www.firstcitizens.com Open in urlscan Pro
52.206.240.104 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://click.firstcitizens.com/Mjk2LUNQWC0yOTUAAAGGjzWEepGrdE_F9gLAZ0-u2miichXjNgyPOUQYI11h_GdvYOzF1rx1NNgTrWni8ZiQFhJmJHQ=
Effective URL:
https://www.firstcitizens.com/?mkt_tok=Mjk2LUNQWC0yOTUAAAGGjzWEenlD9bhQeI4yKU4PJ5Eg5xUYrIuOJJSXEvW7jT2yjNYpb3L3rorhi9Z_gG-_zI6...
Submission: On August 31 via api (August 31st 2022, 2:38:47 pm UTC) from US — Scanned from DE

Summary HTTP 109 Redirects Links 30 Behaviour Indicators

Summary

This website contacted 39 IPs in 7 countries across 29 domains to perform 109 HTTP transactions. The main IP is 52.206.240.104, located in Ashburn, United States and belongs to AMAZON-AES, US. The main domain is www.firstcitizens.com. The Cisco Umbrella rank of the primary domain is 156876.
TLS certificate: Issued by DigiCert TLS RSA SHA256 2020 CA1 on June 27th 2022. Valid for: a year.

This is the only time www.firstcitizens.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1	104.17.72.206 104.17.72.206	13335 (CLOUDFLAR...) (CLOUDFLARENET)
23	52.206.240.104 52.206.240.104	14618 (AMAZON-AES) (AMAZON-AES)
1	192.0.54.4 192.0.54.4	62659 (Q2HOLDINGS) (Q2HOLDINGS)
2	2606:4700::68... 2606:4700::6812:7434	13335 (CLOUDFLAR...) (CLOUDFLARENET)
4	2a02:26f0:350... 2a02:26f0:3500:587::1e80	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
22	44.196.18.202 44.196.18.202	14618 (AMAZON-AES) (AMAZON-AES)
1	99.86.4.115 99.86.4.115	16509 (AMAZON-02) (AMAZON-02)
2	18.202.164.188 18.202.164.188	16509 (AMAZON-02) (AMAZON-02)
5	2a03:2880:f01... 2a03:2880:f01c:8012:face:b00c:0:3	32934 (FACEBOOK) (FACEBOOK)
1	2a02:26f0:350... 2a02:26f0:3500:16::215:14a0	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1	3.96.5.142 3.96.5.142	16509 (AMAZON-02) (AMAZON-02)
3 3	2620:1ec:22::14 2620:1ec:22::14	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1	13.107.42.14 13.107.42.14	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
4	2a03:2880:f11... 2a03:2880:f11c:8183:face:b00c:0:25de	32934 (FACEBOOK) (FACEBOOK)
1	52.18.235.86 52.18.235.86	16509 (AMAZON-02) (AMAZON-02)
1 1	34.248.32.199 34.248.32.199	16509 (AMAZON-02) (AMAZON-02)
1	99.86.4.72 99.86.4.72	16509 (AMAZON-02) (AMAZON-02)
1	2a06:98c1:312... 2a06:98c1:3121::3	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	65.9.66.105 65.9.66.105	16509 (AMAZON-02) (AMAZON-02)
2 4	142.250.185.198 142.250.185.198	15169 (GOOGLE) (GOOGLE)
2	3.220.188.198 3.220.188.198	14618 (AMAZON-AES) (AMAZON-AES)
1	52.209.201.13 52.209.201.13	16509 (AMAZON-02) (AMAZON-02)
1	52.58.29.12 52.58.29.12	16509 (AMAZON-02) (AMAZON-02)
2	2a00:1450:400... 2a00:1450:4001:82f::2002	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:803::2002	15169 (GOOGLE) (GOOGLE)
1	54.205.244.165 54.205.244.165	14618 (AMAZON-AES) (AMAZON-AES)
3	104.17.209.240 104.17.209.240	13335 (CLOUDFLAR...) (CLOUDFLARENET)
4	2a00:1450:400... 2a00:1450:4001:813::2008	15169 (GOOGLE) (GOOGLE)
2	23.205.237.4 23.205.237.4	16625 (AKAMAI-AS) (AKAMAI-AS)
1 2	3.121.84.223 3.121.84.223	16509 (AMAZON-02) (AMAZON-02)
1 2	2606:4700::68... 2606:4700::6812:a4f	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	13.36.218.177 13.36.218.177	16509 (AMAZON-02) (AMAZON-02)
1	192.28.144.124 192.28.144.124	15224 (OMNITURE) (OMNITURE)
3	142.250.181.226 142.250.181.226	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:830::200e	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:80f::2002	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:400c:c0c::9c	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:82b::2004	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:810::2003	15169 (GOOGLE) (GOOGLE)
2	3.227.107.182 3.227.107.182	14618 (AMAZON-AES) (AMAZON-AES)
109	39

1 104.17.72.206 (None, )

ASN13335 (CLOUDFLARENET, US)

click.firstcitizens.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

23 52.206.240.104 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-52-206-240-104.compute-1.amazonaws.com

www.firstcitizens.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 192.0.54.4 (United States)

ASN62659 (Q2HOLDINGS, US)

cds-sdkcfg.onlineaccess1.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:4700::6812:7434 (United States)

ASN13335 (CLOUDFLARENET, US)

assets.sitescdn.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a02:26f0:3500:587::1e80 (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)

assets.adobedtm.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

22 44.196.18.202 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-44-196-18-202.compute-1.amazonaws.com

trk.firstcitizens.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 99.86.4.115 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-99-86-4-115.fra6.r.cloudfront.net

js-cdn.dynatrace.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 18.202.164.188 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-18-202-164-188.eu-west-1.compute.amazonaws.com

dpm.demdex.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2a03:2880:f01c:8012:face:b00c:0:3 (Frankfurt am Main, Germany)

ASN32934 (FACEBOOK, US)

connect.facebook.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a02:26f0:3500:16::215:14a0 (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)

snap.licdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 3.96.5.142 (Montreal, Canada)

ASN16509 (AMAZON-02, US)
PTR: ec2-3-96-5-142.ca-central-1.compute.amazonaws.com

www.sc.pages08.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2620:1ec:22::14 (United States) 3 redirects

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

px.ads.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
www.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.107.42.14 (United States)

