fm.info6.citi.com Open in urlscan Pro
173.213.4.17  Public Scan

1 Outgoing links

These are links going to different origins than the main page.

Search URL Search Domain Scan URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

6 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request url.aspx Show response fm.info6.citi.com/ats/	16 KB 5 KB	1878ms 455ms	Document text/html	173.213.4.17 ASN-CHEETA-MAIL
General Check archive.org Show headers Download Go to Full URL https://fm.info6.citi.com/ats/url.aspx?cr=617&wu=1&we=1&url=https%3A%2F%2Fhome.cards.citidirect.com%2FCommercialCard%2FCards.html&linkName=CT_CitiManagerAcctMgmtTool&transId=A20240301P0081705 Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 173.213.4.17 , United States, ASN53316 (ASN-CHEETA-MAIL, US), Reverse DNS Software / Resource Hash ff3dca8d0b948cf100ff3c3b161f974ed9d0a67aa36d8087e25d38268ab99622 Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers Access-Control-Allow-Headers Origin, X-Requested-With, Content-Type, Accept Access-Control-Allow-Methods POST, GET, OPTIONS, PUT, DELETE Cache-Control no-cache, no-store, must-revalidate Connection Keep-Alive Content-Encoding gzip Content-Length 4913 Content-Type text/html; charset=utf-8 Date Fri, 01 Mar 2024 20:13:09 GMT Expires 0 Pragma no-cache SERVER Vary Accept-Encoding X-Powered-By
GET H2	200	jquery.min.js Show response ajax.googleapis.com/ajax/libs/jquery/2.1.3/	82 KB 30 KB	127ms 40ms	Script text/javascript	2a00:1450:4001:831::200a GOOGLE
General Check archive.org Show headers Download Go to Full URL https://ajax.googleapis.com/ajax/libs/jquery/2.1.3/jquery.min.js Requested by Host: fm.info6.citi.com URL: https://fm.info6.citi.com/ats/url.aspx?cr=617&wu=1&we=1&url=https%3A%2F%2Fhome.cards.citidirect.com%2FCommercialCard%2FCards.html&linkName=CT_CitiManagerAcctMgmtTool&transId=A20240301P0081705 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:831::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 8af93bd675e1cfd9ecc850e862819fdac6e3ad1f5d761f970e409c7d9c63bdc3 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://fm.info6.citi.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36 Response headers date Fri, 01 Mar 2024 12:16:46 GMT content-encoding gzip x-content-type-options nosniff age 28584 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 29707 x-xss-protection 0 last-modified Tue, 03 Mar 2020 19:15:00 GMT server sffe cross-origin-opener-policy same-origin; report-to="hosted-libraries-pushers" vary Accept-Encoding report-to {"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]} content-type text/javascript; charset=UTF-8 access-control-allow-origin * cache-control public, max-age=31536000, stale-while-revalidate=2592000 accept-ranges bytes timing-allow-origin * expires Sat, 01 Mar 2025 12:16:46 GMT
GET H/1.1	200 OK	open.aspx l.info6.citi.com/rts/	43 B 432 B	3872ms 116ms	Image image/gif	173.213.4.17 ASN-CHEETA-MAIL
General Check archive.org Show headers Download Go to Show image Full URL https://l.info6.citi.com/rts/open.aspx?tp=i-16IJ-9x-M-AHG2uy-1q-7SaBS9-1c-U4-G-lA6SKou4wo-1MMpL5&pi= Requested by Host: fm.info6.citi.com URL: https://fm.info6.citi.com/ats/url.aspx?cr=617&wu=1&we=1&url=https%3A%2F%2Fhome.cards.citidirect.com%2FCommercialCard%2FCards.html&linkName=CT_CitiManagerAcctMgmtTool&transId=A20240301P0081705 Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 173.213.4.17 , United States, ASN53316 (ASN-CHEETA-MAIL, US), Reverse DNS Software / Resource Hash b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b Request headers accept-language de-DE,de;q=0.9 Referer https://fm.info6.citi.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36 Response headers Pragma no-cache Date Fri, 01 Mar 2024 20:13:13 GMT Server X-Powered-By Transfer-Encoding chunked Content-Type image/gif Cache-Control no-cache, max-age=0 Expires 0
GET H/1.1	200 OK	conversen-SDK.js Show response sts.eccmp.com/sts/scripts/	15 KB 7 KB	3955ms 269ms	Script application/javascript	63.148.46.76 ASN-CHEETA-MAIL
General Check archive.org Show headers Download Go to Full URL https://sts.eccmp.com/sts/scripts/conversen-SDK.js Requested by Host: fm.info6.citi.com URL: https://fm.info6.citi.com/ats/url.aspx?cr=617&wu=1&we=1&url=https%3A%2F%2Fhome.cards.citidirect.com%2FCommercialCard%2FCards.html&linkName=CT_CitiManagerAcctMgmtTool&transId=A20240301P0081705 Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 63.148.46.76 , United States, ASN53316 (ASN-CHEETA-MAIL, US), Reverse DNS xts.eccmp.com Software / Resource Hash b0a58fb8c12ffbb8b641ae4316da491e42969f9fe904a0dc35f1203cbb76a444 Request headers accept-language de-DE,de;q=0.9 Referer https://fm.info6.citi.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36 Response headers Date Fri, 01 Mar 2024 20:13:14 GMT Content-Encoding gzip Last-Modified Sat, 24 Feb 2024 17:46:54 GMT Server Age 6263 ETag "07b29744967da1:0" X-Powered-By Vary Accept-Encoding Content-Type application/javascript Connection Keep-Alive Accept-Ranges bytes Content-Length 7009
GET H/1.1	200 OK	617 Show response sts.eccmp.com/wts/WebEvent/GetCookieExpiry/	35 B 426 B	453ms 115ms	XHR text/xml	63.148.46.76 ASN-CHEETA-MAIL
General Check archive.org Show headers Download Go to Full URL https://sts.eccmp.com/wts/WebEvent/GetCookieExpiry/617 Requested by Host: sts.eccmp.com URL: https://sts.eccmp.com/sts/scripts/conversen-SDK.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 63.148.46.76 , United States, ASN53316 (ASN-CHEETA-MAIL, US), Reverse DNS xts.eccmp.com Software / Resource Hash 61339a21fa71d17d0dfebceba08dc76ce605e73f65a88438397483478d953aae Request headers accept-language de-DE,de;q=0.9 Referer https://fm.info6.citi.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36 Response headers Date Fri, 01 Mar 2024 20:13:13 GMT X-AspNetMvc-Version 3.0 Server X-Powered-By Vary Accept-Encoding Content-Type text/xml; charset=utf-8 Access-Control-Allow-Origin * Cache-Control private Content-Length 35
GET H/1.1	200 OK	image.gif sts.eccmp.com/wts/WebEvent/	807 B 1 KB	119ms 118ms	Image image/gif	63.148.46.76 ASN-CHEETA-MAIL
General Check archive.org Show headers Download Go to Show image Full URL https://sts.eccmp.com/wts/WebEvent/image.gif?isSplit=false&guid=5f679c2e-d3f7-a7cd-112b-9478e08f6281&segmentNumber=1&pm[linkName]=CT_CitiManagerAcctMgmtTool&pm[transId]=A20240301P0081705&rp[cr]=617&rp[wegc]=&rp[et]=100&rp[ap]=&rp[we]=1 Requested by Host: fm.info6.citi.com URL: https://fm.info6.citi.com/ats/url.aspx?cr=617&wu=1&we=1&url=https%3A%2F%2Fhome.cards.citidirect.com%2FCommercialCard%2FCards.html&linkName=CT_CitiManagerAcctMgmtTool&transId=A20240301P0081705 Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 63.148.46.76 , United States, ASN53316 (ASN-CHEETA-MAIL, US), Reverse DNS xts.eccmp.com Software / Resource Hash 9c6d485ae01a594ef22b3c44e1eca5314259061faacdcdfc51569aba58a4fc2b Request headers accept-language de-DE,de;q=0.9 Referer https://fm.info6.citi.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.94 Safari/537.36 Response headers Date Fri, 01 Mar 2024 20:13:13 GMT X-AspNetMvc-Version 3.0 Server X-Powered-By Vary Accept-Encoding Content-Type image/gif Cache-Control private Content-Length 807

