5damah.com Open in urlscan Pro
149.56.92.220 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
https://5damah.com/appp/online/citi.com/US/login.do.html?jdsh47wryfhoduetoealshfilw4yrledyuwruieryjosdifhyw78456ryw...
Submission: On October 02 via automatic, source openphish (October 2nd 2022, 1:02:10 pm UTC) — Scanned from CA

Summary HTTP 151 Redirects Links 20 Behaviour Indicators

Summary

This website contacted 29 IPs in 2 countries across 25 domains to perform 151 HTTP transactions. The main IP is 149.56.92.220, located in Montreal, Canada and belongs to OVH, FR. The main domain is 5damah.com.
TLS certificate: Issued by R3 on August 28th 2022. Valid for: 3 months.

This is the only time 5damah.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Citibank (Banking)

Domain & IP information

	IP Address	AS Autonomous System
6	149.56.92.220 149.56.92.220	16276 (OVH) (OVH)
2	2a03:2880:f01... 2a03:2880:f012:10c:face:b00c:0:3	32934 (FACEBOOK) (FACEBOOK)
3	142.251.35.162 142.251.35.162	15169 (GOOGLE) (GOOGLE)
2	2600:9000:221... 2600:9000:2211:3000:1:76cf:fe80:93a1	16509 (AMAZON-02) (AMAZON-02)
24	13.249.141.26 13.249.141.26	16509 (AMAZON-02) (AMAZON-02)
1	2607:f8b0:400... 2607:f8b0:4006:823::200e	15169 (GOOGLE) (GOOGLE)
1 3	2607:f8b0:400... 2607:f8b0:4006:821::200e	15169 (GOOGLE) (GOOGLE)
1 15	2607:f8b0:400... 2607:f8b0:4006:81c::2004	15169 (GOOGLE) (GOOGLE)
33	23.217.42.185 23.217.42.185	16625 (AKAMAI-AS) (AKAMAI-AS)
1	2607:f8b0:400... 2607:f8b0:4006:81c::2003	15169 (GOOGLE) (GOOGLE)
2	23.21.145.8 23.21.145.8	14618 (AMAZON-AES) (AMAZON-AES)
10	2607:f8b0:400... 2607:f8b0:4006:816::2002	15169 (GOOGLE) (GOOGLE)
2 4	35.190.60.146 35.190.60.146	15169 (GOOGLE) (GOOGLE)
1	198.160.105.95 198.160.105.95	15026 (ACXIOM) (ACXIOM)
1	2600:9000:21d... 2600:9000:21d5:8e00:12:601f:a940:93a1	16509 (AMAZON-02) (AMAZON-02)
1	52.1.6.72 52.1.6.72	14618 (AMAZON-AES) (AMAZON-AES)
10	2607:f8b0:400... 2607:f8b0:4006:820::2003	15169 (GOOGLE) (GOOGLE)
1 4	3.221.198.169 3.221.198.169	14618 (AMAZON-AES) (AMAZON-AES)
1	52.6.87.15 52.6.87.15	14618 (AMAZON-AES) (AMAZON-AES)
1	63.140.38.186 63.140.38.186	14618 (AMAZON-AES) (AMAZON-AES)
1 1	34.192.133.161 34.192.133.161	14618 (AMAZON-AES) (AMAZON-AES)
3 6	142.250.176.198 142.250.176.198	15169 (GOOGLE) (GOOGLE)
1	199.38.167.131 199.38.167.131	54312 (ROCKETFUEL) (ROCKETFUEL)
13	2607:f8b0:400... 2607:f8b0:4006:807::2008	15169 (GOOGLE) (GOOGLE)
3	2607:f8b0:400... 2607:f8b0:4006:822::2002	15169 (GOOGLE) (GOOGLE)
2	151.101.129.230 151.101.129.230	54113 (FASTLY) (FASTLY)
2	65.8.49.17 65.8.49.17	16509 (AMAZON-02) (AMAZON-02)
1	35.241.45.82 35.241.45.82	15169 (GOOGLE) (GOOGLE)
1 2	142.250.64.83 142.250.64.83	15169 (GOOGLE) (GOOGLE)
1 1	52.85.247.126 52.85.247.126	16509 (AMAZON-02) (AMAZON-02)
151	29

6 149.56.92.220 (Montreal, Canada)

ASN16276 (OVH, FR)
PTR: ip220.ip-149-56-92.net

5damah.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a03:2880:f012:10c:face:b00c:0:3 (Secaucus, United States)

ASN32934 (FACEBOOK, US)

connect.facebook.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 142.251.35.162 (United States)

ASN15169 (GOOGLE, US)
PTR: lga25s78-in-f2.1e100.net

www.googleadservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2600:9000:2211:3000:1:76cf:fe80:93a1 (United States)

ASN16509 (AMAZON-02, US)

c1.rfihub.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

24 13.249.141.26 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-249-141-26.ord51.r.cloudfront.net

nexus.ensighten.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2607:f8b0:4006:823::200e (Rockville, United States)

ASN15169 (GOOGLE, US)

s.ytimg.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2607:f8b0:4006:821::200e (Rockville, United States) 1 redirects

ASN15169 (GOOGLE, US)

www.youtube.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
cse.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

15 2607:f8b0:4006:81c::2004 (Rockville, United States) 1 redirects

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

33 23.217.42.185 (New York, United States)

ASN16625 (AKAMAI-AS, US)
PTR: a23-217-42-185.deploy.static.akamaitechnologies.com

online.citi.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2607:f8b0:4006:81c::2003 (Rockville, United States)

ASN15169 (GOOGLE, US)

www.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 23.21.145.8 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-23-21-145-8.compute-1.amazonaws.com

mpsnare.iesnare.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

10 2607:f8b0:4006:816::2002 (Rockville, United States)

ASN15169 (GOOGLE, US)

googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 35.190.60.146 (Kansas City, United States) 2 redirects

ASN15169 (GOOGLE, US)
PTR: 146.60.190.35.bc.googleusercontent.com

id.rlcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
sr.rlcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 198.160.105.95 (Conway, United States)

ASN15026 (ACXIOM, US)

cardoffer.citicards.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:21d5:8e00:12:601f:a940:93a1 (United States)

ASN16509 (AMAZON-02, US)

cdn.tt.omtrdc.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.1.6.72 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-52-1-6-72.compute-1.amazonaws.com

citicorpcreditservic.tt.omtrdc.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

10 2607:f8b0:4006:820::2003 (Rockville, United States)

ASN15169 (GOOGLE, US)

www.google.ca	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 3.221.198.169 (Ashburn, United States) 1 redirects

ASN14618 (AMAZON-AES, US)
PTR: ec2-3-221-198-169.compute-1.amazonaws.com

dpm.demdex.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.6.87.15 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-52-6-87-15.compute-1.amazonaws.com

citi.demdex.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 63.140.38.186 (United States)

ASN14618 (AMAZON-AES, US)
PTR: ip-63-140-38-186.data.adobedc.net

metrics1.citi.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 34.192.133.161 (Ashburn, United States) 1 redirects

ASN14618 (AMAZON-AES, US)
PTR: ec2-34-192-133-161.compute-1.amazonaws.com

cm.everesttech.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 142.250.176.198 (United States) 3 redirects

ASN15169 (GOOGLE, US)
PTR: lga34s37-in-f6.1e100.net

6260004.fls.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
6417343.fls.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
6269322.fls.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 199.38.167.131 (United States)

ASN54312 (ROCKETFUEL, US)

20766699p.rfihub.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

13 2607:f8b0:4006:807::2008 (Rockville, United States)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2607:f8b0:4006:822::2002 (Rockville, United States)

ASN15169 (GOOGLE, US)

adservice.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 151.101.129.230 (United States)

ASN54113 (FASTLY, US)

resources.digital-cloud-citi.medallia.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 65.8.49.17 (Pompano Beach, United States)

ASN16509 (AMAZON-02, US)
PTR: server-65-8-49-17.ord52.r.cloudfront.net

cdn.pbbl.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 35.241.45.82 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 82.45.241.35.bc.googleusercontent.com

udc-neb.kampyle.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 142.250.64.83 (United States) 1 redirects

ASN15169 (GOOGLE, US)
PTR: lga34s30-in-f19.1e100.net

px0.pbbl.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.85.247.126 (United States) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: server-52-85-247-126.ord51.r.cloudfront.net

aa.agkn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
34	citi.com online.citi.com — Cisco Umbrella Rank: 24052 steps.citi.com Failed paper.citi.com Failed metrics1.citi.com — Cisco Umbrella Rank: 26155	2 MB
24	ensighten.com nexus.ensighten.com — Cisco Umbrella Rank: 2849	173 KB
19	google.com 2 redirects cse.google.com — Cisco Umbrella Rank: 2551 www.google.com — Cisco Umbrella Rank: 2 adservice.google.com — Cisco Umbrella Rank: 76	6 KB
16	doubleclick.net 3 redirects googleads.g.doubleclick.net — Cisco Umbrella Rank: 42 6260004.fls.doubleclick.net — Cisco Umbrella Rank: 72182 6417343.fls.doubleclick.net 6269322.fls.doubleclick.net — Cisco Umbrella Rank: 259021	15 KB
13	googletagmanager.com www.googletagmanager.com — Cisco Umbrella Rank: 64	616 KB
10	google.ca www.google.ca — Cisco Umbrella Rank: 8590	1 KB
6	5damah.com 5damah.com	279 KB
5	demdex.net 1 redirects dpm.demdex.net — Cisco Umbrella Rank: 211 citi.demdex.net — Cisco Umbrella Rank: 42830	7 KB
4	pbbl.co 1 redirects cdn.pbbl.co — Cisco Umbrella Rank: 9503 px0.pbbl.co — Cisco Umbrella Rank: 9802	17 KB
4	rlcdn.com 2 redirects id.rlcdn.com — Cisco Umbrella Rank: 555 sr.rlcdn.com — Cisco Umbrella Rank: 12578	1 KB
3	googleadservices.com www.googleadservices.com — Cisco Umbrella Rank: 129	45 KB
2	medallia.com resources.digital-cloud-citi.medallia.com — Cisco Umbrella Rank: 28650	85 KB
2	omtrdc.net cdn.tt.omtrdc.net — Cisco Umbrella Rank: 9260 citicorpcreditservic.tt.omtrdc.net — Cisco Umbrella Rank: 31535	44 KB
2	iesnare.com mpsnare.iesnare.com — Cisco Umbrella Rank: 5941	14 KB
2	youtube.com www.youtube.com — Cisco Umbrella Rank: 95	53 KB
2	rfihub.net c1.rfihub.net — Cisco Umbrella Rank: 5872	13 KB
2	facebook.net connect.facebook.net — Cisco Umbrella Rank: 151	80 KB
1	agkn.com 1 redirects aa.agkn.com — Cisco Umbrella Rank: 455	718 B
1	kampyle.com udc-neb.kampyle.com — Cisco Umbrella Rank: 2333	317 B
1	rfihub.com 20766699p.rfihub.com — Cisco Umbrella Rank: 40505	2 KB
1	everesttech.net 1 redirects cm.everesttech.net — Cisco Umbrella Rank: 1030	517 B
1	citicards.com cardoffer.citicards.com — Cisco Umbrella Rank: 928460	504 B
1	gstatic.com www.gstatic.com	20 KB
1	ytimg.com s.ytimg.com — Cisco Umbrella Rank: 8475	8 KB
0	cyveillance.com Failed cyseal.cyveillance.com Failed
151	25

	Domain	Requested by
33	online.citi.com	5damah.com online.citi.com
24	nexus.ensighten.com	5damah.com nexus.ensighten.com
15	www.google.com	1 redirects 5damah.com
13	www.googletagmanager.com	nexus.ensighten.com www.googletagmanager.com
10	www.google.ca	5damah.com
10	googleads.g.doubleclick.net	5damah.com www.googleadservices.com
6	5damah.com	5damah.com
4	dpm.demdex.net	1 redirects 5damah.com
3	adservice.google.com	6417343.fls.doubleclick.net 6269322.fls.doubleclick.net 6260004.fls.doubleclick.net
3	www.googleadservices.com	5damah.com www.googletagmanager.com
2	px0.pbbl.co	1 redirects
2	cdn.pbbl.co	nexus.ensighten.com cdn.pbbl.co
2	resources.digital-cloud-citi.medallia.com	nexus.ensighten.com resources.digital-cloud-citi.medallia.com
2	6269322.fls.doubleclick.net	1 redirects 5damah.com
2	6417343.fls.doubleclick.net	1 redirects 5damah.com
2	sr.rlcdn.com	5damah.com nexus.ensighten.com
2	6260004.fls.doubleclick.net	1 redirects 5damah.com
2	id.rlcdn.com	2 redirects
2	mpsnare.iesnare.com	5damah.com online.citi.com
2	www.youtube.com	5damah.com www.youtube.com
2	c1.rfihub.net	5damah.com nexus.ensighten.com
2	connect.facebook.net	5damah.com
1	aa.agkn.com	1 redirects
1	udc-neb.kampyle.com
1	20766699p.rfihub.com	c1.rfihub.net
1	cm.everesttech.net	1 redirects
1	metrics1.citi.com	5damah.com
1	citi.demdex.net	nexus.ensighten.com
1	citicorpcreditservic.tt.omtrdc.net	5damah.com
1	cdn.tt.omtrdc.net	5damah.com
1	cardoffer.citicards.com	5damah.com
1	www.gstatic.com	5damah.com
1	cse.google.com	1 redirects
1	s.ytimg.com	5damah.com
0	paper.citi.com Failed	5damah.com
0	steps.citi.com Failed	5damah.com
0	cyseal.cyveillance.com Failed	5damah.com
151	37

This site contains links to these domains. Also see Links.

Domain
www.citi.com
online.citi.com
www.creditscore.citi.com
yourbenefits.citi.com
www.facebook.com
www.twitter.com
www.youtube.com
www.citigroup.com
jobs.citi.com
citieasydeals.com
www.citiprivatepass.com
www.privatebank.citibank.com
www.citibank.com
www.citigoldinternational.citi.com

Subject Issuer	Validity	Valid
5damah.com R3	`2022-08-28` - `2022-11-26`	3 months	crt.sh
*.facebook.com DigiCert SHA2 High Assurance Server CA	`2022-07-11` - `2022-10-09`	3 months	crt.sh
www.googleadservices.com GTS CA 1C3	`2022-09-12` - `2022-12-05`	3 months	crt.sh
*.rfihub.net Amazon	`2021-12-29` - `2023-01-27`	a year	crt.sh
nexus.ensighten.com DigiCert TLS RSA SHA256 2020 CA1	`2021-09-14` - `2022-10-12`	a year	crt.sh
*.google.com GTS CA 1C3	`2022-09-12` - `2022-12-05`	3 months	crt.sh
online.citibank.com DigiCert SHA2 Extended Validation Server CA	`2022-05-03` - `2023-05-16`	a year	crt.sh
www.google.com GTS CA 1C3	`2022-09-12` - `2022-12-05`	3 months	crt.sh
mpsnare.iesnare.com DigiCert SHA2 High Assurance Server CA	`2022-04-29` - `2023-05-23`	a year	crt.sh
*.g.doubleclick.net GTS CA 1C3	`2022-09-12` - `2022-12-05`	3 months	crt.sh
*.tt.omtrdc.net DigiCert TLS RSA SHA256 2020 CA1	`2021-10-04` - `2022-10-04`	a year	crt.sh
*.google.ca GTS CA 1C3	`2022-09-12` - `2022-12-05`	3 months	crt.sh
*.demdex.com DigiCert TLS RSA SHA256 2020 CA1	`2022-09-26` - `2023-10-27`	a year	crt.sh
metrics1.citi.com DigiCert EV RSA CA G2	`2022-07-22` - `2023-08-22`	a year	crt.sh
*.doubleclick.net GTS CA 1C3	`2022-09-12` - `2022-12-05`	3 months	crt.sh
*.rlcdn.com Sectigo RSA Domain Validation Secure Server CA	`2022-02-03` - `2023-02-25`	a year	crt.sh
*.rfihub.com Sectigo RSA Domain Validation Secure Server CA	`2022-05-24` - `2023-05-24`	a year	crt.sh
*.google-analytics.com GTS CA 1C3	`2022-09-12` - `2022-12-05`	3 months	crt.sh
*.digital-cloud-citi.medallia.com SSL.com RSA SSL subCA	`2021-11-15` - `2022-10-20`	a year	crt.sh
*.pbbl.co Amazon	`2021-11-04` - `2022-12-02`	a year	crt.sh
*.googleadservices.com GTS CA 1C3	`2022-09-12` - `2022-12-05`	3 months	crt.sh
*.kampyle.com SSL.com RSA SSL subCA	`2022-02-28` - `2023-03-31`	a year	crt.sh

This page contains 9 frames:

Primary Page: https://5damah.com/appp/online/citi.com/US/login.do.html?jdsh47wryfhoduetoealshfilw4yrledyuwruieryjosdifhyw78456rywehrfeuk=
Frame ID: 40DF0768CA542E69CC251CCD7DA6697E
Requests: 140 HTTP requests in this frame

Frame: https://citi.demdex.net/dest5.html?d_nsid=0
Frame ID: 2368BBB0B05892BA00A01665FDC0DC3A
Requests: 1 HTTP requests in this frame

Frame: https://6260004.fls.doubleclick.net/activityi;dc_pre=CMmQiKvNwfoCFY4MaAgdkBgEYw;src=6260004;type=cards0;cat=citih0;u4=JSOSIGNON;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=5518354524190.832
Frame ID: 59FB71950A32BDD03900448D851B6ECB
Requests: 2 HTTP requests in this frame

Frame: https://sr.rlcdn.com/425466.html?es=80676&u=da39a3ee5e6b4b0d3255bfef95601890afd80709
Frame ID: 6641B994252895ACD0C99AE66C8C0DE3
Requests: 1 HTTP requests in this frame

Frame: https://6417343.fls.doubleclick.net/activityi;dc_pre=CJHkhqvNwfoCFToJaAgd-WELWA;src=6417343;type=gcb_v0;cat=gcb_c00;dc_lat=;dc_rdid=;ord=1020006552152.4681
Frame ID: F6B8A5FA38949CAD090F3C135ABE0FEB
Requests: 2 HTTP requests in this frame

Frame: https://6269322.fls.doubleclick.net/activityi;dc_pre=CJLchqvNwfoCFXEOaAgdL1AB6g;src=6269322;type=bankp0;cat=banka001;ord=686502391290.5887
Frame ID: 4EB25BA52A8F558BDD96EC13AD68FB37
Requests: 2 HTTP requests in this frame

Frame: https://20766699p.rfihub.com/ca.html?ver=9&ra=1848&rb=648&ca=20766699&_o=17169175&_t=noncookiedusernamepassword&_rev=1&_pcode=1&_orderid=1&ssv_cuuid=&ssv_package=null&ssv_prodlist=null&ssv_pagename=noncookiedusernamepassword&pe=https%3A%2F%2F5damah.com%2Fappp%2Fonline%2Fciti.com%2FUS%2Flogin.do.html%3Fjdsh47wryfhoduetoealshfilw4yrledyuwruieryjosdifhyw78456rywehrfeuk%3D&pf=&ra=5867461392688047
Frame ID: 61FF20F605A5C81C20341A7B3C62B50D
Requests: 1 HTTP requests in this frame

Frame: https://sr.rlcdn.com/425466.html?es=80676&u=da39a3ee5e6b4b0d3255bfef95601890afd80709
Frame ID: 83AD011563F6CDFE7354F44684369145
Requests: 1 HTTP requests in this frame

Frame: https://cdn.pbbl.co/i/pp.html
Frame ID: DAD23381572E5BFF3E81CCC0413F7E8B
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Banking with Citi | Citi.com

Detected technologies

Bootstrap (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js

Ensighten (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

//nexus\.ensighten\.com/

Facebook (Widgets) Expand

Overall confidence: 100%
Detected patterns

//connect\.facebook\.([a-z]+)/[^/]*/[a-z]*\.js

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/gtag/js

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

151
Requests

93 %
HTTPS

37 %
IPv6

25
Domains

37
Subdomains

29
IPs

2
Countries

3262 kB
Transfer

7274 kB
Size

29
Cookies

20 Outgoing links

These are links going to different origins than the main page.

URL: https://www.citi.com/credit-cards/citi.action
Title: Credit Cards

Search URL Search Domain Scan URL

URL: https://online.citi.com/US/banking/savings/citi.action?ID=citi-savings&intc=1~1~52~6~BANR~2~Generic_Save~XPX
Title: Learn More

Search URL Search Domain Scan URL

URL: https://www.citi.com/credit-cards/compare-credit-cards/citi.action?ID=most-popular-credit-cards&afc=105&intc=1~1~52~6~BANR~1~mpc_Default_citicomREDPE_aug2016~OMPC105
Title: Learn More

Search URL Search Domain Scan URL

URL: http://www.creditscore.citi.com/
Title: Get Started

Search URL Search Domain Scan URL

URL: https://online.citi.com/US/p2ptransfer/p2pmarketing/flow.action?intc=1~1~52~6~BANR~2~Zelle2017~XPX
Title: Learn More

Search URL Search Domain Scan URL

URL: https://www.citi.com/credit-cards/knowledge-center/citi-articles/citi.action?ID=employment-credit-check
Title: Learn More

Search URL Search Domain Scan URL

URL: https://yourbenefits.citi.com/4-simple-tips-to-teach-you-how-to-shop-online-safely.html?intc=1~1~52~6~BANR~2~CyberSafeXmas~XPX
Title: Learn More

Search URL Search Domain Scan URL

URL: https://www.facebook.com/citi

Search URL Search Domain Scan URL

URL: https://www.twitter.com/citi

Search URL Search Domain Scan URL

URL: https://www.youtube.com/citi

Search URL Search Domain Scan URL

URL: http://www.citigroup.com/citi/
Title: Our Story

Search URL Search Domain Scan URL

URL: https://jobs.citi.com/
Title: Careers

Search URL Search Domain Scan URL

URL: https://citieasydeals.com/
Title: Citi Easy DealsSM

Search URL Search Domain Scan URL

URL: http://www.citiprivatepass.com/
Title: Citi® Private Pass®

Search URL Search Domain Scan URL

URL: https://www.privatebank.citibank.com/
Title: Citi Private Bank

Search URL Search Domain Scan URL

URL: https://www.citi.com/credit-cards/compare-credit-cards/citi.action?ID=view-all-credit-cards
Title: Credit Cards

Search URL Search Domain Scan URL

URL: http://www.citibank.com/citigoldprivateclient/homepage/content/en/index.html
Title: Citigold Private Client

Search URL Search Domain Scan URL

URL: http://www.citigoldinternational.citi.com/citigoldinternational/homepage/content/english/index.htm
Title: Citigold International

Search URL Search Domain Scan URL

URL: http://www.citibank.com/ipb-global/homepage/newsite/content/english/index.htm
Title: International Personal Banking

Search URL Search Domain Scan URL

URL: http://www.citibank.com/us/geb/index.htm
Title: Global Executive Banking

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 20

https://cse.google.com/cse/cse.js?cx=009695499870347544712:e3dyicpbrwu HTTP 302
https://www.google.com/sorry/index?continue=https://cse.google.com/cse/cse.js%3Fcx%3D009695499870347544712:e3dyicpbrwu&q=EhAmB1MAAGB4ZwAAAAAAAAAGGMuX5pkGIhBBmt1QDHTUvcZUve9Qp19VMgFy

Request Chain 23

https://www.google.com/jsapi?autoload=%7B%22modules%22%3A%5B%7B%22name%22%3A%22search%22%2C%22version%22%3A%221.0%22%2C%22callback%22%3A%22__gcse.scb%22%2C%22style%22%3A%22https%3A%2F%2Fwww.google.com%2Fcse%2Fstatic%2Fstyle%2Flook%2Fv2%2Fdefault.css%22%7D%5D%7D HTTP 301
https://www.gstatic.com/charts/loader.js?autoload=%7B%22modules%22%3A%5B%7B%22name%22%3A%22search%22%2C%22version%22%3A%221.0%22%2C%22callback%22%3A%22__gcse.scb%22%2C%22style%22%3A%22https%3A%2F%2Fwww.google.com%2Fcse%2Fstatic%2Fstyle%2Flook%2Fv2%2Fdefault.css%22%7D%5D%7D

Request Chain 30

https://id.rlcdn.com/387146.gif?partner_uid=29b7cd65-1652-474b-9fb6-56584a5e74fa HTTP 307
https://id.rlcdn.com/1000.gif?memo=CMrQFxIvCisIARDgXxokMjliN2NkNjUtMTY1Mi00NzRiLTlmYjYtNTY1ODRhNWU3NGZhEAAaDQjLl-aZBhIFCOgHEABCAEoA HTTP 307
https://cardoffer.citicards.com/dom/pixel?id=Xc6023IuVpyo1Uwh3hbBPbns_lg3zzYnEIhQZTqQrsSF4WKjE

Request Chain 66

https://dpm.demdex.net/id?d_visid_ver=3.1.2&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=61834D9B5228A7430A490D45%40AdobeOrg&d_nsid=0&ts=1664715723608 HTTP 302
https://dpm.demdex.net/id/rd?d_visid_ver=3.1.2&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=61834D9B5228A7430A490D45%40AdobeOrg&d_nsid=0&ts=1664715723608

Request Chain 81

https://cm.everesttech.net/cm/dd?d_uuid=73485228668894743311560514939524784954 HTTP 302
https://dpm.demdex.net/ibs:dpid=411&dpuuid=YzmLzAAAAGr_dQNw

Request Chain 89

https://6260004.fls.doubleclick.net/activityi;src=6260004;type=cards0;cat=citih0;u4=JSOSIGNON;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=5518354524190.832 HTTP 302
https://6260004.fls.doubleclick.net/activityi;dc_pre=CMmQiKvNwfoCFY4MaAgdkBgEYw;src=6260004;type=cards0;cat=citih0;u4=JSOSIGNON;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=5518354524190.832

Request Chain 91

https://6417343.fls.doubleclick.net/activityi;src=6417343;type=gcb_v0;cat=gcb_c00;dc_lat=;dc_rdid=;ord=1020006552152.4681 HTTP 302
https://6417343.fls.doubleclick.net/activityi;dc_pre=CJHkhqvNwfoCFToJaAgd-WELWA;src=6417343;type=gcb_v0;cat=gcb_c00;dc_lat=;dc_rdid=;ord=1020006552152.4681

Request Chain 92

https://6269322.fls.doubleclick.net/activityi;src=6269322;type=bankp0;cat=banka001;ord=686502391290.5887 HTTP 302
https://6269322.fls.doubleclick.net/activityi;dc_pre=CJLchqvNwfoCFXEOaAgdL1AB6g;src=6269322;type=bankp0;cat=banka001;ord=686502391290.5887

