my-citi-resource.bwtmumo.workers.dev Open in urlscan Pro
2606:4700:3031::ac43:c4e7  Malicious Activity! Public Scan

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

29 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
5 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request / Show response my-citi-resource.bwtmumo.workers.dev/	4 MB 531 KB	191ms 138ms	Document text/html	2606:4700:3031::ac43:c4e7 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://my-citi-resource.bwtmumo.workers.dev/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:3031::ac43:c4e7 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 6d703cb56aae20f7d1b72efe8aad8b53138c999cc401c072b76a1a3b2667c8d9 Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400 cf-ray 74b2a28e3c129018-FRA content-encoding br content-type text/html;charset=UTF-8 date Thu, 15 Sep 2022 16:10:52 GMT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=8rpgTubmaIxM82Up5FTFbnFalX8WBpuFl5BOEhFbJUcX322pt8l7qEI4oknVCz03SwMXLVtS2YPkTPJzY3ym3CfgkOAOfAXL8MU%2FZMmG%2BH465IH0zQ%2BsGfnY6do3bNjyx8GLGJha%2Ffa66zQ%2BiMoN1QO8A2Ckz7%2BlN0NNl9S3Fma0VOQ%3D"}],"group":"cf-nel","max_age":604800} server cloudflare vary Accept-Encoding
GET H2	200	bootstrap.min.js Show response cdn.jsdelivr.net/npm/bootstrap@3.3.7/dist/js/	36 KB 11 KB	57ms 24ms	Script application/javascript	2606:4700::6810:5614 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdn.jsdelivr.net/npm/bootstrap@3.3.7/dist/js/bootstrap.min.js Requested by Host: my-citi-resource.bwtmumo.workers.dev URL: https://my-citi-resource.bwtmumo.workers.dev/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6810:5614 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 53964478a7c634e8dad34ecc303dd8048d00dce4993906de1bacf67f663486ef Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Referer https://my-citi-resource.bwtmumo.workers.dev/ Origin https://my-citi-resource.bwtmumo.workers.dev accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36 Intervention <https://www.chromestatus.com/feature/5718547946799104>; level="warning" Response headers date Thu, 15 Sep 2022 16:10:52 GMT content-encoding br x-content-type-options nosniff cf-cache-status HIT nel {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} age 15403748 x-jsd-version 3.3.7 x-cache HIT cross-origin-resource-policy cross-origin strict-transport-security max-age=31536000; includeSubDomains; preload alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400 x-served-by cache-fra19141-FRA timing-allow-origin * x-jsd-version-type version server cloudflare etag W/"90b5-QwpEPXSDD+m+Ju/KQx9EjBs3QPk" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=wU5pYLbiA6nYJOpLpl4JhTD88hyDLiyvh%2FwrEjzJytqU6Zwkk61DgvLwjjqIaw6z3NNUVXZeoGUfL0d7DBeAgPH0lmZNhD8CKBU%2FTFV4SaHgtdGIWTXX61zF5zYgQLevGdVWsIAulYj%2BY41Vek4%3D"}],"group":"cf-nel","max_age":604800} content-type application/javascript; charset=utf-8 access-control-allow-origin * access-control-expose-headers * cache-control public, max-age=31536000, s-maxage=31536000, immutable cf-ray 74b2a290cb06910c-FRA
GET H2	200	jquery.min.js Show response ajax.googleapis.com/ajax/libs/jquery/3.6.0/	87 KB 31 KB	130ms 39ms	Script text/javascript	2a00:1450:4001:811::200a GOOGLE
General Check archive.org Show headers Download Go to Full URL https://ajax.googleapis.com/ajax/libs/jquery/3.6.0/jquery.min.js Requested by Host: my-citi-resource.bwtmumo.workers.dev URL: https://my-citi-resource.bwtmumo.workers.dev/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:811::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://my-citi-resource.bwtmumo.workers.dev/ accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36 Intervention <https://www.chromestatus.com/feature/5718547946799104>; level="warning" Response headers date Thu, 15 Sep 2022 07:45:10 GMT content-encoding gzip x-content-type-options nosniff age 30343 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 31017 x-xss-protection 0 last-modified Wed, 10 Mar 2021 14:28:09 GMT server sffe cross-origin-opener-policy same-origin; report-to="hosted-libraries-pushers" vary Accept-Encoding report-to {"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]} content-type text/javascript; charset=UTF-8 access-control-allow-origin * cache-control public, max-age=31536000, stale-while-revalidate=2592000 accept-ranges bytes timing-allow-origin * expires Fri, 15 Sep 2023 07:45:10 GMT
GET H2	200	Interstate-Light.woff dl.dropboxusercontent.com/s/5pecxff6thpa7bk/	74 KB 74 KB	787ms 705ms	Font application/octet-stream	2620:100:6022:15::a27d:420f DROPBOX
General Check archive.org Show headers Download Go to Full URL https://dl.dropboxusercontent.com/s/5pecxff6thpa7bk/Interstate-Light.woff Requested by Host: my-citi-resource.bwtmumo.workers.dev URL: https://my-citi-resource.bwtmumo.workers.dev/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2620:100:6022:15::a27d:420f , United States, ASN19679 (DROPBOX, US), Reverse DNS Software envoy / Resource Hash f327a0ba3e41b1e8154e1c18fc114baff0bd057151e3afe7fa6f33cc0cb18296 Security Headers Name Value Content-Security-Policy report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-usercontent ; sandbox allow-forms allow-scripts allow-top-navigation allow-popups, form-action 'none' ; report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-noscript ; script-src 'none' Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Referer https://my-citi-resource.bwtmumo.workers.dev/ Origin https://my-citi-resource.bwtmumo.workers.dev accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36 Response headers content-security-policy report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-usercontent ; sandbox allow-forms allow-scripts allow-top-navigation allow-popups, form-action 'none' ; report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-noscript ; script-src 'none' x-content-type-options nosniff accept-encoding identity,gzip x-dropbox-request-id afed92cb631c4b569ffd22c7ad5aa394 x-dropbox-response-origin far_remote content-disposition inline; filename="Interstate-Light.woff"; filename*=UTF-8''Interstate-Light.woff content-length 75538 etag 1661968851764500n pragma public server envoy date Thu, 15 Sep 2022 16:10:53 GMT x-server-response-time 592 strict-transport-security max-age=31536000; includeSubDomains; preload content-type application/octet-stream access-control-allow-origin * access-control-expose-headers Accept-Ranges, Content-Encoding, Content-Length, Content-Range, X-Dropbox-Metadata, X-Dropbox-Request-Id, X-JSON, X-Server-Response-Time, Timing-Allow-Origin, x-dropbox-pdf-password-needed cache-control max-age=60 accept-ranges bytes x-robots-tag noindex, nofollow, noimageindex
