urlscan.io logo urlscan.io
SecurityTrails logo

westa.kr Open in urlscan Pro
192.254.187.108  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
Submitted URL: http://westa.kr/tag/citi/CITIZ/login/
Effective URL: http://westa.kr/tag/citi/CITIZ/login/ses/index
Submission: On March 18 via automatic, source phishtank — Scanned from DE
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 17 IPs in 4 countries across 16 domains to perform 73 HTTP transactions. The main IP is 192.254.187.108, located in United States and belongs to UNIFIEDLAYER-AS-1, US. The main domain is westa.kr.
This is the only time westa.kr was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Citibank (Banking)

Domain & IP information

IP Address AS Autonomous System
19 192.254.187.108 46606 (UNIFIEDLA...)
2 5 52.209.199.204 16509 (AMAZON-02)
8 18.197.253.20 16509 (AMAZON-02)
1 13.36.218.177 16509 (AMAZON-02)
1 104.111.228.137 16625 (AKAMAI-AS)
1 2.16.186.82 20940 (AKAMAI-ASN1)
2 2 54.194.191.134 16509 (AMAZON-02)
1 108.128.22.191 16509 (AMAZON-02)
2 151.101.2.133 54113 (FASTLY)
1 143.204.98.10 16509 (AMAZON-02)
1 9 2a00:1450:400... 15169 (GOOGLE)
1 104.111.215.191 16625 (AKAMAI-AS)
1 151.101.129.175 54113 (FASTLY)
1 35.241.45.82 15169 (GOOGLE)
3 142.250.179.130 15169 (GOOGLE)
1 8 2a00:1450:400... 15169 (GOOGLE)
1 8 2a00:1450:400... 15169 (GOOGLE)
8 2a00:1450:400... 15169 (GOOGLE)
73 17
19    192.254.187.108 (United States)

ASN46606 (UNIFIEDLAYER-AS-1, US)
PTR: glamifest.com
westa.kr
5    52.209.199.204 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-52-209-199-204.eu-west-1.compute.amazonaws.com
dpm.demdex.net
8    18.197.253.20 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-18-197-253-20.eu-central-1.compute.amazonaws.com
nexus.ensighten.com
1    13.36.218.177 (Paris, France)

ASN16509 (AMAZON-02, US)
PTR: ec2-13-36-218-177.eu-west-3.compute.amazonaws.com
metrics.citi.com
1    104.111.228.137 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a104-111-228-137.deploy.static.akamaitechnologies.com
tags.bkrtx.com
1    2.16.186.82 (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)
PTR: a2-16-186-82.deploy.static.akamaitechnologies.com
fast.citi.demdex.net
2    54.194.191.134 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-54-194-191-134.eu-west-1.compute.amazonaws.com
cm.everesttech.net
1    108.128.22.191 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-108-128-22-191.eu-west-1.compute.amazonaws.com
citicorpcreditservic.tt.omtrdc.net
2    151.101.2.133 (United States)

ASN54113 (FASTLY, US)
resources.digital-cloud-citi.medallia.com
1    143.204.98.10 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-143-204-98-10.fra50.r.cloudfront.net
cdn.pbbl.co
9    2a00:1450:4001:813::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.googletagmanager.com
1    104.111.215.191 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a104-111-215-191.deploy.static.akamaitechnologies.com
stags.bluekai.com
1    151.101.129.175 (United States)

ASN54113 (FASTLY, US)
nebula-cdn.kampyle.com
1    35.241.45.82 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 82.45.241.35.bc.googleusercontent.com
udc-neb.kampyle.com
3    142.250.179.130 (United States)

ASN15169 (GOOGLE, US)
PTR: ams17s10-in-f2.1e100.net
www.googleadservices.com
8    2a00:1450:4001:827::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
googleads.g.doubleclick.net
8    2a00:1450:4001:811::2004 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.google.com
8    2a00:1450:4001:80f::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.google.de
Apex Domain
Subdomains		 Transfer
19 westa.kr
westa.kr
986 KB
9 googletagmanager.com
www.googletagmanager.com — Cisco Umbrella Rank: 54
316 KB
8 google.de
www.google.de — Cisco Umbrella Rank: 6433
1 KB
8 google.com
www.google.com — Cisco Umbrella Rank: 2
2 KB
8 doubleclick.net
googleads.g.doubleclick.net — Cisco Umbrella Rank: 38
9 KB
8 ensighten.com
nexus.ensighten.com — Cisco Umbrella Rank: 2591
77 KB
6 demdex.net
dpm.demdex.net — Cisco Umbrella Rank: 184
fast.citi.demdex.net
7 KB
3 googleadservices.com
www.googleadservices.com — Cisco Umbrella Rank: 101
45 KB
2 kampyle.com
nebula-cdn.kampyle.com — Cisco Umbrella Rank: 3348
udc-neb.kampyle.com — Cisco Umbrella Rank: 2681
6 KB
2 medallia.com
resources.digital-cloud-citi.medallia.com — Cisco Umbrella Rank: 23247
89 KB
2 everesttech.net
cm.everesttech.net — Cisco Umbrella Rank: 878
772 B
1 bluekai.com
stags.bluekai.com — Cisco Umbrella Rank: 437
338 B
1 pbbl.co
cdn.pbbl.co — Cisco Umbrella Rank: 7877
1 omtrdc.net
citicorpcreditservic.tt.omtrdc.net — Cisco Umbrella Rank: 26164
1 KB
1 bkrtx.com
tags.bkrtx.com — Cisco Umbrella Rank: 2764
16 KB
1 citi.com
metrics.citi.com
1 KB
73 16
Domain Requested by
19 westa.kr westa.kr
9 www.googletagmanager.com 1 redirects
8 www.google.de
8 www.google.com 1 redirects
8 googleads.g.doubleclick.net 1 redirects www.googleadservices.com
8 nexus.ensighten.com westa.kr
5 dpm.demdex.net 2 redirects westa.kr
3 www.googleadservices.com www.googletagmanager.com
2 resources.digital-cloud-citi.medallia.com nexus.ensighten.com
resources.digital-cloud-citi.medallia.com
2 cm.everesttech.net 2 redirects
1 udc-neb.kampyle.com
1 nebula-cdn.kampyle.com resources.digital-cloud-citi.medallia.com
1 stags.bluekai.com tags.bkrtx.com
1 cdn.pbbl.co nexus.ensighten.com
1 citicorpcreditservic.tt.omtrdc.net westa.kr
1 fast.citi.demdex.net westa.kr
1 tags.bkrtx.com nexus.ensighten.com
1 metrics.citi.com westa.kr
73 18

This site contains no links.

Subject Issuer Validity Valid
*.bkrtx.com
DigiCert SHA2 Secure Server CA		 2022-02-07 -
2023-02-06		 a year crt.sh
*.digital-cloud-citi.medallia.com
SSL.com RSA SSL subCA		 2021-11-15 -
2022-10-20		 a year crt.sh
odc-pixel-prod-01.oracle.com
DigiCert SHA2 Secure Server CA		 2022-02-26 -
2023-03-01		 a year crt.sh
*.g.doubleclick.net
GTS CA 1C3		 2022-02-28 -
2022-05-23		 3 months crt.sh
www.google.com
GTS CA 1C3		 2022-02-28 -
2022-05-23		 3 months crt.sh
www.google.de
GTS CA 1C3		 2022-02-28 -
2022-05-23		 3 months crt.sh

This page contains 3 frames:

Primary Page: http://westa.kr/tag/citi/CITIZ/login/ses/index
Frame ID: CFA4A49B022F61BE41FB9E8B8F846EED
Requests: 71 HTTP requests in this frame

Frame: http://fast.citi.demdex.net/dest5.html?d_nsid=0
Frame ID: B4183E77CE42B8A4FF2F36DE3E717D64
Requests: 1 HTTP requests in this frame

Frame: https://stags.bluekai.com/site/63068?ret=html&phint=language&phint=product&phint=event&phint=category&phint=page&phint=section1&phint=section2&phint=section3&phint=section4&phint=bankappstatus&phint=productID&phint=__bk_t%3DSign%20On%20to%20Your%20Citi%20Account%20-%20Citibank&phint=__bk_k%3D&phint=__bk_pr%3Dhttp%3A%2F%2Fwesta.kr%2Ftag%2Fciti%2FCITIZ%2Flogin%2F&phint=__bk_l%3Dhttp%3A%2F%2Fwesta.kr%2Ftag%2Fciti%2FCITIZ%2Flogin%2Fses%2Findex&phint=__bk_v%3D3.1.10&limit=10&r=68279188
Frame ID: A4845037E3C567E469F8DD37EB359E70
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Sign On to Your Citi Account - Citibank

Page URL History Show full URLs

  1. http://westa.kr/tag/citi/CITIZ/login/ Page URL
  2. http://westa.kr/tag/citi/CITIZ/login/ses/index Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js
Overall confidence: 100%
Detected patterns
  • //nexus\.ensighten\.com/
Overall confidence: 100%
Detected patterns
  • googletagmanager\.com/gtag/js

Page Statistics

73
Requests

33 %
HTTPS

22 %
IPv6

16
Domains

18
Subdomains

17
IPs

4
Countries

1555 kB
Transfer

4363 kB
Size

19
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. http://westa.kr/tag/citi/CITIZ/login/ Page URL
  2. http://westa.kr/tag/citi/CITIZ/login/ses/index Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 11
  • http://dpm.demdex.net/id?d_visid_ver=3.1.2&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=61834D9B5228A7430A490D45%40AdobeOrg&d_nsid=0&ts=1647641159158 HTTP 302
  • http://dpm.demdex.net/id/rd?d_visid_ver=3.1.2&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=61834D9B5228A7430A490D45%40AdobeOrg&d_nsid=0&ts=1647641159158
Request Chain 24
  • http://cm.everesttech.net/cm/dd?d_uuid=16036500467722143190192068032901957643 HTTP 301
  • https://cm.everesttech.net/cm/dd?d_uuid=16036500467722143190192068032901957643 HTTP 302
  • https://dpm.demdex.net/ibs:dpid=411&dpuuid=YjUCRwAAAHUbpAQS HTTP 302
  • https://dpm.demdex.net/demconf.jpg?et:ibs%7cdata:dpid=411&dpuuid=YjUCRwAAAHUbpAQS
Request Chain 35
  • http://www.googletagmanager.com/gtag/js?id=AW-916451471 HTTP 302
  • https://www.googletagmanager.com/gtag/js?id=AW-916451471
Request Chain 41
  • http://www.googletagmanager.com/gtag/js?id=AW-960621875&l=dataLayer&cx=c HTTP 307
  • https://www.googletagmanager.com/gtag/js?id=AW-960621875&l=dataLayer&cx=c
Request Chain 42
  • http://www.googletagmanager.com/gtag/js?id=AW-644574043&l=dataLayer&cx=c HTTP 307
  • https://www.googletagmanager.com/gtag/js?id=AW-644574043&l=dataLayer&cx=c
Request Chain 43
  • http://www.googletagmanager.com/gtag/js?id=AW-975701947&l=dataLayer&cx=c HTTP 307
  • https://www.googletagmanager.com/gtag/js?id=AW-975701947&l=dataLayer&cx=c
Request Chain 44
  • http://www.googletagmanager.com/gtag/js?id=AW-830907969&l=dataLayer&cx=c HTTP 307
  • https://www.googletagmanager.com/gtag/js?id=AW-830907969&l=dataLayer&cx=c
Request Chain 45
  • http://www.googletagmanager.com/gtag/js?id=AW-695231162&l=dataLayer&cx=c HTTP 307
  • https://www.googletagmanager.com/gtag/js?id=AW-695231162&l=dataLayer&cx=c
Request Chain 46
  • http://www.googletagmanager.com/gtag/js?id=AW-819500023&l=dataLayer&cx=c HTTP 307
  • https://www.googletagmanager.com/gtag/js?id=AW-819500023&l=dataLayer&cx=c
Request Chain 47
  • http://www.googletagmanager.com/gtag/js?id=AW-959299794&l=dataLayer&cx=c HTTP 307
  • https://www.googletagmanager.com/gtag/js?id=AW-959299794&l=dataLayer&cx=c
Request Chain 65
  • https://googleads.g.doubleclick.net/pagead/viewthroughconversion/695231162/?random=1647641160609&cv=9&fst=1647641160609&num=1&fmt=3&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa3e0&sendb=1&ig=1&data=event%3Dgtag.config&frm=0&url=http%3A%2F%2Fwesta.kr%2Ftag%2Fciti%2FCITIZ%2Flogin%2Fses%2Findex&ref=http%3A%2F%2Fwesta.kr%2Ftag%2Fciti%2FCITIZ%2Flogin%2F&tiba=Sign%20On%20to%20Your%20Citi%20Account%20-%20Citibank&hn=www.googleadservices.com&async=1 HTTP 302
  • https://www.google.com/pagead/1p-user-list/695231162/?random=1647641160609&cv=9&fst=1647640800000&num=1&fmt=3&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa3e0&sendb=1&data=event%3Dgtag.config&frm=0&url=http%3A%2F%2Fwesta.kr%2Ftag%2Fciti%2FCITIZ%2Flogin%2Fses%2Findex&ref=http%3A%2F%2Fwesta.kr%2Ftag%2Fciti%2FCITIZ%2Flogin%2F&tiba=Sign%20On%20to%20Your%20Citi%20Account%20-%20Citibank&async=1&is_vtc=1&random=2408651188&resp=GooglemKTybQhCsO HTTP 302
  • https://www.google.de/pagead/1p-user-list/695231162/?random=1647641160609&cv=9&fst=1647640800000&num=1&fmt=3&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa3e0&sendb=1&data=event%3Dgtag.config&frm=0&url=http%3A%2F%2Fwesta.kr%2Ftag%2Fciti%2FCITIZ%2Flogin%2Fses%2Findex&ref=http%3A%2F%2Fwesta.kr%2Ftag%2Fciti%2FCITIZ%2Flogin%2F&tiba=Sign%20On%20to%20Your%20Citi%20Account%20-%20Citibank&async=1&is_vtc=1&random=2408651188&resp=GooglemKTybQhCsO&ipr=y

