www.firstcitizensrewards.com Open in urlscan Pro
129.159.127.141 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://www.rewards.firstcitizens.com/
Effective URL:
https://www.firstcitizensrewards.com/pages/main/default.aspx
Submission: On December 05 via automatic, source certstream-suspicious (December 5th 2023, 6:47:27 pm UTC) — Scanned from DE

Summary HTTP 46 Redirects Links 2 Behaviour Indicators

Summary

This website contacted 9 IPs in 3 countries across 9 domains to perform 46 HTTP transactions. The main IP is 129.159.127.141, located in Ashburn, United States and belongs to ORACLE-BMC-31898, US. The main domain is www.firstcitizensrewards.com.
TLS certificate: Issued by DigiCert TLS RSA SHA256 2020 CA1 on December 19th 2022. Valid for: a year.

This is the only time www.firstcitizensrewards.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
3 37	129.159.127.141 129.159.127.141	31898 (ORACLE-BM...) (ORACLE-BMC-31898)
2	2a00:1450:400... 2a00:1450:4001:813::2004	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:806::200a	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:830::2003	15169 (GOOGLE) (GOOGLE)
2	2001:4860:480... 2001:4860:4802:34::178	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:400c:c04::9c	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:80f::2008	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:803::2003	15169 (GOOGLE) (GOOGLE)
1	2001:4860:480... 2001:4860:4802:32::36	15169 (GOOGLE) (GOOGLE)
46	9

37 129.159.127.141 (Ashburn, United States) 3 redirects

ASN31898 (ORACLE-BMC-31898, US)

www.rewards.firstcitizens.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
www.firstcitizensrewards.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:813::2004 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:806::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:830::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2001:4860:4802:34::178 (United States)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:400c:c04::9c (Brussels, Belgium)

ASN15169 (GOOGLE, US)

stats.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:80f::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:803::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2001:4860:4802:32::36 (United States)

ASN15169 (GOOGLE, US)

region1.analytics.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
36	firstcitizensrewards.com 2 redirects www.firstcitizensrewards.com	2 MB
3	google.com www.google.com — Cisco Umbrella Rank: 2 region1.analytics.google.com — Cisco Umbrella Rank: 2693	2 KB
2	google.de www.google.de — Cisco Umbrella Rank: 6765	515 B
2	doubleclick.net stats.g.doubleclick.net — Cisco Umbrella Rank: 75	414 B
2	google-analytics.com www.google-analytics.com — Cisco Umbrella Rank: 27	21 KB
1	googletagmanager.com www.googletagmanager.com — Cisco Umbrella Rank: 36	82 KB
1	gstatic.com www.gstatic.com	188 KB
1	googleapis.com fonts.googleapis.com — Cisco Umbrella Rank: 29	871 B
1	firstcitizens.com 1 redirects www.rewards.firstcitizens.com	194 B
46	9

	Domain	Requested by
36	www.firstcitizensrewards.com	2 redirects www.firstcitizensrewards.com
2	www.google.de	www.firstcitizensrewards.com
2	stats.g.doubleclick.net	www.google-analytics.com www.googletagmanager.com
2	www.google-analytics.com	www.firstcitizensrewards.com www.google-analytics.com
2	www.google.com	www.firstcitizensrewards.com
1	region1.analytics.google.com	www.googletagmanager.com
1	www.googletagmanager.com	www.google-analytics.com
1	www.gstatic.com	www.google.com
1	fonts.googleapis.com	www.firstcitizensrewards.com
1	www.rewards.firstcitizens.com	1 redirects
46	10

This site contains links to these domains. Also see Links.

Domain
www.firstcitizens.com

Subject Issuer	Validity	Valid
www.firstcitizensrewards.com DigiCert TLS RSA SHA256 2020 CA1	`2022-12-19` - `2023-12-18`	a year	crt.sh
www.google.com GTS CA 1C3	`2023-10-23` - `2024-01-15`	3 months	crt.sh
upload.video.google.com GTS CA 1C3	`2023-10-23` - `2024-01-15`	3 months	crt.sh
*.gstatic.com GTS CA 1C3	`2023-10-23` - `2024-01-15`	3 months	crt.sh
*.google-analytics.com GTS CA 1C3	`2023-10-23` - `2024-01-15`	3 months	crt.sh
*.g.doubleclick.net GTS CA 1C3	`2023-10-23` - `2024-01-15`	3 months	crt.sh
www.google.de GTS CA 1C3	`2023-10-23` - `2024-01-15`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://www.firstcitizensrewards.com/pages/main/default.aspx
Frame ID: C2FC5CF48C52AB0279AC69557058E8A8
Requests: 46 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

First Citizens Bank

Page URL History Show full URLs

https://www.rewards.firstcitizens.com/ HTTP 301
https://www.firstcitizensrewards.com/ HTTP 301
https://www.firstcitizensrewards.com/pages/default.aspx HTTP 302
https://www.firstcitizensrewards.com/pages/main/default.aspx Page URL

Detected technologies

Microsoft ASP.NET (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

\.aspx?(?:$|\?)
<input[^>]+name="__VIEWSTATE

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

google-analytics\.com/(?:ga|urchin|analytics)\.js

Google Font API (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/gtag/js

Modernizr (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

([\d.]+)?/modernizr(?:\.([\d.]+))?.*\.js

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

reCAPTCHA (Captchas) Expand

Overall confidence: 100%
Detected patterns

/recaptcha/api\.js

Page Statistics

46
Requests

100 %
HTTPS

89 %
IPv6

9
Domains

10
Subdomains

9
IPs

3
Countries

2302 kB
Transfer

3245 kB
Size

6
Cookies

2 Outgoing links

These are links going to different origins than the main page.

URL: https://www.firstcitizens.com/personal/loans-credit/credit-cards/rewards
Title: Rewards Credit Card?

Search URL Search Domain Scan URL

URL: https://www.firstcitizens.com/privacy-security/
Title: Privacy & Security

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://www.rewards.firstcitizens.com/ HTTP 301
https://www.firstcitizensrewards.com/ HTTP 301
https://www.firstcitizensrewards.com/pages/default.aspx HTTP 302
https://www.firstcitizensrewards.com/pages/main/default.aspx Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

46 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1

200
OK

Primary Request default.aspx Show response
www.firstcitizensrewards.com/pages/main/
Redirect Chain

https://www.rewards.firstcitizens.com/
https://www.firstcitizensrewards.com/
https://www.firstcitizensrewards.com/pages/default.aspx
https://www.firstcitizensrewards.com/pages/main/default.aspx

27 KB
9 KB

118ms
118ms

Document
text/html

129.159.127.141
ORACLE-BMC-31898

General

Check archive.org

Show headers Download Go to

Full URL

https://www.firstcitizensrewards.com/pages/main/default.aspx

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

129.159.127.141 Ashburn, United States, ASN31898 (ORACLE-BMC-31898, US),

Reverse DNS

Software

/ ASP.NET

Resource Hash

92f63cd5fcb7dbb70a79f94cbd3d4eb764107afdc0ace56444f49057d34a8a7b

Security Headers

Name	Value
Content-Security-Policy	default-src https: data: 'unsafe-inline' 'unsafe-eval'
Public-Key-Pins	pin-sha256='X3pGTSOuJeEVw989IJ/cEtXUEmy52zs1TZQrU06KUKg='; pin-sha256='MHJYVThihUrJcxW6wcqyOISTXIsInsdj3xK8QrZbHec='; pin-sha256='isi41AizREkLvvft0IRW4u3XMFR2Yg7bvrF7padyCJg='; includeSubdomains; max-age=2592000
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Cache-Control: no-cache, no-store, must-revalidate, max-age=0
Connection: keep-alive
Content-Encoding: gzip
Content-Length: 8230
Content-Security-Policy: default-src https: data: 'unsafe-inline' 'unsafe-eval'
Content-Type: text/html; charset=utf-8
Date: Tue, 05 Dec 2023 18:47:22 GMT
Pragma: no-cache
Public-Key-Pins: pin-sha256='X3pGTSOuJeEVw989IJ/cEtXUEmy52zs1TZQrU06KUKg='; pin-sha256='MHJYVThihUrJcxW6wcqyOISTXIsInsdj3xK8QrZbHec='; pin-sha256='isi41AizREkLvvft0IRW4u3XMFR2Yg7bvrF7padyCJg='; includeSubdomains; max-age=2592000
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-AspNet-Version: 4.0.30319
X-Content-Type-Options: nosniff
X-Frame-Options: SAMEORIGIN
X-Permitted-Cross-Domain-Policies: none
X-Powered-By: ASP.NET
X-Xss-Protection: 1; mode=block

Redirect headers

Cache-Control: private
Connection: keep-alive
Content-Length: 922
Content-Security-Policy: default-src https: data: 'unsafe-inline' 'unsafe-eval'
Content-Type: text/html; charset=utf-8
Date: Tue, 05 Dec 2023 18:47:22 GMT
Location: /pages/main/default.aspx
Public-Key-Pins: pin-sha256='X3pGTSOuJeEVw989IJ/cEtXUEmy52zs1TZQrU06KUKg='; pin-sha256='MHJYVThihUrJcxW6wcqyOISTXIsInsdj3xK8QrZbHec='; pin-sha256='isi41AizREkLvvft0IRW4u3XMFR2Yg7bvrF7padyCJg='; includeSubdomains; max-age=2592000
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-AspNet-Version: 4.0.30319
X-Content-Type-Options: nosniff
X-Frame-Options: SAMEORIGIN
X-Permitted-Cross-Domain-Policies: none
X-Powered-By: ASP.NET
X-Xss-Protection: 1; mode=block

GET
H2 200 api.js Show response
www.google.com/recaptcha/ 1 KB
1 KB 39ms
17ms Script
text/javascript 2a00:1450:4001:813::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api.js

Requested by

Host: www.firstcitizensrewards.com
URL: https://www.firstcitizensrewards.com/pages/main/default.aspx

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

eb7bf02db906592731efaa8338874fde0ebd1135d5ae5307aca6b451871d0e73

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self'
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.firstcitizensrewards.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Tue, 05 Dec 2023 18:47:22 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy: frame-ancestors 'self'
server: GSE
x-frame-options: SAMEORIGIN
content-type: text/javascript; charset=utf-8
cache-control: private, max-age=300
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 1; mode=block
expires: Tue, 05 Dec 2023 18:47:22 GMT

GET
H/1.1 200
OK css
www.firstcitizensrewards.com/styles/ 280 KB
45 KB 113ms
111ms Stylesheet
text/css 129.159.127.141
ORACLE-BMC-31898

General

Check archive.org

Show headers Download Go to

Full URL

https://www.firstcitizensrewards.com/styles/css?v=9Sfa950De2OMK7NHwVZwDh0XyhyEfFSskYK_o20fCXA1

Requested by

Host: www.firstcitizensrewards.com
URL: https://www.firstcitizensrewards.com/pages/main/default.aspx

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

129.159.127.141 Ashburn, United States, ASN31898 (ORACLE-BMC-31898, US),

Reverse DNS

Software

/ ASP.NET

Resource Hash

6fd1435593fa3b44450cff6e40805ecaaa6638b74aa5b8cc906a46e6017bc11a

Security Headers

Name	Value
Content-Security-Policy	default-src https: data: 'unsafe-inline' 'unsafe-eval'
Public-Key-Pins	pin-sha256='X3pGTSOuJeEVw989IJ/cEtXUEmy52zs1TZQrU06KUKg='; pin-sha256='MHJYVThihUrJcxW6wcqyOISTXIsInsdj3xK8QrZbHec='; pin-sha256='isi41AizREkLvvft0IRW4u3XMFR2Yg7bvrF7padyCJg='; includeSubdomains; max-age=2592000
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.firstcitizensrewards.com/pages/main/default.aspx
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

Date: Tue, 05 Dec 2023 18:47:22 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Content-Security-Policy: default-src https: data: 'unsafe-inline' 'unsafe-eval'
X-Permitted-Cross-Domain-Policies: none
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Strict-Transport-Security: max-age=31536000; includeSubDomains
Connection: keep-alive
Content-Length: 44746
X-Xss-Protection: 1; mode=block
Public-Key-Pins: pin-sha256='X3pGTSOuJeEVw989IJ/cEtXUEmy52zs1TZQrU06KUKg='; pin-sha256='MHJYVThihUrJcxW6wcqyOISTXIsInsdj3xK8QrZbHec='; pin-sha256='isi41AizREkLvvft0IRW4u3XMFR2Yg7bvrF7padyCJg='; includeSubdomains; max-age=2592000
Last-Modified: Tue, 05 Dec 2023 18:47:22 GMT
Vary: User-Agent
X-Frame-Options: SAMEORIGIN
Content-Type: text/css; charset=utf-8
Cache-Control: public
Expires: Wed, 04 Dec 2024 18:47:22 GMT

GET
H2 200 css
fonts.googleapis.com/ 1 KB
871 B 38ms
16ms Stylesheet
text/css 2a00:1450:4001:806::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css?family=Pinyon+Script