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

px4.ads.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a03:2880:f11c:8183:face:b00c:0:25de (Frankfurt am Main, Germany)

ASN32934 (FACEBOOK, US)

www.facebook.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.18.235.86 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-52-18-235-86.eu-west-1.compute.amazonaws.com

firstcitizens.demdex.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 34.248.32.199 (Dublin, Ireland) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-34-248-32-199.eu-west-1.compute.amazonaws.com

cm.everesttech.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 99.86.4.72 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-99-86-4-72.fra6.r.cloudfront.net

awuse1.advanced-web-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a06:98c1:3121::3 (United States)

ASN13335 (CLOUDFLARENET, US)

siteimproveanalytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 65.9.66.105 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-65-9-66-105.fra56.r.cloudfront.net

t.contentsquare.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 142.250.185.198 (United States) 2 redirects

ASN15169 (GOOGLE, US)
PTR: fra16s52-in-f6.1e100.net

6528888.fls.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
9786468.fls.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 3.220.188.198 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-3-220-188-198.compute-1.amazonaws.com

q-aus1.contentsquare.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.209.201.13 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-52-209-201-13.eu-west-1.compute.amazonaws.com

c.contentsquare.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.58.29.12 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-52-58-29-12.eu-central-1.compute.amazonaws.com

2884.global.siteimproveanalytics.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:82f::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

adservice.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:803::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

adservice.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 54.205.244.165 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-54-205-244-165.compute-1.amazonaws.com

k-aus1.contentsquare.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 104.17.209.240 (None, )

ASN13335 (CLOUDFLARENET, US)

zndhwk2nlgcbvdel3-firstcitizensbank.siteintercept.qualtrics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
siteintercept.qualtrics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a00:1450:4001:813::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 23.205.237.4 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a23-205-237-4.deploy.static.akamaitechnologies.com

munchkin.marketo.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 3.121.84.223 (Frankfurt am Main, Germany) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-3-121-84-223.eu-central-1.compute.amazonaws.com

tags.w55c.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:4700::6812:a4f (United States) 1 redirects

ASN13335 (CLOUDFLARENET, US)

action.dstillery.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
action.media6degrees.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.36.218.177 (Paris, France)

ASN16509 (AMAZON-02, US)
PTR: ec2-13-36-218-177.eu-west-3.compute.amazonaws.com

firstcitizens.sc.omtrdc.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 192.28.144.124 (United States)

ASN15224 (OMNITURE, US)

296-cpx-295.mktoresp.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 142.250.181.226 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s56-in-f2.1e100.net

www.googleadservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:830::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:80f::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:400c:c0c::9c (Brussels, Belgium)

ASN15169 (GOOGLE, US)

stats.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:82b::2004 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:810::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 3.227.107.182 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-3-227-107-182.compute-1.amazonaws.com

bf48372wzr.bf.dynatrace.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
46	firstcitizens.com click.firstcitizens.com www.firstcitizens.com — Cisco Umbrella Rank: 156876 trk.firstcitizens.com — Cisco Umbrella Rank: 122035	1 MB
6	doubleclick.net 2 redirects 6528888.fls.doubleclick.net — Cisco Umbrella Rank: 70172 9786468.fls.doubleclick.net — Cisco Umbrella Rank: 250901 googleads.g.doubleclick.net — Cisco Umbrella Rank: 44 stats.g.doubleclick.net — Cisco Umbrella Rank: 85	4 KB
5	contentsquare.net t.contentsquare.net — Cisco Umbrella Rank: 3639 q-aus1.contentsquare.net — Cisco Umbrella Rank: 8514 c.contentsquare.net — Cisco Umbrella Rank: 3669 k-aus1.contentsquare.net — Cisco Umbrella Rank: 8304	75 KB
5	facebook.net connect.facebook.net — Cisco Umbrella Rank: 154	242 KB
4	googletagmanager.com www.googletagmanager.com — Cisco Umbrella Rank: 66	227 KB
4	google.com adservice.google.com — Cisco Umbrella Rank: 78 www.google.com — Cisco Umbrella Rank: 2	1 KB
4	facebook.com www.facebook.com — Cisco Umbrella Rank: 113	491 B
4	linkedin.com 3 redirects px.ads.linkedin.com — Cisco Umbrella Rank: 370 www.linkedin.com — Cisco Umbrella Rank: 586 px4.ads.linkedin.com — Cisco Umbrella Rank: 6068	4 KB
4	adobedtm.com assets.adobedtm.com — Cisco Umbrella Rank: 481	121 KB
3	googleadservices.com www.googleadservices.com — Cisco Umbrella Rank: 132	47 KB
3	qualtrics.com zndhwk2nlgcbvdel3-firstcitizensbank.siteintercept.qualtrics.com — Cisco Umbrella Rank: 198691 siteintercept.qualtrics.com — Cisco Umbrella Rank: 931	23 KB
3	google.de adservice.google.de — Cisco Umbrella Rank: 9270 www.google.de — Cisco Umbrella Rank: 6487	1 KB
3	demdex.net dpm.demdex.net — Cisco Umbrella Rank: 202 firstcitizens.demdex.net — Cisco Umbrella Rank: 166723	5 KB
3	dynatrace.com js-cdn.dynatrace.com — Cisco Umbrella Rank: 6954 bf48372wzr.bf.dynatrace.com — Cisco Umbrella Rank: 208934	64 KB
2	google-analytics.com www.google-analytics.com — Cisco Umbrella Rank: 37	20 KB
2	w55c.net 1 redirects tags.w55c.net — Cisco Umbrella Rank: 3687	1 KB
2	marketo.net munchkin.marketo.net — Cisco Umbrella Rank: 2677	6 KB
2	sitescdn.net assets.sitescdn.net — Cisco Umbrella Rank: 10818	158 KB
1	mktoresp.com 296-cpx-295.mktoresp.com — Cisco Umbrella Rank: 198868	318 B
1	omtrdc.net firstcitizens.sc.omtrdc.net — Cisco Umbrella Rank: 148105	344 B
1	media6degrees.com action.media6degrees.com — Cisco Umbrella Rank: 5281	231 B
1	dstillery.com 1 redirects action.dstillery.com — Cisco Umbrella Rank: 5681	225 B
1	siteimproveanalytics.io 2884.global.siteimproveanalytics.io — Cisco Umbrella Rank: 183379	620 B
1	siteimproveanalytics.com siteimproveanalytics.com — Cisco Umbrella Rank: 3055	9 KB
1	advanced-web-analytics.com awuse1.advanced-web-analytics.com — Cisco Umbrella Rank: 26611	29 KB
1	everesttech.net 1 redirects cm.everesttech.net — Cisco Umbrella Rank: 967	517 B
1	pages08.net www.sc.pages08.net — Cisco Umbrella Rank: 51545	13 KB
1	licdn.com snap.licdn.com — Cisco Umbrella Rank: 754	3 KB
1	onlineaccess1.com cds-sdkcfg.onlineaccess1.com — Cisco Umbrella Rank: 15713	110 KB
109	29

