%7C&c4=Form&v6=%2A%2ASENSITIVE%20DATA%20REPLACED%2A%2A&v7=Purch%7CGetPreApproved&v20=LO1024024&c25=%5BCS%5Dv1%7C3004DD6E1518937A-6000183F9BF79136%5BCE%5D&v30=REL&v38=%7CRequestCallback%7CForm&c46=Purch%7CGetPreApproved&c47=%2A%2ASENSITIVE%20DATA%20REPLACED%2A%2A&c48=%2A%2ASENSITIVE%20DATA%20REPLACED%2A%2A&c59=jUSCBOL_surestart_preapproval&v60=%7CCallback&c61=26&c63=https%3A%2F%2Fonline.citi.com%2FUS%2FJRS%2Fportal%2Ftemplate_lo.do%3FID%3Dsurestart_preapproval%26client_type%3DLO%26client_id%3D1024024&c64=12%3A30PM&v64=12%3A30PM&c65=Thursday&v65=Thursday&c66=Thursday%7C12%3A30PM&v66=None&v67=New&v68=1&v69=UnAuth&c72=REL&c73=null&s=1600x1200&c=24&j=1.6&v=N&k=Y&bw=1600&bh=1200&AQE=1

Request Chain 126

https://20822230p.rfihub.com/ca.html?rb=648&ca=20822230&ra=279935670&_o=17169175&_t=zx-cookie-match HTTP 302
https://live.rezync.com/pixel?c=bd8618c307ae9885a12561b7191e2cea&cid=1870471591774814639 HTTP 302
https://p.rfihub.com/cm?pub=39342&in=0&userid=41e704e9-77ef-477a-9194-e470f6299f7c%3A1611250399.24&forward=https%3A//idsync.rlcdn.com/501709.gif%3Fpartner_uid%3D41e704e9-77ef-477a-9194-e470f6299f7c%253A1611250399.24 HTTP 302
https://idsync.rlcdn.com/501709.gif?partner_uid=41e704e9-77ef-477a-9194-e470f6299f7c%3A1611250399.24 HTTP 307
https://idsync.rlcdn.com/1000.gif?memo=CM3PHhI8CjgIARAFGjI0MWU3MDRlOS03N2VmLTQ3N2EtOTE5NC1lNDcwZjYyOTlmN2M6MTYxMTI1MDM5OS4yNBAAGg0I3_WmgAYSBQjoBxAAQgBKAA HTTP 307
https://cm.g.doubleclick.net/pixel?google_nid=epsilon&google_cm HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=epsilon&google_cm=&google_tc= HTTP 302
https://idsync.rlcdn.com/362358.gif?google_gid=CAESEFIdqCwAw-rnD4wrmG-VF0A&google_cver=1

164 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

Primary Request template_lo.do Show response
online.citi.com/US/JRS/portal/
Redirect Chain

http://email.homeloans.citi.com/click/348945348079/9b99e9ef95514c718de68d1de7482dcb
https://online.citi.com/US/JRS/portal/template_lo.do?ID=surestart_preapproval&client_type=LO&client_id=1024024

148 KB
32 KB

1367ms
1243ms

Document
text/html

104.111.238.178
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://online.citi.com/US/JRS/portal/template_lo.do?ID=surestart_preapproval&client_type=LO&client_id=1024024

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.111.238.178 , Netherlands, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-111-238-178.deploy.static.akamaitechnologies.com

Software

Resource Hash

4211ba5ac0bc3e9f883a55817fbbe218d26c95384df6a0128418a8a45f2d55b7

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

:method: GET
:authority: online.citi.com
:scheme: https
:path: /US/JRS/portal/template_lo.do?ID=surestart_preapproval&client_type=LO&client_id=1024024
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: none
sec-fetch-mode: navigate
sec-fetch-user: ?1
sec-fetch-dest: document
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

jid: 210121123314678968079344 210121123314678968079344
x-ua-compatible: IE=edge IE=edge
cache-control: no-cache, must-revalidate, proxy-revalidate, no-store
pragma: no-cache
expires: Thu, 01 Jan 1970 00:00:00 GMT
vary: Accept-Encoding
content-encoding: gzip
x-akamai-citisite: GTDC
strict-transport-security: max-age=300
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
content-type: text/html; charset=ISO-8859-1
content-language: en-US
content-length: 31322
date: Thu, 21 Jan 2021 17:33:15 GMT
set-cookie: JSESSIONID=0000iliOc0bpCwC88lVndpqxm9G:gt09p-srv1; Path=/; Secure; HttpOnly client_id=1024024; Comment="Coockie for Client_id"; Path=/ client_type=LO; Comment="Coockie for Client_type"; Path=/ AKMTLTSID=1EE8E4842DA111766D63CED020371C0F; path=/; domain=citi.com; secure CITI_SITE=gtdc; path=/; domain=.citi.com; secure; HttpOnly
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

Redirect headers

Date: Thu, 21 Jan 2021 17:33:13 GMT
Content-Type: text/html; charset=utf-8
Content-Length: 280
Connection: keep-alive
X-Content-Type-Options: nosniff
X-Frame-Options: SAMEORIGIN
X-Download-Options: noopen
X-XSS-Protection: 1; mode=block
Location: https://online.citi.com/US/JRS/portal/template_lo.do?ID=surestart_preapproval&client_type=LO&client_id=1024024
Vary: Accept, Accept-Encoding

GET
H2 200 CBOLClassic.min.css
online.citi.com/JFP/css/ 195 KB
32 KB 71ms
65ms Stylesheet
text/css 104.111.238.178
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://online.citi.com/JFP/css/CBOLClassic.min.css

Requested by

Host: online.citi.com
URL: https://online.citi.com/US/JRS/portal/template_lo.do?ID=surestart_preapproval&client_type=LO&client_id=1024024

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.111.238.178 , Netherlands, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-111-238-178.deploy.static.akamaitechnologies.com

Software

Resource Hash

bb1bd01ab614af54f6c546c88f92ad916365566583639f3fd045defcfd9e43e8

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

Referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=surestart_preapproval&client_type=LO&client_id=1024024
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=300
content-encoding: gzip
last-modified: Tue, 12 Sep 2017 17:20:58 GMT
x-akamai-citisite: GTDC
date: Thu, 21 Jan 2021 17:33:15 GMT
vary: Accept-Encoding
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
expires: Thu, 21 Jan 2021 23:33:15 GMT
cache-control: max-age=21600
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
content-length: 31753
content-type: text/css
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H/1.1 200
OK vt-23.js Show response
vt.myvisualiq.net/2/N3MGhm6dEiH0%2BACrpXSxSw%3D%3D/ 7 KB
3 KB 184ms
62ms Script
application/x-javascript 65.9.83.34
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://vt.myvisualiq.net/2/N3MGhm6dEiH0%2BACrpXSxSw%3D%3D/vt-23.js
Requested by: Host: online.citi.com
URL: https://online.citi.com/US/JRS/portal/template_lo.do?ID=surestart_preapproval&client_type=LO&client_id=1024024
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 65.9.83.34 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: e2347f2294d6ac2ebbc90ab9716f71da51edf868e77f47ce0594ef841fce2f17

Request headers

Referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=surestart_preapproval&client_type=LO&client_id=1024024
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Thu, 21 Jan 2021 14:40:53 GMT
Content-Encoding: gzip
Last-Modified: Wed, 24 May 2017 07:34:34 GMT
Server: AmazonS3
Age: 10343
ETag: W/"9926b91891e03a45b1c4a98b345b587d"
Vary: Accept-Encoding
X-Cache: Hit from cloudfront
x-amz-version-id: GjE1mMn3oWYiu0LU7OeGAg9SvVnhCyVh
Via: 1.1 2bf8812c27f5e451eba4aef5c1aff6ae.cloudfront.net (CloudFront)
Connection: keep-alive
Transfer-Encoding: chunked
X-Amz-Cf-Pop: AMS1-C1
Content-Type: application/x-javascript
X-Amz-Cf-Id: W3v3x50x2PjIS95Jiq_j7_T7BS3Zou5EF682lNs_DpFNeFo_3qjqig==

GET
H2 200 ddl.css
online.citi.com/JRS/CHIP/css/ 312 KB
44 KB 102ms
96ms Stylesheet
text/css 104.111.238.178
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://online.citi.com/JRS/CHIP/css/ddl.css

Requested by

Host: online.citi.com
URL: https://online.citi.com/US/JRS/portal/template_lo.do?ID=surestart_preapproval&client_type=LO&client_id=1024024

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.111.238.178 , Netherlands, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-111-238-178.deploy.static.akamaitechnologies.com

Software

Resource Hash

288246404bcb8a728f25ecdcaafccb63672b26b0e60d594d86c100febd7c66a0

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

Referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=surestart_preapproval&client_type=LO&client_id=1024024
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=300
content-encoding: gzip
last-modified: Thu, 11 Oct 2018 21:10:25 GMT
x-akamai-citisite: GTDC
date: Thu, 21 Jan 2021 17:33:15 GMT
vary: Accept-Encoding
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
expires: Thu, 21 Jan 2021 23:33:15 GMT
cache-control: max-age=21600
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
content-length: 44536
content-type: text/css
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 200 tagging.js Show response
online.citi.com/CBOL/taggingTransformation/ 59 KB
12 KB 143ms
136ms Script
application/x-javascript 104.111.238.178
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://online.citi.com/CBOL/taggingTransformation/tagging.js

Requested by

Host: online.citi.com
URL: https://online.citi.com/US/JRS/portal/template_lo.do?ID=surestart_preapproval&client_type=LO&client_id=1024024

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.111.238.178 , Netherlands, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-111-238-178.deploy.static.akamaitechnologies.com

Software

Resource Hash

85097f5914dba04ad8504b560ac6d6584cccf68c560dfc3ff573dd1e9e32207d

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

Referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=surestart_preapproval&client_type=LO&client_id=1024024
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=300
content-encoding: gzip
last-modified: Wed, 04 Nov 2020 18:47:36 GMT
x-akamai-citisite: GTDC
date: Thu, 21 Jan 2021 17:33:15 GMT
vary: Accept-Encoding
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
expires: Thu, 21 Jan 2021 23:33:15 GMT
cache-control: max-age=21600
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
content-length: 11940
content-type: application/x-javascript
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 200 Bootstrap.js Show response
nexus.ensighten.com/citi/na_prod/ 278 KB
91 KB 179ms
66ms Script
application/javascript 18.197.253.20
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Requested by: Host: online.citi.com
URL: https://online.citi.com/US/JRS/portal/template_lo.do?ID=surestart_preapproval&client_type=LO&client_id=1024024
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 18.197.253.20 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-197-253-20.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 47b5781e69988949c5ef73987ffca68c5e121859c5e337f16cfa422be4b624ed

Request headers

Referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=surestart_preapproval&client_type=LO&client_id=1024024
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 21 Jan 2021 17:33:15 GMT
content-encoding: gzip
last-modified: Wed, 13 Jan 2021 19:54:04 GMT
server: nginx
etag: W/"5fff4fdc-4591d"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
cache-control: max-age=300

GET
H2 200 JFPNav.js Show response
online.citi.com/JPS/portal/js/ 25 KB
7 KB 156ms
150ms Script
application/x-javascript 104.111.238.178
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://online.citi.com/JPS/portal/js/JFPNav.js

Requested by

Host: online.citi.com
URL: https://online.citi.com/US/JRS/portal/template_lo.do?ID=surestart_preapproval&client_type=LO&client_id=1024024

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.111.238.178 , Netherlands, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-111-238-178.deploy.static.akamaitechnologies.com

Software

Resource Hash

86c2ea209b2d76e6694db4148dc0353c160d6d8bdc0f56fd6476fd8e2dbba6aa

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

Referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=surestart_preapproval&client_type=LO&client_id=1024024
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=300
content-encoding: gzip
last-modified: Wed, 11 Nov 2020 16:18:00 GMT
x-akamai-citisite: GTDC
date: Thu, 21 Jan 2021 17:33:15 GMT
vary: Accept-Encoding
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
expires: Thu, 21 Jan 2021 23:33:15 GMT
cache-control: max-age=21600
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
content-length: 6220
content-type: application/x-javascript
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 200 US-Regional.css
online.citi.com/JRS/css/ 59 KB
13 KB 97ms
92ms Stylesheet
text/css 104.111.238.178
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://online.citi.com/JRS/css/US-Regional.css

Requested by

Host: online.citi.com
URL: https://online.citi.com/US/JRS/portal/template_lo.do?ID=surestart_preapproval&client_type=LO&client_id=1024024

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.111.238.178 , Netherlands, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-111-238-178.deploy.static.akamaitechnologies.com

Software

Resource Hash

8e40771ee97376e22303dd8f2c39ec717e7a9b71eb17e3656d76e035684747cf

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

Referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=surestart_preapproval&client_type=LO&client_id=1024024
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=300
content-encoding: gzip
last-modified: Wed, 11 Nov 2020 16:18:00 GMT
x-akamai-citisite: GTDC
date: Thu, 21 Jan 2021 17:33:15 GMT
vary: Accept-Encoding
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
expires: Thu, 21 Jan 2021 23:33:15 GMT
cache-control: max-age=21600
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
content-length: 12517
content-type: text/css
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 200 jquery.combined.ddl.js Show response
online.citi.com/JFP/js/common/ 327 KB
94 KB 182ms
177ms Script
application/x-javascript 104.111.238.178
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://online.citi.com/JFP/js/common/jquery.combined.ddl.js

Requested by

Host: online.citi.com
URL: https://online.citi.com/US/JRS/portal/template_lo.do?ID=surestart_preapproval&client_type=LO&client_id=1024024

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.111.238.178 , Netherlands, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-111-238-178.deploy.static.akamaitechnologies.com

Software

Resource Hash

0ce9b9b7e79cc180dd9364960612f396be614ce6f01f4f659a5387ff2625b5d6

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

Referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=surestart_preapproval&client_type=LO&client_id=1024024
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=300
content-encoding: gzip
last-modified: Fri, 13 Sep 2019 06:57:28 GMT
x-akamai-citisite: GTDC
date: Thu, 21 Jan 2021 17:33:15 GMT
vary: Accept-Encoding
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
expires: Thu, 21 Jan 2021 23:33:15 GMT
cache-control: max-age=21600
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
content-length: 95528
content-type: application/x-javascript
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 200 jfp.branding.js Show response
online.citi.com/JFP/js/widgets/ 87 KB
29 KB 179ms
174ms Script
application/x-javascript 104.111.238.178
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://online.citi.com/JFP/js/widgets/jfp.branding.js

Requested by

Host: online.citi.com
URL: https://online.citi.com/US/JRS/portal/template_lo.do?ID=surestart_preapproval&client_type=LO&client_id=1024024

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.111.238.178 , Netherlands, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-111-238-178.deploy.static.akamaitechnologies.com

Software

Resource Hash

cb27f55d6e59e402fc582097fb823d849c9141b6e992a06c7d1ea68af1d93740

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

Referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=surestart_preapproval&client_type=LO&client_id=1024024
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=300
content-encoding: gzip
last-modified: Wed, 11 Nov 2020 16:18:00 GMT
x-akamai-citisite: GTDC
date: Thu, 21 Jan 2021 17:33:15 GMT
vary: Accept-Encoding
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
expires: Thu, 21 Jan 2021 23:33:15 GMT
cache-control: max-age=21600
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
content-length: 28768
content-type: application/x-javascript
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 200 jfp.widgets.ddl.js Show response
online.citi.com/JFP_DDL/js/widgets/ 304 KB
74 KB 218ms
212ms Script
application/x-javascript 104.111.238.178
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://online.citi.com/JFP_DDL/js/widgets/jfp.widgets.ddl.js

Requested by

Host: online.citi.com
URL: https://online.citi.com/US/JRS/portal/template_lo.do?ID=surestart_preapproval&client_type=LO&client_id=1024024

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.111.238.178 , Netherlands, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-111-238-178.deploy.static.akamaitechnologies.com

Software

Resource Hash

baa964444ed861dabdd7d1ff31f6b7162e0967ddfcf3a32ff4dcb9c44fc570c4

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

Referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=surestart_preapproval&client_type=LO&client_id=1024024
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=300
content-encoding: gzip
last-modified: Fri, 10 Aug 2018 07:26:42 GMT
x-akamai-citisite: GTDC
date: Thu, 21 Jan 2021 17:33:15 GMT
vary: Accept-Encoding
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
expires: Thu, 21 Jan 2021 23:33:15 GMT
cache-control: max-age=21600
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
content-length: 75501
content-type: application/x-javascript
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 200 SitecatCampaigns.js Show response
online.citi.com/JPS/portal/js/ 9 KB
4 KB 218ms
213ms Script
application/x-javascript 104.111.238.178
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://online.citi.com/JPS/portal/js/SitecatCampaigns.js

Requested by

Host: online.citi.com
URL: https://online.citi.com/US/JRS/portal/template_lo.do?ID=surestart_preapproval&client_type=LO&client_id=1024024

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.111.238.178 , Netherlands, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-111-238-178.deploy.static.akamaitechnologies.com

Software

Resource Hash

413240a2f6cf15313f73033807c5cc13d5de67ca72d2abac9652317133692c51

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

Referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=surestart_preapproval&client_type=LO&client_id=1024024
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=300
content-encoding: gzip
last-modified: Wed, 11 Nov 2020 16:18:00 GMT
x-akamai-citisite: GTDC
date: Thu, 21 Jan 2021 17:33:15 GMT
vary: Accept-Encoding
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
expires: Thu, 21 Jan 2021 23:33:15 GMT
cache-control: max-age=21600
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
content-length: 3242
content-type: application/x-javascript
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 200 citi_Common.js Show response
online.citi.com/GFC/common/js/ 491 KB
76 KB 240ms
235ms Script
application/x-javascript 104.111.238.178
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://online.citi.com/GFC/common/js/citi_Common.js

Requested by

Host: online.citi.com
URL: https://online.citi.com/US/JRS/portal/template_lo.do?ID=surestart_preapproval&client_type=LO&client_id=1024024

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.111.238.178 , Netherlands, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-111-238-178.deploy.static.akamaitechnologies.com

Software

Resource Hash

0911117dae5b4cf689a6581a189630d1e001de76e7950dad82933c8ae832a422

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

Referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=surestart_preapproval&client_type=LO&client_id=1024024
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=300
content-encoding: gzip
last-modified: Wed, 11 Nov 2020 16:18:00 GMT
x-akamai-citisite: GTDC
date: Thu, 21 Jan 2021 17:33:15 GMT
vary: Accept-Encoding
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
expires: Thu, 21 Jan 2021 23:33:15 GMT
cache-control: max-age=21600
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
content-length: 76897
content-type: application/x-javascript
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 200 jquery.autocomplete.js Show response
online.citi.com/JFP/js/jquery/plugins/ 17 KB
6 KB 240ms
235ms Script
application/x-javascript 104.111.238.178
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://online.citi.com/JFP/js/jquery/plugins/jquery.autocomplete.js

Requested by

Host: online.citi.com
URL: https://online.citi.com/US/JRS/portal/template_lo.do?ID=surestart_preapproval&client_type=LO&client_id=1024024

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.111.238.178 , Netherlands, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-111-238-178.deploy.static.akamaitechnologies.com

Software

Resource Hash

b63dce0094ea3c2b03d2dc0205507faaa364d2b686cf32d7090f80d87e9cccf9

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

Referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=surestart_preapproval&client_type=LO&client_id=1024024
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=300
content-encoding: gzip
last-modified: Tue, 10 Jul 2018 12:14:02 GMT
x-akamai-citisite: GTDC
date: Thu, 21 Jan 2021 17:33:15 GMT
vary: Accept-Encoding
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
expires: Thu, 21 Jan 2021 23:33:15 GMT
cache-control: max-age=21600
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
content-length: 5196
content-type: application/x-javascript
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 200 branding_main.css
online.citi.com/GFC/branding/css/ 115 KB
18 KB 128ms
124ms Stylesheet
text/css 104.111.238.178
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://online.citi.com/GFC/branding/css/branding_main.css

Requested by

Host: online.citi.com
URL: https://online.citi.com/US/JRS/portal/template_lo.do?ID=surestart_preapproval&client_type=LO&client_id=1024024

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.111.238.178 , Netherlands, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-111-238-178.deploy.static.akamaitechnologies.com

Software

Resource Hash

55c1a891895fc4a46dbc82176e0c0ff3407ef8f2cc9852f6a707ba3bac979004

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

Referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=surestart_preapproval&client_type=LO&client_id=1024024
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=300
content-encoding: gzip
last-modified: Thu, 01 Oct 2020 14:30:25 GMT
x-akamai-citisite: GTDC
date: Thu, 21 Jan 2021 17:33:15 GMT
vary: Accept-Encoding
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
expires: Thu, 21 Jan 2021 23:33:15 GMT
cache-control: max-age=21600
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
content-length: 17450
content-type: text/css
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 200 chip.min.css
online.citi.com/JRS/CHIP/css/ 852 KB
125 KB 130ms
125ms Stylesheet
text/css 104.111.238.178
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://online.citi.com/JRS/CHIP/css/chip.min.css

Requested by

Host: online.citi.com
URL: https://online.citi.com/US/JRS/portal/template_lo.do?ID=surestart_preapproval&client_type=LO&client_id=1024024

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.111.238.178 , Netherlands, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-111-238-178.deploy.static.akamaitechnologies.com

Software

Resource Hash

9438a07875252842cda519138582b14f8a9559f2efe8571e1e9c44834ede8457

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

Referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=surestart_preapproval&client_type=LO&client_id=1024024
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=300
content-encoding: gzip
last-modified: Mon, 11 Jan 2021 21:38:05 GMT
x-akamai-citisite: GTDC
date: Thu, 21 Jan 2021 17:33:15 GMT
vary: Accept-Encoding
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
expires: Thu, 21 Jan 2021 23:33:15 GMT
cache-control: max-age=21600
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
content-length: 127360
content-type: text/css
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 200 jquery-1.7.2.js Show response
online.citi.com/JFP/js/jquery/ 103 KB
36 KB 280ms
275ms Script
application/x-javascript 104.111.238.178
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://online.citi.com/JFP/js/jquery/jquery-1.7.2.js

Requested by

Host: online.citi.com
URL: https://online.citi.com/US/JRS/portal/template_lo.do?ID=surestart_preapproval&client_type=LO&client_id=1024024

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.111.238.178 , Netherlands, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-111-238-178.deploy.static.akamaitechnologies.com

Software

Resource Hash

85f3dbab562f93a712bc882c0e16bfdcd5053643efc500063de6ed152d5b0c33

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

Referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=surestart_preapproval&client_type=LO&client_id=1024024
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=300
content-encoding: gzip
last-modified: Fri, 13 Sep 2019 06:57:28 GMT
x-akamai-citisite: GTDC
date: Thu, 21 Jan 2021 17:33:15 GMT
vary: Accept-Encoding
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
expires: Thu, 21 Jan 2021 23:33:15 GMT
cache-control: max-age=21600
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
content-length: 36782
content-type: application/x-javascript
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 200 chip.min.js Show response
online.citi.com/JRS/CHIP/js/ 568 KB
131 KB 298ms
294ms Script
application/x-javascript 104.111.238.178
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://online.citi.com/JRS/CHIP/js/chip.min.js

Requested by

Host: online.citi.com
URL: https://online.citi.com/US/JRS/portal/template_lo.do?ID=surestart_preapproval&client_type=LO&client_id=1024024

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.111.238.178 , Netherlands, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-111-238-178.deploy.static.akamaitechnologies.com

Software

Resource Hash

559a955364e508ac1fdb0f5a54062f28682c7b4046997f1b5477b40072aa7cad

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

Referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=surestart_preapproval&client_type=LO&client_id=1024024
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=300
content-encoding: gzip
last-modified: Thu, 07 Jan 2021 22:04:38 GMT
x-akamai-citisite: GTDC
date: Thu, 21 Jan 2021 17:33:15 GMT
vary: Accept-Encoding
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
expires: Thu, 21 Jan 2021 23:33:15 GMT
cache-control: max-age=21600
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
content-length: 133815
content-type: application/x-javascript
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 200 youtube-video-player.js Show response
online.citi.com/JRS/CHIP/js/ 24 KB
4 KB 298ms
294ms Script
application/x-javascript 104.111.238.178
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://online.citi.com/JRS/CHIP/js/youtube-video-player.js

Requested by

Host: online.citi.com
URL: https://online.citi.com/US/JRS/portal/template_lo.do?ID=surestart_preapproval&client_type=LO&client_id=1024024

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.111.238.178 , Netherlands, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-111-238-178.deploy.static.akamaitechnologies.com

Software

Resource Hash

56829ae989e5a11036e30ac73bf04ef74094c0871e278f30b6645211b2eb1a1f

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

Referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=surestart_preapproval&client_type=LO&client_id=1024024
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=300
content-encoding: gzip
last-modified: Fri, 15 May 2020 22:02:28 GMT
x-akamai-citisite: GTDC
date: Thu, 21 Jan 2021 17:33:15 GMT
vary: Accept-Encoding
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
expires: Thu, 21 Jan 2021 23:33:15 GMT
cache-control: max-age=21600
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
content-length: 3745
content-type: application/x-javascript
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 200 jquery-ui-1.8.10.js Show response
online.citi.com/JFP/js/jquery/plugins/ 210 KB
53 KB 334ms
331ms Script
application/x-javascript 104.111.238.178
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://online.citi.com/JFP/js/jquery/plugins/jquery-ui-1.8.10.js

Requested by

Host: online.citi.com
URL: https://online.citi.com/US/JRS/portal/template_lo.do?ID=surestart_preapproval&client_type=LO&client_id=1024024

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.111.238.178 , Netherlands, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-111-238-178.deploy.static.akamaitechnologies.com

Software

Resource Hash

b4021b10e9415a2107e00ab35a769df3c3a15328b731da1f627a13c0c83ac6a2

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

Referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=surestart_preapproval&client_type=LO&client_id=1024024
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=300
content-encoding: gzip
last-modified: Tue, 12 Sep 2017 17:24:52 GMT
x-akamai-citisite: GTDC
date: Thu, 21 Jan 2021 17:33:15 GMT
vary: Accept-Encoding
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
expires: Thu, 21 Jan 2021 23:33:15 GMT
cache-control: max-age=21600
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
content-length: 53276
content-type: application/x-javascript
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 200 jfp.widgets.js Show response
online.citi.com/JFP/js/widgets/ 357 KB
86 KB 337ms
334ms Script
application/x-javascript 104.111.238.178
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://online.citi.com/JFP/js/widgets/jfp.widgets.js

Requested by

Host: online.citi.com
URL: https://online.citi.com/US/JRS/portal/template_lo.do?ID=surestart_preapproval&client_type=LO&client_id=1024024

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.111.238.178 , Netherlands, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-111-238-178.deploy.static.akamaitechnologies.com

Software

Resource Hash

192ae096ba2bc7bc55140f2db3522487dd49d626662e78f8f9bd729bf7208206

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

Referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=surestart_preapproval&client_type=LO&client_id=1024024
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=300
content-encoding: gzip
last-modified: Wed, 11 Nov 2020 16:18:00 GMT
x-akamai-citisite: GTDC
date: Thu, 21 Jan 2021 17:33:15 GMT
vary: Accept-Encoding
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
expires: Thu, 21 Jan 2021 23:33:15 GMT
cache-control: max-age=21600
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
content-length: 87282
content-type: application/x-javascript
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 200 handlebars-v3.0.0.runtime.js Show response
online.citi.com/JRS/CHIP/js/ 22 KB
7 KB 354ms
351ms Script
application/x-javascript 104.111.238.178
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://online.citi.com/JRS/CHIP/js/handlebars-v3.0.0.runtime.js

Requested by

Host: online.citi.com
URL: https://online.citi.com/US/JRS/portal/template_lo.do?ID=surestart_preapproval&client_type=LO&client_id=1024024

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.111.238.178 , Netherlands, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-111-238-178.deploy.static.akamaitechnologies.com

Software

Resource Hash

c67f8ec8aee897904395c535ed560101abed2f245bc9e914cccdc882592526a0

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

Referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=surestart_preapproval&client_type=LO&client_id=1024024
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=300
content-encoding: gzip
last-modified: Tue, 12 Sep 2017 17:24:52 GMT
x-akamai-citisite: GTDC
date: Thu, 21 Jan 2021 17:33:15 GMT
vary: Accept-Encoding
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
expires: Thu, 21 Jan 2021 23:33:15 GMT
cache-control: max-age=21600
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
content-length: 6567
content-type: application/x-javascript
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 200 chip-brand-header.js Show response
online.citi.com/JRS/CHIP/js/ 11 KB
3 KB 360ms
357ms Script
application/x-javascript 104.111.238.178
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://online.citi.com/JRS/CHIP/js/chip-brand-header.js

Requested by

Host: online.citi.com
URL: https://online.citi.com/US/JRS/portal/template_lo.do?ID=surestart_preapproval&client_type=LO&client_id=1024024

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.111.238.178 , Netherlands, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-111-238-178.deploy.static.akamaitechnologies.com

Software

Resource Hash

d47715394bd51deef2ed110a313ade6e1b61d55e1107b390fc47abd54454db52

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

Referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=surestart_preapproval&client_type=LO&client_id=1024024
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=300
content-encoding: gzip
last-modified: Tue, 13 Nov 2018 17:23:44 GMT
x-akamai-citisite: GTDC
date: Thu, 21 Jan 2021 17:33:15 GMT
vary: Accept-Encoding
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
expires: Thu, 21 Jan 2021 23:33:15 GMT
cache-control: max-age=21600
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
content-length: 2847
content-type: application/x-javascript
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 200 cbol-smartSearch.css
online.citi.com/NCCS/smartSearch/css/ 8 KB
1 KB 142ms
139ms Stylesheet
text/css 104.111.238.178
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://online.citi.com/NCCS/smartSearch/css/cbol-smartSearch.css

Requested by

Host: online.citi.com
URL: https://online.citi.com/US/JRS/portal/template_lo.do?ID=surestart_preapproval&client_type=LO&client_id=1024024

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.111.238.178 , Netherlands, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-111-238-178.deploy.static.akamaitechnologies.com

Software

Resource Hash

6d3001c9deac8cb1f88ea5254105f8d678de5532f1998a24eab1b59906eaf86b

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

Referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=surestart_preapproval&client_type=LO&client_id=1024024
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=300
content-encoding: gzip
last-modified: Tue, 13 Feb 2018 16:10:30 GMT
x-akamai-citisite: GTDC
date: Thu, 21 Jan 2021 17:33:15 GMT
vary: Accept-Encoding
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
expires: Thu, 21 Jan 2021 23:33:15 GMT
cache-control: max-age=21600
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
content-length: 899
content-type: text/css
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 200 HowCanWeHelpButton_default.png
online.citi.com/GFC/branding/img/ 3 KB
4 KB 459ms
451ms Image
image/png 104.111.238.178
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://online.citi.com/GFC/branding/img/HowCanWeHelpButton_default.png

Requested by

Host: online.citi.com
URL: https://online.citi.com/US/JRS/portal/template_lo.do?ID=surestart_preapproval&client_type=LO&client_id=1024024