Request Chain 131

https://px0.pbbl.co/ns/__p2.gif?ppid=b43335de-325f-46ae-a310-bf456c895b4c&chk=false&brid=1560&brcid=&email=&orderId=&orderValue=&productId=&offerCode=&label=&pageUrl=https%3A%2F%2F5damah.com%2Fappp%2Fonline%2Fciti.com%2FUS%2Flogin.do.html%3Fjdsh47wryfhoduetoealshfilw4yrledyuwruieryjosdifhyw78456rywehrfeuk%3D&referrerUrl=&targetUrl=https%3A%2F%2F5damah.com%2Fappp%2Fonline%2Fciti.com%2FUS%2Flogin.do.html%3Fjdsh47wryfhoduetoealshfilw4yrledyuwruieryjosdifhyw78456rywehrfeuk%3D&sessionId=&markerType=seg&rand=KwwozhBYOLrTsv2i&iabOptOut=-&jsVer=3.2.1&frVer=1.2&markerId=348192 HTTP 302
https://aa.agkn.com/adscores/g.pixel?sid=9212282598&_ppid=b43335de-325f-46ae-a310-bf456c895b4c&_segid=99&iid=1efa811d-b197-426c-8e0d-a7bdc02b0d6c&pni4=d55e19f59e77bc8a569ef3a827b58c007f074b89ef3fcc9d5584e95405c4b517&pni6= HTTP 302
https://px0.pbbl.co/adadvisor.gif?segment=000&_ppid=b43335de-325f-46ae-a310-bf456c895b4c&_segid=99&_zip=&hk=&iid=1efa811d-b197-426c-8e0d-a7bdc02b0d6c&mt=&bd=&cb=1664715725337

151 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK Primary Request login.do.html Show response
5damah.com/appp/online/citi.com/US/ 279 KB
279 KB 72ms
16ms Document
text/html 149.56.92.220
OVH

General

Check archive.org

Show headers Download Go to

Full URL: https://5damah.com/appp/online/citi.com/US/login.do.html?jdsh47wryfhoduetoealshfilw4yrledyuwruieryjosdifhyw78456rywehrfeuk=
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 149.56.92.220 Montreal, Canada, ASN16276 (OVH, FR),
Reverse DNS: ip220.ip-149-56-92.net
Software: Apache /
Resource Hash: a1907f85adbb4c0436ebc852398d1a9b397260d2eba9e49a6aea4c6a27beec11

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

Accept-Ranges: bytes
Connection: Keep-Alive
Content-Length: 285857
Content-Type: text/html
Date: Sun, 02 Oct 2022 13:02:02 GMT
Keep-Alive: timeout=5, max=100
Last-Modified: Thu, 28 Dec 2017 17:00:52 GMT
Server: Apache

GET
H2 200 144025652821024 Show response
connect.facebook.net/signals/config/ 178 KB
53 KB 133ms
75ms Script
application/x-javascript 2a03:2880:f012:10c:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/signals/config/144025652821024?v=2.8.6&r=stable

Requested by

Host: 5damah.com
URL: https://5damah.com/appp/online/citi.com/US/login.do.html?jdsh47wryfhoduetoealshfilw4yrledyuwruieryjosdifhyw78456rywehrfeuk=

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f012:10c:face:b00c:0:3 Secaucus, United States, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

39f9aa83d18bd14b639b419f7dd9431ed76d37fca5f7b33b5912bee3c49905b6

Security Headers

Name	Value
Content-Security-Policy	default-src * data: blob: 'self';script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .google.com 127.0.0.1: 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com: wss://.whatsapp.com: wss://.fbcdn.net attachment.fbsbx.com ws://localhost: blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://5damah.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

content-security-policy: default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; preload; includeSubDomains
date: Sun, 02 Oct 2022 13:02:03 GMT
document-policy: force-load-at-top
content-security-policy-report-only: default-src https: data: wss: blob: chrome-extension: 'unsafe-inline' 'unsafe-eval';report-uri https://www.facebook.com/csp/reporting/?minimize=0;require-trusted-types-for 'script';
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400,h3-29=":443"; ma=86400
x-fb-rlafr: 0
x-xss-protection: 0
pragma: public
x-fb-debug: BjsUy8I1xLxhkX+7y7uQDucOEiqvnziPk4mpgfeOpwda+4m7GfeJw2S7NwRA09txVmMCsQVvQlA9PjoYnmnmvQ==
x-fb-trip-id: 1512268381
cross-origin-opener-policy: same-origin-allow-popups
vary: Accept-Encoding
x-frame-options: DENY
content-type: application/x-javascript; charset=utf-8
cache-control: public, max-age=1200
priority: u=3,i
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 fbevents.js Show response
connect.facebook.net/en_US/ 101 KB
27 KB 81ms
24ms Script
application/x-javascript 2a03:2880:f012:10c:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/fbevents.js

Requested by

Host: 5damah.com
URL: https://5damah.com/appp/online/citi.com/US/login.do.html?jdsh47wryfhoduetoealshfilw4yrledyuwruieryjosdifhyw78456rywehrfeuk=

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f012:10c:face:b00c:0:3 Secaucus, United States, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

00a92494627ed8f758972b7dc47b3af186497c0637ea867a33fdb604c1548674

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://5damah.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; preload; includeSubDomains
content-encoding: gzip
x-content-type-options: nosniff
date: Sun, 02 Oct 2022 13:02:03 GMT
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400,h3-29=":443"; ma=86400
content-length: 26840
x-fb-rlafr: 0
x-xss-protection: 0
pragma: public
x-fb-debug: skIvs6f3Gz18O04IPnB4MV+ObR6NiF8lZh2z6xkrwjmZk9srx9sFX698Z1a72oDxeSEjBVrHCz5t8MruWEafjQ==
x-fb-trip-id: 1512268381
cross-origin-opener-policy: same-origin-allow-popups
vary: Accept-Encoding
x-frame-options: DENY
content-type: application/x-javascript; charset=utf-8
cache-control: public, max-age=1200
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 conversion_async.js Show response
www.googleadservices.com/pagead/ 41 KB
15 KB 167ms
89ms Script
text/javascript 142.251.35.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googleadservices.com/pagead/conversion_async.js

Requested by

Host: 5damah.com
URL: https://5damah.com/appp/online/citi.com/US/login.do.html?jdsh47wryfhoduetoealshfilw4yrledyuwruieryjosdifhyw78456rywehrfeuk=

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.251.35.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga25s78-in-f2.1e100.net

Software

cafe /

Resource Hash

f42283e0ca17a52688c5250e714ecd1b6a53af8b0f6e54ac64546499b0ec1b19

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://5damah.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

date: Sun, 02 Oct 2022 13:02:03 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15192
x-xss-protection: 0
server: cafe
etag: 699633608045481581
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600
timing-allow-origin: *
expires: Sun, 02 Oct 2022 13:02:03 GMT

GET
H2 200 tc.min.js Show response
c1.rfihub.net/js/ 19 KB
6 KB 137ms
35ms Script
application/x-javascript 2600:9000:2211:3000:1:76cf:fe80:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c1.rfihub.net/js/tc.min.js
Requested by: Host: 5damah.com
URL: https://5damah.com/appp/online/citi.com/US/login.do.html?jdsh47wryfhoduetoealshfilw4yrledyuwruieryjosdifhyw78456rywehrfeuk=
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2211:3000:1:76cf:fe80:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: Jetty(9.3.29.v20201019) /
Resource Hash: 7ef97b12890fc6fee67f869c6e1f74b6719de7d66ac0d649c8d7386a80b4c30f

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://5damah.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

date: Sun, 02 Oct 2022 12:32:04 GMT
content-encoding: gzip
via: 1.1 15f2e88ce5f742da8075e454f83e8f5e.cloudfront.net (CloudFront)
last-modified: Sun, 02 Oct 2022 12:31:54 GMT
server: Jetty(9.3.29.v20201019)
x-amz-cf-pop: ORD51-C4
age: 1799
x-cache: Hit from cloudfront
content-type: application/x-javascript
p3p: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
cache-control: public, max-age=3600
content-length: 6162
x-amz-cf-id: J9cHO6Zy68VjV4pbGbYRD7lpCua00TOBazHZlHezEALTt7gppFxbNw==
expires: Sun, 02 Oct 2022 13:32:04 GMT

GET
H2 200 9e25a3d98b7db678ee26fe54b300326f.js Show response
nexus.ensighten.com/citi/na_prod/code/ 15 B
480 B 273ms
173ms Script
application/javascript 13.249.141.26
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://nexus.ensighten.com/citi/na_prod/code/9e25a3d98b7db678ee26fe54b300326f.js?conditionId0=474145
Requested by: Host: 5damah.com
URL: https://5damah.com/appp/online/citi.com/US/login.do.html?jdsh47wryfhoduetoealshfilw4yrledyuwruieryjosdifhyw78456rywehrfeuk=
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.249.141.26 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-249-141-26.ord51.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: c0d8671e209f009f9c1ad8153222f942087ec193b7e87f856e60971bd5424633

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://5damah.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

x-amz-version-id: aoJA4xuOoFemAhjg4lZAdeni.2iMq5FL
date: Sun, 02 Oct 2022 13:02:04 GMT
via: 1.1 3e5a2f6c5b1171dae267d5a9344f95e8.cloudfront.net (CloudFront)
x-amz-cf-pop: ORD51-C1
x-amz-server-side-encryption: AES256
x-cache: Error from cloudfront
x-amz-replication-status: COMPLETED
content-length: 15
last-modified: Fri, 22 Jul 2022 23:48:01 GMT
server: AmazonS3
etag: "ffe905f50d9b47e6353b68513c4d48ac"
vary: Accept-Encoding
content-type: application/javascript
cache-control: no-cache, no-store
accept-ranges: bytes
x-amz-cf-id: TOquqFIIMfCmFJG2NXJL0m832assK885DBA09nT2v2kpe2DSpBcF_A==

GET
H2 200 d250f23aad5c6053da4164851592784d.js Show response
nexus.ensighten.com/citi/na_prod/code/ 15 B
463 B 238ms
138ms Script
application/javascript 13.249.141.26
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://nexus.ensighten.com/citi/na_prod/code/d250f23aad5c6053da4164851592784d.js?conditionId0=644545&conditionId1=644546
Requested by: Host: 5damah.com
URL: https://5damah.com/appp/online/citi.com/US/login.do.html?jdsh47wryfhoduetoealshfilw4yrledyuwruieryjosdifhyw78456rywehrfeuk=
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.249.141.26 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-249-141-26.ord51.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: c0d8671e209f009f9c1ad8153222f942087ec193b7e87f856e60971bd5424633

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://5damah.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

date: Sun, 02 Oct 2022 13:02:04 GMT
x-amz-version-id: aoJA4xuOoFemAhjg4lZAdeni.2iMq5FL
via: 1.1 3e5a2f6c5b1171dae267d5a9344f95e8.cloudfront.net (CloudFront)
last-modified: Fri, 22 Jul 2022 23:48:01 GMT
server: AmazonS3
x-amz-cf-pop: ORD51-C1
etag: "ffe905f50d9b47e6353b68513c4d48ac"
x-amz-server-side-encryption: AES256
x-cache: Error from cloudfront
content-type: application/javascript
cache-control: no-cache, no-store
x-amz-replication-status: COMPLETED
accept-ranges: bytes
content-length: 15
x-amz-cf-id: 9ROTqyY7-SVDKN5NIjRAdG467r0N3VzSz5nraVHt2ukaa3rkeKcPhg==

GET
H2 200 344e6287eba51b8eca1dd6b59b9ebcbf.js Show response
nexus.ensighten.com/citi/na_prod/code/ 15 B
480 B 311ms
211ms Script
application/javascript 13.249.141.26
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://nexus.ensighten.com/citi/na_prod/code/344e6287eba51b8eca1dd6b59b9ebcbf.js?conditionId0=489741
Requested by: Host: 5damah.com
URL: https://5damah.com/appp/online/citi.com/US/login.do.html?jdsh47wryfhoduetoealshfilw4yrledyuwruieryjosdifhyw78456rywehrfeuk=
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.249.141.26 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-249-141-26.ord51.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: c0d8671e209f009f9c1ad8153222f942087ec193b7e87f856e60971bd5424633

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://5damah.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

x-amz-version-id: aoJA4xuOoFemAhjg4lZAdeni.2iMq5FL
date: Sun, 02 Oct 2022 13:02:04 GMT
via: 1.1 3e5a2f6c5b1171dae267d5a9344f95e8.cloudfront.net (CloudFront)
x-amz-cf-pop: ORD51-C1
x-amz-server-side-encryption: AES256
x-cache: Error from cloudfront
x-amz-replication-status: COMPLETED
content-length: 15
last-modified: Fri, 22 Jul 2022 23:48:01 GMT
server: AmazonS3
etag: "ffe905f50d9b47e6353b68513c4d48ac"
vary: Accept-Encoding
content-type: application/javascript
cache-control: no-cache, no-store
accept-ranges: bytes
x-amz-cf-id: FVht3eRpyfdqnCsUOD1LU2vpWa9TcuGiWajIi2ijCePqzfaYNhu6pQ==

GET
H2 200 001a2367b764167555796bd4a5c337fb.js Show response
nexus.ensighten.com/citi/na_prod/code/ 15 B
482 B 310ms
210ms Script
application/javascript 13.249.141.26
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://nexus.ensighten.com/citi/na_prod/code/001a2367b764167555796bd4a5c337fb.js?conditionId0=489470
Requested by: Host: 5damah.com
URL: https://5damah.com/appp/online/citi.com/US/login.do.html?jdsh47wryfhoduetoealshfilw4yrledyuwruieryjosdifhyw78456rywehrfeuk=
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.249.141.26 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-249-141-26.ord51.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: c0d8671e209f009f9c1ad8153222f942087ec193b7e87f856e60971bd5424633

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://5damah.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

x-amz-version-id: aoJA4xuOoFemAhjg4lZAdeni.2iMq5FL
date: Sun, 02 Oct 2022 13:02:04 GMT
via: 1.1 3e5a2f6c5b1171dae267d5a9344f95e8.cloudfront.net (CloudFront)
x-amz-cf-pop: ORD51-C1
x-amz-server-side-encryption: AES256
x-cache: Error from cloudfront
x-amz-replication-status: COMPLETED
content-length: 15
last-modified: Fri, 22 Jul 2022 23:48:01 GMT
server: AmazonS3
etag: "ffe905f50d9b47e6353b68513c4d48ac"
vary: Accept-Encoding
content-type: application/javascript
cache-control: no-cache, no-store
accept-ranges: bytes
x-amz-cf-id: ymMii39j3ueBk8XqxLBd3TUr9v41hmOV5jyRlaqlDL5JquRDXDQgdg==

GET
H2 200 2798cf17adb8e38b54a75581780cd528.js Show response
nexus.ensighten.com/citi/na_prod/code/ 15 B
481 B 311ms
211ms Script
application/javascript 13.249.141.26
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://nexus.ensighten.com/citi/na_prod/code/2798cf17adb8e38b54a75581780cd528.js?conditionId0=405518
Requested by: Host: 5damah.com
URL: https://5damah.com/appp/online/citi.com/US/login.do.html?jdsh47wryfhoduetoealshfilw4yrledyuwruieryjosdifhyw78456rywehrfeuk=
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.249.141.26 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-249-141-26.ord51.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: c0d8671e209f009f9c1ad8153222f942087ec193b7e87f856e60971bd5424633

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://5damah.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

x-amz-version-id: aoJA4xuOoFemAhjg4lZAdeni.2iMq5FL
date: Sun, 02 Oct 2022 13:02:04 GMT
via: 1.1 3e5a2f6c5b1171dae267d5a9344f95e8.cloudfront.net (CloudFront)
x-amz-cf-pop: ORD51-C1
x-amz-server-side-encryption: AES256
x-cache: Error from cloudfront
x-amz-replication-status: COMPLETED
content-length: 15
last-modified: Fri, 22 Jul 2022 23:48:01 GMT
server: AmazonS3
etag: "ffe905f50d9b47e6353b68513c4d48ac"
vary: Accept-Encoding
content-type: application/javascript
cache-control: no-cache, no-store
accept-ranges: bytes
x-amz-cf-id: IGfqJ_I54JWrV2IJ37jaUHJcyJgjG47MTd-Ztq4lOcWXo0_9EN78Sg==

GET
H2 200 9629c46c54c69a0b6f09e36f05f2b12e.js Show response
nexus.ensighten.com/citi/na_prod/code/ 15 B
481 B 311ms
212ms Script
application/javascript 13.249.141.26
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://nexus.ensighten.com/citi/na_prod/code/9629c46c54c69a0b6f09e36f05f2b12e.js?conditionId0=486757
Requested by: Host: 5damah.com
URL: https://5damah.com/appp/online/citi.com/US/login.do.html?jdsh47wryfhoduetoealshfilw4yrledyuwruieryjosdifhyw78456rywehrfeuk=
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.249.141.26 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-249-141-26.ord51.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: c0d8671e209f009f9c1ad8153222f942087ec193b7e87f856e60971bd5424633

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://5damah.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

x-amz-version-id: aoJA4xuOoFemAhjg4lZAdeni.2iMq5FL
date: Sun, 02 Oct 2022 13:02:04 GMT
via: 1.1 3e5a2f6c5b1171dae267d5a9344f95e8.cloudfront.net (CloudFront)
x-amz-cf-pop: ORD51-C1
x-amz-server-side-encryption: AES256
x-cache: Error from cloudfront
x-amz-replication-status: COMPLETED
content-length: 15
last-modified: Fri, 22 Jul 2022 23:48:01 GMT
server: AmazonS3
etag: "ffe905f50d9b47e6353b68513c4d48ac"
vary: Accept-Encoding
content-type: application/javascript
cache-control: no-cache, no-store
accept-ranges: bytes
x-amz-cf-id: JqP_VqEI_0mTcX6G6A8AzY-Hd_Xl0Sybm1tV0V4YGWwi3rS7Tt_hjA==

GET
H2 200 2b9b8d23d616e836616824194101ac5e.js Show response
nexus.ensighten.com/citi/na_prod/code/ 15 B
480 B 312ms
213ms Script
application/javascript 13.249.141.26
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://nexus.ensighten.com/citi/na_prod/code/2b9b8d23d616e836616824194101ac5e.js?conditionId0=454466
Requested by: Host: 5damah.com
URL: https://5damah.com/appp/online/citi.com/US/login.do.html?jdsh47wryfhoduetoealshfilw4yrledyuwruieryjosdifhyw78456rywehrfeuk=
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.249.141.26 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-249-141-26.ord51.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: c0d8671e209f009f9c1ad8153222f942087ec193b7e87f856e60971bd5424633

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://5damah.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

x-amz-version-id: aoJA4xuOoFemAhjg4lZAdeni.2iMq5FL
date: Sun, 02 Oct 2022 13:02:04 GMT
via: 1.1 3e5a2f6c5b1171dae267d5a9344f95e8.cloudfront.net (CloudFront)
x-amz-cf-pop: ORD51-C1
x-amz-server-side-encryption: AES256
x-cache: Error from cloudfront
x-amz-replication-status: COMPLETED
content-length: 15
last-modified: Fri, 22 Jul 2022 23:48:01 GMT
server: AmazonS3
etag: "ffe905f50d9b47e6353b68513c4d48ac"
vary: Accept-Encoding
content-type: application/javascript
cache-control: no-cache, no-store
accept-ranges: bytes
x-amz-cf-id: _1QJ8hWugNA8eh-Uoozo6zS6V3a9O-qxfEkBPO93qOARt74aaNveVw==

GET
H2 200 07adcfab59ec26eb79eade083f91b6a4.js Show response
nexus.ensighten.com/citi/na_prod/code/ 15 B
481 B 312ms
213ms Script
application/javascript 13.249.141.26
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://nexus.ensighten.com/citi/na_prod/code/07adcfab59ec26eb79eade083f91b6a4.js?conditionId0=443037
Requested by: Host: 5damah.com
URL: https://5damah.com/appp/online/citi.com/US/login.do.html?jdsh47wryfhoduetoealshfilw4yrledyuwruieryjosdifhyw78456rywehrfeuk=
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.249.141.26 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-249-141-26.ord51.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: c0d8671e209f009f9c1ad8153222f942087ec193b7e87f856e60971bd5424633

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://5damah.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

x-amz-version-id: aoJA4xuOoFemAhjg4lZAdeni.2iMq5FL
date: Sun, 02 Oct 2022 13:02:04 GMT
via: 1.1 3e5a2f6c5b1171dae267d5a9344f95e8.cloudfront.net (CloudFront)
x-amz-cf-pop: ORD51-C1
x-amz-server-side-encryption: AES256
x-cache: Error from cloudfront
x-amz-replication-status: COMPLETED
content-length: 15
last-modified: Fri, 22 Jul 2022 23:48:01 GMT
server: AmazonS3
etag: "ffe905f50d9b47e6353b68513c4d48ac"
vary: Accept-Encoding
content-type: application/javascript
cache-control: no-cache, no-store
accept-ranges: bytes
x-amz-cf-id: NfNyjeKGWs1Dl-Td-X7TQCFDoHrvjG_aZ_ja1dFsSY3ET0PXsM5dMA==

GET
H2 200 5f17ada4585e38633271a5bb40b56a65.js Show response
nexus.ensighten.com/citi/na_prod/code/ 15 B
481 B 311ms
212ms Script
application/javascript 13.249.141.26
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://nexus.ensighten.com/citi/na_prod/code/5f17ada4585e38633271a5bb40b56a65.js?conditionId0=421908
Requested by: Host: 5damah.com
URL: https://5damah.com/appp/online/citi.com/US/login.do.html?jdsh47wryfhoduetoealshfilw4yrledyuwruieryjosdifhyw78456rywehrfeuk=
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.249.141.26 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-249-141-26.ord51.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: c0d8671e209f009f9c1ad8153222f942087ec193b7e87f856e60971bd5424633

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://5damah.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

x-amz-version-id: aoJA4xuOoFemAhjg4lZAdeni.2iMq5FL
date: Sun, 02 Oct 2022 13:02:04 GMT
via: 1.1 3e5a2f6c5b1171dae267d5a9344f95e8.cloudfront.net (CloudFront)
x-amz-cf-pop: ORD51-C1
x-amz-server-side-encryption: AES256
x-cache: Error from cloudfront
x-amz-replication-status: COMPLETED
content-length: 15
last-modified: Fri, 22 Jul 2022 23:48:01 GMT
server: AmazonS3
etag: "ffe905f50d9b47e6353b68513c4d48ac"
vary: Accept-Encoding
content-type: application/javascript
cache-control: no-cache, no-store
accept-ranges: bytes
x-amz-cf-id: Zy5swz3-3xcZx24RZfnjjoRDl_GnCr3nVT_eom1KwniQO8W5-9aXVA==

GET
H2 200 1c6a2daa245e6e818d119a3f05974a67.js Show response
nexus.ensighten.com/citi/na_prod/code/ 15 B
481 B 311ms
212ms Script
application/javascript 13.249.141.26
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://nexus.ensighten.com/citi/na_prod/code/1c6a2daa245e6e818d119a3f05974a67.js?conditionId0=480881
Requested by: Host: 5damah.com
URL: https://5damah.com/appp/online/citi.com/US/login.do.html?jdsh47wryfhoduetoealshfilw4yrledyuwruieryjosdifhyw78456rywehrfeuk=
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.249.141.26 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-249-141-26.ord51.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: c0d8671e209f009f9c1ad8153222f942087ec193b7e87f856e60971bd5424633

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://5damah.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

x-amz-version-id: aoJA4xuOoFemAhjg4lZAdeni.2iMq5FL
date: Sun, 02 Oct 2022 13:02:04 GMT
via: 1.1 3e5a2f6c5b1171dae267d5a9344f95e8.cloudfront.net (CloudFront)
x-amz-cf-pop: ORD51-C1
x-amz-server-side-encryption: AES256
x-cache: Error from cloudfront
x-amz-replication-status: COMPLETED
content-length: 15
last-modified: Fri, 22 Jul 2022 23:48:01 GMT
server: AmazonS3
etag: "ffe905f50d9b47e6353b68513c4d48ac"
vary: Accept-Encoding
content-type: application/javascript
cache-control: no-cache, no-store
accept-ranges: bytes
x-amz-cf-id: QPnguGKxsI32T48JPaX3LO6aaEclWpT1qVrnHUxRYN9Gsfp6TSIE3g==

GET
H2 200 411c41a4cf04ba74ad294fd19024b554.js Show response
nexus.ensighten.com/citi/na_prod/code/ 15 B
480 B 308ms
210ms Script
application/javascript 13.249.141.26
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://nexus.ensighten.com/citi/na_prod/code/411c41a4cf04ba74ad294fd19024b554.js?conditionId0=658091
Requested by: Host: 5damah.com
URL: https://5damah.com/appp/online/citi.com/US/login.do.html?jdsh47wryfhoduetoealshfilw4yrledyuwruieryjosdifhyw78456rywehrfeuk=
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.249.141.26 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-249-141-26.ord51.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: c0d8671e209f009f9c1ad8153222f942087ec193b7e87f856e60971bd5424633

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://5damah.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

x-amz-version-id: aoJA4xuOoFemAhjg4lZAdeni.2iMq5FL
date: Sun, 02 Oct 2022 13:02:04 GMT
via: 1.1 3e5a2f6c5b1171dae267d5a9344f95e8.cloudfront.net (CloudFront)
x-amz-cf-pop: ORD51-C1
x-amz-server-side-encryption: AES256
x-cache: Error from cloudfront
x-amz-replication-status: COMPLETED
content-length: 15
last-modified: Fri, 22 Jul 2022 23:48:01 GMT
server: AmazonS3
etag: "ffe905f50d9b47e6353b68513c4d48ac"
vary: Accept-Encoding
content-type: application/javascript
cache-control: no-cache, no-store
accept-ranges: bytes
x-amz-cf-id: chUE2CoG1sT3SdXbpOk9xuEx06KPU3nmQ2U3Aa0ItGx0qqou7JOi5g==

GET
H2 200 bfdef1b803c151d3a5a569569f5b55c9.js Show response
nexus.ensighten.com/citi/na_prod/code/ 15 B
480 B 312ms
213ms Script
application/javascript 13.249.141.26
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://nexus.ensighten.com/citi/na_prod/code/bfdef1b803c151d3a5a569569f5b55c9.js?conditionId0=490317
Requested by: Host: 5damah.com
URL: https://5damah.com/appp/online/citi.com/US/login.do.html?jdsh47wryfhoduetoealshfilw4yrledyuwruieryjosdifhyw78456rywehrfeuk=
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.249.141.26 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-249-141-26.ord51.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: c0d8671e209f009f9c1ad8153222f942087ec193b7e87f856e60971bd5424633

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://5damah.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

x-amz-version-id: aoJA4xuOoFemAhjg4lZAdeni.2iMq5FL
date: Sun, 02 Oct 2022 13:02:04 GMT
via: 1.1 3e5a2f6c5b1171dae267d5a9344f95e8.cloudfront.net (CloudFront)
x-amz-cf-pop: ORD51-C1
x-amz-server-side-encryption: AES256
x-cache: Error from cloudfront
x-amz-replication-status: COMPLETED
content-length: 15
last-modified: Fri, 22 Jul 2022 23:48:01 GMT
server: AmazonS3
etag: "ffe905f50d9b47e6353b68513c4d48ac"
vary: Accept-Encoding
content-type: application/javascript
cache-control: no-cache, no-store
accept-ranges: bytes
x-amz-cf-id: Vnonij-gUWnn4KWtS_qWGScatcBlkjihhWiExKdEL6DabbVajWRPxA==

GET
H2 200 55f12b3dcfbfef152239ec72eee0b588.js Show response
nexus.ensighten.com/citi/na_prod/code/ 15 B
463 B 140ms
130ms Script
application/javascript 13.249.141.26
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://nexus.ensighten.com/citi/na_prod/code/55f12b3dcfbfef152239ec72eee0b588.js?conditionId0=467299
Requested by: Host: 5damah.com
URL: https://5damah.com/appp/online/citi.com/US/login.do.html?jdsh47wryfhoduetoealshfilw4yrledyuwruieryjosdifhyw78456rywehrfeuk=
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.249.141.26 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-249-141-26.ord51.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: c0d8671e209f009f9c1ad8153222f942087ec193b7e87f856e60971bd5424633

