urlscan.io logo urlscan.io
SecurityTrails logo

x.info16.citi.com Open in urlscan Pro
63.148.46.109  Public Scan

Go To Rescan Add Verdict Report
Submitted URL: https://l.info16.citi.com/rts/go2.aspx?h=4597430&tp=i-1NGB-Q4N-qCG-E7owBY-2A-KWhPF-1c-Dw0eVF-lA4SoxcL0c-1QMeW0&pi=_36Zh--r...
Effective URL: https://x.info16.citi.com/ats/msg.aspx?pi=_36Zh--rsVhhcilkPE8yjoTcCv9YbenKTPde4aivBiY&sg1=9967957420c1cf0ce4b96452233caa70...
Submission: On February 26 via manual from US — Scanned from DE
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 2 IPs in 2 countries across 2 domains to perform 7 HTTP transactions. The main IP is 63.148.46.109, located in United States and belongs to ASN-CHEETA-MAIL, US. The main domain is x.info16.citi.com.
TLS certificate: Issued by DigiCert SHA2 Extended Validation Ser... on March 24th 2023. Valid for: a year.
This is the only time x.info16.citi.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
1 3 63.148.46.109 53316 (ASN-CHEET...)
5 23.212.201.96 16625 (AKAMAI-AS)
7 2
Apex Domain
Subdomains		 Transfer
5 eccmp.com
snamwpm.eccmp.com — Cisco Umbrella Rank: 50965
namwpm.eccmp.com — Cisco Umbrella Rank: 100137
397 KB
3 citi.com
l.info16.citi.com — Cisco Umbrella Rank: 131286
x.info16.citi.com
38 KB
7 2
Domain Requested by
4 snamwpm.eccmp.com x.info16.citi.com
2 l.info16.citi.com 1 redirects x.info16.citi.com
1 namwpm.eccmp.com x.info16.citi.com
1 x.info16.citi.com
7 4

This site contains links to these domains. Also see Links.

Domain
l.info16.citi.com
Subject Issuer Validity Valid
info16.citi.com
DigiCert SHA2 Extended Validation Server CA		 2023-03-24 -
2024-04-23		 a year crt.sh
wpm.ccmp.eu
R3		 2024-01-26 -
2024-04-25		 3 months crt.sh

This page contains 1 frames:

Primary Page: https://x.info16.citi.com/ats/msg.aspx?pi=_36Zh--rsVhhcilkPE8yjoTcCv9YbenKTPde4aivBiY&sg1=9967957420c1cf0ce4b96452233caa706668e7e577fa6d84a31560b5e17f9773
Frame ID: ABA4294AE3371794AF89C4CF1D2BB72E
Requests: 7 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Don’t miss out! This exclusive, limited-time offer ends soon!

Page URL History Show full URLs

  1. https://l.info16.citi.com/rts/go2.aspx?h=4597430&tp=i-1NGB-Q4N-qCG-E7owBY-2A-KWhPF-1c-Dw0eVF-lA4SoxcL0... HTTP 302
    https://x.info16.citi.com/ats/msg.aspx?pi=_36Zh--rsVhhcilkPE8yjoTcCv9YbenKTPde4aivBiY&sg1=9967957420c1... Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • \.aspx?(?:$|\?)

Page Statistics

7
Requests

100 %
HTTPS

0 %
IPv6

2
Domains

4
Subdomains

2
IPs

2
Countries

434 kB
Transfer

432 kB
Size

3
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://l.info16.citi.com/rts/go2.aspx?h=4597430&tp=i-1NGB-Q4N-qCG-E7owBY-2A-KWhPF-1c-Dw0eVF-lA4SoxcL0c-1QMeW0&pi=_36Zh--rsVhhcilkPE8yjoTcCv9YbenKTPde4aivBiY&x=9967957420c1cf0ce4b96452233caa706668e7e577fa6d84a31560b5e17f9773&hp2=0addd50bd43b700f4270f8a59cefa3713d313a30eca73b161efb99c9612b221f HTTP 302
    https://x.info16.citi.com/ats/msg.aspx?pi=_36Zh--rsVhhcilkPE8yjoTcCv9YbenKTPde4aivBiY&sg1=9967957420c1cf0ce4b96452233caa706668e7e577fa6d84a31560b5e17f9773 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