Requested by

Host: www.firstcitizensrewards.com
URL: https://www.firstcitizensrewards.com/pages/main/default.aspx

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:806::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

46b55acd6ed56d25b761d37ca955a7598259b34694556da76d667dc9f494ba32

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.firstcitizensrewards.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Tue, 05 Dec 2023 18:47:22 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Tue, 05 Dec 2023 18:39:30 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Tue, 05 Dec 2023 18:47:22 GMT

GET
H/1.1 200
OK jquery.min.js Show response
www.firstcitizensrewards.com/scripts/ 94 KB
43 KB 303ms
115ms Script
application/javascript 129.159.127.141
ORACLE-BMC-31898

General

Check archive.org

Show headers Download Go to

Full URL

https://www.firstcitizensrewards.com/scripts/jquery.min.js

Requested by

Host: www.firstcitizensrewards.com
URL: https://www.firstcitizensrewards.com/pages/main/default.aspx

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

129.159.127.141 Ashburn, United States, ASN31898 (ORACLE-BMC-31898, US),

Reverse DNS

Software

/ ASP.NET

Resource Hash

87981e8062814ca279922ee55276ad14bbdc29649f98e34b2d83c3afb5052a51

Security Headers

Name	Value
Content-Security-Policy	default-src https: data: 'unsafe-inline' 'unsafe-eval'
Public-Key-Pins	pin-sha256='X3pGTSOuJeEVw989IJ/cEtXUEmy52zs1TZQrU06KUKg='; pin-sha256='MHJYVThihUrJcxW6wcqyOISTXIsInsdj3xK8QrZbHec='; pin-sha256='isi41AizREkLvvft0IRW4u3XMFR2Yg7bvrF7padyCJg='; includeSubdomains; max-age=2592000
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.firstcitizensrewards.com/pages/main/default.aspx
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

Date: Tue, 05 Dec 2023 18:47:22 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Content-Security-Policy: default-src https: data: 'unsafe-inline' 'unsafe-eval'
X-Permitted-Cross-Domain-Policies: none
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-Powered-By: ASP.NET
Connection: keep-alive
Content-Length: 42750
X-Xss-Protection: 1; mode=block
Public-Key-Pins: pin-sha256='X3pGTSOuJeEVw989IJ/cEtXUEmy52zs1TZQrU06KUKg='; pin-sha256='MHJYVThihUrJcxW6wcqyOISTXIsInsdj3xK8QrZbHec='; pin-sha256='isi41AizREkLvvft0IRW4u3XMFR2Yg7bvrF7padyCJg='; includeSubdomains; max-age=2592000
Last-Modified: Wed, 16 Feb 2022 15:00:04 GMT
ETag: "16b82fe14523d81:0"
Vary: Accept-Encoding
X-Frame-Options: SAMEORIGIN
Content-Type: application/javascript
Accept-Ranges: bytes

GET
H/1.1 200
OK modernizr.js Show response
www.firstcitizensrewards.com/scripts/ 10 KB
6 KB 290ms
102ms Script
application/javascript 129.159.127.141
ORACLE-BMC-31898

General

Check archive.org

Show headers Download Go to

Full URL

https://www.firstcitizensrewards.com/scripts/modernizr.js

Requested by

Host: www.firstcitizensrewards.com
URL: https://www.firstcitizensrewards.com/pages/main/default.aspx

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

129.159.127.141 Ashburn, United States, ASN31898 (ORACLE-BMC-31898, US),

Reverse DNS

Software

/ ASP.NET

Resource Hash

ac7f7d8b7179ddc263d366be0a8c7133a1914fa167f726591b26a3e69c02520c

Security Headers

Name	Value
Content-Security-Policy	default-src https: data: 'unsafe-inline' 'unsafe-eval'
Public-Key-Pins	pin-sha256='X3pGTSOuJeEVw989IJ/cEtXUEmy52zs1TZQrU06KUKg='; pin-sha256='MHJYVThihUrJcxW6wcqyOISTXIsInsdj3xK8QrZbHec='; pin-sha256='isi41AizREkLvvft0IRW4u3XMFR2Yg7bvrF7padyCJg='; includeSubdomains; max-age=2592000
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.firstcitizensrewards.com/pages/main/default.aspx
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

Date: Tue, 05 Dec 2023 18:47:22 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Content-Security-Policy: default-src https: data: 'unsafe-inline' 'unsafe-eval'
X-Permitted-Cross-Domain-Policies: none
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-Powered-By: ASP.NET
Connection: keep-alive
Content-Length: 5198
X-Xss-Protection: 1; mode=block
Public-Key-Pins: pin-sha256='X3pGTSOuJeEVw989IJ/cEtXUEmy52zs1TZQrU06KUKg='; pin-sha256='MHJYVThihUrJcxW6wcqyOISTXIsInsdj3xK8QrZbHec='; pin-sha256='isi41AizREkLvvft0IRW4u3XMFR2Yg7bvrF7padyCJg='; includeSubdomains; max-age=2592000
Last-Modified: Wed, 16 Feb 2022 15:00:04 GMT
ETag: "26e435e14523d81:0"
Vary: Accept-Encoding
X-Frame-Options: SAMEORIGIN
Content-Type: application/javascript
Accept-Ranges: bytes

GET
H/1.1 200
OK refresh.css
www.firstcitizensrewards.com/styles/ 6 KB
3 KB 286ms
99ms Stylesheet
text/css 129.159.127.141
ORACLE-BMC-31898

General

Check archive.org

Show headers Download Go to

Full URL

https://www.firstcitizensrewards.com/styles/refresh.css

Requested by

Host: www.firstcitizensrewards.com
URL: https://www.firstcitizensrewards.com/pages/main/default.aspx

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

129.159.127.141 Ashburn, United States, ASN31898 (ORACLE-BMC-31898, US),

Reverse DNS

Software

/ ASP.NET

Resource Hash

c6fb95296bd7e81b5d23234bc7460dce4da9ed176c4b1603d3feb778dd7ec890

Security Headers

Name	Value
Content-Security-Policy	default-src https: data: 'unsafe-inline' 'unsafe-eval'
Public-Key-Pins	pin-sha256='X3pGTSOuJeEVw989IJ/cEtXUEmy52zs1TZQrU06KUKg='; pin-sha256='MHJYVThihUrJcxW6wcqyOISTXIsInsdj3xK8QrZbHec='; pin-sha256='isi41AizREkLvvft0IRW4u3XMFR2Yg7bvrF7padyCJg='; includeSubdomains; max-age=2592000
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.firstcitizensrewards.com/pages/main/default.aspx
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

Date: Tue, 05 Dec 2023 18:47:22 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Content-Security-Policy: default-src https: data: 'unsafe-inline' 'unsafe-eval'
X-Permitted-Cross-Domain-Policies: none
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-Powered-By: ASP.NET
Connection: keep-alive
Content-Length: 1925
X-Xss-Protection: 1; mode=block
Public-Key-Pins: pin-sha256='X3pGTSOuJeEVw989IJ/cEtXUEmy52zs1TZQrU06KUKg='; pin-sha256='MHJYVThihUrJcxW6wcqyOISTXIsInsdj3xK8QrZbHec='; pin-sha256='isi41AizREkLvvft0IRW4u3XMFR2Yg7bvrF7padyCJg='; includeSubdomains; max-age=2592000
Last-Modified: Wed, 16 Feb 2022 15:00:04 GMT
ETag: "619442e14523d81:0"
Vary: Accept-Encoding
X-Frame-Options: SAMEORIGIN
Content-Type: text/css
Accept-Ranges: bytes

GET
H/1.1 200
OK WebResource.axd Show response
www.firstcitizensrewards.com/ 23 KB
7 KB 289ms
101ms Script
application/x-javascript 129.159.127.141
ORACLE-BMC-31898

General

Check archive.org

Show headers Download Go to

Full URL

https://www.firstcitizensrewards.com/WebResource.axd?d=qIK7C_Hji4WKKPZ0WLZbMfAwhuQXiTkFiWhjwDCe85d5sNgbNpXyaSu1Mi76oC4_2MtpASu4oI9JUR0dw-7hgk4gfPs1&t=638259218771233176

Requested by

Host: www.firstcitizensrewards.com
URL: https://www.firstcitizensrewards.com/pages/main/default.aspx

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

129.159.127.141 Ashburn, United States, ASN31898 (ORACLE-BMC-31898, US),

Reverse DNS

Software

/ ASP.NET

Resource Hash

40732e9dcfa704cf615e4691bb07aecfd1cc5e063220a46e4a7ff6560c77f5db

Security Headers

Name	Value
Content-Security-Policy	default-src https: data: 'unsafe-inline' 'unsafe-eval'
Public-Key-Pins	pin-sha256='X3pGTSOuJeEVw989IJ/cEtXUEmy52zs1TZQrU06KUKg='; pin-sha256='MHJYVThihUrJcxW6wcqyOISTXIsInsdj3xK8QrZbHec='; pin-sha256='isi41AizREkLvvft0IRW4u3XMFR2Yg7bvrF7padyCJg='; includeSubdomains; max-age=2592000
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.firstcitizensrewards.com/pages/main/default.aspx
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

Date: Tue, 05 Dec 2023 18:47:22 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Content-Security-Policy: default-src https: data: 'unsafe-inline' 'unsafe-eval'
X-Permitted-Cross-Domain-Policies: none
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Strict-Transport-Security: max-age=31536000; includeSubDomains
Connection: keep-alive
Content-Length: 6007
X-Xss-Protection: 1; mode=block
Public-Key-Pins: pin-sha256='X3pGTSOuJeEVw989IJ/cEtXUEmy52zs1TZQrU06KUKg='; pin-sha256='MHJYVThihUrJcxW6wcqyOISTXIsInsdj3xK8QrZbHec='; pin-sha256='isi41AizREkLvvft0IRW4u3XMFR2Yg7bvrF7padyCJg='; includeSubdomains; max-age=2592000
Last-Modified: Wed, 26 Jul 2023 02:44:37 GMT
Vary: Accept-Encoding
X-Frame-Options: SAMEORIGIN
Content-Type: application/x-javascript
Cache-Control: public
Expires: Wed, 04 Dec 2024 06:35:29 GMT

GET
H/1.1 200
OK ScriptResource.axd Show response
www.firstcitizensrewards.com/ 89 KB
35 KB 298ms
109ms Script
application/x-javascript 129.159.127.141
ORACLE-BMC-31898

General

Check archive.org

Show headers Download Go to

Full URL

https://www.firstcitizensrewards.com/ScriptResource.axd?d=PoPN1ICqx_BlrpFAIFK4ewX2alG1EDe74tw4W9zkhsWKoZStDXB9kyfqiC6k_DqVlLSoiyYfE893viPGkZgqOwifNi5xBkimWZahTKhKXlBnEG28fza8PkuUWQjpclNB0GZbew2&t=51e37521

Requested by

Host: www.firstcitizensrewards.com
URL: https://www.firstcitizensrewards.com/pages/main/default.aspx

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

129.159.127.141 Ashburn, United States, ASN31898 (ORACLE-BMC-31898, US),

Reverse DNS

Software

/ ASP.NET

Resource Hash

21e1dff4ea91f8d053603d4b774c47bd7c047ff31d854793abd13da79a4a8a6b

Security Headers

Name	Value
Content-Security-Policy	default-src https: data: 'unsafe-inline' 'unsafe-eval'
Public-Key-Pins	pin-sha256='X3pGTSOuJeEVw989IJ/cEtXUEmy52zs1TZQrU06KUKg='; pin-sha256='MHJYVThihUrJcxW6wcqyOISTXIsInsdj3xK8QrZbHec='; pin-sha256='isi41AizREkLvvft0IRW4u3XMFR2Yg7bvrF7padyCJg='; includeSubdomains; max-age=2592000
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.firstcitizensrewards.com/pages/main/default.aspx
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

Date: Tue, 05 Dec 2023 18:47:22 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Content-Security-Policy: default-src https: data: 'unsafe-inline' 'unsafe-eval'
X-Permitted-Cross-Domain-Policies: none
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Strict-Transport-Security: max-age=31536000; includeSubDomains
Connection: keep-alive
Content-Length: 34485
X-Xss-Protection: 1; mode=block
Public-Key-Pins: pin-sha256='X3pGTSOuJeEVw989IJ/cEtXUEmy52zs1TZQrU06KUKg='; pin-sha256='MHJYVThihUrJcxW6wcqyOISTXIsInsdj3xK8QrZbHec='; pin-sha256='isi41AizREkLvvft0IRW4u3XMFR2Yg7bvrF7padyCJg='; includeSubdomains; max-age=2592000
Last-Modified: Tue, 05 Dec 2023 06:35:29 GMT
Vary: Accept-Encoding
X-Frame-Options: SAMEORIGIN
Content-Type: application/x-javascript; charset=utf-8
Cache-Control: public
Expires: Wed, 04 Dec 2024 06:35:29 GMT