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.111.238.178 , Netherlands, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-111-238-178.deploy.static.akamaitechnologies.com

Software

Resource Hash

f35167f960fb0ce996db66bdfc5723771a4acc8e7206b282e7dfaa8c2ca81e3b

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

Referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=surestart_preapproval&client_type=LO&client_id=1024024
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 21 Jan 2021 17:33:16 GMT
last-modified: Mon, 27 Apr 2020 04:42:01 GMT
x-akamai-citisite: GTDC
strict-transport-security: max-age=300
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
content-length: 3364
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
accept-ranges: bytes
content-type: image/png
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 200 sniffer.js Show response
online.citi.com/JRS/cm/js/ 2 KB
1 KB 69ms
57ms Script
application/x-javascript 104.111.238.178
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://online.citi.com/JRS/cm/js/sniffer.js

Requested by

Host: online.citi.com
URL: https://online.citi.com/US/JRS/portal/template_lo.do?ID=surestart_preapproval&client_type=LO&client_id=1024024

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.111.238.178 , Netherlands, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-111-238-178.deploy.static.akamaitechnologies.com

Software

Resource Hash

63a4d32133227b970a48bbd2b8bda5fa0cef4503b4c20ebc1b52dd68c4b21f10

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

Referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=surestart_preapproval&client_type=LO&client_id=1024024
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=300
content-encoding: gzip
last-modified: Tue, 12 Sep 2017 17:24:52 GMT
x-akamai-citisite: GTDC
date: Thu, 21 Jan 2021 17:33:15 GMT
vary: Accept-Encoding
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
expires: Thu, 21 Jan 2021 23:33:15 GMT
cache-control: max-age=21600
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
content-length: 727
content-type: application/x-javascript
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 200 LO-template.css
online.citi.com/JRS/CHIP/css/ 18 KB
4 KB 720ms
708ms Stylesheet
text/css 104.111.238.178
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://online.citi.com/JRS/CHIP/css/LO-template.css

Requested by

Host: online.citi.com
URL: https://online.citi.com/US/JRS/portal/template_lo.do?ID=surestart_preapproval&client_type=LO&client_id=1024024

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.111.238.178 , Netherlands, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-111-238-178.deploy.static.akamaitechnologies.com

Software

Resource Hash

47d3a0c142dc756cd048e15919192fc3dbb22fc8070373f1fa73a41bbbb247db

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=300
content-encoding: gzip
last-modified: Tue, 23 Jun 2020 16:33:49 GMT
x-akamai-citisite: GTDC
date: Thu, 21 Jan 2021 17:33:16 GMT
vary: Accept-Encoding
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
expires: Thu, 21 Jan 2021 23:33:16 GMT
cache-control: max-age=21600
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
content-length: 3695
content-type: text/css
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 200 loan-officer-tmpls.js Show response
online.citi.com/JRS/CHIP/js/ 9 KB
2 KB 730ms
718ms Script
application/x-javascript 104.111.238.178
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://online.citi.com/JRS/CHIP/js/loan-officer-tmpls.js

Requested by

Host: online.citi.com
URL: https://online.citi.com/US/JRS/portal/template_lo.do?ID=surestart_preapproval&client_type=LO&client_id=1024024

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.111.238.178 , Netherlands, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-111-238-178.deploy.static.akamaitechnologies.com

Software

Resource Hash

b09fedb01b573461330e544b518c058872dc311440b2da9d58efbaf025b92beb

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

Referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=surestart_preapproval&client_type=LO&client_id=1024024
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=300
content-encoding: gzip
last-modified: Tue, 12 Sep 2017 17:20:58 GMT
x-akamai-citisite: GTDC
date: Thu, 21 Jan 2021 17:33:16 GMT
vary: Accept-Encoding
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
expires: Thu, 21 Jan 2021 23:33:16 GMT
cache-control: max-age=21600
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
content-length: 1592
content-type: application/x-javascript
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 200 loan-officer.js Show response
online.citi.com/JRS/CHIP/js/ 31 KB
8 KB 778ms
767ms Script
application/x-javascript 104.111.238.178
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://online.citi.com/JRS/CHIP/js/loan-officer.js

Requested by

Host: online.citi.com
URL: https://online.citi.com/US/JRS/portal/template_lo.do?ID=surestart_preapproval&client_type=LO&client_id=1024024

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.111.238.178 , Netherlands, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-111-238-178.deploy.static.akamaitechnologies.com

Software

Resource Hash

fc97d8d255f502986df8493852e51c9a3a7d725c6d0c65fffe8b266940c31699

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

Referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=surestart_preapproval&client_type=LO&client_id=1024024
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=300
content-encoding: gzip
last-modified: Mon, 05 Oct 2020 16:51:33 GMT
x-akamai-citisite: GTDC
date: Thu, 21 Jan 2021 17:33:16 GMT
vary: Accept-Encoding
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
expires: Thu, 21 Jan 2021 23:33:16 GMT
cache-control: max-age=21600
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
content-length: 7596
content-type: application/x-javascript
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 200 DDLValidation.js Show response
online.citi.com/JRS/CHIP/js/ 23 KB
5 KB 149ms
137ms Script
application/x-javascript 104.111.238.178
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://online.citi.com/JRS/CHIP/js/DDLValidation.js

Requested by

Host: online.citi.com
URL: https://online.citi.com/US/JRS/portal/template_lo.do?ID=surestart_preapproval&client_type=LO&client_id=1024024

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.111.238.178 , Netherlands, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-111-238-178.deploy.static.akamaitechnologies.com

Software

Resource Hash

b4d194e97cb5a5422cda4e4c49a8bae0f3bb4584694176386402a1423b65b602

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

Referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=surestart_preapproval&client_type=LO&client_id=1024024
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=300
content-encoding: gzip
last-modified: Fri, 24 Jan 2020 19:58:00 GMT
x-akamai-citisite: GTDC
date: Thu, 21 Jan 2021 17:33:15 GMT
vary: Accept-Encoding
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
expires: Thu, 21 Jan 2021 23:33:15 GMT
cache-control: max-age=21600
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
content-length: 5037
content-type: application/x-javascript
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 200 lo-lead-form.js Show response
online.citi.com/JRS/CHIP/js/ 27 KB
5 KB 788ms
776ms Script
application/x-javascript 104.111.238.178
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://online.citi.com/JRS/CHIP/js/lo-lead-form.js

Requested by

Host: online.citi.com
URL: https://online.citi.com/US/JRS/portal/template_lo.do?ID=surestart_preapproval&client_type=LO&client_id=1024024

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.111.238.178 , Netherlands, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-111-238-178.deploy.static.akamaitechnologies.com

Software

Resource Hash

c8e4f79523defc28bb4948fcf37159478f0ecdbb768cc9be73b9a429be3d1139

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

Referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=surestart_preapproval&client_type=LO&client_id=1024024
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=300
content-encoding: gzip
last-modified: Tue, 24 Apr 2018 14:25:24 GMT
x-akamai-citisite: GTDC
date: Thu, 21 Jan 2021 17:33:16 GMT
vary: Accept-Encoding
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
expires: Thu, 21 Jan 2021 23:33:16 GMT
cache-control: max-age=21600
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
content-length: 4492
content-type: application/x-javascript
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 200 TH-Lounge-Room.jpg
online.citi.com/JRS/CHIP/img/ 94 KB
95 KB 1083ms
1075ms Image
image/jpeg 104.111.238.178
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://online.citi.com/JRS/CHIP/img/TH-Lounge-Room.jpg

Requested by

Host: online.citi.com
URL: https://online.citi.com/US/JRS/portal/template_lo.do?ID=surestart_preapproval&client_type=LO&client_id=1024024

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.111.238.178 , Netherlands, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-111-238-178.deploy.static.akamaitechnologies.com

Software

Resource Hash

3281179a748a0e0cdc4b71cf946d6f4a514f723aef49db36da210b0f30ce44e5

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

Referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=surestart_preapproval&client_type=LO&client_id=1024024
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 21 Jan 2021 17:33:16 GMT
last-modified: Fri, 20 Apr 2018 20:15:43 GMT
x-akamai-citisite: GTDC
strict-transport-security: max-age=300
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
content-length: 96521
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
accept-ranges: bytes
content-type: image/jpeg
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 200 Pre-Approval-VideoStill.png
online.citi.com/JRS/CHIP/img/ 36 KB
36 KB 1164ms
1156ms Image
image/png 104.111.238.178
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://online.citi.com/JRS/CHIP/img/Pre-Approval-VideoStill.png

Requested by

Host: online.citi.com
URL: https://online.citi.com/US/JRS/portal/template_lo.do?ID=surestart_preapproval&client_type=LO&client_id=1024024

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.111.238.178 , Netherlands, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-111-238-178.deploy.static.akamaitechnologies.com

Software

Resource Hash

3244cc85206c13d56be8604e6cd6ca93bb0b58e712fa12e663b8f3e12495e891

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

Referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=surestart_preapproval&client_type=LO&client_id=1024024
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 21 Jan 2021 17:33:16 GMT
last-modified: Wed, 28 Nov 2018 18:11:07 GMT
x-akamai-citisite: GTDC
strict-transport-security: max-age=300
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
content-length: 36790
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
accept-ranges: bytes
content-type: image/png
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 200 CITI-MG-Educational-Videos-Movie-Stills-Time-to-Upsize.jpg
online.citi.com/JRS/CHIP/img/video-module/ 41 KB
41 KB 1164ms
1157ms Image
image/jpeg 104.111.238.178
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://online.citi.com/JRS/CHIP/img/video-module/CITI-MG-Educational-Videos-Movie-Stills-Time-to-Upsize.jpg

Requested by

Host: online.citi.com
URL: https://online.citi.com/US/JRS/portal/template_lo.do?ID=surestart_preapproval&client_type=LO&client_id=1024024

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.111.238.178 , Netherlands, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-111-238-178.deploy.static.akamaitechnologies.com

Software

Resource Hash

53baec92768319431128c733e6df9784b9cc492006494f925410b176a02cb9fd

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

Referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=surestart_preapproval&client_type=LO&client_id=1024024
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 21 Jan 2021 17:33:16 GMT
last-modified: Wed, 13 Feb 2019 15:39:49 GMT
x-akamai-citisite: GTDC
strict-transport-security: max-age=300
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
content-length: 41810
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
accept-ranges: bytes
content-type: image/jpeg
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 200 CITI-MG-Educational-Videos-Movie-Stills-Upgrade-Or-Move.jpg
online.citi.com/JRS/CHIP/img/video-module/ 594 KB
596 KB 1135ms
1127ms Image
image/jpeg 104.111.238.178
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://online.citi.com/JRS/CHIP/img/video-module/CITI-MG-Educational-Videos-Movie-Stills-Upgrade-Or-Move.jpg

Requested by

Host: online.citi.com
URL: https://online.citi.com/US/JRS/portal/template_lo.do?ID=surestart_preapproval&client_type=LO&client_id=1024024

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.111.238.178 , Netherlands, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-111-238-178.deploy.static.akamaitechnologies.com

Software

Resource Hash

df41438b4814647ed52d3803e0815efadd10267a02ad1b6224332e46b8af8105

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

Referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=surestart_preapproval&client_type=LO&client_id=1024024
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 21 Jan 2021 17:33:16 GMT
last-modified: Mon, 04 Nov 2019 17:46:43 GMT
x-akamai-citisite: GTDC
strict-transport-security: max-age=300
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
content-length: 608316
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
accept-ranges: bytes
content-type: image/jpeg
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 200 Citi-Enterprise-White.svg
online.citi.com/JRS/CHIP/img/ 2 KB
1 KB 1164ms
1157ms Image
image/svg+xml 104.111.238.178
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://online.citi.com/JRS/CHIP/img/Citi-Enterprise-White.svg

Requested by

Host: online.citi.com
URL: https://online.citi.com/US/JRS/portal/template_lo.do?ID=surestart_preapproval&client_type=LO&client_id=1024024

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.111.238.178 , Netherlands, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-111-238-178.deploy.static.akamaitechnologies.com

Software

Resource Hash

4bded90d3a2799860116b329ec237413d9850e67cc44ee93bd83d654d44682fe

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

Referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=surestart_preapproval&client_type=LO&client_id=1024024
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=300
content-encoding: gzip
last-modified: Tue, 12 Sep 2017 17:24:52 GMT
x-akamai-citisite: GTDC
date: Thu, 21 Jan 2021 17:33:16 GMT
vary: Accept-Encoding
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
content-length: 965
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
accept-ranges: bytes
content-type: image/svg+xml
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 200 replay.png
online.citi.com/JRS/CHIP/img/ 3 KB
3 KB 1273ms
1267ms Image
image/png 104.111.238.178
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://online.citi.com/JRS/CHIP/img/replay.png

Requested by

Host: online.citi.com
URL: https://online.citi.com/US/JRS/portal/template_lo.do?ID=surestart_preapproval&client_type=LO&client_id=1024024

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.111.238.178 , Netherlands, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-111-238-178.deploy.static.akamaitechnologies.com

Software

Resource Hash

bb09fa6144db5a44a216936f7a915205de5e78882f75a96434d9215f0c3a0872

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

Referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=surestart_preapproval&client_type=LO&client_id=1024024
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 21 Jan 2021 17:33:16 GMT
last-modified: Tue, 12 Sep 2017 17:16:58 GMT
x-akamai-citisite: GTDC
strict-transport-security: max-age=300
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
content-length: 2560
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
accept-ranges: bytes
content-type: image/png
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 200 jquery.caret.min.js Show response
online.citi.com/JRS/CHIP/js/ 1 KB
1 KB 223ms
211ms Script
application/x-javascript 104.111.238.178
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://online.citi.com/JRS/CHIP/js/jquery.caret.min.js

Requested by

Host: online.citi.com
URL: https://online.citi.com/US/JRS/portal/template_lo.do?ID=surestart_preapproval&client_type=LO&client_id=1024024

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.111.238.178 , Netherlands, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-111-238-178.deploy.static.akamaitechnologies.com

Software

Resource Hash

d9a3954458e11340809dd9dcf98d0b52f1a21cc41542d1d3380509d8ae8cf788

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

Referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=surestart_preapproval&client_type=LO&client_id=1024024
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=300
content-encoding: gzip
last-modified: Tue, 12 Sep 2017 17:24:52 GMT
x-akamai-citisite: GTDC
date: Thu, 21 Jan 2021 17:33:15 GMT
vary: Accept-Encoding
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
expires: Thu, 21 Jan 2021 23:33:15 GMT
cache-control: max-age=21600
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
content-length: 607
content-type: application/x-javascript
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 200 citiTextBlur-jquery1.7.js Show response
online.citi.com/JRS/CHIP/js/ 47 KB
9 KB 803ms
791ms Script
application/x-javascript 104.111.238.178
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://online.citi.com/JRS/CHIP/js/citiTextBlur-jquery1.7.js

Requested by

Host: online.citi.com
URL: https://online.citi.com/US/JRS/portal/template_lo.do?ID=surestart_preapproval&client_type=LO&client_id=1024024

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.111.238.178 , Netherlands, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-111-238-178.deploy.static.akamaitechnologies.com

Software

Resource Hash

5931f2f5347340dc4fbd86642ba2cf75f093d1985ed91cbc8b3f7e1aab459a85

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

Referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=surestart_preapproval&client_type=LO&client_id=1024024
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=300
content-encoding: gzip
last-modified: Tue, 12 Sep 2017 17:12:07 GMT
x-akamai-citisite: GTDC
date: Thu, 21 Jan 2021 17:33:16 GMT
vary: Accept-Encoding
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
expires: Thu, 21 Jan 2021 23:33:16 GMT
cache-control: max-age=21600
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
content-length: 8280
content-type: application/x-javascript
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 200 underscore-min.js Show response
online.citi.com/JRS/CHIP/js/ 16 KB
6 KB 223ms
212ms Script
application/x-javascript 104.111.238.178
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://online.citi.com/JRS/CHIP/js/underscore-min.js

Requested by

Host: online.citi.com
URL: https://online.citi.com/US/JRS/portal/template_lo.do?ID=surestart_preapproval&client_type=LO&client_id=1024024

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.111.238.178 , Netherlands, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-111-238-178.deploy.static.akamaitechnologies.com

Software

Resource Hash

2de19ea3b85e03239dd9cbe30d9545a1b5a7ce2f0662feaeaf3d2d088179ea5c

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

Referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=surestart_preapproval&client_type=LO&client_id=1024024
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=300
content-encoding: gzip
last-modified: Tue, 12 Sep 2017 17:22:45 GMT
x-akamai-citisite: GTDC
date: Thu, 21 Jan 2021 17:33:15 GMT
vary: Accept-Encoding
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
expires: Thu, 21 Jan 2021 23:33:15 GMT
cache-control: max-age=21600
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
content-length: 5805
content-type: application/x-javascript
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 200 DDLFormConfiguration.js Show response
online.citi.com/JRS/CHIP/js/ 2 KB
1 KB 242ms
231ms Script
application/x-javascript 104.111.238.178
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://online.citi.com/JRS/CHIP/js/DDLFormConfiguration.js

Requested by

Host: online.citi.com
URL: https://online.citi.com/US/JRS/portal/template_lo.do?ID=surestart_preapproval&client_type=LO&client_id=1024024

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.111.238.178 , Netherlands, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-111-238-178.deploy.static.akamaitechnologies.com

Software

Resource Hash

8ccab9e0c2bd6afa06ebf24a1679c7693f0bccee878286f38c75e80a37f1062b

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

Referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=surestart_preapproval&client_type=LO&client_id=1024024
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=300
content-encoding: gzip
last-modified: Tue, 12 Sep 2017 17:22:45 GMT
x-akamai-citisite: GTDC
date: Thu, 21 Jan 2021 17:33:15 GMT
vary: Accept-Encoding
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
expires: Thu, 21 Jan 2021 23:33:15 GMT
cache-control: max-age=21600
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
content-length: 553
content-type: application/x-javascript
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 200 request-call-back.js Show response
online.citi.com/JRS/CHIP/js/ 109 KB
16 KB 880ms
869ms Script
application/x-javascript 104.111.238.178
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://online.citi.com/JRS/CHIP/js/request-call-back.js

Requested by

Host: online.citi.com
URL: https://online.citi.com/US/JRS/portal/template_lo.do?ID=surestart_preapproval&client_type=LO&client_id=1024024

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.111.238.178 , Netherlands, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-111-238-178.deploy.static.akamaitechnologies.com

Software

Resource Hash

9aad0a8fa60381055fb1fc99b90904e0f933bfbd691691773eb08b2d013651c5

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

Referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=surestart_preapproval&client_type=LO&client_id=1024024
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=300
content-encoding: gzip
last-modified: Fri, 16 Oct 2020 19:31:55 GMT
x-akamai-citisite: GTDC
date: Thu, 21 Jan 2021 17:33:16 GMT
vary: Accept-Encoding
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
expires: Thu, 21 Jan 2021 23:33:16 GMT
cache-control: max-age=21600
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
content-length: 15806
content-type: application/x-javascript
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 200 s_code.js Show response
online.citi.com/JRS/js/ 47 KB
18 KB 243ms
232ms Script
application/x-javascript 104.111.238.178
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://online.citi.com/JRS/js/s_code.js

Requested by

Host: online.citi.com
URL: https://online.citi.com/US/JRS/portal/template_lo.do?ID=surestart_preapproval&client_type=LO&client_id=1024024

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.111.238.178 , Netherlands, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-111-238-178.deploy.static.akamaitechnologies.com

Software

Resource Hash

f5f66ab8170ccc3fd83ed8dab1dcc2b56ab257cb82ddc3c0eba15f33d3012b3f

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

Referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=surestart_preapproval&client_type=LO&client_id=1024024
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=300
content-encoding: gzip
last-modified: Wed, 11 Nov 2020 16:18:00 GMT
x-akamai-citisite: GTDC
date: Thu, 21 Jan 2021 17:33:15 GMT
vary: Accept-Encoding
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
expires: Thu, 21 Jan 2021 23:33:15 GMT
cache-control: max-age=21600
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
content-length: 18173
content-type: application/x-javascript
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 200 le-mtagconfig.js Show response
online.citi.com/JRS/js/chat/ 2 KB
1 KB 271ms
260ms Script
application/x-javascript 104.111.238.178
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://online.citi.com/JRS/js/chat/le-mtagconfig.js

Requested by

Host: online.citi.com
URL: https://online.citi.com/US/JRS/portal/template_lo.do?ID=surestart_preapproval&client_type=LO&client_id=1024024

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.111.238.178 , Netherlands, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-111-238-178.deploy.static.akamaitechnologies.com

Software

Resource Hash

d8b32a1e0f5d3d3d05cda5e3e109a8198be3ceca3ae8b4fe63d2bd471920ef7f

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

Referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=surestart_preapproval&client_type=LO&client_id=1024024
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=300
content-encoding: gzip
last-modified: Tue, 12 Sep 2017 17:22:45 GMT
x-akamai-citisite: GTDC
date: Thu, 21 Jan 2021 17:33:15 GMT
vary: Accept-Encoding
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
expires: Thu, 21 Jan 2021 23:33:15 GMT
cache-control: max-age=21600
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
content-length: 745
content-type: application/x-javascript
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 200 LPAttributes.js Show response
online.citi.com/JRS/js/chat/ 14 KB
4 KB 271ms
261ms Script
application/x-javascript 104.111.238.178
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://online.citi.com/JRS/js/chat/LPAttributes.js

Requested by

Host: online.citi.com
URL: https://online.citi.com/US/JRS/portal/template_lo.do?ID=surestart_preapproval&client_type=LO&client_id=1024024

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.111.238.178 , Netherlands, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-111-238-178.deploy.static.akamaitechnologies.com

Software

Resource Hash

015e6103bdf04fef85eeb4c098ee7f0fa746ece89b30738106a50fa64b40d444

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

Referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=surestart_preapproval&client_type=LO&client_id=1024024
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=300
content-encoding: gzip
last-modified: Mon, 20 Jan 2020 19:26:26 GMT
x-akamai-citisite: GTDC
date: Thu, 21 Jan 2021 17:33:15 GMT
vary: Accept-Encoding
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
expires: Thu, 21 Jan 2021 23:33:15 GMT
cache-control: max-age=21600
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
content-length: 3775
content-type: application/x-javascript
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 200 chatMask.js Show response
online.citi.com/JRS/js/chat/ 802 B
779 B 301ms
291ms Script
application/x-javascript 104.111.238.178
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://online.citi.com/JRS/js/chat/chatMask.js

Requested by

Host: online.citi.com
URL: https://online.citi.com/US/JRS/portal/template_lo.do?ID=surestart_preapproval&client_type=LO&client_id=1024024

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.111.238.178 , Netherlands, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-111-238-178.deploy.static.akamaitechnologies.com

Software

Resource Hash

3975b76cc53eb1aeb0a232bc60d18c3aa1ddd3e8a7a08db6abbc14392662ca67

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

Referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=surestart_preapproval&client_type=LO&client_id=1024024
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=300
content-encoding: gzip
last-modified: Tue, 12 Sep 2017 17:24:53 GMT
x-akamai-citisite: GTDC
date: Thu, 21 Jan 2021 17:33:15 GMT
vary: Accept-Encoding
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
expires: Thu, 21 Jan 2021 23:33:15 GMT
cache-control: max-age=21600
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
content-length: 290
content-type: application/x-javascript
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 200 chatLPHandler.js Show response
online.citi.com/JRS/js/chat/ 5 KB
2 KB 301ms
291ms Script
application/x-javascript 104.111.238.178
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://online.citi.com/JRS/js/chat/chatLPHandler.js

Requested by

Host: online.citi.com
URL: https://online.citi.com/US/JRS/portal/template_lo.do?ID=surestart_preapproval&client_type=LO&client_id=1024024

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.111.238.178 , Netherlands, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-111-238-178.deploy.static.akamaitechnologies.com

Software

Resource Hash

e1739237d530e65b6e4b1a4d0a11223446e78b94d4dd7db657f48fede05e1d6e

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

Referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=surestart_preapproval&client_type=LO&client_id=1024024
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=300
content-encoding: gzip
last-modified: Tue, 12 Sep 2017 17:24:53 GMT
x-akamai-citisite: GTDC
date: Thu, 21 Jan 2021 17:33:16 GMT
vary: Accept-Encoding
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
expires: Thu, 21 Jan 2021 23:33:16 GMT
cache-control: max-age=21600
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
content-length: 1701
content-type: application/x-javascript
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 200 chatSiteCatTagging.js Show response
online.citi.com/JRS/js/chat/ 2 KB
1 KB 334ms
324ms Script
application/x-javascript 104.111.238.178
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://online.citi.com/JRS/js/chat/chatSiteCatTagging.js

Requested by

Host: online.citi.com
URL: https://online.citi.com/US/JRS/portal/template_lo.do?ID=surestart_preapproval&client_type=LO&client_id=1024024

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.111.238.178 , Netherlands, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-111-238-178.deploy.static.akamaitechnologies.com

Software

Resource Hash

5c3344d6f25b95a3561326b43bdea1a94d3dcd65097a6db527442978a3ebf86f

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

Referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=surestart_preapproval&client_type=LO&client_id=1024024
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=300
content-encoding: gzip
last-modified: Tue, 09 Jul 2019 07:57:08 GMT
x-akamai-citisite: GTDC
date: Thu, 21 Jan 2021 17:33:16 GMT
vary: Accept-Encoding
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
expires: Thu, 21 Jan 2021 23:33:16 GMT
cache-control: max-age=21600
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
content-length: 646
content-type: application/x-javascript
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 200 MFAOverlay.js Show response
online.citi.com/JPS/portal/js/ 2 KB
1 KB 334ms
325ms Script
application/x-javascript 104.111.238.178
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://online.citi.com/JPS/portal/js/MFAOverlay.js

Requested by

Host: online.citi.com
URL: https://online.citi.com/US/JRS/portal/template_lo.do?ID=surestart_preapproval&client_type=LO&client_id=1024024

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.111.238.178 , Netherlands, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-111-238-178.deploy.static.akamaitechnologies.com

Software

Resource Hash

65980d692a75b30a18de261f85398dd5e3b9ecca2b8c3e6943c6c45b77a57567

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

Referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=surestart_preapproval&client_type=LO&client_id=1024024
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=300
content-encoding: gzip
last-modified: Tue, 12 Sep 2017 17:24:52 GMT
x-akamai-citisite: GTDC
date: Thu, 21 Jan 2021 17:33:16 GMT
vary: Accept-Encoding
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
expires: Thu, 21 Jan 2021 23:33:16 GMT
cache-control: max-age=21600
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
content-length: 770
content-type: application/x-javascript
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 200 linkCapture.js Show response
online.citi.com/GFC/branding/js/ 1 KB
1 KB 384ms
374ms Script
application/x-javascript 104.111.238.178
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://online.citi.com/GFC/branding/js/linkCapture.js

Requested by

Host: online.citi.com
URL: https://online.citi.com/US/JRS/portal/template_lo.do?ID=surestart_preapproval&client_type=LO&client_id=1024024

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.111.238.178 , Netherlands, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-111-238-178.deploy.static.akamaitechnologies.com

Software

Resource Hash

d33c3580a6f74918cb48b98df98c9d7bb24dffe18938325ba9327459dd0ce424

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

Referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=surestart_preapproval&client_type=LO&client_id=1024024
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=300
content-encoding: gzip
last-modified: Tue, 12 Sep 2017 17:24:52 GMT
x-akamai-citisite: GTDC
date: Thu, 21 Jan 2021 17:33:16 GMT
vary: Accept-Encoding
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
expires: Thu, 21 Jan 2021 23:33:16 GMT
cache-control: max-age=21600
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
content-length: 626
content-type: application/x-javascript
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 200 branding_universal.js Show response
online.citi.com/GFC/branding/js/ 34 KB
11 KB 383ms
374ms Script
application/x-javascript 104.111.238.178
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://online.citi.com/GFC/branding/js/branding_universal.js

Requested by

Host: online.citi.com
URL: https://online.citi.com/US/JRS/portal/template_lo.do?ID=surestart_preapproval&client_type=LO&client_id=1024024

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.111.238.178 , Netherlands, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-111-238-178.deploy.static.akamaitechnologies.com

Software

Resource Hash

218f88c05c6697072bf426ce129b0192afa524adde194503d403a5544576ed81

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

Referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=surestart_preapproval&client_type=LO&client_id=1024024
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=300
content-encoding: gzip
last-modified: Thu, 22 Oct 2020 04:10:50 GMT
x-akamai-citisite: GTDC
date: Thu, 21 Jan 2021 17:33:16 GMT
vary: Accept-Encoding
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
expires: Thu, 21 Jan 2021 23:33:16 GMT
cache-control: max-age=21600
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
content-length: 10317
content-type: application/x-javascript
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 200 btAdServe.js Show response
online.citi.com/JRS/js/ 1 KB
1 KB 407ms
398ms Script
application/x-javascript 104.111.238.178
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://online.citi.com/JRS/js/btAdServe.js

Requested by

Host: online.citi.com
URL: https://online.citi.com/US/JRS/portal/template_lo.do?ID=surestart_preapproval&client_type=LO&client_id=1024024

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.111.238.178 , Netherlands, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-111-238-178.deploy.static.akamaitechnologies.com

Software

Resource Hash

4d09cfb5ba7471be2d35405a0510a67a3a6825e1e0337aca7dd94256e6c107d8

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

Referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=surestart_preapproval&client_type=LO&client_id=1024024
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=300
content-encoding: gzip
last-modified: Tue, 12 Sep 2017 17:22:45 GMT
x-akamai-citisite: GTDC
date: Thu, 21 Jan 2021 17:33:16 GMT
vary: Accept-Encoding
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
expires: Thu, 21 Jan 2021 23:33:16 GMT
cache-control: max-age=21600
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
content-length: 580
content-type: application/x-javascript
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 200 citilive-search.js Show response
online.citi.com/JEA/CitiSearch/nexus-platform/js/ 2 KB
2 KB 417ms
409ms Script
application/x-javascript 104.111.238.178
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://online.citi.com/JEA/CitiSearch/nexus-platform/js/citilive-search.js

Requested by

Host: online.citi.com
URL: https://online.citi.com/US/JRS/portal/template_lo.do?ID=surestart_preapproval&client_type=LO&client_id=1024024

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.111.238.178 , Netherlands, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-111-238-178.deploy.static.akamaitechnologies.com

Software

Resource Hash

f2adfd83f8e9c7f3b092921eb5a59d4463041b2be8386a17ec7ac29d8d588470

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

Referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=surestart_preapproval&client_type=LO&client_id=1024024
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=300
content-encoding: gzip
last-modified: Tue, 13 Feb 2018 16:10:30 GMT
x-akamai-citisite: GTDC
date: Thu, 21 Jan 2021 17:33:16 GMT
vary: Accept-Encoding
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
expires: Thu, 21 Jan 2021 23:33:16 GMT
cache-control: max-age=21600
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
content-length: 1073
content-type: application/x-javascript
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 200 cbol-smartSearch-inject.js Show response
online.citi.com/NCCS/smartSearch/js/ 13 KB
3 KB 431ms
423ms Script
application/x-javascript 104.111.238.178
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://online.citi.com/NCCS/smartSearch/js/cbol-smartSearch-inject.js