73 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
/
westa.kr/tag/citi/CITIZ/login/ 		53 B
414 B 		Document
General
Check archive.org
Download Go to
Full URL
http://westa.kr/tag/citi/CITIZ/login/
Protocol
HTTP/1.1
Server
192.254.187.108 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US),
Reverse DNS
glamifest.com
Software
Apache /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Accept-Language
de-DE,de;q=0.9

Response headers

Date
Fri, 18 Mar 2022 22:05:57 GMT
Server
Apache
Upgrade
h2,h2c
Connection
Upgrade, Keep-Alive
Vary
Accept-Encoding
Content-Encoding
gzip
Accept-Ranges
none
X-Content-Type-Options
nosniff
X-XSS-Protection
1; mode=block
Content-Length
67
Keep-Alive
timeout=5, max=75
Content-Type
text/html; charset=UTF-8
Primary Request index
westa.kr/tag/citi/CITIZ/login/ses/ 		371 KB
72 KB 		Document
General
Check archive.org
Download Go to
Full URL
http://westa.kr/tag/citi/CITIZ/login/ses/index
Requested by
Host: westa.kr
URL: http://westa.kr/tag/citi/CITIZ/login/
Protocol
HTTP/1.1
Server
192.254.187.108 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US),
Reverse DNS
glamifest.com
Software
Apache /
Resource Hash
be7f7c26bf389d3d3ad17a098c4b865438a6581e8d92ea517c20a804c259577a
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Referer
http://westa.kr/tag/citi/CITIZ/login/

Response headers

Date
Fri, 18 Mar 2022 22:05:57 GMT
Server
Apache
Vary
Accept-Encoding
Content-Encoding
gzip
Accept-Ranges
none
X-Content-Type-Options
nosniff
X-XSS-Protection
1; mode=block
Keep-Alive
timeout=5, max=74
Connection
Keep-Alive
Transfer-Encoding
chunked
Content-Type
text/html; charset=UTF-8
Bootstrap.js
westa.kr/tag/citi/CITIZ/login/ses/js/ 		280 KB
112 KB 		Script
General
Check archive.org
Download Go to
Full URL
http://westa.kr/tag/citi/CITIZ/login/ses/js/Bootstrap.js
Requested by
Host: westa.kr
URL: http://westa.kr/tag/citi/CITIZ/login/ses/index
Protocol
HTTP/1.1
Server
192.254.187.108 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US),
Reverse DNS
glamifest.com
Software
Apache /
Resource Hash
c73e69a929ce513e05bba4a3359296cf41064aaff3355d900b971ca39175a935
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
http://westa.kr/tag/citi/CITIZ/login/ses/index
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date
Fri, 18 Mar 2022 22:05:58 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Last-Modified
Thu, 10 Jun 2021 05:44:56 GMT
Server
Apache
Vary
Accept-Encoding
Upgrade
h2,h2c
Transfer-Encoding
chunked
Connection
Upgrade, Keep-Alive
Accept-Ranges
none
Content-Type
application/javascript
Keep-Alive
timeout=5, max=75
X-XSS-Protection
1; mode=block
Interstate-Light.woff
westa.kr/tag/citi/CITIZ/login/ses/css/ 		74 KB
74 KB 		Font
General
Check archive.org
Download Go to
Full URL
http://westa.kr/tag/citi/CITIZ/login/ses/css/Interstate-Light.woff
Requested by
Host: westa.kr
URL: http://westa.kr/tag/citi/CITIZ/login/ses/index
Protocol
HTTP/1.1
Server
192.254.187.108 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US),
Reverse DNS
glamifest.com
Software
Apache /
Resource Hash
f327a0ba3e41b1e8154e1c18fc114baff0bd057151e3afe7fa6f33cc0cb18296
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
http://westa.kr/tag/citi/CITIZ/login/ses/index
Origin
http://westa.kr
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date
Fri, 18 Mar 2022 22:05:58 GMT
X-Content-Type-Options
nosniff
Last-Modified
Thu, 10 Jun 2021 05:29:36 GMT
Server
Apache
Upgrade
h2,h2c
Access-Control-Allow-Origin
*
Connection
Upgrade, Keep-Alive
Accept-Ranges
bytes
Content-Type
font/woff
Keep-Alive
timeout=5, max=75
Content-Length
75538
X-XSS-Protection
1; mode=block
Interstate-Bold.woff
westa.kr/tag/citi/CITIZ/login/ses/css/ 		70 KB
71 KB 		Font
General
Check archive.org
Download Go to
Full URL
http://westa.kr/tag/citi/CITIZ/login/ses/css/Interstate-Bold.woff
Requested by
Host: westa.kr
URL: http://westa.kr/tag/citi/CITIZ/login/ses/index
Protocol
HTTP/1.1
Server
192.254.187.108 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US),
Reverse DNS
glamifest.com
Software
Apache /
Resource Hash
e9e9a67395a0d83b584208a19b95af203df8e8e6c6952fe76c690d60ea9381c7
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
http://westa.kr/tag/citi/CITIZ/login/ses/index
Origin
http://westa.kr
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date
Fri, 18 Mar 2022 22:05:58 GMT
X-Content-Type-Options
nosniff
Last-Modified
Thu, 10 Jun 2021 05:29:34 GMT
Server
Apache
Upgrade
h2,h2c
Access-Control-Allow-Origin
*
Connection
Upgrade, Keep-Alive
Accept-Ranges
bytes
Content-Type
font/woff
Keep-Alive
timeout=5, max=75
Content-Length
71874
X-XSS-Protection
1; mode=block
Interstate-Regular.woff
westa.kr/tag/citi/CITIZ/login/ses/css/ 		77 KB
77 KB 		Font
General
Check archive.org
Download Go to
Full URL
http://westa.kr/tag/citi/CITIZ/login/ses/css/Interstate-Regular.woff
Requested by
Host: westa.kr
URL: http://westa.kr/tag/citi/CITIZ/login/ses/index
Protocol
HTTP/1.1
Server
192.254.187.108 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US),
Reverse DNS
glamifest.com
Software
Apache /
Resource Hash
045cd226594cb32ddf9d4db8ee45611f4d0788675ae50180b68da975e66fe1fe
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
http://westa.kr/tag/citi/CITIZ/login/ses/index
Origin
http://westa.kr
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date
Fri, 18 Mar 2022 22:05:58 GMT
X-Content-Type-Options
nosniff
Last-Modified
Thu, 10 Jun 2021 05:29:38 GMT
Server
Apache
Upgrade
h2,h2c
Access-Control-Allow-Origin
*
Connection
Upgrade, Keep-Alive
Accept-Ranges
bytes
Content-Type
font/woff
Keep-Alive
timeout=5, max=75
Content-Length
78762
X-XSS-Protection
1; mode=block
styles.css
westa.kr/tag/citi/CITIZ/login/ses/css/ 		1 MB
276 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
http://westa.kr/tag/citi/CITIZ/login/ses/css/styles.css
Requested by
Host: westa.kr
URL: http://westa.kr/tag/citi/CITIZ/login/ses/index
Protocol
HTTP/1.1
Server
192.254.187.108 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US),
Reverse DNS
glamifest.com
Software
Apache /
Resource Hash
70f3cacfaa80a9d270cf98ce26fef532b1004bc471a20611f35bc70cd6d8d899
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
http://westa.kr/tag/citi/CITIZ/login/ses/index
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date
Fri, 18 Mar 2022 22:05:58 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Last-Modified
Sun, 13 Jun 2021 23:04:20 GMT
Server
Apache
Vary
Accept-Encoding
Upgrade
h2,h2c
Access-Control-Allow-Origin
*
Transfer-Encoding
chunked
Connection
Upgrade, Keep-Alive
Accept-Ranges
none
Content-Type
text/css
Keep-Alive
timeout=5, max=75
X-XSS-Protection
1; mode=block
citipridelogo.jpg
westa.kr/tag/citi/CITIZ/login/ses/css/ 		3 KB
3 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://westa.kr/tag/citi/CITIZ/login/ses/css/citipridelogo.jpg
Requested by
Host: westa.kr
URL: http://westa.kr/tag/citi/CITIZ/login/ses/index
Protocol
HTTP/1.1
Server
192.254.187.108 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US),
Reverse DNS
glamifest.com
Software
Apache /
Resource Hash
f94cb7cab7413f3e828c469111e3f9ee7bf21ac163cea343be2cdef866160d40
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
http://westa.kr/tag/citi/CITIZ/login/ses/index
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date
Fri, 18 Mar 2022 22:05:59 GMT
X-Content-Type-Options
nosniff
Last-Modified
Thu, 10 Jun 2021 05:03:50 GMT
Server
Apache
Content-Type
image/jpeg
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=74
Content-Length
2658
X-XSS-Protection
1; mode=block
050-location@2x.svg
westa.kr/tag/citi/CITIZ/login/ses/css/ 		2 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://westa.kr/tag/citi/CITIZ/login/ses/css/050-location@2x.svg
Requested by
Host: westa.kr
URL: http://westa.kr/tag/citi/CITIZ/login/ses/index
Protocol
HTTP/1.1
Server
192.254.187.108 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US),
Reverse DNS
glamifest.com
Software
Apache /
Resource Hash
6336ae7b60dff18e0a37721a3a19fd5e18568577a64faa662969d35966dbf72b
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
http://westa.kr/tag/citi/CITIZ/login/ses/index
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date
Fri, 18 Mar 2022 22:05:59 GMT
X-Content-Type-Options
nosniff
Last-Modified
Thu, 10 Jun 2021 05:29:00 GMT
Server
Apache
Content-Type
image/svg+xml
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=74
Content-Length
1752
X-XSS-Protection
1; mode=block
icon_globe_med-grey@2x.svg
westa.kr/tag/citi/CITIZ/login/ses/css/ 		3 KB
4 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://westa.kr/tag/citi/CITIZ/login/ses/css/icon_globe_med-grey@2x.svg
Requested by
Host: westa.kr
URL: http://westa.kr/tag/citi/CITIZ/login/ses/index
Protocol
HTTP/1.1
Server
192.254.187.108 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US),
Reverse DNS
glamifest.com
Software
Apache /
Resource Hash
a593628f2d5ba814f37fbcd3963162f094c2764d4b15d82464c2d1aef92f150f
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
http://westa.kr/tag/citi/CITIZ/login/ses/index
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date
Fri, 18 Mar 2022 22:05:59 GMT
X-Content-Type-Options
nosniff
Last-Modified
Thu, 10 Jun 2021 05:29:14 GMT
Server
Apache
Content-Type
image/svg+xml
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=74
Content-Length
3523
X-XSS-Protection
1; mode=block
320_Citi-PLT@3x.png
westa.kr/tag/citi/CITIZ/login/ses/css/ 		11 KB
12 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://westa.kr/tag/citi/CITIZ/login/ses/css/320_Citi-PLT@3x.png
Requested by
Host: westa.kr
URL: http://westa.kr/tag/citi/CITIZ/login/ses/index
Protocol
HTTP/1.1
Server
192.254.187.108 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US),
Reverse DNS
glamifest.com
Software
Apache /
Resource Hash
f378974fe6a831ae2f48d9191ea74eb21877d4964d5eedbc2810d8756ed13631
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
http://westa.kr/tag/citi/CITIZ/login/ses/index
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date
Fri, 18 Mar 2022 22:05:59 GMT
X-Content-Type-Options
nosniff
Last-Modified
Thu, 10 Jun 2021 05:03:40 GMT
Server
Apache
Content-Type
image/png
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=74
Content-Length
11562
X-XSS-Protection
1; mode=block
1440_Citi-PLT@3x.png
westa.kr/tag/citi/CITIZ/login/ses/css/ 		27 KB
28 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://westa.kr/tag/citi/CITIZ/login/ses/css/1440_Citi-PLT@3x.png
Requested by
Host: westa.kr
URL: http://westa.kr/tag/citi/CITIZ/login/ses/index
Protocol
HTTP/1.1
Server
192.254.187.108 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US),
Reverse DNS
glamifest.com
Software
Apache /
Resource Hash
6dfa343a68ef79e83fef5f7c705119d2473352190c609cf94c67ea99a29fa452
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
http://westa.kr/tag/citi/CITIZ/login/ses/index
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date
Fri, 18 Mar 2022 22:05:59 GMT
X-Content-Type-Options
nosniff
Last-Modified
Thu, 10 Jun 2021 05:03:34 GMT
Server
Apache
Content-Type
image/png
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=73
Content-Length
28149
X-XSS-Protection
1; mode=block
rd
dpm.demdex.net/id/
Redirect Chain
  • http://dpm.demdex.net/id?d_visid_ver=3.1.2&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=61834D9B5228A7430A490D45%40AdobeOrg&d_nsid=0&ts=1647641159158
  • http://dpm.demdex.net/id/rd?d_visid_ver=3.1.2&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=61834D9B5228A7430A490D45%40AdobeOrg&d_nsid=0&ts=1647641159158
110 B
714 B 		XHR
General
Check archive.org
Download Go to
Full URL
http://dpm.demdex.net/id/rd?d_visid_ver=3.1.2&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=61834D9B5228A7430A490D45%40AdobeOrg&d_nsid=0&ts=1647641159158
Requested by
Host: westa.kr
URL: http://westa.kr/tag/citi/CITIZ/login/ses/index
Protocol
HTTP/1.1
Server
52.209.199.204 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-52-209-199-204.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash
a56e82f34c03b1bed67b86e8b09d36303d6204eeb04b968f8fe38077753606ca