	Domain	Requested by
23	www.firstcitizens.com	click.firstcitizens.com www.firstcitizens.com cds-sdkcfg.onlineaccess1.com
22	trk.firstcitizens.com	www.firstcitizens.com trk.firstcitizens.com
5	connect.facebook.net	assets.adobedtm.com connect.facebook.net 9786468.fls.doubleclick.net
4	www.googletagmanager.com	assets.adobedtm.com 9786468.fls.doubleclick.net www.googletagmanager.com
4	www.facebook.com	www.firstcitizens.com 9786468.fls.doubleclick.net
4	assets.adobedtm.com	www.firstcitizens.com assets.adobedtm.com
3	www.googleadservices.com	www.googletagmanager.com
2	bf48372wzr.bf.dynatrace.com	cds-sdkcfg.onlineaccess1.com
2	www.google.de	9786468.fls.doubleclick.net
2	www.google.com	9786468.fls.doubleclick.net
2	www.google-analytics.com	www.googletagmanager.com cds-sdkcfg.onlineaccess1.com
2	tags.w55c.net	1 redirects 9786468.fls.doubleclick.net
2	siteintercept.qualtrics.com	zndhwk2nlgcbvdel3-firstcitizensbank.siteintercept.qualtrics.com cds-sdkcfg.onlineaccess1.com
2	munchkin.marketo.net	assets.adobedtm.com munchkin.marketo.net
2	9786468.fls.doubleclick.net	1 redirects assets.adobedtm.com
2	adservice.google.com	6528888.fls.doubleclick.net 9786468.fls.doubleclick.net
2	q-aus1.contentsquare.net	cds-sdkcfg.onlineaccess1.com
2	6528888.fls.doubleclick.net	1 redirects assets.adobedtm.com
2	px.ads.linkedin.com	2 redirects
2	dpm.demdex.net	cds-sdkcfg.onlineaccess1.com www.firstcitizens.com
2	assets.sitescdn.net	www.firstcitizens.com assets.sitescdn.net
1	stats.g.doubleclick.net	cds-sdkcfg.onlineaccess1.com
1	googleads.g.doubleclick.net	www.googleadservices.com
1	296-cpx-295.mktoresp.com	munchkin.marketo.net
1	firstcitizens.sc.omtrdc.net
1	action.media6degrees.com	9786468.fls.doubleclick.net
1	action.dstillery.com	1 redirects
1	zndhwk2nlgcbvdel3-firstcitizensbank.siteintercept.qualtrics.com	assets.adobedtm.com
1	k-aus1.contentsquare.net	cds-sdkcfg.onlineaccess1.com
1	adservice.google.de	adservice.google.com
1	2884.global.siteimproveanalytics.io	www.firstcitizens.com
1	c.contentsquare.net	www.firstcitizens.com
1	t.contentsquare.net	assets.adobedtm.com
1	siteimproveanalytics.com	www.firstcitizens.com
1	awuse1.advanced-web-analytics.com	trk.firstcitizens.com
1	cm.everesttech.net	1 redirects
1	firstcitizens.demdex.net	assets.adobedtm.com
1	px4.ads.linkedin.com	www.firstcitizens.com
1	www.linkedin.com	1 redirects
1	www.sc.pages08.net	www.firstcitizens.com
1	snap.licdn.com	assets.adobedtm.com
1	js-cdn.dynatrace.com	www.firstcitizens.com
1	cds-sdkcfg.onlineaccess1.com	www.firstcitizens.com
1	click.firstcitizens.com
109	44

This site contains links to these domains. Also see Links.

Domain
locations.firstcitizens.com
jobs.firstcitizens.com
www.facebook.com
twitter.com
www.linkedin.com
www.youtube.com
digitalbanking.firstcitizens.com
commercialadvantage.firstcitizens.com
www.firstcitizensrewards.com
firstcitizens.netxinvestor.com
login.firstcitizens.com
secure.newportgroup.com
www.moneyguidepro.com
fcb.iphiview.com
www.onlinetreasurysolutions.com
www.remoteimagedeposit.com
automatedpayables.mineraltree.com
pmx.vancopayments.com
receivables.regulusgroup.com
unity.sandtechnologygroup.com
fxboss.firstcitizens.com
portal.csr24.com
www.mreports.com
app10.firstcitizensinsights.com
www.americanexpress.com
360control.firstdata.com