Requested by

Host: online.citi.com
URL: https://online.citi.com/US/JRS/portal/template_lo.do?ID=surestart_preapproval&client_type=LO&client_id=1024024

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.111.238.178 , Netherlands, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-111-238-178.deploy.static.akamaitechnologies.com

Software

Resource Hash

c770e459d9988f611c466be1c6a650c3247f8521b536c1c2897c390f7f25e5bb

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

Referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=surestart_preapproval&client_type=LO&client_id=1024024
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=300
content-encoding: gzip
last-modified: Mon, 11 May 2020 19:00:46 GMT
x-akamai-citisite: GTDC
date: Thu, 21 Jan 2021 17:33:16 GMT
vary: Accept-Encoding
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
expires: Thu, 21 Jan 2021 23:33:16 GMT
cache-control: max-age=21600
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
content-length: 3030
content-type: application/x-javascript
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 200 cobrowse_overlay.css
online.citi.com/GPS/portal/css/ 7 KB
2 KB 442ms
434ms Stylesheet
text/css 104.111.238.178
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://online.citi.com/GPS/portal/css/cobrowse_overlay.css

Requested by

Host: online.citi.com
URL: https://online.citi.com/US/JRS/portal/template_lo.do?ID=surestart_preapproval&client_type=LO&client_id=1024024

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.111.238.178 , Netherlands, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-111-238-178.deploy.static.akamaitechnologies.com

Software

Resource Hash

a9623118fb6ec3944d1312cd0d492c3f32455e89bc1e01eafa67628a309d9c60

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

Referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=surestart_preapproval&client_type=LO&client_id=1024024
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=300
content-encoding: gzip
last-modified: Tue, 13 Aug 2019 07:17:14 GMT
x-akamai-citisite: GTDC
date: Thu, 21 Jan 2021 17:33:16 GMT
vary: Accept-Encoding
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
expires: Thu, 21 Jan 2021 23:33:16 GMT
cache-control: max-age=21600
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
content-length: 1597
content-type: text/css
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H/1.1

200
OK

sync
t.myvisualiq.net/
Redirect Chain

https://tapestry.tapad.com/tapestry/1?ta_partner_id=950&ta_redirect=https%3A%2F%2Ft.myvisualiq.net%2Fsync%3Fprid%3D1001%26ao%3D0%26pruuid%3DTAPAD_%24%7BIDS%3Akey%7D
https://t.myvisualiq.net/sync?prid=1001&ao=0&pruuid=TAPAD_be6e9db0-5c0e-11eb-a3c6-2e5955ce7e7f

43 B
300 B

38ms
37ms

Image
image/gif

18.194.78.147
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://t.myvisualiq.net/sync?prid=1001&ao=0&pruuid=TAPAD_be6e9db0-5c0e-11eb-a3c6-2e5955ce7e7f
Requested by: Host: online.citi.com
URL: https://online.citi.com/US/JRS/portal/template_lo.do?ID=surestart_preapproval&client_type=LO&client_id=1024024
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.194.78.147 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-194-78-147.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

Referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=surestart_preapproval&client_type=LO&client_id=1024024
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Thu, 21 Jan 2021 17:33:15 GMT
Cache-Control: no-cache, no-store, must-revalidate
Connection: keep-alive
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Content-Length: 43
Content-Type: image/gif

Redirect headers

date: Thu, 21 Jan 2021 17:33:15 GMT
via: 1.1 google
server: Jetty(9.4.28.v20200408)
strict-transport-security: max-age=31536000
p3p: policyref="http://tapad-taptags.s3.amazonaws.com/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
location: https://t.myvisualiq.net/sync?prid=1001&ao=0&pruuid=TAPAD_be6e9db0-5c0e-11eb-a3c6-2e5955ce7e7f
alt-svc: clear
content-length: 0

GET
H2

451

420356.gif
idsync.rlcdn.com/
Redirect Chain

https://t.myvisualiq.net/sync?prid=1002&ao=0&red=https://idsync.rlcdn.com/420356.gif?partner_uid=${UUID}
https://t.myvisualiq.net/ul_cb/sync?prid=1002&ao=0&red=https://idsync.rlcdn.com/420356.gif?partner_uid=${UUID}
https://idsync.rlcdn.com/420356.gif?partner_uid=80a5d61a-bcec-44f4-b7b0-19640b619062

0
66 B

131ms
66ms

Image
text/plain

34.120.207.148
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://idsync.rlcdn.com/420356.gif?partner_uid=80a5d61a-bcec-44f4-b7b0-19640b619062
Requested by: Host: online.citi.com
URL: https://online.citi.com/US/JRS/portal/template_lo.do?ID=surestart_preapproval&client_type=LO&client_id=1024024
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.120.207.148 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: 148.207.120.34.bc.googleusercontent.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=surestart_preapproval&client_type=LO&client_id=1024024
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 21 Jan 2021 17:33:16 GMT
via: 1.1 google
alt-svc: clear
content-length: 0

Redirect headers

Location: https://idsync.rlcdn.com/420356.gif?partner_uid=80a5d61a-bcec-44f4-b7b0-19640b619062
Date: Thu, 21 Jan 2021 17:33:15 GMT
Cache-Control: no-cache, no-store, must-revalidate
Connection: keep-alive
Content-Length: 0
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"

GET
H2

200

tpid=80a5d61a-bcec-44f4-b7b0-19640b619062
bcp.crwdcntrl.net/map/ct=y/c=10105/tp=VSIQ/
Redirect Chain

https://t.myvisualiq.net/sync?prid=LOAEPNR1&ao=0&red=https%3a%2f%2fbcp.crwdcntrl.net%2fmap%2fc%3d10105%2ftp%3dVSIQ%2ftpid%3d%24%7bUUID%7d
https://t.myvisualiq.net/ul_cb/sync?prid=LOAEPNR1&ao=0&red=https%3a%2f%2fbcp.crwdcntrl.net%2fmap%2fc%3d10105%2ftp%3dVSIQ%2ftpid%3d%24%7bUUID%7d
https://bcp.crwdcntrl.net/map/c=10105/tp=VSIQ/tpid=80a5d61a-bcec-44f4-b7b0-19640b619062
https://bcp.crwdcntrl.net/map/ct=y/c=10105/tp=VSIQ/tpid=80a5d61a-bcec-44f4-b7b0-19640b619062

49 B
710 B

127ms
127ms

Image
image/gif

52.30.234.204
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://bcp.crwdcntrl.net/map/ct=y/c=10105/tp=VSIQ/tpid=80a5d61a-bcec-44f4-b7b0-19640b619062
Requested by: Host: online.citi.com
URL: https://online.citi.com/US/JRS/portal/template_lo.do?ID=surestart_preapproval&client_type=LO&client_id=1024024
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.30.234.204 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-30-234-204.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: 2f561b02a49376e3679acd5975e3790abdff09ecbadfa1e1858c7ba26e3ffcef

Request headers

Referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=surestart_preapproval&client_type=LO&client_id=1024024
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 21 Jan 2021 17:33:16 GMT
p3p: CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
access-control-allow-origin: *
cache-control: no-cache
x-server: 10.45.7.92
content-type: image/gif
content-length: 49
expires: 0

Redirect headers

pragma: no-cache
date: Thu, 21 Jan 2021 17:33:16 GMT
p3p: CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
location: https://bcp.crwdcntrl.net/map/ct=y/c=10105/tp=VSIQ/tpid=80a5d61a-bcec-44f4-b7b0-19640b619062
cache-control: no-cache
x-server: 10.45.21.235
content-length: 0
expires: 0

GET
H/1.1

200
OK

21398
tags.bluekai.com/site/
Redirect Chain

https://t.myvisualiq.net/sync?prid=BUKIPNR1&red=https://tags.bluekai.com/site/21398?id=$%7BUUID%7D
https://tags.bluekai.com/site/21398?id=0-9f3b6ee6-cb31-4675-8798-99d0d3413abe

62 B
753 B

276ms
202ms

Image
image/gif

104.108.41.56
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://tags.bluekai.com/site/21398?id=0-9f3b6ee6-cb31-4675-8798-99d0d3413abe
Requested by: Host: online.citi.com
URL: https://online.citi.com/US/JRS/portal/template_lo.do?ID=surestart_preapproval&client_type=LO&client_id=1024024
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 104.108.41.56 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-108-41-56.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 0af3aae90b7de9fdceee2ab421378ea2f54c74be81ef43fc6c1790a032755d80

Request headers

Referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=surestart_preapproval&client_type=LO&client_id=1024024
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Thu, 21 Jan 2021 17:33:16 GMT
Connection: keep-alive
P3P: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV", policyref="http://tags.bluekai.com/w3c/p3p.xml"
Content-Length: 62
BK-Server: 491f
Content-Type: image/gif

Redirect headers

Location: https://tags.bluekai.com/site/21398?id=0-9f3b6ee6-cb31-4675-8798-99d0d3413abe
Date: Thu, 21 Jan 2021 17:33:15 GMT
Cache-Control: no-cache, no-store, must-revalidate
Connection: keep-alive
Content-Length: 0
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"

GET
H/1.1

200
OK

sync
t.myvisualiq.net/
Redirect Chain

https://t.myvisualiq.net/sync?prid=AOEPNR1&ao=0&red=https%3A%2F%2Fdpm.demdex.net%2Fibs%3Adpid%3D125310%26dpuuid%3D%24%7BUUID%7D%26redir%3Dhttps%253A%252F%252Ft.myvisualiq.net%252Fsync%253Fprid%253D...
https://dpm.demdex.net/ibs:dpid=125310&dpuuid=0-c905b2b7-9da9-4a95-a071-dee5b3cd62e4&redir=https%3A%2F%2Ft.myvisualiq.net%2Fsync%3Fprid%3DAOEPNR1%26ao%3D0%26pruuid%3D%24%7BDD_UUID%7D
https://t.myvisualiq.net/sync?prid=AOEPNR1&ao=0&pruuid=64280508413371541693315245438415847381

43 B
300 B

38ms
38ms

Image
image/gif

18.194.78.147
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://t.myvisualiq.net/sync?prid=AOEPNR1&ao=0&pruuid=64280508413371541693315245438415847381
Requested by: Host: online.citi.com
URL: https://online.citi.com/US/JRS/portal/template_lo.do?ID=surestart_preapproval&client_type=LO&client_id=1024024
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 18.194.78.147 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-194-78-147.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Request headers

Referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=surestart_preapproval&client_type=LO&client_id=1024024
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Thu, 21 Jan 2021 17:33:16 GMT
Cache-Control: no-cache, no-store, must-revalidate
Connection: keep-alive
P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Content-Length: 43
Content-Type: image/gif

Redirect headers

Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-TID: iCt7+nHBQZU=
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Location: https://t.myvisualiq.net/sync?prid=AOEPNR1&ao=0&pruuid=64280508413371541693315245438415847381
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection: keep-alive
Content-Length: 0
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2 200 img;p=11042216433979;a=11042216433971;idfa=;aaid=;idfa_lat=;aaid_lat=;cache=52280097969866904
ad.atdmt.com/i/ 42 B
483 B 103ms
38ms Image
image/gif 2a03:2880:f01c:8004:face:b00c:0:8c
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ad.atdmt.com/i/img;p=11042216433979;a=11042216433971;idfa=;aaid=;idfa_lat=;aaid_lat=;cache=52280097969866904
Requested by: Host: online.citi.com
URL: https://online.citi.com/US/JRS/portal/template_lo.do?ID=surestart_preapproval&client_type=LO&client_id=1024024
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a03:2880:f01c:8004:face:b00c:0:8c , Ireland, ASN32934 (FACEBOOK, US),
Reverse DNS
Software: /
Resource Hash: 6d8ba81d1b60a18707722a1f2b62dad48a6acced95a1933f49a68b5016620b93

Request headers

Referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=surestart_preapproval&client_type=LO&client_id=1024024
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 21 Jan 2021 17:33:15 GMT
x-atlas-debug: AYJTjxYpjBtRpgpUK5NgK7pvIYu1n4WAiDgj2HxAOl4qQrJ6RIFjl5NnOwC9KdAqRUfr6ThBLFtVF2onhDWpOACO
p3p: CP="NOI DSP COR CUR ADM DEV TAIo PSAo PSDo OUR BUS UNI PUR COM NAV INT DEM STA PRE OTC"
cache-control: private, no-cache, no-store, must-revalidate
content-type: image/gif
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 42
expires: 0

GET
H2 200 img;m=11042213147953;cache=17899006549267172
ad.atdmt.com/m/ 42 B
268 B 103ms
38ms Image
image/gif 2a03:2880:f01c:8004:face:b00c:0:8c
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://ad.atdmt.com/m/img;m=11042213147953;cache=17899006549267172?event=DirectPlacementmortgageQ42016&viq3=ID=surestart_preapproval&client_type=LO&client_id=1024024&viq4=https%3A%2F%2Fonline.citi.com%2FUS%2FJRS%2Fportal%2Ftemplate_lo.do%3FID%3Dsurestart_preapproval%26client_type%3DLO%26client_id%3D1024024
Requested by: Host: online.citi.com
URL: https://online.citi.com/US/JRS/portal/template_lo.do?ID=surestart_preapproval&client_type=LO&client_id=1024024
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a03:2880:f01c:8004:face:b00c:0:8c , Ireland, ASN32934 (FACEBOOK, US),
Reverse DNS
Software: /
Resource Hash: 6d8ba81d1b60a18707722a1f2b62dad48a6acced95a1933f49a68b5016620b93

Request headers

Referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=surestart_preapproval&client_type=LO&client_id=1024024
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 21 Jan 2021 17:33:15 GMT
x-atlas-debug: AYIMe-qbvaMwcxPX0NLDeMhH8N9JOlS7YeYqLFkc62xe-LilzkiJ-6dru7IranhIjJTGBl1kS3gzKIr-xPWwKZlQ
p3p: CP="NOI DSP COR CUR ADM DEV TAIo PSAo PSDo OUR BUS UNI PUR COM NAV INT DEM STA PRE OTC"
cache-control: private, no-cache, no-store, must-revalidate
content-type: image/gif
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 42
expires: 0

GET
H2 200 tagging_transformation.json Show response
online.citi.com/gcgapi/prod/public/v1/staticcms/USGCB/en_US/appid/ 784 KB
123 KB 140ms
139ms XHR
application/json 104.111.238.178
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://online.citi.com/gcgapi/prod/public/v1/staticcms/USGCB/en_US/appid/tagging_transformation.json

Requested by

Host: online.citi.com
URL: https://online.citi.com/CBOL/taggingTransformation/tagging.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.111.238.178 , Netherlands, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-111-238-178.deploy.static.akamaitechnologies.com

Software

Resource Hash

e98b6c738d2156a72bdf070c557f07574757b7128525cc049c0843578c17a969

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=31536000 ; includeSubDomains
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

appVersion: CBOLV1.0.0
Referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=surestart_preapproval&client_type=LO&client_id=1024024
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
client_id: 4a51fb19-a1a7-4247-bc7e-18aa56dd1c40

Response headers

strict-transport-security: max-age=31536000 ; includeSubDomains
content-encoding: gzip
x-content-type-options: nosniff
x-route-target: DEFAULT:DEFAULT
citiuuid: 1e1d659c-b1b4-4594-a713-42aa686ebcc37800078
access-control-allow-origin
x-global-transaction-id: 6e68aa426009b8b7298e5a0d
vary: Accept-Encoding
content-length: 124290
x-xss-protection: 1; mode=block
x-akamai-citisite: GTDC
x-frame-options: DENY
date: Thu, 21 Jan 2021 17:33:15 GMT
access-control-max-age: 2147483647
access-control-allow-methods: GET,PUT,POST,DELETE,HEAD
content-type: application/json
x-backside-transport: OK OK,OK OK,OK OK
x-vcap-request-id: c29b582d-5f71-4858-4566-6059654ab4ca
access-control-expose-headers: APIm-Debug-Trans-Id, X-RateLimit-Limit, X-RateLimit-Remaining, X-RateLimit-Reset, X-Global-Transaction-ID,action,challengeType,bizToken,eventid,Eventid,Eventidexpirytime,eventidexpirytime,accesstoken,Authorization,sid,SessionId,CCPToken,CFIToken
cache-control: public, max-age=60
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
access-control-allow-headers: action,challengeType,accesstoken,appVersion,,Content-Type,sid,CCPToken,CFIToken,countryCode,businessCode,channelId,uuid,client_id,environmentId
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H/1.1

200
OK

rd Show response
dpm.demdex.net/id/
Redirect Chain

https://dpm.demdex.net/id?d_visid_ver=3.1.2&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=61834D9B5228A7430A490D45%40AdobeOrg&d_nsid=0&ts=1611250395538
https://dpm.demdex.net/id/rd?d_visid_ver=3.1.2&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=61834D9B5228A7430A490D45%40AdobeOrg&d_nsid=0&ts=1611250395538

363 B
1 KB

59ms
58ms

XHR
application/json

34.249.128.36
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://dpm.demdex.net/id/rd?d_visid_ver=3.1.2&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=61834D9B5228A7430A490D45%40AdobeOrg&d_nsid=0&ts=1611250395538

Requested by

Host: online.citi.com
URL: https://online.citi.com/US/JRS/portal/template_lo.do?ID=surestart_preapproval&client_type=LO&client_id=1024024

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

34.249.128.36 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-34-249-128-36.eu-west-1.compute.amazonaws.com

Software

Resource Hash

4e4bd342751152a1a3cdb1bd66095d16bbc6bb5b8883dd2389049a40e73f36b3

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=surestart_preapproval&client_type=LO&client_id=1024024
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

DCS: dcs-prod-irl1-v088-04de9bd88.edge-irl1.demdex.com 5.80.5.20210120122710 2ms (+1ms)
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Encoding: gzip
X-TID: xRhgaUUeQ+I=
Vary: Origin, Accept-Encoding, User-Agent
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Access-Control-Allow-Origin: https://online.citi.com
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/json;charset=utf-8
Content-Length: 299
Expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
Access-Control-Allow-Origin: https://online.citi.com
X-TID: rpbskk1sQaM=
Vary: Origin
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Location: https://dpm.demdex.net/id/rd?d_visid_ver=3.1.2&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=61834D9B5228A7430A490D45%40AdobeOrg&d_nsid=0&ts=1611250395538
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 0
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2 200 serverComponent.php Show response
nexus.ensighten.com/citi/na_prod/ 2 KB
847 B 55ms
50ms Script
text/javascript 18.197.253.20
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://nexus.ensighten.com/citi/na_prod/serverComponent.php?r=7853009792.30299&namespace=Bootstrapper&staticJsPath=nexus.ensighten.com/citi/na_prod/code/&publishedOn=Wed%20Jan%2013%2019:53:59%20GMT%202021&ClientID=1129&PageID=https%3A%2F%2Fonline.citi.com%2FUS%2FJRS%2Fportal%2Ftemplate_lo.do%3FID%3Dsurestart_preapproval%26client_type%3DLO%26client_id%3D1024024
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 18.197.253.20 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-197-253-20.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 378739b76d3a04e83cc8cdad421adc403f4b196cceb36b5c8118459574186f49

Request headers

Referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=surestart_preapproval&client_type=LO&client_id=1024024
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 21 Jan 2021 17:33:15 GMT
cache-control: no-cache, no-store
content-type: text/javascript
server: nginx
content-encoding: gzip
vary: Accept-Encoding
expires: Thu, 21 Jan 2021 17:33:14 GMT

GET
H2 200 iframe_api Show response
www.youtube.com/ 810 B
1 KB 89ms
24ms Script
text/javascript 2a00:1450:4001:806::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.youtube.com/iframe_api

Requested by

Host: online.citi.com
URL: https://online.citi.com/JRS/CHIP/js/youtube-video-player.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:806::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

a29ad79a8aa3c011f165bf0040b910bcf591c2f1533c5477b866770508128782

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=surestart_preapproval&client_type=LO&client_id=1024024
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 21 Jan 2021 17:33:15 GMT
content-encoding: br
x-content-type-options: nosniff
server: ESF
x-frame-options: SAMEORIGIN
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657?hl=en for more info."
cache-control: private, max-age=0
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000
content-type: text/javascript; charset=utf-8
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
expires: Thu, 21 Jan 2021 17:33:15 GMT

GET
H2 200 Citi-Enterprise-White.png
online.citi.com/GFC/branding/img/ 1 KB
1 KB 469ms
469ms Image
image/png 104.111.238.178
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://online.citi.com/GFC/branding/img/Citi-Enterprise-White.png

Requested by

Host: online.citi.com
URL: https://online.citi.com/JRS/CHIP/css/chip.min.css

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.111.238.178 , Netherlands, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-111-238-178.deploy.static.akamaitechnologies.com

Software

Resource Hash

7cb24e06c00e47bb6bc6c38b935d6bc62817f656703387e4fb7591add96c7454

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

Referer: https://online.citi.com/JRS/CHIP/css/chip.min.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 21 Jan 2021 17:33:16 GMT
last-modified: Wed, 14 Jun 2017 18:29:05 GMT
x-akamai-citisite: GTDC
strict-transport-security: max-age=300
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
content-length: 1040
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
accept-ranges: bytes
content-type: image/png
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 200 Interstate-Light.woff
online.citi.com/JRS/CHIP/css/fonts/interstate/ 74 KB
74 KB 473ms
473ms Font
application/octet-stream 104.111.238.178
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://online.citi.com/JRS/CHIP/css/fonts/interstate/Interstate-Light.woff

Requested by

Host: online.citi.com
URL: https://online.citi.com/JRS/CHIP/css/ddl.css

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.111.238.178 , Netherlands, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-111-238-178.deploy.static.akamaitechnologies.com

Software

Resource Hash

f327a0ba3e41b1e8154e1c18fc114baff0bd057151e3afe7fa6f33cc0cb18296

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

Origin: https://online.citi.com
Referer: https://online.citi.com/JRS/CHIP/css/ddl.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=300
content-encoding: gzip
last-modified: Tue, 12 Sep 2017 17:22:45 GMT
x-akamai-citisite: GTDC
date: Thu, 21 Jan 2021 17:33:16 GMT
vary: Accept-Encoding
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
access-control-allow-origin: *
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
content-length: 75483
content-type: text/plain
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 200 fdf45a7c15c1cee06bb71e10dac4e26e.js Show response
nexus.ensighten.com/citi/na_prod/code/ 989 B
1 KB 45ms
41ms Script
application/javascript 18.197.253.20
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://nexus.ensighten.com/citi/na_prod/code/fdf45a7c15c1cee06bb71e10dac4e26e.js?conditionId0=4849963
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 18.197.253.20 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-197-253-20.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 7df13706eaab8ce9a3dcd2a501f60bc66987c83834d07dfaf07ae56ef814c110

Request headers

Referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=surestart_preapproval&client_type=LO&client_id=1024024
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 21 Jan 2021 17:33:15 GMT
last-modified: Tue, 14 May 2019 17:01:42 GMT
server: nginx
etag: "5cdaf476-3dd"
content-type: application/javascript; charset=utf-8
cache-control: max-age=315360000
accept-ranges: bytes
content-length: 989

GET
H2 200 1aba933a3ecc5ef8fad27fd096354b67.js Show response
nexus.ensighten.com/citi/na_prod/code/ 15 KB
4 KB 48ms
44ms Script
application/javascript 18.197.253.20
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://nexus.ensighten.com/citi/na_prod/code/1aba933a3ecc5ef8fad27fd096354b67.js?conditionId0=467299
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 18.197.253.20 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-197-253-20.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: bd04cb616962bb8f1bb8a3087ae91331badae76e48f6b741fd7a622fcd07651f

Request headers

Referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=surestart_preapproval&client_type=LO&client_id=1024024
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 21 Jan 2021 17:33:15 GMT
content-encoding: gzip
last-modified: Wed, 13 Jan 2021 19:54:04 GMT
server: nginx
etag: W/"5fff4fdc-3df1"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
cache-control: max-age=315360000

GET
H2 200 8637af7c210f4e79436bc39f71b49bfa.js Show response
nexus.ensighten.com/citi/na_prod/code/ 1 KB
737 B 50ms
46ms Script
application/javascript 18.197.253.20
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://nexus.ensighten.com/citi/na_prod/code/8637af7c210f4e79436bc39f71b49bfa.js?conditionId0=4827153
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 18.197.253.20 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-197-253-20.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 06dfb367edf9bbff810def9f75f8695b3ccfbcb2813306609fc6e18fcacfc17e

Request headers

Referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=surestart_preapproval&client_type=LO&client_id=1024024
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 21 Jan 2021 17:33:15 GMT
content-encoding: gzip
last-modified: Wed, 10 Jul 2019 12:57:13 GMT
server: nginx
etag: W/"5d25e0a9-412"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
cache-control: max-age=315360000

GET
H2 200 e77f83f347abea80926ccc06cdc7e1ba.js Show response
nexus.ensighten.com/citi/na_prod/code/ 832 B
1014 B 48ms
44ms Script
application/javascript 18.197.253.20
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://nexus.ensighten.com/citi/na_prod/code/e77f83f347abea80926ccc06cdc7e1ba.js?conditionId0=4886030
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 18.197.253.20 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-197-253-20.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 9b55a270957d6d2111d63e73b73fb7d7eb8493979a419c945dea0314910a2c16

Request headers

Referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=surestart_preapproval&client_type=LO&client_id=1024024
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 21 Jan 2021 17:33:15 GMT
last-modified: Tue, 04 Aug 2020 18:21:48 GMT
server: nginx
etag: "5f29a73c-340"
content-type: application/javascript; charset=utf-8
cache-control: max-age=315360000
accept-ranges: bytes
content-length: 832

GET
H2 200 557566dc60916e3de69e006bef252459.js Show response
nexus.ensighten.com/citi/na_prod/code/ 2 KB
961 B 49ms
46ms Script
application/javascript 18.197.253.20
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://nexus.ensighten.com/citi/na_prod/code/557566dc60916e3de69e006bef252459.js?conditionId0=4837456
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 18.197.253.20 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-197-253-20.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 31b00ff4929696dfca06885da68e58c3e09f6ecb4ae0fe1ae287e99a3fd1f716

Request headers

Referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=surestart_preapproval&client_type=LO&client_id=1024024
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 21 Jan 2021 17:33:15 GMT
content-encoding: gzip
last-modified: Tue, 27 Aug 2019 16:59:12 GMT
server: nginx
etag: W/"5d656160-887"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
cache-control: max-age=315360000

GET
H2 200 4621f9baf38322701f3e9581965cce1c.js Show response
nexus.ensighten.com/citi/na_prod/code/ 2 KB
862 B 55ms
53ms Script
application/javascript 18.197.253.20
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://nexus.ensighten.com/citi/na_prod/code/4621f9baf38322701f3e9581965cce1c.js?conditionId0=480881
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 18.197.253.20 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-197-253-20.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 8241de0bb6aadfe1dc99b9ffb7942503313e474a3bd5e62e2171144971a03168

Request headers

Referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=surestart_preapproval&client_type=LO&client_id=1024024
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 21 Jan 2021 17:33:15 GMT
content-encoding: gzip
last-modified: Tue, 08 Dec 2020 20:40:09 GMT
server: nginx
etag: W/"5fcfe4a9-631"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
cache-control: max-age=315360000

GET
H2 200 18f290115d86c3ce4744668350fa4bb3.js Show response
nexus.ensighten.com/citi/na_prod/code/ 106 KB
23 KB 58ms
55ms Script
application/javascript 18.197.253.20
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://nexus.ensighten.com/citi/na_prod/code/18f290115d86c3ce4744668350fa4bb3.js?conditionId0=421908
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 18.197.253.20 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-197-253-20.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: fd40ba20734e83ebb0c4f877bb2675faa7beaf1f7c88dbd5e06ad06012c4c208

Request headers

Referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=surestart_preapproval&client_type=LO&client_id=1024024
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 21 Jan 2021 17:33:15 GMT
content-encoding: gzip
last-modified: Tue, 12 Jan 2021 21:51:44 GMT
server: nginx
etag: W/"5ffe19f0-1a67b"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
cache-control: max-age=315360000

GET
H2 200 e0a740ce68dcbba3aab4ce835acac806.js Show response
nexus.ensighten.com/citi/na_prod/code/ 1 KB
821 B 54ms
52ms Script
application/javascript 18.197.253.20
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://nexus.ensighten.com/citi/na_prod/code/e0a740ce68dcbba3aab4ce835acac806.js?conditionId0=4854834
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 18.197.253.20 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-197-253-20.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 1c5f4ca631e6335f2f85ec82c0fc50452697853012054de12b3c59013dbe57e2

Request headers

Referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=surestart_preapproval&client_type=LO&client_id=1024024
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 21 Jan 2021 17:33:15 GMT
content-encoding: gzip
last-modified: Tue, 27 Oct 2020 18:32:06 GMT
server: nginx
etag: W/"5f9867a6-57a"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
cache-control: max-age=315360000

GET
H2 200 e1dbe847ab1ad0805325e2d9a172ca25.js Show response
nexus.ensighten.com/citi/na_prod/code/ 113 KB
32 KB 50ms
48ms Script
application/javascript 18.197.253.20
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://nexus.ensighten.com/citi/na_prod/code/e1dbe847ab1ad0805325e2d9a172ca25.js?conditionId0=486757
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 18.197.253.20 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-197-253-20.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 850fa15ac2c9ef551ceba9b22ee6b541afbf8a77ebd94329c75246fc0d19551d

Request headers

Referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=surestart_preapproval&client_type=LO&client_id=1024024
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 21 Jan 2021 17:33:15 GMT
content-encoding: gzip
last-modified: Wed, 13 Jan 2021 19:54:04 GMT
server: nginx
etag: W/"5fff4fdc-1c235"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
cache-control: max-age=315360000

GET
H2 200 4b895b43d9c1209af6f5e71e9b42936b.js Show response
nexus.ensighten.com/citi/na_prod/code/ 334 KB
103 KB 54ms
52ms Script
application/javascript 18.197.253.20
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://nexus.ensighten.com/citi/na_prod/code/4b895b43d9c1209af6f5e71e9b42936b.js?conditionId0=3013337
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 18.197.253.20 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-197-253-20.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 9bdacccac143b69f1f4e0fb884d291ff41077d2f937c8809ff88a1e8c2309f18

Request headers

Referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=surestart_preapproval&client_type=LO&client_id=1024024
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 21 Jan 2021 17:33:15 GMT
content-encoding: gzip
last-modified: Tue, 01 Dec 2020 22:40:13 GMT
server: nginx
etag: W/"5fc6c64d-53922"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
cache-control: max-age=315360000

GET
H2 200 eb7fbc549d9aaadb0512e4c8058a89ab.js Show response
nexus.ensighten.com/citi/na_prod/code/ 922 B
1 KB 77ms
76ms Script
application/javascript 18.197.253.20
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://nexus.ensighten.com/citi/na_prod/code/eb7fbc549d9aaadb0512e4c8058a89ab.js?conditionId0=4878640
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 18.197.253.20 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-197-253-20.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 7864500d9bdaca98dbd359f26bcca34bc3b835628a8af84ba5df5f973f83ba36