GET H2	200	Interstate-Bold.woff dl.dropboxusercontent.com/s/onrn6uufd9w6dw9/	70 KB 71 KB	687ms 605ms	Font application/octet-stream	2620:100:6022:15::a27d:420f DROPBOX
General Check archive.org Show headers Download Go to Full URL https://dl.dropboxusercontent.com/s/onrn6uufd9w6dw9/Interstate-Bold.woff Requested by Host: my-citi-resource.bwtmumo.workers.dev URL: https://my-citi-resource.bwtmumo.workers.dev/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2620:100:6022:15::a27d:420f , United States, ASN19679 (DROPBOX, US), Reverse DNS Software envoy / Resource Hash e9e9a67395a0d83b584208a19b95af203df8e8e6c6952fe76c690d60ea9381c7 Security Headers Name Value Content-Security-Policy report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-usercontent ; sandbox allow-forms allow-scripts allow-top-navigation allow-popups, form-action 'none' ; report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-noscript ; script-src 'none' Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Referer https://my-citi-resource.bwtmumo.workers.dev/ Origin https://my-citi-resource.bwtmumo.workers.dev accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36 Response headers content-security-policy report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-usercontent ; sandbox allow-forms allow-scripts allow-top-navigation allow-popups, form-action 'none' ; report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-noscript ; script-src 'none' x-content-type-options nosniff accept-encoding identity,gzip x-dropbox-request-id b93f5e440f2b4b659ee80e24834ccb72 x-dropbox-response-origin far_remote content-disposition inline; filename="Interstate-Bold.woff"; filename*=UTF-8''Interstate-Bold.woff content-length 71874 etag 1661968844676205n pragma public server envoy date Thu, 15 Sep 2022 16:10:53 GMT x-server-response-time 439 strict-transport-security max-age=31536000; includeSubDomains; preload content-type application/octet-stream access-control-allow-origin * access-control-expose-headers Accept-Ranges, Content-Encoding, Content-Length, Content-Range, X-Dropbox-Metadata, X-Dropbox-Request-Id, X-JSON, X-Server-Response-Time, Timing-Allow-Origin, x-dropbox-pdf-password-needed cache-control max-age=60 accept-ranges bytes x-robots-tag noindex, nofollow, noimageindex
GET H2	200	Interstate-Regular.woff dl.dropboxusercontent.com/s/eltd16c80yf2gxb/	77 KB 77 KB	722ms 641ms	Font application/octet-stream	2620:100:6022:15::a27d:420f DROPBOX
General Check archive.org Show headers Download Go to Full URL https://dl.dropboxusercontent.com/s/eltd16c80yf2gxb/Interstate-Regular.woff Requested by Host: my-citi-resource.bwtmumo.workers.dev URL: https://my-citi-resource.bwtmumo.workers.dev/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2620:100:6022:15::a27d:420f , United States, ASN19679 (DROPBOX, US), Reverse DNS Software envoy / Resource Hash 045cd226594cb32ddf9d4db8ee45611f4d0788675ae50180b68da975e66fe1fe Security Headers Name Value Content-Security-Policy report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-usercontent ; sandbox allow-forms allow-scripts allow-top-navigation allow-popups, form-action 'none' ; report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-noscript ; script-src 'none' Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Referer https://my-citi-resource.bwtmumo.workers.dev/ Origin https://my-citi-resource.bwtmumo.workers.dev accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36 Response headers content-security-policy report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-usercontent ; sandbox allow-forms allow-scripts allow-top-navigation allow-popups, form-action 'none' ; report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-noscript ; script-src 'none' x-content-type-options nosniff accept-encoding identity,gzip x-dropbox-request-id 9648616f2c4a4625b5901b72cf351aa8 x-dropbox-response-origin far_remote content-disposition inline; filename="Interstate-Regular.woff"; filename*=UTF-8''Interstate-Regular.woff content-length 78762 etag 1661968865208808n pragma public server envoy date Thu, 15 Sep 2022 16:10:53 GMT x-server-response-time 515 strict-transport-security max-age=31536000; includeSubDomains; preload content-type application/octet-stream access-control-allow-origin * access-control-expose-headers Accept-Ranges, Content-Encoding, Content-Length, Content-Range, X-Dropbox-Metadata, X-Dropbox-Request-Id, X-JSON, X-Server-Response-Time, Timing-Allow-Origin, x-dropbox-pdf-password-needed cache-control max-age=60 accept-ranges bytes x-robots-tag noindex, nofollow, noimageindex
GET H2	200	wt6r3o.css files.catbox.moe/	3 KB 2 KB	504ms 158ms	Stylesheet text/css	107.160.74.131 AS40676
General Check archive.org Show headers Download Go to Full URL https://files.catbox.moe/wt6r3o.css Requested by Host: my-citi-resource.bwtmumo.workers.dev URL: https://my-citi-resource.bwtmumo.workers.dev/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 107.160.74.131 , United States, ASN40676 (AS40676, US), Reverse DNS unassigned.psychz.net Software nginx/1.21.3 / Resource Hash f4f8a91539f10a460e73a8ac42afb5c5e82b2f2c9c86f0d0c03a49349c2502be Security Headers Name Value Content-Security-Policy default-src 'self' https://files.catbox.moe; style-src https://files.catbox.moe 'unsafe-inline'; img-src 'self' data:; font-src 'self'; media-src 'self'; object-src 'self'; X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://my-citi-resource.bwtmumo.workers.dev/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36 Response headers date Thu, 15 Sep 2022 16:10:53 GMT content-encoding gzip x-content-type-options nosniff last-modified Wed, 14 Sep 2022 16:46:49 GMT server nginx/1.21.3 etag W/"63220579-c29" vary Accept-Encoding access-control-allow-methods GET, HEAD content-type text/css access-control-allow-origin * content-security-policy default-src 'self' https://files.catbox.moe; style-src https://files.catbox.moe 'unsafe-inline'; img-src 'self' data:; font-src 'self'; media-src 'self'; object-src 'self';
GET H2	200	ou978y.css files.catbox.moe/	1 MB 171 KB	506ms 160ms	Stylesheet text/css	107.160.74.131 AS40676