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
http://westa.kr/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

DCS
dcs-prod-irl1-2-v030-094682b17.edge-irl1.demdex.com UNKNOWN
Pragma
no-cache
content-encoding
gzip
X-Error
172
X-TID
wg24+mfNTCc=
Vary
Origin
P3P
policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Access-Control-Allow-Origin
http://westa.kr
Cache-Control
no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
application/json;charset=utf-8
Content-Length
124
Expires
Thu, 01 Jan 1970 00:00:00 UTC

Redirect headers

DCS
dcs-prod-irl1-1-v030-07266cba8.edge-irl1.demdex.com UNKNOWN
Pragma
no-cache
Access-Control-Allow-Origin
http://westa.kr
X-TID
lACxxifxTds=
Vary
Origin
P3P
policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Location
http://dpm.demdex.net/id/rd?d_visid_ver=3.1.2&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=61834D9B5228A7430A490D45%40AdobeOrg&d_nsid=0&ts=1647641159158
Cache-Control
no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Length
0
Expires
Thu, 01 Jan 1970 00:00:00 UTC
e.gif
nexus.ensighten.com/error/ 		0
193 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://nexus.ensighten.com/error/e.gif?msg=_dl%20is%20not%20defined&lnn=-1&fn=&cid=1129&client=citi&publishPath=na_prod&rid=3092996&did=622672&errorName=ReferenceError
Requested by
Host: westa.kr
URL: http://westa.kr/tag/citi/CITIZ/login/ses/index
Protocol
HTTP/1.1
Server
18.197.253.20 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-18-197-253-20.eu-central-1.compute.amazonaws.com
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
http://westa.kr/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date
Fri, 18 Mar 2022 22:05:59 GMT
Cache-Control
no-cache, no-store
Server
nginx
Connection
keep-alive
Expires
Fri, 18 Mar 2022 22:05:58 GMT
serverComponent.php
nexus.ensighten.com/citi/na_prod/ 		1 KB
857 B 		Script
General
Check archive.org
Download Go to
Full URL
http://nexus.ensighten.com/citi/na_prod/serverComponent.php?r=46.58968193056261&namespace=Bootstrapper&staticJsPath=nexus.ensighten.com/citi/na_prod/code/&publishedOn=Tue%20Jun%2008%2018:03:25%20GMT%202021&ClientID=1129&PageID=http%3A%2F%2Fwesta.kr%2Ftag%2Fciti%2FCITIZ%2Flogin%2Fses%2Findex
Requested by
Host: westa.kr
URL: http://westa.kr/tag/citi/CITIZ/login/ses/js/Bootstrap.js
Protocol
HTTP/1.1
Server
18.197.253.20 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-18-197-253-20.eu-central-1.compute.amazonaws.com
Software
nginx /
Resource Hash
ae11e9263e24c7f48407c28b8b23606a3ad72cacb9ce06e29406c58f07e90f2d

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
http://westa.kr/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date
Fri, 18 Mar 2022 22:05:59 GMT
Content-Encoding
gzip
Server
nginx
Vary
Accept-Encoding
Content-Type
text/javascript
Cache-Control
no-cache, no-store
Transfer-Encoding
chunked
Connection
keep-alive
Expires
Fri, 18 Mar 2022 22:05:58 GMT
id
metrics.citi.com/ 		89 B
1 KB 		XHR
General
Check archive.org
Download Go to
Full URL
http://metrics.citi.com/id?d_visid_ver=3.1.2&d_fieldgroup=MC&mcorgid=61834D9B5228A7430A490D45%40AdobeOrg&ts=1647641159248
Requested by
Host: westa.kr
URL: http://westa.kr/tag/citi/CITIZ/login/ses/js/Bootstrap.js
Protocol
HTTP/1.1
Server
13.36.218.177 Paris, France, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-13-36-218-177.eu-west-3.compute.amazonaws.com
Software
jag /
Resource Hash
76c27beadb7fe5a0ee2f14ac6676c1467a72ecc84a099408e7ba0e1f68e5a936
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
http://westa.kr/
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Content-Type
application/x-www-form-urlencoded

Response headers

date
Fri, 18 Mar 2022 22:05:59 GMT
x-content-type-options
nosniff
server
jag
xserver
anedge-7f6b754cd4-25mg4
vary
Origin
x-c
main-1629.I879dac.M0-556
p3p
CP="This is not a P3P policy"
access-control-allow-origin
http://westa.kr
cache-control
no-cache, no-store, max-age=0, no-transform, private
access-control-allow-credentials
true
content-type
application/x-javascript;charset=utf-8
content-length
89
x-xss-protection
1; mode=block
fdf45a7c15c1cee06bb71e10dac4e26e.js
nexus.ensighten.com/citi/na_prod/code/ 		989 B
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
http://nexus.ensighten.com/citi/na_prod/code/fdf45a7c15c1cee06bb71e10dac4e26e.js?conditionId0=4849963
Requested by
Host: westa.kr
URL: http://westa.kr/tag/citi/CITIZ/login/ses/js/Bootstrap.js
Protocol
HTTP/1.1
Server
18.197.253.20 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-18-197-253-20.eu-central-1.compute.amazonaws.com
Software
nginx /
Resource Hash
7df13706eaab8ce9a3dcd2a501f60bc66987c83834d07dfaf07ae56ef814c110

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
http://westa.kr/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date
Fri, 18 Mar 2022 22:05:59 GMT
Last-Modified
Tue, 14 May 2019 17:01:42 GMT
Server
nginx
ETag
"5cdaf476-3dd"
Content-Type
application/javascript; charset=utf-8
cache-control
max-age=315360000
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
989
da6191c2b2959a15b37bb1f025a35ecd.js
nexus.ensighten.com/citi/na_prod/code/ 		5 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
http://nexus.ensighten.com/citi/na_prod/code/da6191c2b2959a15b37bb1f025a35ecd.js?conditionId0=4897099
Requested by
Host: westa.kr
URL: http://westa.kr/tag/citi/CITIZ/login/ses/js/Bootstrap.js
Protocol
HTTP/1.1
Server
18.197.253.20 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-18-197-253-20.eu-central-1.compute.amazonaws.com
Software
nginx /
Resource Hash
5cbb5852d6dd001b4defb3f6ace7f8beb88d0f19d20d00ebfd086a24c31988db

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
http://westa.kr/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date
Fri, 18 Mar 2022 22:05:59 GMT
Content-Encoding
gzip
Last-Modified
Tue, 01 Mar 2022 18:19:28 GMT
Server
nginx
ETag
W/"621e63b0-12ea"
Vary
Accept-Encoding
Content-Type
application/javascript; charset=utf-8
cache-control
max-age=315360000
Transfer-Encoding
chunked
Connection
keep-alive
557566dc60916e3de69e006bef252459.js
nexus.ensighten.com/citi/na_prod/code/ 		2 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
http://nexus.ensighten.com/citi/na_prod/code/557566dc60916e3de69e006bef252459.js?conditionId0=4837456
Requested by
Host: westa.kr
URL: http://westa.kr/tag/citi/CITIZ/login/ses/js/Bootstrap.js
Protocol
HTTP/1.1
Server
18.197.253.20 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-18-197-253-20.eu-central-1.compute.amazonaws.com
Software
nginx /
Resource Hash
31b00ff4929696dfca06885da68e58c3e09f6ecb4ae0fe1ae287e99a3fd1f716

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
http://westa.kr/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date
Fri, 18 Mar 2022 22:05:59 GMT
Content-Encoding
gzip
Last-Modified
Tue, 27 Aug 2019 16:59:12 GMT
Server
nginx
ETag
W/"5d656160-887"
Vary
Accept-Encoding
Content-Type
application/javascript; charset=utf-8
cache-control
max-age=315360000
Transfer-Encoding
chunked
Connection
keep-alive
a81e05b9f5c7e57b0d80e617030f8bd0.js
nexus.ensighten.com/citi/na_prod/code/ 		157 KB
35 KB 		Script
General
Check archive.org
Download Go to
Full URL
http://nexus.ensighten.com/citi/na_prod/code/a81e05b9f5c7e57b0d80e617030f8bd0.js?conditionId0=421908
Requested by
Host: westa.kr
URL: http://westa.kr/tag/citi/CITIZ/login/ses/js/Bootstrap.js
Protocol
HTTP/1.1
Server
18.197.253.20 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-18-197-253-20.eu-central-1.compute.amazonaws.com
Software
nginx /
Resource Hash
0bcb15216559cb490a994fc29303e9e66b109926890e7d3abfddbbfcef347c8e

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
http://westa.kr/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date
Fri, 18 Mar 2022 22:05:59 GMT
Content-Encoding
gzip
Last-Modified
Wed, 16 Mar 2022 21:07:32 GMT
Server
nginx
ETag
W/"62325194-275e6"
Vary
Accept-Encoding
Content-Type
application/javascript; charset=utf-8
cache-control
max-age=315360000
Transfer-Encoding
chunked
Connection
keep-alive
51aba9f62787efbaa13e53a8d1ae3892.js
nexus.ensighten.com/citi/na_prod/code/ 		1 KB
988 B 		Script
General
Check archive.org
Download Go to
Full URL
http://nexus.ensighten.com/citi/na_prod/code/51aba9f62787efbaa13e53a8d1ae3892.js?conditionId0=4827153
Requested by
Host: westa.kr
URL: http://westa.kr/tag/citi/CITIZ/login/ses/js/Bootstrap.js
Protocol
HTTP/1.1
Server
18.197.253.20 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-18-197-253-20.eu-central-1.compute.amazonaws.com
Software
nginx /
Resource Hash
bf8892a953595eb96b9ca68c5756849d404115dcf2ee9bf87e8b4e7b3cf8e650

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
http://westa.kr/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date
Fri, 18 Mar 2022 22:05:59 GMT
Content-Encoding
gzip
Last-Modified
Tue, 31 Aug 2021 17:19:01 GMT
Server
nginx
ETag
W/"612e6485-52a"
Vary
Accept-Encoding
Content-Type
application/javascript; charset=utf-8
cache-control
max-age=315360000
Transfer-Encoding
chunked
Connection
keep-alive
e047f7a400b1380b9dd4b041c45aed8c.js
nexus.ensighten.com/citi/na_prod/code/ 		133 KB
36 KB 		Script
General
Check archive.org
Download Go to
Full URL
http://nexus.ensighten.com/citi/na_prod/code/e047f7a400b1380b9dd4b041c45aed8c.js?conditionId0=486757
Requested by
Host: westa.kr
URL: http://westa.kr/tag/citi/CITIZ/login/ses/js/Bootstrap.js
Protocol
HTTP/1.1
Server
18.197.253.20 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-18-197-253-20.eu-central-1.compute.amazonaws.com
Software
nginx /
Resource Hash
ffb651309250e9ce8ca4d6a354d9403cb80ec23ef11eebc6d518163948061c82

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
http://westa.kr/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date
Fri, 18 Mar 2022 22:05:59 GMT
Content-Encoding
gzip
Last-Modified
Mon, 07 Mar 2022 18:42:31 GMT
Server
nginx
ETag
W/"62265217-2131c"
Vary
Accept-Encoding
Content-Type
application/javascript; charset=utf-8
cache-control
max-age=315360000
Transfer-Encoding
chunked
Connection
keep-alive
bk-coretag.js
tags.bkrtx.com/js/ 		51 KB
16 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tags.bkrtx.com/js/bk-coretag.js
Requested by
Host: nexus.ensighten.com
URL: http://nexus.ensighten.com/citi/na_prod/code/a81e05b9f5c7e57b0d80e617030f8bd0.js?conditionId0=421908
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.111.228.137 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-111-228-137.deploy.static.akamaitechnologies.com
Software
nginx/1.15.8 /
Resource Hash
88cd43c3f5453f7b4db2cbe884b47db3c8317860a2ce6e9b2bc934ff4b8e32eb
Security Headers
Name Value
Strict-Transport-Security max-age=15724800; includeSubDomains

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
http://westa.kr/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Strict-Transport-Security
max-age=15724800; includeSubDomains
Content-Encoding
gzip
Last-Modified
Fri, 21 May 2021 19:14:21 GMT
Server
nginx/1.15.8
ETag
W/"60a8068d-cbc2"
Vary
Accept-Encoding
Content-Type
application/javascript
Cache-Control
max-age=604800
Date
Fri, 18 Mar 2022 22:05:59 GMT
Connection
keep-alive
Content-Length
16078
Expires
Fri, 25 Mar 2022 22:05:59 GMT
id
dpm.demdex.net/ 		358 B
1022 B 		XHR
General
Check archive.org
Download Go to
Full URL
http://dpm.demdex.net/id?d_visid_ver=3.1.2&d_fieldgroup=AAM&d_rtbd=json&d_ver=2&d_orgid=61834D9B5228A7430A490D45%40AdobeOrg&d_nsid=0&d_mid=22976329610983678840795385483613860264&d_cid_ic=AVID%01311A8123F40E4FD7-400016C67987C367&ts=1647641159301
Requested by
Host: westa.kr
URL: http://westa.kr/tag/citi/CITIZ/login/ses/js/Bootstrap.js
Protocol
HTTP/1.1
Server
52.209.199.204 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-52-209-199-204.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash
595277dafc06f4d0e54be4719a82168f4b9c5b12b145037e5a48427c8a0c92b4

Request headers

Referer
http://westa.kr/
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Content-Type
application/x-www-form-urlencoded