Request headers

Referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=surestart_preapproval&client_type=LO&client_id=1024024
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 21 Jan 2021 17:33:15 GMT
last-modified: Thu, 30 Apr 2020 13:42:50 GMT
server: nginx
etag: "5eaad5da-39a"
content-type: application/javascript; charset=utf-8
cache-control: max-age=315360000
accept-ranges: bytes
content-length: 922

GET
H3-Q050 200 www-widgetapi.js Show response
www.youtube.com/s/player/9f996d3e/www-widgetapi.vflset/ 102 KB
37 KB 34ms
20ms Script
text/javascript 2a00:1450:4001:806::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.youtube.com/s/player/9f996d3e/www-widgetapi.vflset/www-widgetapi.js

Requested by

Host: www.youtube.com
URL: https://www.youtube.com/iframe_api

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

45411434d7d8fe258124f2e19cbbc37f0379f0882a64ec263840ab3b5c702a9d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=surestart_preapproval&client_type=LO&client_id=1024024
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 21 Jan 2021 08:07:37 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Thu, 07 Jan 2021 01:17:38 GMT
server: sffe
age: 33938
vary: Accept-Encoding, Origin
content-type: text/javascript
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 37413
x-xss-protection: 0
expires: Fri, 21 Jan 2022 08:07:37 GMT

GET
H/1.1 200
OK Cookie set dest5.html
citi.demdex.net/ Frame C6CA 0
0 241ms
65ms Document
text/html 54.171.106.172
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://citi.demdex.net/dest5.html?d_nsid=0

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.171.106.172 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-54-171-106-172.eu-west-1.compute.amazonaws.com

Software

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Host: citi.demdex.net
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=surestart_preapproval&client_type=LO&client_id=1024024
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Cookie: demdex=64280508413371541693315245438415847381
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=surestart_preapproval&client_type=LO&client_id=1024024

Response headers

Accept-Ranges: bytes
Cache-Control: max-age=21600
Content-Encoding: gzip
Content-Type: text/html
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Last-Modified: Thu, 21 Jan 2021 11:34:43 GMT
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Pragma: no-cache
Set-Cookie: demdex=64280508413371541693315245438415847381;Path=/;Domain=.demdex.net;Expires=Tue, 20-Jul-2021 17:33:16 GMT;Max-Age=15552000;Secure;SameSite=None
Strict-Transport-Security: max-age=31536000; includeSubDomains
Vary: Accept-Encoding, User-Agent
X-TID: UF9jZbBcTBM=
Content-Length: 2785
Connection: keep-alive

GET
H2 200 id Show response
metrics1.citi.com/ 89 B
674 B 211ms
53ms XHR
application/x-javascript 15.237.136.106
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://metrics1.citi.com/id?d_visid_ver=3.1.2&d_fieldgroup=A&mcorgid=61834D9B5228A7430A490D45%40AdobeOrg&mid=58070003941454284422855708847003698806&ts=1611250395907

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

15.237.136.106 Paris, France, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-15-237-136-106.eu-west-3.compute.amazonaws.com

Software

jag /

Resource Hash

5a62e3af05fba88e8de7af59df1536d20fd50911e6cdc2dc90672b5c75cf384a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=surestart_preapproval&client_type=LO&client_id=1024024
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

date: Thu, 21 Jan 2021 17:33:15 GMT
x-content-type-options: nosniff
server: jag
xserver: anedge-75ffb878dc-p96xf
vary: Origin
x-c: main-1414.Id04486.M0-474
p3p: CP="This is not a P3P policy"
access-control-allow-origin: https://online.citi.com
cache-control: no-cache, no-store, max-age=0, no-transform, private
access-control-allow-credentials: true
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/x-javascript;charset=utf-8
content-length: 89
x-xss-protection: 1; mode=block

GET
H/1.1

200
OK

ibs:dpid=411&dpuuid=YAm63AAAAEdm-R__
dpm.demdex.net/
Redirect Chain

https://cm.everesttech.net/cm/dd?d_uuid=64280508413371541693315245438415847381
https://dpm.demdex.net/ibs:dpid=411&dpuuid=YAm63AAAAEdm-R__

42 B
915 B

62ms
62ms

Image
image/gif

34.249.128.36
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dpm.demdex.net/ibs:dpid=411&dpuuid=YAm63AAAAEdm-R__

Requested by

Host: online.citi.com
URL: https://online.citi.com/US/JRS/portal/template_lo.do?ID=surestart_preapproval&client_type=LO&client_id=1024024

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

34.249.128.36 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-34-249-128-36.eu-west-1.compute.amazonaws.com

Software

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=surestart_preapproval&client_type=LO&client_id=1024024
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

DCS: dcs-prod-irl1-v088-06b843d8e.edge-irl1.demdex.com 5.80.5.20210120122710 1ms (+0ms)
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-Content-Type-Options: nosniff
X-TID: WZKQJ2JNSpc=
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection: keep-alive
Content-Type: image/gif
Content-Length: 42
Expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

Location: https://dpm.demdex.net/ibs:dpid=411&dpuuid=YAm63AAAAEdm-R__
Date: Thu, 21 Jan 2021 17:33:16 GMT
Cache-Control: no-cache
Server: AMO-cookiemap/1.1
Connection: keep-alive
Content-Length: 0
P3P: CP="NOI NID DEVa PSAa PSDa OUR IND PUR COM NAV INT DEM"

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 98 KB
39 KB 42ms
21ms Script
application/javascript 2a00:1450:4001:802::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=DC-6260004

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:802::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

9c9c84d9e9338cc91fb1a5177e788d420ddfc5f97a51d857918f89c99c6bddf0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=surestart_preapproval&client_type=LO&client_id=1024024
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 21 Jan 2021 17:33:15 GMT
content-encoding: br
vary: Accept-Encoding
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 39589
x-xss-protection: 0
last-modified: Thu, 21 Jan 2021 15:00:00 GMT
server: Google Tag Manager
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Thu, 21 Jan 2021 17:33:15 GMT

GET
H/1.1 200
OK bk-coretag.js Show response
tags.bkrtx.com/js/ 51 KB
16 KB 140ms
59ms Script
application/javascript 104.111.228.137
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://tags.bkrtx.com/js/bk-coretag.js

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/code/18f290115d86c3ce4744668350fa4bb3.js?conditionId0=421908

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.111.228.137 , Netherlands, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-111-228-137.deploy.static.akamaitechnologies.com

Software

nginx/1.15.8 /

Resource Hash

cea6f7b2e2badb4642c07d42e950403f303e22eda1c9c05baa72b0a4ebf576f0

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; includeSubDomains

Request headers

Referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=surestart_preapproval&client_type=LO&client_id=1024024
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Strict-Transport-Security: max-age=15724800; includeSubDomains
Content-Encoding: gzip
Last-Modified: Fri, 08 Jan 2021 19:44:31 GMT
Server: nginx/1.15.8
ETag: W/"5ff8b61f-ca6e"
Vary: Accept-Encoding
Content-Type: application/javascript
bk-edge: 1
Cache-Control: max-age=300
Date: Thu, 21 Jan 2021 17:33:16 GMT
Connection: keep-alive
Content-Length: 16032
Expires: Thu, 21 Jan 2021 17:38:16 GMT

GET
H3-Q050 200 js Show response
www.googletagmanager.com/gtag/ 98 KB
39 KB 55ms
40ms Script
application/javascript 2a00:1450:4001:802::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=DC-6269322&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=DC-6260004

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:802::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

2f7a2b2aa895d1b0d5eefb6ddd68b0efa1c6614b1d25cdab575703e95289d7ed

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=surestart_preapproval&client_type=LO&client_id=1024024
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 21 Jan 2021 17:33:16 GMT
content-encoding: br
vary: Accept-Encoding
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 39559
x-xss-protection: 0
last-modified: Thu, 21 Jan 2021 15:00:00 GMT
server: Google Tag Manager
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Thu, 21 Jan 2021 17:33:16 GMT

GET
H3-Q050 200 js Show response
www.googletagmanager.com/gtag/ 98 KB
39 KB 47ms
33ms Script
application/javascript 2a00:1450:4001:802::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=DC-6256710&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=DC-6260004

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:802::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

5665be770c61aa276c0e6b9da7ee8e2fc9fa2b7165043a83b9c1757e1e369198

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=surestart_preapproval&client_type=LO&client_id=1024024
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 21 Jan 2021 17:33:16 GMT
content-encoding: br
vary: Accept-Encoding
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 39557
x-xss-protection: 0
last-modified: Thu, 21 Jan 2021 15:00:00 GMT
server: Google Tag Manager
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Thu, 21 Jan 2021 17:33:16 GMT

GET
H/1.1 200
OK id Show response
dpm.demdex.net/ 363 B
1 KB 101ms
69ms XHR
application/json 34.249.128.36
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://dpm.demdex.net/id?d_visid_ver=3.1.2&d_fieldgroup=AAM&d_rtbd=json&d_ver=2&d_orgid=61834D9B5228A7430A490D45%40AdobeOrg&d_nsid=0&d_mid=58070003941454284422855708847003698806&d_blob=RKhpRz8krg2tLO6pguXWp5olkAcUniQYPHaMWWgdJ3xzPWQmdj0y&d_cid_ic=AVID%013004DD6E1518937A-6000183F9BF79136&ts=1611250396121

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/code/4b895b43d9c1209af6f5e71e9b42936b.js?conditionId0=3013337

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

34.249.128.36 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-34-249-128-36.eu-west-1.compute.amazonaws.com

Software

Resource Hash

26b891e22ff382d724a31923df2b790b2ce12ae383e498790d5a3e8c98785274

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=surestart_preapproval&client_type=LO&client_id=1024024
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

DCS: dcs-prod-irl1-v088-0e574643e.edge-irl1.demdex.com 5.80.5.20210120122710 3ms (+1ms)
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Encoding: gzip
X-TID: BlTJHQBrQNc=
Vary: Origin, Accept-Encoding, User-Agent
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Access-Control-Allow-Origin: https://online.citi.com
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/json;charset=utf-8
Content-Length: 299
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2 200 json Show response
citicorpcreditservic.tt.omtrdc.net/m2/citicorpcreditservic/mbox/ 537 B
1 KB 183ms
55ms XHR
application/json 34.252.166.160
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://citicorpcreditservic.tt.omtrdc.net/m2/citicorpcreditservic/mbox/json?mbox=target-global-mbox&mboxSession=7d17f1210ccc463784723d4c1b80a0a7&mboxPC=&mboxPage=5a1e2fb77d004a97a38c9216a0c82211&mboxRid=a03e536f8b094efab702a12cec8e0d45&mboxVersion=1.7.0&mboxCount=1&mboxTime=1611253995586&mboxHost=online.citi.com&mboxURL=https%3A%2F%2Fonline.citi.com%2FUS%2FJRS%2Fportal%2Ftemplate_lo.do%3FID%3Dsurestart_preapproval%26client_type%3DLO%26client_id%3D1024024&mboxReferrer=&mboxXDomain=enabled&browserHeight=1200&browserWidth=1600&browserTimeOffset=60&screenHeight=1200&screenWidth=1600&colorDepth=24&devicePixelRatio=1&screenOrientation=landscape&mboxMCSDID=7BA36E12A046CE00-0D2A66F45F1DB7C2&vst.trk=metrics.citi.com&vst.trks=metrics1.citi.com&mboxMCGVID=58070003941454284422855708847003698806&mboxMCAVID=3004DD6E1518937A-6000183F9BF79136&mboxAAMB=RKhpRz8krg2tLO6pguXWp5olkAcUniQYPHaMWWgdJ3xzPWQmdj0y&mboxMCGLH=6
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/code/4b895b43d9c1209af6f5e71e9b42936b.js?conditionId0=3013337
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.252.166.160 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-34-252-166-160.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: e1d216f9d81b363d3a9606fde7da8587208208f3a8a970705416aa9c7ea9f412

Request headers

Referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=surestart_preapproval&client_type=LO&client_id=1024024
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 21 Jan 2021 17:33:16 GMT
content-encoding: gzip
content-type: application/json;charset=UTF-8
vary: Accept-Encoding, Origin, Access-Control-Request-Method, Access-Control-Request-Headers
p3p: CP="NOI DSP CURa OUR STP COM"
access-control-allow-origin: https://online.citi.com
cache-control: no-cache
access-control-allow-credentials: true
timing-allow-origin: *
x-request-id: a03e536f8b094efab702a12cec8e0d45

GET
H3-Q050 200 OOJvvDAVPKg
www.youtube.com/embed/ Frame 4D13 0
0 116ms
115ms Document
text/html 2a00:1450:4001:806::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.youtube.com/embed/OOJvvDAVPKg?version=3&enablejsapi=1&rel=0

Requested by

Host: online.citi.com
URL: https://online.citi.com/US/JRS/portal/template_lo.do?ID=surestart_preapproval&client_type=LO&client_id=1024024

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

YouTube Frontend Proxy /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: www.youtube.com
:scheme: https
:path: /embed/OOJvvDAVPKg?version=3&enablejsapi=1&rel=0
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=surestart_preapproval&client_type=LO&client_id=1024024
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: YSC=LJ9qM9x-WkE; VISITOR_INFO1_LIVE=fuoecDGS1Ro
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=surestart_preapproval&client_type=LO&client_id=1024024

Response headers

expires: Tue, 27 Apr 1971 19:44:06 GMT
x-content-type-options: nosniff
content-length: 21219
strict-transport-security: max-age=31536000
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657?hl=en for more info."
cache-control: no-cache
content-type: text/html; charset=utf-8
content-encoding: br
date: Thu, 21 Jan 2021 17:33:16 GMT
server: YouTube Frontend Proxy
x-xss-protection: 0
set-cookie: GPS=1; path=/; domain=.youtube.com; expires=Thu, 21-Jan-2021 18:03:16 GMT
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 video-play.svg
online.citi.com/JRS/CHIP/img/svg/ 789 B
890 B 700ms
699ms Image
image/svg+xml 104.111.238.178
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://online.citi.com/JRS/CHIP/img/svg/video-play.svg

Requested by

Host: online.citi.com
URL: https://online.citi.com/JRS/CHIP/css/chip.min.css

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.111.238.178 , Netherlands, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-111-238-178.deploy.static.akamaitechnologies.com

Software

Resource Hash

f6da6c05cc1591253f4b9999a83a75039090f70bd1e34e4ed256ae8527ec1d86

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

Referer: https://online.citi.com/JRS/CHIP/css/chip.min.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=300
content-encoding: gzip
last-modified: Tue, 06 Dec 2016 14:40:31 GMT
x-akamai-citisite: GTDC
date: Thu, 21 Jan 2021 17:33:17 GMT
vary: Accept-Encoding
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
content-length: 436
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
accept-ranges: bytes
content-type: image/svg+xml
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 200 Interstate-Bold.woff
online.citi.com/JRS/CHIP/css/fonts/interstate/ 70 KB
71 KB 59ms
59ms Font
application/octet-stream 104.111.238.178
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://online.citi.com/JRS/CHIP/css/fonts/interstate/Interstate-Bold.woff

Requested by

Host: online.citi.com
URL: https://online.citi.com/JRS/CHIP/css/ddl.css

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.111.238.178 , Netherlands, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-111-238-178.deploy.static.akamaitechnologies.com

Software

Resource Hash

e9e9a67395a0d83b584208a19b95af203df8e8e6c6952fe76c690d60ea9381c7

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

Origin: https://online.citi.com
Referer: https://online.citi.com/JRS/CHIP/css/ddl.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=300
content-encoding: gzip
last-modified: Tue, 12 Sep 2017 17:22:45 GMT
x-akamai-citisite: GTDC
date: Thu, 21 Jan 2021 17:33:16 GMT
vary: Accept-Encoding
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
access-control-allow-origin: *
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
content-length: 71859
content-type: text/plain
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 200 top_nav.css
online.citi.com/JRS/cm/css/top_nav/ 28 KB
6 KB 56ms
56ms Stylesheet
text/css 104.111.238.178
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://online.citi.com/JRS/cm/css/top_nav/top_nav.css

Requested by

Host: online.citi.com
URL: https://online.citi.com/JRS/cm/js/sniffer.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.111.238.178 , Netherlands, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-111-238-178.deploy.static.akamaitechnologies.com

Software

Resource Hash

930615d28b1ffaacd878634f3dcecef35d1b8b59e92c41f57ed2d320dd63ca17

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

Referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=surestart_preapproval&client_type=LO&client_id=1024024
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=300
content-encoding: gzip
last-modified: Tue, 12 Sep 2017 17:24:52 GMT
x-akamai-citisite: GTDC
date: Thu, 21 Jan 2021 17:33:16 GMT
vary: Accept-Encoding
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
expires: Thu, 21 Jan 2021 23:33:16 GMT
cache-control: max-age=21600
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
content-length: 5284
content-type: text/css
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 200 arrow-btn-next-blue-sm-bold.svg
online.citi.com/JRS/CHIP/images/icons/svgs/arrows/ 918 B
953 B 57ms
56ms Image
image/svg+xml 104.111.238.178
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://online.citi.com/JRS/CHIP/images/icons/svgs/arrows/arrow-btn-next-blue-sm-bold.svg

Requested by

Host: online.citi.com
URL: https://online.citi.com/JRS/CHIP/css/chip.min.css

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.111.238.178 , Netherlands, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-111-238-178.deploy.static.akamaitechnologies.com

Software

Resource Hash

e90fb0eba512ed6473f6fb8acf4cd09b38732f150f43c396246c12bb2aacbb67

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

Referer: https://online.citi.com/JRS/CHIP/css/chip.min.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=300
content-encoding: gzip
last-modified: Tue, 12 Sep 2017 17:24:52 GMT
x-akamai-citisite: GTDC
date: Thu, 21 Jan 2021 17:33:16 GMT
vary: Accept-Encoding
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
content-length: 499
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
accept-ranges: bytes
content-type: image/svg+xml
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2

200

s99394056880722
metrics1.citibank.com/b/ss/citinaprod/1/JS-1.4/
Redirect Chain

https://metrics1.citibank.com/b/ss/citinaprod/1/JS-1.4/s99394056880722?AQB=1&ndh=1&pf=1&t=21%2F0%2F2021%2018%3A33%3A16%204%20-60&fid=262D8E5D69FA491C-3C828004B48A5FE0&ce=UTF-8&pageName=Purch%7CGetP...
https://metrics1.citibank.com/b/ss/citinaprod/1/JS-1.4/s99394056880722?AQB=1&pccr=true&vidn=3004DD6E7A34589D-40001B421AD99043&ndh=1&pf=1&t=21%2F0%2F2021%2018%3A33%3A16%204%20-60&fid=262D8E5D69FA491...

43 B
271 B

93ms
93ms

Image
image/gif

35.181.18.61
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://metrics1.citibank.com/b/ss/citinaprod/1/JS-1.4/s99394056880722?AQB=1&pccr=true&vidn=3004DD6E7A34589D-40001B421AD99043&ndh=1&pf=1&t=21%2F0%2F2021%2018%3A33%3A16%204%20-60&fid=262D8E5D69FA491C-3C828004B48A5FE0&ce=UTF-8&pageName=Purch%7CGetPreApproved%7CPurch%7CRequestCallback%7CForm&g=https%3A%2F%2Fonline.citi.com%2FUS%2FJRS%2Fportal%2Ftemplate_lo.do%3FID%3Dsurestart_preapproval%26client_type%3DLO%26client_id%3D1024024&c.&visitStart=1&.c&cc=USD&ch=CMIWebEnglish&events=event76&c1=CBOL_Lending&h1=BANKRIAWebEnglish%2FCBOL_Lending%2FPurch%2FGetPreApproved%7CHUCY%7CPurch%2FForm&c2=Purch&c3=GetPreApproved%7CHUCY%7CPurch&c4=Form&v6=%2A%2ASENSITIVE%20DATA%20REPLACED%2A%2A&v20=LO1024024&c25=%5BCS%5Dv1%7C3004DD6E1518937A-6000183F9BF79136%5BCE%5D&v30=REL&v38=Purch%7CGetPreApproved%7CPurch%7CRequestCallback%7CForm&c47=%2A%2ASENSITIVE%20DATA%20REPLACED%2A%2A&c48=%2A%2ASENSITIVE%20DATA%20REPLACED%2A%2A&c59=USCBOL_surestart_preapproval&v60=Purch%7CCallback&c61=26&c63=https%3A%2F%2Fonline.citi.com%2FUS%2FJRS%2Fportal%2Ftemplate_lo.do%3FID%3Dsurestart_preapproval%26client_type%3DLO%26client_id%3D1024024&c64=12%3A30PM&v64=12%3A30PM&c65=Thursday&v65=Thursday&c66=Thursday%7C12%3A30PM&v67=New&v68=1&v69=UnAuth&c72=REL&c73=null&s=1600x1200&c=24&j=1.6&v=N&k=Y&bw=1600&bh=1200&AQE=1

Requested by

Host: online.citi.com
URL: https://online.citi.com/US/JRS/portal/template_lo.do?ID=surestart_preapproval&client_type=LO&client_id=1024024

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

35.181.18.61 Paris, France, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-35-181-18-61.eu-west-3.compute.amazonaws.com

Software

jag /

Resource Hash

a1ecbaed793a1f564c49c671f2dd0ce36f858534ef6d26b55783a06b884cc506

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=surestart_preapproval&client_type=LO&client_id=1024024
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 21 Jan 2021 17:33:16 GMT
x-content-type-options: nosniff
x-c: main-1414.Id04486.M0-474
p3p: CP="This is not a P3P policy"
vary: *
content-length: 43
x-xss-protection: 1; mode=block
pragma: no-cache
last-modified: Fri, 22 Jan 2021 17:33:16 GMT
server: jag
xserver: anedge-75ffb878dc-9vnd7
etag: 3460133879467671552-4621913795761515744
strict-transport-security: max-age=31536000; includeSubDomains
content-type: image/gif;charset=utf-8
access-control-allow-origin: *
cache-control: no-cache, no-store, max-age=0, no-transform, private
expires: Wed, 20 Jan 2021 17:33:16 GMT

Redirect headers

date: Thu, 21 Jan 2021 17:33:16 GMT
x-content-type-options: nosniff
x-c: main-1414.Id04486.M0-474
p3p: CP="This is not a P3P policy"
content-length: 0
x-xss-protection: 1; mode=block
pragma: no-cache
location: https://metrics1.citibank.com/b/ss/citinaprod/1/JS-1.4/s99394056880722?AQB=1&pccr=true&vidn=3004DD6E7A34589D-40001B421AD99043&ndh=1&pf=1&t=21%2F0%2F2021%2018%3A33%3A16%204%20-60&fid=262D8E5D69FA491C-3C828004B48A5FE0&ce=UTF-8&pageName=Purch%7CGetPreApproved%7CPurch%7CRequestCallback%7CForm&g=https%3A%2F%2Fonline.citi.com%2FUS%2FJRS%2Fportal%2Ftemplate_lo.do%3FID%3Dsurestart_preapproval%26client_type%3DLO%26client_id%3D1024024&c.&visitStart=1&.c&cc=USD&ch=CMIWebEnglish&events=event76&c1=CBOL_Lending&h1=BANKRIAWebEnglish%2FCBOL_Lending%2FPurch%2FGetPreApproved%7CHUCY%7CPurch%2FForm&c2=Purch&c3=GetPreApproved%7CHUCY%7CPurch&c4=Form&v6=%2A%2ASENSITIVE%20DATA%20REPLACED%2A%2A&v20=LO1024024&c25=%5BCS%5Dv1%7C3004DD6E1518937A-6000183F9BF79136%5BCE%5D&v30=REL&v38=Purch%7CGetPreApproved%7CPurch%7CRequestCallback%7CForm&c47=%2A%2ASENSITIVE%20DATA%20REPLACED%2A%2A&c48=%2A%2ASENSITIVE%20DATA%20REPLACED%2A%2A&c59=USCBOL_surestart_preapproval&v60=Purch%7CCallback&c61=26&c63=https%3A%2F%2Fonline.citi.com%2FUS%2FJRS%2Fportal%2Ftemplate_lo.do%3FID%3Dsurestart_preapproval%26client_type%3DLO%26client_id%3D1024024&c64=12%3A30PM&v64=12%3A30PM&c65=Thursday&v65=Thursday&c66=Thursday%7C12%3A30PM&v67=New&v68=1&v69=UnAuth&c72=REL&c73=null&s=1600x1200&c=24&j=1.6&v=N&k=Y&bw=1600&bh=1200&AQE=1
last-modified: Fri, 22 Jan 2021 17:33:16 GMT
server: jag
xserver: anedge-75ffb878dc-5b59v
strict-transport-security: max-age=31536000; includeSubDomains
content-type: text/plain;charset=utf-8
access-control-allow-origin: *
cache-control: no-cache, no-store, max-age=0, no-transform, private
expires: Wed, 20 Jan 2021 17:33:16 GMT

GET
H2 200 Citi-Branding-Sprite.png
online.citi.com/GFC/branding/img/ 5 KB
5 KB 69ms
69ms Image
image/png 104.111.238.178
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://online.citi.com/GFC/branding/img/Citi-Branding-Sprite.png

Requested by

Host: online.citi.com
URL: https://online.citi.com/JRS/CHIP/css/chip.min.css

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.111.238.178 , Netherlands, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-111-238-178.deploy.static.akamaitechnologies.com

Software

Resource Hash

3fca3de24621f0f10186594054444d608016297c2e853e548710b3521e42a609

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

Referer: https://online.citi.com/JRS/CHIP/css/chip.min.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 21 Jan 2021 17:33:16 GMT
last-modified: Wed, 14 Jun 2017 18:29:01 GMT
x-akamai-citisite: GTDC
strict-transport-security: max-age=300
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
content-length: 4952
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
accept-ranges: bytes
content-type: image/png
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 200 arrow-btn-next-white-sm-bold.svg
online.citi.com/CBOL/common/ui/ddl/theme/latest/images/icons/svgs/arrows/ 918 B
950 B 68ms
68ms Image
image/svg+xml 104.111.238.178
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://online.citi.com/CBOL/common/ui/ddl/theme/latest/images/icons/svgs/arrows/arrow-btn-next-white-sm-bold.svg

Requested by

Host: online.citi.com
URL: https://online.citi.com/JRS/CHIP/css/chip.min.css

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.111.238.178 , Netherlands, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-111-238-178.deploy.static.akamaitechnologies.com

Software

Resource Hash

4f918cd256712c03a1b88007176cabf623cc63740e919d35a217c18dc7ebe607

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

Referer: https://online.citi.com/JRS/CHIP/css/chip.min.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=300
content-encoding: gzip
last-modified: Tue, 12 Sep 2017 17:22:45 GMT
x-akamai-citisite: GTDC
date: Thu, 21 Jan 2021 17:33:16 GMT
vary: Accept-Encoding
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
content-length: 496
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
accept-ranges: bytes
content-type: image/svg+xml
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 200 tag.js Show response
lptag.liveperson.net/tag/ 21 KB
8 KB 154ms
44ms Script
application/javascript 178.249.101.23
LIVEPERSON

General

Check archive.org

Show headers Download Go to

Full URL: https://lptag.liveperson.net/tag/tag.js?site=50929468
Requested by: Host: online.citi.com
URL: https://online.citi.com/JRS/js/chat/le-mtagconfig.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 178.249.101.23 , Netherlands, ASN11054 (LIVEPERSON, US),
Reverse DNS
Software: ws /
Resource Hash: 145d14bb73e5b03cc73062c2a78c392125b891c62b1cc9d542e5adba762f04e7

Request headers

Referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=surestart_preapproval&client_type=LO&client_id=1024024
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 21 Jan 2021 17:33:16 GMT
content-encoding: gzip
last-modified: Thu, 03 Sep 2020 08:27:49 GMT
server: ws
etag: "5f50a905-1d8f"
access-control-allow-methods: GET, POST, PATCH
content-type: application/javascript
access-control-expose-headers: X-Requested-With, X-HTTP-Method-Override, LP-DOMAIN-REFERER, LP-URL, ETag, ac-revision, X-LP-Last-Modified, If-Match, Authentication-Method, Credit-Card-Ref, Automation-Secret, Email-Token, x-lp-host, Lp-Req-Time, date, x-application-context, strict-transport-security, x-content-type-options, x-download-options, x-xss-protection, x-cache-status, x-amz-id-2, x-amz-request-id, expires, last-modified, set-cookie, content-security-policy, x-frame-options
cache-control: public, max-age=630
access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization, X-HTTP-Method-Override, LP-DOMAIN-REFERER, LP-URL, ETag, ac-revision, X-LP-Last-Modified, If-Match, Authentication-Method, Credit-Card-Ref, Automation-Secret, Email-Token
content-length: 7567

GET
H2

200

cse.js Show response
cse.google.com/cse/
Redirect Chain

https://www.google.com/cse/cse.js?cx=009695499870347544712:e3dyicpbrwu
https://cse.google.com/cse/cse.js?cx=009695499870347544712:e3dyicpbrwu

10 KB
4 KB

75ms
55ms

Script
text/javascript

2a00:1450:4001:825::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cse.google.com/cse/cse.js?cx=009695499870347544712:e3dyicpbrwu

Requested by

Host: online.citi.com
URL: https://online.citi.com/US/JRS/portal/template_lo.do?ID=surestart_preapproval&client_type=LO&client_id=1024024

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:825::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

gws /

Resource Hash

32a17f5568bff60258cc679775d465e23972d3f7656817c877aeb4a36218630a

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=surestart_preapproval&client_type=LO&client_id=1024024
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 21 Jan 2021 17:33:16 GMT
content-encoding: br
server: gws
x-frame-options: SAMEORIGIN
p3p: CP="This is not a P3P policy! See g.co/p3phelp for more info."
cache-control: private
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3467
x-xss-protection: 0
expires: Thu, 21 Jan 2021 17:33:16 GMT

Redirect headers

date: Thu, 21 Jan 2021 17:16:11 GMT
x-content-type-options: nosniff
server: sffe
age: 1025
content-type: text/html; charset=UTF-8
location: https://cse.google.com/cse/cse.js?cx=009695499870347544712:e3dyicpbrwu
cache-control: public, max-age=1800
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 267
x-xss-protection: 0
expires: Thu, 21 Jan 2021 17:46:11 GMT

POST
H2 200 ngapostbranding.jws Show response
online.citi.com/US/REST/nga/ 162 B
694 B 233ms
232ms XHR
text/html 104.111.238.178
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://online.citi.com/US/REST/nga/ngapostbranding.jws?JFP_TOKEN=Q2D8T4WP

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/code/4b895b43d9c1209af6f5e71e9b42936b.js?conditionId0=3013337

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.111.238.178 , Netherlands, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-111-238-178.deploy.static.akamaitechnologies.com