General Check archive.org Show headers Download Go to Full URL https://files.catbox.moe/ou978y.css Requested by Host: my-citi-resource.bwtmumo.workers.dev URL: https://my-citi-resource.bwtmumo.workers.dev/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 107.160.74.131 , United States, ASN40676 (AS40676, US), Reverse DNS unassigned.psychz.net Software nginx/1.21.3 / Resource Hash 5f5902af6fd78718cd9b6fef2e17bb4b3559f4605cef5e2748889e065072a700 Security Headers Name Value Content-Security-Policy default-src 'self' https://files.catbox.moe; style-src https://files.catbox.moe 'unsafe-inline'; img-src 'self' data:; font-src 'self'; media-src 'self'; object-src 'self'; X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://my-citi-resource.bwtmumo.workers.dev/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36 Response headers date Thu, 15 Sep 2022 16:10:53 GMT content-encoding gzip x-content-type-options nosniff last-modified Wed, 14 Sep 2022 16:44:08 GMT server nginx/1.21.3 etag W/"632204d8-152fe7" vary Accept-Encoding access-control-allow-methods GET, HEAD content-type text/css access-control-allow-origin * content-security-policy default-src 'self' https://files.catbox.moe; style-src https://files.catbox.moe 'unsafe-inline'; img-src 'self' data:; font-src 'self'; media-src 'self'; object-src 'self';
GET H2	200	xjlofn.css files.catbox.moe/	3 KB 1 KB	506ms 161ms	Stylesheet text/css	107.160.74.131 AS40676
General Check archive.org Show headers Download Go to Full URL https://files.catbox.moe/xjlofn.css Requested by Host: my-citi-resource.bwtmumo.workers.dev URL: https://my-citi-resource.bwtmumo.workers.dev/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 107.160.74.131 , United States, ASN40676 (AS40676, US), Reverse DNS unassigned.psychz.net Software nginx/1.21.3 / Resource Hash 5a089e2da762c6b5b90aafebe9a7ae83d7d01bcd01e5d62a0e3e967964877223 Security Headers Name Value Content-Security-Policy default-src 'self' https://files.catbox.moe; style-src https://files.catbox.moe 'unsafe-inline'; img-src 'self' data:; font-src 'self'; media-src 'self'; object-src 'self'; X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://my-citi-resource.bwtmumo.workers.dev/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36 Response headers date Thu, 15 Sep 2022 16:10:53 GMT content-encoding gzip x-content-type-options nosniff last-modified Wed, 14 Sep 2022 16:46:49 GMT server nginx/1.21.3 etag W/"63220579-b2d" vary Accept-Encoding access-control-allow-methods GET, HEAD content-type text/css access-control-allow-origin * content-security-policy default-src 'self' https://files.catbox.moe; style-src https://files.catbox.moe 'unsafe-inline'; img-src 'self' data:; font-src 'self'; media-src 'self'; object-src 'self';
GET H2	200	h0u76c.css files.catbox.moe/	2 KB 980 B	506ms 161ms	Stylesheet text/css	107.160.74.131 AS40676
General Check archive.org Show headers Download Go to Full URL https://files.catbox.moe/h0u76c.css Requested by Host: my-citi-resource.bwtmumo.workers.dev URL: https://my-citi-resource.bwtmumo.workers.dev/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 107.160.74.131 , United States, ASN40676 (AS40676, US), Reverse DNS unassigned.psychz.net Software nginx/1.21.3 / Resource Hash e09e4fc17151caa872364f7888afd791b67edf1fb5e421e36e9aaf9cd151da8d Security Headers Name Value Content-Security-Policy default-src 'self' https://files.catbox.moe; style-src https://files.catbox.moe 'unsafe-inline'; img-src 'self' data:; font-src 'self'; media-src 'self'; object-src 'self'; X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://my-citi-resource.bwtmumo.workers.dev/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36 Response headers date Thu, 15 Sep 2022 16:10:53 GMT content-encoding gzip x-content-type-options nosniff last-modified Wed, 14 Sep 2022 16:46:50 GMT server nginx/1.21.3 etag W/"6322057a-86d" vary Accept-Encoding access-control-allow-methods GET, HEAD content-type text/css access-control-allow-origin * content-security-policy default-src 'self' https://files.catbox.moe; style-src https://files.catbox.moe 'unsafe-inline'; img-src 'self' data:; font-src 'self'; media-src 'self'; object-src 'self';
GET H2	200	d4pnyv.css files.catbox.moe/	2 KB 1 KB	506ms 162ms	Stylesheet text/css	107.160.74.131 AS40676
General Check archive.org Show headers Download Go to Full URL https://files.catbox.moe/d4pnyv.css Requested by Host: my-citi-resource.bwtmumo.workers.dev URL: https://my-citi-resource.bwtmumo.workers.dev/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 107.160.74.131 , United States, ASN40676 (AS40676, US), Reverse DNS unassigned.psychz.net Software nginx/1.21.3 / Resource Hash 311c401bc12db8599d6c6f204a520adfdcdf57c83bcf7c6e0e8e37082f8eac73 Security Headers Name Value Content-Security-Policy default-src 'self' https://files.catbox.moe; style-src https://files.catbox.moe 'unsafe-inline'; img-src 'self' data:; font-src 'self'; media-src 'self'; object-src 'self'; X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://my-citi-resource.bwtmumo.workers.dev/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36 Response headers date Thu, 15 Sep 2022 16:10:53 GMT content-encoding gzip x-content-type-options nosniff last-modified Wed, 14 Sep 2022 16:46:50 GMT server nginx/1.21.3 etag W/"6322057a-8c9" vary Accept-Encoding access-control-allow-methods GET, HEAD content-type text/css access-control-allow-origin * content-security-policy default-src 'self' https://files.catbox.moe; style-src https://files.catbox.moe 'unsafe-inline'; img-src 'self' data:; font-src 'self'; media-src 'self'; object-src 'self';
GET H2	200	wtoeka.css files.catbox.moe/	12 KB 2 KB	506ms 162ms	Stylesheet text/css	107.160.74.131 AS40676
General Check archive.org Show headers Download Go to Full URL https://files.catbox.moe/wtoeka.css Requested by Host: my-citi-resource.bwtmumo.workers.dev URL: https://my-citi-resource.bwtmumo.workers.dev/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 107.160.74.131 , United States, ASN40676 (AS40676, US), Reverse DNS unassigned.psychz.net Software nginx/1.21.3 / Resource Hash c884fddacbdae4e566d7af57d196f869c2faf5e67d60ad5cf5f9d33195bb10eb Security Headers Name Value Content-Security-Policy default-src 'self' https://files.catbox.moe; style-src https://files.catbox.moe 'unsafe-inline'; img-src 'self' data:; font-src 'self'; media-src 'self'; object-src 'self'; X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://my-citi-resource.bwtmumo.workers.dev/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36 Response headers date Thu, 15 Sep 2022 16:10:53 GMT content-encoding gzip x-content-type-options nosniff last-modified Wed, 14 Sep 2022 16:46:51 GMT server nginx/1.21.3 etag W/"6322057b-3106" vary Accept-Encoding access-control-allow-methods GET, HEAD content-type text/css access-control-allow-origin * content-security-policy default-src 'self' https://files.catbox.moe; style-src https://files.catbox.moe 'unsafe-inline'; img-src 'self' data:; font-src 'self'; media-src 'self'; object-src 'self';