Response headers

DCS
dcs-prod-irl1-1-v030-0d99b628d.edge-irl1.demdex.com UNKNOWN
Pragma
no-cache
content-encoding
gzip
X-TID
TVoHHemMRIE=
Vary
Origin
P3P
policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Access-Control-Allow-Origin
http://westa.kr
Cache-Control
no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
application/json;charset=utf-8
Content-Length
302
Expires
Thu, 01 Jan 1970 00:00:00 UTC
dest5.html
fast.citi.demdex.net/ Frame B418 		7 KB
3 KB 		Document
General
Check archive.org
Download Go to
Full URL
http://fast.citi.demdex.net/dest5.html?d_nsid=0
Requested by
Host: westa.kr
URL: http://westa.kr/tag/citi/CITIZ/login/ses/js/Bootstrap.js
Protocol
HTTP/1.1
Server
2.16.186.82 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a2-16-186-82.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
7bea17a80a61ed0f54248b4ffc4c718f7c8ff2619742577a73591d62ce074da8

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Referer
http://westa.kr/

Response headers

Accept-Ranges
bytes
Content-Type
text/html
ETag
"2c9c2ee145ee280b85a217ad7045fae5:1580750826.437238"
Last-Modified
Mon, 03 Feb 2020 17:27:06 GMT
Server
AkamaiNetStorage
Vary
Accept-Encoding
Content-Encoding
gzip
Cache-Control
max-age=21600
Date
Fri, 18 Mar 2022 22:05:59 GMT
Content-Length
2785
Connection
keep-alive
P3P
policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
demconf.jpg
dpm.demdex.net/
Redirect Chain
  • http://cm.everesttech.net/cm/dd?d_uuid=16036500467722143190192068032901957643
  • https://cm.everesttech.net/cm/dd?d_uuid=16036500467722143190192068032901957643
  • https://dpm.demdex.net/ibs:dpid=411&dpuuid=YjUCRwAAAHUbpAQS
  • https://dpm.demdex.net/demconf.jpg?et:ibs%7cdata:dpid=411&dpuuid=YjUCRwAAAHUbpAQS
42 B
945 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://dpm.demdex.net/demconf.jpg?et:ibs%7cdata:dpid=411&dpuuid=YjUCRwAAAHUbpAQS
Requested by
Host: westa.kr
URL: http://westa.kr/tag/citi/CITIZ/login/ses/index
Protocol
HTTP/1.1
Server
52.209.199.204 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-52-209-199-204.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
http://westa.kr/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

DCS
dcs-prod-irl1-2-v030-0ea54742f.edge-irl1.demdex.com UNKNOWN
Pragma
no-cache
Strict-Transport-Security
max-age=31536000; includeSubDomains
content-encoding
gzip
X-Content-Type-Options
nosniff
X-TID
+YQb9Aw9QT4=
P3P
policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Cache-Control
no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection
keep-alive
Content-Type
image/gif
Content-Length
59
Expires
Thu, 01 Jan 1970 00:00:00 UTC

Redirect headers

DCS
dcs-prod-irl1-1-v030-0f3d654ec.edge-irl1.demdex.com UNKNOWN
Pragma
no-cache
Strict-Transport-Security
max-age=31536000; includeSubDomains
X-TID
K+A6CDSsSOA=
P3P
policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Location
https://dpm.demdex.net/demconf.jpg?et:ibs%7cdata:dpid=411&dpuuid=YjUCRwAAAHUbpAQS
Cache-Control
no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection
keep-alive
Content-Length
0
Expires
Thu, 01 Jan 1970 00:00:00 UTC
json
citicorpcreditservic.tt.omtrdc.net/m2/citicorpcreditservic/mbox/ 		142 B
1 KB 		XHR
General
Check archive.org
Download Go to
Full URL
http://citicorpcreditservic.tt.omtrdc.net/m2/citicorpcreditservic/mbox/json?mbox=target-global-mbox&mboxSession=af2e0e1b5a224693ac4a446660f104b8&mboxPC=&mboxPage=da683cfc58b446b0aa958fc166d0c1a4&mboxRid=093c7abf677043f2a0d9b05a2d4c65dd&mboxVersion=1.7.0&mboxCount=1&mboxTime=1647641159196&mboxHost=westa.kr&mboxURL=http%3A%2F%2Fwesta.kr%2Ftag%2Fciti%2FCITIZ%2Flogin%2Fses%2Findex&mboxReferrer=http%3A%2F%2Fwesta.kr%2Ftag%2Fciti%2FCITIZ%2Flogin%2F&mboxXDomain=enabled&browserHeight=1200&browserWidth=1600&browserTimeOffset=0&screenHeight=1200&screenWidth=1600&colorDepth=24&devicePixelRatio=1&screenOrientation=landscape&webGLRenderer=Intel%20Iris%20OpenGL%20Engine&mboxMCSDID=54CE757C7BCABC11-3120D6D53914D73A&vst.trk=metrics.citi.com&vst.trks=metrics1.citi.com&mboxMCGVID=22976329610983678840795385483613860264&mboxMCAVID=311A8123F40E4FD7-400016C67987C367&mboxAAMB=j8Odv6LonN4r3an7LhD3WZrU1bUpAkFkkiY1ncBR96t2PTI&mboxMCGLH=6
Requested by
Host: westa.kr
URL: http://westa.kr/tag/citi/CITIZ/login/ses/js/Bootstrap.js
Protocol
HTTP/1.1
Server
108.128.22.191 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-108-128-22-191.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash
3a48237fbfe9edaa2d88dd572e3f2a4bb5b542f616c12b94e41dae8825986332

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
http://westa.kr/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Pragma
no-cache
Date
Fri, 18 Mar 2022 22:05:59 GMT
Timing-Allow-Origin
*
Vary
Origin, Access-Control-Request-Method, Access-Control-Request-Headers
P3P
CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Access-Control-Allow-Origin
http://westa.kr
Cache-Control
no-cache
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
application/json;charset=UTF-8
Content-Length
142
X-Request-ID
093c7abf677043f2a0d9b05a2d4c65dd
jamp-spinner-2x.gif
westa.kr/tag/citi/CITIZ/login/ses/css/ 		36 KB
36 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://westa.kr/tag/citi/CITIZ/login/ses/css/jamp-spinner-2x.gif
Requested by
Host: westa.kr
URL: http://westa.kr/tag/citi/CITIZ/login/ses/index
Protocol
HTTP/1.1
Server
192.254.187.108 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US),
Reverse DNS
glamifest.com
Software
Apache /
Resource Hash
79206ccd37edbafc46266406417abb5be984a5d0fb9f38e693d67b6d30cba8bb
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
http://westa.kr/tag/citi/CITIZ/login/ses/index
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date
Fri, 18 Mar 2022 22:05:59 GMT
X-Content-Type-Options
nosniff
Last-Modified
Thu, 10 Jun 2021 05:04:06 GMT
Server
Apache
Content-Type
image/gif
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=73
Content-Length
36855
X-XSS-Protection
1; mode=block
LSO_4959.jpg
westa.kr/tag/citi/CITIZ/login/ses/css/ 		171 KB
171 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://westa.kr/tag/citi/CITIZ/login/ses/css/LSO_4959.jpg
Requested by
Host: westa.kr
URL: http://westa.kr/tag/citi/CITIZ/login/ses/index
Protocol
HTTP/1.1
Server
192.254.187.108 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US),
Reverse DNS
glamifest.com
Software
Apache /
Resource Hash
48e89b7e40e096b89d864a5c8ee340ce44ca60fe9675310ef2f3f40a53a7d593
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
http://westa.kr/tag/citi/CITIZ/login/ses/index
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date
Fri, 18 Mar 2022 22:05:59 GMT
X-Content-Type-Options
nosniff
Last-Modified
Sat, 12 Jun 2021 06:22:08 GMT
Server
Apache
Content-Type
image/jpeg
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=74
Content-Length
174933
X-XSS-Protection
1; mode=block
Citi-Branding-Sprite.png
westa.kr/tag/citi/CITIZ/login/ses/img/ 		746 B
746 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://westa.kr/tag/citi/CITIZ/login/ses/img/Citi-Branding-Sprite.png
Requested by
Host: westa.kr
URL: http://westa.kr/tag/citi/CITIZ/login/ses/index
Protocol
HTTP/1.1
Server
192.254.187.108 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US),
Reverse DNS
glamifest.com
Software
Apache /
Resource Hash
63c52aa99ca361b59a27e7f51fe5fadffef99e671f8b4f9560fab204219e0666

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
http://westa.kr/tag/citi/CITIZ/login/ses/index
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date
Fri, 18 Mar 2022 22:05:59 GMT
Content-Encoding
gzip
Last-Modified
Wed, 13 May 2020 18:19:02 GMT
Server
Apache
Vary
Accept-Encoding
Content-Type
text/html
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=73
Content-Length
462
Appstore-Googleplay-JDPower-Sprite.png
westa.kr/tag/citi/CITIZ/login/ses/css/ 		44 KB
44 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://westa.kr/tag/citi/CITIZ/login/ses/css/Appstore-Googleplay-JDPower-Sprite.png
Requested by
Host: westa.kr
URL: http://westa.kr/tag/citi/CITIZ/login/ses/index
Protocol
HTTP/1.1
Server
192.254.187.108 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US),
Reverse DNS
glamifest.com
Software
Apache /
Resource Hash
b8e446605f92c29a178dd6494688103ac268004592afe06643df46f4bff68577
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
http://westa.kr/tag/citi/CITIZ/login/ses/index
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date
Fri, 18 Mar 2022 22:05:59 GMT
X-Content-Type-Options
nosniff
Last-Modified
Thu, 10 Jun 2021 05:03:44 GMT
Server
Apache
Content-Type
image/png
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=73
Content-Length
44996
X-XSS-Protection
1; mode=block
social-media_facebook@3x.png
westa.kr/tag/citi/CITIZ/login/ses/css/ 		445 B
752 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://westa.kr/tag/citi/CITIZ/login/ses/css/social-media_facebook@3x.png
Requested by
Host: westa.kr
URL: http://westa.kr/tag/citi/CITIZ/login/ses/index
Protocol
HTTP/1.1
Server
192.254.187.108 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US),
Reverse DNS
glamifest.com
Software
Apache /
Resource Hash
695788dc05d94be3b32060ffea15c1a4d74897bd32e5da7811e7ca76d82fc86b
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
http://westa.kr/tag/citi/CITIZ/login/ses/index
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date
Fri, 18 Mar 2022 22:05:59 GMT
X-Content-Type-Options
nosniff
Last-Modified
Thu, 10 Jun 2021 05:03:54 GMT
Server
Apache
Content-Type
image/png
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=72
Content-Length
445
X-XSS-Protection
1; mode=block
social-media_twitter@3x.png
westa.kr/tag/citi/CITIZ/login/ses/css/ 		1 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://westa.kr/tag/citi/CITIZ/login/ses/css/social-media_twitter@3x.png
Requested by
Host: westa.kr
URL: http://westa.kr/tag/citi/CITIZ/login/ses/index
Protocol
HTTP/1.1
Server
192.254.187.108 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US),
Reverse DNS
glamifest.com
Software
Apache /
Resource Hash
5394d11ec8ad7a5494bcdb65cd95f885388532e14fb45a747e249112389bd837
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
http://westa.kr/tag/citi/CITIZ/login/ses/index
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date
Fri, 18 Mar 2022 22:05:59 GMT
X-Content-Type-Options
nosniff
Last-Modified
Thu, 10 Jun 2021 05:03:56 GMT
Server
Apache
Content-Type
image/png
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=73
Content-Length
1277
X-XSS-Protection
1; mode=block
social-media_youtube@3x.png
westa.kr/tag/citi/CITIZ/login/ses/css/ 		1 KB
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://westa.kr/tag/citi/CITIZ/login/ses/css/social-media_youtube@3x.png
Requested by
Host: westa.kr
URL: http://westa.kr/tag/citi/CITIZ/login/ses/index
Protocol
HTTP/1.1
Server
192.254.187.108 , United States, ASN46606 (UNIFIEDLAYER-AS-1, US),
Reverse DNS
glamifest.com
Software
Apache /
Resource Hash
be9b5382b4526ffd3306d0292122ce3599123f1cd543f52f3035b4f24fbf9de8
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
http://westa.kr/tag/citi/CITIZ/login/ses/index
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date
Fri, 18 Mar 2022 22:05:59 GMT
X-Content-Type-Options
nosniff
Last-Modified
Thu, 10 Jun 2021 05:03:58 GMT
Server
Apache
Content-Type
image/png
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=73
Content-Length
1175
X-XSS-Protection
1; mode=block
embed.js
resources.digital-cloud-citi.medallia.com/wdcusciti/50/onsite/ 		2 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://resources.digital-cloud-citi.medallia.com/wdcusciti/50/onsite/embed.js
Requested by
Host: nexus.ensighten.com
URL: http://nexus.ensighten.com/citi/na_prod/code/fdf45a7c15c1cee06bb71e10dac4e26e.js?conditionId0=4849963
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.2.133 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
b5d1c26722742c44e62a4fbb4b67117d2587aa320f61784a27fea9d66d9f62b4

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
http://westa.kr/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

x-amz-version-id
7ZFGbm5gfkxV.pQuBY8LWu5zWeTQ0IFs
content-encoding
gzip
etag
"a698e80bc62ebcae5d8ef95ef0d2804d"
age
81461
via
1.1 varnish
x-cache
HIT
content-length
675
x-amz-id-2
1XLSeoD4keLyBShD19j9JKoeR5e3nLPzbAPB+lRsD0fOonUG8J6mykBjsS8p324xZzokDI5OIUk=
x-served-by
cache-hhn4026-HHN
last-modified
Fri, 25 Feb 2022 18:17:26 GMT
server
AmazonS3
x-timer
S1647641160.108791,VS0,VE0
date
Fri, 18 Mar 2022 22:06:00 GMT
vary
Accept-Encoding
x-amz-request-id
1G43Y9X616R781AH
access-control-allow-origin
*
cache-control
max-age=0,must-revalidate
accept-ranges
bytes
content-type
application/javascript
x-cache-hits
2
1560.js
cdn.pbbl.co/r/ 		0
0 		Script
General
Check archive.org
Download Go to
Full URL
http://cdn.pbbl.co/r/1560.js
Requested by
Host: nexus.ensighten.com
URL: http://nexus.ensighten.com/citi/na_prod/code/da6191c2b2959a15b37bb1f025a35ecd.js?conditionId0=4897099
Protocol
HTTP/1.1
Server
143.204.98.10 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-98-10.fra50.r.cloudfront.net
Software
/
Resource Hash