GET
H/1.1 200
OK ScriptResource.axd Show response
www.firstcitizensrewards.com/ 38 KB
13 KB 298ms
94ms Script
application/x-javascript 129.159.127.141
ORACLE-BMC-31898

General

Check archive.org

Show headers Download Go to

Full URL

https://www.firstcitizensrewards.com/ScriptResource.axd?d=QIpkq-RC60GWgcFH4uiyAPWJRG5RzzjHzSN34Daff-xEsAjiKM0xBl3EIRCiEwtj0jf-o4WK72G5S5TA-_5V5fxLr7OyMONudVlfu6K6ixb6ttp_8o5vctJGlAsiBVDWqKSVOg2&t=51e37521

Requested by

Host: www.firstcitizensrewards.com
URL: https://www.firstcitizensrewards.com/pages/main/default.aspx

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

129.159.127.141 Ashburn, United States, ASN31898 (ORACLE-BMC-31898, US),

Reverse DNS

Software

/ ASP.NET

Resource Hash

3405ac070a16f48cbef78ca93ac5f6fd3695e748ad05da409a652bf2a7886d1c

Security Headers

Name	Value
Content-Security-Policy	default-src https: data: 'unsafe-inline' 'unsafe-eval'
Public-Key-Pins	pin-sha256='X3pGTSOuJeEVw989IJ/cEtXUEmy52zs1TZQrU06KUKg='; pin-sha256='MHJYVThihUrJcxW6wcqyOISTXIsInsdj3xK8QrZbHec='; pin-sha256='isi41AizREkLvvft0IRW4u3XMFR2Yg7bvrF7padyCJg='; includeSubdomains; max-age=2592000
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.firstcitizensrewards.com/pages/main/default.aspx
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

Date: Tue, 05 Dec 2023 18:47:22 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Content-Security-Policy: default-src https: data: 'unsafe-inline' 'unsafe-eval'
X-Permitted-Cross-Domain-Policies: none
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Strict-Transport-Security: max-age=31536000; includeSubDomains
Connection: keep-alive
Content-Length: 12395
X-Xss-Protection: 1; mode=block
Public-Key-Pins: pin-sha256='X3pGTSOuJeEVw989IJ/cEtXUEmy52zs1TZQrU06KUKg='; pin-sha256='MHJYVThihUrJcxW6wcqyOISTXIsInsdj3xK8QrZbHec='; pin-sha256='isi41AizREkLvvft0IRW4u3XMFR2Yg7bvrF7padyCJg='; includeSubdomains; max-age=2592000
Last-Modified: Tue, 05 Dec 2023 06:35:29 GMT
Vary: Accept-Encoding
X-Frame-Options: SAMEORIGIN
Content-Type: application/x-javascript; charset=utf-8
Cache-Control: public
Expires: Wed, 04 Dec 2024 06:35:29 GMT

GET
H/1.1 200
OK webkit.js Show response
www.firstcitizensrewards.com/scripts/ 360 B
1 KB 379ms
93ms Script
application/javascript 129.159.127.141
ORACLE-BMC-31898

General

Check archive.org

Show headers Download Go to

Full URL

https://www.firstcitizensrewards.com/scripts/webkit.js

Requested by

Host: www.firstcitizensrewards.com
URL: https://www.firstcitizensrewards.com/pages/main/default.aspx

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

129.159.127.141 Ashburn, United States, ASN31898 (ORACLE-BMC-31898, US),

Reverse DNS

Software

/ ASP.NET

Resource Hash

6083f0dabd659d673464f2ef3b355c4b9d8ac4174602cd918374b9508cef59ef

Security Headers

Name	Value
Content-Security-Policy	default-src https: data: 'unsafe-inline' 'unsafe-eval'
Public-Key-Pins	pin-sha256='X3pGTSOuJeEVw989IJ/cEtXUEmy52zs1TZQrU06KUKg='; pin-sha256='MHJYVThihUrJcxW6wcqyOISTXIsInsdj3xK8QrZbHec='; pin-sha256='isi41AizREkLvvft0IRW4u3XMFR2Yg7bvrF7padyCJg='; includeSubdomains; max-age=2592000
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.firstcitizensrewards.com/pages/main/default.aspx
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

Date: Tue, 05 Dec 2023 18:47:22 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Content-Security-Policy: default-src https: data: 'unsafe-inline' 'unsafe-eval'
X-Permitted-Cross-Domain-Policies: none
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-Powered-By: ASP.NET
Connection: keep-alive
Content-Length: 333
X-Xss-Protection: 1; mode=block
Public-Key-Pins: pin-sha256='X3pGTSOuJeEVw989IJ/cEtXUEmy52zs1TZQrU06KUKg='; pin-sha256='MHJYVThihUrJcxW6wcqyOISTXIsInsdj3xK8QrZbHec='; pin-sha256='isi41AizREkLvvft0IRW4u3XMFR2Yg7bvrF7padyCJg='; includeSubdomains; max-age=2592000
Last-Modified: Wed, 16 Feb 2022 15:00:04 GMT
ETag: "89c938e14523d81:0"
Vary: Accept-Encoding
X-Frame-Options: SAMEORIGIN
Content-Type: application/javascript
Accept-Ranges: bytes

GET
H/1.1 200
OK alert-close.png
www.firstcitizensrewards.com/images/ 2 KB
3 KB 96ms
95ms Image
image/png 129.159.127.141
ORACLE-BMC-31898

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.firstcitizensrewards.com/images/alert-close.png

Requested by

Host: www.firstcitizensrewards.com
URL: https://www.firstcitizensrewards.com/pages/main/default.aspx

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

129.159.127.141 Ashburn, United States, ASN31898 (ORACLE-BMC-31898, US),

Reverse DNS

Software

/ ASP.NET

Resource Hash

6d645dd2170b161a872020a02f6e3f157d829f233833588202084590565b1264

Security Headers

Name	Value
Content-Security-Policy	default-src https: data: 'unsafe-inline' 'unsafe-eval'
Public-Key-Pins	pin-sha256='X3pGTSOuJeEVw989IJ/cEtXUEmy52zs1TZQrU06KUKg='; pin-sha256='MHJYVThihUrJcxW6wcqyOISTXIsInsdj3xK8QrZbHec='; pin-sha256='isi41AizREkLvvft0IRW4u3XMFR2Yg7bvrF7padyCJg='; includeSubdomains; max-age=2592000
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.firstcitizensrewards.com/pages/main/default.aspx
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

Date: Tue, 05 Dec 2023 18:47:22 GMT
Content-Security-Policy: default-src https: data: 'unsafe-inline' 'unsafe-eval'
X-Content-Type-Options: nosniff
Strict-Transport-Security: max-age=31536000; includeSubDomains
Last-Modified: Fri, 30 Sep 2022 17:56:38 GMT
X-Permitted-Cross-Domain-Policies: none
ETag: "0cfc0fcf5d4d81:0"
X-Powered-By: ASP.NET
X-Frame-Options: SAMEORIGIN
Content-Type: image/png
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 2024
X-Xss-Protection: 1; mode=block
Public-Key-Pins: pin-sha256='X3pGTSOuJeEVw989IJ/cEtXUEmy52zs1TZQrU06KUKg='; pin-sha256='MHJYVThihUrJcxW6wcqyOISTXIsInsdj3xK8QrZbHec='; pin-sha256='isi41AizREkLvvft0IRW4u3XMFR2Yg7bvrF7padyCJg='; includeSubdomains; max-age=2592000

GET
H/1.1 200
OK New_logo.png
www.firstcitizensrewards.com/images/ 10 KB
11 KB 97ms
97ms Image
image/png 129.159.127.141
ORACLE-BMC-31898

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.firstcitizensrewards.com/images/New_logo.png

Requested by

Host: www.firstcitizensrewards.com
URL: https://www.firstcitizensrewards.com/pages/main/default.aspx

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

129.159.127.141 Ashburn, United States, ASN31898 (ORACLE-BMC-31898, US),

Reverse DNS

Software

/ ASP.NET

Resource Hash

43950b99d7660f2d926f2d17fe9dc74b02d86bbbe4d2f52cf2ab5cc1f9c80d0a

Security Headers

Name	Value
Content-Security-Policy	default-src https: data: 'unsafe-inline' 'unsafe-eval'
Public-Key-Pins	pin-sha256='X3pGTSOuJeEVw989IJ/cEtXUEmy52zs1TZQrU06KUKg='; pin-sha256='MHJYVThihUrJcxW6wcqyOISTXIsInsdj3xK8QrZbHec='; pin-sha256='isi41AizREkLvvft0IRW4u3XMFR2Yg7bvrF7padyCJg='; includeSubdomains; max-age=2592000
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.firstcitizensrewards.com/pages/main/default.aspx
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

Date: Tue, 05 Dec 2023 18:47:22 GMT
Content-Security-Policy: default-src https: data: 'unsafe-inline' 'unsafe-eval'
X-Content-Type-Options: nosniff
Strict-Transport-Security: max-age=31536000; includeSubDomains
Last-Modified: Fri, 30 Sep 2022 17:56:38 GMT
X-Permitted-Cross-Domain-Policies: none
ETag: "0cfc0fcf5d4d81:0"
X-Powered-By: ASP.NET
X-Frame-Options: SAMEORIGIN
Content-Type: image/png
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 10502
X-Xss-Protection: 1; mode=block
Public-Key-Pins: pin-sha256='X3pGTSOuJeEVw989IJ/cEtXUEmy52zs1TZQrU06KUKg='; pin-sha256='MHJYVThihUrJcxW6wcqyOISTXIsInsdj3xK8QrZbHec='; pin-sha256='isi41AizREkLvvft0IRW4u3XMFR2Yg7bvrF7padyCJg='; includeSubdomains; max-age=2592000

GET
H/1.1 200
OK New_mobile-logo.png
www.firstcitizensrewards.com/images/ 8 KB
8 KB 96ms
96ms Image
image/png 129.159.127.141
ORACLE-BMC-31898

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.firstcitizensrewards.com/images/New_mobile-logo.png

Requested by

Host: www.firstcitizensrewards.com
URL: https://www.firstcitizensrewards.com/pages/main/default.aspx

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

129.159.127.141 Ashburn, United States, ASN31898 (ORACLE-BMC-31898, US),

Reverse DNS

Software

/ ASP.NET

Resource Hash

c104f24454cb98ba2ff67a8bbe0ea495703cc82f5ed2fe56fe295b612d6eaaab

Security Headers

Name	Value
Content-Security-Policy	default-src https: data: 'unsafe-inline' 'unsafe-eval'
Public-Key-Pins	pin-sha256='X3pGTSOuJeEVw989IJ/cEtXUEmy52zs1TZQrU06KUKg='; pin-sha256='MHJYVThihUrJcxW6wcqyOISTXIsInsdj3xK8QrZbHec='; pin-sha256='isi41AizREkLvvft0IRW4u3XMFR2Yg7bvrF7padyCJg='; includeSubdomains; max-age=2592000
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.firstcitizensrewards.com/pages/main/default.aspx
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

Date: Tue, 05 Dec 2023 18:47:22 GMT
Content-Security-Policy: default-src https: data: 'unsafe-inline' 'unsafe-eval'
X-Content-Type-Options: nosniff
Strict-Transport-Security: max-age=31536000; includeSubDomains
Last-Modified: Fri, 30 Sep 2022 17:56:38 GMT
X-Permitted-Cross-Domain-Policies: none
ETag: "0cfc0fcf5d4d81:0"
X-Powered-By: ASP.NET
X-Frame-Options: SAMEORIGIN
Content-Type: image/png
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 7702
X-Xss-Protection: 1; mode=block
Public-Key-Pins: pin-sha256='X3pGTSOuJeEVw989IJ/cEtXUEmy52zs1TZQrU06KUKg='; pin-sha256='MHJYVThihUrJcxW6wcqyOISTXIsInsdj3xK8QrZbHec='; pin-sha256='isi41AizREkLvvft0IRW4u3XMFR2Yg7bvrF7padyCJg='; includeSubdomains; max-age=2592000

GET
H/1.1 200
OK New_logo-mobile-small.png
www.firstcitizensrewards.com/images/ 8 KB
8 KB 95ms
95ms Image
image/png 129.159.127.141
ORACLE-BMC-31898

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.firstcitizensrewards.com/images/New_logo-mobile-small.png

Requested by

Host: www.firstcitizensrewards.com
URL: https://www.firstcitizensrewards.com/pages/main/default.aspx

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

129.159.127.141 Ashburn, United States, ASN31898 (ORACLE-BMC-31898, US),

Reverse DNS

Software

/ ASP.NET

Resource Hash

d07666d005831d406475474a607cd18800ff7451a3181e629fa345dd30f583c7

Security Headers

Name	Value
Content-Security-Policy	default-src https: data: 'unsafe-inline' 'unsafe-eval'
Public-Key-Pins	pin-sha256='X3pGTSOuJeEVw989IJ/cEtXUEmy52zs1TZQrU06KUKg='; pin-sha256='MHJYVThihUrJcxW6wcqyOISTXIsInsdj3xK8QrZbHec='; pin-sha256='isi41AizREkLvvft0IRW4u3XMFR2Yg7bvrF7padyCJg='; includeSubdomains; max-age=2592000
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.firstcitizensrewards.com/pages/main/default.aspx
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