7 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request msg.aspx
x.info16.citi.com/ats/
Redirect Chain
  • https://l.info16.citi.com/rts/go2.aspx?h=4597430&tp=i-1NGB-Q4N-qCG-E7owBY-2A-KWhPF-1c-Dw0eVF-lA4SoxcL0c-1QMeW0&pi=_36Zh--rsVhhcilkPE8yjoTcCv9YbenKTPde4aivBiY&x=9967957420c1cf0ce4b96452233caa706668e...
  • https://x.info16.citi.com/ats/msg.aspx?pi=_36Zh--rsVhhcilkPE8yjoTcCv9YbenKTPde4aivBiY&sg1=9967957420c1cf0ce4b96452233caa706668e7e577fa6d84a31560b5e17f9773
37 KB
38 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://x.info16.citi.com/ats/msg.aspx?pi=_36Zh--rsVhhcilkPE8yjoTcCv9YbenKTPde4aivBiY&sg1=9967957420c1cf0ce4b96452233caa706668e7e577fa6d84a31560b5e17f9773
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
63.148.46.109 , United States, ASN53316 (ASN-CHEETA-MAIL, US),
Reverse DNS
Software
/
Resource Hash
2ef1d875abafb05d6807624438f13e991ae88861fdf7fbc0038d48c107e34f74

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

Access-Control-Allow-Headers
Origin, X-Requested-With, Content-Type, Accept
Access-Control-Allow-Methods
POST, GET, OPTIONS, PUT, DELETE
Cache-Control
no-cache, no-store, must-revalidate
Content-Length
37944
Content-Type
text/html; charset=utf-8
Date
Mon, 26 Feb 2024 20:22:41 GMT
Expires
0
Pragma
no-cache
SERVER
X-Powered-By

Redirect headers

Cache-Control
private
Content-Type
text/html; charset=utf-8
Date
Mon, 26 Feb 2024 20:22:38 GMT
Location
https://x.info16.citi.com/ats/msg.aspx?pi=_36Zh--rsVhhcilkPE8yjoTcCv9YbenKTPde4aivBiY&sg1=9967957420c1cf0ce4b96452233caa706668e7e577fa6d84a31560b5e17f9773
Server
Transfer-Encoding
chunked
X-Powered-By
open.aspx
l.info16.citi.com/rts/ 		43 B
255 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://l.info16.citi.com/rts/open.aspx?tp=i-16IJ-Q4N-qCG-E7owBY-2A-KWhPF-1c-4ahHD-G-lA5TafINmw-17nfU8&pi=_36Zh--rsVhhcilkPE8yjoTcCv9YbenKTPde4aivBiY
Requested by
Host: x.info16.citi.com
URL: https://x.info16.citi.com/ats/msg.aspx?pi=_36Zh--rsVhhcilkPE8yjoTcCv9YbenKTPde4aivBiY&sg1=9967957420c1cf0ce4b96452233caa706668e7e577fa6d84a31560b5e17f9773
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
63.148.46.109 , United States, ASN53316 (ASN-CHEETA-MAIL, US),
Reverse DNS
Software
/
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://x.info16.citi.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

Pragma
no-cache
Date
Mon, 26 Feb 2024 20:22:41 GMT
Server
X-Powered-By
Transfer-Encoding
chunked
Content-Type
image/gif
Cache-Control
no-cache, max-age=0
Expires
0
SW_Shop_Your_Way_Mastercard_250x60.png
snamwpm.eccmp.com/wpm/552/ContentUploads/CardArt/Sears/ 		8 KB
8 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://snamwpm.eccmp.com/wpm/552/ContentUploads/CardArt/Sears/SW_Shop_Your_Way_Mastercard_250x60.png
Requested by
Host: x.info16.citi.com
URL: https://x.info16.citi.com/ats/msg.aspx?pi=_36Zh--rsVhhcilkPE8yjoTcCv9YbenKTPde4aivBiY&sg1=9967957420c1cf0ce4b96452233caa706668e7e577fa6d84a31560b5e17f9773
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
23.212.201.96 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-212-201-96.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
42887dfb6f3d37b9531863e3999e7c0522dcacb3aa514bf0262c2bb077e18073