Software

Resource Hash

50938486fbd18c6197151fa18f56908449b6edc6c9f161277078fe00b69599aa

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

Accept: application/json, text/javascript, */*; q=0.01
Referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=surestart_preapproval&client_type=LO&client_id=1024024
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=300
content-encoding: gzip
x-akamai-citisite: GTDC
date: Thu, 21 Jan 2021 17:33:16 GMT
vary: Accept-Encoding
content-language: en-US
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
cache-control: no-cache, must-revalidate, proxy-revalidate, no-store
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
content-length: 167
content-type: text/html;charset=ISO-8859-1
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 200 citilive-search-responsive.css
online.citi.com/JEA/CitiSearch/nexus-platform/css/ 62 KB
12 KB 90ms
89ms Stylesheet
text/css 104.111.238.178
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://online.citi.com/JEA/CitiSearch/nexus-platform/css/citilive-search-responsive.css

Requested by

Host: online.citi.com
URL: https://online.citi.com/JEA/CitiSearch/nexus-platform/js/citilive-search.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.111.238.178 , Netherlands, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-111-238-178.deploy.static.akamaitechnologies.com

Software

Resource Hash

6f3649e19993fee191ac81abe9c6c74f6714d9fd19ccd3a0cce2f31835018e10

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

Referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=surestart_preapproval&client_type=LO&client_id=1024024
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=300
content-encoding: gzip
last-modified: Wed, 15 Jul 2020 06:51:10 GMT
x-akamai-citisite: GTDC
date: Thu, 21 Jan 2021 17:33:16 GMT
vary: Accept-Encoding
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
expires: Thu, 21 Jan 2021 23:33:16 GMT
cache-control: max-age=21600
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
content-length: 12101
content-type: text/css
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 200 citilive-search-library.js Show response
online.citi.com/JEA/CitiSearch/nexus-platform/js/ 179 KB
61 KB 91ms
90ms Script
application/x-javascript 104.111.238.178
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://online.citi.com/JEA/CitiSearch/nexus-platform/js/citilive-search-library.js

Requested by

Host: online.citi.com
URL: https://online.citi.com/JEA/CitiSearch/nexus-platform/js/citilive-search.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.111.238.178 , Netherlands, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-111-238-178.deploy.static.akamaitechnologies.com

Software

Resource Hash

d57c8034f9c12aa3ce626c9ed1d61a4bb0941c3ef320bb59346f20496fb0096a

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

Referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=surestart_preapproval&client_type=LO&client_id=1024024
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=300
content-encoding: gzip
last-modified: Tue, 12 Sep 2017 17:24:53 GMT
x-akamai-citisite: GTDC
date: Thu, 21 Jan 2021 17:33:16 GMT
vary: Accept-Encoding
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
expires: Thu, 21 Jan 2021 23:33:16 GMT
cache-control: max-age=21600
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
content-length: 61658
content-type: application/x-javascript
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 200 citilive-search-service.js Show response
online.citi.com/JEA/CitiSearch/nexus-platform/js/ 9 KB
3 KB 120ms
119ms Script
application/x-javascript 104.111.238.178
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://online.citi.com/JEA/CitiSearch/nexus-platform/js/citilive-search-service.js

Requested by

Host: online.citi.com
URL: https://online.citi.com/JEA/CitiSearch/nexus-platform/js/citilive-search.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.111.238.178 , Netherlands, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-111-238-178.deploy.static.akamaitechnologies.com

Software

Resource Hash

eec5cc477e7cb4f1eee1f26dce3eb411a63716d89a9b659c7d5559571c837ccb

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

Referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=surestart_preapproval&client_type=LO&client_id=1024024
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=300
content-encoding: gzip
last-modified: Tue, 11 Sep 2018 07:31:14 GMT
x-akamai-citisite: GTDC
date: Thu, 21 Jan 2021 17:33:16 GMT
vary: Accept-Encoding
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
expires: Thu, 21 Jan 2021 23:33:16 GMT
cache-control: max-age=21600
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
content-length: 2415
content-type: application/x-javascript
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 200 citi-search-tmpl.js Show response
online.citi.com/JEA/CitiSearch/nexus-platform/js/ 1 MB
732 KB 121ms
119ms Script
application/x-javascript 104.111.238.178
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://online.citi.com/JEA/CitiSearch/nexus-platform/js/citi-search-tmpl.js

Requested by

Host: online.citi.com
URL: https://online.citi.com/JEA/CitiSearch/nexus-platform/js/citilive-search.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.111.238.178 , Netherlands, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-111-238-178.deploy.static.akamaitechnologies.com

Software

Resource Hash

4061018b43e420a8f4513629af7dc6c78465e9f9d42c13c97104c637c2480f25

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

Referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=surestart_preapproval&client_type=LO&client_id=1024024
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=300
content-encoding: gzip
last-modified: Wed, 16 Sep 2020 07:27:38 GMT
x-akamai-citisite: GTDC
date: Thu, 21 Jan 2021 17:33:16 GMT
vary: Accept-Encoding
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
expires: Thu, 21 Jan 2021 23:33:16 GMT
cache-control: max-age=21600
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
content-length: 747501
content-type: application/x-javascript
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 200 citilive-search-controller.js Show response
online.citi.com/JEA/CitiSearch/nexus-platform/js/ 127 KB
25 KB 126ms
124ms Script
application/x-javascript 104.111.238.178
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://online.citi.com/JEA/CitiSearch/nexus-platform/js/citilive-search-controller.js

Requested by

Host: online.citi.com
URL: https://online.citi.com/JEA/CitiSearch/nexus-platform/js/citilive-search.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.111.238.178 , Netherlands, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-111-238-178.deploy.static.akamaitechnologies.com

Software

Resource Hash

0013498129c7c6740dfa91fa229a33d0e2f115f9d38e61faafd594a4c8122a10

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

Referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=surestart_preapproval&client_type=LO&client_id=1024024
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=300
content-encoding: gzip
last-modified: Wed, 16 Sep 2020 07:27:38 GMT
x-akamai-citisite: GTDC
date: Thu, 21 Jan 2021 17:33:16 GMT
vary: Accept-Encoding
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
expires: Thu, 21 Jan 2021 23:33:16 GMT
cache-control: max-age=21600
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
content-length: 25011
content-type: application/x-javascript
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H/1.1

200
OK

servlet.ImageServer
citirel--c.na91.content.force.com/servlet/
Redirect Chain

https://citirel.my.salesforce.com/servlet/servlet.ImageServer?id=0152E000001TtDQQA0&oid=00D300000005om9EAA
https://citirel--c.na91.content.force.com/servlet/servlet.ImageServer?id=0152E000001TtDQQA0&oid=00D300000005om9EAA

31 KB
32 KB

812ms
134ms

Image
image/jpeg

13.110.10.60
SALESFORCE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://citirel--c.na91.content.force.com/servlet/servlet.ImageServer?id=0152E000001TtDQQA0&oid=00D300000005om9EAA

Requested by

Host: online.citi.com
URL: https://online.citi.com/US/JRS/portal/template_lo.do?ID=surestart_preapproval&client_type=LO&client_id=1024024

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

13.110.10.60 , United States, ASN14340 (SALESFORCE, US),

Reverse DNS

dcl5-ncg0-iad3.na91-ia2.force.com

Software

Resource Hash

49dba3c0728c92695be07d9b57e1143ad9953ee8949fd7aa836a71d248f655b5

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://online.citi.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Thu, 21 Jan 2021 17:33:18 GMT
X-Content-Type-Options: nosniff
X-B3-TraceId: fe18de74ed989601
Content-Length: 31663
X-XSS-Protection: 1; mode=block
Referrer-Policy: origin-when-cross-origin
Last-Modified: Wed, 19 Jun 2019 16:15:57 GMT
Expect-CT: max-age=86400, report-uri="https://a.forcesslreports.com/Expect-CT-report/nullm"
Content-Type: image/jpeg
Cache-Control: public,max-age=900
X-B3-SpanId: fe18de74ed989601
Public-Key-Pins-Report-Only: pin-sha256="9n0izTnSRF+W4W4JTq51avSXkWhQB8duS2bxVLfzXsY="; pin-sha256="5kJvNEMw0KjrCAu7eXY5HZdvyCS13BbA0VJG1RSP91w="; pin-sha256="njN4rRG+22dNXAi+yb8e3UMypgzPUPHlv4+foULwl1g="; max-age=86400; includeSubDomains; report-uri="https://a.forcesslreports.com/hpkp-report/nullm";
Content-Security-Policy: upgrade-insecure-requests
X-Robots-Tag: none
X-B3-Sampled: 0
Expires: Thu, 21 Jan 2021 17:48:18 GMT

Redirect headers

X-Content-Type-Options: nosniff
Strict-Transport-Security: max-age=31536002; includeSubDomains
Referrer-Policy: origin-when-cross-origin
X-B3-TraceId: 6e30e65c3001c6af
Expect-CT: max-age=86400, report-uri="https://a.forcesslreports.com/Expect-CT-report/00D300000005om9m"
Content-Type: text/html;charset=ISO-8859-1
Location: https://citirel--c.na91.content.force.com/servlet/servlet.ImageServer?id=0152E000001TtDQQA0&oid=00D300000005om9EAA
Cache-Control: must-revalidate,no-cache,no-store
X-B3-SpanId: 6e30e65c3001c6af
Public-Key-Pins-Report-Only: pin-sha256="9n0izTnSRF+W4W4JTq51avSXkWhQB8duS2bxVLfzXsY="; pin-sha256="5kJvNEMw0KjrCAu7eXY5HZdvyCS13BbA0VJG1RSP91w="; pin-sha256="njN4rRG+22dNXAi+yb8e3UMypgzPUPHlv4+foULwl1g="; max-age=86400; includeSubDomains; report-uri="https://a.forcesslreports.com/hpkp-report/00D300000005om9m";
X-B3-Sampled: 0
X-Robots-Tag: none
Content-Length: 730
X-XSS-Protection: 1; mode=block

GET
H/1.1 200
OK tc.min.js Show response
c1.rfihub.net/js/ 20 KB
7 KB 126ms
38ms Script
application/x-javascript 104.111.224.160
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://c1.rfihub.net/js/tc.min.js
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/code/1aba933a3ecc5ef8fad27fd096354b67.js?conditionId0=467299
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 104.111.224.160 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-111-224-160.deploy.static.akamaitechnologies.com
Software: Jetty(9.0.6.v20130930) /
Resource Hash: cb2bb21705b9cce9781d02c9223f3344a65bd5314027d11c5a8518ad4bd84e84

Request headers

Referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=surestart_preapproval&client_type=LO&client_id=1024024
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Thu, 21 Jan 2021 17:33:16 GMT
Content-Encoding: gzip
Last-Modified: Fri, 27 Nov 2020 07:07:45 GMT
Server: Jetty(9.0.6.v20130930)
Vary: Accept-Encoding
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Cache-Control: public, max-age=3600
Connection: keep-alive
Content-Type: application/x-javascript
Content-Length: 6375
Expires: Thu, 21 Jan 2021 18:33:16 GMT

GET
H3-Q050

200

activityi;dc_pre=CIf0vbzHre4CFVqKsgod7cgJ4A;src=6256710;type=drsog0;cat=mortg002;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;ord=5676426202304
6256710.fls.doubleclick.net/ Frame BDDF
Redirect Chain

https://6256710.fls.doubleclick.net/activityi;src=6256710;type=drsog0;cat=mortg002;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;ord=5676426202304?
https://6256710.fls.doubleclick.net/activityi;dc_pre=CIf0vbzHre4CFVqKsgod7cgJ4A;src=6256710;type=drsog0;cat=mortg002;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;ord=5676426202304?

0
0

182ms
114ms

Document
text/html

172.217.22.70
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://6256710.fls.doubleclick.net/activityi;dc_pre=CIf0vbzHre4CFVqKsgod7cgJ4A;src=6256710;type=drsog0;cat=mortg002;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;ord=5676426202304?

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/code/eb7fbc549d9aaadb0512e4c8058a89ab.js?conditionId0=4878640

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

172.217.22.70 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra15s17-in-f6.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=21600
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: 6256710.fls.doubleclick.net
:scheme: https
:path: /activityi;dc_pre=CIf0vbzHre4CFVqKsgod7cgJ4A;src=6256710;type=drsog0;cat=mortg002;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;ord=5676426202304?
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=surestart_preapproval&client_type=LO&client_id=1024024
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: IDE=AHWqTUmMf-FIeiRujlXULmHtr5w_EuDzIGNvXnN7R8XlsEH8Am_4UDepbJgIzY8U
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=surestart_preapproval&client_type=LO&client_id=1024024

Response headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
date: Thu, 21 Jan 2021 17:33:17 GMT
expires: Thu, 21 Jan 2021 17:33:17 GMT
cache-control: private, max-age=0
strict-transport-security: max-age=21600
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 322
x-xss-protection: 0
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

Redirect headers

p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
date: Thu, 21 Jan 2021 17:33:17 GMT
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
cache-control: no-cache, must-revalidate
follow-only-when-prerender-shown: 1
strict-transport-security: max-age=21600
location: https://6256710.fls.doubleclick.net/activityi;dc_pre=CIf0vbzHre4CFVqKsgod7cgJ4A;src=6256710;type=drsog0;cat=mortg002;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;tfua=;npa=;ord=5676426202304?
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
server: cafe
content-length: 0
x-xss-protection: 0
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H3-Q050 200 cse_element__de.js Show response
www.google.com/cse/static/element/a57bc5975bc720b0/ 275 KB
90 KB 9ms
7ms Script
text/javascript 2a00:1450:4001:801::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/cse/static/element/a57bc5975bc720b0/cse_element__de.js?usqp=CAM%3D

Requested by

Host: www.google.com
URL: https://www.google.com/cse/cse.js?cx=009695499870347544712:e3dyicpbrwu

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

b9fc2db5b8d368c28d5bfed2156100289f12437b60eb32c43a613528cc95461a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=surestart_preapproval&client_type=LO&client_id=1024024
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 20 Jan 2021 08:21:55 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Fri, 08 Jan 2021 18:04:24 GMT
server: sffe
age: 119481
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 92577
x-xss-protection: 0
expires: Thu, 20 Jan 2022 08:21:55 GMT

GET
H3-Q050 200 default+de.css
www.google.com/cse/static/element/a57bc5975bc720b0/ 41 KB
9 KB 7ms
6ms Stylesheet
text/css 2a00:1450:4001:801::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/cse/static/element/a57bc5975bc720b0/default+de.css

Requested by

Host: www.google.com
URL: https://www.google.com/cse/cse.js?cx=009695499870347544712:e3dyicpbrwu

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4c1355d27b14881a055e00a4a2afa4608b452c9780ac5c61e1b8f9fd55fa3e1e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=surestart_preapproval&client_type=LO&client_id=1024024
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 20 Jan 2021 08:21:55 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Fri, 08 Jan 2021 18:04:24 GMT
server: sffe
age: 119481
vary: Accept-Encoding
content-type: text/css
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 9032
x-xss-protection: 0
expires: Thu, 20 Jan 2022 08:21:55 GMT

GET
H3-Q050 200 default.css
www.google.com/cse/static/style/look/v4/ 4 KB
1 KB 8ms
7ms Stylesheet
text/css 2a00:1450:4001:801::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/cse/static/style/look/v4/default.css

Requested by

Host: www.google.com
URL: https://www.google.com/cse/cse.js?cx=009695499870347544712:e3dyicpbrwu

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

dcec22bbcb68119d6c7d6d5e088fb82183a9826d0c9e3403f1386fd837f06a89

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=surestart_preapproval&client_type=LO&client_id=1024024
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 21 Jan 2021 16:56:20 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Wed, 17 Jun 2020 00:00:00 GMT
server: sffe
age: 2216
vary: Accept-Encoding
content-type: text/css
cache-control: public, max-age=3000
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1345
x-xss-protection: 0
expires: Thu, 21 Jan 2021 17:46:20 GMT

GET
H2 200 .jsonp Show response
lptag.liveperson.net/lptag/api/account/50929468/configuration/applications/taglets/ 286 KB
103 KB 84ms
83ms Script
application/x-javascript 178.249.101.23
LIVEPERSON

General

Check archive.org

Show headers Download Go to

Full URL: https://lptag.liveperson.net/lptag/api/account/50929468/configuration/applications/taglets/.jsonp?v=2.0&df=0&b=1
Requested by: Host: online.citi.com
URL: https://online.citi.com/JRS/js/chat/le-mtagconfig.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 178.249.101.23 , Netherlands, ASN11054 (LIVEPERSON, US),
Reverse DNS
Software: ws /
Resource Hash: c126f0597eddb532c669114849ed058abb108e142f5633fb46b762c60f546f52

Request headers

Referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=surestart_preapproval&client_type=LO&client_id=1024024
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 21 Jan 2021 17:33:16 GMT
content-encoding: gzip
server: ws
x-cache-status: HIT
access-control-allow-methods: GET, POST, PATCH
content-type: application/x-javascript
access-control-expose-headers: X-Requested-With, X-HTTP-Method-Override, LP-DOMAIN-REFERER, LP-URL, ETag, ac-revision, X-LP-Last-Modified, If-Match, Authentication-Method, Credit-Card-Ref, Automation-Secret, Email-Token, x-lp-host, Lp-Req-Time, date, x-application-context, strict-transport-security, x-content-type-options, x-download-options, x-xss-protection, x-cache-status, x-amz-id-2, x-amz-request-id, expires, last-modified, set-cookie, content-security-policy, x-frame-options
cache-control: public, max-age=630
access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization, X-HTTP-Method-Override, LP-DOMAIN-REFERER, LP-URL, ETag, ac-revision, X-LP-Last-Modified, If-Match, Authentication-Method, Credit-Card-Ref, Automation-Secret, Email-Token

GET
H2

200

s94755139168289
metrics1.citibank.com/b/ss/citinaprod/1/JS-1.4/
Redirect Chain

https://metrics1.citibank.com/b/ss/citinaprod/1/JS-1.4/s94755139168289?AQB=1&ndh=1&pf=1&t=21%2F0%2F2021%2018%3A33%3A16%204%20-60&fid=262D8E5D69FA491C-3C828004B48A5FE0&ce=UTF-8&pageName=Purch%7CGetP...
https://metrics1.citibank.com/b/ss/citinaprod/1/JS-1.4/s94755139168289?AQB=1&pccr=true&vidn=3004DD6EB0BD1A93-40001F0C5ADF976F&ndh=1&pf=1&t=21%2F0%2F2021%2018%3A33%3A16%204%20-60&fid=262D8E5D69FA491...

43 B
251 B

64ms
63ms

Image
image/gif

35.181.18.61
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://metrics1.citibank.com/b/ss/citinaprod/1/JS-1.4/s94755139168289?AQB=1&pccr=true&vidn=3004DD6EB0BD1A93-40001F0C5ADF976F&ndh=1&pf=1&t=21%2F0%2F2021%2018%3A33%3A16%204%20-60&fid=262D8E5D69FA491C-3C828004B48A5FE0&ce=UTF-8&pageName=Purch%7CGetPreApproved&g=https%3A%2F%2Fonline.citi.com%2FUS%2FJRS%2Fportal%2Ftemplate_lo.do%3FID%3Dsurestart_preapproval%26client_type%3DLO%26client_id%3D1024024&cc=USD&ch=CMIWebEnglish&events=event76&c1=CBOL_Lending&h1=BANKRIAWebEnglish%2FCBOL_Lending%2FPurch%2FGetPreApproved%7CHUCY%7CPurch%2FForm&c2=Purch&c3=GetPreApproved&c4=Form&v6=%2A%2ASENSITIVE%20DATA%20REPLACED%2A%2A&v7=Purch%7CGetPreApproved%7CPurch%7CRequestCallback%7CForm&v20=LO1024024&c25=%5BCS%5Dv1%7C3004DD6E1518937A-6000183F9BF79136%5BCE%5D&v30=REL&v38=Purch%7CGetPreApproved&c47=%2A%2ASENSITIVE%20DATA%20REPLACED%2A%2A&c48=%2A%2ASENSITIVE%20DATA%20REPLACED%2A%2A&c59=USCBOL_surestart_preapproval&v60=Purch%7CCallback&c61=26&c63=https%3A%2F%2Fonline.citi.com%2FUS%2FJRS%2Fportal%2Ftemplate_lo.do%3FID%3Dsurestart_preapproval%26client_type%3DLO%26client_id%3D1024024&c64=12%3A30PM&v64=12%3A30PM&c65=Thursday&v65=Thursday&c66=Thursday%7C12%3A30PM&v67=New&v68=1&v69=UnAuth&c72=REL&c73=null&s=1600x1200&c=24&j=1.6&v=N&k=Y&bw=1600&bh=1200&AQE=1

Requested by

Host: online.citi.com
URL: https://online.citi.com/US/JRS/portal/template_lo.do?ID=surestart_preapproval&client_type=LO&client_id=1024024

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

35.181.18.61 Paris, France, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-35-181-18-61.eu-west-3.compute.amazonaws.com

Software

jag /

Resource Hash

a1ecbaed793a1f564c49c671f2dd0ce36f858534ef6d26b55783a06b884cc506

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=surestart_preapproval&client_type=LO&client_id=1024024
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 21 Jan 2021 17:33:16 GMT
x-content-type-options: nosniff
x-c: main-1414.Id04486.M0-474
p3p: CP="This is not a P3P policy"
vary: *
content-length: 43
x-xss-protection: 1; mode=block
pragma: no-cache
last-modified: Fri, 22 Jan 2021 17:33:17 GMT
server: jag
xserver: anedge-75ffb878dc-vlw7n
etag: 3460133881537921024-4621682692160561405
strict-transport-security: max-age=31536000; includeSubDomains
content-type: image/gif;charset=utf-8
access-control-allow-origin: *
cache-control: no-cache, no-store, max-age=0, no-transform, private
expires: Wed, 20 Jan 2021 17:33:17 GMT

Redirect headers

date: Thu, 21 Jan 2021 17:33:16 GMT
x-content-type-options: nosniff
x-c: main-1414.Id04486.M0-474
p3p: CP="This is not a P3P policy"
content-length: 0
x-xss-protection: 1; mode=block
pragma: no-cache
location: https://metrics1.citibank.com/b/ss/citinaprod/1/JS-1.4/s94755139168289?AQB=1&pccr=true&vidn=3004DD6EB0BD1A93-40001F0C5ADF976F&ndh=1&pf=1&t=21%2F0%2F2021%2018%3A33%3A16%204%20-60&fid=262D8E5D69FA491C-3C828004B48A5FE0&ce=UTF-8&pageName=Purch%7CGetPreApproved&g=https%3A%2F%2Fonline.citi.com%2FUS%2FJRS%2Fportal%2Ftemplate_lo.do%3FID%3Dsurestart_preapproval%26client_type%3DLO%26client_id%3D1024024&cc=USD&ch=CMIWebEnglish&events=event76&c1=CBOL_Lending&h1=BANKRIAWebEnglish%2FCBOL_Lending%2FPurch%2FGetPreApproved%7CHUCY%7CPurch%2FForm&c2=Purch&c3=GetPreApproved&c4=Form&v6=%2A%2ASENSITIVE%20DATA%20REPLACED%2A%2A&v7=Purch%7CGetPreApproved%7CPurch%7CRequestCallback%7CForm&v20=LO1024024&c25=%5BCS%5Dv1%7C3004DD6E1518937A-6000183F9BF79136%5BCE%5D&v30=REL&v38=Purch%7CGetPreApproved&c47=%2A%2ASENSITIVE%20DATA%20REPLACED%2A%2A&c48=%2A%2ASENSITIVE%20DATA%20REPLACED%2A%2A&c59=USCBOL_surestart_preapproval&v60=Purch%7CCallback&c61=26&c63=https%3A%2F%2Fonline.citi.com%2FUS%2FJRS%2Fportal%2Ftemplate_lo.do%3FID%3Dsurestart_preapproval%26client_type%3DLO%26client_id%3D1024024&c64=12%3A30PM&v64=12%3A30PM&c65=Thursday&v65=Thursday&c66=Thursday%7C12%3A30PM&v67=New&v68=1&v69=UnAuth&c72=REL&c73=null&s=1600x1200&c=24&j=1.6&v=N&k=Y&bw=1600&bh=1200&AQE=1
last-modified: Fri, 22 Jan 2021 17:33:17 GMT
server: jag
xserver: anedge-75ffb878dc-l6svd
strict-transport-security: max-age=31536000; includeSubDomains
content-type: text/plain;charset=utf-8
access-control-allow-origin: *
cache-control: no-cache, no-store, max-age=0, no-transform, private
expires: Wed, 20 Jan 2021 17:33:17 GMT

GET
H/1.1 200
OK idr.js Show response
a.rfihub.com/ 83 B
685 B 420ms
273ms Script
application/javascript 193.0.160.129
ROCKETFUEL

General

Check archive.org

Show headers Download Go to

Full URL: https://a.rfihub.com/idr.js?_callback=window.RocketfuelBCP.jsonpCallbacks.request_cmZpSWRJbkNhY2hl
Requested by: Host: c1.rfihub.net
URL: https://c1.rfihub.net/js/tc.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_256_CBC
Server: 193.0.160.129 , Netherlands, ASN54312 (ROCKETFUEL, US),
Reverse DNS
Software: Jetty(9.0.6.v20130930) /
Resource Hash: 7b339673dc3c84e10acac205a1cdfef6dc6502fba85fba46e4e5fe96bcdcce5a

Request headers

Referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=surestart_preapproval&client_type=LO&client_id=1024024
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Cache-Control: public, max-age=33696000
Content-Type: application/javascript
Server: Jetty(9.0.6.v20130930)
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Content-Length: 83
Expires: Tue, 15 Feb 2022 17:33:17 GMT

GET
H2 200 / Show response
lp-01.chat.online.citi.com/api/account/50929468/configuration/setting/accountproperties/ 4 KB
1 KB 408ms
21ms Script
application/javascript 2a03:6400:10:0:178:249:97:99
LIVEPERSON

General

Check archive.org

Show headers Download Go to

Full URL: https://lp-01.chat.online.citi.com/api/account/50929468/configuration/setting/accountproperties/?cb=lpCb29052x83855
Requested by: Host: lptag.liveperson.net
URL: https://lptag.liveperson.net/lptag/api/account/50929468/configuration/applications/taglets/.jsonp?v=2.0&df=0&b=1
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2a03:6400:10:0:178:249:97:99 , United Kingdom, ASN11054 (LIVEPERSON, US),
Reverse DNS
Software: ws /
Resource Hash: dae4acecbd1d892109a8b7f2ed6b3d4812328d4cbae3b14758e445724a2a38a0

Request headers

Referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=surestart_preapproval&client_type=LO&client_id=1024024
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 21 Jan 2021 17:33:17 GMT
content-encoding: gzip
server: ws
x-cache-status: HIT
vary: Accept
content-type: application/javascript
x-envoy-upstream-service-time: 1
expires: Thu, 21 Jan 2021 17:33:45 GMT

GET
H/1.1 200
OK taglet_v2.4.js Show response
static-assets.fs.liveperson.com/citi/taglets/ 30 KB
7 KB 145ms
41ms Script
application/javascript 143.204.215.24
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://static-assets.fs.liveperson.com/citi/taglets/taglet_v2.4.js
Requested by: Host: lptag.liveperson.net
URL: https://lptag.liveperson.net/lptag/api/account/50929468/configuration/applications/taglets/.jsonp?v=2.0&df=0&b=1
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 143.204.215.24 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-143-204-215-24.fra53.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: adb1b99bd6e0c98acebcadc78cbf92fcba77bc07941e2c00d374a551f3f42a89

Request headers

Referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=surestart_preapproval&client_type=LO&client_id=1024024
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-amz-server-side-encryption: AES256
Date: Thu, 21 Jan 2021 17:31:35 GMT
Content-Encoding: gzip
Vary: Accept-Encoding
Last-Modified: Tue, 19 Jan 2021 18:11:00 GMT
Server: AmazonS3
Age: 103
ETag: W/"3525af26eda2f572a3dc8ccdd713e338"
Transfer-Encoding: chunked
X-Cache: Hit from cloudfront
Content-Type: application/javascript
Via: 1.1 6080b2713e502211e152f21f5c59c5a7.cloudfront.net (CloudFront)
Connection: keep-alive
X-Amz-Cf-Pop: FRA53-C1
X-Amz-Cf-Id: jXJju62t8s2SP70s6YBUvTlDjjcgooMMH7-rXzxQVA-KvTjzNRriLA==

GET
H2 200 zones Show response
lp-01.chat.online.citi.com/api/account/50929468/configuration/le-campaigns/ 5 KB
1021 B 416ms
40ms Script
application/javascript 2a03:6400:10:0:178:249:97:99
LIVEPERSON

General

Check archive.org

Show headers Download Go to

Full URL: https://lp-01.chat.online.citi.com/api/account/50929468/configuration/le-campaigns/zones?fields=id&fields=zoneValue&cb=lpZonesStaticCB
Requested by: Host: lptag.liveperson.net
URL: https://lptag.liveperson.net/lptag/api/account/50929468/configuration/applications/taglets/.jsonp?v=2.0&df=0&b=1
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2a03:6400:10:0:178:249:97:99 , United Kingdom, ASN11054 (LIVEPERSON, US),
Reverse DNS
Software: ws /
Resource Hash: 12f9393ae0fd222984b6a955088bd83de9f8548d17e7110b814f133f3a8e460f

Request headers

Referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=surestart_preapproval&client_type=LO&client_id=1024024
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 21 Jan 2021 17:33:17 GMT
content-encoding: gzip
server: ws
x-cache-status: HIT
vary: Accept
content-type: application/javascript
x-envoy-upstream-service-time: 1
expires: Thu, 21 Jan 2021 17:33:45 GMT

GET
H2

200

s93554276062718
metrics1.citibank.com/b/ss/citinaprod/1/JS-1.4/
Redirect Chain

https://metrics1.citibank.com/b/ss/citinaprod/1/JS-1.4/s93554276062718?AQB=1&ndh=1&pf=1&t=21%2F0%2F2021%2018%3A33%3A16%204%20-60&fid=262D8E5D69FA491C-3C828004B48A5FE0&ce=UTF-8&pageName=%7CRequestCa...
https://metrics1.citibank.com/b/ss/citinaprod/1/JS-1.4/s93554276062718?AQB=1&pccr=true&vidn=3004DD6EE56A3739-40001B92FADB0BAB&ndh=1&pf=1&t=21%2F0%2F2021%2018%3A33%3A16%204%20-60&fid=262D8E5D69FA491...