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://5damah.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

date: Sun, 02 Oct 2022 13:02:04 GMT
x-amz-version-id: aoJA4xuOoFemAhjg4lZAdeni.2iMq5FL
via: 1.1 3e5a2f6c5b1171dae267d5a9344f95e8.cloudfront.net (CloudFront)
last-modified: Fri, 22 Jul 2022 23:48:01 GMT
server: AmazonS3
x-amz-cf-pop: ORD51-C1
etag: "ffe905f50d9b47e6353b68513c4d48ac"
x-amz-server-side-encryption: AES256
x-cache: Error from cloudfront
content-type: application/javascript
cache-control: no-cache, no-store
x-amz-replication-status: COMPLETED
accept-ranges: bytes
content-length: 15
x-amz-cf-id: IO1VnElvRIxc6yvi7150_Q2WG7koqJWfdiGvxYBy1Iu8_jwr65og9w==

GET
H2 200 www-widgetapi.js Show response
s.ytimg.com/yts/jsbin/www-widgetapi-vfluxKqfs/ 21 KB
8 KB 86ms
20ms Script
text/javascript 2607:f8b0:4006:823::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s.ytimg.com/yts/jsbin/www-widgetapi-vfluxKqfs/www-widgetapi.js

Requested by

Host: 5damah.com
URL: https://5damah.com/appp/online/citi.com/US/login.do.html?jdsh47wryfhoduetoealshfilw4yrledyuwruieryjosdifhyw78456rywehrfeuk=

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:823::200e Rockville, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

4dc9ca6c56ae86b2c15cdcbed7193727a40855653dd2b5beaa4ee1d76fc39faf

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://5damah.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

date: Thu, 29 Sep 2022 18:36:56 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 239107
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 8037
x-xss-protection: 0
last-modified: Wed, 03 Jan 2018 20:31:50 GMT
server: sffe
vary: Accept-Encoding, Origin
report-to: {"group":"youtube","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube"}]}
content-type: text/javascript
cache-control: public, max-age=691200
accept-ranges: bytes
timing-allow-origin: https://www.youtube.com
cross-origin-opener-policy-report-only: same-origin; report-to="youtube"
expires: Fri, 07 Oct 2022 18:36:56 GMT

GET cyss.js
cyseal.cyveillance.com/SiteSeal/ 0
0

GET
H2 200 iframe_api Show response
www.youtube.com/ 992 B
2 KB 113ms
43ms Script
text/javascript 2607:f8b0:4006:821::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.youtube.com/iframe_api

Requested by

Host: 5damah.com
URL: https://5damah.com/appp/online/citi.com/US/login.do.html?jdsh47wryfhoduetoealshfilw4yrledyuwruieryjosdifhyw78456rywehrfeuk=

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:821::200e Rockville, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

ad3e96cb4461ada912c601d7163ea04a2ce8b5021c82d77a1eb1c8c13f81c29d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://5damah.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

date: Sun, 02 Oct 2022 13:02:03 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-encoding: br
p3p: CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657?hl=en for more info."
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
server: ESF
x-frame-options: SAMEORIGIN
report-to: {"group":"youtube_main","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube_main"}]}
content-type: text/javascript; charset=utf-8
vary: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cache-control: private, max-age=0
permissions-policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-platform=*, ch-ua-platform-version=*
cross-origin-opener-policy-report-only: same-origin; report-to="youtube_main"
expires: Sun, 02 Oct 2022 13:02:03 GMT

GET
H3

429

index
www.google.com/sorry/
Redirect Chain

https://cse.google.com/cse/cse.js?cx=009695499870347544712:e3dyicpbrwu
https://www.google.com/sorry/index?continue=https://cse.google.com/cse/cse.js%3Fcx%3D009695499870347544712:e3dyicpbrwu&q=EhAmB1MAAGB4ZwAAAAAAAAAGGMuX5pkGIhBBmt1QDHTUvcZUve9Qp19VMgFy

0
0

35ms
34ms

Script
text/html

2607:f8b0:4006:81c::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://www.google.com/sorry/index?continue=https://cse.google.com/cse/cse.js%3Fcx%3D009695499870347544712:e3dyicpbrwu&q=EhAmB1MAAGB4ZwAAAAAAAAAGGMuX5pkGIhBBmt1QDHTUvcZUve9Qp19VMgFy
Requested by: Host: 5damah.com
URL: https://5damah.com/appp/online/citi.com/US/login.do.html?jdsh47wryfhoduetoealshfilw4yrledyuwruieryjosdifhyw78456rywehrfeuk=
Protocol: H3
Server: 2607:f8b0:4006:81c::2004 Rockville, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://5damah.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

Redirect headers

bfcache-opt-in: unload
date: Sun, 02 Oct 2022 13:02:03 GMT
server: gws
x-frame-options: SAMEORIGIN
p3p: CP="This is not a P3P policy! See g.co/p3phelp for more info."
location: https://www.google.com/sorry/index?continue=https://cse.google.com/cse/cse.js%3Fcx%3D009695499870347544712:e3dyicpbrwu&q=EhAmB1MAAGB4ZwAAAAAAAAAGGMuX5pkGIhBBmt1QDHTUvcZUve9Qp19VMgFy
x-hallmonitor-challenge: CgwIy5fmmQYQutvToQMSECYHUwAAYHhnAAAAAAAAAAY
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 382
x-xss-protection: 0

GET
H2 200 serverComponent.php Show response
nexus.ensighten.com/citi/na_prod/ 2 KB
1 KB 179ms
81ms Script
text/javascript 13.249.141.26
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://nexus.ensighten.com/citi/na_prod/serverComponent.php?r=222.40325302287388&ClientID=1129&PageID=https%3A%2F%2Fonline.citi.com%2FUS%2Flogin.do%3FJFP_TOKEN%3D906KF3PT
Requested by: Host: 5damah.com
URL: https://5damah.com/appp/online/citi.com/US/login.do.html?jdsh47wryfhoduetoealshfilw4yrledyuwruieryjosdifhyw78456rywehrfeuk=
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.249.141.26 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-249-141-26.ord51.r.cloudfront.net
Software: nginx /
Resource Hash: e8097c207ba7882010ad55405901c4f24424265d1ab62818d5c13b9a3f5d9dc1

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://5damah.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

date: Sun, 02 Oct 2022 13:02:03 GMT
content-encoding: gzip
via: 1.1 3e5a2f6c5b1171dae267d5a9344f95e8.cloudfront.net (CloudFront)
server: nginx
x-amz-cf-pop: ORD51-C1
vary: Accept-Encoding
x-cache: Miss from cloudfront
content-type: text/javascript
cache-control: no-cache, no-store
x-amz-cf-id: 3xZRBbAKy6billAE7RuPuC5Cfms09n6eFo9hNsx8arpH4T8cU3ZR4A==
expires: Sun, 02 Oct 2022 13:02:02 GMT

GET
H2 200 citilive-search-responsive.css
online.citi.com/JEA/CitiSearch/nexus-platform/css/ 1 KB
876 B 137ms
50ms Stylesheet
text/css 23.217.42.185
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://online.citi.com/JEA/CitiSearch/nexus-platform/css/citilive-search-responsive.css

Requested by

Host: 5damah.com
URL: https://5damah.com/appp/online/citi.com/US/login.do.html?jdsh47wryfhoduetoealshfilw4yrledyuwruieryjosdifhyw78456rywehrfeuk=

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

23.217.42.185 New York, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-217-42-185.deploy.static.akamaitechnologies.com

Software

Resource Hash

61eb086edee74d836ac3ff4cf7e7eefb28f97934c0e17748251e3db8d949c0b7

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://5damah.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

expires: Sun, 02 Oct 2022 19:02:03 GMT
strict-transport-security: max-age=300
content-encoding: gzip
date: Sun, 02 Oct 2022 13:02:03 GMT
last-modified: Sun, 11 Sep 2022 00:40:55 GMT
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-akamai-citisite: SWDC
vary: Accept-Encoding
content-type: text/css
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
cache-control: max-age=21600
content-length: 337
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2

200

loader.js Show response
www.gstatic.com/charts/
Redirect Chain

https://www.google.com/jsapi?autoload=%7B%22modules%22%3A%5B%7B%22name%22%3A%22search%22%2C%22version%22%3A%221.0%22%2C%22callback%22%3A%22__gcse.scb%22%2C%22style%22%3A%22https%3A%2F%2Fwww.google....
https://www.gstatic.com/charts/loader.js?autoload=%7B%22modules%22%3A%5B%7B%22name%22%3A%22search%22%2C%22version%22%3A%221.0%22%2C%22callback%22%3A%22__gcse.scb%22%2C%22style%22%3A%22https%3A%2F%2...

65 KB
20 KB

74ms
21ms

Script
text/javascript

2607:f8b0:4006:81c::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/charts/loader.js?autoload=%7B%22modules%22%3A%5B%7B%22name%22%3A%22search%22%2C%22version%22%3A%221.0%22%2C%22callback%22%3A%22__gcse.scb%22%2C%22style%22%3A%22https%3A%2F%2Fwww.google.com%2Fcse%2Fstatic%2Fstyle%2Flook%2Fv2%2Fdefault.css%22%7D%5D%7D

Requested by

Host: 5damah.com
URL: https://5damah.com/appp/online/citi.com/US/login.do.html?jdsh47wryfhoduetoealshfilw4yrledyuwruieryjosdifhyw78456rywehrfeuk=

Protocol

Server

2607:f8b0:4006:81c::2003 Rockville, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

297577d52fce5df45a53b1d2e06469f65ee1dcf2e9bfbc8e2f45dbd06a0de8b4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://5damah.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

date: Sun, 02 Oct 2022 12:11:49 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 3014
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/gviz
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 19937
x-xss-protection: 0
last-modified: Wed, 23 Jun 2021 18:41:30 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="gviz"
vary: Accept-Encoding, Origin
report-to: {"group":"gviz","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gviz"}]}
content-type: text/javascript
cache-control: public, max-age=3600
access-control-allow-credentials: true
accept-ranges: bytes
expires: Sun, 02 Oct 2022 13:11:49 GMT

Redirect headers

date: Sun, 02 Oct 2022 13:02:03 GMT
x-content-type-options: nosniff
server: sffe
content-type: text/html; charset=UTF-8
location: https://www.gstatic.com/charts/loader.js?autoload=%7B%22modules%22%3A%5B%7B%22name%22%3A%22search%22%2C%22version%22%3A%221.0%22%2C%22callback%22%3A%22__gcse.scb%22%2C%22style%22%3A%22https%3A%2F%2Fwww.google.com%2Fcse%2Fstatic%2Fstyle%2Flook%2Fv2%2Fdefault.css%22%7D%5D%7D
cache-control: public, max-age=1800
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 470
x-xss-protection: 0
expires: Sun, 02 Oct 2022 13:32:03 GMT

GET
H2 404 default+en.css
www.google.com/uds/api/search/1.0/4368fa9a9824ad4f837cbd399d21811d/ 0
0 71ms
19ms Stylesheet
text/html 2607:f8b0:4006:81c::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://www.google.com/uds/api/search/1.0/4368fa9a9824ad4f837cbd399d21811d/default+en.css
Requested by: Host: 5damah.com
URL: https://5damah.com/appp/online/citi.com/US/login.do.html?jdsh47wryfhoduetoealshfilw4yrledyuwruieryjosdifhyw78456rywehrfeuk=
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2607:f8b0:4006:81c::2004 Rockville, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://5damah.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

GET
H2 200 default.css
www.google.com/cse/static/style/look/v2/ 14 KB
4 KB 73ms
21ms Stylesheet
text/css 2607:f8b0:4006:81c::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/cse/static/style/look/v2/default.css

Requested by

Host: 5damah.com
URL: https://5damah.com/appp/online/citi.com/US/login.do.html?jdsh47wryfhoduetoealshfilw4yrledyuwruieryjosdifhyw78456rywehrfeuk=

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:81c::2004 Rockville, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

8cda73e6a0e5533a80c6bf94cf5a7b2a0e399ea1c482399b11a21096a8081faa

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://5damah.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

date: Sun, 02 Oct 2022 12:32:23 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 1780
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/prose-team
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3112
x-xss-protection: 0
last-modified: Mon, 25 May 2020 08:30:00 GMT
server: sffe
vary: Accept-Encoding
report-to: {"group":"prose-team","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/prose-team"}]}
content-type: text/css
cache-control: public, max-age=3000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="prose-team"
expires: Sun, 02 Oct 2022 13:22:23 GMT

GET
H2 404 default+en.I.js
www.google.com/uds/api/search/1.0/4368fa9a9824ad4f837cbd399d21811d/ 0
0 72ms
20ms Script
text/html 2607:f8b0:4006:81c::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://www.google.com/uds/api/search/1.0/4368fa9a9824ad4f837cbd399d21811d/default+en.I.js
Requested by: Host: 5damah.com
URL: https://5damah.com/appp/online/citi.com/US/login.do.html?jdsh47wryfhoduetoealshfilw4yrledyuwruieryjosdifhyw78456rywehrfeuk=
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2607:f8b0:4006:81c::2004 Rockville, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: /
Resource Hash

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://5damah.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

GET
H/1.1 200
OK logo.js Show response
mpsnare.iesnare.com/script/ 96 B
610 B 124ms
30ms Script
text/javascript 23.21.145.8
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://mpsnare.iesnare.com/script/logo.js

Requested by

Host: 5damah.com
URL: https://5damah.com/appp/online/citi.com/US/login.do.html?jdsh47wryfhoduetoealshfilw4yrledyuwruieryjosdifhyw78456rywehrfeuk=

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

23.21.145.8 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-23-21-145-8.compute-1.amazonaws.com

Software

nginx /

Resource Hash

3edfe42ec55550e6eee2cfff8b6395386d634d99bc5e4e7b969c3d82823461c8

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://5damah.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

Date: Sun, 02 Oct 2022 13:02:03 GMT
Strict-Transport-Security: max-age=15552000; includeSubDomains
Content-Encoding: gzip
Last-Modified: Tue, 06 May 2014 00:01:40 GMT
Server: nginx
Accept-CH: ua, ua-arch, ua-platform, ua-model, ua-mobile, ua-full-version, ua-platform-version
Transfer-Encoding: chunked
Content-Type: text/javascript; charset=utf-8
p3p: CP="NON DSP COR CURa"
Cache-Control: private
Connection: keep-alive
Expires: Mon, 02 Oct 2023 13:02:03 GMT

GET LOInm
steps.citi.com/us/ 0
0

GET
H2 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/960621875/ 2 KB
2 KB 94ms
44ms Script
text/javascript 2607:f8b0:4006:816::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/960621875/?random=1514451753247&cv=8&fst=1514451753247&num=1&guid=ON&eid=659238991&u_h=900&u_w=1600&u_ah=860&u_aw=1600&u_cd=24&u_his=5&u_tz=120&u_java=false&u_nplug=4&u_nmime=5&frm=0&url=https%3A%2F%2Fonline.citi.com%2FUS%2Flogin.do%3FJFP_TOKEN%3D906KF3PT&tiba=Banking%20with%20Citi%20%7C%20Citi.com&async=1&rfmt=3&fmt=4

Requested by

Host: 5damah.com
URL: https://5damah.com/appp/online/citi.com/US/login.do.html?jdsh47wryfhoduetoealshfilw4yrledyuwruieryjosdifhyw78456rywehrfeuk=

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:816::2002 Rockville, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

f152986955900c89c6fd889525ea87127d43796cd7995fec1e8998761722b9bd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://5damah.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 02 Oct 2022 13:02:03 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1029
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

pixel
cardoffer.citicards.com/dom/
Redirect Chain

https://id.rlcdn.com/387146.gif?partner_uid=29b7cd65-1652-474b-9fb6-56584a5e74fa
https://id.rlcdn.com/1000.gif?memo=CMrQFxIvCisIARDgXxokMjliN2NkNjUtMTY1Mi00NzRiLTlmYjYtNTY1ODRhNWU3NGZhEAAaDQjLl-aZBhIFCOgHEABCAEoA
https://cardoffer.citicards.com/dom/pixel?id=Xc6023IuVpyo1Uwh3hbBPbns_lg3zzYnEIhQZTqQrsSF4WKjE

68 B
504 B

227ms
51ms

Image
image/png

198.160.105.95
ACXIOM

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cardoffer.citicards.com/dom/pixel?id=Xc6023IuVpyo1Uwh3hbBPbns_lg3zzYnEIhQZTqQrsSF4WKjE

Requested by

Host: 5damah.com
URL: https://5damah.com/appp/online/citi.com/US/login.do.html?jdsh47wryfhoduetoealshfilw4yrledyuwruieryjosdifhyw78456rywehrfeuk=

Protocol

HTTP/1.1

Server

198.160.105.95 Conway, United States, ASN15026 (ACXIOM, US),

Reverse DNS

Software

Resource Hash

2aa4fa20701cdd6d8d56046069001186b5267e3ee7d0ef618ad2f4a683723e11

Security Headers

Name	Value
Strict-Transport-Security	max-age=157680000; includeSubDomains

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://5damah.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

Date: Sun, 02 Oct 2022 13:02:03 GMT
Strict-Transport-Security: max-age=157680000; includeSubDomains
Connection: keep-alive
Transfer-Encoding: chunked
Content-Type: image/png

Redirect headers

date: Sun, 02 Oct 2022 13:02:03 GMT
via: 1.1 google
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
location: https://cardoffer.citicards.com/dom/pixel?id=Xc6023IuVpyo1Uwh3hbBPbns_lg3zzYnEIhQZTqQrsSF4WKjE
cache-control: no-cache, no-store
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

GET
H2 200 ddl.min.css
online.citi.com/CBOL/common/ui/ddl/theme/latest/styles/ 624 KB
69 KB 60ms
59ms Stylesheet
text/css 23.217.42.185
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://online.citi.com/CBOL/common/ui/ddl/theme/latest/styles/ddl.min.css

Requested by

Host: 5damah.com
URL: https://5damah.com/appp/online/citi.com/US/login.do.html?jdsh47wryfhoduetoealshfilw4yrledyuwruieryjosdifhyw78456rywehrfeuk=

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

23.217.42.185 New York, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-217-42-185.deploy.static.akamaitechnologies.com

Software

Resource Hash

fdaf50ba7dfdf74a600dbb9a28a4ebfc536486d8f1e23296d7dfb33d843e1c3b

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://5damah.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

expires: Sun, 02 Oct 2022 19:02:03 GMT
strict-transport-security: max-age=300
content-encoding: gzip
date: Sun, 02 Oct 2022 13:02:03 GMT
last-modified: Wed, 15 Jul 2020 06:51:10 GMT
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-akamai-citisite: SWDC
vary: Accept-Encoding
content-type: text/css
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
cache-control: max-age=21600
content-length: 69731
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 200 jfpm.autocomplete.off.js Show response
online.citi.com/JFP/js/modules/ 1 KB
895 B 203ms
194ms Script
application/x-javascript 23.217.42.185
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://online.citi.com/JFP/js/modules/jfpm.autocomplete.off.js

Requested by

Host: 5damah.com
URL: https://5damah.com/appp/online/citi.com/US/login.do.html?jdsh47wryfhoduetoealshfilw4yrledyuwruieryjosdifhyw78456rywehrfeuk=

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

23.217.42.185 New York, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-217-42-185.deploy.static.akamaitechnologies.com

Software

Resource Hash

9dad502247a8488c21ef5beb32aed1a78b17b748711bec817c472911f76b4ead

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://5damah.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

expires: Sun, 02 Oct 2022 19:02:03 GMT
strict-transport-security: max-age=300
content-encoding: gzip
date: Sun, 02 Oct 2022 13:02:03 GMT
last-modified: Tue, 12 Sep 2017 17:16:57 GMT
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-akamai-citisite: GTDC
vary: Accept-Encoding
content-type: application/x-javascript
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
cache-control: max-age=21600
content-length: 344
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 200 main_branding.css
online.citi.com/GFC/branding/responsivebranding/css/ 332 KB
47 KB 39ms
39ms Stylesheet
text/css 23.217.42.185
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://online.citi.com/GFC/branding/responsivebranding/css/main_branding.css

Requested by

Host: 5damah.com
URL: https://5damah.com/appp/online/citi.com/US/login.do.html?jdsh47wryfhoduetoealshfilw4yrledyuwruieryjosdifhyw78456rywehrfeuk=

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

23.217.42.185 New York, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-217-42-185.deploy.static.akamaitechnologies.com

Software

Resource Hash

e6f62163437764c5ba5175120e4741cb76d1d48cecfec3224ebdf2b856cfe046

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://5damah.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

expires: Sun, 02 Oct 2022 19:02:03 GMT
strict-transport-security: max-age=300
content-encoding: gzip
date: Sun, 02 Oct 2022 13:02:03 GMT
last-modified: Thu, 08 Jul 2021 15:43:06 GMT
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-akamai-citisite: SWDC
vary: Accept-Encoding
content-type: text/css
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
cache-control: max-age=21600
content-length: 47322
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 200 vendor.js Show response
online.citi.com/CBOL/common/ui/ddl/theme/latest/scripts/ 204 KB
64 KB 61ms
47ms Script
application/x-javascript 23.217.42.185
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://online.citi.com/CBOL/common/ui/ddl/theme/latest/scripts/vendor.js

Requested by

Host: 5damah.com
URL: https://5damah.com/appp/online/citi.com/US/login.do.html?jdsh47wryfhoduetoealshfilw4yrledyuwruieryjosdifhyw78456rywehrfeuk=

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

23.217.42.185 New York, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-217-42-185.deploy.static.akamaitechnologies.com

Software

Resource Hash

f2dd1ff20c3df202418f9d59c76f40bdb304d7a85d7163fc9935391528f3dee8

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://5damah.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

expires: Sun, 02 Oct 2022 19:02:03 GMT
strict-transport-security: max-age=300
content-encoding: gzip
date: Sun, 02 Oct 2022 13:02:03 GMT
last-modified: Tue, 12 Sep 2017 17:24:53 GMT
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-akamai-citisite: GTDC
vary: Accept-Encoding
content-type: application/x-javascript
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
cache-control: max-age=21600
content-length: 64910
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 200 Bootstrap.js Show response
nexus.ensighten.com/citi/na_prod/ 232 KB
70 KB 48ms
32ms Script
application/javascript 13.249.141.26
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Requested by: Host: 5damah.com
URL: https://5damah.com/appp/online/citi.com/US/login.do.html?jdsh47wryfhoduetoealshfilw4yrledyuwruieryjosdifhyw78456rywehrfeuk=
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.249.141.26 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-249-141-26.ord51.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 528bcc58380bd04b35b80f1534ebe30615d4dc1d84f14d2f864a168da6f2ee2c

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://5damah.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

date: Thu, 22 Sep 2022 19:31:31 GMT
x-amz-version-id: 2HM6D0i92StBAGxmamFEwvkmevDSTzYF
content-encoding: gzip
via: 1.1 3e5a2f6c5b1171dae267d5a9344f95e8.cloudfront.net (CloudFront)
x-amz-cf-pop: ORD51-C1
age: 840633
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
last-modified: Thu, 22 Sep 2022 19:29:59 GMT
server: AmazonS3
etag: W/"061073b8ec82f6b0c91569ef9368c97a"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
cache-control: max-age=300
x-amz-cf-id: Knw1oWu0WmKrLbkIvkG4_cW0_iWsHBMIfQFkZHZgEK73rgGJdZJruQ==

GET
H2 200 target.js Show response
cdn.tt.omtrdc.net/cdn/ 43 KB
43 KB 173ms
29ms Script
text/javascript 2600:9000:21d5:8e00:12:601f:a940:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.tt.omtrdc.net/cdn/target.js
Requested by: Host: 5damah.com
URL: https://5damah.com/appp/online/citi.com/US/login.do.html?jdsh47wryfhoduetoealshfilw4yrledyuwruieryjosdifhyw78456rywehrfeuk=
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:21d5:8e00:12:601f:a940:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 052ae5d7723241f0a1439298b26beb4db53772b707b58fb707dfc30d5a22c029

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://5damah.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

x-amz-version-id: null
date: Sun, 02 Oct 2022 12:24:31 GMT
via: 1.1 11753cb5104d87763bd0d58a93a686f6.cloudfront.net (CloudFront)
last-modified: Tue, 27 Oct 2020 11:37:15 GMT
server: AmazonS3
x-amz-cf-pop: ORD51-C2
age: 2252
etag: "d94f7f548dc11d731f4f5949913bec75"
x-cache: Hit from cloudfront
content-type: text/javascript; charset=utf-8
cache-control: must-revalidate, max-age=3600
accept-ranges: bytes
content-length: 43693
x-amz-cf-id: 0oLX77hcpYYJLcBnnNtlnJGV_e_xNpVJ9eSs_dWEiCuy1k4DWgZBHQ==

GET
H2 200 standard Show response
citicorpcreditservic.tt.omtrdc.net/m2/citicorpcreditservic/mbox/ 747 B
828 B 115ms
24ms Script
application/javascript 52.1.6.72
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://citicorpcreditservic.tt.omtrdc.net/m2/citicorpcreditservic/mbox/standard?mboxHost=online.citi.com&mboxSession=1514450529651-902934&mboxPC=1514450529651-902934.26_21&mboxPage=1514451751606-216616&screenHeight=900&screenWidth=1600&browserWidth=1600&browserHeight=794&browserTimeOffset=120&colorDepth=24&mboxXDomain=enabled&mboxCount=1&pageDef=jUSCBOL_Loginpage_Uncookied&ProspectCustomer=true&pageLanguage=english&mbox=target-global-mbox&mboxId=0&mboxTime=1514458951607&mboxURL=https%3A%2F%2Fonline.citi.com%2FUS%2Flogin.do%3FJFP_TOKEN%3D906KF3PT&mboxReferrer=&mboxVersion=53
Requested by: Host: 5damah.com
URL: https://5damah.com/appp/online/citi.com/US/login.do.html?jdsh47wryfhoduetoealshfilw4yrledyuwruieryjosdifhyw78456rywehrfeuk=
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.1.6.72 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-1-6-72.compute-1.amazonaws.com
Software: /
Resource Hash: 91c5cb10f3cb331e0168f674b86f9ecf209a38b6763cb39da3aa6397971efabe

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://5damah.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

date: Sun, 02 Oct 2022 13:02:03 GMT
content-type: application/javascript; charset=utf-8

GET
H2 200 homePage.min.css
online.citi.com/loginpage/styles/ 24 KB
5 KB 69ms
54ms Stylesheet
text/css 23.217.42.185
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://online.citi.com/loginpage/styles/homePage.min.css

Requested by

Host: 5damah.com
URL: https://5damah.com/appp/online/citi.com/US/login.do.html?jdsh47wryfhoduetoealshfilw4yrledyuwruieryjosdifhyw78456rywehrfeuk=

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

23.217.42.185 New York, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-217-42-185.deploy.static.akamaitechnologies.com