Date: Tue, 05 Dec 2023 18:47:22 GMT
Content-Security-Policy: default-src https: data: 'unsafe-inline' 'unsafe-eval'
X-Content-Type-Options: nosniff
Strict-Transport-Security: max-age=31536000; includeSubDomains
Last-Modified: Fri, 30 Sep 2022 17:56:38 GMT
X-Permitted-Cross-Domain-Policies: none
ETag: "0cfc0fcf5d4d81:0"
X-Powered-By: ASP.NET
X-Frame-Options: SAMEORIGIN
Content-Type: image/png
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 7689
X-Xss-Protection: 1; mode=block
Public-Key-Pins: pin-sha256='X3pGTSOuJeEVw989IJ/cEtXUEmy52zs1TZQrU06KUKg='; pin-sha256='MHJYVThihUrJcxW6wcqyOISTXIsInsdj3xK8QrZbHec='; pin-sha256='isi41AizREkLvvft0IRW4u3XMFR2Yg7bvrF7padyCJg='; includeSubdomains; max-age=2592000

GET
H/1.1 200
OK 79003b61-b829-45fe-a5a9-d06f4514ebc9.png
www.firstcitizensrewards.com/graphics/ 1 MB
1 MB 97ms
97ms Image
image/png 129.159.127.141
ORACLE-BMC-31898

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.firstcitizensrewards.com/graphics/79003b61-b829-45fe-a5a9-d06f4514ebc9.png

Requested by

Host: www.firstcitizensrewards.com
URL: https://www.firstcitizensrewards.com/pages/main/default.aspx

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

129.159.127.141 Ashburn, United States, ASN31898 (ORACLE-BMC-31898, US),

Reverse DNS

Software

/ ASP.NET

Resource Hash

40ef3a508a4df47da46c1c3c9cd35f89277db282caa46e5ae1cbbcf6bf60bbee

Security Headers

Name	Value
Content-Security-Policy	default-src https: data: 'unsafe-inline' 'unsafe-eval'
Public-Key-Pins	pin-sha256='X3pGTSOuJeEVw989IJ/cEtXUEmy52zs1TZQrU06KUKg='; pin-sha256='MHJYVThihUrJcxW6wcqyOISTXIsInsdj3xK8QrZbHec='; pin-sha256='isi41AizREkLvvft0IRW4u3XMFR2Yg7bvrF7padyCJg='; includeSubdomains; max-age=2592000
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.firstcitizensrewards.com/pages/main/default.aspx
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

Date: Tue, 05 Dec 2023 18:47:22 GMT
Content-Security-Policy: default-src https: data: 'unsafe-inline' 'unsafe-eval'
X-Content-Type-Options: nosniff
Strict-Transport-Security: max-age=31536000; includeSubDomains
Last-Modified: Thu, 19 May 2022 09:46:24 GMT
X-Permitted-Cross-Domain-Policies: none
ETag: "0184a4d656bd81:0"
X-Powered-By: ASP.NET
X-Frame-Options: SAMEORIGIN
Content-Type: image/png
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 1195487
X-Xss-Protection: 1; mode=block
Public-Key-Pins: pin-sha256='X3pGTSOuJeEVw989IJ/cEtXUEmy52zs1TZQrU06KUKg='; pin-sha256='MHJYVThihUrJcxW6wcqyOISTXIsInsdj3xK8QrZbHec='; pin-sha256='isi41AizREkLvvft0IRW4u3XMFR2Yg7bvrF7padyCJg='; includeSubdomains; max-age=2592000

GET
H/1.1 200
OK 4cb21422-bbc7-4ec5-866a-5b38524f7879.png
www.firstcitizensrewards.com/graphics/ 315 KB
316 KB 163ms
99ms Image
image/png 129.159.127.141
ORACLE-BMC-31898

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.firstcitizensrewards.com/graphics/4cb21422-bbc7-4ec5-866a-5b38524f7879.png

Requested by

Host: www.firstcitizensrewards.com
URL: https://www.firstcitizensrewards.com/pages/main/default.aspx

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

129.159.127.141 Ashburn, United States, ASN31898 (ORACLE-BMC-31898, US),

Reverse DNS

Software

/ ASP.NET

Resource Hash

2c690abc65232a93c89dc14b3a4e0bf461eb6e42e55aee8ce4f00361f9f6d524

Security Headers

Name	Value
Content-Security-Policy	default-src https: data: 'unsafe-inline' 'unsafe-eval'
Public-Key-Pins	pin-sha256='X3pGTSOuJeEVw989IJ/cEtXUEmy52zs1TZQrU06KUKg='; pin-sha256='MHJYVThihUrJcxW6wcqyOISTXIsInsdj3xK8QrZbHec='; pin-sha256='isi41AizREkLvvft0IRW4u3XMFR2Yg7bvrF7padyCJg='; includeSubdomains; max-age=2592000
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.firstcitizensrewards.com/pages/main/default.aspx
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

Date: Tue, 05 Dec 2023 18:47:22 GMT
Content-Security-Policy: default-src https: data: 'unsafe-inline' 'unsafe-eval'
X-Content-Type-Options: nosniff
Strict-Transport-Security: max-age=31536000; includeSubDomains
Last-Modified: Tue, 11 Oct 2022 13:54:20 GMT
X-Permitted-Cross-Domain-Policies: none
ETag: "04ef9f578ddd81:0"
X-Powered-By: ASP.NET
X-Frame-Options: SAMEORIGIN
Content-Type: image/png
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 322835
X-Xss-Protection: 1; mode=block
Public-Key-Pins: pin-sha256='X3pGTSOuJeEVw989IJ/cEtXUEmy52zs1TZQrU06KUKg='; pin-sha256='MHJYVThihUrJcxW6wcqyOISTXIsInsdj3xK8QrZbHec='; pin-sha256='isi41AizREkLvvft0IRW4u3XMFR2Yg7bvrF7padyCJg='; includeSubdomains; max-age=2592000

GET
H/1.1 200
OK icon-white_gas.png
www.firstcitizensrewards.com/images/icons/ 15 KB
16 KB 96ms
96ms Image
image/png 129.159.127.141
ORACLE-BMC-31898

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.firstcitizensrewards.com/images/icons/icon-white_gas.png

Requested by

Host: www.firstcitizensrewards.com
URL: https://www.firstcitizensrewards.com/pages/main/default.aspx

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

129.159.127.141 Ashburn, United States, ASN31898 (ORACLE-BMC-31898, US),

Reverse DNS

Software

/ ASP.NET

Resource Hash

5a4e98e4199894be49adff3642753711ec805292607447f0a59297c24ad2bb9f

Security Headers

Name	Value
Content-Security-Policy	default-src https: data: 'unsafe-inline' 'unsafe-eval'
Public-Key-Pins	pin-sha256='X3pGTSOuJeEVw989IJ/cEtXUEmy52zs1TZQrU06KUKg='; pin-sha256='MHJYVThihUrJcxW6wcqyOISTXIsInsdj3xK8QrZbHec='; pin-sha256='isi41AizREkLvvft0IRW4u3XMFR2Yg7bvrF7padyCJg='; includeSubdomains; max-age=2592000
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.firstcitizensrewards.com/pages/main/default.aspx
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

Date: Tue, 05 Dec 2023 18:47:22 GMT
Content-Security-Policy: default-src https: data: 'unsafe-inline' 'unsafe-eval'
X-Content-Type-Options: nosniff
Strict-Transport-Security: max-age=31536000; includeSubDomains
Last-Modified: Fri, 30 Sep 2022 17:56:38 GMT
X-Permitted-Cross-Domain-Policies: none
ETag: "0cfc0fcf5d4d81:0"
X-Powered-By: ASP.NET
X-Frame-Options: SAMEORIGIN
Content-Type: image/png
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 15429
X-Xss-Protection: 1; mode=block
Public-Key-Pins: pin-sha256='X3pGTSOuJeEVw989IJ/cEtXUEmy52zs1TZQrU06KUKg='; pin-sha256='MHJYVThihUrJcxW6wcqyOISTXIsInsdj3xK8QrZbHec='; pin-sha256='isi41AizREkLvvft0IRW4u3XMFR2Yg7bvrF7padyCJg='; includeSubdomains; max-age=2592000

GET
H/1.1 200
OK icon-white_dining.png
www.firstcitizensrewards.com/images/icons/ 16 KB
17 KB 95ms
95ms Image
image/png 129.159.127.141
ORACLE-BMC-31898

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.firstcitizensrewards.com/images/icons/icon-white_dining.png

Requested by

Host: www.firstcitizensrewards.com
URL: https://www.firstcitizensrewards.com/pages/main/default.aspx

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

129.159.127.141 Ashburn, United States, ASN31898 (ORACLE-BMC-31898, US),

Reverse DNS

Software

/ ASP.NET

Resource Hash

b8f709b278ef98077988ebfdffb5e348522f8ab0c10c6963dad35e4a3d629096

Security Headers

Name	Value
Content-Security-Policy	default-src https: data: 'unsafe-inline' 'unsafe-eval'
Public-Key-Pins	pin-sha256='X3pGTSOuJeEVw989IJ/cEtXUEmy52zs1TZQrU06KUKg='; pin-sha256='MHJYVThihUrJcxW6wcqyOISTXIsInsdj3xK8QrZbHec='; pin-sha256='isi41AizREkLvvft0IRW4u3XMFR2Yg7bvrF7padyCJg='; includeSubdomains; max-age=2592000
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.firstcitizensrewards.com/pages/main/default.aspx
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

Date: Tue, 05 Dec 2023 18:47:22 GMT
Content-Security-Policy: default-src https: data: 'unsafe-inline' 'unsafe-eval'
X-Content-Type-Options: nosniff
Strict-Transport-Security: max-age=31536000; includeSubDomains
Last-Modified: Fri, 30 Sep 2022 17:56:38 GMT
X-Permitted-Cross-Domain-Policies: none
ETag: "0cfc0fcf5d4d81:0"
X-Powered-By: ASP.NET
X-Frame-Options: SAMEORIGIN
Content-Type: image/png
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 16669
X-Xss-Protection: 1; mode=block
Public-Key-Pins: pin-sha256='X3pGTSOuJeEVw989IJ/cEtXUEmy52zs1TZQrU06KUKg='; pin-sha256='MHJYVThihUrJcxW6wcqyOISTXIsInsdj3xK8QrZbHec='; pin-sha256='isi41AizREkLvvft0IRW4u3XMFR2Yg7bvrF7padyCJg='; includeSubdomains; max-age=2592000

GET
H/1.1 200
OK icon-white_shopping.png
www.firstcitizensrewards.com/images/icons/ 2 KB
3 KB 95ms
94ms Image
image/png 129.159.127.141
ORACLE-BMC-31898

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.firstcitizensrewards.com/images/icons/icon-white_shopping.png

Requested by

Host: www.firstcitizensrewards.com
URL: https://www.firstcitizensrewards.com/pages/main/default.aspx

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

129.159.127.141 Ashburn, United States, ASN31898 (ORACLE-BMC-31898, US),

Reverse DNS

Software

/ ASP.NET

Resource Hash

f5fece0d25a46b78f20a9e20b928c52b530417af417c997f3e9e25b504a43d6d

Security Headers

Name	Value
Content-Security-Policy	default-src https: data: 'unsafe-inline' 'unsafe-eval'
Public-Key-Pins	pin-sha256='X3pGTSOuJeEVw989IJ/cEtXUEmy52zs1TZQrU06KUKg='; pin-sha256='MHJYVThihUrJcxW6wcqyOISTXIsInsdj3xK8QrZbHec='; pin-sha256='isi41AizREkLvvft0IRW4u3XMFR2Yg7bvrF7padyCJg='; includeSubdomains; max-age=2592000
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.firstcitizensrewards.com/pages/main/default.aspx
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

Date: Tue, 05 Dec 2023 18:47:23 GMT
Content-Security-Policy: default-src https: data: 'unsafe-inline' 'unsafe-eval'
X-Content-Type-Options: nosniff
Strict-Transport-Security: max-age=31536000; includeSubDomains
Last-Modified: Fri, 30 Sep 2022 17:56:38 GMT
X-Permitted-Cross-Domain-Policies: none
ETag: "0cfc0fcf5d4d81:0"
X-Powered-By: ASP.NET
X-Frame-Options: SAMEORIGIN
Content-Type: image/png
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 2094
X-Xss-Protection: 1; mode=block
Public-Key-Pins: pin-sha256='X3pGTSOuJeEVw989IJ/cEtXUEmy52zs1TZQrU06KUKg='; pin-sha256='MHJYVThihUrJcxW6wcqyOISTXIsInsdj3xK8QrZbHec='; pin-sha256='isi41AizREkLvvft0IRW4u3XMFR2Yg7bvrF7padyCJg='; includeSubdomains; max-age=2592000