43 B
250 B

46ms
46ms

Image
image/gif

35.181.18.61
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://metrics1.citibank.com/b/ss/citinaprod/1/JS-1.4/s93554276062718?AQB=1&pccr=true&vidn=3004DD6EE56A3739-40001B92FADB0BAB&ndh=1&pf=1&t=21%2F0%2F2021%2018%3A33%3A16%204%20-60&fid=262D8E5D69FA491C-3C828004B48A5FE0&ce=UTF-8&pageName=%7CRequestCallback%7CForm&g=https%3A%2F%2Fonline.citi.com%2FUS%2FJRS%2Fportal%2Ftemplate_lo.do%3FID%3Dsurestart_preapproval%26client_type%3DLO%26client_id%3D1024024&cc=USD&ch=CMIWebEnglish&events=event76&c1=CBOL_Lending&h1=BANKRIAWebEnglish%2FCBOL_Lending%2FPurch%2FGetPreApproved%7CHUCY%7CPurch%2FForm&c2=Purch&c3=RequestCallback%7C&c4=Form&v6=%2A%2ASENSITIVE%20DATA%20REPLACED%2A%2A&v7=Purch%7CGetPreApproved&v20=LO1024024&c25=%5BCS%5Dv1%7C3004DD6E1518937A-6000183F9BF79136%5BCE%5D&v30=REL&v38=%7CRequestCallback%7CForm&c46=Purch%7CGetPreApproved&c47=%2A%2ASENSITIVE%20DATA%20REPLACED%2A%2A&c48=%2A%2ASENSITIVE%20DATA%20REPLACED%2A%2A&c59=jUSCBOL_surestart_preapproval&v60=%7CCallback&c61=26&c63=https%3A%2F%2Fonline.citi.com%2FUS%2FJRS%2Fportal%2Ftemplate_lo.do%3FID%3Dsurestart_preapproval%26client_type%3DLO%26client_id%3D1024024&c64=12%3A30PM&v64=12%3A30PM&c65=Thursday&v65=Thursday&c66=Thursday%7C12%3A30PM&v66=None&v67=New&v68=1&v69=UnAuth&c72=REL&c73=null&s=1600x1200&c=24&j=1.6&v=N&k=Y&bw=1600&bh=1200&AQE=1

Requested by

Host: online.citi.com
URL: https://online.citi.com/US/JRS/portal/template_lo.do?ID=surestart_preapproval&client_type=LO&client_id=1024024

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

35.181.18.61 Paris, France, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-35-181-18-61.eu-west-3.compute.amazonaws.com

Software

jag /

Resource Hash

a1ecbaed793a1f564c49c671f2dd0ce36f858534ef6d26b55783a06b884cc506

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=surestart_preapproval&client_type=LO&client_id=1024024
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 21 Jan 2021 17:33:17 GMT
x-content-type-options: nosniff
x-c: main-1414.Id04486.M0-474
p3p: CP="This is not a P3P policy"
vary: *
content-length: 43
x-xss-protection: 1; mode=block
pragma: no-cache
last-modified: Fri, 22 Jan 2021 17:33:17 GMT
server: jag
xserver: anedge-75ffb878dc-8ps9w
etag: 3460133881600966656-4621883801320569247
strict-transport-security: max-age=31536000; includeSubDomains
content-type: image/gif;charset=utf-8
access-control-allow-origin: *
cache-control: no-cache, no-store, max-age=0, no-transform, private
expires: Wed, 20 Jan 2021 17:33:17 GMT

Redirect headers

date: Thu, 21 Jan 2021 17:33:17 GMT
x-content-type-options: nosniff
x-c: main-1414.Id04486.M0-474
p3p: CP="This is not a P3P policy"
content-length: 0
x-xss-protection: 1; mode=block
pragma: no-cache
location: https://metrics1.citibank.com/b/ss/citinaprod/1/JS-1.4/s93554276062718?AQB=1&pccr=true&vidn=3004DD6EE56A3739-40001B92FADB0BAB&ndh=1&pf=1&t=21%2F0%2F2021%2018%3A33%3A16%204%20-60&fid=262D8E5D69FA491C-3C828004B48A5FE0&ce=UTF-8&pageName=%7CRequestCallback%7CForm&g=https%3A%2F%2Fonline.citi.com%2FUS%2FJRS%2Fportal%2Ftemplate_lo.do%3FID%3Dsurestart_preapproval%26client_type%3DLO%26client_id%3D1024024&cc=USD&ch=CMIWebEnglish&events=event76&c1=CBOL_Lending&h1=BANKRIAWebEnglish%2FCBOL_Lending%2FPurch%2FGetPreApproved%7CHUCY%7CPurch%2FForm&c2=Purch&c3=RequestCallback%7C&c4=Form&v6=%2A%2ASENSITIVE%20DATA%20REPLACED%2A%2A&v7=Purch%7CGetPreApproved&v20=LO1024024&c25=%5BCS%5Dv1%7C3004DD6E1518937A-6000183F9BF79136%5BCE%5D&v30=REL&v38=%7CRequestCallback%7CForm&c46=Purch%7CGetPreApproved&c47=%2A%2ASENSITIVE%20DATA%20REPLACED%2A%2A&c48=%2A%2ASENSITIVE%20DATA%20REPLACED%2A%2A&c59=jUSCBOL_surestart_preapproval&v60=%7CCallback&c61=26&c63=https%3A%2F%2Fonline.citi.com%2FUS%2FJRS%2Fportal%2Ftemplate_lo.do%3FID%3Dsurestart_preapproval%26client_type%3DLO%26client_id%3D1024024&c64=12%3A30PM&v64=12%3A30PM&c65=Thursday&v65=Thursday&c66=Thursday%7C12%3A30PM&v66=None&v67=New&v68=1&v69=UnAuth&c72=REL&c73=null&s=1600x1200&c=24&j=1.6&v=N&k=Y&bw=1600&bh=1200&AQE=1
last-modified: Fri, 22 Jan 2021 17:33:17 GMT
server: jag
xserver: anedge-75ffb878dc-vfsc4
strict-transport-security: max-age=31536000; includeSubDomains
content-type: text/plain;charset=utf-8
access-control-allow-origin: *
cache-control: no-cache, no-store, max-age=0, no-transform, private
expires: Wed, 20 Jan 2021 17:33:17 GMT

GET
H2 200 all.min.css
cdnjs.cloudflare.com/ajax/libs/font-awesome/5.14.0/css/ 58 KB
11 KB 37ms
22ms Stylesheet
text/css 2606:4700::6810:135e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/font-awesome/5.14.0/css/all.min.css

Requested by

Host: static-assets.fs.liveperson.com
URL: https://static-assets.fs.liveperson.com/citi/taglets/taglet_v2.4.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:135e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

14cbd9b866a9b092e3a2e03a93b128da5baca005fd8b44a1956146eaab7b48b7

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

Referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=surestart_preapproval&client_type=LO&client_id=1024024
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 21 Jan 2021 17:33:17 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"max_age":604800,"report_to":"cf-nel"}
age: 72655
cross-origin-resource-policy: cross-origin
alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 10391
cf-request-id: 07c79b089400002bf22aa09000000001
timing-allow-origin: *
last-modified: Wed, 15 Jul 2020 18:15:47 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "5f0f47d3-e637"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15780000
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=lbMFfWIO9MpvmmxP%2FG%2BTft978neaDCC1swWj6e%2F9bIVZMp8scg2EL56IiW6waeVPC7l9zkLas0iJEWQcnJaaoINSRR4UcA9GBUeXjX7H7%2BuqP5xl7V3ha%2FWIC0m1kcsajg%3D%3D"}]}
content-type: text/css; charset=utf-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=30672000
accept-ranges: bytes
cf-ray: 6152c7875b792bf2-FRA
expires: Tue, 11 Jan 2022 17:33:17 GMT

GET
H/1.1 200
OK style.css
static-assets.dev.fs.liveperson.com/citi/projects/start_a_convo/ 4 KB
1 KB 145ms
42ms Stylesheet
text/css 65.9.83.19
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://static-assets.dev.fs.liveperson.com/citi/projects/start_a_convo/style.css
Requested by: Host: static-assets.fs.liveperson.com
URL: https://static-assets.fs.liveperson.com/citi/taglets/taglet_v2.4.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 65.9.83.19 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 439be5ae819f4fbf2565e4ce41aa8ab5cd0ddb2ba61c503e6233cc98c83b92cd

Request headers

Referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=surestart_preapproval&client_type=LO&client_id=1024024
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-amz-server-side-encryption: AES256
x-amz-version-id: lD_GpD_AAAipRSgkPL542.IKnDOFvK7D
Content-Encoding: gzip
Vary: Accept-Encoding
Last-Modified: Wed, 20 Jan 2021 23:43:44 GMT
Server: AmazonS3
X-Amz-Cf-Pop: AMS1-C1
ETag: W/"8e8b9a4c76502772642c6b71686fdf83"
Transfer-Encoding: chunked
X-Cache: Hit from cloudfront
Content-Type: text/css
Via: 1.1 6d424430e2badcd8859fea1f1185697a.cloudfront.net (CloudFront)
Date: Thu, 21 Jan 2021 17:33:17 GMT
Connection: keep-alive
X-Amz-Cf-Id: jw3MZIemVox1XBiXLC8_7pztbejcXEDf3xfG5C-VDH-Gi-svnzScoA==

GET
H/1.1 200
OK Cookie set ca.html
20766699p.rfihub.com/ Frame B8FC 0
0 179ms
44ms Document
text/html 193.0.160.129
ROCKETFUEL

General

Check archive.org

Show headers Download Go to

Full URL: https://20766699p.rfihub.com/ca.html?rfiidc=1870471591774814639&rfiaid=aa45adb1a2b249378e3c365b7010c65d&ver=9&ra=246&rb=648&ca=20766699&_o=17169175&_t=purchgetpreapprovedpurchrequestcallbackform&ssv_cuuid=&ssv_package=null&ssv_prodlist=null&ssv_pagename=purchgetpreapprovedpurchrequestcallbackform&pe=https%3A%2F%2Fonline.citi.com%2FUS%2FJRS%2Fportal%2Ftemplate_lo.do%3FID%3Dsurestart_preapproval%26client_type%3DLO%26client_id%3D1024024&pf=&ra=8810443171021525
Requested by: Host: c1.rfihub.net
URL: https://c1.rfihub.net/js/tc.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_256_CBC
Server: 193.0.160.129 , Netherlands, ASN54312 (ROCKETFUEL, US),
Reverse DNS
Software: Jetty(9.0.6.v20130930) /
Resource Hash

Request headers

Host: 20766699p.rfihub.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=surestart_preapproval&client_type=LO&client_id=1024024
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Cookie: ruds=H4sIAAAAAAAAAOMSNrQwNzAxNzS1NDQ3N7EwNDEzthTiM9QNdsx2N_Moj7coNy8FAE6QWAIlAAAA; rud=H4sIAAAAAAAAAOMSNrQwNzAxNzS1NDQ3N7EwNDEzthTiM9QNdsx2N_Moj7coNy-V4jU0MzQ0MjUwtgQqMQEAhftyQjQAAAA
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=surestart_preapproval&client_type=LO&client_id=1024024

Response headers

P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Set-Cookie: ruds=H4sIAAAAAAAAAOMSNrQwNzAxNzS1NDQ3N7EwNDEzthTiM9QNdsx2N_Moj7coNy8FAE6QWAIlAAAA; Path=/; Domain=.rfihub.com; Secure; SameSite=None rud=H4sIAAAAAAAAAOMSNrQwNzAxNzS1NDQ3N7EwNDEzthTiM9QNdsx2N_Moj7coNy-V4jU0MzQ0MjUwtgQqMQEAhftyQjQAAAA; Path=/; Domain=.rfihub.com; Expires=Tue, 15 Feb 2022 17:33:17 GMT; Secure; SameSite=None
Cache-Control: no-cache
Content-Type: text/html
Content-Encoding: gzip
Vary: Accept-Encoding, User-Agent
Transfer-Encoding: chunked
Server: Jetty(9.0.6.v20130930)

GET
H2 200 embed.js Show response
resources.digital-cloud-citi.medallia.com/wdcusciti/50/onsite/ 2 KB
1 KB 119ms
32ms Script
application/javascript 151.101.14.133
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://resources.digital-cloud-citi.medallia.com/wdcusciti/50/onsite/embed.js
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/code/fdf45a7c15c1cee06bb71e10dac4e26e.js?conditionId0=4849963
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.14.133 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 9e413d8a6e3fd51a289a6b73fc880120fb72e7be4f2d935577f39e53ac478642

Request headers

Referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=surestart_preapproval&client_type=LO&client_id=1024024
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-amz-version-id: TyZkSjhXC24iwIM_tQFePIVGoaM6in3c
content-encoding: gzip
etag: "5df0f07fa8cf7fcfc9fa90bd8d706544"
age: 66
via: 1.1 varnish
x-cache: HIT
content-length: 674
x-amz-id-2: a81H6fpzbYuKsPsM51KSUNzazoyGppJ8NFO4U027DuhYPTXfqrBkupE0Jyd1usZREUkj914fAFU=
x-served-by: cache-fra19123-FRA
last-modified: Tue, 15 Dec 2020 17:51:52 GMT
server: AmazonS3
x-timer: S1611250399.763567,VS0,VE2
date: Thu, 21 Jan 2021 17:33:18 GMT
vary: Accept-Encoding
x-amz-request-id: B3319B0EE4AA3E9D
access-control-allow-origin: *
cache-control: max-age=0,must-revalidate
accept-ranges: bytes
content-type: application/javascript
x-cache-hits: 1

GET
H2 451 425466.html
sr.rlcdn.com/ Frame 2B82 0
0 263ms
168ms Document
text/plain 35.244.245.222
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://sr.rlcdn.com/425466.html?es=80676&u=da39a3ee5e6b4b0d3255bfef95601890afd80709
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/code/1aba933a3ecc5ef8fad27fd096354b67.js?conditionId0=467299
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.245.222 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash

Request headers

:method: GET
:authority: sr.rlcdn.com
:scheme: https
:path: /425466.html?es=80676&u=da39a3ee5e6b4b0d3255bfef95601890afd80709
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=surestart_preapproval&client_type=LO&client_id=1024024
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=surestart_preapproval&client_type=LO&client_id=1024024

Response headers

date: Thu, 21 Jan 2021 17:33:18 GMT
content-length: 0
via: 1.1 google
alt-svc: clear

GET
H/1.1 200
OK up_loader.1.1.0.js Show response
js.adsrvr.org/ 4 KB
2 KB 104ms
33ms Script
application/x-javascript 65.9.78.118
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://js.adsrvr.org/up_loader.1.1.0.js
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 65.9.78.118 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: ee3a7301fe1e0c0f6bf6acff0d7a8d107f5cb3f62a2566740c0416d8e61f00b9

Request headers

Referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=surestart_preapproval&client_type=LO&client_id=1024024
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Thu, 21 Jan 2021 14:55:37 GMT
Content-Encoding: gzip
Last-Modified: Thu, 24 Sep 2020 15:15:34 GMT
Server: AmazonS3
Age: 9462
ETag: W/"98d98b3499058b76d58073cf8ede2f10"
Vary: Accept-Encoding
X-Cache: Hit from cloudfront
Content-Type: application/x-javascript
Via: 1.1 e10153740ff95eb4d0c9f3172baeb43e.cloudfront.net (CloudFront)
Connection: keep-alive
Transfer-Encoding: chunked
X-Amz-Cf-Pop: AMS1-C1
X-Amz-Cf-Id: mRBAe1tD7ztluSqc9AbOruSaEKJEKOOGGH6PqmiJcp8e3vDLy5pV3g==

GET
H2 403 1560.js
cdn.pbbl.co/r/ 0
0 132ms
33ms Script
text/html 143.204.215.103
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.pbbl.co/r/1560.js
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/code/8637af7c210f4e79436bc39f71b49bfa.js?conditionId0=4827153
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 143.204.215.103 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-143-204-215-103.fra53.r.cloudfront.net
Software: /
Resource Hash

Request headers

Referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=surestart_preapproval&client_type=LO&client_id=1024024
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

GET
H3-Q050 200 js Show response
www.googletagmanager.com/gtag/ 98 KB
39 KB 21ms
21ms Script
application/javascript 2a00:1450:4001:802::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-916451471

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:802::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

d31a50cf17b234acf39fabd6826ffe5dfd8f38263017dd1901845e02b44def21

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=surestart_preapproval&client_type=LO&client_id=1024024
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 21 Jan 2021 17:33:18 GMT
content-encoding: br
vary: Accept-Encoding
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 39584
x-xss-protection: 0
last-modified: Thu, 21 Jan 2021 15:00:00 GMT
server: Google Tag Manager
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Thu, 21 Jan 2021 17:33:18 GMT

POST
H2 200 s97394707724143 Show response
metrics1.citi.com/b/ss/citiuscombprod/1/JS-2.9.0/ 43 B
465 B 129ms
43ms XHR
image/gif 15.237.136.106
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://metrics1.citi.com/b/ss/citiuscombprod/1/JS-2.9.0/s97394707724143

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/code/4b895b43d9c1209af6f5e71e9b42936b.js?conditionId0=3013337

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

15.237.136.106 Paris, France, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-15-237-136-106.eu-west-3.compute.amazonaws.com

Software

jag /

Resource Hash

55c9d2f019f9d7ddfd69b2ad0351c5617338a222362aebb02b3b98a4dbc18486

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=surestart_preapproval&client_type=LO&client_id=1024024
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

date: Thu, 21 Jan 2021 17:33:18 GMT
x-content-type-options: nosniff
x-c: main-1414.Id04486.M0-474
p3p: CP="This is not a P3P policy"
vary: *
content-length: 43
x-xss-protection: 1; mode=block
pragma: no-cache
last-modified: Fri, 22 Jan 2021 17:33:18 GMT
server: jag
xserver: anedge-75ffb878dc-pqd5z
etag: 3460133884100083712-4621622664090214064
strict-transport-security: max-age=31536000; includeSubDomains
content-type: image/gif;charset=utf-8
access-control-allow-origin: https://online.citi.com
cache-control: no-cache, no-store, max-age=0, no-transform, private
access-control-allow-credentials: true
expires: Wed, 20 Jan 2021 17:33:18 GMT

GET
H2

200

362358.gif
idsync.rlcdn.com/
Redirect Chain

https://20822230p.rfihub.com/ca.html?rb=648&ca=20822230&ra=279935670&_o=17169175&_t=zx-cookie-match
https://live.rezync.com/pixel?c=bd8618c307ae9885a12561b7191e2cea&cid=1870471591774814639
https://p.rfihub.com/cm?pub=39342&in=0&userid=41e704e9-77ef-477a-9194-e470f6299f7c%3A1611250399.24&forward=https%3A//idsync.rlcdn.com/501709.gif%3Fpartner_uid%3D41e704e9-77ef-477a-9194-e470f6299f7c...
https://idsync.rlcdn.com/501709.gif?partner_uid=41e704e9-77ef-477a-9194-e470f6299f7c%3A1611250399.24
https://idsync.rlcdn.com/1000.gif?memo=CM3PHhI8CjgIARAFGjI0MWU3MDRlOS03N2VmLTQ3N2EtOTE5NC1lNDcwZjYyOTlmN2M6MTYxMTI1MDM5OS4yNBAAGg0I3_WmgAYSBQjoBxAAQgBKAA
https://cm.g.doubleclick.net/pixel?google_nid=epsilon&google_cm
https://cm.g.doubleclick.net/pixel?google_nid=epsilon&google_cm=&google_tc=
https://idsync.rlcdn.com/362358.gif?google_gid=CAESEFIdqCwAw-rnD4wrmG-VF0A&google_cver=1

42 B
317 B

62ms
62ms

Image
image/gif

34.120.207.148
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://idsync.rlcdn.com/362358.gif?google_gid=CAESEFIdqCwAw-rnD4wrmG-VF0A&google_cver=1
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.120.207.148 , United States, ASN15169 (GOOGLE, US),
Reverse DNS: 148.207.120.34.bc.googleusercontent.com
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=surestart_preapproval&client_type=LO&client_id=1024024
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

timing-allow-origin: *
date: Thu, 21 Jan 2021 17:33:19 GMT
via: 1.1 google
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
cache-control: no-cache, no-store
content-type: image/gif
alt-svc: clear
content-length: 42

Redirect headers

pragma: no-cache
date: Thu, 21 Jan 2021 17:33:19 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://idsync.rlcdn.com/362358.gif?google_gid=CAESEFIdqCwAw-rnD4wrmG-VF0A&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 289
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK cls_report Show response
prod.report.nacustomerexperience.citi.com/glassbox/reporting/ 0
660 B 950ms
155ms XHR
text/plain 192.193.179.248
CITIGROUP

General

Check archive.org

Show headers Download Go to

Full URL

https://prod.report.nacustomerexperience.citi.com/glassbox/reporting/cls_report?_cls_s=ce3496ce-32d7-4c29-af32-8e16b63951e9%3A0&_cls_v=7f5d7fe5-b399-420d-9d4e-c1bd8b41c89f

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/code/4b895b43d9c1209af6f5e71e9b42936b.js?conditionId0=3013337

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

192.193.179.248 , United States, ASN25883 (CITIGROUP, US),

Reverse DNS

Software

GlassBox Cligate /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubdomains;
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=surestart_preapproval&client_type=LO&client_id=1024024
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Thu, 21 Jan 2021 17:33:19 GMT
Strict-Transport-Security: max-age=63072000; includeSubdomains;
vary: origin
Server: GlassBox Cligate
X-Akamai-CITISITE: GTDC
X-Frame-Options: SAMEORIGIN
Content-Type: text/plain; charset=utf-8
access-control-allow-origin: https://online.citi.com
access-control-allow-credentials: true
Connection: close
Content-Length: 0

GET
H/1.1 200
OK 63068
stags.bluekai.com/site/ Frame 612A 0
0 248ms
177ms Document
text/html 104.108.41.56
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://stags.bluekai.com/site/63068?ret=html&phint=language&phint=product&phint=event&phint=category&phint=page&phint=section1&phint=section2&phint=section3&phint=section4&phint=bankappstatus&phint=productID&phint=__bk_t%3DSurestart%C2%AE%20Mortgage%20Pre-approval%20-%20Citi.com&phint=__bk_k%3D&phint=__bk_l%3Dhttps%3A%2F%2Fonline.citi.com%2FUS%2FJRS%2Fportal%2Ftemplate_lo.do%3FID%3Dsurestart_preapproval%26client_type%3DLO%26client_id%3D1024024&phint=__bk_v%3D3.1.8&limit=10&r=25475429
Requested by: Host: tags.bkrtx.com
URL: https://tags.bkrtx.com/js/bk-coretag.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 104.108.41.56 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-108-41-56.deploy.static.akamaitechnologies.com
Software: /
Resource Hash

Request headers

Host: stags.bluekai.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=surestart_preapproval&client_type=LO&client_id=1024024
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Cookie: bkdc=phx; bkpa=KJpEnXTLu5Dl1Mut+newEnWN6nP116T0u66N66Nm1MqDBEWpB2VN1nK66nV6Eea/1ERhBW81uQD9CL6msy==; bku=kk199B0bYVentE9f
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=surestart_preapproval&client_type=LO&client_id=1024024

Response headers

Content-Type: text/html
Content-Length: 71
P3P: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV", policyref="http://tags.bluekai.com/w3c/p3p.xml"
BK-Server: 82c4
Date: Thu, 21 Jan 2021 17:33:18 GMT
Connection: keep-alive
X-N: S

GET /
track/s/ 0
0

GET
H3-Q050 200 js Show response
www.googletagmanager.com/gtag/ 98 KB
39 KB 20ms
20ms Script
application/javascript 2a00:1450:4001:802::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-916451471&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=DC-6260004

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:802::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

cd801a27b2df0682defacdca8a36165d74f9ea3f3800d944a55227cc51b53968

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=surestart_preapproval&client_type=LO&client_id=1024024
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 21 Jan 2021 17:33:18 GMT
content-encoding: br
vary: Accept-Encoding
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 39519
x-xss-protection: 0
last-modified: Thu, 21 Jan 2021 15:00:00 GMT
server: Google Tag Manager
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Thu, 21 Jan 2021 17:33:18 GMT

GET
H2 200 conversion_async.js Show response
www.googleadservices.com/pagead/ 30 KB
13 KB 180ms
83ms Script
text/javascript 172.217.22.2
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googleadservices.com/pagead/conversion_async.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-916451471

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.22.2 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s14-in-f2.1e100.net

Software

cafe /

Resource Hash

6f028cf1a64a634dcc135c46244706b685cfb2b8ace97a76b7640014818f3846

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=surestart_preapproval&client_type=LO&client_id=1024024
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 21 Jan 2021 17:33:18 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 12166
x-xss-protection: 0
server: cafe
etag: 11146625265121783887
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600
timing-allow-origin: *
expires: Thu, 21 Jan 2021 17:33:18 GMT

GET
H3-Q050 200 js Show response
www.googletagmanager.com/gtag/ 98 KB
39 KB 15ms
15ms Script
application/javascript 2a00:1450:4001:802::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-960621875&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=DC-6260004

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:802::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

a6177507e6277bba4faeff81596dea32ddaf084507444d684e7365f70f0987c6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=surestart_preapproval&client_type=LO&client_id=1024024
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 21 Jan 2021 17:33:18 GMT
content-encoding: br
vary: Accept-Encoding
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 39519
x-xss-protection: 0
last-modified: Thu, 21 Jan 2021 15:00:00 GMT
server: Google Tag Manager
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Thu, 21 Jan 2021 17:33:18 GMT

GET
H3-Q050 200 js Show response
www.googletagmanager.com/gtag/ 98 KB
39 KB 21ms
21ms Script
application/javascript 2a00:1450:4001:802::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-644574043&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=DC-6260004

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:802::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

326f41c7305c8a7911049505b1d2e385d8b87f190774466a42f084dbd3982aba

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=surestart_preapproval&client_type=LO&client_id=1024024
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 21 Jan 2021 17:33:18 GMT
content-encoding: br
vary: Accept-Encoding
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 39519
x-xss-protection: 0
last-modified: Thu, 21 Jan 2021 15:00:00 GMT
server: Google Tag Manager
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Thu, 21 Jan 2021 17:33:18 GMT

GET
H3-Q050 200 js Show response
www.googletagmanager.com/gtag/ 98 KB
39 KB 15ms
15ms Script
application/javascript 2a00:1450:4001:802::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-830907969&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=DC-6260004

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:802::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

7835a80064e872d67e257fd52d5918d1dca3377f2ef07bf42e3febd8206cec7b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=surestart_preapproval&client_type=LO&client_id=1024024
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 21 Jan 2021 17:33:18 GMT
content-encoding: br
vary: Accept-Encoding
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 39519
x-xss-protection: 0
last-modified: Thu, 21 Jan 2021 15:00:00 GMT
server: Google Tag Manager
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Thu, 21 Jan 2021 17:33:18 GMT

GET
H2 200 up
insight.adsrvr.org/track/ Frame 1004 0
0 163ms
57ms Document
text/html 34.251.61.210
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://insight.adsrvr.org/track/up?adv=1jw5cvl&ref=https%3A%2F%2Fonline.citi.com%2FUS%2FJRS%2Fportal%2Ftemplate_lo.do%3FID%3Dsurestart_preapproval%26client_type%3DLO%26client_id%3D1024024&upid=t1sl5ty&upv=1.1.0&orderid={orderid}&v={v}&vf={vf}&td1=undefined&td2=undefined&td3=undefined&td4=undefined&td5=https://online.citi.com/US/JRS/portal/template_lo.do?ID=surestart_preapproval&client_type=LO&client_id=1024024&td6={td6}&td7={td7}&td8={td8}&td9={td9}&td10={td10}
Requested by: Host: js.adsrvr.org
URL: https://js.adsrvr.org/up_loader.1.1.0.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.251.61.210 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-34-251-61-210.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash

Request headers

:method: GET
:authority: insight.adsrvr.org
:scheme: https
:path: /track/up?adv=1jw5cvl&ref=https%3A%2F%2Fonline.citi.com%2FUS%2FJRS%2Fportal%2Ftemplate_lo.do%3FID%3Dsurestart_preapproval%26client_type%3DLO%26client_id%3D1024024&upid=t1sl5ty&upv=1.1.0&orderid={orderid}&v={v}&vf={vf}&td1=undefined&td2=undefined&td3=undefined&td4=undefined&td5=https://online.citi.com/US/JRS/portal/template_lo.do?ID=surestart_preapproval&client_type=LO&client_id=1024024&td6={td6}&td7={td7}&td8={td8}&td9={td9}&td10={td10}
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=surestart_preapproval&client_type=LO&client_id=1024024
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=surestart_preapproval&client_type=LO&client_id=1024024

Response headers

date: Thu, 21 Jan 2021 17:33:18 GMT
content-type: text/html
cache-control: private,no-cache, must-revalidate
pragma: no-cache
x-aspnet-version: 4.0.30319
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"

GET
H2 200 generic1608054710811.js Show response
resources.digital-cloud-citi.medallia.com/wdcusciti/50/onsite/ 333 KB
62 KB 35ms
35ms Script
application/javascript 151.101.14.133
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://resources.digital-cloud-citi.medallia.com/wdcusciti/50/onsite/generic1608054710811.js
Requested by: Host: resources.digital-cloud-citi.medallia.com
URL: https://resources.digital-cloud-citi.medallia.com/wdcusciti/50/onsite/embed.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.14.133 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 78af61897fafb5a82b787273472a93de723186b17f46ed315617c70ae2b6a6fe

Request headers

Referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=surestart_preapproval&client_type=LO&client_id=1024024
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-amz-version-id: Kqi2p6FS.A2AzLCJok5fsBD_5A7fWxpm
content-encoding: gzip
etag: "57e6c47a533050c63dc8fefbdeb401d1"
age: 65
via: 1.1 varnish
x-cache: HIT
content-length: 63129
x-amz-id-2: LJJYW+4FdLKyUfwVKjEsWu0LoqTv0bkCwzz4Qg/MCEBzNOH8N+JX+dKTUdoFpmqkDS4ZVqI/CEU=
x-served-by: cache-fra19123-FRA
last-modified: Tue, 15 Dec 2020 17:51:52 GMT
server: AmazonS3
x-timer: S1611250399.800100,VS0,VE1
date: Thu, 21 Jan 2021 17:33:18 GMT
vary: Accept-Encoding
x-amz-request-id: F7EBF0CB81C71450
access-control-allow-origin: *
cache-control: max-age=0,must-revalidate
accept-ranges: bytes
content-type: application/javascript
x-cache-hits: 1

GET
H2 200 cool-2.1.15.min.js Show response
nebula-cdn.kampyle.com/resources/onsite/js/ 14 KB
6 KB 108ms
38ms Script
application/javascript 151.101.13.175
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://nebula-cdn.kampyle.com/resources/onsite/js/cool-2.1.15.min.js
Requested by: Host: resources.digital-cloud-citi.medallia.com
URL: https://resources.digital-cloud-citi.medallia.com/wdcusciti/50/onsite/generic1608054710811.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.13.175 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 3e72de5de67d6d80b65a114af684eaf880c53c250155a663cb17d677ff064bc1

Request headers

Referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=surestart_preapproval&client_type=LO&client_id=1024024
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-amz-version-id: accShNYyBkP1LVhZ029kQZPb0dZZq1dS
content-encoding: gzip
etag: "80dd5e3be5152c5c72d552c6a26ef6ff"
age: 0
via: 1.1 varnish, 1.1 varnish
x-cache: HIT, HIT
x-amz-request-id: 44E89CAECEBC7179
x-amz-id-2: 4OWxN1dQhN6x+07WW+w0f8US1mPHZnIJFWgzubUNJ9N0RSlvCan+Pm1ucn6oGCopOYCl4sHzAuw=
x-served-by: cache-dca17723-DCA, cache-fra19179-FRA
accept-ranges: bytes
last-modified: Sun, 13 Dec 2020 12:02:41 GMT
server: AmazonS3
x-timer: S1611250399.954082,VS0,VE0
date: Thu, 21 Jan 2021 17:33:18 GMT
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=31536000
content-length: 5197
x-cache-hits: 18, 640657