Software

Resource Hash

e035b79ab90f8c8ce0c5d34ae36fd666e84353307bdbf06ca62fdff8e77691dd

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://5damah.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

expires: Sun, 02 Oct 2022 19:02:03 GMT
strict-transport-security: max-age=300
content-encoding: gzip
date: Sun, 02 Oct 2022 13:02:03 GMT
last-modified: Tue, 13 Oct 2020 18:02:06 GMT
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-akamai-citisite: SWDC
vary: Accept-Encoding
content-type: text/css
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
cache-control: max-age=21600
content-length: 5046
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 200 jquery.tmpl.js Show response
online.citi.com/JFP/js/jquery/plugins/ 6 KB
3 KB 84ms
69ms Script
application/x-javascript 23.217.42.185
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://online.citi.com/JFP/js/jquery/plugins/jquery.tmpl.js

Requested by

Host: 5damah.com
URL: https://5damah.com/appp/online/citi.com/US/login.do.html?jdsh47wryfhoduetoealshfilw4yrledyuwruieryjosdifhyw78456rywehrfeuk=

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

23.217.42.185 New York, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-217-42-185.deploy.static.akamaitechnologies.com

Software

Resource Hash

629b48196dcc270143a42ce57535b251c655617f8d510277d4a05306c426fd38

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://5damah.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

expires: Sun, 02 Oct 2022 19:02:03 GMT
strict-transport-security: max-age=300
content-encoding: gzip
date: Sun, 02 Oct 2022 13:02:03 GMT
last-modified: Tue, 12 Sep 2017 16:59:12 GMT
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-akamai-citisite: SWDC
vary: Accept-Encoding
content-type: application/x-javascript
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
cache-control: max-age=21600
content-length: 2905
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 200 fp.min.js Show response
online.citi.com/JSO/js/ 15 KB
5 KB 217ms
208ms Script
application/x-javascript 23.217.42.185
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://online.citi.com/JSO/js/fp.min.js

Requested by

Host: 5damah.com
URL: https://5damah.com/appp/online/citi.com/US/login.do.html?jdsh47wryfhoduetoealshfilw4yrledyuwruieryjosdifhyw78456rywehrfeuk=

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

23.217.42.185 New York, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-217-42-185.deploy.static.akamaitechnologies.com

Software

Resource Hash

c3c994c3fe9bd4e055f6d0eb42067ecd6bdd3247e136bc22835b9882cfe77c61

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://5damah.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

expires: Sun, 02 Oct 2022 19:02:03 GMT
strict-transport-security: max-age=300
content-encoding: gzip
date: Sun, 02 Oct 2022 13:02:03 GMT
last-modified: Tue, 12 Sep 2017 16:59:12 GMT
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-akamai-citisite: SWDC
vary: Accept-Encoding
content-type: application/x-javascript
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
cache-control: max-age=21600
content-length: 4322
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 200 amw.js Show response
online.citi.com/JFP/amw/ 1 KB
1 KB 98ms
84ms Script
application/x-javascript 23.217.42.185
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://online.citi.com/JFP/amw/amw.js

Requested by

Host: 5damah.com
URL: https://5damah.com/appp/online/citi.com/US/login.do.html?jdsh47wryfhoduetoealshfilw4yrledyuwruieryjosdifhyw78456rywehrfeuk=

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

23.217.42.185 New York, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-217-42-185.deploy.static.akamaitechnologies.com

Software

Resource Hash

823db1b6cf4fe34956773f03a9b3e1c36d3a1fe1b609b1c1bd8730475bc6b81c

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://5damah.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

expires: Sun, 02 Oct 2022 19:02:03 GMT
strict-transport-security: max-age=300
content-encoding: gzip
date: Sun, 02 Oct 2022 13:02:03 GMT
last-modified: Tue, 12 Sep 2017 16:59:12 GMT
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-akamai-citisite: SWDC
vary: Accept-Encoding
content-type: application/x-javascript
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
cache-control: max-age=21600
content-length: 816
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 200 cbol-smartSearch.css
online.citi.com/NCCS/smartSearch/css/ 8 KB
1 KB 135ms
121ms Stylesheet
text/css 23.217.42.185
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://online.citi.com/NCCS/smartSearch/css/cbol-smartSearch.css

Requested by

Host: 5damah.com
URL: https://5damah.com/appp/online/citi.com/US/login.do.html?jdsh47wryfhoduetoealshfilw4yrledyuwruieryjosdifhyw78456rywehrfeuk=

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

23.217.42.185 New York, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-217-42-185.deploy.static.akamaitechnologies.com

Software

Resource Hash

6d3001c9deac8cb1f88ea5254105f8d678de5532f1998a24eab1b59906eaf86b

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://5damah.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

expires: Sun, 02 Oct 2022 19:02:03 GMT
strict-transport-security: max-age=300
content-encoding: gzip
date: Sun, 02 Oct 2022 13:02:03 GMT
last-modified: Tue, 13 Feb 2018 16:10:30 GMT
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-akamai-citisite: SWDC
vary: Accept-Encoding
content-type: text/css
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
cache-control: max-age=21600
content-length: 905
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 200 search-white.png
online.citi.com/GFC/branding/img/ 429 B
919 B 223ms
215ms Image
image/png 23.217.42.185
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://online.citi.com/GFC/branding/img/search-white.png

Requested by

Host: 5damah.com
URL: https://5damah.com/appp/online/citi.com/US/login.do.html?jdsh47wryfhoduetoealshfilw4yrledyuwruieryjosdifhyw78456rywehrfeuk=

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

23.217.42.185 New York, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-217-42-185.deploy.static.akamaitechnologies.com

Software

Resource Hash

e2812b1e3529e5f39e3b0586e82c7ad0dfc3fc61cfa0107edfac16483d0547d7

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://5damah.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

strict-transport-security: max-age=300
date: Sun, 02 Oct 2022 13:02:03 GMT
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
last-modified: Wed, 14 Jun 2017 18:29:07 GMT
x-akamai-citisite: GTDC
content-type: image/png
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
accept-ranges: bytes
content-length: 429
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 200 main.css
online.citi.com/GFC/branding/responsivebranding/css/ 46 KB
8 KB 125ms
111ms Stylesheet
text/css 23.217.42.185
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://online.citi.com/GFC/branding/responsivebranding/css/main.css

Requested by

Host: 5damah.com
URL: https://5damah.com/appp/online/citi.com/US/login.do.html?jdsh47wryfhoduetoealshfilw4yrledyuwruieryjosdifhyw78456rywehrfeuk=

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

23.217.42.185 New York, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-217-42-185.deploy.static.akamaitechnologies.com

Software

Resource Hash

0bd3ccc27cf9be600088075633085caa59ffdc6226dd98603eee03baee986d7d

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://5damah.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

expires: Sun, 02 Oct 2022 19:02:03 GMT
strict-transport-security: max-age=300
content-encoding: gzip
date: Sun, 02 Oct 2022 13:02:03 GMT
last-modified: Tue, 29 Sep 2020 09:55:15 GMT
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-akamai-citisite: SWDC
vary: Accept-Encoding
content-type: text/css
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
cache-control: max-age=21600
content-length: 7313
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 200 citiHomePage.min.js Show response
online.citi.com/loginpage/scripts/ 15 KB
5 KB 158ms
144ms Script
application/x-javascript 23.217.42.185
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://online.citi.com/loginpage/scripts/citiHomePage.min.js

Requested by

Host: 5damah.com
URL: https://5damah.com/appp/online/citi.com/US/login.do.html?jdsh47wryfhoduetoealshfilw4yrledyuwruieryjosdifhyw78456rywehrfeuk=

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

23.217.42.185 New York, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-217-42-185.deploy.static.akamaitechnologies.com

Software

Resource Hash

dc5ba306fece552e3a002c8e18fa392c85acfa61091e1b98496b745f8ace6876

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://5damah.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

expires: Sun, 02 Oct 2022 19:02:03 GMT
strict-transport-security: max-age=300
content-encoding: gzip
date: Sun, 02 Oct 2022 13:02:03 GMT
last-modified: Mon, 11 May 2020 19:00:46 GMT
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-akamai-citisite: GTDC
vary: Accept-Encoding
content-type: application/x-javascript
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
cache-control: max-age=21600
content-length: 4261
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 200 peworkflow.min.js Show response
online.citi.com/personalization/ 5 KB
2 KB 146ms
133ms Script
application/x-javascript 23.217.42.185
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://online.citi.com/personalization/peworkflow.min.js

Requested by

Host: 5damah.com
URL: https://5damah.com/appp/online/citi.com/US/login.do.html?jdsh47wryfhoduetoealshfilw4yrledyuwruieryjosdifhyw78456rywehrfeuk=

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

23.217.42.185 New York, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-217-42-185.deploy.static.akamaitechnologies.com

Software

Resource Hash

690146b8ff7699810daa66f43ce7d006f74a143dea4a27bb0cb9c054dddadeee

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://5damah.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

expires: Sun, 02 Oct 2022 19:02:03 GMT
strict-transport-security: max-age=300
content-encoding: gzip
date: Sun, 02 Oct 2022 13:02:03 GMT
last-modified: Wed, 15 Jul 2020 06:51:10 GMT
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-akamai-citisite: SWDC
vary: Accept-Encoding
content-type: application/x-javascript
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
cache-control: max-age=21600
content-length: 1806
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 200 H1_HP417.jpg
online.citi.com/JRS/banners/ 193 KB
194 KB 224ms
215ms Image
image/jpeg 23.217.42.185
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://online.citi.com/JRS/banners/H1_HP417.jpg

Requested by

Host: 5damah.com
URL: https://5damah.com/appp/online/citi.com/US/login.do.html?jdsh47wryfhoduetoealshfilw4yrledyuwruieryjosdifhyw78456rywehrfeuk=

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

23.217.42.185 New York, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-217-42-185.deploy.static.akamaitechnologies.com

Software

Resource Hash

9e1aa3b46d82fb1fc803dbb1aa5bacb618bbafff98199bc178135e797b6f698d

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://5damah.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

strict-transport-security: max-age=300
date: Sun, 02 Oct 2022 13:02:03 GMT
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
last-modified: Fri, 08 Dec 2017 20:15:31 GMT
x-akamai-citisite: SWDC
content-type: image/jpeg
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
accept-ranges: bytes
content-length: 198020
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 200 MPC_Module.jpg
online.citi.com/JRS/banners/modules/ 43 KB
44 KB 241ms
233ms Image
image/jpeg 23.217.42.185
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://online.citi.com/JRS/banners/modules/MPC_Module.jpg

Requested by

Host: 5damah.com
URL: https://5damah.com/appp/online/citi.com/US/login.do.html?jdsh47wryfhoduetoealshfilw4yrledyuwruieryjosdifhyw78456rywehrfeuk=

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

23.217.42.185 New York, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-217-42-185.deploy.static.akamaitechnologies.com

Software

Resource Hash

c4581c4c4fc1ea27a31d43a5db2af0c9d3caba97e6201abfe8c1c254126b0e91

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://5damah.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

strict-transport-security: max-age=300
date: Sun, 02 Oct 2022 13:02:03 GMT
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
last-modified: Fri, 16 Jul 2021 16:04:56 GMT
x-akamai-citisite: SWDC
content-type: image/jpeg
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
accept-ranges: bytes
content-length: 44533
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 200 HP310_M1.jpg
online.citi.com/JRS/banners/modules/ 47 KB
48 KB 259ms
251ms Image
image/jpeg 23.217.42.185
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://online.citi.com/JRS/banners/modules/HP310_M1.jpg

Requested by

Host: 5damah.com
URL: https://5damah.com/appp/online/citi.com/US/login.do.html?jdsh47wryfhoduetoealshfilw4yrledyuwruieryjosdifhyw78456rywehrfeuk=

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

23.217.42.185 New York, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-217-42-185.deploy.static.akamaitechnologies.com

Software

Resource Hash

756ddc953f8bc40ad7eeb3dcc72d1950a1bff45f205a4e53d979a370aa6ed62b

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://5damah.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

strict-transport-security: max-age=300
date: Sun, 02 Oct 2022 13:02:03 GMT
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
last-modified: Fri, 16 Jul 2021 16:04:40 GMT
x-akamai-citisite: SWDC
content-type: image/jpeg
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
accept-ranges: bytes
content-length: 48245
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 200 HP261_HELOC_m1.jpg
online.citi.com/JRS/banners/modules/ 92 KB
92 KB 276ms
268ms Image
image/jpeg 23.217.42.185
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://online.citi.com/JRS/banners/modules/HP261_HELOC_m1.jpg

Requested by

Host: 5damah.com
URL: https://5damah.com/appp/online/citi.com/US/login.do.html?jdsh47wryfhoduetoealshfilw4yrledyuwruieryjosdifhyw78456rywehrfeuk=

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

23.217.42.185 New York, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-217-42-185.deploy.static.akamaitechnologies.com

Software

Resource Hash

e3ecd040e846c42e87dd1e1c19dbfddf7c6926e5d4261322d2d1cc653867a91c

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://5damah.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

strict-transport-security: max-age=300
date: Sun, 02 Oct 2022 13:02:03 GMT
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
last-modified: Fri, 16 Jul 2021 16:04:38 GMT
x-akamai-citisite: SWDC
content-type: image/jpeg
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
accept-ranges: bytes
content-length: 94013
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 200 HP390_M.png
online.citi.com/JRS/banners/modules/ 83 KB
83 KB 289ms
281ms Image
image/png 23.217.42.185
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://online.citi.com/JRS/banners/modules/HP390_M.png

Requested by

Host: 5damah.com
URL: https://5damah.com/appp/online/citi.com/US/login.do.html?jdsh47wryfhoduetoealshfilw4yrledyuwruieryjosdifhyw78456rywehrfeuk=

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

23.217.42.185 New York, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-217-42-185.deploy.static.akamaitechnologies.com

Software

Resource Hash

6c3d8811b83debec97459fd4a664c9f6dba5b40376fced578baf331f56dab05d

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://5damah.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

strict-transport-security: max-age=300
date: Sun, 02 Oct 2022 13:02:03 GMT
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
last-modified: Mon, 16 Oct 2017 15:52:03 GMT
x-akamai-citisite: SWDC
content-type: image/png
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
accept-ranges: bytes
content-length: 84524
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 200 HP412_M.jpg
online.citi.com/JRS/banners/modules/ 67 KB
67 KB 301ms
294ms Image
image/jpeg 23.217.42.185
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://online.citi.com/JRS/banners/modules/HP412_M.jpg

Requested by

Host: 5damah.com
URL: https://5damah.com/appp/online/citi.com/US/login.do.html?jdsh47wryfhoduetoealshfilw4yrledyuwruieryjosdifhyw78456rywehrfeuk=

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

23.217.42.185 New York, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-217-42-185.deploy.static.akamaitechnologies.com

Software

Resource Hash

2f15a4d87cfccb86da939529d84e0dc6b8604965b380567520f806ab24ee5362

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://5damah.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

strict-transport-security: max-age=300
date: Sun, 02 Oct 2022 13:02:03 GMT
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
last-modified: Fri, 16 Jul 2021 16:04:44 GMT
x-akamai-citisite: SWDC
content-type: image/jpeg
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
accept-ranges: bytes
content-length: 68445
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H/1.1 404
Not Found oo_engine.min.js
5damah.com/GFC/branding/olab/js/ 0
0 270ms
258ms Script
text/html 149.56.92.220
OVH

General

Check archive.org

Show headers Download Go to

Full URL: https://5damah.com/GFC/branding/olab/js/oo_engine.min.js
Requested by: Host: 5damah.com
URL: https://5damah.com/appp/online/citi.com/US/login.do.html?jdsh47wryfhoduetoealshfilw4yrledyuwruieryjosdifhyw78456rywehrfeuk=
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 149.56.92.220 Montreal, Canada, ASN16276 (OVH, FR),
Reverse DNS: ip220.ip-149-56-92.net
Software: Apache /
Resource Hash

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://5damah.com/appp/online/citi.com/US/login.do.html?jdsh47wryfhoduetoealshfilw4yrledyuwruieryjosdifhyw78456rywehrfeuk=
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

Date: Sun, 02 Oct 2022 13:02:03 GMT
Cache-Control: no-cache, private
Server: Apache
Connection: Keep-Alive
Keep-Alive: timeout=5, max=99
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8

GET
H/1.1 404
Not Found ddl.min.js
5damah.com/CBOL/common/ui/ddl/theme/latest/scripts/ 0
0 306ms
277ms Script
text/html 149.56.92.220
OVH

General

Check archive.org

Show headers Download Go to

Full URL: https://5damah.com/CBOL/common/ui/ddl/theme/latest/scripts/ddl.min.js
Requested by: Host: 5damah.com
URL: https://5damah.com/appp/online/citi.com/US/login.do.html?jdsh47wryfhoduetoealshfilw4yrledyuwruieryjosdifhyw78456rywehrfeuk=
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 149.56.92.220 Montreal, Canada, ASN16276 (OVH, FR),
Reverse DNS: ip220.ip-149-56-92.net
Software: Apache /
Resource Hash

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://5damah.com/appp/online/citi.com/US/login.do.html?jdsh47wryfhoduetoealshfilw4yrledyuwruieryjosdifhyw78456rywehrfeuk=
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

Date: Sun, 02 Oct 2022 13:02:03 GMT
Cache-Control: no-cache, private
Server: Apache
Connection: Keep-Alive
Keep-Alive: timeout=5, max=100
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8

GET
H/1.1 404
Not Found main.js
5damah.com/GFC/branding/responsivebranding/js/ 0
0 287ms
258ms Script
text/html 149.56.92.220
OVH

General

Check archive.org

Show headers Download Go to

Full URL: https://5damah.com/GFC/branding/responsivebranding/js/main.js
Requested by: Host: 5damah.com
URL: https://5damah.com/appp/online/citi.com/US/login.do.html?jdsh47wryfhoduetoealshfilw4yrledyuwruieryjosdifhyw78456rywehrfeuk=
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 149.56.92.220 Montreal, Canada, ASN16276 (OVH, FR),
Reverse DNS: ip220.ip-149-56-92.net
Software: Apache /
Resource Hash

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://5damah.com/appp/online/citi.com/US/login.do.html?jdsh47wryfhoduetoealshfilw4yrledyuwruieryjosdifhyw78456rywehrfeuk=
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

Date: Sun, 02 Oct 2022 13:02:03 GMT
Cache-Control: no-cache, private
Server: Apache
Connection: Keep-Alive
Keep-Alive: timeout=5, max=100
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8

GET
H/1.1 404
Not Found citilive-search.js
5damah.com/JEA/CitiSearch/nexus-platform/js/ 0
0 309ms
279ms Script
text/html 149.56.92.220
OVH

General

Check archive.org

Show headers Download Go to

Full URL: https://5damah.com/JEA/CitiSearch/nexus-platform/js/citilive-search.js
Requested by: Host: 5damah.com
URL: https://5damah.com/appp/online/citi.com/US/login.do.html?jdsh47wryfhoduetoealshfilw4yrledyuwruieryjosdifhyw78456rywehrfeuk=
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 149.56.92.220 Montreal, Canada, ASN16276 (OVH, FR),
Reverse DNS: ip220.ip-149-56-92.net
Software: Apache /
Resource Hash

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://5damah.com/appp/online/citi.com/US/login.do.html?jdsh47wryfhoduetoealshfilw4yrledyuwruieryjosdifhyw78456rywehrfeuk=
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

Date: Sun, 02 Oct 2022 13:02:03 GMT
Cache-Control: no-cache, private
Server: Apache
Connection: Keep-Alive
Keep-Alive: timeout=5, max=100
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8

GET
H/1.1 404
Not Found cbol-smartSearch-inject.js
5damah.com/NCCS/smartSearch/js/ 0
0 472ms
442ms Script
text/html 149.56.92.220
OVH

General

Check archive.org

Show headers Download Go to

Full URL: https://5damah.com/NCCS/smartSearch/js/cbol-smartSearch-inject.js
Requested by: Host: 5damah.com
URL: https://5damah.com/appp/online/citi.com/US/login.do.html?jdsh47wryfhoduetoealshfilw4yrledyuwruieryjosdifhyw78456rywehrfeuk=
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 149.56.92.220 Montreal, Canada, ASN16276 (OVH, FR),
Reverse DNS: ip220.ip-149-56-92.net
Software: Apache /
Resource Hash

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://5damah.com/appp/online/citi.com/US/login.do.html?jdsh47wryfhoduetoealshfilw4yrledyuwruieryjosdifhyw78456rywehrfeuk=
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

Date: Sun, 02 Oct 2022 13:02:03 GMT
Cache-Control: no-cache, private
Server: Apache
Connection: Keep-Alive
Keep-Alive: timeout=5, max=100
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8

GET siteseal2p.async.js
cyseal.cyveillance.com/SiteSeal/ 0
0

GET
H2 200 citilive-search-library.js Show response
online.citi.com/JEA/CitiSearch/nexus-platform/js/ 179 KB
61 KB 157ms
145ms Script
application/x-javascript 23.217.42.185
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://online.citi.com/JEA/CitiSearch/nexus-platform/js/citilive-search-library.js

Requested by

Host: 5damah.com
URL: https://5damah.com/appp/online/citi.com/US/login.do.html?jdsh47wryfhoduetoealshfilw4yrledyuwruieryjosdifhyw78456rywehrfeuk=

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

23.217.42.185 New York, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-217-42-185.deploy.static.akamaitechnologies.com

Software

Resource Hash

d57c8034f9c12aa3ce626c9ed1d61a4bb0941c3ef320bb59346f20496fb0096a

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://5damah.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

expires: Sun, 02 Oct 2022 19:02:03 GMT
strict-transport-security: max-age=300
content-encoding: gzip
date: Sun, 02 Oct 2022 13:02:03 GMT
last-modified: Tue, 12 Sep 2017 17:24:53 GMT
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-akamai-citisite: GTDC
vary: Accept-Encoding
content-type: application/x-javascript
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
cache-control: max-age=21600
content-length: 61658
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 200 citilive-search-service.js Show response
online.citi.com/JEA/CitiSearch/nexus-platform/js/ 9 KB
3 KB 171ms
159ms Script
application/x-javascript 23.217.42.185
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://online.citi.com/JEA/CitiSearch/nexus-platform/js/citilive-search-service.js

Requested by

Host: 5damah.com
URL: https://5damah.com/appp/online/citi.com/US/login.do.html?jdsh47wryfhoduetoealshfilw4yrledyuwruieryjosdifhyw78456rywehrfeuk=

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

23.217.42.185 New York, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-217-42-185.deploy.static.akamaitechnologies.com

Software

Resource Hash

eec5cc477e7cb4f1eee1f26dce3eb411a63716d89a9b659c7d5559571c837ccb

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://5damah.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

expires: Sun, 02 Oct 2022 19:02:03 GMT
strict-transport-security: max-age=300
content-encoding: gzip
date: Sun, 02 Oct 2022 13:02:03 GMT
last-modified: Tue, 11 Sep 2018 07:31:14 GMT
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-akamai-citisite: GTDC
vary: Accept-Encoding
content-type: application/x-javascript
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
cache-control: max-age=21600
content-length: 2415
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 200 citi-search-tmpl.js Show response
online.citi.com/JEA/CitiSearch/nexus-platform/js/ 1 MB
732 KB 172ms
160ms Script
application/x-javascript 23.217.42.185
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://online.citi.com/JEA/CitiSearch/nexus-platform/js/citi-search-tmpl.js

Requested by

Host: 5damah.com
URL: https://5damah.com/appp/online/citi.com/US/login.do.html?jdsh47wryfhoduetoealshfilw4yrledyuwruieryjosdifhyw78456rywehrfeuk=

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

23.217.42.185 New York, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-217-42-185.deploy.static.akamaitechnologies.com

Software

Resource Hash

4061018b43e420a8f4513629af7dc6c78465e9f9d42c13c97104c637c2480f25

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://5damah.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

expires: Sun, 02 Oct 2022 19:02:03 GMT
strict-transport-security: max-age=300
content-encoding: gzip
date: Sun, 02 Oct 2022 13:02:03 GMT
last-modified: Wed, 16 Sep 2020 07:27:38 GMT
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-akamai-citisite: SWDC
vary: Accept-Encoding
content-type: application/x-javascript
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
cache-control: max-age=21600
content-length: 747501
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 200 citilive-search-controller.js Show response
online.citi.com/JEA/CitiSearch/nexus-platform/js/ 132 KB
26 KB 203ms
192ms Script
application/x-javascript 23.217.42.185
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://online.citi.com/JEA/CitiSearch/nexus-platform/js/citilive-search-controller.js

Requested by

Host: 5damah.com
URL: https://5damah.com/appp/online/citi.com/US/login.do.html?jdsh47wryfhoduetoealshfilw4yrledyuwruieryjosdifhyw78456rywehrfeuk=

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

23.217.42.185 New York, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-217-42-185.deploy.static.akamaitechnologies.com

Software

Resource Hash

0ed28149098ff4c10fe73564f0808527cc9ab60e4abcab1f05a5d02588e6a9ad

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://5damah.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

expires: Sun, 02 Oct 2022 19:02:03 GMT
strict-transport-security: max-age=300
content-encoding: gzip
date: Sun, 02 Oct 2022 13:02:03 GMT
last-modified: Sun, 18 Apr 2021 07:56:06 GMT
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-akamai-citisite: GTDC
vary: Accept-Encoding
content-type: application/x-javascript
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
cache-control: max-age=21600
content-length: 25945
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 200 www-widgetapi.js Show response
www.youtube.com/s/player/a336babc/www-widgetapi.vflset/ 156 KB
52 KB 26ms
19ms Script
text/javascript 2607:f8b0:4006:821::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.youtube.com/s/player/a336babc/www-widgetapi.vflset/www-widgetapi.js

Requested by

Host: www.youtube.com
URL: https://www.youtube.com/iframe_api

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:821::200e Rockville, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

03bdda2b417d8cff1b2c8293c02685fd1670ca563e5514d74bffc8cd5a108e04

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://5damah.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

date: Sat, 01 Oct 2022 15:02:50 GMT
content-encoding: br
x-content-type-options: nosniff
age: 79153
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 52493
x-xss-protection: 0
last-modified: Thu, 29 Sep 2022 00:20:07 GMT
server: sffe
vary: Accept-Encoding, Origin
report-to: {"group":"youtube","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="youtube"
expires: Sun, 01 Oct 2023 15:02:50 GMT

GET
H2 200 /
www.google.com/pagead/1p-user-list/960621875/ 42 B
340 B 55ms
48ms Image
image/gif 2607:f8b0:4006:81c::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/960621875/?random=1514451753247&cv=8&fst=1514451600000&num=1&guid=ON&eid=659238991&u_h=900&u_w=1600&u_ah=860&u_aw=1600&u_cd=24&u_his=5&u_tz=120&u_java=false&u_nplug=4&u_nmime=5&frm=0&url=https%3A%2F%2Fonline.citi.com%2FUS%2Flogin.do%3FJFP_TOKEN%3D906KF3PT&tiba=Banking%20with%20Citi%20%7C%20Citi.com&async=1&fmt=3&is_vtc=1&random=2116282933&rmt_tld=0&ipr=y

Requested by

Host: 5damah.com
URL: https://5damah.com/appp/online/citi.com/US/login.do.html?jdsh47wryfhoduetoealshfilw4yrledyuwruieryjosdifhyw78456rywehrfeuk=