Subject Issuer	Validity	Valid
click.firstcitizens.com Cloudflare Inc ECC CA-3	`2022-07-14` - `2023-07-13`	a year	crt.sh
www.firstcitizens.com DigiCert TLS RSA SHA256 2020 CA1	`2022-06-27` - `2023-06-27`	a year	crt.sh
cds-sdkcfg.onlineaccess1.com Cloudflare Inc ECC CA-3	`2022-01-12` - `2023-01-11`	a year	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2022-08-10` - `2023-08-10`	a year	crt.sh
assets.adobedtm.com DigiCert TLS RSA SHA256 2020 CA1	`2022-07-19` - `2023-08-19`	a year	crt.sh
trk.firstcitizens.com DigiCert TLS RSA SHA256 2020 CA1	`2022-06-23` - `2023-06-23`	a year	crt.sh
js-cdn.dynatrace.com Amazon	`2022-03-04` - `2023-04-02`	a year	crt.sh
*.demdex.net DigiCert TLS RSA SHA256 2020 CA1	`2021-10-19` - `2022-11-19`	a year	crt.sh
*.facebook.com DigiCert SHA2 High Assurance Server CA	`2022-06-09` - `2022-09-07`	3 months	crt.sh
snap.licdn.com DigiCert SHA2 Secure Server CA	`2022-03-01` - `2023-03-01`	a year	crt.sh
*.engage8.silverpop.com DigiCert TLS RSA SHA256 2020 CA1	`2022-05-02` - `2023-05-26`	a year	crt.sh
*.advanced-web-analytics.com GeoTrust TLS RSA CA G1	`2022-05-09` - `2023-05-11`	a year	crt.sh
t.contentsquare.net Amazon	`2021-11-13` - `2022-12-11`	a year	crt.sh
*.doubleclick.net GTS CA 1C3	`2022-08-08` - `2022-10-31`	3 months	crt.sh
q-aus1.contentsquare.net Amazon	`2022-05-23` - `2023-06-21`	a year	crt.sh
c.contentsquare.net Amazon	`2022-08-15` - `2023-09-13`	a year	crt.sh
*.global.r1.siteimproveanalytics.io Amazon	`2022-04-27` - `2023-05-26`	a year	crt.sh
*.google.com GTS CA 1C3	`2022-08-08` - `2022-10-31`	3 months	crt.sh
*.google.de GTS CA 1C3	`2022-08-15` - `2022-11-07`	3 months	crt.sh
kep-malka.bf.contentsquare.net Amazon	`2022-08-25` - `2023-09-23`	a year	crt.sh
*.qualtrics.com DigiCert TLS RSA SHA256 2020 CA1	`2022-05-04` - `2023-05-04`	a year	crt.sh
*.google-analytics.com GTS CA 1C3	`2022-08-08` - `2022-10-31`	3 months	crt.sh
*.marketo.net DigiCert SHA2 Secure Server CA	`2022-02-06` - `2023-02-07`	a year	crt.sh
*.sc.omtrdc.net DigiCert TLS Hybrid ECC SHA384 2020 CA1	`2022-02-17` - `2023-03-07`	a year	crt.sh
*.mktoresp.com DigiCert TLS RSA SHA256 2020 CA1	`2021-11-30` - `2022-11-30`	a year	crt.sh
www.googleadservices.com GTS CA 1C3	`2022-08-08` - `2022-10-31`	3 months	crt.sh
*.g.doubleclick.net GTS CA 1C3	`2022-08-15` - `2022-11-07`	3 months	crt.sh
www.google.com GTS CA 1C3	`2022-08-08` - `2022-10-31`	3 months	crt.sh
www.google.de GTS CA 1C3	`2022-08-08` - `2022-10-31`	3 months	crt.sh
*.bf.dynatrace.com Amazon	`2022-01-08` - `2023-02-06`	a year	crt.sh

This page contains 13 frames:

Primary Page: https://www.firstcitizens.com/?mkt_tok=Mjk2LUNQWC0yOTUAAAGGjzWEenlD9bhQeI4yKU4PJ5Eg5xUYrIuOJJSXEvW7jT2yjNYpb3L3rorhi9Z_gG-_zI6eKyJLQDzI_99g55Pt-q-TEO8XVAg7nqO2Hj8X
Frame ID: E22DAF82BE2EF5D39A1EAB672F0F03BE
Requests: 76 HTTP requests in this frame

Frame: https://firstcitizens.demdex.net/dest5.html?d_nsid=0
Frame ID: 556A7F47C6FE8D494415F9E994B98683
Requests: 1 HTTP requests in this frame

Frame: https://www.facebook.com/tr/
Frame ID: 2A91C2FB7D216454BC6307148CEED5F3
Requests: 1 HTTP requests in this frame

Frame: https://awuse1.advanced-web-analytics.com/200189/pysty.html?e=https%3A%2F%2Fwww.firstcitizens.com&es=eyJpIjoid3hnckxST2s3c29SKytDVVwvZHJacGc9PSIsImUiOiI2RmdYSnQ2ZGhXR292dmx3a3Z4dTBlcWRyVU0yNTNyYWRSUW9HNkVcL1NpeVhOMDhyM25FZDFUZHBuNGRkejhNZmt4Z2RsUzg3RnpQZldwdkpzdGJQSlg1SWVKY3prV01UUUp0aTluNTdGdWIyRUJuVlpQRGdhSWFBOVlGc1NaaVJaNzd4WWNkcHVPbVlOc3kwRHZxendRPT0ifQ%3D%3D.758d5dc8a541e933.ODc1ZjBjMWIwMzY4NTBjNzg4Njk5MTQ1YTgzMDE1NmE4MmIxY2I1ZTI2ZTJmN2I1OWZmMDFmZTljMWZkOGRkNA%3D%3D&re=https%3A%2F%2Fwww.firstcitizens.com%2F%3Fmkt_tok%3DMjk2LUNQWC0yOTUAAAGGjzWEenlD9bhQeI4yKU4PJ5Eg5xUYrIuOJJSXEvW7jT2yjNYpb3L3rorhi9Z_gG-_zI6eKyJLQDzI_99g55Pt-q-TEO8XVAg7nqO2Hj8X&eu=https%3A%2F%2Fwww.firstcitizens.com%2F&icid=166195671799769454&sr=https%3A%2F%2Fwww.firstcitizens.com%2Fetc.clientlibs%2Ffirstcitizens%2Fclientlibs%2Fclientlib-aem.css
Frame ID: 3C8594E4FC41EE5D143709D1DC35DFC6
Requests: 1 HTTP requests in this frame

Frame: https://trk.firstcitizens.com/200189/fulvip.html?sui=5e714debaf6d4439159f3327270b947e7ac3ebf8e0985c5788545626262bff8c
Frame ID: A2CFC1D7DC837CAD7FF1D87C7A1908E3
Requests: 2 HTTP requests in this frame

Frame: https://6528888.fls.doubleclick.net/activityi;dc_pre=CInq056n8fkCFRrUmgodIHAINg;cat=sitev03p;ord=1;src=6528888;type=count0
Frame ID: 4ADF09DA1AA4DF38EA428C427A4F6E1F
Requests: 1 HTTP requests in this frame

Frame: https://adservice.google.com/ddm/fls/i/dc_pre=CInq056n8fkCFRrUmgodIHAINg;cat=sitev03p;ord=1;src=6528888;type=count0;~oref=https://www.firstcitizens.com/
Frame ID: 2D464831EE7FF7BF7FC5D51233F1CE4E
Requests: 1 HTTP requests in this frame