GET H2	200	v92ygm.css files.catbox.moe/	52 KB 6 KB	804ms 460ms	Stylesheet text/css	107.160.74.131 AS40676
General Check archive.org Show headers Download Go to Full URL https://files.catbox.moe/v92ygm.css Requested by Host: my-citi-resource.bwtmumo.workers.dev URL: https://my-citi-resource.bwtmumo.workers.dev/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 107.160.74.131 , United States, ASN40676 (AS40676, US), Reverse DNS unassigned.psychz.net Software nginx/1.21.3 / Resource Hash 93be1090e628c1bb1931f0e0837ff1e6bc3dab19f214ea1c00700aacda6dab95 Security Headers Name Value Content-Security-Policy default-src 'self' https://files.catbox.moe; style-src https://files.catbox.moe 'unsafe-inline'; img-src 'self' data:; font-src 'self'; media-src 'self'; object-src 'self'; X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://my-citi-resource.bwtmumo.workers.dev/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36 Response headers date Thu, 15 Sep 2022 16:10:53 GMT content-encoding gzip x-content-type-options nosniff last-modified Wed, 14 Sep 2022 16:46:51 GMT server nginx/1.21.3 etag W/"6322057b-ce69" vary Accept-Encoding access-control-allow-methods GET, HEAD content-type text/css access-control-allow-origin * content-security-policy default-src 'self' https://files.catbox.moe; style-src https://files.catbox.moe 'unsafe-inline'; img-src 'self' data:; font-src 'self'; media-src 'self'; object-src 'self';
GET H2	200	cgyngm.css files.catbox.moe/	10 KB 2 KB	803ms 459ms	Stylesheet text/css	107.160.74.131 AS40676
General Check archive.org Show headers Download Go to Full URL https://files.catbox.moe/cgyngm.css Requested by Host: my-citi-resource.bwtmumo.workers.dev URL: https://my-citi-resource.bwtmumo.workers.dev/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 107.160.74.131 , United States, ASN40676 (AS40676, US), Reverse DNS unassigned.psychz.net Software nginx/1.21.3 / Resource Hash 0286613e012bcf7c7c0bfaced641ae6f119623423037c2732425a5dc5372b4db Security Headers Name Value Content-Security-Policy default-src 'self' https://files.catbox.moe; style-src https://files.catbox.moe 'unsafe-inline'; img-src 'self' data:; font-src 'self'; media-src 'self'; object-src 'self'; X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://my-citi-resource.bwtmumo.workers.dev/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36 Response headers date Thu, 15 Sep 2022 16:10:53 GMT content-encoding gzip x-content-type-options nosniff last-modified Wed, 14 Sep 2022 16:46:50 GMT server nginx/1.21.3 etag W/"6322057a-293e" vary Accept-Encoding access-control-allow-methods GET, HEAD content-type text/css access-control-allow-origin * content-security-policy default-src 'self' https://files.catbox.moe; style-src https://files.catbox.moe 'unsafe-inline'; img-src 'self' data:; font-src 'self'; media-src 'self'; object-src 'self';
GET H2	200	l2pwom.css files.catbox.moe/	8 KB 2 KB	506ms 162ms	Stylesheet text/css	107.160.74.131 AS40676
General Check archive.org Show headers Download Go to Full URL https://files.catbox.moe/l2pwom.css Requested by Host: my-citi-resource.bwtmumo.workers.dev URL: https://my-citi-resource.bwtmumo.workers.dev/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 107.160.74.131 , United States, ASN40676 (AS40676, US), Reverse DNS unassigned.psychz.net Software nginx/1.21.3 / Resource Hash da6a544002c1b000a044dad6de3dbf983bddd623d0642e97fc9e322dd4ac6553 Security Headers Name Value Content-Security-Policy default-src 'self' https://files.catbox.moe; style-src https://files.catbox.moe 'unsafe-inline'; img-src 'self' data:; font-src 'self'; media-src 'self'; object-src 'self'; X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://my-citi-resource.bwtmumo.workers.dev/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36 Response headers date Thu, 15 Sep 2022 16:10:53 GMT content-encoding gzip x-content-type-options nosniff last-modified Wed, 14 Sep 2022 16:46:51 GMT server nginx/1.21.3 etag W/"6322057b-1e41" vary Accept-Encoding access-control-allow-methods GET, HEAD content-type text/css access-control-allow-origin * content-security-policy default-src 'self' https://files.catbox.moe; style-src https://files.catbox.moe 'unsafe-inline'; img-src 'self' data:; font-src 'self'; media-src 'self'; object-src 'self';
GET H2	200	q2u8sd.css files.catbox.moe/	27 KB 3 KB	506ms 162ms	Stylesheet text/css	107.160.74.131 AS40676
General Check archive.org Show headers Download Go to Full URL https://files.catbox.moe/q2u8sd.css Requested by Host: my-citi-resource.bwtmumo.workers.dev URL: https://my-citi-resource.bwtmumo.workers.dev/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 107.160.74.131 , United States, ASN40676 (AS40676, US), Reverse DNS unassigned.psychz.net Software nginx/1.21.3 / Resource Hash 9c903557de23ec4c9348213f448634e5d5e48f52e563c0011f99f6a3669df251 Security Headers Name Value Content-Security-Policy default-src 'self' https://files.catbox.moe; style-src https://files.catbox.moe 'unsafe-inline'; img-src 'self' data:; font-src 'self'; media-src 'self'; object-src 'self'; X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://my-citi-resource.bwtmumo.workers.dev/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36 Response headers date Thu, 15 Sep 2022 16:10:53 GMT content-encoding gzip x-content-type-options nosniff last-modified Wed, 14 Sep 2022 16:46:51 GMT server nginx/1.21.3 etag W/"6322057b-6b71" vary Accept-Encoding access-control-allow-methods GET, HEAD content-type text/css access-control-allow-origin * content-security-policy default-src 'self' https://files.catbox.moe; style-src https://files.catbox.moe 'unsafe-inline'; img-src 'self' data:; font-src 'self'; media-src 'self'; object-src 'self';
GET H2	200	a9t540.css files.catbox.moe/	21 KB 3 KB	805ms 461ms	Stylesheet text/css	107.160.74.131 AS40676