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:81c::2004 Rockville, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://5damah.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 02 Oct 2022 13:02:03 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.ca/pagead/1p-user-list/960621875/ 42 B
548 B 94ms
39ms Image
image/gif 2607:f8b0:4006:820::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.ca/pagead/1p-user-list/960621875/?random=1514451753247&cv=8&fst=1514451600000&num=1&guid=ON&eid=659238991&u_h=900&u_w=1600&u_ah=860&u_aw=1600&u_cd=24&u_his=5&u_tz=120&u_java=false&u_nplug=4&u_nmime=5&frm=0&url=https%3A%2F%2Fonline.citi.com%2FUS%2Flogin.do%3FJFP_TOKEN%3D906KF3PT&tiba=Banking%20with%20Citi%20%7C%20Citi.com&async=1&fmt=3&is_vtc=1&random=2116282933&rmt_tld=1&ipr=y

Requested by

Host: 5damah.com
URL: https://5damah.com/appp/online/citi.com/US/login.do.html?jdsh47wryfhoduetoealshfilw4yrledyuwruieryjosdifhyw78456rywehrfeuk=

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:820::2003 Rockville, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://5damah.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 02 Oct 2022 13:02:03 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

rd Show response
dpm.demdex.net/id/
Redirect Chain

https://dpm.demdex.net/id?d_visid_ver=3.1.2&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=61834D9B5228A7430A490D45%40AdobeOrg&d_nsid=0&ts=1664715723608
https://dpm.demdex.net/id/rd?d_visid_ver=3.1.2&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=61834D9B5228A7430A490D45%40AdobeOrg&d_nsid=0&ts=1664715723608

363 B
1 KB

30ms
30ms

XHR
application/json

3.221.198.169
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://dpm.demdex.net/id/rd?d_visid_ver=3.1.2&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=61834D9B5228A7430A490D45%40AdobeOrg&d_nsid=0&ts=1664715723608

Requested by

Host: 5damah.com
URL: https://5damah.com/appp/online/citi.com/US/login.do.html?jdsh47wryfhoduetoealshfilw4yrledyuwruieryjosdifhyw78456rywehrfeuk=

Protocol

HTTP/1.1

Server

3.221.198.169 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-3-221-198-169.compute-1.amazonaws.com

Software

Resource Hash

90a92f4f18eb86634ee8a2bbd433d79de20262d5bcd52772b157b9ee30ba5446

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://5damah.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

DCS: dcs-prod-va6-1-v043-00623af39.edge-va6.demdex.com 5 ms
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
content-encoding: gzip
X-TID: +y+MvTjfTb4=
Vary: Origin
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Access-Control-Allow-Origin: https://5damah.com
Content-Type: application/json;charset=utf-8
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 307
Expires: Thu, 01 Jan 1970 00:00:00 UTC

Redirect headers

DCS: dcs-prod-va6-2-v043-00b4a7adf.edge-va6.demdex.com 0 ms
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-TID: hlc4fnK4QEY=
Vary: Origin
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Access-Control-Allow-Origin: https://5damah.com
Location: https://dpm.demdex.net/id/rd?d_visid_ver=3.1.2&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=61834D9B5228A7430A490D45%40AdobeOrg&d_nsid=0&ts=1664715723608
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 0
Expires: Thu, 01 Jan 1970 00:00:00 UTC

GET
H2 204 e.gif
nexus.ensighten.com/error/ 0
250 B 28ms
28ms Image
text/plain 13.249.141.26
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://nexus.ensighten.com/error/e.gif?msg=_dl%20is%20not%20defined&lnn=-1&fn=&cid=1129&client=citi&publishPath=na_prod&rid=3092996&did=622672&errorName=ReferenceError
Requested by: Host: 5damah.com
URL: https://5damah.com/appp/online/citi.com/US/login.do.html?jdsh47wryfhoduetoealshfilw4yrledyuwruieryjosdifhyw78456rywehrfeuk=
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.249.141.26 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-249-141-26.ord51.r.cloudfront.net
Software: CloudFront /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://5damah.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

date: Sun, 02 Oct 2022 07:04:45 GMT
via: 1.1 3e5a2f6c5b1171dae267d5a9344f95e8.cloudfront.net (CloudFront)
server: CloudFront
x-amz-cf-pop: ORD51-C1
age: 21438
x-cache: Hit from cloudfront
cache-control: no-cache, no-store
x-amz-cf-id: qGUsNVy4Mk5BllAsGvHZojH6VEYy0Aur9XCExrA4pko1zOB_p9A2-w==

GET navigation.js
steps.citi.com/us/ 0
0

GET style4.js
paper.citi.com/127893/ 0
0

GET
H2 200 Citi-Enterprise-White.png
online.citi.com/GFC/branding/img/ 1 KB
1 KB 30ms
28ms Image
image/png 23.217.42.185
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://online.citi.com/GFC/branding/img/Citi-Enterprise-White.png

Requested by

Host: online.citi.com
URL: https://online.citi.com/GFC/branding/responsivebranding/css/main_branding.css

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

23.217.42.185 New York, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-217-42-185.deploy.static.akamaitechnologies.com

Software

Resource Hash

7cb24e06c00e47bb6bc6c38b935d6bc62817f656703387e4fb7591add96c7454

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://online.citi.com/GFC/branding/responsivebranding/css/main_branding.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

strict-transport-security: max-age=300
date: Sun, 02 Oct 2022 13:02:03 GMT
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
last-modified: Wed, 14 Jun 2017 18:29:05 GMT
x-akamai-citisite: SWDC
content-type: image/png
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
accept-ranges: bytes
content-length: 1040
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 200 Interstate-Light.woff
online.citi.com/CBOL/common/ui/ddl/theme/latest/styles/fonts/interstate/ 74 KB
74 KB 68ms
29ms Font
application/octet-stream 23.217.42.185
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://online.citi.com/CBOL/common/ui/ddl/theme/latest/styles/fonts/interstate/Interstate-Light.woff

Requested by

Host: online.citi.com
URL: https://online.citi.com/CBOL/common/ui/ddl/theme/latest/styles/ddl.min.css

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

23.217.42.185 New York, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-217-42-185.deploy.static.akamaitechnologies.com

Software

Resource Hash

f327a0ba3e41b1e8154e1c18fc114baff0bd057151e3afe7fa6f33cc0cb18296

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

Referer: https://online.citi.com/CBOL/common/ui/ddl/theme/latest/styles/ddl.min.css
Origin: https://5damah.com
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

strict-transport-security: max-age=300
content-encoding: gzip
date: Sun, 02 Oct 2022 13:02:03 GMT
last-modified: Tue, 12 Sep 2017 16:59:12 GMT
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-akamai-citisite: SWDC
vary: Accept-Encoding
content-type: text/plain
access-control-allow-origin: *
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
content-length: 75483
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 200 serverComponent.php Show response
nexus.ensighten.com/citi/na_prod/ 1 KB
920 B 78ms
77ms Script
text/javascript 13.249.141.26
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://nexus.ensighten.com/citi/na_prod/serverComponent.php?namespace=Bootstrapper&staticJsPath=nexus.ensighten.com/citi/na_prod/code/&publishedOn=Thu%20Sep%2022%2019:29:55%20GMT%202022&ClientID=1129&PageID=https%3A%2F%2F5damah.com%2Fappp%2Fonline%2Fciti.com%2FUS%2Flogin.do.html%3Fjdsh47wryfhoduetoealshfilw4yrledyuwruieryjosdifhyw78456rywehrfeuk%3D
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.249.141.26 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-249-141-26.ord51.r.cloudfront.net
Software: nginx /
Resource Hash: 823c8dd9c2a03256be59aec2abf354b4d32371fc6e79b95b6f93d4d7b7a059c7

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://5damah.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

date: Sun, 02 Oct 2022 13:02:03 GMT
content-encoding: gzip
via: 1.1 3e5a2f6c5b1171dae267d5a9344f95e8.cloudfront.net (CloudFront)
server: nginx
x-amz-cf-pop: ORD51-C1
vary: Accept-Encoding
x-cache: Miss from cloudfront
content-type: text/javascript
cache-control: no-cache, no-store
x-amz-cf-id: E2-gu_agdTjffExlKC-PpvKQ6ftStEPief9zlYR0_tzmyWCYKALHsw==
expires: Sun, 02 Oct 2022 13:02:02 GMT

GET
H2 200 arrow-btn-next-white-sm-bold.svg
online.citi.com/CBOL/common/ui/ddl/theme/latest/images/icons/svgs/arrows/ 918 B
1010 B 32ms
32ms Image
image/svg+xml 23.217.42.185
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://online.citi.com/CBOL/common/ui/ddl/theme/latest/images/icons/svgs/arrows/arrow-btn-next-white-sm-bold.svg

Requested by

Host: online.citi.com
URL: https://online.citi.com/CBOL/common/ui/ddl/theme/latest/styles/ddl.min.css

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

23.217.42.185 New York, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-217-42-185.deploy.static.akamaitechnologies.com

Software

Resource Hash

4f918cd256712c03a1b88007176cabf623cc63740e919d35a217c18dc7ebe607

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://online.citi.com/CBOL/common/ui/ddl/theme/latest/styles/ddl.min.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

strict-transport-security: max-age=300
content-encoding: gzip
date: Sun, 02 Oct 2022 13:02:03 GMT
last-modified: Tue, 12 Sep 2017 17:12:06 GMT
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-akamai-citisite: GTDC
vary: Accept-Encoding
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
content-type: image/svg+xml
accept-ranges: bytes
content-length: 496
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 200 Interstate-Bold.woff
online.citi.com/CBOL/common/ui/ddl/theme/latest/styles/fonts/interstate/ 70 KB
71 KB 37ms
33ms Font
application/octet-stream 23.217.42.185
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://online.citi.com/CBOL/common/ui/ddl/theme/latest/styles/fonts/interstate/Interstate-Bold.woff

Requested by

Host: online.citi.com
URL: https://online.citi.com/CBOL/common/ui/ddl/theme/latest/styles/ddl.min.css

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

23.217.42.185 New York, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-217-42-185.deploy.static.akamaitechnologies.com

Software

Resource Hash

e9e9a67395a0d83b584208a19b95af203df8e8e6c6952fe76c690d60ea9381c7

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

Referer: https://online.citi.com/CBOL/common/ui/ddl/theme/latest/styles/ddl.min.css
Origin: https://5damah.com
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

strict-transport-security: max-age=300
content-encoding: gzip
date: Sun, 02 Oct 2022 13:02:03 GMT
last-modified: Tue, 12 Sep 2017 17:24:53 GMT
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-akamai-citisite: GTDC
vary: Accept-Encoding
content-type: text/plain
access-control-allow-origin: *
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
content-length: 71859
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 200 arrow-btn-next-blue-sm-bold.svg
online.citi.com/CBOL/common/ui/ddl/theme/latest/images/icons/svgs/arrows/ 918 B
1013 B 30ms
30ms Image
image/svg+xml 23.217.42.185
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://online.citi.com/CBOL/common/ui/ddl/theme/latest/images/icons/svgs/arrows/arrow-btn-next-blue-sm-bold.svg

Requested by

Host: online.citi.com
URL: https://online.citi.com/CBOL/common/ui/ddl/theme/latest/styles/ddl.min.css

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

23.217.42.185 New York, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-217-42-185.deploy.static.akamaitechnologies.com

Software

Resource Hash

e90fb0eba512ed6473f6fb8acf4cd09b38732f150f43c396246c12bb2aacbb67

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://online.citi.com/CBOL/common/ui/ddl/theme/latest/styles/ddl.min.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

strict-transport-security: max-age=300
content-encoding: gzip
date: Sun, 02 Oct 2022 13:02:03 GMT
last-modified: Tue, 12 Sep 2017 17:20:58 GMT
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-akamai-citisite: GTDC
vary: Accept-Encoding
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
content-type: image/svg+xml
accept-ranges: bytes
content-length: 499
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 200 HP409.jpg
online.citi.com/JRS/banners/modules/ 63 KB
63 KB 43ms
43ms Image
image/jpeg 23.217.42.185
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://online.citi.com/JRS/banners/modules/HP409.jpg

Requested by

Host: 5damah.com
URL: https://5damah.com/appp/online/citi.com/US/login.do.html?jdsh47wryfhoduetoealshfilw4yrledyuwruieryjosdifhyw78456rywehrfeuk=

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

23.217.42.185 New York, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-217-42-185.deploy.static.akamaitechnologies.com

Software

Resource Hash

26246a1b6ffa7098469c2a9e6780bc7553a93580a0fa97d2f722af1b202daae9

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://5damah.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

strict-transport-security: max-age=300
date: Sun, 02 Oct 2022 13:02:03 GMT
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
last-modified: Fri, 16 Jul 2021 16:04:43 GMT
x-akamai-citisite: SWDC
content-type: image/jpeg
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
accept-ranges: bytes
content-length: 64350
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 200 Citi-Branding-Sprite.png
online.citi.com/GFC/branding/img/ 5 KB
5 KB 60ms
60ms Image
image/png 23.217.42.185
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://online.citi.com/GFC/branding/img/Citi-Branding-Sprite.png

Requested by

Host: online.citi.com
URL: https://online.citi.com/GFC/branding/responsivebranding/css/main_branding.css

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

23.217.42.185 New York, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-217-42-185.deploy.static.akamaitechnologies.com

Software

Resource Hash

3fca3de24621f0f10186594054444d608016297c2e853e548710b3521e42a609

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://online.citi.com/GFC/branding/responsivebranding/css/main_branding.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

strict-transport-security: max-age=300
date: Sun, 02 Oct 2022 13:02:03 GMT
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
last-modified: Wed, 14 Jun 2017 18:29:01 GMT
x-akamai-citisite: SWDC
content-type: image/png
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
accept-ranges: bytes
content-length: 4952
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 200 oo_icon_retina.gif
online.citi.com/GFC/branding/olab/images/ 2 KB
3 KB 57ms
57ms Image
image/gif 23.217.42.185
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://online.citi.com/GFC/branding/olab/images/oo_icon_retina.gif

Requested by

Host: online.citi.com
URL: https://online.citi.com/GFC/branding/responsivebranding/css/main_branding.css

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

23.217.42.185 New York, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-217-42-185.deploy.static.akamaitechnologies.com

Software

Resource Hash

701d2f9f02741b8429f4fb892b2b48c34a8a0f9189cb09013b2799031f22e484

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://online.citi.com/GFC/branding/responsivebranding/css/main_branding.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

strict-transport-security: max-age=300
date: Sun, 02 Oct 2022 13:02:03 GMT
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
last-modified: Tue, 12 Sep 2017 16:59:12 GMT
x-akamai-citisite: SWDC
content-type: image/gif
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
accept-ranges: bytes
content-length: 2204
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H/1.1 200
OK dest5.html Show response
citi.demdex.net/ Frame 2368 7 KB
3 KB 114ms
25ms Document
text/html 52.6.87.15
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://citi.demdex.net/dest5.html?d_nsid=0

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.6.87.15 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-52-6-87-15.compute-1.amazonaws.com

Software

Resource Hash

7bea17a80a61ed0f54248b4ffc4c718f7c8ff2619742577a73591d62ce074da8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://5damah.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

Accept-Ranges: bytes
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection: keep-alive
Content-Length: 2791
Content-Type: text/html;charset=UTF-8
DCS: dcs-prod-va6-1-v043-0617b3c63.edge-va6.demdex.com 0 ms
Expires: Thu, 01 Jan 1970 00:00:00 UTC
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-TID: 3hQyDzVwQ4Y=
content-encoding: gzip
date: Sun, 2 Oct 2022 13:02:03 GMT
last-modified: Thu, 29 Sep 2022 16:19:06 GMT
vary: accept-encoding

GET
H2 200 id Show response
metrics1.citi.com/ 89 B
620 B 107ms
28ms XHR
application/x-javascript 63.140.38.186
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://metrics1.citi.com/id?d_visid_ver=3.1.2&d_fieldgroup=A&mcorgid=61834D9B5228A7430A490D45%40AdobeOrg&mid=78071753791149487922020860764063701657&ts=1664715723831

Requested by

Host: 5damah.com
URL: https://5damah.com/appp/online/citi.com/US/login.do.html?jdsh47wryfhoduetoealshfilw4yrledyuwruieryjosdifhyw78456rywehrfeuk=

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

63.140.38.186 , United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ip-63-140-38-186.data.adobedc.net

Software

jag /

Resource Hash

ceb9592af76fd2eb1f5c8b1bb4ab734fd5571ad062f723e6d7029f5829f9281b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://5damah.com/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

date: Sun, 02 Oct 2022 13:02:03 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
server: jag
vary: Origin
content-type: application/x-javascript;charset=utf-8
access-control-allow-origin: https://5damah.com
p3p: CP="This is not a P3P policy"
cache-control: no-cache, no-store, max-age=0, no-transform, private
access-control-allow-credentials: true
content-length: 89
x-xss-protection: 1; mode=block

GET
H/1.1

200
OK

ibs:dpid=411&dpuuid=YzmLzAAAAGr_dQNw
dpm.demdex.net/
Redirect Chain

https://cm.everesttech.net/cm/dd?d_uuid=73485228668894743311560514939524784954
https://dpm.demdex.net/ibs:dpid=411&dpuuid=YzmLzAAAAGr_dQNw

42 B
940 B

29ms
28ms

Image
image/gif

3.221.198.169
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dpm.demdex.net/ibs:dpid=411&dpuuid=YzmLzAAAAGr_dQNw

Requested by

Host: 5damah.com
URL: https://5damah.com/appp/online/citi.com/US/login.do.html?jdsh47wryfhoduetoealshfilw4yrledyuwruieryjosdifhyw78456rywehrfeuk=

Protocol

HTTP/1.1

Server

3.221.198.169 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-3-221-198-169.compute-1.amazonaws.com

Software

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://5damah.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

DCS: dcs-prod-va6-1-v043-01e1b017f.edge-va6.demdex.com 4 ms
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
content-encoding: gzip
X-Content-Type-Options: nosniff
X-TID: Enu2Jo1DQ5M=
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Content-Type: image/gif
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection: keep-alive
Content-Length: 59
Expires: Thu, 01 Jan 1970 00:00:00 UTC

Redirect headers

Location: https://dpm.demdex.net/ibs:dpid=411&dpuuid=YzmLzAAAAGr_dQNw
Date: Sun, 02 Oct 2022 13:02:04 GMT
Cache-Control: no-cache
Server: AMO-cookiemap/1.1
Connection: keep-alive
Content-Length: 0
P3P: CP="NOI NID DEVa PSAa PSDa OUR IND PUR COM NAV INT DEM"

GET
H2 200 fdf45a7c15c1cee06bb71e10dac4e26e.js Show response
nexus.ensighten.com/citi/na_prod/code/ 989 B
1 KB 28ms
28ms Script
application/javascript 13.249.141.26
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://nexus.ensighten.com/citi/na_prod/code/fdf45a7c15c1cee06bb71e10dac4e26e.js?conditionId0=4849963
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.249.141.26 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-249-141-26.ord51.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 7df13706eaab8ce9a3dcd2a501f60bc66987c83834d07dfaf07ae56ef814c110

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://5damah.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

date: Mon, 05 Sep 2022 07:06:19 GMT
x-amz-version-id: .wEMJ82rme0Ajy8MXYWYMqCLOS4zdOlx
via: 1.1 3e5a2f6c5b1171dae267d5a9344f95e8.cloudfront.net (CloudFront)
x-amz-cf-pop: ORD51-C1
age: 2354145
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
content-length: 989
last-modified: Tue, 20 Jul 2021 20:01:14 GMT
server: AmazonS3
etag: "a88ee16d6636b998b8a6bb0eedf3a3bb"
content-type: application/javascript; charset=utf-8
cache-control: max-age=315360000
accept-ranges: bytes
x-amz-cf-id: PKjwgBsgGNvCf542TfDrNkbZ-Cx4B9bGvXZ_xDOyEUGKa4V9-T0R1Q==

GET
H2 200 af3b21070dd01ab22a4f331056324374.js Show response
nexus.ensighten.com/citi/na_prod/code/ 7 KB
3 KB 29ms
29ms Script
application/javascript 13.249.141.26
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://nexus.ensighten.com/citi/na_prod/code/af3b21070dd01ab22a4f331056324374.js?conditionId0=4897099
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.249.141.26 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-249-141-26.ord51.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: d2751a84e6a70913798dd8b2aede47ab49b7a701618cd151d89755638f71aa02

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://5damah.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

date: Fri, 26 Aug 2022 07:58:53 GMT
x-amz-version-id: QTYOdEvDbSbtudwcv3X6K9qpVGIDVLJs
content-encoding: gzip
via: 1.1 3e5a2f6c5b1171dae267d5a9344f95e8.cloudfront.net (CloudFront)
x-amz-cf-pop: ORD51-C1
age: 3214991
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
last-modified: Tue, 16 Aug 2022 21:43:05 GMT
server: AmazonS3
etag: W/"412eb38d6a797c24fd5d7e30e1b9799d"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
cache-control: max-age=315360000
x-amz-cf-id: a7jK0HX4vwDTg573NapaqmK1f9G1a15AklKHTxHWEmsd03qOFxGDgg==

GET
H2 200 557566dc60916e3de69e006bef252459.js Show response
nexus.ensighten.com/citi/na_prod/code/ 2 KB
1 KB 30ms
30ms Script
application/javascript 13.249.141.26
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://nexus.ensighten.com/citi/na_prod/code/557566dc60916e3de69e006bef252459.js?conditionId0=4837456
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.249.141.26 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-249-141-26.ord51.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 31b00ff4929696dfca06885da68e58c3e09f6ecb4ae0fe1ae287e99a3fd1f716

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://5damah.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

date: Thu, 08 Sep 2022 07:27:35 GMT
x-amz-version-id: nE2jchQRxt_gtDKDOvHRLQGyp_MKp2PL
content-encoding: gzip
via: 1.1 3e5a2f6c5b1171dae267d5a9344f95e8.cloudfront.net (CloudFront)
x-amz-cf-pop: ORD51-C1
age: 2093669
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
last-modified: Tue, 20 Jul 2021 20:01:09 GMT
server: AmazonS3
etag: W/"c12999fcad47ab9cba1967b8c736048d"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
cache-control: max-age=315360000
x-amz-cf-id: RFctZfMzNi7xvchEcWYw0ZUNE3tXNu3vCeZVoJ2CNC9_IPJe4Y837g==

GET
H2 200 5b5636c16f494d5fcc948f4554300f79.js Show response
nexus.ensighten.com/citi/na_prod/code/ 166 KB
35 KB 31ms
31ms Script
application/javascript 13.249.141.26
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://nexus.ensighten.com/citi/na_prod/code/5b5636c16f494d5fcc948f4554300f79.js?conditionId0=421908
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.249.141.26 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-249-141-26.ord51.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 6643bb410c647786949016cd3032ea1ed824a5a17313a2216c115de612482a5a

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://5damah.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

date: Tue, 13 Sep 2022 17:23:30 GMT
x-amz-version-id: CZbhUaMVGcELu7Tp.vnFWThm1Iz7u.mg
content-encoding: gzip
via: 1.1 3e5a2f6c5b1171dae267d5a9344f95e8.cloudfront.net (CloudFront)
x-amz-cf-pop: ORD51-C1
age: 1625914
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: PENDING
last-modified: Tue, 13 Sep 2022 17:23:26 GMT
server: AmazonS3
etag: W/"de2e8ecdb9334e6565ea8d4feb369116"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
cache-control: max-age=315360000
x-amz-cf-id: K4BoJ1XoHTGcBgdzdJaBEBxEXEyYeaWzSoCO_T3H28XyUcR5a4C6xQ==

GET
H2 200 51aba9f62787efbaa13e53a8d1ae3892.js Show response
nexus.ensighten.com/citi/na_prod/code/ 1 KB
1 KB 35ms
34ms Script
application/javascript 13.249.141.26
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://nexus.ensighten.com/citi/na_prod/code/51aba9f62787efbaa13e53a8d1ae3892.js?conditionId0=4827153
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.249.141.26 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-249-141-26.ord51.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: bf8892a953595eb96b9ca68c5756849d404115dcf2ee9bf87e8b4e7b3cf8e650

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://5damah.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

date: Mon, 12 Sep 2022 06:41:22 GMT
x-amz-version-id: wbqnWd5jL63548esNkWLxT1ImQDA0TC0
content-encoding: gzip
via: 1.1 3e5a2f6c5b1171dae267d5a9344f95e8.cloudfront.net (CloudFront)
x-amz-cf-pop: ORD51-C1
age: 1750842
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
last-modified: Tue, 31 Aug 2021 17:19:04 GMT
server: AmazonS3
etag: W/"4d37444c012a76a0557182615bf5cdd3"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
cache-control: max-age=315360000
x-amz-cf-id: G_IGRoaIO5K6xmO5dXSU8NnbOaN8GZaFfmr61Xmi6L1I6g5pPIGumw==

GET
H2 200 8641057b9716149f761014486e77c4c0.js Show response
nexus.ensighten.com/citi/na_prod/code/ 173 KB
40 KB 37ms
37ms Script
application/javascript 13.249.141.26
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://nexus.ensighten.com/citi/na_prod/code/8641057b9716149f761014486e77c4c0.js?conditionId0=486757
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.249.141.26 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-249-141-26.ord51.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: aa04a8b0e57ead0aa5ab793816b58772250bd6efdd01042f1bc7ccc4c20ec540

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://5damah.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

date: Thu, 08 Sep 2022 07:27:35 GMT
x-amz-version-id: JA70f_WGNG7H1tnE4i_sKuxvYaFEwzMJ
content-encoding: gzip
via: 1.1 3e5a2f6c5b1171dae267d5a9344f95e8.cloudfront.net (CloudFront)
x-amz-cf-pop: ORD51-C1
age: 2093669
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
last-modified: Tue, 16 Aug 2022 21:43:05 GMT
server: AmazonS3
etag: W/"6c0ec1ecef630bef7b1fb87b13b4f2cb"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
cache-control: max-age=315360000
x-amz-cf-id: TL5QkD535Oobn_Omn3RZpnsF8lLdC38KZllB93rc2zDSYFPjBNqYDA==

GET
H2 200 2fec4c7c6dc69d561844935cdcfc1d5c.js Show response
nexus.ensighten.com/citi/na_prod/code/ 74 KB
12 KB 55ms
54ms Script
application/javascript 13.249.141.26
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://nexus.ensighten.com/citi/na_prod/code/2fec4c7c6dc69d561844935cdcfc1d5c.js?conditionId0=467299
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.249.141.26 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-249-141-26.ord51.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: cc23ed6fa37ee5c404d8dc720360520d576d3732fa957152a9bc54958a1478fd

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://5damah.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

date: Tue, 23 Aug 2022 07:27:09 GMT
x-amz-version-id: jza8GqxZGhVz18cCFAItH4ZpiQFQqNOt
content-encoding: gzip
via: 1.1 3e5a2f6c5b1171dae267d5a9344f95e8.cloudfront.net (CloudFront)
x-amz-cf-pop: ORD51-C1
age: 3476095
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
last-modified: Tue, 16 Aug 2022 21:43:05 GMT
server: AmazonS3
etag: W/"6ee8c75c11d701bd85d6e3c25093c469"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
cache-control: max-age=315360000
x-amz-cf-id: 1gRd7NzW0i3vMkb0943i0d8PK5asicQfsQQnADk1h4Kltal9AFWHAQ==

GET
H3

200

activityi;dc_pre=CMmQiKvNwfoCFY4MaAgdkBgEYw;src=6260004;type=cards0;cat=citih0;u4=JSOSIGNON;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=5518354524190.832 Show response
6260004.fls.doubleclick.net/ Frame 59FB
Redirect Chain

https://6260004.fls.doubleclick.net/activityi;src=6260004;type=cards0;cat=citih0;u4=JSOSIGNON;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=5518354524190.832?
https://6260004.fls.doubleclick.net/activityi;dc_pre=CMmQiKvNwfoCFY4MaAgdkBgEYw;src=6260004;type=cards0;cat=citih0;u4=JSOSIGNON;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=5518354524190....