20 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| antiClickjack function| $ function| jQuery object| paramObj undefined| trackingParams string| redirectURL string| shortenedURL number| webEventId object| regExp object| reservedParams boolean| urlDone object| queryParams string| index object| qp function| onSuccess function| logError function| cnvAsyncInit object| Cnv object| stack object| data

4 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			fm.info6.citi.com/	1969-12-31 23:59:59	Name: BIGipServercnv_ats_ssl_pool Value: 1044846602.47873.0000
			l.info6.citi.com/	1969-12-31 23:59:59	Name: ASP.NET_SessionId Value: 2zoxp2fghozb5e1hdsz50xol
			l.info6.citi.com/	1969-12-31 23:59:59	Name: BIGipServercnv_ats_ssl_pool Value: 1162287114.47873.0000
			.citi.com/	1970-01-20 18:58:48	Name: xyz_cr_617_et_100 Value:

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ajax.googleapis.com
fm.info6.citi.com
l.info6.citi.com
sts.eccmp.com
173.213.4.17
2a00:1450:4001:831::200a
63.148.46.76
61339a21fa71d17d0dfebceba08dc76ce605e73f65a88438397483478d953aae
8af93bd675e1cfd9ecc850e862819fdac6e3ad1f5d761f970e409c7d9c63bdc3
9c6d485ae01a594ef22b3c44e1eca5314259061faacdcdfc51569aba58a4fc2b
b0a58fb8c12ffbb8b641ae4316da491e42969f9fe904a0dc35f1203cbb76a444
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
ff3dca8d0b948cf100ff3c3b161f974ed9d0a67aa36d8087e25d38268ab99622