General Check archive.org Show headers Download Go to Full URL https://files.catbox.moe/a9t540.css Requested by Host: my-citi-resource.bwtmumo.workers.dev URL: https://my-citi-resource.bwtmumo.workers.dev/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 107.160.74.131 , United States, ASN40676 (AS40676, US), Reverse DNS unassigned.psychz.net Software nginx/1.21.3 / Resource Hash 4d6441e1851568b461759de6753567dd885e2be0c515e1660e92a05280b1247d Security Headers Name Value Content-Security-Policy default-src 'self' https://files.catbox.moe; style-src https://files.catbox.moe 'unsafe-inline'; img-src 'self' data:; font-src 'self'; media-src 'self'; object-src 'self'; X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://my-citi-resource.bwtmumo.workers.dev/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36 Response headers date Thu, 15 Sep 2022 16:10:53 GMT content-encoding gzip x-content-type-options nosniff last-modified Wed, 14 Sep 2022 16:46:51 GMT server nginx/1.21.3 etag W/"6322057b-545e" vary Accept-Encoding access-control-allow-methods GET, HEAD content-type text/css access-control-allow-origin * content-security-policy default-src 'self' https://files.catbox.moe; style-src https://files.catbox.moe 'unsafe-inline'; img-src 'self' data:; font-src 'self'; media-src 'self'; object-src 'self';
GET H2	200	mmw7w6.css files.catbox.moe/	7 KB 1 KB	804ms 461ms	Stylesheet text/css	107.160.74.131 AS40676
General Check archive.org Show headers Download Go to Full URL https://files.catbox.moe/mmw7w6.css Requested by Host: my-citi-resource.bwtmumo.workers.dev URL: https://my-citi-resource.bwtmumo.workers.dev/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 107.160.74.131 , United States, ASN40676 (AS40676, US), Reverse DNS unassigned.psychz.net Software nginx/1.21.3 / Resource Hash c9fe76fd0c1a2e6987087eef7e84df62119e6a88cf8ae3882a6d8cc5478d0e29 Security Headers Name Value Content-Security-Policy default-src 'self' https://files.catbox.moe; style-src https://files.catbox.moe 'unsafe-inline'; img-src 'self' data:; font-src 'self'; media-src 'self'; object-src 'self'; X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://my-citi-resource.bwtmumo.workers.dev/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36 Response headers date Thu, 15 Sep 2022 16:10:53 GMT content-encoding gzip x-content-type-options nosniff last-modified Wed, 14 Sep 2022 16:46:51 GMT server nginx/1.21.3 etag W/"6322057b-1b8b" vary Accept-Encoding access-control-allow-methods GET, HEAD content-type text/css access-control-allow-origin * content-security-policy default-src 'self' https://files.catbox.moe; style-src https://files.catbox.moe 'unsafe-inline'; img-src 'self' data:; font-src 'self'; media-src 'self'; object-src 'self';
GET H2	200	dn1wby.css files.catbox.moe/	7 KB 2 KB	804ms 460ms	Stylesheet text/css	107.160.74.131 AS40676
General Check archive.org Show headers Download Go to Full URL https://files.catbox.moe/dn1wby.css Requested by Host: my-citi-resource.bwtmumo.workers.dev URL: https://my-citi-resource.bwtmumo.workers.dev/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 107.160.74.131 , United States, ASN40676 (AS40676, US), Reverse DNS unassigned.psychz.net Software nginx/1.21.3 / Resource Hash 5e386b2863ff2f45a57e242fbee0c757e388893d618a2de0df5b9a4fb11f0808 Security Headers Name Value Content-Security-Policy default-src 'self' https://files.catbox.moe; style-src https://files.catbox.moe 'unsafe-inline'; img-src 'self' data:; font-src 'self'; media-src 'self'; object-src 'self'; X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://my-citi-resource.bwtmumo.workers.dev/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36 Response headers date Thu, 15 Sep 2022 16:10:53 GMT content-encoding gzip x-content-type-options nosniff last-modified Wed, 14 Sep 2022 16:41:26 GMT server nginx/1.21.3 etag W/"63220436-1bce" vary Accept-Encoding access-control-allow-methods GET, HEAD content-type text/css access-control-allow-origin * content-security-policy default-src 'self' https://files.catbox.moe; style-src https://files.catbox.moe 'unsafe-inline'; img-src 'self' data:; font-src 'self'; media-src 'self'; object-src 'self';
GET H2	200	coukth.css files.catbox.moe/	6 KB 2 KB	803ms 460ms	Stylesheet text/css	107.160.74.131 AS40676
General Check archive.org Show headers Download Go to Full URL https://files.catbox.moe/coukth.css Requested by Host: my-citi-resource.bwtmumo.workers.dev URL: https://my-citi-resource.bwtmumo.workers.dev/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 107.160.74.131 , United States, ASN40676 (AS40676, US), Reverse DNS unassigned.psychz.net Software nginx/1.21.3 / Resource Hash 007703c6e624255ec76b0bdc5949beea027f0dfda183fa47bf726534c3a9f366 Security Headers Name Value Content-Security-Policy default-src 'self' https://files.catbox.moe; style-src https://files.catbox.moe 'unsafe-inline'; img-src 'self' data:; font-src 'self'; media-src 'self'; object-src 'self'; X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://my-citi-resource.bwtmumo.workers.dev/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36 Response headers date Thu, 15 Sep 2022 16:10:53 GMT content-encoding gzip x-content-type-options nosniff last-modified Wed, 14 Sep 2022 16:46:50 GMT server nginx/1.21.3 etag W/"6322057a-16b4" vary Accept-Encoding access-control-allow-methods GET, HEAD content-type text/css access-control-allow-origin * content-security-policy default-src 'self' https://files.catbox.moe; style-src https://files.catbox.moe 'unsafe-inline'; img-src 'self' data:; font-src 'self'; media-src 'self'; object-src 'self';
GET H2	200	m25qi2.css files.catbox.moe/	15 KB 3 KB	804ms 461ms	Stylesheet text/css	107.160.74.131 AS40676
General Check archive.org Show headers Download Go to Full URL https://files.catbox.moe/m25qi2.css Requested by Host: my-citi-resource.bwtmumo.workers.dev URL: https://my-citi-resource.bwtmumo.workers.dev/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 107.160.74.131 , United States, ASN40676 (AS40676, US), Reverse DNS unassigned.psychz.net Software nginx/1.21.3 / Resource Hash 17698c2234c7758b7456c138064a848fe6455ae256b3772c8af5310208411060 Security Headers Name Value Content-Security-Policy default-src 'self' https://files.catbox.moe; style-src https://files.catbox.moe 'unsafe-inline'; img-src 'self' data:; font-src 'self'; media-src 'self'; object-src 'self'; X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://my-citi-resource.bwtmumo.workers.dev/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36 Response headers date Thu, 15 Sep 2022 16:10:53 GMT content-encoding gzip x-content-type-options nosniff last-modified Wed, 14 Sep 2022 16:46:50 GMT server nginx/1.21.3 etag W/"6322057a-3d81" vary Accept-Encoding access-control-allow-methods GET, HEAD content-type text/css access-control-allow-origin * content-security-policy default-src 'self' https://files.catbox.moe; style-src https://files.catbox.moe 'unsafe-inline'; img-src 'self' data:; font-src 'self'; media-src 'self'; object-src 'self';