400 B
357 B

102ms
51ms

Document
text/html

142.250.176.198
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://6260004.fls.doubleclick.net/activityi;dc_pre=CMmQiKvNwfoCFY4MaAgdkBgEYw;src=6260004;type=cards0;cat=citih0;u4=JSOSIGNON;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=5518354524190.832?

Requested by

Host: 5damah.com
URL: https://5damah.com/appp/online/citi.com/US/login.do.html?jdsh47wryfhoduetoealshfilw4yrledyuwruieryjosdifhyw78456rywehrfeuk=

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.176.198 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga34s37-in-f6.1e100.net

Software

cafe /

Resource Hash

5857a6cd798ada2f0e714ec74b00bf8036be59a79d7d30b8acbbc09d06e7aabe

Security Headers

Name	Value
Strict-Transport-Security	max-age=21600
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://5damah.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private, max-age=0
content-encoding: gzip
content-length: 332
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sun, 02 Oct 2022 13:02:04 GMT
expires: Sun, 02 Oct 2022 13:02:04 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
strict-transport-security: max-age=21600
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

Redirect headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: no-cache, must-revalidate
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sun, 02 Oct 2022 13:02:04 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
follow-only-when-prerender-shown: 1
location: https://6260004.fls.doubleclick.net/activityi;dc_pre=CMmQiKvNwfoCFY4MaAgdkBgEYw;src=6260004;type=cards0;cat=citih0;u4=JSOSIGNON;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=5518354524190.832?
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
pragma: no-cache
server: cafe
strict-transport-security: max-age=21600
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 425466.html Show response
sr.rlcdn.com/ Frame 6641 237 B
513 B 67ms
50ms Document
text/html 35.190.60.146
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://sr.rlcdn.com/425466.html?es=80676&u=da39a3ee5e6b4b0d3255bfef95601890afd80709
Requested by: Host: 5damah.com
URL: https://5damah.com/appp/online/citi.com/US/login.do.html?jdsh47wryfhoduetoealshfilw4yrledyuwruieryjosdifhyw78456rywehrfeuk=
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.190.60.146 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 146.60.190.35.bc.googleusercontent.com
Software: /
Resource Hash: d08b0e82e4be24856001e584cef52bd6dc7461ca0e4c05963b52e4f58dd4449b

Request headers

Referer: https://5damah.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, no-store
content-length: 237
content-type: text/html
date: Sun, 02 Oct 2022 13:02:03 GMT
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
timing-allow-origin: *
via: 1.1 google

GET
H3

200

activityi;dc_pre=CJHkhqvNwfoCFToJaAgd-WELWA;src=6417343;type=gcb_v0;cat=gcb_c00;dc_lat=;dc_rdid=;ord=1020006552152.4681 Show response
6417343.fls.doubleclick.net/ Frame F6B8
Redirect Chain

https://6417343.fls.doubleclick.net/activityi;src=6417343;type=gcb_v0;cat=gcb_c00;dc_lat=;dc_rdid=;ord=1020006552152.4681?
https://6417343.fls.doubleclick.net/activityi;dc_pre=CJHkhqvNwfoCFToJaAgd-WELWA;src=6417343;type=gcb_v0;cat=gcb_c00;dc_lat=;dc_rdid=;ord=1020006552152.4681?

355 B
321 B

108ms
58ms

Document
text/html

142.250.176.198
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://6417343.fls.doubleclick.net/activityi;dc_pre=CJHkhqvNwfoCFToJaAgd-WELWA;src=6417343;type=gcb_v0;cat=gcb_c00;dc_lat=;dc_rdid=;ord=1020006552152.4681?

Requested by

Host: 5damah.com
URL: https://5damah.com/appp/online/citi.com/US/login.do.html?jdsh47wryfhoduetoealshfilw4yrledyuwruieryjosdifhyw78456rywehrfeuk=

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.176.198 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga34s37-in-f6.1e100.net

Software

cafe /

Resource Hash

b688553f6307375ea6d4b13072957090e51b97f0b2f41e608bdcef7350472393

Security Headers

Name	Value
Strict-Transport-Security	max-age=21600
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://5damah.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private, max-age=0
content-encoding: gzip
content-length: 296
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sun, 02 Oct 2022 13:02:04 GMT
expires: Sun, 02 Oct 2022 13:02:04 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
strict-transport-security: max-age=21600
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

Redirect headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: no-cache, must-revalidate
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sun, 02 Oct 2022 13:02:04 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
follow-only-when-prerender-shown: 1
location: https://6417343.fls.doubleclick.net/activityi;dc_pre=CJHkhqvNwfoCFToJaAgd-WELWA;src=6417343;type=gcb_v0;cat=gcb_c00;dc_lat=;dc_rdid=;ord=1020006552152.4681?
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
pragma: no-cache
server: cafe
strict-transport-security: max-age=21600
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H3

200

activityi;dc_pre=CJLchqvNwfoCFXEOaAgdL1AB6g;src=6269322;type=bankp0;cat=banka001;ord=686502391290.5887 Show response
6269322.fls.doubleclick.net/ Frame 4EB2
Redirect Chain

https://6269322.fls.doubleclick.net/activityi;src=6269322;type=bankp0;cat=banka001;ord=686502391290.5887?
https://6269322.fls.doubleclick.net/activityi;dc_pre=CJLchqvNwfoCFXEOaAgdL1AB6g;src=6269322;type=bankp0;cat=banka001;ord=686502391290.5887?

338 B
314 B

124ms
74ms

Document
text/html

142.250.176.198
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://6269322.fls.doubleclick.net/activityi;dc_pre=CJLchqvNwfoCFXEOaAgdL1AB6g;src=6269322;type=bankp0;cat=banka001;ord=686502391290.5887?

Requested by

Host: 5damah.com
URL: https://5damah.com/appp/online/citi.com/US/login.do.html?jdsh47wryfhoduetoealshfilw4yrledyuwruieryjosdifhyw78456rywehrfeuk=

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.176.198 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga34s37-in-f6.1e100.net

Software

cafe /

Resource Hash

a45cbaff68050bac6bafd588588ee2434d6bb62dd95902d9359c53308331f47f

Security Headers

Name	Value
Strict-Transport-Security	max-age=21600
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://5damah.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private, max-age=0
content-encoding: gzip
content-length: 289
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sun, 02 Oct 2022 13:02:04 GMT
expires: Sun, 02 Oct 2022 13:02:04 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
strict-transport-security: max-age=21600
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

Redirect headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: no-cache, must-revalidate
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Sun, 02 Oct 2022 13:02:04 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
follow-only-when-prerender-shown: 1
location: https://6269322.fls.doubleclick.net/activityi;dc_pre=CJLchqvNwfoCFXEOaAgdL1AB6g;src=6269322;type=bankp0;cat=banka001;ord=686502391290.5887?
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
pragma: no-cache
server: cafe
strict-transport-security: max-age=21600
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H/1.1 200
OK snare.js Show response
mpsnare.iesnare.com/ 38 KB
13 KB 50ms
49ms Script
text/javascript 23.21.145.8
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://mpsnare.iesnare.com/snare.js?_=1664715723571

Requested by

Host: online.citi.com
URL: https://online.citi.com/CBOL/common/ui/ddl/theme/latest/scripts/vendor.js

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

23.21.145.8 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-23-21-145-8.compute-1.amazonaws.com

Software

nginx /

Resource Hash

665379a09f8a42dc7a727452a54ea72a08ab18a59aba966ec023aee7690fe438

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://5damah.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

Pragma: no-cache
Date: Sun, 02 Oct 2022 13:02:03 GMT
Strict-Transport-Security: max-age=15552000; includeSubDomains
Content-Encoding: gzip
Server: nginx
Transfer-Encoding: chunked
Content-Type: text/javascript; charset=utf-8
p3p: CP="NON DSP COR CURa"
Cache-Control: no-cache, private
Connection: keep-alive
Expires: 0

GET
H2 200 close.svg
online.citi.com/CBOL/common/ui/ddl/theme/latest/images/icons/svgs/ 1 KB
1 KB 32ms
29ms Image
image/svg+xml 23.217.42.185
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://online.citi.com/CBOL/common/ui/ddl/theme/latest/images/icons/svgs/close.svg

Requested by

Host: online.citi.com
URL: https://online.citi.com/CBOL/common/ui/ddl/theme/latest/styles/ddl.min.css

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

23.217.42.185 New York, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-217-42-185.deploy.static.akamaitechnologies.com

Software

Resource Hash

55e066703c69d4d89a1f4d66794d474aa93d710624d8f807096bac17a7867b17

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://online.citi.com/CBOL/common/ui/ddl/theme/latest/styles/ddl.min.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

strict-transport-security: max-age=300
content-encoding: gzip
date: Sun, 02 Oct 2022 13:02:03 GMT
last-modified: Tue, 12 Sep 2017 17:20:58 GMT
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-akamai-citisite: GTDC
vary: Accept-Encoding
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
content-type: image/svg+xml
accept-ranges: bytes
content-length: 641
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H/1.1 200
OK id Show response
dpm.demdex.net/ 363 B
1 KB 42ms
41ms XHR
application/json 3.221.198.169
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://dpm.demdex.net/id?d_visid_ver=3.1.2&d_fieldgroup=AAM&d_rtbd=json&d_ver=2&d_orgid=61834D9B5228A7430A490D45%40AdobeOrg&d_nsid=0&d_mid=78071753791149487922020860764063701657&d_blob=RKhpRz8krg2tLO6pguXWp5olkAcUniQYPHaMWWgdJ3xzPWQmdj0y&d_cid_ic=AVID%01319CC5E5A0D10C26-40001D50BE65AB08&ts=1664715724078

Requested by

Host: 5damah.com
URL: https://5damah.com/appp/online/citi.com/US/login.do.html?jdsh47wryfhoduetoealshfilw4yrledyuwruieryjosdifhyw78456rywehrfeuk=

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

3.221.198.169 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-3-221-198-169.compute-1.amazonaws.com

Software

Resource Hash

01f8f873a860696a5f2b0c8e22a3471bb81c5ac2ce40f85678bfba8dc030e1d7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://5damah.com/
accept-language: en-CA,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

DCS: dcs-prod-va6-2-v043-0f8a0958f.edge-va6.demdex.com 12 ms
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
content-encoding: gzip
X-TID: twq3/65/RXs=
Vary: Origin
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Access-Control-Allow-Origin: https://5damah.com
Content-Type: application/json;charset=utf-8
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 306
Expires: Thu, 01 Jan 1970 00:00:00 UTC

GET
H2 200 tc.min.js Show response
c1.rfihub.net/js/ 19 KB
6 KB 31ms
30ms Script
application/x-javascript 2600:9000:2211:3000:1:76cf:fe80:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c1.rfihub.net/js/tc.min.js
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/code/af3b21070dd01ab22a4f331056324374.js?conditionId0=4897099
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2211:3000:1:76cf:fe80:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: Jetty(9.3.29.v20201019) /
Resource Hash: 7ef97b12890fc6fee67f869c6e1f74b6719de7d66ac0d649c8d7386a80b4c30f

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://5damah.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

date: Sun, 02 Oct 2022 12:32:04 GMT
content-encoding: gzip
via: 1.1 15f2e88ce5f742da8075e454f83e8f5e.cloudfront.net (CloudFront)
last-modified: Sun, 02 Oct 2022 12:31:54 GMT
server: Jetty(9.3.29.v20201019)
x-amz-cf-pop: ORD51-C4
age: 1800
x-cache: Hit from cloudfront
content-type: application/x-javascript
p3p: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
cache-control: public, max-age=3600
content-length: 6162
x-amz-cf-id: JwQFBqckMxG_gUC-wstFMmaZUJ4jWc_b8rXx9BEdT0xkVz4G6SUprg==
expires: Sun, 02 Oct 2022 13:32:04 GMT

GET
H/1.1 200
OK ca.html Show response
20766699p.rfihub.com/ Frame 61FF 2 KB
2 KB 258ms
22ms Document
text/html 199.38.167.131
ROCKETFUEL

General

Check archive.org

Show headers Download Go to

Full URL: https://20766699p.rfihub.com/ca.html?ver=9&ra=1848&rb=648&ca=20766699&_o=17169175&_t=noncookiedusernamepassword&_rev=1&_pcode=1&_orderid=1&ssv_cuuid=&ssv_package=null&ssv_prodlist=null&ssv_pagename=noncookiedusernamepassword&pe=https%3A%2F%2F5damah.com%2Fappp%2Fonline%2Fciti.com%2FUS%2Flogin.do.html%3Fjdsh47wryfhoduetoealshfilw4yrledyuwruieryjosdifhyw78456rywehrfeuk%3D&pf=&ra=5867461392688047
Requested by: Host: c1.rfihub.net
URL: https://c1.rfihub.net/js/tc.min.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 199.38.167.131 , United States, ASN54312 (ROCKETFUEL, US),
Reverse DNS
Software: Jetty(9.3.29.v20201019) /
Resource Hash: 6142d15f288669d79b907827ba9be37711a266ef721cb22a330b3277723015fb

Request headers

Referer: https://5damah.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

Cache-Control: no-cache
Content-Length: 1677
Content-Type: text/html;charset=utf-8
Date: Sun, 02 Oct 2022 13:02:04 GMT
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Server: Jetty(9.3.29.v20201019)

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 106 KB
42 KB 88ms
35ms Script
application/javascript 2607:f8b0:4006:807::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=DC-6260004

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:807::2008 Rockville, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

010e587a53e1759d6485cc0455ecae68ea668a65de20ae631bcbd5ef66352d5d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://5damah.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

date: Sun, 02 Oct 2022 13:02:04 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42642
x-xss-protection: 0
last-modified: Sun, 02 Oct 2022 12:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Sun, 02 Oct 2022 13:02:04 GMT

GET
H2 200 dc_pre=CJHkhqvNwfoCFToJaAgd-WELWA;src=6417343;type=gcb_v0;cat=gcb_c00;dc_lat=;dc_rdid=;ord=1020006552152.4681
adservice.google.com/ddm/fls/z/ Frame F6B8 42 B
494 B 115ms
51ms Image
image/gif 2607:f8b0:4006:822::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://adservice.google.com/ddm/fls/z/dc_pre=CJHkhqvNwfoCFToJaAgd-WELWA;src=6417343;type=gcb_v0;cat=gcb_c00;dc_lat=;dc_rdid=;ord=1020006552152.4681

Requested by

Host: 6417343.fls.doubleclick.net
URL: https://6417343.fls.doubleclick.net/activityi;dc_pre=CJHkhqvNwfoCFToJaAgd-WELWA;src=6417343;type=gcb_v0;cat=gcb_c00;dc_lat=;dc_rdid=;ord=1020006552152.4681?

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:822::2002 Rockville, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://6417343.fls.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 02 Oct 2022 13:02:04 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 dc_pre=CJLchqvNwfoCFXEOaAgdL1AB6g;src=6269322;type=bankp0;cat=banka001;ord=686502391290.5887
adservice.google.com/ddm/fls/z/ Frame 4EB2 42 B
107 B 109ms
55ms Image
image/gif 2607:f8b0:4006:822::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://adservice.google.com/ddm/fls/z/dc_pre=CJLchqvNwfoCFXEOaAgdL1AB6g;src=6269322;type=bankp0;cat=banka001;ord=686502391290.5887

Requested by

Host: 6269322.fls.doubleclick.net
URL: https://6269322.fls.doubleclick.net/activityi;dc_pre=CJLchqvNwfoCFXEOaAgdL1AB6g;src=6269322;type=bankp0;cat=banka001;ord=686502391290.5887?

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:822::2002 Rockville, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://6269322.fls.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 02 Oct 2022 13:02:04 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 dc_pre=CMmQiKvNwfoCFY4MaAgdkBgEYw;src=6260004;type=cards0;cat=citih0;u4=JSOSIGNON;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=5518354524190.832
adservice.google.com/ddm/fls/z/ Frame 59FB 42 B
107 B 99ms
53ms Image
image/gif 2607:f8b0:4006:822::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://adservice.google.com/ddm/fls/z/dc_pre=CMmQiKvNwfoCFY4MaAgdkBgEYw;src=6260004;type=cards0;cat=citih0;u4=JSOSIGNON;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=5518354524190.832

Requested by

Host: 6260004.fls.doubleclick.net
URL: https://6260004.fls.doubleclick.net/activityi;dc_pre=CMmQiKvNwfoCFY4MaAgdkBgEYw;src=6260004;type=cards0;cat=citih0;u4=JSOSIGNON;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=5518354524190.832?

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:822::2002 Rockville, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://6260004.fls.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 02 Oct 2022 13:02:04 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 106 KB
42 KB 78ms
36ms Script
application/javascript 2607:f8b0:4006:807::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=DC-6269322&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=DC-6260004

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:807::2008 Rockville, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

139ee99bb2f4b004d29ce3a395e9713d096ce363dd84191cad3af3ced64044ef

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://5damah.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

date: Sun, 02 Oct 2022 13:02:04 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42643
x-xss-protection: 0
last-modified: Sun, 02 Oct 2022 12:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Sun, 02 Oct 2022 13:02:04 GMT

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 106 KB
42 KB 93ms
52ms Script
application/javascript 2607:f8b0:4006:807::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=DC-6256710&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=DC-6260004

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:807::2008 Rockville, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

06533625bc622bb13d112ea4841b9f255a517df9728cb836942a0ff3bf75aa5c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://5damah.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

date: Sun, 02 Oct 2022 13:02:04 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42649
x-xss-protection: 0
last-modified: Sun, 02 Oct 2022 12:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Sun, 02 Oct 2022 13:02:04 GMT

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 106 KB
42 KB 84ms
44ms Script
application/javascript 2607:f8b0:4006:807::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=DC-6415812&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=DC-6260004

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:807::2008 Rockville, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

6b9f611fbd81522583f3cb28238215688bf40866268e270ededf23e0f26d18d4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://5damah.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

date: Sun, 02 Oct 2022 13:02:04 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42644
x-xss-protection: 0
last-modified: Sun, 02 Oct 2022 12:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Sun, 02 Oct 2022 13:02:04 GMT

GET
H2 200 embed.js Show response
resources.digital-cloud-citi.medallia.com/wdcusciti/50/onsite/ 1 KB
955 B 60ms
12ms Script
application/javascript 151.101.129.230
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://resources.digital-cloud-citi.medallia.com/wdcusciti/50/onsite/embed.js

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/code/fdf45a7c15c1cee06bb71e10dac4e26e.js?conditionId0=4849963

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

151.101.129.230 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

AmazonS3 /

Resource Hash

1c5391cd953f0795fdd58a4e26899f1952522101afc71b63de87f5f467c0d1a6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31557600

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://5damah.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

x-amz-version-id: eKMfkf17jnOEK1NZY3.0vSO_D.gj7xc9
content-encoding: gzip
via: 1.1 varnish
date: Sun, 02 Oct 2022 13:02:04 GMT
strict-transport-security: max-age=31557600
x-amz-request-id: 3GXZPD6DX10D2EJ4
age: 1659189
x-cache: HIT
content-length: 531
x-amz-id-2: ak5whh9dKuA/BLSjRk9/x+IiGAkz4jIJf6bdzVA4Feykun9CPjJ/9BhYDswnWFeTyfB04DzOtLY=
x-served-by: cache-yul12820-YUL
last-modified: Mon, 29 Aug 2022 07:49:45 GMT
server: AmazonS3
x-timer: S1664715725.629337,VS0,VE0
etag: "c1db4c234cf539e2bfab42c09c1ca05d"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=0,must-revalidate
accept-ranges: bytes
x-cache-hits: 4

GET
H2 200 1560.js Show response
cdn.pbbl.co/r/ 33 KB
10 KB 158ms
56ms Script
application/javascript 65.8.49.17
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.pbbl.co/r/1560.js

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/code/af3b21070dd01ab22a4f331056324374.js?conditionId0=4897099

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

65.8.49.17 Pompano Beach, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-65-8-49-17.ord52.r.cloudfront.net

Software

nginx/1.20.1 /

Resource Hash

fc6d51c8cf191d581599c9df93f289248272ff952613d0df3d72fc5fbc2060fb

Security Headers

Name	Value
Content-Security-Policy	default-src 'self'; base-uri 'self'; upgrade-insecure-requests; frame-ancestors 'self'; form-action 'none'; object-src 'self'; block-all-mixed-content; script-src 'self'; style-src 'self' 'unsafe-inline'; child-src 'self'; worker-src 'self';
Strict-Transport-Security	max-age=31536000
X-Xss-Protection	1

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://5damah.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-security-policy: default-src 'self'; base-uri 'self'; upgrade-insecure-requests; frame-ancestors 'self'; form-action 'none'; object-src 'self'; block-all-mixed-content; script-src 'self'; style-src 'self' 'unsafe-inline'; child-src 'self'; worker-src 'self';
content-encoding: gzip
date: Sun, 02 Oct 2022 13:02:04 GMT
via: 1.1 a497b0eefe66dc6fa9e24b5f51d2ab42.cloudfront.net (CloudFront)
x-amz-cf-pop: ORD52-C3
x-cache: RefreshHit from cloudfront
x-xss-protection: 1
last-modified: Fri, 10 Dec 2021 19:14:49 GMT
server: nginx/1.20.1
etag: W/"61b3a729-855d"
vary: Accept-Encoding, Origin
content-type: application/javascript
cache-control: max-age=1800, public
x-amz-cf-id: jRQKv2sZfQLZNEcSYP71S_bdO3u-AHMq8xRfuH5SxClhSh7pqnQmJg==
expires: Sun, 02 Oct 2022 13:32:04 GMT

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 155 KB
58 KB 40ms
40ms Script
application/javascript 2607:f8b0:4006:807::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-916451471

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:807::2008 Rockville, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

a8e61e5d2206d9cf57cb92dfd0d723fdc0b2eea3e69b11ed11270c1810323c5d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://5damah.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

date: Sun, 02 Oct 2022 13:02:04 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 59460
x-xss-protection: 0
last-modified: Sun, 02 Oct 2022 12:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Sun, 02 Oct 2022 13:02:04 GMT

GET
H3 200 425466.html Show response
sr.rlcdn.com/ Frame 83AD 237 B
256 B 47ms
46ms Document
text/html 35.190.60.146
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://sr.rlcdn.com/425466.html?es=80676&u=da39a3ee5e6b4b0d3255bfef95601890afd80709
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/code/2fec4c7c6dc69d561844935cdcfc1d5c.js?conditionId0=467299
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 35.190.60.146 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 146.60.190.35.bc.googleusercontent.com
Software: /
Resource Hash: d08b0e82e4be24856001e584cef52bd6dc7461ca0e4c05963b52e4f58dd4449b

Request headers

Referer: https://5damah.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, no-store
content-length: 237
content-type: text/html
date: Sun, 02 Oct 2022 13:02:04 GMT
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
timing-allow-origin: *
via: 1.1 google

GET
H3 200 conversion_async.js Show response
www.googleadservices.com/pagead/ 41 KB
15 KB 103ms
57ms Script
text/javascript 142.251.35.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googleadservices.com/pagead/conversion_async.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-916451471

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.35.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga25s78-in-f2.1e100.net

Software

cafe /

Resource Hash

f42283e0ca17a52688c5250e714ecd1b6a53af8b0f6e54ac64546499b0ec1b19

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://5damah.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

date: Sun, 02 Oct 2022 13:02:04 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15192
x-xss-protection: 0
server: cafe
etag: 699633608045481581
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600
timing-allow-origin: *
expires: Sun, 02 Oct 2022 13:02:04 GMT

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 155 KB
58 KB 40ms
39ms Script
application/javascript 2607:f8b0:4006:807::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-960621875&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=DC-6260004

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:807::2008 Rockville, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

391a023d72baa955ecf76cab22ad60f55607ba5b705e95ac7b982a4128e5d715

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://5damah.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

date: Sun, 02 Oct 2022 13:02:04 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 59472
x-xss-protection: 0
last-modified: Sun, 02 Oct 2022 12:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Sun, 02 Oct 2022 13:02:04 GMT

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 116 KB
46 KB 77ms
69ms Script
application/javascript 2607:f8b0:4006:807::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-644574043&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=DC-6260004

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:807::2008 Rockville, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

90e2294facf36d8bf814d2c69ce6fe6f4fb87f1651c66e8b62ed8b4e63973719

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://5damah.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

date: Sun, 02 Oct 2022 13:02:04 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 46731
x-xss-protection: 0
last-modified: Sun, 02 Oct 2022 12:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Sun, 02 Oct 2022 13:02:04 GMT

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 116 KB
46 KB 77ms
70ms Script
application/javascript 2607:f8b0:4006:807::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-975701947&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=DC-6260004

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:807::2008 Rockville, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

cc89636037cf1207e54f61f2525f40eb6378845b14fd3ec67602ae147e7651b8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://5damah.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

date: Sun, 02 Oct 2022 13:02:04 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 46725
x-xss-protection: 0
last-modified: Sun, 02 Oct 2022 12:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Sun, 02 Oct 2022 13:02:04 GMT

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 116 KB
46 KB 51ms
44ms Script
application/javascript 2607:f8b0:4006:807::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-830907969&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=DC-6260004

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:807::2008 Rockville, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

697b072c2117429a39b04508eec77e28c0a26f16564c81c335f9a78e94b6692a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://5damah.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

date: Sun, 02 Oct 2022 13:02:04 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 46776
x-xss-protection: 0
last-modified: Sun, 02 Oct 2022 12:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Sun, 02 Oct 2022 13:02:04 GMT

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 116 KB
46 KB 79ms
73ms Script
application/javascript 2607:f8b0:4006:807::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-695231162&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=DC-6260004

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:807::2008 Rockville, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

0cb1533713d352ed7f29ce8ae532a869600330bb5c3d3cd0c0305833870601eb

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://5damah.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

date: Sun, 02 Oct 2022 13:02:04 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 46755
x-xss-protection: 0
last-modified: Sun, 02 Oct 2022 12:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Sun, 02 Oct 2022 13:02:04 GMT

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 116 KB
46 KB 78ms
71ms Script
application/javascript 2607:f8b0:4006:807::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-819500023&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=DC-6260004

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:807::2008 Rockville, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

835477bb41eb0b1ed1271f1bf08192aaabde5a40a5d53e70ab5826fc45d5d120

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://5damah.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

date: Sun, 02 Oct 2022 13:02:04 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 46774
x-xss-protection: 0
last-modified: Sun, 02 Oct 2022 12:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Sun, 02 Oct 2022 13:02:04 GMT

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 116 KB
46 KB 72ms
67ms Script
application/javascript 2607:f8b0:4006:807::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-959299794&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=DC-6260004

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:807::2008 Rockville, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

32ce20023478c2ca22d760035fd78d0e2c79ab75f70c5fe8bdca983095d0660f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://5damah.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

date: Sun, 02 Oct 2022 13:02:04 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 46829
x-xss-protection: 0
last-modified: Sun, 02 Oct 2022 12:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Sun, 02 Oct 2022 13:02:04 GMT