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
http://westa.kr/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers
js
www.googletagmanager.com/gtag/
Redirect Chain
  • http://www.googletagmanager.com/gtag/js?id=AW-916451471
  • https://www.googletagmanager.com/gtag/js?id=AW-916451471
99 KB
40 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagmanager.com/gtag/js?id=AW-916451471
Protocol
H2
Server
2a00:1450:4001:813::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
ae4cde03e8b860c6ed777a95889f773efed0acb027cfd2fc21033c5111e05230
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
http://westa.kr/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date
Fri, 18 Mar 2022 22:06:00 GMT
content-encoding
br
vary
Accept-Encoding
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
40272
x-xss-protection
0
last-modified
Fri, 18 Mar 2022 21:11:44 GMT
server
Google Tag Manager
strict-transport-security
max-age=31536000; includeSubDomains
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
access-control-allow-headers
Cache-Control
expires
Fri, 18 Mar 2022 22:06:00 GMT

Redirect headers

Location
https://www.googletagmanager.com/gtag/js?id=AW-916451471
Date
Fri, 18 Mar 2022 22:06:00 GMT
Cross-Origin-Resource-Policy
cross-origin
Server
Google Tag Manager
Content-Length
253
X-XSS-Protection
0
Content-Type
text/html; charset=UTF-8
63068
stags.bluekai.com/site/ Frame A484 		71 B
338 B 		Document
General
Check archive.org
Download Go to
Full URL
https://stags.bluekai.com/site/63068?ret=html&phint=language&phint=product&phint=event&phint=category&phint=page&phint=section1&phint=section2&phint=section3&phint=section4&phint=bankappstatus&phint=productID&phint=__bk_t%3DSign%20On%20to%20Your%20Citi%20Account%20-%20Citibank&phint=__bk_k%3D&phint=__bk_pr%3Dhttp%3A%2F%2Fwesta.kr%2Ftag%2Fciti%2FCITIZ%2Flogin%2F&phint=__bk_l%3Dhttp%3A%2F%2Fwesta.kr%2Ftag%2Fciti%2FCITIZ%2Flogin%2Fses%2Findex&phint=__bk_v%3D3.1.10&limit=10&r=68279188
Requested by
Host: tags.bkrtx.com
URL: https://tags.bkrtx.com/js/bk-coretag.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
104.111.215.191 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-111-215-191.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
53350525edba0b889e87ea52a16ed843a928a2557e9f8d6747acd7ff991c95c3

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Referer
http://westa.kr/

Response headers

Content-Type
text/html
Content-Length
71
P3P
CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV", policyref="http://tags.bluekai.com/w3c/p3p.xml"
BK-Server
7dbe
Date
Fri, 18 Mar 2022 22:06:00 GMT
Connection
keep-alive
X-N
S
generic1645813044147.js
resources.digital-cloud-citi.medallia.com/wdcusciti/50/onsite/ 		532 KB
88 KB 		Script
General
Check archive.org
Download Go to
Full URL
http://resources.digital-cloud-citi.medallia.com/wdcusciti/50/onsite/generic1645813044147.js
Requested by
Host: resources.digital-cloud-citi.medallia.com
URL: https://resources.digital-cloud-citi.medallia.com/wdcusciti/50/onsite/embed.js
Protocol
HTTP/1.1
Server
151.101.2.133 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
05a45e5c705e5fa8b22c243d3461520e64f75236b702335764bed044e763e25e

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
http://westa.kr/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

x-amz-version-id
n9np7L1i8NPYVmXlDkA6OOYu.Ggu5g4q
Content-Encoding
gzip
ETag
"b6b583d1c21fe708664599f47fe6d042"
Age
80133
Via
1.1 varnish
X-Cache
HIT
Connection
keep-alive
Content-Length
89444
x-amz-id-2
1if0wswQ9/02sNnPV9vfeWjFhz1ZxKs3bUc8lqlSgJ703gKZilSlz37bHV3PrJV07Ecpz1CTyts=
X-Served-By
cache-hhn4036-HHN
Last-Modified
Fri, 25 Feb 2022 18:17:26 GMT
Server
AmazonS3
X-Timer
S1647641160.122822,VS0,VE0
Date
Fri, 18 Mar 2022 22:06:00 GMT
Vary
Accept-Encoding
x-amz-request-id
D15YCVR45X4PJ69F
Access-Control-Allow-Origin
*
Cache-Control
max-age=0,must-revalidate
Accept-Ranges
bytes
Content-Type
application/javascript
X-Cache-Hits
19
cool-2.1.15.min.js
nebula-cdn.kampyle.com/resources/onsite/js/ 		14 KB
6 KB 		Script
General
Check archive.org
Download Go to
Full URL
http://nebula-cdn.kampyle.com/resources/onsite/js/cool-2.1.15.min.js
Requested by
Host: resources.digital-cloud-citi.medallia.com
URL: http://resources.digital-cloud-citi.medallia.com/wdcusciti/50/onsite/generic1645813044147.js
Protocol
HTTP/1.1
Server
151.101.129.175 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
3e72de5de67d6d80b65a114af684eaf880c53c250155a663cb17d677ff064bc1

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
http://westa.kr/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

x-amz-version-id
9HCXbKZTbCJZkS8s9IuB.pE0JEvI0TGW
Content-Encoding
gzip
ETag
"80dd5e3be5152c5c72d552c6a26ef6ff"
Age
81543
Via
1.1 varnish
X-Cache
HIT
Connection
keep-alive
Content-Length
5197
x-amz-id-2
cv5VPIGCLLcXtswk37oaFl4fBbweUeVQHYrMuBMn+c9sgiGiJKp9+J3PzqI9Db3Up4e5W4lD9Ko=
X-Served-By
cache-hhn4025-HHN
Last-Modified
Sun, 24 Jan 2021 11:03:10 GMT
Server
AmazonS3
X-Timer
S1647641160.161810,VS0,VE0
Date
Fri, 18 Mar 2022 22:06:00 GMT
Vary
Accept-Encoding
x-amz-request-id
TJ8QGVFCE6QYVTNF
Access-Control-Allow-Origin
*
Cache-Control
max-age=31622400
Accept-Ranges
bytes
Content-Type
application/javascript
X-Cache-Hits
5526
__cool.gif
udc-neb.kampyle.com/egw/5/qceuv8449dzg58ptt1bhda9g8ue19c7s/track/ 		0
487 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
http://udc-neb.kampyle.com/egw/5/qceuv8449dzg58ptt1bhda9g8ue19c7s/track/__cool.gif?data=eyJldmVudHMiOiBbCiAgICB7InNlc3Npb25fc2NyZWVuX3NpemUiOiAiMTYwMHgxMjAwIiwic2Vzc2lvbl9kdWEiOiAiTW96aWxsYS81LjAgKFdpbmRvd3MgTlQgMTAuMDsgV2luNjQ7IHg2NCkgQXBwbGVXZWJLaXQvNTM3LjM2IChLSFRNTCwgbGlrZSBHZWNrbykgQ2hyb21lLzk5LjAuNDg0NC41MSBTYWZhcmkvNTM3LjM2Iiwic2Vzc2lvbl9wbGF0Zm9ybSI6ICJMaW51eCB4ODZfNjQiLCJyZWZlcnJpbmdfdXJsIjogImh0dHA6Ly93ZXN0YS5rci90YWcvY2l0aS9DSVRJWi9sb2dpbi8iLCJyZWZlcnJpbmdfZG9tYWluIjogIndlc3RhLmtyIiwidHJhY2tlcl90eXBlIjogImphdmFzY3JpcHQiLCJ0cmFja2VyX3ZlcnNpb24iOiAiMi4xLjE1IiwiZXZlbnRfbmFtZSI6ICJuZWJ1bGFfcGFnZV92aWV3IiwiZXZlbnRfdGltZXN0YW1wX2Vwb2NoIjogIjE2NDc2NDExNjAxNzQiLCJldmVudF90aW1lem9uZV9vZmZzZXQiOiAwLCJ1c2VyX2lkIjogIjE3ZjlmMTBlOWVjN2NkLTA4MmU2ZDVjZmFiYzdlLTk3NzE3M2MtMWQ0YzAwLTE3ZjlmMTBlOWVkYjQ4IiwiZW52aXJvbWVudCI6ICJkaWdpdGFsLWNsb3VkLXVzLWNpdGkiLCJhY2NvdW50SWQiOiA0OSwidXJsIjogImh0dHA6Ly93ZXN0YS5rci90YWcvY2l0aS9DSVRJWi9sb2dpbi9zZXMvaW5kZXgiLCJ3ZWJzaXRlSWQiOiA1MCwiZm9ybUlkIjogbnVsbCwiZm9ybVRyaWdnZXJUeXBlIjogbnVsbCwia2FtcHlsZV9kYXRhIjogeyJMQVNUX0lOVklUQVRJT05fVklFVyI6ICIiLCJERUNMSU5FRF9EQVRFIjogIiIsImthbXB5bGVJbnZpdGVQcmVzZW50ZWQiOiAiIiwia2FtcHlsZV91c2VyaWQiOiAiM2NmMS00ZTFlLTZjZjMtNmIwMy1mOTE2LTFjZGItZGJiNy1iZTg0Iiwia2FtcHlsZVVzZXJTZXNzaW9uIjogIjE2NDc2NDExNjAxNTgiLCJrYW1weWxlVXNlclBlcmNlbnRpbGUiOiAiIiwiU1VCTUlUVEVEX0RBVEUiOiAiIn0sImNvb2tpZV9zaXplIjogODQzLCJrYW1weWxlX3ZlcnNpb24iOiAiMi40Mi4xIiwib25zaXRlX3ZlcnNpb24iOiAiMi40Mi4xIiwiaGlzdG9yeV9sZW5ndGgiOiAyLCJldmVudF9sb2NhbF90aW1lc3RhbXAiOiAxNjQ3NjQxMTYwMTYwLCJwb3NpdGlvbiI6IG51bGwsImlzVXNlcklkZW50aWZpZWQiOiBmYWxzZSwiZmVlZGJhY2tfY29ycmVsYXRpb25fdXVpZCI6IG51bGx9Cl19
Protocol
HTTP/1.1
Server
35.241.45.82 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
82.45.241.35.bc.googleusercontent.com
Software
Jetty(9.2.11.v20150529) /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
http://westa.kr/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

X-ME
prod-instance-gatewayservice-green-229v
Date
Fri, 18 Mar 2022 22:06:00 GMT
Via
1.1 google
Server
Jetty(9.2.11.v20150529)
Access-Control-Max-Age
1800
Access-Control-Allow-Methods
GET, POST, PUT, DELETE
Content-Type
image/gif; charset=UTF-8
Access-Control-Allow-Origin
*
Access-Control-Allow-Credentials
true
Access-Control-Allow-Headers
X-Requested-With, Origin, Content-Type, Accept
Content-Length
0
X-Application-Context
application:9090
conversion_async.js
www.googleadservices.com/pagead/ 		39 KB
15 KB 		Script
General
Check archive.org
Download Go to
Full URL
http://www.googleadservices.com/pagead/conversion_async.js
Requested by
Host: www.googletagmanager.com
URL: http://www.googletagmanager.com/gtag/js?id=AW-916451471
Protocol
HTTP/1.1
Server
142.250.179.130 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
ams17s10-in-f2.1e100.net
Software
cafe /
Resource Hash
b872b4ad2e649961fbf3cdc43966716bd820301634adebaf5329c1aa22a1f7ee
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
http://westa.kr/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Timing-Allow-Origin
*
Date
Fri, 18 Mar 2022 22:06:00 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Server
cafe
ETag
11178597599353190569
Vary
Accept-Encoding
P3P
policyref="http://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
Cache-Control
private, max-age=3600
Cross-Origin-Resource-Policy
cross-origin
Content-Disposition
attachment; filename="f.txt"
Content-Type
text/javascript; charset=UTF-8
Content-Length
14889
X-XSS-Protection
0
Expires
Fri, 18 Mar 2022 22:06:00 GMT
js
www.googletagmanager.com/gtag/
Redirect Chain
  • http://www.googletagmanager.com/gtag/js?id=AW-960621875&l=dataLayer&cx=c
  • https://www.googletagmanager.com/gtag/js?id=AW-960621875&l=dataLayer&cx=c
99 KB
39 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagmanager.com/gtag/js?id=AW-960621875&l=dataLayer&cx=c
Protocol
H2
Server
2a00:1450:4001:813::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
5966b6aeb23d10276c684f5312ae71a86a480582d77ffefc0e030170c9e3f026
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
http://westa.kr/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date
Fri, 18 Mar 2022 22:06:00 GMT
content-encoding
br
vary
Accept-Encoding
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
40272
x-xss-protection
0
last-modified
Fri, 18 Mar 2022 21:11:44 GMT
server
Google Tag Manager
strict-transport-security
max-age=31536000; includeSubDomains
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
access-control-allow-headers
Cache-Control
expires
Fri, 18 Mar 2022 22:06:00 GMT