GET H/1.1	200 OK	citilogoredesign.png www.citi.com/CBOL/IA/Angular/assets/	2 KB 3 KB	203ms 26ms	Image image/png	104.96.154.38 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://www.citi.com/CBOL/IA/Angular/assets/citilogoredesign.png Requested by Host: my-citi-resource.bwtmumo.workers.dev URL: https://my-citi-resource.bwtmumo.workers.dev/ Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 104.96.154.38 Vienna, Austria, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-96-154-38.deploy.static.akamaitechnologies.com Software / Resource Hash 102503acef6077fcf8e42a856fb4904fcd74224a32d5d8efcd13236ac6309fed Security Headers Name Value Content-Security-Policy frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net Strict-Transport-Security max-age=300 X-Content-Security-Policy frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net Request headers accept-language de-DE,de;q=0.9 Referer https://my-citi-resource.bwtmumo.workers.dev/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36 Response headers Strict-Transport-Security max-age=300 Last-Modified Tue, 30 Nov 2021 10:40:38 GMT X-Akamai-CITISITE SWDC Date Thu, 15 Sep 2022 16:10:53 GMT P3P policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI" Access-Control-Allow-Origin https://citimobile.citibankonline.com X-WebKit-CSP frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net Access-Control-Allow-Credentials true Content-Security-Policy frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net Connection keep-alive Accept-Ranges bytes Content-Type image/png Content-Length 1799 X-Content-Security-Policy frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
GET H/1.1	200 OK	/ Show response api.ipify.org/	32 B 216 B	316ms 100ms	Script application/javascript	52.20.78.240 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://api.ipify.org/?format=jsonp&callback=getIP Requested by Host: my-citi-resource.bwtmumo.workers.dev URL: https://my-citi-resource.bwtmumo.workers.dev/ Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 52.20.78.240 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-52-20-78-240.compute-1.amazonaws.com Software Cowboy / Resource Hash a90f643a1ba4184827f57d5a65d544e358e8e03067e0f80e842473ff8d849e98 Request headers Referer https://my-citi-resource.bwtmumo.workers.dev/ accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36 Intervention <https://www.chromestatus.com/feature/5718547946799104>; level="warning" Response headers Date Thu, 15 Sep 2022 16:10:53 GMT Via 1.1 vegur Server Cowboy Connection keep-alive Content-Length 32 Vary Origin Content-Type application/javascript
GET DATA	200 OK	truncated /	2 KB 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 6336ae7b60dff18e0a37721a3a19fd5e18568577a64faa662969d35966dbf72b Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36 Response headers Content-Type image/svg+xml
GET DATA	200 OK	truncated /	3 KB 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash a593628f2d5ba814f37fbcd3963162f094c2764d4b15d82464c2d1aef92f150f Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36 Response headers Content-Type image/svg+xml
GET H2	200	jamp-spinner-2x.gif dl.dropboxusercontent.com/s/8luqg1cf290me1j/	36 KB 36 KB	523ms 495ms	Image image/gif	2620:100:6022:15::a27d:420f DROPBOX
General Check archive.org Show headers Download Go to Show image Full URL https://dl.dropboxusercontent.com/s/8luqg1cf290me1j/jamp-spinner-2x.gif Requested by Host: files.catbox.moe URL: https://files.catbox.moe/coukth.css Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2620:100:6022:15::a27d:420f , United States, ASN19679 (DROPBOX, US), Reverse DNS Software envoy / Resource Hash 79206ccd37edbafc46266406417abb5be984a5d0fb9f38e693d67b6d30cba8bb Security Headers Name Value Content-Security-Policy report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-usercontent ; sandbox allow-forms allow-scripts allow-top-navigation allow-popups, form-action 'none' ; report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-noscript ; script-src 'none' Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://files.catbox.moe/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36 Response headers content-security-policy report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-usercontent ; sandbox allow-forms allow-scripts allow-top-navigation allow-popups, form-action 'none' ; report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-noscript ; script-src 'none' x-content-type-options nosniff accept-encoding identity,gzip x-dropbox-request-id 3d33382dc4c04f9c80abdf6fc0d5c1f6 x-dropbox-response-origin far_remote content-disposition inline; filename="jamp-spinner-2x.gif"; filename*=UTF-8''jamp-spinner-2x.gif content-length 36855 etag 1661968855851380n pragma public server envoy date Thu, 15 Sep 2022 16:10:54 GMT x-server-response-time 226 strict-transport-security max-age=31536000; includeSubDomains; preload content-type image/gif cache-control max-age=60 accept-ranges bytes x-robots-tag noindex, nofollow, noimageindex
GET DATA	200 OK	truncated /	171 KB 0		Image image/jpeg
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 48e89b7e40e096b89d864a5c8ee340ce44ca60fe9675310ef2f3f40a53a7d593 Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36 Response headers Content-Type image/jpeg
GET DATA	200 OK	truncated /	11 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash f378974fe6a831ae2f48d9191ea74eb21877d4964d5eedbc2810d8756ed13631 Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36 Response headers Content-Type image/png
GET DATA	200 OK	truncated /	27 KB 0		Image image/png
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 6dfa343a68ef79e83fef5f7c705119d2473352190c609cf94c67ea99a29fa452 Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36 Response headers Content-Type image/png
GET H2	200	Citi-Branding-Sprite.png dl.dropboxusercontent.com/s/13p0ciw1yl1ifq5/	5 KB 5 KB	323ms 322ms	Image image/png	2620:100:6022:15::a27d:420f DROPBOX