GET
H/1.1 200
OK icon-white_travel.png
www.firstcitizensrewards.com/images/icons/ 16 KB
16 KB 96ms
96ms Image
image/png 129.159.127.141
ORACLE-BMC-31898

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.firstcitizensrewards.com/images/icons/icon-white_travel.png

Requested by

Host: www.firstcitizensrewards.com
URL: https://www.firstcitizensrewards.com/pages/main/default.aspx

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

129.159.127.141 Ashburn, United States, ASN31898 (ORACLE-BMC-31898, US),

Reverse DNS

Software

/ ASP.NET

Resource Hash

8f3afe36f81d30bc8033f69a9791facbf99c7b6fa74c7187bc526472460558b2

Security Headers

Name	Value
Content-Security-Policy	default-src https: data: 'unsafe-inline' 'unsafe-eval'
Public-Key-Pins	pin-sha256='X3pGTSOuJeEVw989IJ/cEtXUEmy52zs1TZQrU06KUKg='; pin-sha256='MHJYVThihUrJcxW6wcqyOISTXIsInsdj3xK8QrZbHec='; pin-sha256='isi41AizREkLvvft0IRW4u3XMFR2Yg7bvrF7padyCJg='; includeSubdomains; max-age=2592000
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.firstcitizensrewards.com/pages/main/default.aspx
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

Date: Tue, 05 Dec 2023 18:47:23 GMT
Content-Security-Policy: default-src https: data: 'unsafe-inline' 'unsafe-eval'
X-Content-Type-Options: nosniff
Strict-Transport-Security: max-age=31536000; includeSubDomains
Last-Modified: Fri, 30 Sep 2022 17:56:38 GMT
X-Permitted-Cross-Domain-Policies: none
ETag: "0cfc0fcf5d4d81:0"
X-Powered-By: ASP.NET
X-Frame-Options: SAMEORIGIN
Content-Type: image/png
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 16118
X-Xss-Protection: 1; mode=block
Public-Key-Pins: pin-sha256='X3pGTSOuJeEVw989IJ/cEtXUEmy52zs1TZQrU06KUKg='; pin-sha256='MHJYVThihUrJcxW6wcqyOISTXIsInsdj3xK8QrZbHec='; pin-sha256='isi41AizREkLvvft0IRW4u3XMFR2Yg7bvrF7padyCJg='; includeSubdomains; max-age=2592000

GET
H/1.1 200
OK icon-white_pooling.png
www.firstcitizensrewards.com/images/icons/ 16 KB
17 KB 95ms
95ms Image
image/png 129.159.127.141
ORACLE-BMC-31898

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.firstcitizensrewards.com/images/icons/icon-white_pooling.png

Requested by

Host: www.firstcitizensrewards.com
URL: https://www.firstcitizensrewards.com/pages/main/default.aspx

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

129.159.127.141 Ashburn, United States, ASN31898 (ORACLE-BMC-31898, US),

Reverse DNS

Software

/ ASP.NET

Resource Hash

f980a61903248079a4bfa278d1ece2209c747604cd58b9eba9e80f433db3c39a

Security Headers

Name	Value
Content-Security-Policy	default-src https: data: 'unsafe-inline' 'unsafe-eval'
Public-Key-Pins	pin-sha256='X3pGTSOuJeEVw989IJ/cEtXUEmy52zs1TZQrU06KUKg='; pin-sha256='MHJYVThihUrJcxW6wcqyOISTXIsInsdj3xK8QrZbHec='; pin-sha256='isi41AizREkLvvft0IRW4u3XMFR2Yg7bvrF7padyCJg='; includeSubdomains; max-age=2592000
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.firstcitizensrewards.com/pages/main/default.aspx
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

Date: Tue, 05 Dec 2023 18:47:23 GMT
Content-Security-Policy: default-src https: data: 'unsafe-inline' 'unsafe-eval'
X-Content-Type-Options: nosniff
Strict-Transport-Security: max-age=31536000; includeSubDomains
Last-Modified: Fri, 30 Sep 2022 17:56:38 GMT
X-Permitted-Cross-Domain-Policies: none
ETag: "0cfc0fcf5d4d81:0"
X-Powered-By: ASP.NET
X-Frame-Options: SAMEORIGIN
Content-Type: image/png
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 16885
X-Xss-Protection: 1; mode=block
Public-Key-Pins: pin-sha256='X3pGTSOuJeEVw989IJ/cEtXUEmy52zs1TZQrU06KUKg='; pin-sha256='MHJYVThihUrJcxW6wcqyOISTXIsInsdj3xK8QrZbHec='; pin-sha256='isi41AizREkLvvft0IRW4u3XMFR2Yg7bvrF7padyCJg='; includeSubdomains; max-age=2592000

GET
H/1.1 200
OK icon-white-gift_points.png
www.firstcitizensrewards.com/images/icons/ 15 KB
16 KB 95ms
95ms Image
image/png 129.159.127.141
ORACLE-BMC-31898

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.firstcitizensrewards.com/images/icons/icon-white-gift_points.png

Requested by

Host: www.firstcitizensrewards.com
URL: https://www.firstcitizensrewards.com/pages/main/default.aspx

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

129.159.127.141 Ashburn, United States, ASN31898 (ORACLE-BMC-31898, US),

Reverse DNS

Software

/ ASP.NET

Resource Hash

7841131e25c56e0629fc0d09618882b7271f7c318f57e848dd5b77c74030a0f3

Security Headers

Name	Value
Content-Security-Policy	default-src https: data: 'unsafe-inline' 'unsafe-eval'
Public-Key-Pins	pin-sha256='X3pGTSOuJeEVw989IJ/cEtXUEmy52zs1TZQrU06KUKg='; pin-sha256='MHJYVThihUrJcxW6wcqyOISTXIsInsdj3xK8QrZbHec='; pin-sha256='isi41AizREkLvvft0IRW4u3XMFR2Yg7bvrF7padyCJg='; includeSubdomains; max-age=2592000
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.firstcitizensrewards.com/pages/main/default.aspx
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

Date: Tue, 05 Dec 2023 18:47:23 GMT
Content-Security-Policy: default-src https: data: 'unsafe-inline' 'unsafe-eval'
X-Content-Type-Options: nosniff
Strict-Transport-Security: max-age=31536000; includeSubDomains
Last-Modified: Fri, 30 Sep 2022 17:56:38 GMT
X-Permitted-Cross-Domain-Policies: none
ETag: "0cfc0fcf5d4d81:0"
X-Powered-By: ASP.NET
X-Frame-Options: SAMEORIGIN
Content-Type: image/png
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 15728
X-Xss-Protection: 1; mode=block
Public-Key-Pins: pin-sha256='X3pGTSOuJeEVw989IJ/cEtXUEmy52zs1TZQrU06KUKg='; pin-sha256='MHJYVThihUrJcxW6wcqyOISTXIsInsdj3xK8QrZbHec='; pin-sha256='isi41AizREkLvvft0IRW4u3XMFR2Yg7bvrF7padyCJg='; includeSubdomains; max-age=2592000

GET
H/1.1 200
OK icon-darkblue-travel.png
www.firstcitizensrewards.com/images/icons/ 1 KB
2 KB 96ms
95ms Image
image/png 129.159.127.141
ORACLE-BMC-31898

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.firstcitizensrewards.com/images/icons/icon-darkblue-travel.png

Requested by

Host: www.firstcitizensrewards.com
URL: https://www.firstcitizensrewards.com/pages/main/default.aspx

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

129.159.127.141 Ashburn, United States, ASN31898 (ORACLE-BMC-31898, US),

Reverse DNS

Software

/ ASP.NET

Resource Hash

0085b16186957822940d8bcca5fb3c4b8c2d25ec43218dd1830d050e401f9f79

Security Headers

Name	Value
Content-Security-Policy	default-src https: data: 'unsafe-inline' 'unsafe-eval'
Public-Key-Pins	pin-sha256='X3pGTSOuJeEVw989IJ/cEtXUEmy52zs1TZQrU06KUKg='; pin-sha256='MHJYVThihUrJcxW6wcqyOISTXIsInsdj3xK8QrZbHec='; pin-sha256='isi41AizREkLvvft0IRW4u3XMFR2Yg7bvrF7padyCJg='; includeSubdomains; max-age=2592000
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.firstcitizensrewards.com/pages/main/default.aspx
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

Date: Tue, 05 Dec 2023 18:47:23 GMT
Content-Security-Policy: default-src https: data: 'unsafe-inline' 'unsafe-eval'
X-Content-Type-Options: nosniff
Strict-Transport-Security: max-age=31536000; includeSubDomains
Last-Modified: Fri, 30 Sep 2022 17:56:38 GMT
X-Permitted-Cross-Domain-Policies: none
ETag: "0cfc0fcf5d4d81:0"
X-Powered-By: ASP.NET
X-Frame-Options: SAMEORIGIN
Content-Type: image/png
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 1344
X-Xss-Protection: 1; mode=block
Public-Key-Pins: pin-sha256='X3pGTSOuJeEVw989IJ/cEtXUEmy52zs1TZQrU06KUKg='; pin-sha256='MHJYVThihUrJcxW6wcqyOISTXIsInsdj3xK8QrZbHec='; pin-sha256='isi41AizREkLvvft0IRW4u3XMFR2Yg7bvrF7padyCJg='; includeSubdomains; max-age=2592000

GET
H/1.1 200
OK icon-darkblue-merchandise.png
www.firstcitizensrewards.com/images/icons/ 2 KB
3 KB 94ms
94ms Image
image/png 129.159.127.141
ORACLE-BMC-31898

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.firstcitizensrewards.com/images/icons/icon-darkblue-merchandise.png

Requested by

Host: www.firstcitizensrewards.com
URL: https://www.firstcitizensrewards.com/pages/main/default.aspx

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

129.159.127.141 Ashburn, United States, ASN31898 (ORACLE-BMC-31898, US),

Reverse DNS

Software

/ ASP.NET

Resource Hash

19a88567b84481ed390493b76efdb52c1ca480a41565713cbdfc5660add6dba2

Security Headers

Name	Value
Content-Security-Policy	default-src https: data: 'unsafe-inline' 'unsafe-eval'
Public-Key-Pins	pin-sha256='X3pGTSOuJeEVw989IJ/cEtXUEmy52zs1TZQrU06KUKg='; pin-sha256='MHJYVThihUrJcxW6wcqyOISTXIsInsdj3xK8QrZbHec='; pin-sha256='isi41AizREkLvvft0IRW4u3XMFR2Yg7bvrF7padyCJg='; includeSubdomains; max-age=2592000
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.firstcitizensrewards.com/pages/main/default.aspx
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

Date: Tue, 05 Dec 2023 18:47:23 GMT
Content-Security-Policy: default-src https: data: 'unsafe-inline' 'unsafe-eval'
X-Content-Type-Options: nosniff
Strict-Transport-Security: max-age=31536000; includeSubDomains
Last-Modified: Fri, 30 Sep 2022 17:56:38 GMT
X-Permitted-Cross-Domain-Policies: none
ETag: "0cfc0fcf5d4d81:0"
X-Powered-By: ASP.NET
X-Frame-Options: SAMEORIGIN
Content-Type: image/png
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 1926
X-Xss-Protection: 1; mode=block
Public-Key-Pins: pin-sha256='X3pGTSOuJeEVw989IJ/cEtXUEmy52zs1TZQrU06KUKg='; pin-sha256='MHJYVThihUrJcxW6wcqyOISTXIsInsdj3xK8QrZbHec='; pin-sha256='isi41AizREkLvvft0IRW4u3XMFR2Yg7bvrF7padyCJg='; includeSubdomains; max-age=2592000

GET
H/1.1 200
OK icon-darkblue-gift_cards.png
www.firstcitizensrewards.com/images/icons/ 2 KB
2 KB 95ms
95ms Image
image/png 129.159.127.141
ORACLE-BMC-31898

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.firstcitizensrewards.com/images/icons/icon-darkblue-gift_cards.png

Requested by

Host: www.firstcitizensrewards.com
URL: https://www.firstcitizensrewards.com/pages/main/default.aspx

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

129.159.127.141 Ashburn, United States, ASN31898 (ORACLE-BMC-31898, US),

Reverse DNS

Software

/ ASP.NET

Resource Hash

98824ad5e4abf947dbe64c19947e540a7879aec44e65b330653a865890410dd4

Security Headers

Name	Value
Content-Security-Policy	default-src https: data: 'unsafe-inline' 'unsafe-eval'
Public-Key-Pins	pin-sha256='X3pGTSOuJeEVw989IJ/cEtXUEmy52zs1TZQrU06KUKg='; pin-sha256='MHJYVThihUrJcxW6wcqyOISTXIsInsdj3xK8QrZbHec='; pin-sha256='isi41AizREkLvvft0IRW4u3XMFR2Yg7bvrF7padyCJg='; includeSubdomains; max-age=2592000
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.firstcitizensrewards.com/pages/main/default.aspx
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