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://x.info16.citi.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

Date
Mon, 26 Feb 2024 20:22:42 GMT
Last-Modified
Mon, 23 Oct 2023 20:32:44 GMT
Server
ETag
"a3b9a13f05da1:0"
X-Powered-By
Content-Type
image/png
Access-Control-Allow-Origin
*
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
8143
cardart_BLANK.png
snamwpm.eccmp.com/wpm/552/ContentUploads/CardArt/ 		971 B
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://snamwpm.eccmp.com/wpm/552/ContentUploads/CardArt/cardart_BLANK.png
Requested by
Host: x.info16.citi.com
URL: https://x.info16.citi.com/ats/msg.aspx?pi=_36Zh--rsVhhcilkPE8yjoTcCv9YbenKTPde4aivBiY&sg1=9967957420c1cf0ce4b96452233caa706668e7e577fa6d84a31560b5e17f9773
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
23.212.201.96 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-212-201-96.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
ad77f31edcf32e6396082beb0a984215cae318f84c82e85ce8efa09b49f35888

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://x.info16.citi.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

Date
Mon, 26 Feb 2024 20:22:42 GMT
Last-Modified
Tue, 27 Oct 2020 17:14:00 GMT
Server
ETag
"c04f1e9084acd61:0"
X-Powered-By
Content-Type
image/png
Access-Control-Allow-Origin
*
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
971
CRS_LCheadersecurity.png
snamwpm.eccmp.com/wpm/552/ContentUploads/Lifecycle/ 		1 KB
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://snamwpm.eccmp.com/wpm/552/ContentUploads/Lifecycle/CRS_LCheadersecurity.png
Requested by
Host: x.info16.citi.com
URL: https://x.info16.citi.com/ats/msg.aspx?pi=_36Zh--rsVhhcilkPE8yjoTcCv9YbenKTPde4aivBiY&sg1=9967957420c1cf0ce4b96452233caa706668e7e577fa6d84a31560b5e17f9773
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
23.212.201.96 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-212-201-96.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
e1ecdea17d3ead30c886629f7f3233ec9952e1fb8bf840476f5e39a0612ec9c1

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://x.info16.citi.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

Date
Mon, 26 Feb 2024 20:22:42 GMT
Last-Modified
Tue, 16 Jun 2015 15:21:50 GMT
Server
ETag
"78231f2b48a8d01:0"
X-Powered-By
Content-Type
image/png
Access-Control-Allow-Origin
*
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
1066
q1-hero-syw-0123.jpg
snamwpm.eccmp.com/wpm/100215/ContentUploads/_2023_AEL/Triggers_Q1/ 		384 KB
385 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://snamwpm.eccmp.com/wpm/100215/ContentUploads/_2023_AEL/Triggers_Q1/q1-hero-syw-0123.jpg
Requested by
Host: x.info16.citi.com
URL: https://x.info16.citi.com/ats/msg.aspx?pi=_36Zh--rsVhhcilkPE8yjoTcCv9YbenKTPde4aivBiY&sg1=9967957420c1cf0ce4b96452233caa706668e7e577fa6d84a31560b5e17f9773
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
23.212.201.96 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-212-201-96.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
07f6396773384b57844a664a83806db91bb85da91d96ad45e2825b96d084fa29

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://x.info16.citi.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

Date
Mon, 26 Feb 2024 20:22:42 GMT
Last-Modified
Wed, 22 Feb 2023 19:46:42 GMT
Server
ETag
"80e18163f646d91:0"
X-Powered-By
Content-Type
image/jpeg
Access-Control-Allow-Origin
*
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
393570
CRS_LC_footersecurity.png
namwpm.eccmp.com/wpm/552/ContentUploads/Lifecycle/ 		1 KB
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://namwpm.eccmp.com/wpm/552/ContentUploads/Lifecycle/CRS_LC_footersecurity.png
Requested by
Host: x.info16.citi.com
URL: https://x.info16.citi.com/ats/msg.aspx?pi=_36Zh--rsVhhcilkPE8yjoTcCv9YbenKTPde4aivBiY&sg1=9967957420c1cf0ce4b96452233caa706668e7e577fa6d84a31560b5e17f9773
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
23.212.201.96 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-212-201-96.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
761e76cf26eccbee37912bce82c35122217c8cf711968d4f908c8c3cf35dee28