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 155 KB
58 KB 87ms
81ms Script
application/javascript 2607:f8b0:4006:807::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-10955006959&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=DC-6260004

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:807::2008 Rockville, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

fb2174f99dd17edcf52501aa47eacdbee603bf47894ad834b732bab9d3c3417c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://5damah.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

date: Sun, 02 Oct 2022 13:02:04 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 59433
x-xss-protection: 0
last-modified: Sun, 02 Oct 2022 12:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Sun, 02 Oct 2022 13:02:04 GMT

GET
H2 200 generic1661759384239.js Show response
resources.digital-cloud-citi.medallia.com/wdcusciti/50/onsite/ 503 KB
84 KB 12ms
11ms Script
application/javascript 151.101.129.230
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://resources.digital-cloud-citi.medallia.com/wdcusciti/50/onsite/generic1661759384239.js

Requested by

Host: resources.digital-cloud-citi.medallia.com
URL: https://resources.digital-cloud-citi.medallia.com/wdcusciti/50/onsite/embed.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

151.101.129.230 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

AmazonS3 /

Resource Hash

cc1f329f34c5f9f4c759b787ccc409241a8ffe8d13863a87cc9214e628b43cff

Security Headers

Name	Value
Strict-Transport-Security	max-age=31557600

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://5damah.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

x-amz-version-id: cbf3VAh2wvqiC_RNSd9Tltn6dOvsrine
content-encoding: gzip
via: 1.1 varnish
date: Sun, 02 Oct 2022 13:02:04 GMT
strict-transport-security: max-age=31557600
x-amz-request-id: 44DFVPSE7H897BAN
age: 1061130
x-cache: HIT
content-length: 85764
x-amz-id-2: 30/rGod36g0fxMjyJSlWcg9Y5IBf7vi3fnVDENTWt/X3tKzRM7/s+LuGYUjO1jiDhbe9fhrVJoE=
x-served-by: cache-yul12820-YUL
last-modified: Mon, 29 Aug 2022 07:49:45 GMT
server: AmazonS3
x-timer: S1664715725.691184,VS0,VE0
etag: "31ab1facffb3500494bf6aca3d7e439d"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=0,must-revalidate
accept-ranges: bytes
x-cache-hits: 4

GET
H2 200 __cool.gif
udc-neb.kampyle.com/egw/5/qceuv8449dzg58ptt1bhda9g8ue19c7s/track/ 0
317 B 67ms
29ms Image
image/gif 35.241.45.82
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://udc-neb.kampyle.com/egw/5/qceuv8449dzg58ptt1bhda9g8ue19c7s/track/__cool.gif?data=eyJldmVudHMiOiBbCiAgICB7InNlc3Npb25fc2NyZWVuX3NpemUiOiAiMTYwMHgxMjAwIiwic2Vzc2lvbl9kdWEiOiAiTW96aWxsYS81LjAgKFdpbmRvd3MgTlQgMTAuMDsgV2luNjQ7IHg2NCkgQXBwbGVXZWJLaXQvNTM3LjM2IChLSFRNTCwgbGlrZSBHZWNrbykgQ2hyb21lLzEwNi4wLjUyNDkuNjEgU2FmYXJpLzUzNy4zNiIsInNlc3Npb25fcGxhdGZvcm0iOiAiV2luMzIiLCJwYWdlX3RpdGxlIjogIkJhbmtpbmcgd2l0aCBDaXRpIHwgQ2l0aS5jb20iLCJwYWdlX3VybCI6ICJodHRwczovLzVkYW1haC5jb20vYXBwcC9vbmxpbmUvY2l0aS5jb20vVVMvbG9naW4uZG8uaHRtbD9qZHNoNDd3cnlmaG9kdWV0b2VhbHNoZmlsdzR5cmxlZHl1d3J1aWVyeWpvc2RpZmh5dzc4NDU2cnl3ZWhyZmV1az0iLCJ0cmFja2VyX3R5cGUiOiAiamF2YXNjcmlwdCIsInRyYWNrZXJfdmVyc2lvbiI6ICIyLjIuMjMiLCJldmVudF9uYW1lIjogIm5lYnVsYV9wYWdlX3ZpZXciLCJldmVudF90aW1lc3RhbXBfZXBvY2giOiAiMTY2NDcxNTcyNDc4MSIsImV2ZW50X3RpbWV6b25lX29mZnNldCI6IDAsInVzZXJfaWQiOiAiMTgzOThjYTE3ZGZmMC0wZDhjY2RhNTcyY2I0My0xMzNiMzQ3Yi0xZDRjMDAtMTgzOThjYTE3ZTA4ZDEiLCJlbnZpcm9tZW50IjogImRpZ2l0YWwtY2xvdWQtdXMtY2l0aSIsImFjY291bnRJZCI6IDQ5LCJ1cmwiOiAiaHR0cHM6Ly81ZGFtYWguY29tL2FwcHAvb25saW5lL2NpdGkuY29tL1VTL2xvZ2luLmRvLmh0bWw/amRzaDQ3d3J5ZmhvZHVldG9lYWxzaGZpbHc0eXJsZWR5dXdydWllcnlqb3NkaWZoeXc3ODQ1NnJ5d2VocmZldWs9Iiwid2Vic2l0ZUlkIjogNTAsImZvcm1JZCI6IG51bGwsImZvcm1UcmlnZ2VyVHlwZSI6IG51bGwsImthbXB5bGVfZGF0YSI6IHsibWRfaXNTdXJ2ZXlTdWJtaXR0ZWRJblNlc3Npb24iOiAiIiwiTEFTVF9JTlZJVEFUSU9OX1ZJRVciOiAiIiwiREVDTElORURfREFURSI6ICIiLCJrYW1weWxlSW52aXRlUHJlc2VudGVkIjogIiIsImthbXB5bGVfdXNlcmlkIjogIjEwZGItYjliMC0yYjI4LWIyYjItNDhjNy1mZWQzLTVjNGItYWYxMSIsImthbXB5bGVVc2VyU2Vzc2lvbiI6ICIxNjY0NzE1NzI0Nzc3Iiwia2FtcHlsZVVzZXJQZXJjZW50aWxlIjogIiIsIlNVQk1JVFRFRF9EQVRFIjogIiJ9LCJjb29raWVfc2l6ZSI6IDczNCwia2FtcHlsZV92ZXJzaW9uIjogIjIuNDcuMyIsIm9uc2l0ZV92ZXJzaW9uIjogIjIuNDcuMyIsImhpc3RvcnlfbGVuZ3RoIjogMiwiZXZlbnRfbG9jYWxfdGltZXN0YW1wIjogMTY2NDcxNTcyNDc4MSwicG9zaXRpb24iOiBudWxsLCJpc1VzZXJJZGVudGlmaWVkIjogZmFsc2UsImZlZWRiYWNrX2NvcnJlbGF0aW9uX3V1aWQiOiBudWxsfQpdfQ==
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.241.45.82 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 82.45.241.35.bc.googleusercontent.com
Software: Jetty(9.2.11.v20150529) /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://5damah.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

x-me: prod-instance-gatewayservice-blue-9777
date: Sun, 02 Oct 2022 13:02:04 GMT
via: 1.1 google
server: Jetty(9.2.11.v20150529)
access-control-max-age: 1800
access-control-allow-methods: GET, POST, PUT, DELETE
content-type: image/gif; charset=UTF-8
access-control-allow-origin: *
access-control-allow-credentials: true
alt-svc: clear
access-control-allow-headers: X-Requested-With, Origin, Content-Type, Accept
content-length: 0
x-application-context: application:9090

GET
H2 200 pp.html Show response
cdn.pbbl.co/i/ Frame DAD2 27 KB
7 KB 64ms
64ms Document
text/html 65.8.49.17
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.pbbl.co/i/pp.html
Requested by: Host: cdn.pbbl.co
URL: https://cdn.pbbl.co/r/1560.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 65.8.49.17 Pompano Beach, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-65-8-49-17.ord52.r.cloudfront.net
Software: nginx/1.20.1 /
Resource Hash: 37fd2cab060aec0691991303de430f904823dc21a9d05ac4984c899798ee1a89

Request headers

Referer: https://5damah.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36
accept-language: en-CA,en;q=0.9

Response headers

content-encoding: gzip
content-type: text/html
date: Sun, 02 Oct 2022 13:02:04 GMT
etag: W/"5f7c8ffc-6ca7"
last-modified: Tue, 06 Oct 2020 15:40:44 GMT
server: nginx/1.20.1
vary: Accept-Encoding Origin
via: 1.1 a497b0eefe66dc6fa9e24b5f51d2ab42.cloudfront.net (CloudFront)
x-amz-cf-id: 5IJjhaxSXO0WVnaXhNaPdaGltQNBOALM-JbZPV9z42U5orQ-_5di4A==
x-amz-cf-pop: ORD52-C3
x-cache: RefreshHit from cloudfront

GET
H3 200 conversion_async.js Show response
www.googleadservices.com/pagead/ 41 KB
15 KB 43ms
43ms Script
text/javascript 142.251.35.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googleadservices.com/pagead/conversion_async.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-959299794&l=dataLayer&cx=c

Protocol

Security

QUIC, , AES_128_GCM

Server

142.251.35.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga25s78-in-f2.1e100.net

Software

cafe /

Resource Hash

f42283e0ca17a52688c5250e714ecd1b6a53af8b0f6e54ac64546499b0ec1b19

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://5damah.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

date: Sun, 02 Oct 2022 13:02:04 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15192
x-xss-protection: 0
server: cafe
etag: 699633608045481581
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600
timing-allow-origin: *
expires: Sun, 02 Oct 2022 13:02:04 GMT

GET
H3 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/960621875/ 2 KB
1 KB 149ms
105ms Script
text/javascript 2607:f8b0:4006:816::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/960621875/?random=1664715724882&cv=9&fst=1664715724882&num=1&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa9s0&sendb=1&ig=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2F5damah.com%2Fappp%2Fonline%2Fciti.com%2FUS%2Flogin.do.html%3Fjdsh47wryfhoduetoealshfilw4yrledyuwruieryjosdifhyw78456rywehrfeuk%3D&tiba=Banking%20with%20Citi%20%7C%20Citi.com&auid=1573934486.1664715724&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4

Requested by

Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/conversion_async.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:816::2002 Rockville, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a4159bf1f2c0ede01cef66923ff294eee5978cefd0ea9b5b1fb3ea0f8665af40

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://5damah.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 02 Oct 2022 13:02:04 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1118
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/916451471/ 2 KB
1 KB 154ms
116ms Script
text/javascript 2607:f8b0:4006:816::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/916451471/?random=1664715724887&cv=9&fst=1664715724887&num=1&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa9s0&sendb=1&ig=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2F5damah.com%2Fappp%2Fonline%2Fciti.com%2FUS%2Flogin.do.html%3Fjdsh47wryfhoduetoealshfilw4yrledyuwruieryjosdifhyw78456rywehrfeuk%3D&tiba=Banking%20with%20Citi%20%7C%20Citi.com&auid=1573934486.1664715724&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4

Requested by

Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/conversion_async.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:816::2002 Rockville, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

c659fab2482584faec137cf1e9c1b2cdec20814ef22e4766c01e99ebf39084f0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://5damah.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 02 Oct 2022 13:02:04 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1115
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/830907969/ 2 KB
1 KB 112ms
74ms Script
text/javascript 2607:f8b0:4006:816::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/830907969/?random=1664715724888&cv=9&fst=1664715724888&num=1&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa9s0&sendb=1&ig=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2F5damah.com%2Fappp%2Fonline%2Fciti.com%2FUS%2Flogin.do.html%3Fjdsh47wryfhoduetoealshfilw4yrledyuwruieryjosdifhyw78456rywehrfeuk%3D&tiba=Banking%20with%20Citi%20%7C%20Citi.com&auid=1573934486.1664715724&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4

Requested by

Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/conversion_async.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:816::2002 Rockville, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

763317a010a476d678d62dc77f526b6c3387f455d2b53f4fc0595c24218df61c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://5damah.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 02 Oct 2022 13:02:04 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1120
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/644574043/ 2 KB
1 KB 118ms
111ms Script
text/javascript 2607:f8b0:4006:816::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/644574043/?random=1664715724991&cv=9&fst=1664715724991&num=1&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa9s0&sendb=1&ig=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2F5damah.com%2Fappp%2Fonline%2Fciti.com%2FUS%2Flogin.do.html%3Fjdsh47wryfhoduetoealshfilw4yrledyuwruieryjosdifhyw78456rywehrfeuk%3D&tiba=Banking%20with%20Citi%20%7C%20Citi.com&auid=1573934486.1664715724&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4

Requested by

Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/conversion_async.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:816::2002 Rockville, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

f0fa175b8f429fef8cf665c9031bbed33be4e9ad84c70e057c4ff16f41d53a0d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://5damah.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 02 Oct 2022 13:02:05 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1118
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/975701947/ 2 KB
1 KB 207ms
206ms Script
text/javascript 2607:f8b0:4006:816::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/975701947/?random=1664715724994&cv=9&fst=1664715724994&num=1&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa9s0&sendb=1&ig=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2F5damah.com%2Fappp%2Fonline%2Fciti.com%2FUS%2Flogin.do.html%3Fjdsh47wryfhoduetoealshfilw4yrledyuwruieryjosdifhyw78456rywehrfeuk%3D&tiba=Banking%20with%20Citi%20%7C%20Citi.com&auid=1573934486.1664715724&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4

Requested by

Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/conversion_async.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:816::2002 Rockville, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

9946957daad91b20f6a146b28608a2ece3efbd7bb2f7e579e75489c047eb5148

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://5damah.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 02 Oct 2022 13:02:05 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1119
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/959299794/ 2 KB
1 KB 114ms
113ms Script
text/javascript 2607:f8b0:4006:816::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/959299794/?random=1664715724997&cv=9&fst=1664715724997&num=1&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa9s0&sendb=1&ig=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2F5damah.com%2Fappp%2Fonline%2Fciti.com%2FUS%2Flogin.do.html%3Fjdsh47wryfhoduetoealshfilw4yrledyuwruieryjosdifhyw78456rywehrfeuk%3D&tiba=Banking%20with%20Citi%20%7C%20Citi.com&auid=1573934486.1664715724&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4

Requested by

Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/conversion_async.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:816::2002 Rockville, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d0abe3644483efd817d49834c6bdb2d14d787536c925eb896d1872e94317e19e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://5damah.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 02 Oct 2022 13:02:05 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1118
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/695231162/ 2 KB
1 KB 104ms
103ms Script
text/javascript 2607:f8b0:4006:816::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/695231162/?random=1664715724998&cv=9&fst=1664715724998&num=1&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa9s0&sendb=1&ig=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2F5damah.com%2Fappp%2Fonline%2Fciti.com%2FUS%2Flogin.do.html%3Fjdsh47wryfhoduetoealshfilw4yrledyuwruieryjosdifhyw78456rywehrfeuk%3D&tiba=Banking%20with%20Citi%20%7C%20Citi.com&auid=1573934486.1664715724&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4

Requested by

Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/conversion_async.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:816::2002 Rockville, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

18246093e94d64149bd87ca2f6f929b51cefec4114acc08a7b4b9fb15161559b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://5damah.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 02 Oct 2022 13:02:05 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1119
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/819500023/ 2 KB
1 KB 98ms
97ms Script
text/javascript 2607:f8b0:4006:816::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/819500023/?random=1664715725000&cv=9&fst=1664715725000&num=1&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa9s0&sendb=1&ig=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2F5damah.com%2Fappp%2Fonline%2Fciti.com%2FUS%2Flogin.do.html%3Fjdsh47wryfhoduetoealshfilw4yrledyuwruieryjosdifhyw78456rywehrfeuk%3D&tiba=Banking%20with%20Citi%20%7C%20Citi.com&auid=1573934486.1664715724&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4

Requested by

Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/conversion_async.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:816::2002 Rockville, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

1fa45fa314ac24e6ac48b7c3b299f68ab740dc3d5b0c226b66d087f7f6e8229a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://5damah.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 02 Oct 2022 13:02:05 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1115
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/10955006959/ 2 KB
1 KB 45ms
45ms Script
text/javascript 2607:f8b0:4006:816::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/10955006959/?random=1664715725002&cv=9&fst=1664715725002&num=1&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa9s0&sendb=1&ig=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2F5damah.com%2Fappp%2Fonline%2Fciti.com%2FUS%2Flogin.do.html%3Fjdsh47wryfhoduetoealshfilw4yrledyuwruieryjosdifhyw78456rywehrfeuk%3D&tiba=Banking%20with%20Citi%20%7C%20Citi.com&auid=1573934486.1664715724&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4

Requested by

Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/conversion_async.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:816::2002 Rockville, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

6992f2b35e891d38f7753c87f8a8d9c58d8ee6f5018032e5e2e6a8414dac02c0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://5damah.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 02 Oct 2022 13:02:05 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1119
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

adadvisor.gif
px0.pbbl.co/
Redirect Chain

https://px0.pbbl.co/ns/__p2.gif?ppid=b43335de-325f-46ae-a310-bf456c895b4c&chk=false&brid=1560&brcid=&email=&orderId=&orderValue=&productId=&offerCode=&label=&pageUrl=https%3A%2F%2F5damah.com%2Fappp...
https://aa.agkn.com/adscores/g.pixel?sid=9212282598&_ppid=b43335de-325f-46ae-a310-bf456c895b4c&_segid=99&iid=1efa811d-b197-426c-8e0d-a7bdc02b0d6c&pni4=d55e19f59e77bc8a569ef3a827b58c007f074b89ef3fcc...
https://px0.pbbl.co/adadvisor.gif?segment=000&_ppid=b43335de-325f-46ae-a310-bf456c895b4c&_segid=99&_zip=&hk=&iid=1efa811d-b197-426c-8e0d-a7bdc02b0d6c&mt=&bd=&cb=1664715725337

42 B
132 B

66ms
65ms

Image
image/gif

142.250.64.83
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://px0.pbbl.co/adadvisor.gif?segment=000&_ppid=b43335de-325f-46ae-a310-bf456c895b4c&_segid=99&_zip=&hk=&iid=1efa811d-b197-426c-8e0d-a7bdc02b0d6c&mt=&bd=&cb=1664715725337

Protocol

Server

142.250.64.83 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lga34s30-in-f19.1e100.net

Software

Google Frontend /

Resource Hash

99c2917ee5b2a01459a923bdd1c676f15ee73b62b87f696e6735312d26f51e12

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://5damah.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 02 Oct 2022 13:02:05 GMT
x-content-type-options: nosniff
server: Google Frontend
content-type: image/gif
x-cloud-trace-context: 161bbeff57941f4f1fc6ba62843d1d8e
cache-control: must-revalidate, no-cache, no-store
content-length: 42
x-xss-protection: 1
expires: 0

Redirect headers

pragma: no-cache
date: Sun, 02 Oct 2022 13:02:05 GMT
via: 1.1 62cb87f302ffda6aad8c50cfc260c97a.cloudfront.net (CloudFront)
server: AAWebServer
x-amz-cf-pop: ORD51-C4
access-control-allow-methods: GET, POST, OPTIONS
p3p: policyref="https://www.agkn.com/p3p/p3p.xml",CP="NOI NID"
location: https://px0.pbbl.co/adadvisor.gif?segment=000&_ppid=b43335de-325f-46ae-a310-bf456c895b4c&_segid=99&_zip=&hk=&iid=1efa811d-b197-426c-8e0d-a7bdc02b0d6c&mt=&bd=&cb=1664715725337
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
x-cache: Miss from cloudfront
access-control-allow-headers: accept, cache-control, origin, x-requested-with, x-file-name, content-type
x-amz-cf-id: pY8IEiGD5YsgkTdfQq24nUzfeB6UTjulMWeLOydy56XAURUH6IbXvw==
expires: 0

GET
H3 200 /
www.google.com/pagead/1p-user-list/830907969/ 42 B
64 B 50ms
50ms Image
image/gif 2607:f8b0:4006:81c::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/830907969/?random=1664715724888&cv=9&fst=1664715600000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa9s0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2F5damah.com%2Fappp%2Fonline%2Fciti.com%2FUS%2Flogin.do.html%3Fjdsh47wryfhoduetoealshfilw4yrledyuwruieryjosdifhyw78456rywehrfeuk%3D&tiba=Banking%20with%20Citi%20%7C%20Citi.com&async=1&fmt=3&is_vtc=1&random=3615917432&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81c::2004 Rockville, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://5damah.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 02 Oct 2022 13:02:05 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 /
www.google.ca/pagead/1p-user-list/830907969/ 42 B
64 B 99ms
57ms Image
image/gif 2607:f8b0:4006:820::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.ca/pagead/1p-user-list/830907969/?random=1664715724888&cv=9&fst=1664715600000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa9s0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2F5damah.com%2Fappp%2Fonline%2Fciti.com%2FUS%2Flogin.do.html%3Fjdsh47wryfhoduetoealshfilw4yrledyuwruieryjosdifhyw78456rywehrfeuk%3D&tiba=Banking%20with%20Citi%20%7C%20Citi.com&async=1&fmt=3&is_vtc=1&random=3615917432&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:820::2003 Rockville, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://5damah.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 02 Oct 2022 13:02:05 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 /
www.google.com/pagead/1p-user-list/960621875/ 42 B
64 B 53ms
53ms Image
image/gif 2607:f8b0:4006:81c::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/960621875/?random=1664715724882&cv=9&fst=1664715600000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa9s0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2F5damah.com%2Fappp%2Fonline%2Fciti.com%2FUS%2Flogin.do.html%3Fjdsh47wryfhoduetoealshfilw4yrledyuwruieryjosdifhyw78456rywehrfeuk%3D&tiba=Banking%20with%20Citi%20%7C%20Citi.com&async=1&fmt=3&is_vtc=1&random=604703207&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81c::2004 Rockville, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://5damah.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 02 Oct 2022 13:02:05 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 /
www.google.ca/pagead/1p-user-list/960621875/ 42 B
64 B 71ms
42ms Image
image/gif 2607:f8b0:4006:820::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.ca/pagead/1p-user-list/960621875/?random=1664715724882&cv=9&fst=1664715600000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa9s0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2F5damah.com%2Fappp%2Fonline%2Fciti.com%2FUS%2Flogin.do.html%3Fjdsh47wryfhoduetoealshfilw4yrledyuwruieryjosdifhyw78456rywehrfeuk%3D&tiba=Banking%20with%20Citi%20%7C%20Citi.com&async=1&fmt=3&is_vtc=1&random=604703207&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:820::2003 Rockville, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://5damah.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 02 Oct 2022 13:02:05 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 /
www.google.com/pagead/1p-user-list/916451471/ 42 B
64 B 54ms
53ms Image
image/gif 2607:f8b0:4006:81c::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/916451471/?random=1664715724887&cv=9&fst=1664715600000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa9s0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2F5damah.com%2Fappp%2Fonline%2Fciti.com%2FUS%2Flogin.do.html%3Fjdsh47wryfhoduetoealshfilw4yrledyuwruieryjosdifhyw78456rywehrfeuk%3D&tiba=Banking%20with%20Citi%20%7C%20Citi.com&async=1&fmt=3&is_vtc=1&random=1560996479&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81c::2004 Rockville, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://5damah.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 02 Oct 2022 13:02:05 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 /
www.google.ca/pagead/1p-user-list/916451471/ 42 B
64 B 67ms
40ms Image
image/gif 2607:f8b0:4006:820::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.ca/pagead/1p-user-list/916451471/?random=1664715724887&cv=9&fst=1664715600000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa9s0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2F5damah.com%2Fappp%2Fonline%2Fciti.com%2FUS%2Flogin.do.html%3Fjdsh47wryfhoduetoealshfilw4yrledyuwruieryjosdifhyw78456rywehrfeuk%3D&tiba=Banking%20with%20Citi%20%7C%20Citi.com&async=1&fmt=3&is_vtc=1&random=1560996479&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:820::2003 Rockville, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://5damah.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 02 Oct 2022 13:02:05 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 /
www.google.com/pagead/1p-user-list/10955006959/ 42 B
64 B 54ms
53ms Image
image/gif 2607:f8b0:4006:81c::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/10955006959/?random=1664715725002&cv=9&fst=1664715600000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa9s0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2F5damah.com%2Fappp%2Fonline%2Fciti.com%2FUS%2Flogin.do.html%3Fjdsh47wryfhoduetoealshfilw4yrledyuwruieryjosdifhyw78456rywehrfeuk%3D&tiba=Banking%20with%20Citi%20%7C%20Citi.com&async=1&fmt=3&is_vtc=1&random=2948819943&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81c::2004 Rockville, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://5damah.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 02 Oct 2022 13:02:05 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 /
www.google.ca/pagead/1p-user-list/10955006959/ 42 B
64 B 62ms
41ms Image
image/gif 2607:f8b0:4006:820::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.ca/pagead/1p-user-list/10955006959/?random=1664715725002&cv=9&fst=1664715600000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa9s0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2F5damah.com%2Fappp%2Fonline%2Fciti.com%2FUS%2Flogin.do.html%3Fjdsh47wryfhoduetoealshfilw4yrledyuwruieryjosdifhyw78456rywehrfeuk%3D&tiba=Banking%20with%20Citi%20%7C%20Citi.com&async=1&fmt=3&is_vtc=1&random=2948819943&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:820::2003 Rockville, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://5damah.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 02 Oct 2022 13:02:05 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 /
www.google.com/pagead/1p-user-list/819500023/ 42 B
64 B 54ms
53ms Image
image/gif 2607:f8b0:4006:81c::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/819500023/?random=1664715725000&cv=9&fst=1664715600000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa9s0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2F5damah.com%2Fappp%2Fonline%2Fciti.com%2FUS%2Flogin.do.html%3Fjdsh47wryfhoduetoealshfilw4yrledyuwruieryjosdifhyw78456rywehrfeuk%3D&tiba=Banking%20with%20Citi%20%7C%20Citi.com&async=1&fmt=3&is_vtc=1&random=284286085&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81c::2004 Rockville, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://5damah.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 02 Oct 2022 13:02:05 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 /
www.google.ca/pagead/1p-user-list/819500023/ 42 B
64 B 42ms
42ms Image
image/gif 2607:f8b0:4006:820::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.ca/pagead/1p-user-list/819500023/?random=1664715725000&cv=9&fst=1664715600000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa9s0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2F5damah.com%2Fappp%2Fonline%2Fciti.com%2FUS%2Flogin.do.html%3Fjdsh47wryfhoduetoealshfilw4yrledyuwruieryjosdifhyw78456rywehrfeuk%3D&tiba=Banking%20with%20Citi%20%7C%20Citi.com&async=1&fmt=3&is_vtc=1&random=284286085&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:820::2003 Rockville, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://5damah.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 02 Oct 2022 13:02:05 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 /
www.google.com/pagead/1p-user-list/695231162/ 42 B
64 B 51ms
51ms Image
image/gif 2607:f8b0:4006:81c::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/695231162/?random=1664715724998&cv=9&fst=1664715600000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa9s0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2F5damah.com%2Fappp%2Fonline%2Fciti.com%2FUS%2Flogin.do.html%3Fjdsh47wryfhoduetoealshfilw4yrledyuwruieryjosdifhyw78456rywehrfeuk%3D&tiba=Banking%20with%20Citi%20%7C%20Citi.com&async=1&fmt=3&is_vtc=1&random=3201939607&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81c::2004 Rockville, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://5damah.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 02 Oct 2022 13:02:05 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 /
www.google.ca/pagead/1p-user-list/695231162/ 42 B
64 B 39ms
39ms Image
image/gif 2607:f8b0:4006:820::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.ca/pagead/1p-user-list/695231162/?random=1664715724998&cv=9&fst=1664715600000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa9s0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2F5damah.com%2Fappp%2Fonline%2Fciti.com%2FUS%2Flogin.do.html%3Fjdsh47wryfhoduetoealshfilw4yrledyuwruieryjosdifhyw78456rywehrfeuk%3D&tiba=Banking%20with%20Citi%20%7C%20Citi.com&async=1&fmt=3&is_vtc=1&random=3201939607&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:820::2003 Rockville, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://5damah.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 02 Oct 2022 13:02:05 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 /
www.google.com/pagead/1p-user-list/644574043/ 42 B
64 B 50ms
48ms Image
image/gif 2607:f8b0:4006:81c::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/644574043/?random=1664715724991&cv=9&fst=1664715600000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa9s0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2F5damah.com%2Fappp%2Fonline%2Fciti.com%2FUS%2Flogin.do.html%3Fjdsh47wryfhoduetoealshfilw4yrledyuwruieryjosdifhyw78456rywehrfeuk%3D&tiba=Banking%20with%20Citi%20%7C%20Citi.com&async=1&fmt=3&is_vtc=1&random=2705596541&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81c::2004 Rockville, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://5damah.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 02 Oct 2022 13:02:05 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 /
www.google.ca/pagead/1p-user-list/644574043/ 42 B
64 B 41ms
39ms Image
image/gif 2607:f8b0:4006:820::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.ca/pagead/1p-user-list/644574043/?random=1664715724991&cv=9&fst=1664715600000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa9s0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2F5damah.com%2Fappp%2Fonline%2Fciti.com%2FUS%2Flogin.do.html%3Fjdsh47wryfhoduetoealshfilw4yrledyuwruieryjosdifhyw78456rywehrfeuk%3D&tiba=Banking%20with%20Citi%20%7C%20Citi.com&async=1&fmt=3&is_vtc=1&random=2705596541&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:820::2003 Rockville, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://5damah.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 02 Oct 2022 13:02:05 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 /
www.google.com/pagead/1p-user-list/959299794/ 42 B
64 B 58ms
57ms Image
image/gif 2607:f8b0:4006:81c::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/959299794/?random=1664715724997&cv=9&fst=1664715600000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa9s0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2F5damah.com%2Fappp%2Fonline%2Fciti.com%2FUS%2Flogin.do.html%3Fjdsh47wryfhoduetoealshfilw4yrledyuwruieryjosdifhyw78456rywehrfeuk%3D&tiba=Banking%20with%20Citi%20%7C%20Citi.com&async=1&fmt=3&is_vtc=1&random=3642475305&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81c::2004 Rockville, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://5damah.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 02 Oct 2022 13:02:05 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 /
www.google.ca/pagead/1p-user-list/959299794/ 42 B
64 B 41ms
41ms Image
image/gif 2607:f8b0:4006:820::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.ca/pagead/1p-user-list/959299794/?random=1664715724997&cv=9&fst=1664715600000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa9s0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2F5damah.com%2Fappp%2Fonline%2Fciti.com%2FUS%2Flogin.do.html%3Fjdsh47wryfhoduetoealshfilw4yrledyuwruieryjosdifhyw78456rywehrfeuk%3D&tiba=Banking%20with%20Citi%20%7C%20Citi.com&async=1&fmt=3&is_vtc=1&random=3642475305&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:820::2003 Rockville, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://5damah.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 02 Oct 2022 13:02:05 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 /
www.google.com/pagead/1p-user-list/975701947/ 42 B
64 B 53ms
52ms Image
image/gif 2607:f8b0:4006:81c::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/975701947/?random=1664715724994&cv=9&fst=1664715600000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa9s0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2F5damah.com%2Fappp%2Fonline%2Fciti.com%2FUS%2Flogin.do.html%3Fjdsh47wryfhoduetoealshfilw4yrledyuwruieryjosdifhyw78456rywehrfeuk%3D&tiba=Banking%20with%20Citi%20%7C%20Citi.com&async=1&fmt=3&is_vtc=1&random=2314646684&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:81c::2004 Rockville, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://5damah.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 02 Oct 2022 13:02:05 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 /
www.google.ca/pagead/1p-user-list/975701947/ 42 B
64 B 41ms
41ms Image
image/gif 2607:f8b0:4006:820::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.ca/pagead/1p-user-list/975701947/?random=1664715724994&cv=9&fst=1664715600000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa9s0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2F5damah.com%2Fappp%2Fonline%2Fciti.com%2FUS%2Flogin.do.html%3Fjdsh47wryfhoduetoealshfilw4yrledyuwruieryjosdifhyw78456rywehrfeuk%3D&tiba=Banking%20with%20Citi%20%7C%20Citi.com&async=1&fmt=3&is_vtc=1&random=2314646684&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y