GET
H2 200 1592741950571_CTA_Feedback(final).png
resources.digital-cloud-citi.medallia.com/wdcusciti/50/resources/image/ 2 KB
2 KB 34ms
34ms Image
image/png 151.101.14.133
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://resources.digital-cloud-citi.medallia.com/wdcusciti/50/resources/image/1592741950571_CTA_Feedback(final).png
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.14.133 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 25f4eeb23f67fe1d74534ed37230ecd54ab4f57524276970dcbeaaf3b0fc64f9

Request headers

Referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=surestart_preapproval&client_type=LO&client_id=1024024
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-amz-version-id: Yu5KFpG13jOL6lsHUOzbaMYLsyQXTr7u
content-encoding: gzip
etag: "e6ed675f115fb1568bb1aabc00aa3f30"
age: 63
via: 1.1 varnish
x-cache: HIT
content-length: 2219
x-amz-id-2: XegtbcL18mqRbX3V0B6zkqIZ3I4DETowDyKeqlPALqLBp1S2W2MLH+bMaSNSo+KKwYXRrC8Z2Y8=
x-served-by: cache-fra19123-FRA
last-modified: Sun, 21 Jun 2020 12:19:35 GMT
server: AmazonS3
x-timer: S1611250399.901232,VS0,VE1
date: Thu, 21 Jan 2021 17:33:18 GMT
vary: Accept-Encoding
x-amz-request-id: DC5FCC011FDF2458
access-control-allow-origin: *
cache-control: max-age=0,must-revalidate
accept-ranges: bytes
content-type: image/png
x-cache-hits: 1

GET
H3-Q050 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/916451471/ 2 KB
1 KB 274ms
273ms Script
text/javascript 2a00:1450:4001:801::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/916451471/?random=1611250398911&cv=9&fst=1611250398911&num=1&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa1d0&sendb=1&ig=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fonline.citi.com%2FUS%2FJRS%2Fportal%2Ftemplate_lo.do%3FID%3Dsurestart_preapproval%26client_type%3DLO%26client_id%3D1024024&tiba=Surestart%C2%AE%20Mortgage%20Pre-approval%20-%20Citi.com&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4

Requested by

Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/conversion_async.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

59ef0e92f579389a5592beac68c4b9fc27204dab490d348d068768f61a170554

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=surestart_preapproval&client_type=LO&client_id=1024024
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 21 Jan 2021 17:33:18 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 1101
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-Q050 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/916451471/ 2 KB
1 KB 51ms
51ms Script
text/javascript 2a00:1450:4001:801::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/916451471/?random=1611250398915&cv=9&fst=1611250398915&num=1&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa1d0&sendb=1&ig=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fonline.citi.com%2FUS%2FJRS%2Fportal%2Ftemplate_lo.do%3FID%3Dsurestart_preapproval%26client_type%3DLO%26client_id%3D1024024&tiba=Surestart%C2%AE%20Mortgage%20Pre-approval%20-%20Citi.com&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4

Requested by

Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/conversion_async.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

0c450bd175d77018813affa46a2bea08fd817b88875cd533db69f3584639732e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=surestart_preapproval&client_type=LO&client_id=1024024
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 21 Jan 2021 17:33:18 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 1103
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-Q050 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/960621875/ 2 KB
1 KB 49ms
49ms Script
text/javascript 2a00:1450:4001:801::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/960621875/?random=1611250398917&cv=9&fst=1611250398917&num=1&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa1d0&sendb=1&ig=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fonline.citi.com%2FUS%2FJRS%2Fportal%2Ftemplate_lo.do%3FID%3Dsurestart_preapproval%26client_type%3DLO%26client_id%3D1024024&tiba=Surestart%C2%AE%20Mortgage%20Pre-approval%20-%20Citi.com&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4

Requested by

Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/conversion_async.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

27f7bfbad08fd8ccbacfb5b1b4f38208e2c35832372f981d233eb240f2f03ce9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=surestart_preapproval&client_type=LO&client_id=1024024
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 21 Jan 2021 17:33:18 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 1104
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-Q050 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/644574043/ 2 KB
1 KB 49ms
49ms Script
text/javascript 2a00:1450:4001:801::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/644574043/?random=1611250398918&cv=9&fst=1611250398918&num=1&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa1d0&sendb=1&ig=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fonline.citi.com%2FUS%2FJRS%2Fportal%2Ftemplate_lo.do%3FID%3Dsurestart_preapproval%26client_type%3DLO%26client_id%3D1024024&tiba=Surestart%C2%AE%20Mortgage%20Pre-approval%20-%20Citi.com&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4

Requested by

Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/conversion_async.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3e385f9f9bc22340f6ae4ec99763206149638f367569389e3ba6feeaaf242f7f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=surestart_preapproval&client_type=LO&client_id=1024024
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 21 Jan 2021 17:33:18 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 1104
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-Q050 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/830907969/ 2 KB
1 KB 132ms
132ms Script
text/javascript 2a00:1450:4001:801::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/830907969/?random=1611250398919&cv=9&fst=1611250398919&num=1&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa1d0&sendb=1&ig=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fonline.citi.com%2FUS%2FJRS%2Fportal%2Ftemplate_lo.do%3FID%3Dsurestart_preapproval%26client_type%3DLO%26client_id%3D1024024&tiba=Surestart%C2%AE%20Mortgage%20Pre-approval%20-%20Citi.com&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4

Requested by

Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/conversion_async.js

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

26bd08ed2cd872e2aaa0db2ec168b1f8d74c1c8f8aceb0640b12463cd7d69bf8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=surestart_preapproval&client_type=LO&client_id=1024024
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 21 Jan 2021 17:33:18 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 1104
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-Q050 200 /
www.google.com/pagead/1p-user-list/960621875/ 42 B
66 B 66ms
65ms Image
image/gif 2a00:1450:4001:801::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/960621875/?random=1611250398917&cv=9&fst=1611248400000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa1d0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fonline.citi.com%2FUS%2FJRS%2Fportal%2Ftemplate_lo.do%3FID%3Dsurestart_preapproval%26client_type%3DLO%26client_id%3D1024024&tiba=Surestart%C2%AE%20Mortgage%20Pre-approval%20-%20Citi.com&async=1&fmt=3&is_vtc=1&random=1549686702&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=surestart_preapproval&client_type=LO&client_id=1024024
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 21 Jan 2021 17:33:19 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.de/pagead/1p-user-list/960621875/ 42 B
552 B 43ms
21ms Image
image/gif 2a00:1450:4001:817::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/960621875/?random=1611250398917&cv=9&fst=1611248400000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa1d0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fonline.citi.com%2FUS%2FJRS%2Fportal%2Ftemplate_lo.do%3FID%3Dsurestart_preapproval%26client_type%3DLO%26client_id%3D1024024&tiba=Surestart%C2%AE%20Mortgage%20Pre-approval%20-%20Citi.com&async=1&fmt=3&is_vtc=1&random=1549686702&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:817::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=surestart_preapproval&client_type=LO&client_id=1024024
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 21 Jan 2021 17:33:19 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-Q050 200 /
www.google.com/pagead/1p-user-list/916451471/ 42 B
66 B 66ms
65ms Image
image/gif 2a00:1450:4001:801::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/916451471/?random=1611250398915&cv=9&fst=1611248400000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa1d0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fonline.citi.com%2FUS%2FJRS%2Fportal%2Ftemplate_lo.do%3FID%3Dsurestart_preapproval%26client_type%3DLO%26client_id%3D1024024&tiba=Surestart%C2%AE%20Mortgage%20Pre-approval%20-%20Citi.com&async=1&fmt=3&is_vtc=1&random=144616067&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=surestart_preapproval&client_type=LO&client_id=1024024
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 21 Jan 2021 17:33:19 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.de/pagead/1p-user-list/916451471/ 42 B
108 B 52ms
31ms Image
image/gif 2a00:1450:4001:817::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/916451471/?random=1611250398915&cv=9&fst=1611248400000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa1d0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fonline.citi.com%2FUS%2FJRS%2Fportal%2Ftemplate_lo.do%3FID%3Dsurestart_preapproval%26client_type%3DLO%26client_id%3D1024024&tiba=Surestart%C2%AE%20Mortgage%20Pre-approval%20-%20Citi.com&async=1&fmt=3&is_vtc=1&random=144616067&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:817::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=surestart_preapproval&client_type=LO&client_id=1024024
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 21 Jan 2021 17:33:19 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-Q050 200 /
www.google.com/pagead/1p-user-list/644574043/ 42 B
321 B 61ms
60ms Image
image/gif 2a00:1450:4001:801::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/644574043/?random=1611250398918&cv=9&fst=1611248400000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa1d0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fonline.citi.com%2FUS%2FJRS%2Fportal%2Ftemplate_lo.do%3FID%3Dsurestart_preapproval%26client_type%3DLO%26client_id%3D1024024&tiba=Surestart%C2%AE%20Mortgage%20Pre-approval%20-%20Citi.com&async=1&fmt=3&is_vtc=1&random=480698919&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=surestart_preapproval&client_type=LO&client_id=1024024
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 21 Jan 2021 17:33:19 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.de/pagead/1p-user-list/644574043/ 42 B
108 B 41ms
21ms Image
image/gif 2a00:1450:4001:817::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/644574043/?random=1611250398918&cv=9&fst=1611248400000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa1d0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fonline.citi.com%2FUS%2FJRS%2Fportal%2Ftemplate_lo.do%3FID%3Dsurestart_preapproval%26client_type%3DLO%26client_id%3D1024024&tiba=Surestart%C2%AE%20Mortgage%20Pre-approval%20-%20Citi.com&async=1&fmt=3&is_vtc=1&random=480698919&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:817::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=surestart_preapproval&client_type=LO&client_id=1024024
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 21 Jan 2021 17:33:19 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 __cool.gif
udc-neb.kampyle.com/egw/5/qceuv8449dzg58ptt1bhda9g8ue19c7s/track/ 0
318 B 261ms
164ms Image
image/gif 35.241.45.82
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://udc-neb.kampyle.com/egw/5/qceuv8449dzg58ptt1bhda9g8ue19c7s/track/__cool.gif?data=eyJldmVudHMiOiBbCiAgICB7InNlc3Npb25fc2NyZWVuX3NpemUiOiAiMTYwMHgxMjAwIiwic2Vzc2lvbl9kdWEiOiAiTW96aWxsYS81LjAgKE1hY2ludG9zaDsgSW50ZWwgTWFjIE9TIFggMTBfMTRfNSkgQXBwbGVXZWJLaXQvNTM3LjM2IChLSFRNTCwgbGlrZSBHZWNrbykgQ2hyb21lLzgzLjAuNDEwMy42MSBTYWZhcmkvNTM3LjM2Iiwic2Vzc2lvbl9wbGF0Zm9ybSI6ICJMaW51eCB4ODZfNjQiLCJ0cmFja2VyX3R5cGUiOiAiamF2YXNjcmlwdCIsInRyYWNrZXJfdmVyc2lvbiI6ICIyLjEuMTUiLCJldmVudF9uYW1lIjogIm5lYnVsYV9wYWdlX3ZpZXciLCJldmVudF90aW1lc3RhbXBfZXBvY2giOiAiMTYxMTI1MDM5ODk5NSIsImV2ZW50X3RpbWV6b25lX29mZnNldCI6IDEsInVzZXJfaWQiOiAiMTc3MjYwMWY3MTE3M2EtMDczMzdhMTBjM2MzMzctMWIzOTYyNTYtMWQ0YzAwLTE3NzI2MDFmNzEyYTQ2IiwiZW52aXJvbWVudCI6ICJkaWdpdGFsLWNsb3VkLXVzLWNpdGkiLCJhY2NvdW50SWQiOiA0OSwidXJsIjogImh0dHBzOi8vb25saW5lLmNpdGkuY29tL1VTL0pSUy9wb3J0YWwvdGVtcGxhdGVfbG8uZG8/SUQ9c3VyZXN0YXJ0X3ByZWFwcHJvdmFsJmNsaWVudF90eXBlPUxPJmNsaWVudF9pZD0xMDI0MDI0Iiwid2Vic2l0ZUlkIjogNTAsImZlZWRiYWNrX3V1aWQiOiBudWxsLCJmb3JtSWQiOiBudWxsLCJmb3JtVHJpZ2dlclR5cGUiOiBudWxsLCJrYW1weWxlX2RhdGEiOiB7IkxBU1RfSU5WSVRBVElPTl9WSUVXIjogIiIsIkRFQ0xJTkVEX0RBVEUiOiAiIiwia2FtcHlsZUludml0ZVByZXNlbnRlZCI6ICIiLCJrYW1weWxlX3VzZXJpZCI6ICJjNGJiLTMwMmQtMDBlMC1mZWI0LWMxYmUtNmQ4Yy02ZWIzLWJjYjQiLCJrYW1weWxlVXNlclNlc3Npb24iOiAiMTYxMTI1MDM5ODg3NCIsImthbXB5bGVVc2VyUGVyY2VudGlsZSI6ICIiLCJTVUJNSVRURURfREFURSI6ICIifSwiY29va2llX3NpemUiOiAxOTA2LCJrYW1weWxlX3ZlcnNpb24iOiAiMi4zNC4xIiwib25zaXRlX3ZlcnNpb24iOiAiMi4zNC4xIiwiaGlzdG9yeV9sZW5ndGgiOiAyLCJldmVudF9sb2NhbF90aW1lc3RhbXAiOiAxNjExMjUwMzk4ODc3LCJwb3NpdGlvbiI6IG51bGwsImlzVXNlcklkZW50aWZpZWQiOiBmYWxzZX0KXX0=
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.241.45.82 , Ascension Island, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Jetty(9.2.11.v20150529) /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=surestart_preapproval&client_type=LO&client_id=1024024
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-me: prod-instance-gatewayservice-green-v6mn
date: Thu, 21 Jan 2021 17:33:19 GMT
via: 1.1 google
server: Jetty(9.2.11.v20150529)
access-control-allow-headers: X-Requested-With, Origin, Content-Type, Accept
access-control-max-age: 1800
access-control-allow-methods: GET, POST, PUT, DELETE
content-type: image/gif; charset=UTF-8
access-control-allow-origin: *
access-control-allow-credentials: true
alt-svc: clear
content-length: 0
x-application-context: application:9090

GET
H3-Q050 200 /
www.google.com/pagead/1p-user-list/830907969/ 42 B
66 B 62ms
62ms Image
image/gif 2a00:1450:4001:801::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/830907969/?random=1611250398919&cv=9&fst=1611248400000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa1d0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fonline.citi.com%2FUS%2FJRS%2Fportal%2Ftemplate_lo.do%3FID%3Dsurestart_preapproval%26client_type%3DLO%26client_id%3D1024024&tiba=Surestart%C2%AE%20Mortgage%20Pre-approval%20-%20Citi.com&async=1&fmt=3&is_vtc=1&random=2783525066&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=surestart_preapproval&client_type=LO&client_id=1024024
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 21 Jan 2021 17:33:19 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-Q050 200 /
www.google.de/pagead/1p-user-list/830907969/ 42 B
530 B 53ms
38ms Image
image/gif 2a00:1450:4001:817::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/830907969/?random=1611250398919&cv=9&fst=1611248400000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa1d0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fonline.citi.com%2FUS%2FJRS%2Fportal%2Ftemplate_lo.do%3FID%3Dsurestart_preapproval%26client_type%3DLO%26client_id%3D1024024&tiba=Surestart%C2%AE%20Mortgage%20Pre-approval%20-%20Citi.com&async=1&fmt=3&is_vtc=1&random=2783525066&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:817::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=surestart_preapproval&client_type=LO&client_id=1024024
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 21 Jan 2021 17:33:19 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 storage.secure.min.html Show response
lpcdn.chat.online.citi.com/le_secure_storage/3.12.0.0-release_5037/ Frame 81F6 39 KB
16 KB 94ms
32ms Document
text/html 2a03:6400:10:0:178:249:97:98
LIVEPERSON

General

Check archive.org

Show headers Download Go to

Full URL: https://lpcdn.chat.online.citi.com/le_secure_storage/3.12.0.0-release_5037/storage.secure.min.html?loc=https%3A%2F%2Fonline.citi.com&site=50929468&env=prod
Requested by: Host: lptag.liveperson.net
URL: https://lptag.liveperson.net/lptag/api/account/50929468/configuration/applications/taglets/.jsonp?v=2.0&df=0&b=1
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2a03:6400:10:0:178:249:97:98 , United Kingdom, ASN11054 (LIVEPERSON, US),
Reverse DNS
Software: ws /
Resource Hash: 59f4843277d9aca1200c779c52318aadb380021a0051a6644b75274acb7fe158

Request headers

:method: GET
:authority: lpcdn.chat.online.citi.com
:scheme: https
:path: /le_secure_storage/3.12.0.0-release_5037/storage.secure.min.html?loc=https%3A%2F%2Fonline.citi.com&site=50929468&env=prod
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: same-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=surestart_preapproval&client_type=LO&client_id=1024024
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: AKMTLTSID=1EE8E4842DA111766D63CED020371C0F; CITI_SITE=gtdc; check=true; AMCVS_61834D9B5228A7430A490D45%40AdobeOrg=1; _cls_v=7f5d7fe5-b399-420d-9d4e-c1bd8b41c89f; _cls_s=ce3496ce-32d7-4c29-af32-8e16b63951e9:0; _gcl_au=1.1.2038892438.1611250396; s_vi=[CS]v1|3004DD6E1518937A-6000183F9BF79136[CE]; s_ecid=MCMID%7C58070003941454284422855708847003698806; AMCV_61834D9B5228A7430A490D45%40AdobeOrg=-330454231%7CMCIDTS%7C18649%7CMCMID%7C58070003941454284422855708847003698806%7CMCAAMLH-1611855196%7C6%7CMCAAMB-1611855196%7CRKhpRz8krg2tLO6pguXWp5olkAcUniQYPHaMWWgdJ3xzPWQmdj0y%7CMCOPTOUT-1611257595s%7CNONE%7CMCAID%7C3004DD6E1518937A-6000183F9BF79136%7CMCSYNCSOP%7C411-18656%7CvVersion%7C3.1.2; mbox=session#7d17f1210ccc463784723d4c1b80a0a7#1611252257|PC#7d17f1210ccc463784723d4c1b80a0a7.37_0#1674495197; mboxEdgeCluster=37; s_fid=262D8E5D69FA491C-3C828004B48A5FE0; s_cc=true; s_sess=%20s_vstart%3D1611250396693%3B%20SC_LINKS%3D%257CRequestCallback%257CForm%255E%255Eundefined%255E%255E%257CRequestCallback%257CForm%2520%257C%2520undefined%255E%255E%3B; s_pers=%20s_vnum%3D1612134000687%2526vn%253D1%7C1612134000687%3B%20gpv_p7%3D%257CRequestCallback%257CForm%7C1611252196862%3B%20s_visit%3D1%7C1611252196864%3B%20s_invisit%3Dtrue%7C1611252196865%3B%20s_nr%3D1611250396867-New%7C1768930396867%3B; s_nr=1611250398675-New; gpv_pn=marketing%7Cmortgage%20callback%20surestart%7Clanding; cd_user_id=1772601f71173a-07337a10c3c337-1b396256-1d4c00-1772601f712a46
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=surestart_preapproval&client_type=LO&client_id=1024024

Response headers

date: Thu, 21 Jan 2021 17:33:19 GMT
content-type: text/html
last-modified: Tue, 29 Dec 2020 12:59:22 GMT
content-encoding: gzip
server: ws
vary: Origin
access-control-allow-methods: GET, POST, PATCH
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization, X-HTTP-Method-Override, LP-DOMAIN-REFERER, LP-URL, ETag, ac-revision, X-LP-Last-Modified, If-Match, Authentication-Method, Credit-Card-Ref, Automation-Secret, Email-Token
access-control-expose-headers: X-Requested-With, X-HTTP-Method-Override, LP-DOMAIN-REFERER, LP-URL, ETag, ac-revision, X-LP-Last-Modified, If-Match, Authentication-Method, Credit-Card-Ref, Automation-Secret, Email-Token, x-lp-host, Lp-Req-Time, date, x-application-context, strict-transport-security, x-content-type-options, x-download-options, x-xss-protection, x-cache-status, x-amz-id-2, x-amz-request-id, expires, last-modified, set-cookie, content-security-policy, x-frame-options
access-control-allow-credentials: true
expires: Thu, 21 Jan 2021 17:43:19 GMT
cache-control: max-age=600

GET
H3-Q050 200 /
www.google.com/pagead/1p-user-list/916451471/ 42 B
66 B 64ms
64ms Image
image/gif 2a00:1450:4001:801::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/916451471/?random=1611250398911&cv=9&fst=1611248400000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa1d0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fonline.citi.com%2FUS%2FJRS%2Fportal%2Ftemplate_lo.do%3FID%3Dsurestart_preapproval%26client_type%3DLO%26client_id%3D1024024&tiba=Surestart%C2%AE%20Mortgage%20Pre-approval%20-%20Citi.com&async=1&fmt=3&is_vtc=1&random=2005816026&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:801::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=surestart_preapproval&client_type=LO&client_id=1024024
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 21 Jan 2021 17:33:19 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3-Q050 200 /
www.google.de/pagead/1p-user-list/916451471/ 42 B
66 B 30ms
30ms Image
image/gif 2a00:1450:4001:817::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/916451471/?random=1611250398911&cv=9&fst=1611248400000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=0&u_nmime=0&gtm=2oa1d0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fonline.citi.com%2FUS%2FJRS%2Fportal%2Ftemplate_lo.do%3FID%3Dsurestart_preapproval%26client_type%3DLO%26client_id%3D1024024&tiba=Surestart%C2%AE%20Mortgage%20Pre-approval%20-%20Citi.com&async=1&fmt=3&is_vtc=1&random=2005816026&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:817::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=surestart_preapproval&client_type=LO&client_id=1024024
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 21 Jan 2021 17:33:19 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 50929468 Show response
lp-03.chat.online.citi.com/api/js/ 233 B
1 KB 883ms
347ms Script
application/javascript 208.89.12.87
LIVEPERSON

General

Check archive.org

Show headers Download Go to

Full URL: https://lp-03.chat.online.citi.com/api/js/50929468?&cb=lpCb64202x84340&t=sp&ts=1611250397175&pid=2886897492&tid=5350040055&pt=Surestart%C2%AE%20Mortgage%20Pre-approval%20-%20Citi.com&u=https%3A%2F%2Fonline.citi.com%2FUS%2FJRS%2Fportal%2Ftemplate_lo.do%3FID%3Dsurestart_preapproval%26client_type%3DLO%26client_id%3D1024024&sec=%5B%22Other%22%2C%22jUSCBOL_surestart_preapproval%22%2C%22CBOL_Lending%2FPurch%2FGetPreApproved%7CHUCY%7CPurch%2FForm%2FPurch%7CGetPreApproved%7CPurch%7CRequestCallback%7CForm%22%2Cnull%2C%22%22%2Cnull%5D&df=0&os=1&identities=%5B%7B%22iss%22%3A%22Citi%22%2C%22acr%22%3A%22loa1%22%2C%22sub%22%3A%22livechat%22%7D%2C%7B%22iss%22%3A%22LivePerson%22%2C%22acr%22%3A%220%22%7D%5D
Requested by: Host: lptag.liveperson.net
URL: https://lptag.liveperson.net/lptag/api/account/50929468/configuration/applications/taglets/.jsonp?v=2.0&df=0&b=1
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 208.89.12.87 , United States, ASN11054 (LIVEPERSON, US),
Reverse DNS: va.v.liveperson.net
Software: ws /
Resource Hash: b4d81e297696a333ab9074579aa0b59f61558916bde25f037845d92ba6964596

Request headers

Referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=surestart_preapproval&client_type=LO&client_id=1024024
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 21 Jan 2021 17:33:20 GMT
content-encoding: gzip
server: ws
access-control-allow-methods: GET, POST, PATCH
content-type: application/javascript
access-control-expose-headers: X-Requested-With, X-HTTP-Method-Override, LP-DOMAIN-REFERER, LP-URL, ETag, ac-revision, X-LP-Last-Modified, If-Match, Authentication-Method, Credit-Card-Ref, Automation-Secret, Email-Token, x-lp-host, Lp-Req-Time, date, x-application-context, strict-transport-security, x-content-type-options, x-download-options, x-xss-protection, x-cache-status, x-amz-id-2, x-amz-request-id, expires, last-modified, set-cookie, content-security-policy, x-frame-options
cache-control: no-store
access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization, X-HTTP-Method-Override, LP-DOMAIN-REFERER, LP-URL, ETag, ac-revision, X-LP-Last-Modified, If-Match, Authentication-Method, Credit-Card-Ref, Automation-Secret, Email-Token

GET
H2 200 50929468 Show response
lp-03.chat.online.citi.com/api/js/ 42 B
792 B 135ms
135ms Script
application/javascript 208.89.12.87
LIVEPERSON

General

Check archive.org

Show headers Download Go to

Full URL: https://lp-03.chat.online.citi.com/api/js/50929468?sid=mlnCcoJHQ0mH_idXSN4ucg&cb=lpCb31649x39220&t=uc&ts=1611250397173&pid=2886897492&tid=5350040055&sdes=%5B%7B%22type%22%3A%22ctmrinfo%22%2C%22info%22%3A%7B%22lastPaymentDate%22%3A%7B%7D%2C%22registrationDate%22%3A%7B%7D%2C%22ctype%22%3A%22cbol-blue%22%7D%7D%2C%7B%22type%22%3A%22ctmrinfo%22%2C%22info%22%3A%7B%22lastPaymentDate%22%3A%7B%7D%2C%22registrationDate%22%3A%7B%7D%2C%22ctype%22%3A%22cbol-blue%22%7D%7D%2C%7B%22type%22%3A%22prodView%22%2C%22products%22%3A%7B%22product%22%3A%7B%22name%22%3A%22Surestart%C2%AE%20Mortgage%20Pre-approval%20-%20Citi.com%22%2C%22category%22%3A%22https%3A%2F%2Fonline.citi.com%2FUS%2FJRS%2Fportal%2Ftemplate_lo.do%3FID%3Dsurestart_preapproval%26client_type%3DLO%26client_id%3D1024024%22%2C%22sku%22%3A%22Other%2CjUSCBOL_surestart_preapproval%2CCBOL_Lending%2FPurch%2FGetPreApproved%7CHUCY%7CPurch%2FForm%2FPurch%7CGetPreApproved%7CPurch%7CRequestCallback%7CForm%2C%2C%2C%22%7D%7D%7D%5D&vid=JhMmZlODg1YmQ2MDhmNmQ0
Requested by: Host: lptag.liveperson.net
URL: https://lptag.liveperson.net/lptag/api/account/50929468/configuration/applications/taglets/.jsonp?v=2.0&df=0&b=1
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 208.89.12.87 , United States, ASN11054 (LIVEPERSON, US),
Reverse DNS: va.v.liveperson.net
Software: ws /
Resource Hash: 440e78a9eb145a4c98fe1a25b7830b36a987d606aa5cc8e404df50b4eeba3726

Request headers

Referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=surestart_preapproval&client_type=LO&client_id=1024024
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 21 Jan 2021 17:33:20 GMT
content-encoding: gzip
server: ws
access-control-allow-methods: GET, POST, PATCH
content-type: application/javascript
access-control-expose-headers: X-Requested-With, X-HTTP-Method-Override, LP-DOMAIN-REFERER, LP-URL, ETag, ac-revision, X-LP-Last-Modified, If-Match, Authentication-Method, Credit-Card-Ref, Automation-Secret, Email-Token, x-lp-host, Lp-Req-Time, date, x-application-context, strict-transport-security, x-content-type-options, x-download-options, x-xss-protection, x-cache-status, x-amz-id-2, x-amz-request-id, expires, last-modified, set-cookie, content-security-policy, x-frame-options
cache-control: no-store
access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization, X-HTTP-Method-Override, LP-DOMAIN-REFERER, LP-URL, ETag, ac-revision, X-LP-Last-Modified, If-Match, Authentication-Method, Credit-Card-Ref, Automation-Secret, Email-Token

GET
H2 200 50929468 Show response
lp-03.chat.online.citi.com/api/js/ 110 B
853 B 132ms
131ms Script
application/javascript 208.89.12.87
LIVEPERSON

General

Check archive.org

Show headers Download Go to

Full URL: https://lp-03.chat.online.citi.com/api/js/50929468?sid=mlnCcoJHQ0mH_idXSN4ucg&cb=lpCb47058x51437&t=pl&ts=1611250399316&pid=2886897492&tid=5350040055&vid=JhMmZlODg1YmQ2MDhmNmQ0
Requested by: Host: lptag.liveperson.net
URL: https://lptag.liveperson.net/lptag/api/account/50929468/configuration/applications/taglets/.jsonp?v=2.0&df=0&b=1
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 208.89.12.87 , United States, ASN11054 (LIVEPERSON, US),
Reverse DNS: va.v.liveperson.net
Software: ws /
Resource Hash: 507d070f201e809847fd7fdd042aadf1e38f5d14ad44b3198f20018d78112f24

Request headers

Referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=surestart_preapproval&client_type=LO&client_id=1024024
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 21 Jan 2021 17:33:20 GMT
content-encoding: gzip
server: ws
access-control-allow-methods: GET, POST, PATCH
content-type: application/javascript
access-control-expose-headers: X-Requested-With, X-HTTP-Method-Override, LP-DOMAIN-REFERER, LP-URL, ETag, ac-revision, X-LP-Last-Modified, If-Match, Authentication-Method, Credit-Card-Ref, Automation-Secret, Email-Token, x-lp-host, Lp-Req-Time, date, x-application-context, strict-transport-security, x-content-type-options, x-download-options, x-xss-protection, x-cache-status, x-amz-id-2, x-amz-request-id, expires, last-modified, set-cookie, content-security-policy, x-frame-options
cache-control: no-store
access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization, X-HTTP-Method-Override, LP-DOMAIN-REFERER, LP-URL, ETag, ac-revision, X-LP-Last-Modified, If-Match, Authentication-Method, Credit-Card-Ref, Automation-Secret, Email-Token

POST
H/1.1 200
OK cls_report Show response
prod.report.nacustomerexperience.citi.com/glassbox/reporting/ 20 KB
3 KB 804ms
330ms XHR
application/json 192.193.179.248
CITIGROUP

General

Check archive.org

Show headers Download Go to

Full URL

https://prod.report.nacustomerexperience.citi.com/glassbox/reporting/cls_report?clsjsv=6.3.114B126&_cls_s=ce3496ce-32d7-4c29-af32-8e16b63951e9:0&_cls_v=7f5d7fe5-b399-420d-9d4e-c1bd8b41c89f&pid=457d0a51-c3ee-49d4-be96-419e0b1b9862&sn=1&aid=

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/code/4b895b43d9c1209af6f5e71e9b42936b.js?conditionId0=3013337