Redirect headers

Location
https://www.googletagmanager.com/gtag/js?id=AW-960621875&l=dataLayer&cx=c
Non-Authoritative-Reason
HSTS
Cross-Origin-Resource-Policy
Cross-Origin
js
www.googletagmanager.com/gtag/
Redirect Chain
  • http://www.googletagmanager.com/gtag/js?id=AW-644574043&l=dataLayer&cx=c
  • https://www.googletagmanager.com/gtag/js?id=AW-644574043&l=dataLayer&cx=c
99 KB
39 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagmanager.com/gtag/js?id=AW-644574043&l=dataLayer&cx=c
Protocol
H2
Server
2a00:1450:4001:813::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
d5ed7adcad9936bb2b4192b4240be86211845f007f5d2feef8e6afb440f88582
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
http://westa.kr/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date
Fri, 18 Mar 2022 22:06:00 GMT
content-encoding
br
vary
Accept-Encoding
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
40339
x-xss-protection
0
last-modified
Fri, 18 Mar 2022 21:11:44 GMT
server
Google Tag Manager
strict-transport-security
max-age=31536000; includeSubDomains
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
access-control-allow-headers
Cache-Control
expires
Fri, 18 Mar 2022 22:06:00 GMT

Redirect headers

Location
https://www.googletagmanager.com/gtag/js?id=AW-644574043&l=dataLayer&cx=c
Non-Authoritative-Reason
HSTS
Cross-Origin-Resource-Policy
Cross-Origin
js
www.googletagmanager.com/gtag/
Redirect Chain
  • http://www.googletagmanager.com/gtag/js?id=AW-975701947&l=dataLayer&cx=c
  • https://www.googletagmanager.com/gtag/js?id=AW-975701947&l=dataLayer&cx=c
100 KB
40 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagmanager.com/gtag/js?id=AW-975701947&l=dataLayer&cx=c
Protocol
H2
Server
2a00:1450:4001:813::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
00b1e23a8e553c077da0717e9673f07e824e21a8bfc326c4e639ec9dc5a8b3cd
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
http://westa.kr/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date
Fri, 18 Mar 2022 22:06:00 GMT
content-encoding
br
vary
Accept-Encoding
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
40433
x-xss-protection
0
last-modified
Fri, 18 Mar 2022 21:11:44 GMT
server
Google Tag Manager
strict-transport-security
max-age=31536000; includeSubDomains
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
access-control-allow-headers
Cache-Control
expires
Fri, 18 Mar 2022 22:06:00 GMT

Redirect headers

Location
https://www.googletagmanager.com/gtag/js?id=AW-975701947&l=dataLayer&cx=c
Non-Authoritative-Reason
HSTS
Cross-Origin-Resource-Policy
Cross-Origin
js
www.googletagmanager.com/gtag/
Redirect Chain
  • http://www.googletagmanager.com/gtag/js?id=AW-830907969&l=dataLayer&cx=c
  • https://www.googletagmanager.com/gtag/js?id=AW-830907969&l=dataLayer&cx=c
99 KB
39 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagmanager.com/gtag/js?id=AW-830907969&l=dataLayer&cx=c
Protocol
H2
Server
2a00:1450:4001:813::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
2f7afa871ed143da7d10f7e155b347ffd704d17f3fd39f6b977efb2d56a4ab09
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
http://westa.kr/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date
Fri, 18 Mar 2022 22:06:00 GMT
content-encoding
br
vary
Accept-Encoding
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
40250
x-xss-protection
0
last-modified
Fri, 18 Mar 2022 21:11:44 GMT
server
Google Tag Manager
strict-transport-security
max-age=31536000; includeSubDomains
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
access-control-allow-headers
Cache-Control
expires
Fri, 18 Mar 2022 22:06:00 GMT

Redirect headers

Location
https://www.googletagmanager.com/gtag/js?id=AW-830907969&l=dataLayer&cx=c
Non-Authoritative-Reason
HSTS
Cross-Origin-Resource-Policy
Cross-Origin
js
www.googletagmanager.com/gtag/
Redirect Chain
  • http://www.googletagmanager.com/gtag/js?id=AW-695231162&l=dataLayer&cx=c
  • https://www.googletagmanager.com/gtag/js?id=AW-695231162&l=dataLayer&cx=c
99 KB
39 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagmanager.com/gtag/js?id=AW-695231162&l=dataLayer&cx=c
Protocol
H2
Server
2a00:1450:4001:813::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
d1c8d325f94a3ab60a2af54f2c8ab94e486e79e5c503eed5b8c3d89eb7f6756c
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
http://westa.kr/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date
Fri, 18 Mar 2022 22:06:00 GMT
content-encoding
br
vary
Accept-Encoding
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
40276
x-xss-protection
0
last-modified
Fri, 18 Mar 2022 21:11:44 GMT
server
Google Tag Manager
strict-transport-security
max-age=31536000; includeSubDomains
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
access-control-allow-headers
Cache-Control
expires
Fri, 18 Mar 2022 22:06:00 GMT

Redirect headers

Location
https://www.googletagmanager.com/gtag/js?id=AW-695231162&l=dataLayer&cx=c
Non-Authoritative-Reason
HSTS
Cross-Origin-Resource-Policy
Cross-Origin
js
www.googletagmanager.com/gtag/
Redirect Chain
  • http://www.googletagmanager.com/gtag/js?id=AW-819500023&l=dataLayer&cx=c
  • https://www.googletagmanager.com/gtag/js?id=AW-819500023&l=dataLayer&cx=c
99 KB
39 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagmanager.com/gtag/js?id=AW-819500023&l=dataLayer&cx=c
Protocol
H2
Server
2a00:1450:4001:813::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
cfc828883897e41063f161803efb8130b4892d73bef3252fafda30b3940eba87
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
http://westa.kr/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date
Fri, 18 Mar 2022 22:06:00 GMT
content-encoding
br
vary
Accept-Encoding
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
40251
x-xss-protection
0
last-modified
Fri, 18 Mar 2022 21:11:44 GMT
server
Google Tag Manager
strict-transport-security
max-age=31536000; includeSubDomains
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
access-control-allow-headers
Cache-Control
expires
Fri, 18 Mar 2022 22:06:00 GMT

Redirect headers

Location
https://www.googletagmanager.com/gtag/js?id=AW-819500023&l=dataLayer&cx=c
Non-Authoritative-Reason
HSTS
Cross-Origin-Resource-Policy
Cross-Origin
js
www.googletagmanager.com/gtag/
Redirect Chain
  • http://www.googletagmanager.com/gtag/js?id=AW-959299794&l=dataLayer&cx=c
  • https://www.googletagmanager.com/gtag/js?id=AW-959299794&l=dataLayer&cx=c
99 KB
39 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagmanager.com/gtag/js?id=AW-959299794&l=dataLayer&cx=c
Protocol
H3
Server
2a00:1450:4001:813::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
ee52ac49330e6b2e93341ce879001f2754aeba6b618435e227ef9fc916166ddf
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
http://westa.kr/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date
Fri, 18 Mar 2022 22:06:00 GMT
content-encoding
br
vary
Accept-Encoding
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
40254
x-xss-protection
0
last-modified
Fri, 18 Mar 2022 21:11:44 GMT
server
Google Tag Manager
strict-transport-security
max-age=31536000; includeSubDomains
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
access-control-allow-headers
Cache-Control
expires
Fri, 18 Mar 2022 22:06:00 GMT