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://x.info16.citi.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.69 Safari/537.36

Response headers

Date
Mon, 26 Feb 2024 20:22:42 GMT
Last-Modified
Tue, 16 Jun 2015 15:21:49 GMT
Server
ETag
"e2b54f2a48a8d01:0"
X-Powered-By
Content-Type
image/png
Access-Control-Allow-Origin
*
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
1116

Verdicts & Comments Add Verdict or Comment

0 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

3 Cookies

Domain/Path Name / Value
l.info16.citi.com/ Name: ASP.NET_SessionId
Value: zbhmqbnidnapwzkfd3ceenex
l.info16.citi.com/ Name: BIGipServercnv_ats_ssl_pool
Value: 1145509898.47873.0000
x.info16.citi.com/ Name: BIGipServercnv_ats_ssl_pool
Value: 1145509898.47873.0000

3 Console Messages

Source Level URL
Text
security warning URL: https://x.info16.citi.com/ats/msg.aspx?pi=_36Zh--rsVhhcilkPE8yjoTcCv9YbenKTPde4aivBiY&sg1=9967957420c1cf0ce4b96452233caa706668e7e577fa6d84a31560b5e17f9773
Message:
Mixed Content: The page at 'https://x.info16.citi.com/ats/msg.aspx?pi=_36Zh--rsVhhcilkPE8yjoTcCv9YbenKTPde4aivBiY&sg1=9967957420c1cf0ce4b96452233caa706668e7e577fa6d84a31560b5e17f9773' was loaded over HTTPS, but requested an insecure element 'http://snamwpm.eccmp.com/wpm/552/ContentUploads/Lifecycle/CRS_LCheadersecurity.png'. This request was automatically upgraded to HTTPS, For more information see https://blog.chromium.org/2019/10/no-more-mixed-messages-about-https.html
security warning URL: https://x.info16.citi.com/ats/msg.aspx?pi=_36Zh--rsVhhcilkPE8yjoTcCv9YbenKTPde4aivBiY&sg1=9967957420c1cf0ce4b96452233caa706668e7e577fa6d84a31560b5e17f9773(Line 298)
Message:
Mixed Content: The page at 'https://x.info16.citi.com/ats/msg.aspx?pi=_36Zh--rsVhhcilkPE8yjoTcCv9YbenKTPde4aivBiY&sg1=9967957420c1cf0ce4b96452233caa706668e7e577fa6d84a31560b5e17f9773' was loaded over HTTPS, but requested an insecure element 'http://snamwpm.eccmp.com/wpm/552/ContentUploads/Lifecycle/CRS_LCheadersecurity.png'. This request was automatically upgraded to HTTPS, For more information see https://blog.chromium.org/2019/10/no-more-mixed-messages-about-https.html
security warning URL: https://x.info16.citi.com/ats/msg.aspx?pi=_36Zh--rsVhhcilkPE8yjoTcCv9YbenKTPde4aivBiY&sg1=9967957420c1cf0ce4b96452233caa706668e7e577fa6d84a31560b5e17f9773(Line 486)
Message:
Mixed Content: The page at 'https://x.info16.citi.com/ats/msg.aspx?pi=_36Zh--rsVhhcilkPE8yjoTcCv9YbenKTPde4aivBiY&sg1=9967957420c1cf0ce4b96452233caa706668e7e577fa6d84a31560b5e17f9773' was loaded over HTTPS, but requested an insecure element 'http://namwpm.eccmp.com/wpm/552/ContentUploads/Lifecycle/CRS_LC_footersecurity.png'. This request was automatically upgraded to HTTPS, For more information see https://blog.chromium.org/2019/10/no-more-mixed-messages-about-https.html