Frame: https://adservice.google.de/ddm/fls/i/dc_pre=CInq056n8fkCFRrUmgodIHAINg;cat=sitev03p;ord=1;src=6528888;type=count0;~oref=https://www.firstcitizens.com/
Frame ID: C0E2403D42FFE73C5221FD5B2138D03C
Requests: 1 HTTP requests in this frame

Frame: https://9786468.fls.doubleclick.net/activityi;dc_pre=COqsmqCn8fkCFZrxmgodyw4Mvw;cat=fcb-u0;src=9786468;type=unive0
Frame ID: 25A6D6D10D92A61CBBE2CB9CACC46FA5
Requests: 13 HTTP requests in this frame

Frame: https://trk.firstcitizens.com/200189/fulvip.html?sui=5e714debaf6d4439159f3327270b947e7ac3ebf8e0985c5788545626262bff8c
Frame ID: BE18FA7547A23AA7E0B2DDDEB76745D1
Requests: 2 HTTP requests in this frame

Frame: https://trk.firstcitizens.com/200189/tlen.html?si=0&e=https%3A%2F%2Fwww.firstcitizens.com&LSESSIONID=eyJpIjoid3hnckxST2s3c29SKytDVVwvZHJacGc9PSIsImUiOiI2RmdYSnQ2ZGhXR292dmx3a3Z4dTBlcWRyVU0yNTNyYWRSUW9HNkVcL1NpeVhOMDhyM25FZDFUZHBuNGRkejhNZmt4Z2RsUzg3RnpQZldwdkpzdGJQSlg1SWVKY3prV01UUUp0aTluNTdGdWIyRUJuVlpQRGdhSWFBOVlGc1NaaVJaNzd4WWNkcHVPbVlOc3kwRHZxendRPT0ifQ%3D%3D.758d5dc8a541e933.ODc1ZjBjMWIwMzY4NTBjNzg4Njk5MTQ1YTgzMDE1NmE4MmIxY2I1ZTI2ZTJmN2I1OWZmMDFmZTljMWZkOGRkNA%3D%3D&t=xframe&__tp=login&eu=https%3A%2F%2Fwww.firstcitizens.com%2F&icid=1661956721673996&sr=https%3A%2F%2Fwww.firstcitizens.com%2Fcontent%2Fdam%2Ffirstcitizens%2Fimages%2Fresources%2Fpersonal%2Fcredit%2F5-cs-of-credit%402x.jpg.transform%2Fresource-card-standard-3-desktop%2Fimage-scaled-2x-to-1x%2Fimage.jpeg
Frame ID: E18666BF70B1B10C4D54FD9024BFA563
Requests: 6 HTTP requests in this frame

Frame: https://trk.firstcitizens.com/200189/grobutl.html/discovercard.com/dfs/accounthome/summary/www.schwab.com/secure.accurint.com/unfcu2.org//login1/wachovia.com/MyAccounts.aspx/investing.schwab.com/secure/schwab///httpsabph.pl/pi/do/Authorization/alfabank.ru/swedbank/pf.bgz.pl/httponline.eurobank.pl/https://snsbank.nl/mijnsns/secure/login/?cid=5&si=0&e=https%3A%2F%2Fwww.firstcitizens.com&LSESSIONID=eyJpIjoid3hnckxST2s3c29SKytDVVwvZHJacGc9PSIsImUiOiI2RmdYSnQ2ZGhXR292dmx3a3Z4dTBlcWRyVU0yNTNyYWRSUW9HNkVcL1NpeVhOMDhyM25FZDFUZHBuNGRkejhNZmt4Z2RsUzg3RnpQZldwdkpzdGJQSlg1SWVKY3prV01UUUp0aTluNTdGdWIyRUJuVlpQRGdhSWFBOVlGc1NaaVJaNzd4WWNkcHVPbVlOc3kwRHZxendRPT0ifQ%3D%3D.758d5dc8a541e933.ODc1ZjBjMWIwMzY4NTBjNzg4Njk5MTQ1YTgzMDE1NmE4MmIxY2I1ZTI2ZTJmN2I1OWZmMDFmZTljMWZkOGRkNA%3D%3D&t=xframe&__tp=login&eu=https%3A%2F%2Fwww.firstcitizens.com%2F&icid=166195672168074903&sr=https%3A%2F%2Fwww.firstcitizens.com%2Fcontent%2Fdam%2Ffirstcitizens%2Fimages%2Fresources%2Fpersonal%2Fcredit%2F5-cs-of-credit%402x.jpg.transform%2Fresource-card-standard-3-desktop%2Fimage-scaled-2x-to-1x%2Fimage.jpeg
Frame ID: D08D2337B93C87FFC72186578C95DB55
Requests: 2 HTTP requests in this frame

Frame: https://trk.firstcitizens.com/200189/fulvip.html?sui=5e714debaf6d4439159f3327270b947e7ac3ebf8e0985c5788545626262bff8c
Frame ID: 426D9E1BD5F7CDCF78A094D9DDF9CA81
Requests: 2 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Personal Banking, Credit Cards, Loans | First Citizens Bank

Page URL History Show full URLs

https://click.firstcitizens.com/Mjk2LUNQWC0yOTUAAAGGjzWEepGrdE_F9gLAZ0-u2miichXjNgyPOUQYI11h_GdvYOzF1rx1NNgT... Page URL
https://www.firstcitizens.com/?mkt_tok=Mjk2LUNQWC0yOTUAAAGGjzWEenlD9bhQeI4yKU4PJ5Eg5xUYrIuOJJSXEvW7jT2yjNY... Page URL

Detected technologies

Adobe Experience Manager (CMS) Expand

Overall confidence: 100%
Detected patterns

/etc\.clientlibs/

Facebook (Widgets) Expand

Overall confidence: 100%
Detected patterns

//connect\.facebook\.([a-z]+)/[^/]*/[a-z]*\.js

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

google-analytics\.com/(?:ga|urchin|analytics)\.js

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/gtag/js

Linkedin Insight Tag (Analytics) Expand

Overall confidence: 100%
Detected patterns

snap\.licdn\.com/li\.lms-analytics/insight\.min\.js

Marketo (Marketing Automation) Expand

Overall confidence: 100%
Detected patterns

munchkin\.marketo\.\w+/(?:([\d.]+)/)?munchkin\.js

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

109
Requests

95 %
HTTPS

40 %
IPv6

29
Domains

44
Subdomains

39
IPs

7
Countries

2664 kB
Transfer

7233 kB
Size

44
Cookies

30 Outgoing links

These are links going to different origins than the main page.