Redirect headers

Location
https://www.googletagmanager.com/gtag/js?id=AW-959299794&l=dataLayer&cx=c
Non-Authoritative-Reason
HSTS
Cross-Origin-Resource-Policy
Cross-Origin
/
googleads.g.doubleclick.net/pagead/viewthroughconversion/916451471/ 		2 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://googleads.g.doubleclick.net/pagead/viewthroughconversion/916451471/?random=1647641160414&cv=9&fst=1647641160414&num=1&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa3e0&sendb=1&ig=1&data=event%3Dgtag.config&frm=0&url=http%3A%2F%2Fwesta.kr%2Ftag%2Fciti%2FCITIZ%2Flogin%2Fses%2Findex&ref=http%3A%2F%2Fwesta.kr%2Ftag%2Fciti%2FCITIZ%2Flogin%2F&tiba=Sign%20On%20to%20Your%20Citi%20Account%20-%20Citibank&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4
Requested by
Host: www.googleadservices.com
URL: http://www.googleadservices.com/pagead/conversion_async.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
47e7e2742d2c079365535ac4ee3b7114b94829daacef3009ba223099cbc3e372
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
http://westa.kr/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 18 Mar 2022 22:06:00 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
content-type
text/javascript; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
1069
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
conversion_async.js
www.googleadservices.com/pagead/ 		39 KB
15 KB 		Script
General
Check archive.org
Download Go to
Full URL
http://www.googleadservices.com/pagead/conversion_async.js
Requested by
Host: www.googletagmanager.com
URL: http://www.googletagmanager.com/gtag/js?id=AW-960621875&l=dataLayer&cx=c
Protocol
HTTP/1.1
Server
142.250.179.130 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
ams17s10-in-f2.1e100.net
Software
cafe /
Resource Hash
b872b4ad2e649961fbf3cdc43966716bd820301634adebaf5329c1aa22a1f7ee
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
http://westa.kr/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Timing-Allow-Origin
*
Date
Fri, 18 Mar 2022 22:06:00 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Server
cafe
ETag
11178597599353190569
Vary
Accept-Encoding
P3P
policyref="http://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
Cache-Control
private, max-age=3600
Cross-Origin-Resource-Policy
cross-origin
Content-Disposition
attachment; filename="f.txt"
Content-Type
text/javascript; charset=UTF-8
Content-Length
14889
X-XSS-Protection
0
Expires
Fri, 18 Mar 2022 22:06:00 GMT
/
googleads.g.doubleclick.net/pagead/viewthroughconversion/975701947/ 		2 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://googleads.g.doubleclick.net/pagead/viewthroughconversion/975701947/?random=1647641160514&cv=9&fst=1647641160514&num=1&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa3e0&sendb=1&ig=1&data=event%3Dgtag.config&frm=0&url=http%3A%2F%2Fwesta.kr%2Ftag%2Fciti%2FCITIZ%2Flogin%2Fses%2Findex&ref=http%3A%2F%2Fwesta.kr%2Ftag%2Fciti%2FCITIZ%2Flogin%2F&tiba=Sign%20On%20to%20Your%20Citi%20Account%20-%20Citibank&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4
Requested by
Host: www.googleadservices.com
URL: http://www.googleadservices.com/pagead/conversion_async.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
8427a91aa93af0f15ace8559ea73cba7b7a2c411c2bb1b5156e2ecdf80d60a42
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
http://westa.kr/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 18 Mar 2022 22:06:00 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
content-type
text/javascript; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
1069
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
googleads.g.doubleclick.net/pagead/viewthroughconversion/960621875/ 		2 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://googleads.g.doubleclick.net/pagead/viewthroughconversion/960621875/?random=1647641160515&cv=9&fst=1647641160515&num=1&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa3e0&sendb=1&ig=1&data=event%3Dgtag.config&frm=0&url=http%3A%2F%2Fwesta.kr%2Ftag%2Fciti%2FCITIZ%2Flogin%2Fses%2Findex&ref=http%3A%2F%2Fwesta.kr%2Ftag%2Fciti%2FCITIZ%2Flogin%2F&tiba=Sign%20On%20to%20Your%20Citi%20Account%20-%20Citibank&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4
Requested by
Host: www.googleadservices.com
URL: http://www.googleadservices.com/pagead/conversion_async.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
9e67ca98b0fa8ef66fa9732f580cdd82cd56c0ab33ec90097def5e9803f1bc23
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
http://westa.kr/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 18 Mar 2022 22:06:00 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
content-type
text/javascript; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
1071
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
googleads.g.doubleclick.net/pagead/viewthroughconversion/644574043/ 		2 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://googleads.g.doubleclick.net/pagead/viewthroughconversion/644574043/?random=1647641160516&cv=9&fst=1647641160516&num=1&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa3e0&sendb=1&ig=1&data=event%3Dgtag.config&frm=0&url=http%3A%2F%2Fwesta.kr%2Ftag%2Fciti%2FCITIZ%2Flogin%2Fses%2Findex&ref=http%3A%2F%2Fwesta.kr%2Ftag%2Fciti%2FCITIZ%2Flogin%2F&tiba=Sign%20On%20to%20Your%20Citi%20Account%20-%20Citibank&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4
Requested by
Host: www.googleadservices.com
URL: http://www.googleadservices.com/pagead/conversion_async.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
9d096ccdc4ddb85804f1c08555b2243800916c9c6d54d93803c97ad961ef8b83
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
http://westa.kr/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 18 Mar 2022 22:06:00 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
content-type
text/javascript; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
1071
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
conversion_async.js
www.googleadservices.com/pagead/ 		39 KB
15 KB 		Script
General
Check archive.org
Download Go to
Full URL
http://www.googleadservices.com/pagead/conversion_async.js
Requested by
Host: www.googletagmanager.com
URL: http://www.googletagmanager.com/gtag/js?id=AW-830907969&l=dataLayer&cx=c
Protocol
HTTP/1.1
Server
142.250.179.130 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
ams17s10-in-f2.1e100.net
Software
cafe /
Resource Hash
b872b4ad2e649961fbf3cdc43966716bd820301634adebaf5329c1aa22a1f7ee
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
http://westa.kr/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Timing-Allow-Origin
*
Date
Fri, 18 Mar 2022 22:06:00 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Server
cafe
ETag
11178597599353190569
Vary
Accept-Encoding
P3P
policyref="http://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
Cache-Control
private, max-age=3600
Cross-Origin-Resource-Policy
cross-origin
Content-Disposition
attachment; filename="f.txt"
Content-Type
text/javascript; charset=UTF-8
Content-Length
14889
X-XSS-Protection
0
Expires
Fri, 18 Mar 2022 22:06:00 GMT
/
www.google.com/pagead/1p-user-list/916451471/ 		42 B
108 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.com/pagead/1p-user-list/916451471/?random=1647641160414&cv=9&fst=1647640800000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa3e0&sendb=1&data=event%3Dgtag.config&frm=0&url=http%3A%2F%2Fwesta.kr%2Ftag%2Fciti%2FCITIZ%2Flogin%2Fses%2Findex&ref=http%3A%2F%2Fwesta.kr%2Ftag%2Fciti%2FCITIZ%2Flogin%2F&tiba=Sign%20On%20to%20Your%20Citi%20Account%20-%20Citibank&async=1&fmt=3&is_vtc=1&random=3831342279&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:811::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
http://westa.kr/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 18 Mar 2022 22:06:00 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
content-security-policy
script-src 'none'; object-src 'none'
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
www.google.de/pagead/1p-user-list/916451471/ 		42 B
108 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.de/pagead/1p-user-list/916451471/?random=1647641160414&cv=9&fst=1647640800000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa3e0&sendb=1&data=event%3Dgtag.config&frm=0&url=http%3A%2F%2Fwesta.kr%2Ftag%2Fciti%2FCITIZ%2Flogin%2Fses%2Findex&ref=http%3A%2F%2Fwesta.kr%2Ftag%2Fciti%2FCITIZ%2Flogin%2F&tiba=Sign%20On%20to%20Your%20Citi%20Account%20-%20Citibank&async=1&fmt=3&is_vtc=1&random=3831342279&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
http://westa.kr/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 18 Mar 2022 22:06:00 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
content-security-policy
script-src 'none'; object-src 'none'
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
www.google.com/pagead/1p-user-list/975701947/ 		42 B
548 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.com/pagead/1p-user-list/975701947/?random=1647641160514&cv=9&fst=1647640800000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa3e0&sendb=1&data=event%3Dgtag.config&frm=0&url=http%3A%2F%2Fwesta.kr%2Ftag%2Fciti%2FCITIZ%2Flogin%2Fses%2Findex&ref=http%3A%2F%2Fwesta.kr%2Ftag%2Fciti%2FCITIZ%2Flogin%2F&tiba=Sign%20On%20to%20Your%20Citi%20Account%20-%20Citibank&async=1&fmt=3&is_vtc=1&random=190671373&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:811::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
http://westa.kr/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 18 Mar 2022 22:06:00 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
content-security-policy
script-src 'none'; object-src 'none'
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
www.google.de/pagead/1p-user-list/975701947/ 		42 B
108 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.de/pagead/1p-user-list/975701947/?random=1647641160514&cv=9&fst=1647640800000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa3e0&sendb=1&data=event%3Dgtag.config&frm=0&url=http%3A%2F%2Fwesta.kr%2Ftag%2Fciti%2FCITIZ%2Flogin%2Fses%2Findex&ref=http%3A%2F%2Fwesta.kr%2Ftag%2Fciti%2FCITIZ%2Flogin%2F&tiba=Sign%20On%20to%20Your%20Citi%20Account%20-%20Citibank&async=1&fmt=3&is_vtc=1&random=190671373&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
http://westa.kr/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 18 Mar 2022 22:06:00 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
content-security-policy
script-src 'none'; object-src 'none'
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
www.google.com/pagead/1p-user-list/960621875/ 		42 B
108 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.com/pagead/1p-user-list/960621875/?random=1647641160515&cv=9&fst=1647640800000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa3e0&sendb=1&data=event%3Dgtag.config&frm=0&url=http%3A%2F%2Fwesta.kr%2Ftag%2Fciti%2FCITIZ%2Flogin%2Fses%2Findex&ref=http%3A%2F%2Fwesta.kr%2Ftag%2Fciti%2FCITIZ%2Flogin%2F&tiba=Sign%20On%20to%20Your%20Citi%20Account%20-%20Citibank&async=1&fmt=3&is_vtc=1&random=3470636520&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:811::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
http://westa.kr/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 18 Mar 2022 22:06:00 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
content-security-policy
script-src 'none'; object-src 'none'
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
www.google.de/pagead/1p-user-list/960621875/ 		42 B
548 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.de/pagead/1p-user-list/960621875/?random=1647641160515&cv=9&fst=1647640800000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa3e0&sendb=1&data=event%3Dgtag.config&frm=0&url=http%3A%2F%2Fwesta.kr%2Ftag%2Fciti%2FCITIZ%2Flogin%2Fses%2Findex&ref=http%3A%2F%2Fwesta.kr%2Ftag%2Fciti%2FCITIZ%2Flogin%2F&tiba=Sign%20On%20to%20Your%20Citi%20Account%20-%20Citibank&async=1&fmt=3&is_vtc=1&random=3470636520&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
http://westa.kr/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 18 Mar 2022 22:06:00 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
content-security-policy
script-src 'none'; object-src 'none'
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
www.google.com/pagead/1p-user-list/644574043/ 		42 B
108 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.com/pagead/1p-user-list/644574043/?random=1647641160516&cv=9&fst=1647640800000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa3e0&sendb=1&data=event%3Dgtag.config&frm=0&url=http%3A%2F%2Fwesta.kr%2Ftag%2Fciti%2FCITIZ%2Flogin%2Fses%2Findex&ref=http%3A%2F%2Fwesta.kr%2Ftag%2Fciti%2FCITIZ%2Flogin%2F&tiba=Sign%20On%20to%20Your%20Citi%20Account%20-%20Citibank&async=1&fmt=3&is_vtc=1&random=2436494093&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:811::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
http://westa.kr/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 18 Mar 2022 22:06:00 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
content-security-policy
script-src 'none'; object-src 'none'
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
www.google.de/pagead/1p-user-list/644574043/ 		42 B
108 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.de/pagead/1p-user-list/644574043/?random=1647641160516&cv=9&fst=1647640800000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa3e0&sendb=1&data=event%3Dgtag.config&frm=0&url=http%3A%2F%2Fwesta.kr%2Ftag%2Fciti%2FCITIZ%2Flogin%2Fses%2Findex&ref=http%3A%2F%2Fwesta.kr%2Ftag%2Fciti%2FCITIZ%2Flogin%2F&tiba=Sign%20On%20to%20Your%20Citi%20Account%20-%20Citibank&async=1&fmt=3&is_vtc=1&random=2436494093&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
http://westa.kr/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 18 Mar 2022 22:06:00 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
content-security-policy
script-src 'none'; object-src 'none'
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
googleads.g.doubleclick.net/pagead/viewthroughconversion/959299794/ 		2 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://googleads.g.doubleclick.net/pagead/viewthroughconversion/959299794/?random=1647641160607&cv=9&fst=1647641160607&num=1&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa3e0&sendb=1&ig=1&data=event%3Dgtag.config&frm=0&url=http%3A%2F%2Fwesta.kr%2Ftag%2Fciti%2FCITIZ%2Flogin%2Fses%2Findex&ref=http%3A%2F%2Fwesta.kr%2Ftag%2Fciti%2FCITIZ%2Flogin%2F&tiba=Sign%20On%20to%20Your%20Citi%20Account%20-%20Citibank&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4
Requested by
Host: www.googleadservices.com
URL: http://www.googleadservices.com/pagead/conversion_async.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
b4ffa9c0eb436998c4aab9c545be8654571cc2f20b86288374a50891d1fe7ec8
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
http://westa.kr/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 18 Mar 2022 22:06:00 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
content-type
text/javascript; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
1070
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
googleads.g.doubleclick.net/pagead/viewthroughconversion/830907969/ 		2 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://googleads.g.doubleclick.net/pagead/viewthroughconversion/830907969/?random=1647641160608&cv=9&fst=1647641160608&num=1&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa3e0&sendb=1&ig=1&data=event%3Dgtag.config&frm=0&url=http%3A%2F%2Fwesta.kr%2Ftag%2Fciti%2FCITIZ%2Flogin%2Fses%2Findex&ref=http%3A%2F%2Fwesta.kr%2Ftag%2Fciti%2FCITIZ%2Flogin%2F&tiba=Sign%20On%20to%20Your%20Citi%20Account%20-%20Citibank&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4
Requested by
Host: www.googleadservices.com
URL: http://www.googleadservices.com/pagead/conversion_async.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
a78641d33fb8d79bcc1ebf2a48ff89609ece46d519fba0a5c2683658c8e53fa9
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
http://westa.kr/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 18 Mar 2022 22:06:00 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
content-type
text/javascript; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
1070
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
googleads.g.doubleclick.net/pagead/viewthroughconversion/819500023/ 		2 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://googleads.g.doubleclick.net/pagead/viewthroughconversion/819500023/?random=1647641160609&cv=9&fst=1647641160609&num=1&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa3e0&sendb=1&ig=1&data=event%3Dgtag.config&frm=0&url=http%3A%2F%2Fwesta.kr%2Ftag%2Fciti%2FCITIZ%2Flogin%2Fses%2Findex&ref=http%3A%2F%2Fwesta.kr%2Ftag%2Fciti%2FCITIZ%2Flogin%2F&tiba=Sign%20On%20to%20Your%20Citi%20Account%20-%20Citibank&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4
Requested by
Host: www.googleadservices.com
URL: http://www.googleadservices.com/pagead/conversion_async.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
41462b3d5fe09512b7c94c22e6541f1484595b56a4f8ccecb9e6552cfa8bec45
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
http://westa.kr/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 18 Mar 2022 22:06:00 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
content-type
text/javascript; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
1069
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
www.google.de/pagead/1p-user-list/695231162/
Redirect Chain
  • https://googleads.g.doubleclick.net/pagead/viewthroughconversion/695231162/?random=1647641160609&cv=9&fst=1647641160609&num=1&fmt=3&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=12...
  • https://www.google.com/pagead/1p-user-list/695231162/?random=1647641160609&cv=9&fst=1647640800000&num=1&fmt=3&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=f...
  • https://www.google.de/pagead/1p-user-list/695231162/?random=1647641160609&cv=9&fst=1647640800000&num=1&fmt=3&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=fa...
42 B
64 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.de/pagead/1p-user-list/695231162/?random=1647641160609&cv=9&fst=1647640800000&num=1&fmt=3&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa3e0&sendb=1&data=event%3Dgtag.config&frm=0&url=http%3A%2F%2Fwesta.kr%2Ftag%2Fciti%2FCITIZ%2Flogin%2Fses%2Findex&ref=http%3A%2F%2Fwesta.kr%2Ftag%2Fciti%2FCITIZ%2Flogin%2F&tiba=Sign%20On%20to%20Your%20Citi%20Account%20-%20Citibank&async=1&is_vtc=1&random=2408651188&resp=GooglemKTybQhCsO&ipr=y
Protocol
H3
Server
2a00:1450:4001:80f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
http://westa.kr/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 18 Mar 2022 22:06:00 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
content-security-policy
script-src 'none'; object-src 'none'
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma
no-cache
date
Fri, 18 Mar 2022 22:06:00 GMT
x-content-type-options
nosniff
server
cafe
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-type
image/gif
location
https://www.google.de/pagead/1p-user-list/695231162/?random=1647641160609&cv=9&fst=1647640800000&num=1&fmt=3&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa3e0&sendb=1&data=event%3Dgtag.config&frm=0&url=http%3A%2F%2Fwesta.kr%2Ftag%2Fciti%2FCITIZ%2Flogin%2Fses%2Findex&ref=http%3A%2F%2Fwesta.kr%2Ftag%2Fciti%2FCITIZ%2Flogin%2F&tiba=Sign%20On%20to%20Your%20Citi%20Account%20-%20Citibank&async=1&is_vtc=1&random=2408651188&resp=GooglemKTybQhCsO&ipr=y
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
content-security-policy
script-src 'none'; object-src 'none'
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
www.google.com/pagead/1p-user-list/819500023/ 		42 B
108 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.com/pagead/1p-user-list/819500023/?random=1647641160609&cv=9&fst=1647640800000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa3e0&sendb=1&data=event%3Dgtag.config&frm=0&url=http%3A%2F%2Fwesta.kr%2Ftag%2Fciti%2FCITIZ%2Flogin%2Fses%2Findex&ref=http%3A%2F%2Fwesta.kr%2Ftag%2Fciti%2FCITIZ%2Flogin%2F&tiba=Sign%20On%20to%20Your%20Citi%20Account%20-%20Citibank&async=1&fmt=3&is_vtc=1&random=3351086763&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:811::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
http://westa.kr/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 18 Mar 2022 22:06:00 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
content-security-policy
script-src 'none'; object-src 'none'
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
www.google.de/pagead/1p-user-list/819500023/ 		42 B
108 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.de/pagead/1p-user-list/819500023/?random=1647641160609&cv=9&fst=1647640800000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa3e0&sendb=1&data=event%3Dgtag.config&frm=0&url=http%3A%2F%2Fwesta.kr%2Ftag%2Fciti%2FCITIZ%2Flogin%2Fses%2Findex&ref=http%3A%2F%2Fwesta.kr%2Ftag%2Fciti%2FCITIZ%2Flogin%2F&tiba=Sign%20On%20to%20Your%20Citi%20Account%20-%20Citibank&async=1&fmt=3&is_vtc=1&random=3351086763&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
http://westa.kr/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 18 Mar 2022 22:06:00 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
content-security-policy
script-src 'none'; object-src 'none'
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
www.google.com/pagead/1p-user-list/830907969/ 		42 B
108 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.com/pagead/1p-user-list/830907969/?random=1647641160608&cv=9&fst=1647640800000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa3e0&sendb=1&data=event%3Dgtag.config&frm=0&url=http%3A%2F%2Fwesta.kr%2Ftag%2Fciti%2FCITIZ%2Flogin%2Fses%2Findex&ref=http%3A%2F%2Fwesta.kr%2Ftag%2Fciti%2FCITIZ%2Flogin%2F&tiba=Sign%20On%20to%20Your%20Citi%20Account%20-%20Citibank&async=1&fmt=3&is_vtc=1&random=711837543&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:811::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
http://westa.kr/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 18 Mar 2022 22:06:00 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
content-security-policy
script-src 'none'; object-src 'none'
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
www.google.de/pagead/1p-user-list/830907969/ 		42 B
108 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.de/pagead/1p-user-list/830907969/?random=1647641160608&cv=9&fst=1647640800000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa3e0&sendb=1&data=event%3Dgtag.config&frm=0&url=http%3A%2F%2Fwesta.kr%2Ftag%2Fciti%2FCITIZ%2Flogin%2Fses%2Findex&ref=http%3A%2F%2Fwesta.kr%2Ftag%2Fciti%2FCITIZ%2Flogin%2F&tiba=Sign%20On%20to%20Your%20Citi%20Account%20-%20Citibank&async=1&fmt=3&is_vtc=1&random=711837543&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
http://westa.kr/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 18 Mar 2022 22:06:00 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
content-security-policy
script-src 'none'; object-src 'none'
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
www.google.com/pagead/1p-user-list/959299794/ 		42 B
108 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.com/pagead/1p-user-list/959299794/?random=1647641160607&cv=9&fst=1647640800000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa3e0&sendb=1&data=event%3Dgtag.config&frm=0&url=http%3A%2F%2Fwesta.kr%2Ftag%2Fciti%2FCITIZ%2Flogin%2Fses%2Findex&ref=http%3A%2F%2Fwesta.kr%2Ftag%2Fciti%2FCITIZ%2Flogin%2F&tiba=Sign%20On%20to%20Your%20Citi%20Account%20-%20Citibank&async=1&fmt=3&is_vtc=1&random=2323642674&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:811::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
http://westa.kr/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 18 Mar 2022 22:06:00 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
content-security-policy
script-src 'none'; object-src 'none'
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
www.google.de/pagead/1p-user-list/959299794/ 		42 B
108 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.de/pagead/1p-user-list/959299794/?random=1647641160607&cv=9&fst=1647640800000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa3e0&sendb=1&data=event%3Dgtag.config&frm=0&url=http%3A%2F%2Fwesta.kr%2Ftag%2Fciti%2FCITIZ%2Flogin%2Fses%2Findex&ref=http%3A%2F%2Fwesta.kr%2Ftag%2Fciti%2FCITIZ%2Flogin%2F&tiba=Sign%20On%20to%20Your%20Citi%20Account%20-%20Citibank&async=1&fmt=3&is_vtc=1&random=2323642674&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
http://westa.kr/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 18 Mar 2022 22:06:00 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
content-security-policy
script-src 'none'; object-src 'none'
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Citibank (Banking)