Protocol

Security

QUIC, , AES_128_GCM

Server

2607:f8b0:4006:820::2003 Rockville, United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: en-CA,en;q=0.9
Referer: https://5damah.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.61 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 02 Oct 2022 13:02:05 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: cyseal.cyveillance.com
URL: https://cyseal.cyveillance.com/SiteSeal/cyss.js?ref=online.citi.com

Domain: steps.citi.com
URL: https://steps.citi.com/us/LOInm?d=JTVCJTdCJTIyaWQlMjIlM0ElMjI0JTIyJTJDJTIyZGF0YSUyMiUzQSU3QiUyMnMlMjIlM0ElMjJDQk9MJTNBMTcxMjI4MDQwMjEwNDQzOTU4MDcyOTc5JTIyJTdEJTdEJTVE&cid=4&si=2&e=https%3A%2F%2Fonline.citi.com&LSESSIONID=jLd1p68f4oImeCmELBwq2DgLpPOSpXvZVkG4EXavFtPX08UvN8F3682k&t=jsonp&c=wzrabxstssonkpzt&eu=https%3A%2F%2Fonline.citi.com%2FUS%2Flogin.do%3FJFP_TOKEN%3D906KF3PT

Domain: cyseal.cyveillance.com
URL: https://cyseal.cyveillance.com/SiteSeal/siteseal2p.async.js

Domain: steps.citi.com
URL: https://steps.citi.com/us/navigation.js

Domain: paper.citi.com
URL: https://paper.citi.com/127893/style4.js?r=0.18233068905379501

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Citibank (Banking)

381 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

29 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.youtube.com/	1969-12-31 23:59:59	Name: YSC Value: eR4mfx_a7rA
.youtube.com/	1970-01-20 10:44:27	Name: VISITOR_INFO1_LIVE Value: z0T6RK83Wqc
.demdex.net/	1970-01-20 10:44:27	Name: demdex Value: 73485228668894743311560514939524784954
.rlcdn.com/	1970-01-20 07:51:39	Name: pxrc Value: CMuX5pkGEgUI6AcQABIGCPzdKhAA
5damah.com/	1969-12-31 23:59:59	Name: AMCVS_61834D9B5228A7430A490D45%40AdobeOrg Value: 1
.google.com/	1970-01-20 10:48:46	Name: NID Value: 511=YsBNg51FnW-kgj_0C3pZHXu7KGo32oMnTc4Y0wzJ9EtdKvXcQWNrzhApxwZyzb4b6-eXRQLAfotX4uqJqIJEUdE06dGAEdBXabaSy0Z2kq4q1v0KXCYDOlVGc3z5n9w031u-HR_7lHiHXEeiFo0O3EHdWh5lfzwyLtZnwoCTGFA
.citi.com/	1970-01-20 16:01:15	Name: s_vi Value: [CS]v1\|319CC5E5A0D10C26-40001D50BE65AB08[CE]
.citi.com/	1970-01-20 16:01:15	Name: s_ecid Value: MCMID%7C78071753791149487922020860764063701657
5damah.com/	1970-01-20 15:10:51	Name: count Value: 1
mpsnare.iesnare.com/	1970-01-20 15:10:51	Name: io_token_7c6a6574-f011-4c9a-abdd-9894a102ccef Value: RCs+DIMziQSrTtSq9QOQEg0QHNCM2nF42cnfOkrE2M8=
cardoffer.citicards.com/	1969-12-31 23:59:59	Name: axDP Value: ts:1664715723993:Xc6023IuVpyo1Uwh3hbBPbns_lg3zzYnEIhQZTqQrsSF4WKjE
cardoffer.citicards.com/	1969-12-31 23:59:59	Name: axDS Value: ts:1664715723993:3c5ad4793b9949d4b8e64c08a6b6672f
.everesttech.net/	1970-01-20 15:10:51	Name: everest_g_v2 Value: g_surferid~YzmLzAAAAGr_dQNw
.doubleclick.net/	1970-01-20 15:46:51	Name: IDE Value: AHWqTUlL7bEbZNPFPLCO_r-ytoiAkP1IrHlJ1xROg0CjlaXXpNsbRg5fvvP2anZvXOQ
5damah.com/	1970-01-20 06:25:17	Name: 7830 Value: error
5damah.com/	1970-01-20 06:25:17	Name: 7018 Value:
5damah.com/	1970-01-20 08:34:51	Name: 64072 Value:
.dpm.demdex.net/	1970-01-20 10:44:27	Name: dpm Value: 73485228668894743311560514939524784954
5damah.com/	1970-01-20 16:01:15	Name: AMCV_61834D9B5228A7430A490D45%40AdobeOrg Value: -330454231%7CMCIDTS%7C19268%7CMCMID%7C78071753791149487922020860764063701657%7CMCAAMLH-1665320524%7C7%7CMCAAMB-1665320524%7CRKhpRz8krg2tLO6pguXWp5olkAcUniQYPHaMWWgdJ3xzPWQmdj0y%7CMCOPTOUT-1664722923s%7CNONE%7CMCAID%7C319CC5E5A0D10C26-40001D50BE65AB08%7CMCSYNCSOP%7C411-19275%7CvVersion%7C3.1.2
.rfihub.com/	1969-12-31 23:59:59	Name: ruds Value: H4sIAAAAAAAA_-MSNjS3NDeysDA0NDOxNDQ1NTU2MhXiM9StDE80Mqyy8PAM8o4AAGG7MDwlAAAA
.rfihub.com/	1970-01-20 15:46:51	Name: rud Value: H4sIAAAAAAAA_-MSNjS3NDeysDA0NDOxNDQ1NTU2MhXiM9StDE80Mqyy8PAM8o4AAGG7MDwlAAAA
.5damah.com/	1970-01-20 08:34:51	Name: _gcl_au Value: 1.1.1573934486.1664715724
.rlcdn.com/	1970-01-20 15:10:51	Name: rlas3 Value: NJd0QfW9ACplGprF4nJfT/HOFPD9AKGsIbJzMNbrSHM=
5damah.com/	1970-01-20 15:10:51	Name: mdLogger Value: false
5damah.com/	1970-01-20 15:10:51	Name: kampyle_userid Value: 10db-b9b0-2b28-b2b2-48c7-fed3-5c4b-af11
5damah.com/	1970-01-20 15:10:51	Name: kampyleUserSession Value: 1664715724777
5damah.com/	1970-01-20 15:10:51	Name: kampyleUserSessionsCount Value: 1
5damah.com/	1970-01-20 15:10:51	Name: kampyleSessionPageCounter Value: 1
.agkn.com/	1970-01-20 15:10:51	Name: ab Value: 0001%3AVCHuRG3IDQ824vz19OfPm3dX3Kpr%2FUD%2F

14 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://www.google.com/uds/api/search/1.0/4368fa9a9824ad4f837cbd399d21811d/default+en.css Message: Failed to load resource: the server responded with a status of 404 ()
network	error	URL: https://www.google.com/uds/api/search/1.0/4368fa9a9824ad4f837cbd399d21811d/default+en.I.js Message: Failed to load resource: the server responded with a status of 404 ()
network	error	URL: https://steps.citi.com/us/LOInm?d=JTVCJTdCJTIyaWQlMjIlM0ElMjI0JTIyJTJDJTIyZGF0YSUyMiUzQSU3QiUyMnMlMjIlM0ElMjJDQk9MJTNBMTcxMjI4MDQwMjEwNDQzOTU4MDcyOTc5JTIyJTdEJTdEJTVE&cid=4&si=2&e=https%3A%2F%2Fonline.citi.com&LSESSIONID=jLd1p68f4oImeCmELBwq2DgLpPOSpXvZVkG4EXavFtPX08UvN8F3682k&t=jsonp&c=wzrabxstssonkpzt&eu=https%3A%2F%2Fonline.citi.com%2FUS%2Flogin.do%3FJFP_TOKEN%3D906KF3PT Message: Failed to load resource: net::ERR_NAME_NOT_RESOLVED
network	error	URL: https://5damah.com/GFC/branding/olab/js/oo_engine.min.js Message: Failed to load resource: the server responded with a status of 404 (Not Found)
network	error	URL: https://5damah.com/GFC/branding/responsivebranding/js/main.js Message: Failed to load resource: the server responded with a status of 404 (Not Found)
network	error	URL: https://5damah.com/CBOL/common/ui/ddl/theme/latest/scripts/ddl.min.js Message: Failed to load resource: the server responded with a status of 404 (Not Found)
network	error	URL: https://5damah.com/JEA/CitiSearch/nexus-platform/js/citilive-search.js Message: Failed to load resource: the server responded with a status of 404 (Not Found)
network	error	URL: https://paper.citi.com/127893/style4.js?r=0.18233068905379501 Message: Failed to load resource: net::ERR_NAME_NOT_RESOLVED
network	error	URL: https://steps.citi.com/us/navigation.js Message: Failed to load resource: net::ERR_NAME_NOT_RESOLVED
network	error	URL: https://5damah.com/NCCS/smartSearch/js/cbol-smartSearch-inject.js Message: Failed to load resource: the server responded with a status of 404 (Not Found)
other	warning	URL: https://5damah.com/appp/online/citi.com/US/login.do.html?jdsh47wryfhoduetoealshfilw4yrledyuwruieryjosdifhyw78456rywehrfeuk=(Line 71) Message: The AudioContext was not allowed to start. It must be resumed (or created) after a user gesture on the page. https://goo.gl/7K7WLu
network	error	URL: https://www.google.com/sorry/index?continue=https://cse.google.com/cse/cse.js%3Fcx%3D009695499870347544712:e3dyicpbrwu&q=EhAmB1MAAGB4ZwAAAAAAAAAGGMuX5pkGIhBBmt1QDHTUvcZUve9Qp19VMgFy Message: Failed to load resource: the server responded with a status of 429 ()
network	error	URL: https://cyseal.cyveillance.com/SiteSeal/cyss.js?ref=online.citi.com Message: Failed to load resource: net::ERR_NAME_NOT_RESOLVED
network	error	URL: https://cyseal.cyveillance.com/SiteSeal/siteseal2p.async.js Message: Failed to load resource: net::ERR_NAME_NOT_RESOLVED

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

20766699p.rfihub.com
5damah.com
6260004.fls.doubleclick.net
6269322.fls.doubleclick.net
6417343.fls.doubleclick.net
aa.agkn.com
adservice.google.com
c1.rfihub.net
cardoffer.citicards.com
cdn.pbbl.co
cdn.tt.omtrdc.net
citi.demdex.net
citicorpcreditservic.tt.omtrdc.net
cm.everesttech.net
connect.facebook.net
cse.google.com
cyseal.cyveillance.com
dpm.demdex.net
googleads.g.doubleclick.net
id.rlcdn.com
metrics1.citi.com
mpsnare.iesnare.com
nexus.ensighten.com
online.citi.com
paper.citi.com
px0.pbbl.co
resources.digital-cloud-citi.medallia.com
s.ytimg.com
sr.rlcdn.com
steps.citi.com
udc-neb.kampyle.com
www.google.ca
www.google.com
www.googleadservices.com
www.googletagmanager.com
www.gstatic.com
www.youtube.com
cyseal.cyveillance.com
paper.citi.com
steps.citi.com
13.249.141.26
142.250.176.198
142.250.64.83
142.251.35.162
149.56.92.220
151.101.129.230
198.160.105.95
199.38.167.131
23.21.145.8
23.217.42.185
2600:9000:21d5:8e00:12:601f:a940:93a1
2600:9000:2211:3000:1:76cf:fe80:93a1
2607:f8b0:4006:807::2008
2607:f8b0:4006:816::2002
2607:f8b0:4006:81c::2003
2607:f8b0:4006:81c::2004
2607:f8b0:4006:820::2003
2607:f8b0:4006:821::200e
2607:f8b0:4006:822::2002
2607:f8b0:4006:823::200e
2a03:2880:f012:10c:face:b00c:0:3
3.221.198.169
34.192.133.161
35.190.60.146
35.241.45.82
52.1.6.72
52.6.87.15
52.85.247.126
63.140.38.186
65.8.49.17
00a92494627ed8f758972b7dc47b3af186497c0637ea867a33fdb604c1548674
010e587a53e1759d6485cc0455ecae68ea668a65de20ae631bcbd5ef66352d5d
01f8f873a860696a5f2b0c8e22a3471bb81c5ac2ce40f85678bfba8dc030e1d7
03bdda2b417d8cff1b2c8293c02685fd1670ca563e5514d74bffc8cd5a108e04
052ae5d7723241f0a1439298b26beb4db53772b707b58fb707dfc30d5a22c029
06533625bc622bb13d112ea4841b9f255a517df9728cb836942a0ff3bf75aa5c
0bd3ccc27cf9be600088075633085caa59ffdc6226dd98603eee03baee986d7d
0cb1533713d352ed7f29ce8ae532a869600330bb5c3d3cd0c0305833870601eb
0ed28149098ff4c10fe73564f0808527cc9ab60e4abcab1f05a5d02588e6a9ad
139ee99bb2f4b004d29ce3a395e9713d096ce363dd84191cad3af3ced64044ef
18246093e94d64149bd87ca2f6f929b51cefec4114acc08a7b4b9fb15161559b
1c5391cd953f0795fdd58a4e26899f1952522101afc71b63de87f5f467c0d1a6
1fa45fa314ac24e6ac48b7c3b299f68ab740dc3d5b0c226b66d087f7f6e8229a
26246a1b6ffa7098469c2a9e6780bc7553a93580a0fa97d2f722af1b202daae9
297577d52fce5df45a53b1d2e06469f65ee1dcf2e9bfbc8e2f45dbd06a0de8b4
2aa4fa20701cdd6d8d56046069001186b5267e3ee7d0ef618ad2f4a683723e11
2f15a4d87cfccb86da939529d84e0dc6b8604965b380567520f806ab24ee5362
31b00ff4929696dfca06885da68e58c3e09f6ecb4ae0fe1ae287e99a3fd1f716
32ce20023478c2ca22d760035fd78d0e2c79ab75f70c5fe8bdca983095d0660f
37fd2cab060aec0691991303de430f904823dc21a9d05ac4984c899798ee1a89
391a023d72baa955ecf76cab22ad60f55607ba5b705e95ac7b982a4128e5d715
39f9aa83d18bd14b639b419f7dd9431ed76d37fca5f7b33b5912bee3c49905b6
3edfe42ec55550e6eee2cfff8b6395386d634d99bc5e4e7b969c3d82823461c8
3fca3de24621f0f10186594054444d608016297c2e853e548710b3521e42a609
4061018b43e420a8f4513629af7dc6c78465e9f9d42c13c97104c637c2480f25
4dc9ca6c56ae86b2c15cdcbed7193727a40855653dd2b5beaa4ee1d76fc39faf
4f918cd256712c03a1b88007176cabf623cc63740e919d35a217c18dc7ebe607
528bcc58380bd04b35b80f1534ebe30615d4dc1d84f14d2f864a168da6f2ee2c
55e066703c69d4d89a1f4d66794d474aa93d710624d8f807096bac17a7867b17
5857a6cd798ada2f0e714ec74b00bf8036be59a79d7d30b8acbbc09d06e7aabe
6142d15f288669d79b907827ba9be37711a266ef721cb22a330b3277723015fb
61eb086edee74d836ac3ff4cf7e7eefb28f97934c0e17748251e3db8d949c0b7
629b48196dcc270143a42ce57535b251c655617f8d510277d4a05306c426fd38
6643bb410c647786949016cd3032ea1ed824a5a17313a2216c115de612482a5a
665379a09f8a42dc7a727452a54ea72a08ab18a59aba966ec023aee7690fe438
690146b8ff7699810daa66f43ce7d006f74a143dea4a27bb0cb9c054dddadeee
697b072c2117429a39b04508eec77e28c0a26f16564c81c335f9a78e94b6692a
6992f2b35e891d38f7753c87f8a8d9c58d8ee6f5018032e5e2e6a8414dac02c0
6b9f611fbd81522583f3cb28238215688bf40866268e270ededf23e0f26d18d4
6c3d8811b83debec97459fd4a664c9f6dba5b40376fced578baf331f56dab05d
6d3001c9deac8cb1f88ea5254105f8d678de5532f1998a24eab1b59906eaf86b
701d2f9f02741b8429f4fb892b2b48c34a8a0f9189cb09013b2799031f22e484
756ddc953f8bc40ad7eeb3dcc72d1950a1bff45f205a4e53d979a370aa6ed62b
763317a010a476d678d62dc77f526b6c3387f455d2b53f4fc0595c24218df61c
7bea17a80a61ed0f54248b4ffc4c718f7c8ff2619742577a73591d62ce074da8
7cb24e06c00e47bb6bc6c38b935d6bc62817f656703387e4fb7591add96c7454
7df13706eaab8ce9a3dcd2a501f60bc66987c83834d07dfaf07ae56ef814c110
7ef97b12890fc6fee67f869c6e1f74b6719de7d66ac0d649c8d7386a80b4c30f
823c8dd9c2a03256be59aec2abf354b4d32371fc6e79b95b6f93d4d7b7a059c7
823db1b6cf4fe34956773f03a9b3e1c36d3a1fe1b609b1c1bd8730475bc6b81c
835477bb41eb0b1ed1271f1bf08192aaabde5a40a5d53e70ab5826fc45d5d120
8cda73e6a0e5533a80c6bf94cf5a7b2a0e399ea1c482399b11a21096a8081faa
90a92f4f18eb86634ee8a2bbd433d79de20262d5bcd52772b157b9ee30ba5446
90e2294facf36d8bf814d2c69ce6fe6f4fb87f1651c66e8b62ed8b4e63973719
91c5cb10f3cb331e0168f674b86f9ecf209a38b6763cb39da3aa6397971efabe
9946957daad91b20f6a146b28608a2ece3efbd7bb2f7e579e75489c047eb5148
99c2917ee5b2a01459a923bdd1c676f15ee73b62b87f696e6735312d26f51e12
9dad502247a8488c21ef5beb32aed1a78b17b748711bec817c472911f76b4ead
9e1aa3b46d82fb1fc803dbb1aa5bacb618bbafff98199bc178135e797b6f698d
a1907f85adbb4c0436ebc852398d1a9b397260d2eba9e49a6aea4c6a27beec11
a4159bf1f2c0ede01cef66923ff294eee5978cefd0ea9b5b1fb3ea0f8665af40
a45cbaff68050bac6bafd588588ee2434d6bb62dd95902d9359c53308331f47f
a8e61e5d2206d9cf57cb92dfd0d723fdc0b2eea3e69b11ed11270c1810323c5d
aa04a8b0e57ead0aa5ab793816b58772250bd6efdd01042f1bc7ccc4c20ec540
ad3e96cb4461ada912c601d7163ea04a2ce8b5021c82d77a1eb1c8c13f81c29d
b688553f6307375ea6d4b13072957090e51b97f0b2f41e608bdcef7350472393
bf8892a953595eb96b9ca68c5756849d404115dcf2ee9bf87e8b4e7b3cf8e650
c0d8671e209f009f9c1ad8153222f942087ec193b7e87f856e60971bd5424633
c3c994c3fe9bd4e055f6d0eb42067ecd6bdd3247e136bc22835b9882cfe77c61
c4581c4c4fc1ea27a31d43a5db2af0c9d3caba97e6201abfe8c1c254126b0e91
c659fab2482584faec137cf1e9c1b2cdec20814ef22e4766c01e99ebf39084f0
cc1f329f34c5f9f4c759b787ccc409241a8ffe8d13863a87cc9214e628b43cff
cc23ed6fa37ee5c404d8dc720360520d576d3732fa957152a9bc54958a1478fd
cc89636037cf1207e54f61f2525f40eb6378845b14fd3ec67602ae147e7651b8
ceb9592af76fd2eb1f5c8b1bb4ab734fd5571ad062f723e6d7029f5829f9281b
d08b0e82e4be24856001e584cef52bd6dc7461ca0e4c05963b52e4f58dd4449b
d0abe3644483efd817d49834c6bdb2d14d787536c925eb896d1872e94317e19e
d2751a84e6a70913798dd8b2aede47ab49b7a701618cd151d89755638f71aa02
d57c8034f9c12aa3ce626c9ed1d61a4bb0941c3ef320bb59346f20496fb0096a
dc5ba306fece552e3a002c8e18fa392c85acfa61091e1b98496b745f8ace6876
e035b79ab90f8c8ce0c5d34ae36fd666e84353307bdbf06ca62fdff8e77691dd
e2812b1e3529e5f39e3b0586e82c7ad0dfc3fc61cfa0107edfac16483d0547d7
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e3ecd040e846c42e87dd1e1c19dbfddf7c6926e5d4261322d2d1cc653867a91c
e6f62163437764c5ba5175120e4741cb76d1d48cecfec3224ebdf2b856cfe046
e8097c207ba7882010ad55405901c4f24424265d1ab62818d5c13b9a3f5d9dc1
e90fb0eba512ed6473f6fb8acf4cd09b38732f150f43c396246c12bb2aacbb67
e9e9a67395a0d83b584208a19b95af203df8e8e6c6952fe76c690d60ea9381c7
eec5cc477e7cb4f1eee1f26dce3eb411a63716d89a9b659c7d5559571c837ccb
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f0fa175b8f429fef8cf665c9031bbed33be4e9ad84c70e057c4ff16f41d53a0d
f152986955900c89c6fd889525ea87127d43796cd7995fec1e8998761722b9bd
f2dd1ff20c3df202418f9d59c76f40bdb304d7a85d7163fc9935391528f3dee8
f327a0ba3e41b1e8154e1c18fc114baff0bd057151e3afe7fa6f33cc0cb18296
f42283e0ca17a52688c5250e714ecd1b6a53af8b0f6e54ac64546499b0ec1b19
fb2174f99dd17edcf52501aa47eacdbee603bf47894ad834b732bab9d3c3417c
fc6d51c8cf191d581599c9df93f289248272ff952613d0df3d72fc5fbc2060fb
fdaf50ba7dfdf74a600dbb9a28a4ebfc536486d8f1e23296d7dfb33d843e1c3b

5damah.com Open in urlscan Pro 149.56.92.220 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

151 Requests

93 %HTTPS

37 %IPv6

25 Domains

37 Subdomains

29 IPs

2 Countries

3262 kBTransfer

7274 kBSize

29 Cookies

20 Outgoing links

Redirected requests

151 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

5damah.com Open in urlscan Pro
149.56.92.220 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

151
Requests

93 %
HTTPS

37 %
IPv6

25
Domains

37
Subdomains

29
IPs

2
Countries

3262 kB
Transfer

7274 kB
Size

29
Cookies

151 HTTP transactions
0 data transactions