URL: https://locations.firstcitizens.com/
Title: Find a Branch , Opens in a new tab

Search URL Search Domain Scan URL

URL: https://jobs.firstcitizens.com/
Title: Careers, Opens in a new tab

Search URL Search Domain Scan URL

URL: https://www.facebook.com/firstcitizensbank/
Title: , Opens in a new tab

Search URL Search Domain Scan URL

URL: https://twitter.com/firstcitizens
Title: , Opens in a new tab

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/company/first-citizens-bank/
Title: , Opens in a new tab

Search URL Search Domain Scan URL

URL: https://www.youtube.com/channel/UCGp8w5KIoFheteqBeKaKuXw
Title: , Opens in a new tab

Search URL Search Domain Scan URL

URL: https://digitalbanking.firstcitizens.com/FCBTC_AutoEnroll/SignUp.html
Title: Enroll Now Enroll in digital banking now

Search URL Search Domain Scan URL

URL: https://digitalbanking.firstcitizens.com/FCBTC_ForgotLogin/ForgotUsername.html
Title: Forgot ID Select if you forgot your ID

Search URL Search Domain Scan URL

URL: https://digitalbanking.firstcitizens.com/FCBTCOnline/uux.aspx#/login/resetPasswordUsername
Title: Password? Select if you forgot your password

Search URL Search Domain Scan URL

URL: https://commercialadvantage.firstcitizens.com/
Title: Log In Select to log in to Commercial Advantage

Search URL Search Domain Scan URL

URL: https://www.firstcitizensrewards.com/pages/main/default.aspx
Title: First Citizens Rewards®, Opens in a new tab

Search URL Search Domain Scan URL

URL: https://firstcitizens.netxinvestor.com/nxi/login
Title: Online Brokerage, Opens in a new tab

Search URL Search Domain Scan URL

URL: https://login.firstcitizens.com/home/idx-fcb_portfolioonlinetrustdeskrdms_1/0oaaj5zkwoF9rynJB357/alnaj65kbpplezvKH357
Title: Portfolio Online, Opens in a new tab

Search URL Search Domain Scan URL

URL: https://secure.newportgroup.com/login/fcb/participant
Title: Retirement Plan Access, Opens in a new tab

Search URL Search Domain Scan URL

URL: https://www.moneyguidepro.com/fcbwealthplanning/Guests.aspx
Title: Financial Planning Tool, Opens in a new tab

Search URL Search Domain Scan URL

URL: https://fcb.iphiview.com/fcb/
Title: Stellar Technology - Fund, Opens in a new tab

Search URL Search Domain Scan URL

URL: https://www.onlinetreasurysolutions.com/portal/esec/login.ht
Title: Lockbox - Online Treasury Solutions, Opens in a new tab

Search URL Search Domain Scan URL

URL: https://www.remoteimagedeposit.com/FCBNC/Login.faces?DOMAIN=customerDomain&LOCALE=en_US&SHOWTIPS=true
Title: Remote Deposit Capture, Opens in a new tab

Search URL Search Domain Scan URL

URL: https://automatedpayables.mineraltree.com/app/login?returnUrl=/
Title: Automated Payables, Opens in a new tab

Search URL Search Domain Scan URL

URL: https://login.firstcitizens.com/home/idx-fcb_commercialadvantageintegratedpayments_1/0oafd44fclJxgDsNd357/alnfd4b0lpeInH6xi357
Title: CA Integrated Payments, Opens in a new tab

Search URL Search Domain Scan URL

URL: https://pmx.vancopayments.com/#/firstcitizens/signin
Title: eReceivables Payment, Opens in a new tab

Search URL Search Domain Scan URL

URL: https://receivables.regulusgroup.com/lockbox/Authentication/PSGLogin.aspx?undefined&screenWidth=1366
Title: Lockbox Portal, Opens in a new tab

Search URL Search Domain Scan URL

URL: https://unity.sandtechnologygroup.com/Account/Login/N5574KQR4pVhXf1kWgdBNVx5GGrMsuik46_AlzYzgjU1
Title: Smart Returns, Opens in a new tab

Search URL Search Domain Scan URL

URL: https://fxboss.firstcitizens.com/cas/login?service=https%3A%2F%2Ffxboss.firstcitizens.com%2F%2Fj_spring_cas_security_check
Title: FXEnvoy, Opens in a new tab

Search URL Search Domain Scan URL

URL: https://portal.csr24.com/mvc/8339761
Title: My Insurance Center, Opens in a new tab

Search URL Search Domain Scan URL

URL: https://www.mreports.com/sso/login?service=https%3A%2F%2Fwww.mreports.com%2Fportal%2Fstart%2Ffcb
Title: Merchant eConnections, Opens in a new tab

Search URL Search Domain Scan URL

URL: https://app10.firstcitizensinsights.com/dashboard/#/signin
Title: Merchant Insights, Opens in a new tab

Search URL Search Domain Scan URL

URL: https://www.americanexpress.com/en-us/business/merchant/supplies/
Title: American Express Supplies, Opens in a new tab

Search URL Search Domain Scan URL

URL: https://360control.firstdata.com/UI/login/views/login.html#/Login/246883/840/fir0000034/0/
Title: Purchasing Card, Opens in a new tab

Search URL Search Domain Scan URL

URL: https://login.firstcitizens.com/home/idx-fcb_electronicbillpresentmentandpaymentebpp_1/0oaaj5yattL4cd8MD357/alnaj62h75xFvYj6x357
Title: Electronic Bill Presentment & Payment, Opens in a new tab