73 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| 1 object| 2 function| structuredClone object| oncontextlost object| oncontextrestored object| ensBootstraps object| Bootstrapper function| Visitor object| s_c_il number| s_c_in object| adobe_visitor function| targetPageParams object| adobe object| ___target_traces function| mboxCreate function| mboxDefine function| mboxUpdate number| getOfferCount object| citiData function| bk_async object| val object| tags object| BKTAG function| bk_addUserCtx function| bk_addPageCtx function| bk_addEmailHash function| bk_addPhoneHash function| bk_doJSTag function| bk_doJSTag2 function| bk_doCarsJSTag function| bk_doPartnerAltTag function| bk_doCallbackTag function| bk_doCallbackTagWithTimeOut boolean| bk_use_multiple_iframes boolean| bk_allow_multiple_calls undefined| CCSID undefined| citiLocale boolean| citiNGA undefined| pageID object| _pp object| dataLayer function| gtag object| KAMPYLE_EMBED object| MDIGITAL object| KAMPYLE_CONSTANT object| KAMPYLE_FUNC object| KAMPYLE_DATA object| KAMPYLE_TARGETING object| KAMPYLE_ANIMATION object| KAMPYLE_VIEW object| KAMPYLE_MESSAGE object| KAMPYLE_UTILS object| KAMPYLE_EVENT_DISPATCHER object| KAMPYLE_GA object| MDIGITAL_ELEMENT_BUILDER object| COOLADATA_CODE object| KAMPYLE_COOLADATA object| KAMPYLE_COMMON object| KAMPYLE_THERMO_TEALEAF_FUNC object| KAMPYLE_ADOBE_ANALYTICS object| KAMPYLE_CLICKTALE_FUNC object| KAMPYLE_SESSIONCAM object| KAMPYLE_SCREEN_CAPTURE object| KAMPYLE_ONSITE_SDK undefined| KAMPYLE_POLYFILLS object| KAMPYLE_INTEGRATION object| cooladata object| google_tag_manager object| google_tag_data function| GooglemKTybQhCsO function| google_trackConversion object| GooglebQhCsO

19 Cookies

Domain/Path Name / Value
.westa.kr/ Name: check
Value: true
westa.kr/ Name: AMCVS_61834D9B5228A7430A490D45%40AdobeOrg
Value: 1
westa.kr/ Name: 7830
Value: error
westa.kr/ Name: 7018
Value:
westa.kr/ Name: 64072
Value:
.westa.kr/ Name: mbox
Value: session#af2e0e1b5a224693ac4a446660f104b8#1647643020|PC#af2e0e1b5a224693ac4a446660f104b8.37_0#1710885960
.westa.kr/ Name: mboxEdgeCluster
Value: 37
.everesttech.net/ Name: everest_g_v2
Value: g_surferid~YjUCRwAAAHUbpAQS
.demdex.net/ Name: demdex
Value: 19475786586444444811267544467041645815
.dpm.demdex.net/ Name: dpm
Value: 19475786586444444811267544467041645815
westa.kr/ Name: AMCV_61834D9B5228A7430A490D45%40AdobeOrg
Value: -330454231%7CMCIDTS%7C19070%7CMCMID%7C22976329610983678840795385483613860264%7CMCAID%7C311A8123F40E4FD7-400016C67987C367%7CMCOPTOUT-1647648359s%7CNONE%7CMCAAMLH-1648245959%7C6%7CMCAAMB-1648245959%7Cj8Odv6LonN4r3an7LhD3WZrU1bUpAkFkkiY1ncBR96t2PTI%7CMCSYNCSOP%7C411-19077%7CvVersion%7C3.1.2
westa.kr/ Name: mdLogger
Value: false
westa.kr/ Name: kampyle_userid
Value: 3cf1-4e1e-6cf3-6b03-f916-1cdb-dbb7-be84
westa.kr/ Name: kampyleUserSession
Value: 1647641160158
westa.kr/ Name: kampyleUserSessionsCount
Value: 1
westa.kr/ Name: kampyleSessionPageCounter
Value: 1
.westa.kr/ Name: cd_user_id
Value: 17f9f10e9ec7cd-082e6d5cfabc7e-977173c-1d4c00-17f9f10e9edb48
.westa.kr/ Name: _gcl_au
Value: 1.1.179594343.1647641160
.doubleclick.net/ Name: IDE
Value: AHWqTUlrNnCkCVPZhF9jKvkBYX4jm4h4MSxBliiuQupYL9gsUYRdLMDcfRwgilHK

2 Console Messages

Source Level URL
Text
network error URL: http://westa.kr/tag/citi/CITIZ/login/ses/img/Citi-Branding-Sprite.png
Message:
Failed to load resource: the server responded with a status of 404 (Not Found)
network error URL: http://cdn.pbbl.co/r/1560.js
Message:
Failed to load resource: the server responded with a status of 403 (Forbidden)

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

cdn.pbbl.co
citicorpcreditservic.tt.omtrdc.net
cm.everesttech.net
dpm.demdex.net
fast.citi.demdex.net
googleads.g.doubleclick.net
metrics.citi.com
nebula-cdn.kampyle.com
nexus.ensighten.com
resources.digital-cloud-citi.medallia.com
stags.bluekai.com
tags.bkrtx.com
udc-neb.kampyle.com
westa.kr
www.google.com
www.google.de
www.googleadservices.com
www.googletagmanager.com
104.111.215.191
104.111.228.137
108.128.22.191
13.36.218.177
142.250.179.130
143.204.98.10
151.101.129.175
151.101.2.133
18.197.253.20
192.254.187.108
2.16.186.82
2a00:1450:4001:80f::2003
2a00:1450:4001:811::2004
2a00:1450:4001:813::2008
2a00:1450:4001:827::2002
35.241.45.82
52.209.199.204
54.194.191.134
00b1e23a8e553c077da0717e9673f07e824e21a8bfc326c4e639ec9dc5a8b3cd
045cd226594cb32ddf9d4db8ee45611f4d0788675ae50180b68da975e66fe1fe
05a45e5c705e5fa8b22c243d3461520e64f75236b702335764bed044e763e25e
0bcb15216559cb490a994fc29303e9e66b109926890e7d3abfddbbfcef347c8e
2f7afa871ed143da7d10f7e155b347ffd704d17f3fd39f6b977efb2d56a4ab09
31b00ff4929696dfca06885da68e58c3e09f6ecb4ae0fe1ae287e99a3fd1f716
3a48237fbfe9edaa2d88dd572e3f2a4bb5b542f616c12b94e41dae8825986332
3e72de5de67d6d80b65a114af684eaf880c53c250155a663cb17d677ff064bc1
41462b3d5fe09512b7c94c22e6541f1484595b56a4f8ccecb9e6552cfa8bec45
47e7e2742d2c079365535ac4ee3b7114b94829daacef3009ba223099cbc3e372
48e89b7e40e096b89d864a5c8ee340ce44ca60fe9675310ef2f3f40a53a7d593
53350525edba0b889e87ea52a16ed843a928a2557e9f8d6747acd7ff991c95c3
5394d11ec8ad7a5494bcdb65cd95f885388532e14fb45a747e249112389bd837
595277dafc06f4d0e54be4719a82168f4b9c5b12b145037e5a48427c8a0c92b4
5966b6aeb23d10276c684f5312ae71a86a480582d77ffefc0e030170c9e3f026
5cbb5852d6dd001b4defb3f6ace7f8beb88d0f19d20d00ebfd086a24c31988db
6336ae7b60dff18e0a37721a3a19fd5e18568577a64faa662969d35966dbf72b
63c52aa99ca361b59a27e7f51fe5fadffef99e671f8b4f9560fab204219e0666
695788dc05d94be3b32060ffea15c1a4d74897bd32e5da7811e7ca76d82fc86b
6dfa343a68ef79e83fef5f7c705119d2473352190c609cf94c67ea99a29fa452
70f3cacfaa80a9d270cf98ce26fef532b1004bc471a20611f35bc70cd6d8d899
76c27beadb7fe5a0ee2f14ac6676c1467a72ecc84a099408e7ba0e1f68e5a936
79206ccd37edbafc46266406417abb5be984a5d0fb9f38e693d67b6d30cba8bb
7bea17a80a61ed0f54248b4ffc4c718f7c8ff2619742577a73591d62ce074da8
7df13706eaab8ce9a3dcd2a501f60bc66987c83834d07dfaf07ae56ef814c110
8427a91aa93af0f15ace8559ea73cba7b7a2c411c2bb1b5156e2ecdf80d60a42
88cd43c3f5453f7b4db2cbe884b47db3c8317860a2ce6e9b2bc934ff4b8e32eb
9d096ccdc4ddb85804f1c08555b2243800916c9c6d54d93803c97ad961ef8b83
9e67ca98b0fa8ef66fa9732f580cdd82cd56c0ab33ec90097def5e9803f1bc23
a56e82f34c03b1bed67b86e8b09d36303d6204eeb04b968f8fe38077753606ca
a593628f2d5ba814f37fbcd3963162f094c2764d4b15d82464c2d1aef92f150f
a78641d33fb8d79bcc1ebf2a48ff89609ece46d519fba0a5c2683658c8e53fa9
ae11e9263e24c7f48407c28b8b23606a3ad72cacb9ce06e29406c58f07e90f2d
ae4cde03e8b860c6ed777a95889f773efed0acb027cfd2fc21033c5111e05230
b4ffa9c0eb436998c4aab9c545be8654571cc2f20b86288374a50891d1fe7ec8
b5d1c26722742c44e62a4fbb4b67117d2587aa320f61784a27fea9d66d9f62b4
b872b4ad2e649961fbf3cdc43966716bd820301634adebaf5329c1aa22a1f7ee
b8e446605f92c29a178dd6494688103ac268004592afe06643df46f4bff68577
be7f7c26bf389d3d3ad17a098c4b865438a6581e8d92ea517c20a804c259577a
be9b5382b4526ffd3306d0292122ce3599123f1cd543f52f3035b4f24fbf9de8
bf8892a953595eb96b9ca68c5756849d404115dcf2ee9bf87e8b4e7b3cf8e650
c73e69a929ce513e05bba4a3359296cf41064aaff3355d900b971ca39175a935
cfc828883897e41063f161803efb8130b4892d73bef3252fafda30b3940eba87
d1c8d325f94a3ab60a2af54f2c8ab94e486e79e5c503eed5b8c3d89eb7f6756c
d5ed7adcad9936bb2b4192b4240be86211845f007f5d2feef8e6afb440f88582
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e9e9a67395a0d83b584208a19b95af203df8e8e6c6952fe76c690d60ea9381c7
ee52ac49330e6b2e93341ce879001f2754aeba6b618435e227ef9fc916166ddf
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f327a0ba3e41b1e8154e1c18fc114baff0bd057151e3afe7fa6f33cc0cb18296
f378974fe6a831ae2f48d9191ea74eb21877d4964d5eedbc2810d8756ed13631
f94cb7cab7413f3e828c469111e3f9ee7bf21ac163cea343be2cdef866160d40
ffb651309250e9ce8ca4d6a354d9403cb80ec23ef11eebc6d518163948061c82