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

192.193.179.248 , United States, ASN25883 (CITIGROUP, US),

Reverse DNS

Software

GlassBox Cligate /

Resource Hash

4ffe92333c96470e33c31a61843ed003ce2e50b80d49ffdb926e15160f72aad3

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubdomains;
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=surestart_preapproval&client_type=LO&client_id=1024024
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

Date: Thu, 21 Jan 2021 17:33:29 GMT
content-encoding: gzip
vary: origin
Server: GlassBox Cligate
X-Akamai-CITISITE: GTDC
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=63072000; includeSubdomains;
Content-Type: application/json
access-control-allow-origin: https://online.citi.com
access-control-allow-credentials: true
Connection: close
content-length: 3012

POST
H/1.1 200
OK cls_report Show response
prod.report.nacustomerexperience.citi.com/glassbox/reporting/ 20 KB
3 KB 834ms
358ms XHR
application/json 192.193.179.248
CITIGROUP

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/code/4b895b43d9c1209af6f5e71e9b42936b.js?conditionId0=3013337

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

192.193.179.248 , United States, ASN25883 (CITIGROUP, US),

Reverse DNS

Software

GlassBox Cligate /

Resource Hash

bac13653fd791e602e95efe7eb170b530f8fefd2d07efbcfa46d7393de70a650

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubdomains;
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=surestart_preapproval&client_type=LO&client_id=1024024
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

Date: Thu, 21 Jan 2021 17:33:30 GMT
content-encoding: gzip
vary: origin
Server: GlassBox Cligate
X-Akamai-CITISITE: GTDC
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=63072000; includeSubdomains;
Content-Type: application/json
access-control-allow-origin: https://online.citi.com
access-control-allow-credentials: true
Connection: close
content-length: 3011

GET
H2 200 50929468 Show response
lp-03.chat.online.citi.com/api/js/ 73 B
823 B 239ms
239ms Script
application/javascript 208.89.12.87
LIVEPERSON

General

Check archive.org

Show headers Download Go to

Full URL: https://lp-03.chat.online.citi.com/api/js/50929468?sid=mlnCcoJHQ0mH_idXSN4ucg&cb=lpCb97804x11678&t=ip&ts=1611250410473&pid=2886897492&tid=5350040055&vid=JhMmZlODg1YmQ2MDhmNmQ0
Requested by: Host: lptag.liveperson.net
URL: https://lptag.liveperson.net/lptag/api/account/50929468/configuration/applications/taglets/.jsonp?v=2.0&df=0&b=1
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 208.89.12.87 , United States, ASN11054 (LIVEPERSON, US),
Reverse DNS: va.v.liveperson.net
Software: ws /
Resource Hash: 2171452a830a17d7eefd36a80c9d9072cb343bebb31809af3dc24b1d8b1788e5

Request headers

Referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=surestart_preapproval&client_type=LO&client_id=1024024
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Thu, 21 Jan 2021 17:33:30 GMT
content-encoding: gzip
server: ws
access-control-allow-methods: GET, POST, PATCH
content-type: application/javascript
access-control-expose-headers: X-Requested-With, X-HTTP-Method-Override, LP-DOMAIN-REFERER, LP-URL, ETag, ac-revision, X-LP-Last-Modified, If-Match, Authentication-Method, Credit-Card-Ref, Automation-Secret, Email-Token, x-lp-host, Lp-Req-Time, date, x-application-context, strict-transport-security, x-content-type-options, x-download-options, x-xss-protection, x-cache-status, x-amz-id-2, x-amz-request-id, expires, last-modified, set-cookie, content-security-policy, x-frame-options
cache-control: no-store
access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization, X-HTTP-Method-Override, LP-DOMAIN-REFERER, LP-URL, ETag, ac-revision, X-LP-Last-Modified, If-Match, Authentication-Method, Credit-Card-Ref, Automation-Secret, Email-Token

POST
H/1.1 200
OK cls_report Show response
prod.report.nacustomerexperience.citi.com/glassbox/reporting/ 20 KB
3 KB 662ms
174ms XHR
application/json 192.193.179.248
CITIGROUP

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/code/4b895b43d9c1209af6f5e71e9b42936b.js?conditionId0=3013337

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

192.193.179.248 , United States, ASN25883 (CITIGROUP, US),

Reverse DNS

Software

GlassBox Cligate /

Resource Hash

d844653e4d2e16ba28ba8972082841433babd254eac17ffa28ed394b4c812375

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubdomains;
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://online.citi.com/US/JRS/portal/template_lo.do?ID=surestart_preapproval&client_type=LO&client_id=1024024
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

Date: Thu, 21 Jan 2021 17:33:31 GMT
content-encoding: gzip
vary: origin
Server: GlassBox Cligate
X-Akamai-CITISITE: GTDC
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=63072000; includeSubdomains;
Content-Type: application/json
access-control-allow-origin: https://online.citi.com
access-control-allow-credentials: true
Connection: close
content-length: 3013

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: track
URL: https://track/s/?id=44715&PageID=USCBOL_surestart_preapproval&masterID=undefined&ref=&p=https%3A//online.citi.com/US/JRS/portal/template_lo.do%3FID%3Dsurestart_preapproval%26client_type%3DLO%26client_id%3D1024024&random=452797737

Verdicts & Comments Add Verdict or Comment

1178 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

31 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.rfihub.com/	1970-01-20 00:55:46	Name: rud Value: H4sIAAAAAAAAAOMSNrQwNzAxNzS1NDQ3N7EwNDEzthTiM9QNdsx2N_Moj7coNy-V4jU0MzQ0MjUwtgQqMQEAhftyQjQAAAA
.rfihub.com/	1969-12-31 23:59:59	Name: ruds Value: H4sIAAAAAAAAAOMSNrQwNzAxNzS1NDQ3N7EwNDEzthTiM9QNdsx2N_Moj7coNy8FAE6QWAIlAAAA
.doubleclick.net/	1970-01-20 00:55:46	Name: IDE Value: AHWqTUmMf-FIeiRujlXULmHtr5w_EuDzIGNvXnN7R8XlsEH8Am_4UDepbJgIzY8U
.youtube.com/	1970-01-19 19:53:22	Name: VISITOR_INFO1_LIVE Value: fuoecDGS1Ro
.youtube.com/	1969-12-31 23:59:59	Name: YSC Value: LJ9qM9x-WkE
.demdex.net/	1970-01-19 19:53:22	Name: demdex Value: 64280508413371541693315245438415847381
online.citi.com/	1970-01-20 01:10:10	Name: style Value: null
.citi.com/	1970-01-19 15:34:12	Name: gpv_pn Value: marketing%7Cmortgage%20callback%20surestart%7Clanding
.citi.com/	1969-12-31 23:59:59	Name: s_sess Value: %20s_vstart%3D1611250396693%3B%20SC_LINKS%3D%257CRequestCallback%257CForm%255E%255Eundefined%255E%255E%257CRequestCallback%257CForm%2520%257C%2520undefined%255E%255E%3B
.citi.com/	1970-01-21 11:22:10	Name: _cls_v Value: 7f5d7fe5-b399-420d-9d4e-c1bd8b41c89f
.citi.com/	1970-01-21 11:22:10	Name: s_pers Value: %20s_vnum%3D1612134000687%2526vn%253D1%7C1612134000687%3B%20gpv_p7%3D%257CRequestCallback%257CForm%7C1611252196862%3B%20s_visit%3D1%7C1611252196864%3B%20s_invisit%3Dtrue%7C1611252196865%3B%20s_nr%3D1611250396867-New%7C1768930396867%3B
.citi.com/	1969-12-31 23:59:59	Name: s_cc Value: true
.citi.com/	1969-12-31 23:59:59	Name: AMCVS_61834D9B5228A7430A490D45%40AdobeOrg Value: 1
.citi.com/	1970-01-19 15:34:12	Name: mboxEdgeCluster Value: 37
.citi.com/	1970-01-20 09:08:15	Name: mbox Value: session#7d17f1210ccc463784723d4c1b80a0a7#1611252257\|PC#7d17f1210ccc463784723d4c1b80a0a7.37_0#1674495197
.citi.com/	1970-01-20 09:05:22	Name: AMCV_61834D9B5228A7430A490D45%40AdobeOrg Value: -330454231%7CMCIDTS%7C18649%7CMCMID%7C58070003941454284422855708847003698806%7CMCAAMLH-1611855196%7C6%7CMCAAMB-1611855196%7CRKhpRz8krg2tLO6pguXWp5olkAcUniQYPHaMWWgdJ3xzPWQmdj0y%7CMCOPTOUT-1611257595s%7CNONE%7CMCAID%7C3004DD6E1518937A-6000183F9BF79136%7CMCSYNCSOP%7C411-18656%7CvVersion%7C3.1.2
.citi.com/	1970-01-20 09:05:22	Name: s_ecid Value: MCMID%7C58070003941454284422855708847003698806
.citi.com/	1970-01-20 09:05:22	Name: s_vi Value: [CS]v1\|3004DD6E1518937A-6000183F9BF79136[CE]
.citi.com/	1969-12-31 23:59:59	Name: _cls_s Value: ce3496ce-32d7-4c29-af32-8e16b63951e9:0
.citi.com/	1970-01-19 16:17:22	Name: s_nr Value: 1611250398675-New
.citi.com/	1970-01-21 11:23:36	Name: s_fid Value: 262D8E5D69FA491C-3C828004B48A5FE0
.citi.com/	1970-01-19 17:43:46	Name: _gcl_au Value: 1.1.2038892438.1611250396
.citi.com/	1969-12-31 23:59:59	Name: check Value: true
online.citi.com/	1969-12-31 23:59:59	Name: JSESSIONID Value: 0000iliOc0bpCwC88lVndpqxm9G:gt09p-srv1
online.citi.com/	1970-01-19 17:43:46	Name: 64072 Value:
online.citi.com/	1970-01-19 15:34:12	Name: 7018 Value:
online.citi.com/	1970-01-19 15:34:12	Name: 7830 Value: error
.citi.com/	1969-12-31 23:59:59	Name: CITI_SITE Value: gtdc
.citi.com/	1969-12-31 23:59:59	Name: AKMTLTSID Value: 1EE8E4842DA111766D63CED020371C0F
online.citi.com/	1969-12-31 23:59:59	Name: client_type Value: LO
online.citi.com/	1969-12-31 23:59:59	Name: client_id Value: 1024024

23 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
console-api	log	URL: https://online.citi.com/CBOL/taggingTransformation/tagging.js(Line 300) Message: Started tagging.js core
console-api	log	URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js(Line 150) Message: Loading at.js
console-api	log	URL: https://online.citi.com/JFP/js/common/jquery.combined.ddl.js(Line 80) Message: JQMIGRATE: Logging is active
console-api	warning	URL: https://online.citi.com/JFP/js/common/jquery.combined.ddl.js(Line 80) Message: JQMIGRATE: jQuery.browser is deprecated
console-api	log	URL: https://online.citi.com/JFP/js/common/jquery.combined.ddl.js(Line 80) Message: console.trace
console-api	log	URL: https://online.citi.com/CBOL/taggingTransformation/tagging.js(Line 1454) Message: key external campaign tracking code is not available
console-api	log	URL: https://online.citi.com/CBOL/taggingTransformation/tagging.js(Line 1469) Message: key internal campaign tracking code is not available
console-api	log	URL: https://nexus.ensighten.com/citi/na_prod/code/4b895b43d9c1209af6f5e71e9b42936b.js?conditionId0=3013337(Line 635) Message: [object HTMLDivElement]
console-api	log	URL: https://online.citi.com/JRS/CHIP/js/chip.min.js(Line 4) Message: Purch\|GetPreApproved
console-api	log	URL: https://online.citi.com/JRS/CHIP/js/loan-officer.js(Line 71) Message: Save LO ID [object Object]
console-api	log	URL: https://online.citi.com/JRS/CHIP/js/loan-officer.js(Line 389) Message: LO_data exists.
console-api	log	URL: https://online.citi.com/CBOL/taggingTransformation/tagging.js(Line 787) Message: Load data...[object Object]
console-api	log	URL: https://online.citi.com/CBOL/taggingTransformation/tagging.js(Line 790) Message: [object Object]
console-api	log	URL: https://online.citi.com/JRS/CHIP/js/request-call-back.js(Line 1991) Message: type: LO
console-api	log	URL: https://online.citi.com/JEA/CitiSearch/nexus-platform/js/citilive-search.js(Line 1) Message: >>>>>>>>>>>>>Smart Search init>>>>>>>>>>>>>>>>>>>>>> pageId: jUSCBOL_surestart_preapproval userRole: VISITOR isLoggedIn: false language: en_US_USGCB
console-api	log	URL: https://lptag.liveperson.net/lptag/api/account/50929468/configuration/applications/taglets/.jsonp?v=2.0&df=0&b=1(Line 1) Message: ext JS_in init
console-api	log	URL: https://lptag.liveperson.net/lptag/api/account/50929468/configuration/applications/taglets/.jsonp?v=2.0&df=0&b=1(Line 1) Message: ext JS_in addexternalscript
console-api	log	URL: https://lptag.liveperson.net/lptag/api/account/50929468/configuration/applications/taglets/.jsonp?v=2.0&df=0&b=1(Line 1) Message: ext JS_in valid check
console-api	log	URL: https://lptag.liveperson.net/lptag/api/account/50929468/configuration/applications/taglets/.jsonp?v=2.0&df=0&b=1(Line 1) Message: ext JS_in_if function
console-api	log	URL: https://lptag.liveperson.net/lptag/api/account/50929468/configuration/applications/taglets/.jsonp?v=2.0&df=0&b=1(Line 1) Message: ext JS_after add
console-api	log	URL: https://online.citi.com/JRS/CHIP/js/youtube-video-player.js(Line 50) Message: player ready
console-api	log	URL: https://nexus.ensighten.com/citi/na_prod/code/18f290115d86c3ce4744668350fa4bb3.js?conditionId0=421908(Line 31) Message: site_events detected
console-api	log	URL: https://nexus.ensighten.com/citi/na_prod/code/18f290115d86c3ce4744668350fa4bb3.js?conditionId0=421908(Line 31) Message: product data detected

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

20766699p.rfihub.com
20822230p.rfihub.com
6256710.fls.doubleclick.net
a.rfihub.com
ad.atdmt.com
bcp.crwdcntrl.net
c1.rfihub.net
cdn.pbbl.co
cdnjs.cloudflare.com
citi.demdex.net
citicorpcreditservic.tt.omtrdc.net
citirel--c.na91.content.force.com
citirel.my.salesforce.com
cm.everesttech.net
cm.g.doubleclick.net
cse.google.com
dpm.demdex.net
email.homeloans.citi.com
googleads.g.doubleclick.net
idsync.rlcdn.com
insight.adsrvr.org
js.adsrvr.org
live.rezync.com
lp-01.chat.online.citi.com
lp-03.chat.online.citi.com
lpcdn.chat.online.citi.com
lptag.liveperson.net
metrics1.citi.com
metrics1.citibank.com
nebula-cdn.kampyle.com
nexus.ensighten.com
online.citi.com
p.rfihub.com
prod.report.nacustomerexperience.citi.com
resources.digital-cloud-citi.medallia.com
sr.rlcdn.com
stags.bluekai.com
static-assets.dev.fs.liveperson.com
static-assets.fs.liveperson.com
t.myvisualiq.net
tags.bkrtx.com
tags.bluekai.com
tapestry.tapad.com
track
udc-neb.kampyle.com
vt.myvisualiq.net
www.google.com
www.google.de
www.googleadservices.com
www.googletagmanager.com
www.youtube.com
track
104.108.41.56
104.111.224.160
104.111.228.137
104.111.238.178
13.110.10.60
13.110.9.61
13.225.80.50
143.204.215.103
143.204.215.24
15.237.136.106
151.101.13.175
151.101.14.133
172.217.22.2
172.217.22.70
178.249.101.23
18.194.78.147
18.197.253.20
192.193.179.248
193.0.160.129
208.89.12.87
2606:4700::6810:135e
2a00:1450:4001:801::2002
2a00:1450:4001:801::2004
2a00:1450:4001:802::2008
2a00:1450:4001:806::200e
2a00:1450:4001:817::2003
2a00:1450:4001:825::200e
2a03:2880:f01c:8004:face:b00c:0:8c
2a03:6400:10:0:178:249:97:98
2a03:6400:10:0:178:249:97:99
34.120.207.148
34.249.128.36
34.251.61.210
34.252.166.160
35.181.18.61
35.227.248.159
35.241.45.82
35.244.245.222
52.1.126.9
52.30.234.204
54.171.106.172
54.171.42.33
65.9.78.118
65.9.83.19
65.9.83.34
0013498129c7c6740dfa91fa229a33d0e2f115f9d38e61faafd594a4c8122a10
015e6103bdf04fef85eeb4c098ee7f0fa746ece89b30738106a50fa64b40d444
06dfb367edf9bbff810def9f75f8695b3ccfbcb2813306609fc6e18fcacfc17e
0911117dae5b4cf689a6581a189630d1e001de76e7950dad82933c8ae832a422
0af3aae90b7de9fdceee2ab421378ea2f54c74be81ef43fc6c1790a032755d80
0c450bd175d77018813affa46a2bea08fd817b88875cd533db69f3584639732e
0ce9b9b7e79cc180dd9364960612f396be614ce6f01f4f659a5387ff2625b5d6
12f9393ae0fd222984b6a955088bd83de9f8548d17e7110b814f133f3a8e460f
145d14bb73e5b03cc73062c2a78c392125b891c62b1cc9d542e5adba762f04e7
14cbd9b866a9b092e3a2e03a93b128da5baca005fd8b44a1956146eaab7b48b7
192ae096ba2bc7bc55140f2db3522487dd49d626662e78f8f9bd729bf7208206
1c5f4ca631e6335f2f85ec82c0fc50452697853012054de12b3c59013dbe57e2
2171452a830a17d7eefd36a80c9d9072cb343bebb31809af3dc24b1d8b1788e5
218f88c05c6697072bf426ce129b0192afa524adde194503d403a5544576ed81
25f4eeb23f67fe1d74534ed37230ecd54ab4f57524276970dcbeaaf3b0fc64f9
26b891e22ff382d724a31923df2b790b2ce12ae383e498790d5a3e8c98785274
26bd08ed2cd872e2aaa0db2ec168b1f8d74c1c8f8aceb0640b12463cd7d69bf8
27f7bfbad08fd8ccbacfb5b1b4f38208e2c35832372f981d233eb240f2f03ce9
288246404bcb8a728f25ecdcaafccb63672b26b0e60d594d86c100febd7c66a0
2de19ea3b85e03239dd9cbe30d9545a1b5a7ce2f0662feaeaf3d2d088179ea5c
2f561b02a49376e3679acd5975e3790abdff09ecbadfa1e1858c7ba26e3ffcef
2f7a2b2aa895d1b0d5eefb6ddd68b0efa1c6614b1d25cdab575703e95289d7ed
31b00ff4929696dfca06885da68e58c3e09f6ecb4ae0fe1ae287e99a3fd1f716
3244cc85206c13d56be8604e6cd6ca93bb0b58e712fa12e663b8f3e12495e891
326f41c7305c8a7911049505b1d2e385d8b87f190774466a42f084dbd3982aba
3281179a748a0e0cdc4b71cf946d6f4a514f723aef49db36da210b0f30ce44e5
32a17f5568bff60258cc679775d465e23972d3f7656817c877aeb4a36218630a
378739b76d3a04e83cc8cdad421adc403f4b196cceb36b5c8118459574186f49
3975b76cc53eb1aeb0a232bc60d18c3aa1ddd3e8a7a08db6abbc14392662ca67
3e385f9f9bc22340f6ae4ec99763206149638f367569389e3ba6feeaaf242f7f
3e72de5de67d6d80b65a114af684eaf880c53c250155a663cb17d677ff064bc1
3fca3de24621f0f10186594054444d608016297c2e853e548710b3521e42a609
4061018b43e420a8f4513629af7dc6c78465e9f9d42c13c97104c637c2480f25
413240a2f6cf15313f73033807c5cc13d5de67ca72d2abac9652317133692c51
4211ba5ac0bc3e9f883a55817fbbe218d26c95384df6a0128418a8a45f2d55b7
439be5ae819f4fbf2565e4ce41aa8ab5cd0ddb2ba61c503e6233cc98c83b92cd
440e78a9eb145a4c98fe1a25b7830b36a987d606aa5cc8e404df50b4eeba3726
45411434d7d8fe258124f2e19cbbc37f0379f0882a64ec263840ab3b5c702a9d
47b5781e69988949c5ef73987ffca68c5e121859c5e337f16cfa422be4b624ed
47d3a0c142dc756cd048e15919192fc3dbb22fc8070373f1fa73a41bbbb247db
49dba3c0728c92695be07d9b57e1143ad9953ee8949fd7aa836a71d248f655b5
4bded90d3a2799860116b329ec237413d9850e67cc44ee93bd83d654d44682fe
4c1355d27b14881a055e00a4a2afa4608b452c9780ac5c61e1b8f9fd55fa3e1e
4d09cfb5ba7471be2d35405a0510a67a3a6825e1e0337aca7dd94256e6c107d8
4e4bd342751152a1a3cdb1bd66095d16bbc6bb5b8883dd2389049a40e73f36b3
4f918cd256712c03a1b88007176cabf623cc63740e919d35a217c18dc7ebe607
4ffe92333c96470e33c31a61843ed003ce2e50b80d49ffdb926e15160f72aad3
507d070f201e809847fd7fdd042aadf1e38f5d14ad44b3198f20018d78112f24
50938486fbd18c6197151fa18f56908449b6edc6c9f161277078fe00b69599aa
53baec92768319431128c733e6df9784b9cc492006494f925410b176a02cb9fd
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87
559a955364e508ac1fdb0f5a54062f28682c7b4046997f1b5477b40072aa7cad
55c1a891895fc4a46dbc82176e0c0ff3407ef8f2cc9852f6a707ba3bac979004
55c9d2f019f9d7ddfd69b2ad0351c5617338a222362aebb02b3b98a4dbc18486
5665be770c61aa276c0e6b9da7ee8e2fc9fa2b7165043a83b9c1757e1e369198
56829ae989e5a11036e30ac73bf04ef74094c0871e278f30b6645211b2eb1a1f
5931f2f5347340dc4fbd86642ba2cf75f093d1985ed91cbc8b3f7e1aab459a85
59ef0e92f579389a5592beac68c4b9fc27204dab490d348d068768f61a170554
59f4843277d9aca1200c779c52318aadb380021a0051a6644b75274acb7fe158
5a62e3af05fba88e8de7af59df1536d20fd50911e6cdc2dc90672b5c75cf384a
5c3344d6f25b95a3561326b43bdea1a94d3dcd65097a6db527442978a3ebf86f
63a4d32133227b970a48bbd2b8bda5fa0cef4503b4c20ebc1b52dd68c4b21f10
65980d692a75b30a18de261f85398dd5e3b9ecca2b8c3e6943c6c45b77a57567
6d3001c9deac8cb1f88ea5254105f8d678de5532f1998a24eab1b59906eaf86b
6d8ba81d1b60a18707722a1f2b62dad48a6acced95a1933f49a68b5016620b93
6f028cf1a64a634dcc135c46244706b685cfb2b8ace97a76b7640014818f3846
6f3649e19993fee191ac81abe9c6c74f6714d9fd19ccd3a0cce2f31835018e10
7835a80064e872d67e257fd52d5918d1dca3377f2ef07bf42e3febd8206cec7b
7864500d9bdaca98dbd359f26bcca34bc3b835628a8af84ba5df5f973f83ba36
78af61897fafb5a82b787273472a93de723186b17f46ed315617c70ae2b6a6fe
7b339673dc3c84e10acac205a1cdfef6dc6502fba85fba46e4e5fe96bcdcce5a
7cb24e06c00e47bb6bc6c38b935d6bc62817f656703387e4fb7591add96c7454
7df13706eaab8ce9a3dcd2a501f60bc66987c83834d07dfaf07ae56ef814c110
8241de0bb6aadfe1dc99b9ffb7942503313e474a3bd5e62e2171144971a03168
85097f5914dba04ad8504b560ac6d6584cccf68c560dfc3ff573dd1e9e32207d
850fa15ac2c9ef551ceba9b22ee6b541afbf8a77ebd94329c75246fc0d19551d
85f3dbab562f93a712bc882c0e16bfdcd5053643efc500063de6ed152d5b0c33
86c2ea209b2d76e6694db4148dc0353c160d6d8bdc0f56fd6476fd8e2dbba6aa
8ccab9e0c2bd6afa06ebf24a1679c7693f0bccee878286f38c75e80a37f1062b
8e40771ee97376e22303dd8f2c39ec717e7a9b71eb17e3656d76e035684747cf
930615d28b1ffaacd878634f3dcecef35d1b8b59e92c41f57ed2d320dd63ca17
9438a07875252842cda519138582b14f8a9559f2efe8571e1e9c44834ede8457
9aad0a8fa60381055fb1fc99b90904e0f933bfbd691691773eb08b2d013651c5
9b55a270957d6d2111d63e73b73fb7d7eb8493979a419c945dea0314910a2c16
9bdacccac143b69f1f4e0fb884d291ff41077d2f937c8809ff88a1e8c2309f18
9c9c84d9e9338cc91fb1a5177e788d420ddfc5f97a51d857918f89c99c6bddf0
9e413d8a6e3fd51a289a6b73fc880120fb72e7be4f2d935577f39e53ac478642
a1ecbaed793a1f564c49c671f2dd0ce36f858534ef6d26b55783a06b884cc506
a29ad79a8aa3c011f165bf0040b910bcf591c2f1533c5477b866770508128782
a6177507e6277bba4faeff81596dea32ddaf084507444d684e7365f70f0987c6
a9623118fb6ec3944d1312cd0d492c3f32455e89bc1e01eafa67628a309d9c60
adb1b99bd6e0c98acebcadc78cbf92fcba77bc07941e2c00d374a551f3f42a89
b09fedb01b573461330e544b518c058872dc311440b2da9d58efbaf025b92beb
b4021b10e9415a2107e00ab35a769df3c3a15328b731da1f627a13c0c83ac6a2
b4d194e97cb5a5422cda4e4c49a8bae0f3bb4584694176386402a1423b65b602
b4d81e297696a333ab9074579aa0b59f61558916bde25f037845d92ba6964596
b63dce0094ea3c2b03d2dc0205507faaa364d2b686cf32d7090f80d87e9cccf9
b9fc2db5b8d368c28d5bfed2156100289f12437b60eb32c43a613528cc95461a
baa964444ed861dabdd7d1ff31f6b7162e0967ddfcf3a32ff4dcb9c44fc570c4
bac13653fd791e602e95efe7eb170b530f8fefd2d07efbcfa46d7393de70a650
bb09fa6144db5a44a216936f7a915205de5e78882f75a96434d9215f0c3a0872
bb1bd01ab614af54f6c546c88f92ad916365566583639f3fd045defcfd9e43e8
bd04cb616962bb8f1bb8a3087ae91331badae76e48f6b741fd7a622fcd07651f
c126f0597eddb532c669114849ed058abb108e142f5633fb46b762c60f546f52
c67f8ec8aee897904395c535ed560101abed2f245bc9e914cccdc882592526a0
c770e459d9988f611c466be1c6a650c3247f8521b536c1c2897c390f7f25e5bb
c8e4f79523defc28bb4948fcf37159478f0ecdbb768cc9be73b9a429be3d1139
cb27f55d6e59e402fc582097fb823d849c9141b6e992a06c7d1ea68af1d93740
cb2bb21705b9cce9781d02c9223f3344a65bd5314027d11c5a8518ad4bd84e84
cd801a27b2df0682defacdca8a36165d74f9ea3f3800d944a55227cc51b53968
cea6f7b2e2badb4642c07d42e950403f303e22eda1c9c05baa72b0a4ebf576f0
d31a50cf17b234acf39fabd6826ffe5dfd8f38263017dd1901845e02b44def21
d33c3580a6f74918cb48b98df98c9d7bb24dffe18938325ba9327459dd0ce424
d47715394bd51deef2ed110a313ade6e1b61d55e1107b390fc47abd54454db52
d57c8034f9c12aa3ce626c9ed1d61a4bb0941c3ef320bb59346f20496fb0096a
d844653e4d2e16ba28ba8972082841433babd254eac17ffa28ed394b4c812375
d8b32a1e0f5d3d3d05cda5e3e109a8198be3ceca3ae8b4fe63d2bd471920ef7f
d9a3954458e11340809dd9dcf98d0b52f1a21cc41542d1d3380509d8ae8cf788
dae4acecbd1d892109a8b7f2ed6b3d4812328d4cbae3b14758e445724a2a38a0
dcec22bbcb68119d6c7d6d5e088fb82183a9826d0c9e3403f1386fd837f06a89
df41438b4814647ed52d3803e0815efadd10267a02ad1b6224332e46b8af8105
e1739237d530e65b6e4b1a4d0a11223446e78b94d4dd7db657f48fede05e1d6e
e1d216f9d81b363d3a9606fde7da8587208208f3a8a970705416aa9c7ea9f412
e2347f2294d6ac2ebbc90ab9716f71da51edf868e77f47ce0594ef841fce2f17
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e90fb0eba512ed6473f6fb8acf4cd09b38732f150f43c396246c12bb2aacbb67
e98b6c738d2156a72bdf070c557f07574757b7128525cc049c0843578c17a969
e9e9a67395a0d83b584208a19b95af203df8e8e6c6952fe76c690d60ea9381c7
ee3a7301fe1e0c0f6bf6acff0d7a8d107f5cb3f62a2566740c0416d8e61f00b9
eec5cc477e7cb4f1eee1f26dce3eb411a63716d89a9b659c7d5559571c837ccb
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f2adfd83f8e9c7f3b092921eb5a59d4463041b2be8386a17ec7ac29d8d588470
f327a0ba3e41b1e8154e1c18fc114baff0bd057151e3afe7fa6f33cc0cb18296
f35167f960fb0ce996db66bdfc5723771a4acc8e7206b282e7dfaa8c2ca81e3b
f5f66ab8170ccc3fd83ed8dab1dcc2b56ab257cb82ddc3c0eba15f33d3012b3f
f6da6c05cc1591253f4b9999a83a75039090f70bd1e34e4ed256ae8527ec1d86
fc97d8d255f502986df8493852e51c9a3a7d725c6d0c65fffe8b266940c31699
fd40ba20734e83ebb0c4f877bb2675faa7beaf1f7c88dbd5e06ad06012c4c208

online.citi.com Open in urlscan Pro 104.111.238.178 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Page Statistics

164 Requests

99 %HTTPS

22 %IPv6

32 Domains

51 Subdomains

41 IPs

7 Countries

3925 kBTransfer

10948 kBSize

31 Cookies

14 Outgoing links

Page URL History

Redirected requests

164 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

online.citi.com Open in urlscan Pro
104.111.238.178 Public Scan

Screenshot
Live screenshot

Full Image

164
Requests

99 %
HTTPS

22 %
IPv6

32
Domains

51
Subdomains

41
IPs

7
Countries

3925 kB
Transfer

10948 kB
Size

31
Cookies

164 HTTP transactions
0 data transactions