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://click.firstcitizens.com/Mjk2LUNQWC0yOTUAAAGGjzWEepGrdE_F9gLAZ0-u2miichXjNgyPOUQYI11h_GdvYOzF1rx1NNgTrWni8ZiQFhJmJHQ= Page URL
https://www.firstcitizens.com/?mkt_tok=Mjk2LUNQWC0yOTUAAAGGjzWEenlD9bhQeI4yKU4PJ5Eg5xUYrIuOJJSXEvW7jT2yjNYpb3L3rorhi9Z_gG-_zI6eKyJLQDzI_99g55Pt-q-TEO8XVAg7nqO2Hj8X Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 29

https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=2970716&time=1661956717464&url=https%3A%2F%2Fwww.firstcitizens.com%2F%3Fmkt_tok%3DMjk2LUNQWC0yOTUAAAGGjzWEenlD9bhQeI4yKU4PJ5Eg5xUYrIuOJJSXEvW7jT2yjNYpb3L3rorhi9Z_gG-_zI6eKyJLQDzI_99g55Pt-q-TEO8XVAg7nqO2Hj8X HTTP 302
https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D2970716%26time%3D1661956717464%26url%3Dhttps%253A%252F%252Fwww.firstcitizens.com%252F%253Fmkt_tok%253DMjk2LUNQWC0yOTUAAAGGjzWEenlD9bhQeI4yKU4PJ5Eg5xUYrIuOJJSXEvW7jT2yjNYpb3L3rorhi9Z_gG-_zI6eKyJLQDzI_99g55Pt-q-TEO8XVAg7nqO2Hj8X%26liSync%3Dtrue HTTP 302
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=2970716&time=1661956717464&url=https%3A%2F%2Fwww.firstcitizens.com%2F%3Fmkt_tok%3DMjk2LUNQWC0yOTUAAAGGjzWEenlD9bhQeI4yKU4PJ5Eg5xUYrIuOJJSXEvW7jT2yjNYpb3L3rorhi9Z_gG-_zI6eKyJLQDzI_99g55Pt-q-TEO8XVAg7nqO2Hj8X&liSync=true HTTP 302
https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=2970716&time=1661956717464&url=https%3A%2F%2Fwww.firstcitizens.com%2F%3Fmkt_tok%3DMjk2LUNQWC0yOTUAAAGGjzWEenlD9bhQeI4yKU4PJ5Eg5xUYrIuOJJSXEvW7jT2yjNYpb3L3rorhi9Z_gG-_zI6eKyJLQDzI_99g55Pt-q-TEO8XVAg7nqO2Hj8X&liSync=true&e_ipv6=AQKumhlXZovjXAAAAYL0Vv2_x0QYdBJsaz__9jifVOYUc4tP9TlCb6jGLAP8HBrWkW1DR_jpVgDk

Request Chain 32

https://cm.everesttech.net/cm/dd?d_uuid=20077602378767582852873053970317377673 HTTP 302
https://dpm.demdex.net/ibs:dpid=411&dpuuid=Yw9ybQAAAMRovgOJ

Request Chain 43

https://6528888.fls.doubleclick.net/activityi;cat=sitev03p;ord=1;src=6528888;type=count0 HTTP 302
https://6528888.fls.doubleclick.net/activityi;dc_pre=CInq056n8fkCFRrUmgodIHAINg;cat=sitev03p;ord=1;src=6528888;type=count0

Request Chain 61

https://9786468.fls.doubleclick.net/activityi;cat=fcb-u0;src=9786468;type=unive0 HTTP 302
https://9786468.fls.doubleclick.net/activityi;dc_pre=COqsmqCn8fkCFZrxmgodyw4Mvw;cat=fcb-u0;src=9786468;type=unive0

Request Chain 73

https://tags.w55c.net/rs?id=51b9ba5765fa41d0a20f86741131dc72&t=marketing HTTP 302
https://tags.w55c.net/rs?sccid=ddd7cdcd-a2a6-ec76-3046-756a7267623f&scc=1&id=51b9ba5765fa41d0a20f86741131dc72&t=marketing

Request Chain 75

https://action.dstillery.com/orbserv/nsjs?adv=cl1027245&ns=4080&nc=FCBHomepage&ncv=32&dstOrderId=[OrderId]&dstOrderAmount=[OrderAmount] HTTP 302
https://action.media6degrees.com/orbserv/nsjs?adv=cl1027245&ns=4080&nc=FCBHomepage&ncv=32&dstOrderId=[OrderId]&dstOrderAmount=[OrderAmount]

109 HTTP transactions
1 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 302 Mjk2LUNQWC0yOTUAAAGGjzWEepGrdE_F9gLAZ0-u2miichXjNgyPOUQYI11h_GdvYOzF1rx1NNgTrWni8ZiQFhJmJHQ=
click.firstcitizens.com/ 515 B
1 KB 261ms
206ms Document
text/html 104.17.72.206
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://click.firstcitizens.com/Mjk2LUNQWC0yOTUAAAGGjzWEepGrdE_F9gLAZ0-u2miichXjNgyPOUQYI11h_GdvYOzF1rx1NNgTrWni8ZiQFhJmJHQ=

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

104.17.72.206 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	default-src 'self'; img-src 'self';script-src 'self' 'sha256-qriJlH823x8+MLNVeMFMZpthotziBIOGm9q827fR30M=';object-src 'none';form-action:'none';frame-src:'none'
X-Frame-Options	SAMEORIGIN

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

cache-control: private, no-cache, no-store, max-age=0
cf-cache-status: DYNAMIC
cf-ray: 743682be5e07925c-FRA
content-security-policy: default-src 'self'; img-src 'self';script-src 'self' 'sha256-qriJlH823x8+MLNVeMFMZpthotziBIOGm9q827fR30M=';object-src 'none';form-action:'none';frame-src:'none'
content-type: text/html;charset=UTF-8
date: Wed, 31 Aug 2022 14:38:35 GMT
referrer-policy: strict-origin
server: cloudflare
x-frame-options: SAMEORIGIN
x-request-id: aacdc8bcf99a0d30

GET
H2 200 Primary Request / Show response
www.firstcitizens.com/ 163 KB
29 KB 1175ms
937ms Document
text/html 52.206.240.104
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://www.firstcitizens.com/?mkt_tok=Mjk2LUNQWC0yOTUAAAGGjzWEenlD9bhQeI4yKU4PJ5Eg5xUYrIuOJJSXEvW7jT2yjNYpb3L3rorhi9Z_gG-_zI6eKyJLQDzI_99g55Pt-q-TEO8XVAg7nqO2Hj8X

Requested by

Host: click.firstcitizens.com
URL: https://click.firstcitizens.com/Mjk2LUNQWC0yOTUAAAGGjzWEepGrdE_F9gLAZ0-u2miichXjNgyPOUQYI11h_GdvYOzF1rx1NNgTrWni8ZiQFhJmJHQ=

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.206.240.104 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-52-206-240-104.compute-1.amazonaws.com