Date: Tue, 05 Dec 2023 18:47:23 GMT
Content-Security-Policy: default-src https: data: 'unsafe-inline' 'unsafe-eval'
X-Content-Type-Options: nosniff
Strict-Transport-Security: max-age=31536000; includeSubDomains
Last-Modified: Fri, 30 Sep 2022 17:56:38 GMT
X-Permitted-Cross-Domain-Policies: none
ETag: "0cfc0fcf5d4d81:0"
X-Powered-By: ASP.NET
X-Frame-Options: SAMEORIGIN
Content-Type: image/png
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 1652
X-Xss-Protection: 1; mode=block
Public-Key-Pins: pin-sha256='X3pGTSOuJeEVw989IJ/cEtXUEmy52zs1TZQrU06KUKg='; pin-sha256='MHJYVThihUrJcxW6wcqyOISTXIsInsdj3xK8QrZbHec='; pin-sha256='isi41AizREkLvvft0IRW4u3XMFR2Yg7bvrF7padyCJg='; includeSubdomains; max-age=2592000

GET
H/1.1 200
OK icon-darkblue-gift_box.png
www.firstcitizensrewards.com/images/icons/ 2 KB
3 KB 96ms
96ms Image
image/png 129.159.127.141
ORACLE-BMC-31898

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.firstcitizensrewards.com/images/icons/icon-darkblue-gift_box.png

Requested by

Host: www.firstcitizensrewards.com
URL: https://www.firstcitizensrewards.com/pages/main/default.aspx

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

129.159.127.141 Ashburn, United States, ASN31898 (ORACLE-BMC-31898, US),

Reverse DNS

Software

/ ASP.NET

Resource Hash

3ca430568c6bde1a3fba7fbe5283014c8fc12885e9450fe7c632f6977b322daf

Security Headers

Name	Value
Content-Security-Policy	default-src https: data: 'unsafe-inline' 'unsafe-eval'
Public-Key-Pins	pin-sha256='X3pGTSOuJeEVw989IJ/cEtXUEmy52zs1TZQrU06KUKg='; pin-sha256='MHJYVThihUrJcxW6wcqyOISTXIsInsdj3xK8QrZbHec='; pin-sha256='isi41AizREkLvvft0IRW4u3XMFR2Yg7bvrF7padyCJg='; includeSubdomains; max-age=2592000
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.firstcitizensrewards.com/pages/main/default.aspx
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

Date: Tue, 05 Dec 2023 18:47:23 GMT
Content-Security-Policy: default-src https: data: 'unsafe-inline' 'unsafe-eval'
X-Content-Type-Options: nosniff
Strict-Transport-Security: max-age=31536000; includeSubDomains
Last-Modified: Fri, 30 Sep 2022 17:56:38 GMT
X-Permitted-Cross-Domain-Policies: none
ETag: "0cfc0fcf5d4d81:0"
X-Powered-By: ASP.NET
X-Frame-Options: SAMEORIGIN
Content-Type: image/png
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 1901
X-Xss-Protection: 1; mode=block
Public-Key-Pins: pin-sha256='X3pGTSOuJeEVw989IJ/cEtXUEmy52zs1TZQrU06KUKg='; pin-sha256='MHJYVThihUrJcxW6wcqyOISTXIsInsdj3xK8QrZbHec='; pin-sha256='isi41AizREkLvvft0IRW4u3XMFR2Yg7bvrF7padyCJg='; includeSubdomains; max-age=2592000

GET
H/1.1 200
OK ico-paymeback.png
www.firstcitizensrewards.com/images/ 5 KB
6 KB 94ms
94ms Image
image/png 129.159.127.141
ORACLE-BMC-31898

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.firstcitizensrewards.com/images/ico-paymeback.png

Requested by

Host: www.firstcitizensrewards.com
URL: https://www.firstcitizensrewards.com/pages/main/default.aspx

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

129.159.127.141 Ashburn, United States, ASN31898 (ORACLE-BMC-31898, US),

Reverse DNS

Software

/ ASP.NET

Resource Hash

ff82e79f2a1b80b68510c46cd0693a87a8d27a6984fd69c8613329fc0ba523b3

Security Headers

Name	Value
Content-Security-Policy	default-src https: data: 'unsafe-inline' 'unsafe-eval'
Public-Key-Pins	pin-sha256='X3pGTSOuJeEVw989IJ/cEtXUEmy52zs1TZQrU06KUKg='; pin-sha256='MHJYVThihUrJcxW6wcqyOISTXIsInsdj3xK8QrZbHec='; pin-sha256='isi41AizREkLvvft0IRW4u3XMFR2Yg7bvrF7padyCJg='; includeSubdomains; max-age=2592000
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.firstcitizensrewards.com/pages/main/default.aspx
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

Date: Tue, 05 Dec 2023 18:47:23 GMT
Content-Security-Policy: default-src https: data: 'unsafe-inline' 'unsafe-eval'
X-Content-Type-Options: nosniff
Strict-Transport-Security: max-age=31536000; includeSubDomains
Last-Modified: Fri, 30 Sep 2022 17:56:38 GMT
X-Permitted-Cross-Domain-Policies: none
ETag: "0cfc0fcf5d4d81:0"
X-Powered-By: ASP.NET
X-Frame-Options: SAMEORIGIN
Content-Type: image/png
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 5047
X-Xss-Protection: 1; mode=block
Public-Key-Pins: pin-sha256='X3pGTSOuJeEVw989IJ/cEtXUEmy52zs1TZQrU06KUKg='; pin-sha256='MHJYVThihUrJcxW6wcqyOISTXIsInsdj3xK8QrZbHec='; pin-sha256='isi41AizREkLvvft0IRW4u3XMFR2Yg7bvrF7padyCJg='; includeSubdomains; max-age=2592000

GET
H/1.1 200
OK skrollr.min.js Show response
www.firstcitizensrewards.com/scripts/ 11 KB
7 KB 98ms
98ms Script
application/javascript 129.159.127.141
ORACLE-BMC-31898

General

Check archive.org

Show headers Download Go to

Full URL

https://www.firstcitizensrewards.com/scripts/skrollr.min.js

Requested by

Host: www.firstcitizensrewards.com
URL: https://www.firstcitizensrewards.com/pages/main/default.aspx

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

129.159.127.141 Ashburn, United States, ASN31898 (ORACLE-BMC-31898, US),

Reverse DNS

Software

/ ASP.NET

Resource Hash

c2c10abb0f3eb00cfe81e422269b2c8f27b33ddbfa33507a1687aae45305f606

Security Headers

Name	Value
Content-Security-Policy	default-src https: data: 'unsafe-inline' 'unsafe-eval'
Public-Key-Pins	pin-sha256='X3pGTSOuJeEVw989IJ/cEtXUEmy52zs1TZQrU06KUKg='; pin-sha256='MHJYVThihUrJcxW6wcqyOISTXIsInsdj3xK8QrZbHec='; pin-sha256='isi41AizREkLvvft0IRW4u3XMFR2Yg7bvrF7padyCJg='; includeSubdomains; max-age=2592000
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.firstcitizensrewards.com/pages/main/default.aspx
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

Date: Tue, 05 Dec 2023 18:47:22 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Content-Security-Policy: default-src https: data: 'unsafe-inline' 'unsafe-eval'
X-Permitted-Cross-Domain-Policies: none
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-Powered-By: ASP.NET
Connection: keep-alive
Content-Length: 5953
X-Xss-Protection: 1; mode=block
Public-Key-Pins: pin-sha256='X3pGTSOuJeEVw989IJ/cEtXUEmy52zs1TZQrU06KUKg='; pin-sha256='MHJYVThihUrJcxW6wcqyOISTXIsInsdj3xK8QrZbHec='; pin-sha256='isi41AizREkLvvft0IRW4u3XMFR2Yg7bvrF7padyCJg='; includeSubdomains; max-age=2592000
Last-Modified: Wed, 16 Feb 2022 15:00:04 GMT
ETag: "fc6937e14523d81:0"
Vary: Accept-Encoding
X-Frame-Options: SAMEORIGIN
Content-Type: application/javascript
Accept-Ranges: bytes

GET
H/1.1 200
OK jquery.nicescroll.min.js Show response
www.firstcitizensrewards.com/scripts/ 57 KB
22 KB 112ms
111ms Script
application/javascript 129.159.127.141
ORACLE-BMC-31898

General

Check archive.org

Show headers Download Go to

Full URL

https://www.firstcitizensrewards.com/scripts/jquery.nicescroll.min.js

Requested by

Host: www.firstcitizensrewards.com
URL: https://www.firstcitizensrewards.com/pages/main/default.aspx

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

129.159.127.141 Ashburn, United States, ASN31898 (ORACLE-BMC-31898, US),

Reverse DNS

Software

/ ASP.NET

Resource Hash

286f2ddd2a473e6a567380ecb5f6440b8943865ba4690e4ae15a2f34a8a3b297

Security Headers

Name	Value
Content-Security-Policy	default-src https: data: 'unsafe-inline' 'unsafe-eval'
Public-Key-Pins	pin-sha256='X3pGTSOuJeEVw989IJ/cEtXUEmy52zs1TZQrU06KUKg='; pin-sha256='MHJYVThihUrJcxW6wcqyOISTXIsInsdj3xK8QrZbHec='; pin-sha256='isi41AizREkLvvft0IRW4u3XMFR2Yg7bvrF7padyCJg='; includeSubdomains; max-age=2592000
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.firstcitizensrewards.com/pages/main/default.aspx
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

Date: Tue, 05 Dec 2023 18:47:22 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Content-Security-Policy: default-src https: data: 'unsafe-inline' 'unsafe-eval'
X-Permitted-Cross-Domain-Policies: none
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-Powered-By: ASP.NET
Connection: keep-alive
Content-Length: 21277
X-Xss-Protection: 1; mode=block
Public-Key-Pins: pin-sha256='X3pGTSOuJeEVw989IJ/cEtXUEmy52zs1TZQrU06KUKg='; pin-sha256='MHJYVThihUrJcxW6wcqyOISTXIsInsdj3xK8QrZbHec='; pin-sha256='isi41AizREkLvvft0IRW4u3XMFR2Yg7bvrF7padyCJg='; includeSubdomains; max-age=2592000
Last-Modified: Wed, 16 Feb 2022 15:00:04 GMT
ETag: "176430e14523d81:0"
Vary: Accept-Encoding
X-Frame-Options: SAMEORIGIN
Content-Type: application/javascript
Accept-Ranges: bytes

GET
H/1.1 200
OK jquery.nicescroll.plus.js Show response
www.firstcitizensrewards.com/scripts/ 3 KB
2 KB 104ms
103ms Script
application/javascript 129.159.127.141
ORACLE-BMC-31898

General

Check archive.org

Show headers Download Go to

Full URL

https://www.firstcitizensrewards.com/scripts/jquery.nicescroll.plus.js

Requested by

Host: www.firstcitizensrewards.com
URL: https://www.firstcitizensrewards.com/pages/main/default.aspx

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

129.159.127.141 Ashburn, United States, ASN31898 (ORACLE-BMC-31898, US),

Reverse DNS

Software

/ ASP.NET

Resource Hash

dad91c0601fccbf443d580da55ebae4bf031190be711132e62bc7fb66040a3a3

Security Headers

Name	Value
Content-Security-Policy	default-src https: data: 'unsafe-inline' 'unsafe-eval'
Public-Key-Pins	pin-sha256='X3pGTSOuJeEVw989IJ/cEtXUEmy52zs1TZQrU06KUKg='; pin-sha256='MHJYVThihUrJcxW6wcqyOISTXIsInsdj3xK8QrZbHec='; pin-sha256='isi41AizREkLvvft0IRW4u3XMFR2Yg7bvrF7padyCJg='; includeSubdomains; max-age=2592000
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.firstcitizensrewards.com/pages/main/default.aspx
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

Date: Tue, 05 Dec 2023 18:47:22 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Content-Security-Policy: default-src https: data: 'unsafe-inline' 'unsafe-eval'
X-Permitted-Cross-Domain-Policies: none
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-Powered-By: ASP.NET
Connection: keep-alive
Content-Length: 1284
X-Xss-Protection: 1; mode=block
Public-Key-Pins: pin-sha256='X3pGTSOuJeEVw989IJ/cEtXUEmy52zs1TZQrU06KUKg='; pin-sha256='MHJYVThihUrJcxW6wcqyOISTXIsInsdj3xK8QrZbHec='; pin-sha256='isi41AizREkLvvft0IRW4u3XMFR2Yg7bvrF7padyCJg='; includeSubdomains; max-age=2592000
Last-Modified: Wed, 16 Feb 2022 15:00:04 GMT
ETag: "f4bb30e14523d81:0"
Vary: Accept-Encoding
X-Frame-Options: SAMEORIGIN
Content-Type: application/javascript
Accept-Ranges: bytes