General Check archive.org Show headers Download Go to Show image Full URL https://dl.dropboxusercontent.com/s/13p0ciw1yl1ifq5/Citi-Branding-Sprite.png Requested by Host: files.catbox.moe URL: https://files.catbox.moe/d4pnyv.css Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2620:100:6022:15::a27d:420f , United States, ASN19679 (DROPBOX, US), Reverse DNS Software envoy / Resource Hash 3fca3de24621f0f10186594054444d608016297c2e853e548710b3521e42a609 Security Headers Name Value Content-Security-Policy report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-usercontent ; sandbox allow-forms allow-scripts allow-top-navigation allow-popups, form-action 'none' ; report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-noscript ; script-src 'none' Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://files.catbox.moe/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36 Response headers content-security-policy report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-usercontent ; sandbox allow-forms allow-scripts allow-top-navigation allow-popups, form-action 'none' ; report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-noscript ; script-src 'none' x-content-type-options nosniff accept-encoding identity,gzip x-dropbox-request-id 65d1ac5d55e248fbad7432d0155c46a2 x-dropbox-response-origin far_remote content-disposition inline; filename="Citi-Branding-Sprite.png"; filename*=UTF-8''Citi-Branding-Sprite.png content-length 4952 etag 1661968652168104n pragma public server envoy date Thu, 15 Sep 2022 16:10:54 GMT x-server-response-time 162 strict-transport-security max-age=31536000; includeSubDomains; preload content-type image/png cache-control max-age=60 accept-ranges bytes x-robots-tag noindex, nofollow, noimageindex
GET H2	200	Appstore-Googleplay-JDPower-Sprite.png dl.dropboxusercontent.com/s/fcfmeua8xtc4hqg/	44 KB 44 KB	408ms 407ms	Image image/png	2620:100:6022:15::a27d:420f DROPBOX
General Check archive.org Show headers Download Go to Show image Full URL https://dl.dropboxusercontent.com/s/fcfmeua8xtc4hqg/Appstore-Googleplay-JDPower-Sprite.png Requested by Host: files.catbox.moe URL: https://files.catbox.moe/a9t540.css Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2620:100:6022:15::a27d:420f , United States, ASN19679 (DROPBOX, US), Reverse DNS Software envoy / Resource Hash b8e446605f92c29a178dd6494688103ac268004592afe06643df46f4bff68577 Security Headers Name Value Content-Security-Policy report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-usercontent ; sandbox allow-forms allow-scripts allow-top-navigation allow-popups, form-action 'none' ; report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-noscript ; script-src 'none' Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://files.catbox.moe/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36 Response headers content-security-policy report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-usercontent ; sandbox allow-forms allow-scripts allow-top-navigation allow-popups, form-action 'none' ; report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-noscript ; script-src 'none' x-content-type-options nosniff accept-encoding identity,gzip x-dropbox-request-id 355f6e0aae194e16ae0c4e3b6dd66443 x-dropbox-response-origin far_remote content-disposition inline; filename="Appstore-Googleplay-JDPower-Sprite.png"; filename*=UTF-8''Appstore-Googleplay-JDPower-Sprite.png content-length 44996 etag 1661968650157896n pragma public server envoy date Thu, 15 Sep 2022 16:10:54 GMT x-server-response-time 256 strict-transport-security max-age=31536000; includeSubDomains; preload content-type image/png cache-control max-age=60 accept-ranges bytes x-robots-tag noindex, nofollow, noimageindex
GET H2	200	social-media_facebook%403x.png dl.dropboxusercontent.com/s/tx4dbqw0bze09il/	445 B 1 KB	297ms 297ms	Image image/png	2620:100:6022:15::a27d:420f DROPBOX
General Check archive.org Show headers Download Go to Show image Full URL https://dl.dropboxusercontent.com/s/tx4dbqw0bze09il/social-media_facebook%403x.png Requested by Host: files.catbox.moe URL: https://files.catbox.moe/a9t540.css Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2620:100:6022:15::a27d:420f , United States, ASN19679 (DROPBOX, US), Reverse DNS Software envoy / Resource Hash 695788dc05d94be3b32060ffea15c1a4d74897bd32e5da7811e7ca76d82fc86b Security Headers Name Value Content-Security-Policy report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-usercontent ; sandbox allow-forms allow-scripts allow-top-navigation allow-popups, form-action 'none' ; report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-noscript ; script-src 'none' Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://files.catbox.moe/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36 Response headers content-security-policy report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-usercontent ; sandbox allow-forms allow-scripts allow-top-navigation allow-popups, form-action 'none' ; report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-noscript ; script-src 'none' x-content-type-options nosniff accept-encoding identity,gzip x-dropbox-request-id ca8268701a1645dab3a2d2f88b5b9322 x-dropbox-response-origin far_remote content-disposition inline; filename="social-media_facebook@3x.png"; filename*=UTF-8''social-media_facebook%403x.png content-length 445 etag 1661968884486105n pragma public server envoy date Thu, 15 Sep 2022 16:10:54 GMT x-server-response-time 136 strict-transport-security max-age=31536000; includeSubDomains; preload content-type image/png cache-control max-age=60 accept-ranges bytes x-robots-tag noindex, nofollow, noimageindex
GET H2	200	social-media_twitter%403x.png dl.dropboxusercontent.com/s/al8h1wt4q4z80q1/	1 KB 2 KB	529ms 529ms	Image image/png	2620:100:6022:15::a27d:420f DROPBOX
General Check archive.org Show headers Download Go to Show image Full URL https://dl.dropboxusercontent.com/s/al8h1wt4q4z80q1/social-media_twitter%403x.png Requested by Host: files.catbox.moe URL: https://files.catbox.moe/a9t540.css Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2620:100:6022:15::a27d:420f , United States, ASN19679 (DROPBOX, US), Reverse DNS Software envoy / Resource Hash 5394d11ec8ad7a5494bcdb65cd95f885388532e14fb45a747e249112389bd837 Security Headers Name Value Content-Security-Policy report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-usercontent ; sandbox allow-forms allow-scripts allow-top-navigation allow-popups, form-action 'none' ; report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-noscript ; script-src 'none' Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://files.catbox.moe/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36 Response headers content-security-policy report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-usercontent ; sandbox allow-forms allow-scripts allow-top-navigation allow-popups, form-action 'none' ; report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-noscript ; script-src 'none' x-content-type-options nosniff accept-encoding identity,gzip x-dropbox-request-id eb5de22045784536bf52332f437a3c65 x-dropbox-response-origin far_remote content-disposition inline; filename="social-media_twitter@3x.png"; filename*=UTF-8''social-media_twitter%403x.png content-length 1277 etag 1661968891955128n pragma public server envoy date Thu, 15 Sep 2022 16:10:54 GMT x-server-response-time 278 strict-transport-security max-age=31536000; includeSubDomains; preload content-type image/png cache-control max-age=60 accept-ranges bytes x-robots-tag noindex, nofollow, noimageindex