GET
H/1.1 200
OK home.js Show response
www.firstcitizensrewards.com/scripts/ 11 KB
4 KB 98ms
97ms Script
application/javascript 129.159.127.141
ORACLE-BMC-31898

General

Check archive.org

Show headers Download Go to

Full URL

https://www.firstcitizensrewards.com/scripts/home.js

Requested by

Host: www.firstcitizensrewards.com
URL: https://www.firstcitizensrewards.com/pages/main/default.aspx

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

129.159.127.141 Ashburn, United States, ASN31898 (ORACLE-BMC-31898, US),

Reverse DNS

Software

/ ASP.NET

Resource Hash

baa7c3be80b75737198e340b51dd58300611afe62e67488f1856a20494ee98cd

Security Headers

Name	Value
Content-Security-Policy	default-src https: data: 'unsafe-inline' 'unsafe-eval'
Public-Key-Pins	pin-sha256='X3pGTSOuJeEVw989IJ/cEtXUEmy52zs1TZQrU06KUKg='; pin-sha256='MHJYVThihUrJcxW6wcqyOISTXIsInsdj3xK8QrZbHec='; pin-sha256='isi41AizREkLvvft0IRW4u3XMFR2Yg7bvrF7padyCJg='; includeSubdomains; max-age=2592000
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.firstcitizensrewards.com/pages/main/default.aspx
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

Date: Tue, 05 Dec 2023 18:47:22 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Content-Security-Policy: default-src https: data: 'unsafe-inline' 'unsafe-eval'
X-Permitted-Cross-Domain-Policies: none
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-Powered-By: ASP.NET
Connection: keep-alive
Content-Length: 3152
X-Xss-Protection: 1; mode=block
Public-Key-Pins: pin-sha256='X3pGTSOuJeEVw989IJ/cEtXUEmy52zs1TZQrU06KUKg='; pin-sha256='MHJYVThihUrJcxW6wcqyOISTXIsInsdj3xK8QrZbHec='; pin-sha256='isi41AizREkLvvft0IRW4u3XMFR2Yg7bvrF7padyCJg='; includeSubdomains; max-age=2592000
Last-Modified: Wed, 16 Feb 2022 15:00:04 GMT
ETag: "2a922ee14523d81:0"
Vary: Accept-Encoding
X-Frame-Options: SAMEORIGIN
Content-Type: application/javascript
Accept-Ranges: bytes

GET
H/1.1 200
OK js Show response
www.firstcitizensrewards.com/scripts/ 64 KB
17 KB 100ms
99ms Script
text/javascript 129.159.127.141
ORACLE-BMC-31898

General

Check archive.org

Show headers Download Go to

Full URL

https://www.firstcitizensrewards.com/scripts/js?v=i4XAIYifWI6huCxVnvhGaTJ9YD5rjk6aiAF_BqobFHw1

Requested by

Host: www.firstcitizensrewards.com
URL: https://www.firstcitizensrewards.com/pages/main/default.aspx

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

129.159.127.141 Ashburn, United States, ASN31898 (ORACLE-BMC-31898, US),

Reverse DNS

Software

/ ASP.NET

Resource Hash

14375c33a937b11eb428ebad24b3e649f72046191e9b1af18e23dbcfd987a2bf

Security Headers

Name	Value
Content-Security-Policy	default-src https: data: 'unsafe-inline' 'unsafe-eval'
Public-Key-Pins	pin-sha256='X3pGTSOuJeEVw989IJ/cEtXUEmy52zs1TZQrU06KUKg='; pin-sha256='MHJYVThihUrJcxW6wcqyOISTXIsInsdj3xK8QrZbHec='; pin-sha256='isi41AizREkLvvft0IRW4u3XMFR2Yg7bvrF7padyCJg='; includeSubdomains; max-age=2592000
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.firstcitizensrewards.com/pages/main/default.aspx
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

Date: Tue, 05 Dec 2023 18:47:22 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Content-Security-Policy: default-src https: data: 'unsafe-inline' 'unsafe-eval'
X-Permitted-Cross-Domain-Policies: none
X-AspNet-Version: 4.0.30319
X-Powered-By: ASP.NET
Strict-Transport-Security: max-age=31536000; includeSubDomains
Connection: keep-alive
Content-Length: 16346
X-Xss-Protection: 1; mode=block
Public-Key-Pins: pin-sha256='X3pGTSOuJeEVw989IJ/cEtXUEmy52zs1TZQrU06KUKg='; pin-sha256='MHJYVThihUrJcxW6wcqyOISTXIsInsdj3xK8QrZbHec='; pin-sha256='isi41AizREkLvvft0IRW4u3XMFR2Yg7bvrF7padyCJg='; includeSubdomains; max-age=2592000
Last-Modified: Tue, 05 Dec 2023 18:47:22 GMT
Vary: User-Agent
X-Frame-Options: SAMEORIGIN
Content-Type: text/javascript; charset=utf-8
Cache-Control: public
Expires: Wed, 04 Dec 2024 18:47:22 GMT

GET
H2 200 recaptcha__de.js Show response
www.gstatic.com/recaptcha/releases/-QbJqHfGOUB8nuVRLvzFLVed/ 468 KB
188 KB 29ms
8ms Script
text/javascript 2a00:1450:4001:830::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/recaptcha/releases/-QbJqHfGOUB8nuVRLvzFLVed/recaptcha__de.js

Requested by

Host: www.google.com
URL: https://www.google.com/recaptcha/api.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

983871cac9e719263fcecaa540c4e1597c8ece1805845830ec21fef0e71d9f88

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.firstcitizensrewards.com/
Origin: https://www.firstcitizensrewards.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Tue, 05 Dec 2023 13:19:11 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 19691
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 192016
x-xss-protection: 0
last-modified: Tue, 14 Nov 2023 05:42:11 GMT
server: sffe
cross-origin-opener-policy: same-origin-allow-popups; report-to="recaptcha"
vary: Accept-Encoding
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Wed, 04 Dec 2024 13:19:11 GMT

GET
H/1.1 200
OK ajax-loader.gif
www.firstcitizensrewards.com/images/ 35 KB
35 KB 168ms
94ms Image
image/gif 129.159.127.141
ORACLE-BMC-31898

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.firstcitizensrewards.com/images/ajax-loader.gif

Requested by

Host: www.firstcitizensrewards.com
URL: https://www.firstcitizensrewards.com/styles/css?v=9Sfa950De2OMK7NHwVZwDh0XyhyEfFSskYK_o20fCXA1

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

129.159.127.141 Ashburn, United States, ASN31898 (ORACLE-BMC-31898, US),

Reverse DNS

Software

/ ASP.NET

Resource Hash

76507a6f9071663991ae6cae6a64803966acdee47d09aad3a6cff802bd88d1ad

Security Headers

Name	Value
Content-Security-Policy	default-src https: data: 'unsafe-inline' 'unsafe-eval'
Public-Key-Pins	pin-sha256='X3pGTSOuJeEVw989IJ/cEtXUEmy52zs1TZQrU06KUKg='; pin-sha256='MHJYVThihUrJcxW6wcqyOISTXIsInsdj3xK8QrZbHec='; pin-sha256='isi41AizREkLvvft0IRW4u3XMFR2Yg7bvrF7padyCJg='; includeSubdomains; max-age=2592000
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.firstcitizensrewards.com/styles/css?v=9Sfa950De2OMK7NHwVZwDh0XyhyEfFSskYK_o20fCXA1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

Date: Tue, 05 Dec 2023 18:47:22 GMT
Content-Security-Policy: default-src https: data: 'unsafe-inline' 'unsafe-eval'
X-Content-Type-Options: nosniff
Strict-Transport-Security: max-age=31536000; includeSubDomains
Last-Modified: Fri, 30 Sep 2022 17:56:38 GMT
X-Permitted-Cross-Domain-Policies: none
ETag: "0cfc0fcf5d4d81:0"
X-Powered-By: ASP.NET
X-Frame-Options: SAMEORIGIN
Content-Type: image/gif
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 35487
X-Xss-Protection: 1; mode=block
Public-Key-Pins: pin-sha256='X3pGTSOuJeEVw989IJ/cEtXUEmy52zs1TZQrU06KUKg='; pin-sha256='MHJYVThihUrJcxW6wcqyOISTXIsInsdj3xK8QrZbHec='; pin-sha256='isi41AizREkLvvft0IRW4u3XMFR2Yg7bvrF7padyCJg='; includeSubdomains; max-age=2592000

GET
H/1.1 200
OK 76dd58fd-40bb-42b1-8f87-070ba2e8cb9f.jpeg
www.firstcitizensrewards.com/graphics/ 144 KB
145 KB 171ms
99ms Image
image/jpeg 129.159.127.141
ORACLE-BMC-31898

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.firstcitizensrewards.com/graphics/76dd58fd-40bb-42b1-8f87-070ba2e8cb9f.jpeg

Requested by

Host: www.firstcitizensrewards.com
URL: https://www.firstcitizensrewards.com/pages/main/default.aspx

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

129.159.127.141 Ashburn, United States, ASN31898 (ORACLE-BMC-31898, US),

Reverse DNS

Software

/ ASP.NET

Resource Hash

d54cf8f4a7ae89f358836cc77fbb52b09617cd960c3f47a984a25b7b3d1c0a7a

Security Headers

Name	Value
Content-Security-Policy	default-src https: data: 'unsafe-inline' 'unsafe-eval'
Public-Key-Pins	pin-sha256='X3pGTSOuJeEVw989IJ/cEtXUEmy52zs1TZQrU06KUKg='; pin-sha256='MHJYVThihUrJcxW6wcqyOISTXIsInsdj3xK8QrZbHec='; pin-sha256='isi41AizREkLvvft0IRW4u3XMFR2Yg7bvrF7padyCJg='; includeSubdomains; max-age=2592000
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.firstcitizensrewards.com/pages/main/default.aspx
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

Date: Tue, 05 Dec 2023 18:47:22 GMT
Content-Security-Policy: default-src https: data: 'unsafe-inline' 'unsafe-eval'
X-Content-Type-Options: nosniff
Strict-Transport-Security: max-age=31536000; includeSubDomains
Last-Modified: Tue, 28 Nov 2023 14:06:52 GMT
X-Permitted-Cross-Domain-Policies: none
ETag: "469dfc22422da1:0"
X-Powered-By: ASP.NET
X-Frame-Options: SAMEORIGIN
Content-Type: image/jpeg
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 147634
X-Xss-Protection: 1; mode=block
Public-Key-Pins: pin-sha256='X3pGTSOuJeEVw989IJ/cEtXUEmy52zs1TZQrU06KUKg='; pin-sha256='MHJYVThihUrJcxW6wcqyOISTXIsInsdj3xK8QrZbHec='; pin-sha256='isi41AizREkLvvft0IRW4u3XMFR2Yg7bvrF7padyCJg='; includeSubdomains; max-age=2592000

GET
H/1.1 200
OK skrollrOn.js Show response
www.firstcitizensrewards.com/(S(aovfgoe32fvgrpgcxyp0eaez))/scripts/ 471 B
1 KB 93ms
93ms Script
application/javascript 129.159.127.141
ORACLE-BMC-31898

General

Check archive.org

Show headers Download Go to

Full URL

https://www.firstcitizensrewards.com/(S(aovfgoe32fvgrpgcxyp0eaez))/scripts/skrollrOn.js

Requested by

Host: www.firstcitizensrewards.com
URL: https://www.firstcitizensrewards.com/pages/main/default.aspx

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

129.159.127.141 Ashburn, United States, ASN31898 (ORACLE-BMC-31898, US),

Reverse DNS

Software

/ ASP.NET

Resource Hash

cd5a3f1c1f93534dc249e34e094d9f59c542db4f49ec710f4f6b1c36dae5458c

Security Headers

Name	Value
Content-Security-Policy	default-src https: data: 'unsafe-inline' 'unsafe-eval'
Public-Key-Pins	pin-sha256='X3pGTSOuJeEVw989IJ/cEtXUEmy52zs1TZQrU06KUKg='; pin-sha256='MHJYVThihUrJcxW6wcqyOISTXIsInsdj3xK8QrZbHec='; pin-sha256='isi41AizREkLvvft0IRW4u3XMFR2Yg7bvrF7padyCJg='; includeSubdomains; max-age=2592000
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.firstcitizensrewards.com/pages/main/default.aspx
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

Date: Tue, 05 Dec 2023 18:47:23 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Content-Security-Policy: default-src https: data: 'unsafe-inline' 'unsafe-eval'
X-Permitted-Cross-Domain-Policies: none
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-Powered-By: ASP.NET
Connection: keep-alive
Content-Length: 390
X-Xss-Protection: 1; mode=block
Public-Key-Pins: pin-sha256='X3pGTSOuJeEVw989IJ/cEtXUEmy52zs1TZQrU06KUKg='; pin-sha256='MHJYVThihUrJcxW6wcqyOISTXIsInsdj3xK8QrZbHec='; pin-sha256='isi41AizREkLvvft0IRW4u3XMFR2Yg7bvrF7padyCJg='; includeSubdomains; max-age=2592000
Last-Modified: Wed, 16 Feb 2022 15:00:04 GMT
ETag: "30df37e14523d81:0"
Vary: Accept-Encoding
X-Frame-Options: SAMEORIGIN
Content-Type: application/javascript
Accept-Ranges: bytes

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 52 KB
21 KB 28ms
7ms Script
text/javascript 2001:4860:4802:34::178
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.firstcitizensrewards.com
URL: https://www.firstcitizensrewards.com/pages/main/default.aspx

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2001:4860:4802:34::178 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.firstcitizensrewards.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
date: Tue, 05 Dec 2023 18:31:36 GMT
last-modified: Mon, 12 Jun 2023 18:23:07 GMT
server: Golfe2
age: 946
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 20994
expires: Tue, 05 Dec 2023 20:31:36 GMT

POST
H2 200 collect Show response
www.google-analytics.com/j/ 16 B
231 B 15ms
14ms XHR
text/plain 2001:4860:4802:34::178
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j101&a=548161686&t=pageview&_s=1&dl=https%3A%2F%2Fwww.firstcitizensrewards.com%2Fpages%2Fmain%2Fdefault.aspx&dp=%2Fmain%2Fdefault.aspx&ul=en-us&de=UTF-8&dt=First%20Citizens%20Bank&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=IEBAAEABAAAAACAAI~&jid=560238350&gjid=1751709906&cid=1814242479.1701802043&tid=UA-584275-29&_gid=107448520.1701802043&_r=1&_slc=1&z=1150454838

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2001:4860:4802:34::178 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

ca5e9a9723cf1d2c50ab5c5b5a7e53a992bfbcaca29c52162269e7224254dc17

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.firstcitizensrewards.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Tue, 05 Dec 2023 18:47:22 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://www.firstcitizensrewards.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 16
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 200 collect Show response
stats.g.doubleclick.net/j/ 4 B
358 B 56ms
19ms XHR
text/plain 2a00:1450:400c:c04::9c
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j101&tid=UA-584275-29&cid=1814242479.1701802043&jid=560238350&gjid=1751709906&_gid=107448520.1701802043&_u=IEBAAEAAAAAAACAAI~&z=678797763

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400c:c04::9c Brussels, Belgium, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.firstcitizensrewards.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
strict-transport-security: max-age=10886400; includeSubDomains; preload
date: Tue, 05 Dec 2023 18:47:23 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://www.firstcitizensrewards.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 230 KB
82 KB 47ms
25ms Script
application/javascript 2a00:1450:4001:80f::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-D9CF26V33W&cx=c&_slc=1

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

d335a37bc5017b0db47f2963e39c528c00e227ffb2aa49c8e9034d305df3fcb5

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.firstcitizensrewards.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Tue, 05 Dec 2023 18:47:23 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 83446
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Tue, 05 Dec 2023 18:47:23 GMT

GET
H2 200 ga-audiences
www.google.com/ads/ 42 B
296 B 32ms
31ms Image
image/gif 2a00:1450:4001:813::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j101&tid=UA-584275-29&cid=1814242479.1701802043&jid=560238350&_u=IEBAAEAAAAAAACAAI~&z=1734460750

Requested by

Host: www.firstcitizensrewards.com
URL: https://www.firstcitizensrewards.com/pages/main/default.aspx

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.firstcitizensrewards.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 05 Dec 2023 18:47:23 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ga-audiences
www.google.de/ads/ 42 B
408 B 52ms
32ms Image
image/gif 2a00:1450:4001:803::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j101&tid=UA-584275-29&cid=1814242479.1701802043&jid=560238350&_u=IEBAAEAAAAAAACAAI~&z=1734460750

Requested by

Host: www.firstcitizensrewards.com
URL: https://www.firstcitizensrewards.com/pages/main/default.aspx

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:803::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.firstcitizensrewards.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 05 Dec 2023 18:47:23 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 204 collect
region1.analytics.google.com/g/ 0
263 B 37ms
16ms Ping
text/plain 2001:4860:4802:32::36
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://region1.analytics.google.com/g/collect?v=2&tid=G-D9CF26V33W&gtm=45je3bt0v9125243360&_p=1701802042972&_gaz=1&gcd=11l1l1l1l2&dma_cps=sypham&dma=1&ul=en-us&sr=1600x1200&cid=1814242479.1701802043&ir=1&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&_eu=EBAI&_s=1&dl=https%3A%2F%2Fwww.firstcitizensrewards.com%2Fpages%2Fmain%2Fdefault.aspx&dp=%2Fmain%2Fdefault.aspx&dt=First%20Citizens%20Bank&sid=1701802043&sct=1&seg=0&en=page_view&_fv=1&_ss=1&_ee=1&tfd=1910
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-D9CF26V33W&cx=c&_slc=1
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4860:4802:32::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.firstcitizensrewards.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 05 Dec 2023 18:47:23 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://www.firstcitizensrewards.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 204 collect
stats.g.doubleclick.net/g/ 0
56 B 18ms
18ms Ping
text/plain 2a00:1450:400c:c04::9c
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://stats.g.doubleclick.net/g/collect?v=2&tid=G-D9CF26V33W&cid=1814242479.1701802043&gtm=45je3bt0v9125243360&aip=1&dma=1&dma_cps=sypham&gcd=11l1l1l1l2
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-D9CF26V33W&cx=c&_slc=1
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:400c:c04::9c Brussels, Belgium, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.firstcitizensrewards.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 05 Dec 2023 18:47:23 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://www.firstcitizensrewards.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ga-audiences
www.google.de/ads/ 42 B
107 B 33ms
33ms Image
image/gif 2a00:1450:4001:803::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/ads/ga-audiences?v=1&t=sr&slf_rd=1&_r=4&tid=G-D9CF26V33W&cid=1814242479.1701802043&gtm=45je3bt0v9125243360&aip=1&dma=1&dma_cps=sypham&gcd=11l1l1l1l2&z=1406580338

Requested by

Host: www.firstcitizensrewards.com
URL: https://www.firstcitizensrewards.com/pages/main/default.aspx

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:803::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.firstcitizensrewards.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 05 Dec 2023 18:47:23 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Verdicts & Comments Add Verdict or Comment

111 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

6 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
www.firstcitizensrewards.com/	1969-12-31 23:59:59	Name: X-Oracle-BMC-LBS-Route Value: aacc460046ff9882e64ec67302eb4f4bdb7e0121
www.firstcitizensrewards.com/	1969-12-31 23:59:59	Name: ASP.NET_SessionId Value: b0ugomm3usqccoo2x5txdq2p8nEkd8FS8puRx3Rzcj/cULYZjx0=
.firstcitizensrewards.com/	1970-01-21 02:19:22	Name: _ga Value: GA1.2.1814242479.1701802043
.firstcitizensrewards.com/	1970-01-20 16:44:48	Name: _gid Value: GA1.2.107448520.1701802043
.firstcitizensrewards.com/	1970-01-20 16:43:22	Name: _gat Value: 1
.firstcitizensrewards.com/	1970-01-21 02:19:22	Name: _ga_D9CF26V33W Value: GS1.2.1701802043.1.0.1701802043.60.0.0

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Content-Security-Policy	default-src https: data: 'unsafe-inline' 'unsafe-eval'
Public-Key-Pins	pin-sha256='X3pGTSOuJeEVw989IJ/cEtXUEmy52zs1TZQrU06KUKg='; pin-sha256='MHJYVThihUrJcxW6wcqyOISTXIsInsdj3xK8QrZbHec='; pin-sha256='isi41AizREkLvvft0IRW4u3XMFR2Yg7bvrF7padyCJg='; includeSubdomains; max-age=2592000
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

fonts.googleapis.com
region1.analytics.google.com
stats.g.doubleclick.net
www.firstcitizensrewards.com
www.google-analytics.com
www.google.com
www.google.de
www.googletagmanager.com
www.gstatic.com
www.rewards.firstcitizens.com
129.159.127.141
2001:4860:4802:32::36
2001:4860:4802:34::178
2a00:1450:4001:803::2003
2a00:1450:4001:806::200a
2a00:1450:4001:80f::2008
2a00:1450:4001:813::2004
2a00:1450:4001:830::2003
2a00:1450:400c:c04::9c
0085b16186957822940d8bcca5fb3c4b8c2d25ec43218dd1830d050e401f9f79
14375c33a937b11eb428ebad24b3e649f72046191e9b1af18e23dbcfd987a2bf
19a88567b84481ed390493b76efdb52c1ca480a41565713cbdfc5660add6dba2
21e1dff4ea91f8d053603d4b774c47bd7c047ff31d854793abd13da79a4a8a6b
286f2ddd2a473e6a567380ecb5f6440b8943865ba4690e4ae15a2f34a8a3b297
2c690abc65232a93c89dc14b3a4e0bf461eb6e42e55aee8ce4f00361f9f6d524
3405ac070a16f48cbef78ca93ac5f6fd3695e748ad05da409a652bf2a7886d1c
3ca430568c6bde1a3fba7fbe5283014c8fc12885e9450fe7c632f6977b322daf
40732e9dcfa704cf615e4691bb07aecfd1cc5e063220a46e4a7ff6560c77f5db
40ef3a508a4df47da46c1c3c9cd35f89277db282caa46e5ae1cbbcf6bf60bbee
43950b99d7660f2d926f2d17fe9dc74b02d86bbbe4d2f52cf2ab5cc1f9c80d0a
46b55acd6ed56d25b761d37ca955a7598259b34694556da76d667dc9f494ba32
5a4e98e4199894be49adff3642753711ec805292607447f0a59297c24ad2bb9f
6083f0dabd659d673464f2ef3b355c4b9d8ac4174602cd918374b9508cef59ef
6d645dd2170b161a872020a02f6e3f157d829f233833588202084590565b1264
6fd1435593fa3b44450cff6e40805ecaaa6638b74aa5b8cc906a46e6017bc11a
76507a6f9071663991ae6cae6a64803966acdee47d09aad3a6cff802bd88d1ad
7841131e25c56e0629fc0d09618882b7271f7c318f57e848dd5b77c74030a0f3
84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80
87981e8062814ca279922ee55276ad14bbdc29649f98e34b2d83c3afb5052a51
8f3afe36f81d30bc8033f69a9791facbf99c7b6fa74c7187bc526472460558b2
92f63cd5fcb7dbb70a79f94cbd3d4eb764107afdc0ace56444f49057d34a8a7b
983871cac9e719263fcecaa540c4e1597c8ece1805845830ec21fef0e71d9f88
98824ad5e4abf947dbe64c19947e540a7879aec44e65b330653a865890410dd4
ac7f7d8b7179ddc263d366be0a8c7133a1914fa167f726591b26a3e69c02520c
b8f709b278ef98077988ebfdffb5e348522f8ab0c10c6963dad35e4a3d629096
baa7c3be80b75737198e340b51dd58300611afe62e67488f1856a20494ee98cd
c104f24454cb98ba2ff67a8bbe0ea495703cc82f5ed2fe56fe295b612d6eaaab
c2c10abb0f3eb00cfe81e422269b2c8f27b33ddbfa33507a1687aae45305f606
c6fb95296bd7e81b5d23234bc7460dce4da9ed176c4b1603d3feb778dd7ec890
ca5e9a9723cf1d2c50ab5c5b5a7e53a992bfbcaca29c52162269e7224254dc17
cd5a3f1c1f93534dc249e34e094d9f59c542db4f49ec710f4f6b1c36dae5458c
d07666d005831d406475474a607cd18800ff7451a3181e629fa345dd30f583c7
d335a37bc5017b0db47f2963e39c528c00e227ffb2aa49c8e9034d305df3fcb5
d54cf8f4a7ae89f358836cc77fbb52b09617cd960c3f47a984a25b7b3d1c0a7a
dad91c0601fccbf443d580da55ebae4bf031190be711132e62bc7fb66040a3a3
de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
eb7bf02db906592731efaa8338874fde0ebd1135d5ae5307aca6b451871d0e73
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f5fece0d25a46b78f20a9e20b928c52b530417af417c997f3e9e25b504a43d6d
f980a61903248079a4bfa278d1ece2209c747604cd58b9eba9e80f433db3c39a
ff82e79f2a1b80b68510c46cd0693a87a8d27a6984fd69c8613329fc0ba523b3

www.firstcitizensrewards.com Open in urlscan Pro 129.159.127.141 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

46 Requests

100 %HTTPS

89 %IPv6

9 Domains

10 Subdomains

9 IPs

3 Countries

2302 kBTransfer

3245 kBSize

6 Cookies

2 Outgoing links

Page URL History

Redirected requests

46 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

www.firstcitizensrewards.com Open in urlscan Pro
129.159.127.141 Public Scan

Screenshot
Live screenshot

Full Image

46
Requests

100 %
HTTPS

89 %
IPv6

9
Domains

10
Subdomains

9
IPs

3
Countries

2302 kB
Transfer

3245 kB
Size

6
Cookies

46 HTTP transactions
0 data transactions