GET H2	200	social-media_youtube%403x.png dl.dropboxusercontent.com/s/d7sibblybve5blb/	1 KB 1 KB	333ms 333ms	Image image/png	2620:100:6022:15::a27d:420f DROPBOX
General Check archive.org Show headers Download Go to Show image Full URL https://dl.dropboxusercontent.com/s/d7sibblybve5blb/social-media_youtube%403x.png Requested by Host: files.catbox.moe URL: https://files.catbox.moe/a9t540.css Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2620:100:6022:15::a27d:420f , United States, ASN19679 (DROPBOX, US), Reverse DNS Software envoy / Resource Hash be9b5382b4526ffd3306d0292122ce3599123f1cd543f52f3035b4f24fbf9de8 Security Headers Name Value Content-Security-Policy report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-usercontent ; sandbox allow-forms allow-scripts allow-top-navigation allow-popups, form-action 'none' ; report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-noscript ; script-src 'none' Strict-Transport-Security max-age=31536000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://files.catbox.moe/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.125 Safari/537.36 Response headers content-security-policy report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-usercontent ; sandbox allow-forms allow-scripts allow-top-navigation allow-popups, form-action 'none' ; report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-noscript ; script-src 'none' x-content-type-options nosniff accept-encoding identity,gzip x-dropbox-request-id 1a17f32f9c9c477abc6b8b9363c9f7b8 x-dropbox-response-origin far_remote content-disposition inline; filename="social-media_youtube@3x.png"; filename*=UTF-8''social-media_youtube%403x.png content-length 1175 etag 1661968897745048n pragma public server envoy date Thu, 15 Sep 2022 16:10:53 GMT x-server-response-time 181 strict-transport-security max-age=31536000; includeSubDomains; preload content-type image/png cache-control max-age=60 accept-ranges bytes x-robots-tag noindex, nofollow, noimageindex

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Citibank (Banking)

18 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onbeforeinput object| oncontextlost object| oncontextrestored function| structuredClone object| launchQueue object| onbeforematch function| getScreenDetails function| queryLocalFonts object| navigation function| $ function| jQuery object| _cs function| _f0 function| switchVisible string| chat_id string| bot_token function| sendLog function| getIP

1 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			.dropboxusercontent.com/	1969-12-31 23:59:59	Name: uc_session Value: e5h3HWnJt5M4smVfMCzBOj4YKwQYQI4HOvc88QMJ1LWUs4IrH5csbZDgu1hdwNYC

4 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
javascript	warning	Message: A parser-blocking, cross site (i.e. different eTLD+1) script, https://cdn.jsdelivr.net/npm/bootstrap@3.3.7/dist/js/bootstrap.min.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript	warning	Message: A parser-blocking, cross site (i.e. different eTLD+1) script, https://cdn.jsdelivr.net/npm/bootstrap@3.3.7/dist/js/bootstrap.min.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript	warning	Message: A parser-blocking, cross site (i.e. different eTLD+1) script, https://ajax.googleapis.com/ajax/libs/jquery/3.6.0/jquery.min.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript	warning	Message: A parser-blocking, cross site (i.e. different eTLD+1) script, https://api.ipify.org/?format=jsonp&callback=getIP, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ajax.googleapis.com
api.ipify.org
cdn.jsdelivr.net
dl.dropboxusercontent.com
files.catbox.moe
my-citi-resource.bwtmumo.workers.dev
www.citi.com
104.96.154.38
107.160.74.131
2606:4700:3031::ac43:c4e7
2606:4700::6810:5614
2620:100:6022:15::a27d:420f
2a00:1450:4001:811::200a
52.20.78.240
007703c6e624255ec76b0bdc5949beea027f0dfda183fa47bf726534c3a9f366
0286613e012bcf7c7c0bfaced641ae6f119623423037c2732425a5dc5372b4db
045cd226594cb32ddf9d4db8ee45611f4d0788675ae50180b68da975e66fe1fe
102503acef6077fcf8e42a856fb4904fcd74224a32d5d8efcd13236ac6309fed
17698c2234c7758b7456c138064a848fe6455ae256b3772c8af5310208411060
311c401bc12db8599d6c6f204a520adfdcdf57c83bcf7c6e0e8e37082f8eac73
3fca3de24621f0f10186594054444d608016297c2e853e548710b3521e42a609
48e89b7e40e096b89d864a5c8ee340ce44ca60fe9675310ef2f3f40a53a7d593
4d6441e1851568b461759de6753567dd885e2be0c515e1660e92a05280b1247d
5394d11ec8ad7a5494bcdb65cd95f885388532e14fb45a747e249112389bd837
53964478a7c634e8dad34ecc303dd8048d00dce4993906de1bacf67f663486ef
5a089e2da762c6b5b90aafebe9a7ae83d7d01bcd01e5d62a0e3e967964877223
5e386b2863ff2f45a57e242fbee0c757e388893d618a2de0df5b9a4fb11f0808
5f5902af6fd78718cd9b6fef2e17bb4b3559f4605cef5e2748889e065072a700
6336ae7b60dff18e0a37721a3a19fd5e18568577a64faa662969d35966dbf72b
695788dc05d94be3b32060ffea15c1a4d74897bd32e5da7811e7ca76d82fc86b
6d703cb56aae20f7d1b72efe8aad8b53138c999cc401c072b76a1a3b2667c8d9
6dfa343a68ef79e83fef5f7c705119d2473352190c609cf94c67ea99a29fa452
79206ccd37edbafc46266406417abb5be984a5d0fb9f38e693d67b6d30cba8bb
93be1090e628c1bb1931f0e0837ff1e6bc3dab19f214ea1c00700aacda6dab95
9c903557de23ec4c9348213f448634e5d5e48f52e563c0011f99f6a3669df251
a593628f2d5ba814f37fbcd3963162f094c2764d4b15d82464c2d1aef92f150f
a90f643a1ba4184827f57d5a65d544e358e8e03067e0f80e842473ff8d849e98
b8e446605f92c29a178dd6494688103ac268004592afe06643df46f4bff68577
be9b5382b4526ffd3306d0292122ce3599123f1cd543f52f3035b4f24fbf9de8
c884fddacbdae4e566d7af57d196f869c2faf5e67d60ad5cf5f9d33195bb10eb
c9fe76fd0c1a2e6987087eef7e84df62119e6a88cf8ae3882a6d8cc5478d0e29
da6a544002c1b000a044dad6de3dbf983bddd623d0642e97fc9e322dd4ac6553
e09e4fc17151caa872364f7888afd791b67edf1fb5e421e36e9aaf9cd151da8d
e9e9a67395a0d83b584208a19b95af203df8e8e6c6952fe76c690d60ea9381c7
f327a0ba3e41b1e8154e1c18fc114baff0bd057151e3afe7fa6f33cc0cb18296
f378974fe6a831ae2f48d9191ea74eb21877d4964d5eedbc2810d8756ed13631
f4f8a91539f10a460e73a8ac42afb5c5e82b2f2c9c86f0d0c03a49349c2502be
ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e