Software

Apache /

Resource Hash

9a299923eea8e6bd0b0562f7919d02a13b43ff891920ad42319e411ae682fe10

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://click.firstcitizens.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

access-control-allow-credentials: true
access-control-allow-headers: x-requested-with, Content-Type, origin, authorization, accept, client-security-token, Access-Control-Request-Method, Access-Control-Request-Headers, __token__,d6gq0uiuiy-a,d6gq0uiuiy-b,d6gq0uiuiy-c,d6gq0uiuiy-d,d6gq0uiuiy-f,d6gq0uiuiy-z,x-okta-user-agent-extended
access-control-allow-methods: GET, OPTIONS, HEAD
access-control-max-age: 1000
content-encoding: gzip
content-length: 29212
content-type: text/html;charset=utf-8
date: Wed, 31 Aug 2022 14:38:36 GMT
server: Apache
vary: Origin,User-Agent,Accept-Encoding
x-content-type-options: nosniff
x-custom-location: DE,TH,Erfurt
x-dispatcher: dispatcher2useast1
x-frame-options: SAMEORIGIN
x-vhost: publish

GET
H2 200 common.js Show response
cds-sdkcfg.onlineaccess1.com/ 202 KB
110 KB 256ms
175ms Script
application/javascript 192.0.54.4
Q2HOLDINGS

General

Check archive.org

Show headers Download Go to

Full URL

https://cds-sdkcfg.onlineaccess1.com/common.js

Requested by

Host: www.firstcitizens.com
URL: https://www.firstcitizens.com/?mkt_tok=Mjk2LUNQWC0yOTUAAAGGjzWEenlD9bhQeI4yKU4PJ5Eg5xUYrIuOJJSXEvW7jT2yjNYpb3L3rorhi9Z_gG-_zI6eKyJLQDzI_99g55Pt-q-TEO8XVAg7nqO2Hj8X

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.54.4 , United States, ASN62659 (Q2HOLDINGS, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e63a4fb8974e1af8329f29da6d5577bda98b2c850b6803737a544f0878883a7a

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.firstcitizens.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 31 Aug 2022 14:38:36 GMT
via: 1.1 google
cf-cache-status: DYNAMIC
server: cloudflare
strict-transport-security: max-age=15552000; includeSubDomains; preload
content-type: application/javascript; charset=UTF-8
content-encoding: gzip
cache-control: no-cache, no-store, must-revalidate
cf-ray: 743682c7ab4e5ca4-FRA
x-ion-hop: prod
expires: 0

GET
H2 200 clientlib-aem.css
www.firstcitizens.com/etc.clientlibs/firstcitizens/clientlibs/ 384 KB
38 KB 207ms
207ms Stylesheet
text/css 52.206.240.104
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://www.firstcitizens.com/etc.clientlibs/firstcitizens/clientlibs/clientlib-aem.css

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.206.240.104 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-52-206-240-104.compute-1.amazonaws.com

Software

Apache /

Resource Hash

80c2563d02969374b040e33efeed326951c45ebe05aa5eab4e38fede33ded2c4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.firstcitizens.com/?mkt_tok=Mjk2LUNQWC0yOTUAAAGGjzWEenlD9bhQeI4yKU4PJ5Eg5xUYrIuOJJSXEvW7jT2yjNYpb3L3rorhi9Z_gG-_zI6eKyJLQDzI_99g55Pt-q-TEO8XVAg7nqO2Hj8X
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

x-dispatcher: dispatcher1useast1
date: Wed, 31 Aug 2022 14:38:36 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 57063
x-vhost: publish
vary: Origin,Accept-Encoding,User-Agent
content-length: 38253
x-custom-location: DE,TH,Erfurt
last-modified: Tue, 30 Aug 2022 22:26:30 GMT
server: Apache
x-frame-options: SAMEORIGIN
etag: "5ff71-5e77cdf305180-gzip"
access-control-max-age: 1000
access-control-allow-methods: GET, OPTIONS, HEAD
content-type: text/css;charset=utf-8
cache-control: max-age=2592000 env=long_expires
access-control-allow-credentials: true
accept-ranges: bytes
access-control-allow-headers: x-requested-with, Content-Type, origin, authorization, accept, client-security-token, Access-Control-Request-Method, Access-Control-Request-Headers, __token__,d6gq0uiuiy-a,d6gq0uiuiy-b,d6gq0uiuiy-c,d6gq0uiuiy-d,d6gq0uiuiy-f,d6gq0uiuiy-z,x-okta-user-agent-extended

GET
H2 200 answers.min.js Show response
assets.sitescdn.net/answers/v0.13.1/ 368 KB
102 KB 94ms
42ms Script
application/javascript 2606:4700::6812:7434
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.sitescdn.net/answers/v0.13.1/answers.min.js
Requested by: Host: www.firstcitizens.com
URL: https://www.firstcitizens.com/?mkt_tok=Mjk2LUNQWC0yOTUAAAGGjzWEenlD9bhQeI4yKU4PJ5Eg5xUYrIuOJJSXEvW7jT2yjNYpb3L3rorhi9Z_gG-_zI6eKyJLQDzI_99g55Pt-q-TEO8XVAg7nqO2Hj8X
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 2606:4700::6812:7434 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 6cdb76a12fdc124b0a3e053eb3be7d2a837afb43e459fdda17416979a95d0220

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.firstcitizens.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

date: Wed, 31 Aug 2022 14:38:36 GMT
content-encoding: gzip
cf-cache-status: HIT
last-modified: Fri, 03 Apr 2020 16:08:44 GMT
server: cloudflare
age: 5985533
etag: W/"125adc663cd8df095f39b2d92196ee48"
vary: Accept-Encoding
x-amz-version-id: null
content-type: application/javascript
cache-control: max-age=31536000
cf-ray: 743682c77d3ebbf5-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-amz-request-id: 7P6C4BP49Z9V1BKD
x-amz-id-2: pnQfGZWIM6n4VpVytjifilMNOTvfCrKGf8SkHU5DlmNC1dEJaeFA95LgGTNJMnmagc43UofWs3c=

GET
H2 200 launch-3bb7433af2ae.min.js Show response
assets.adobedtm.com/60e0841c6ded/d5a97f0ea4af/ 503 KB
106 KB 94ms
26ms Script
application/x-javascript 2a02:26f0:3500:587::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/60e0841c6ded/d5a97f0ea4af/launch-3bb7433af2ae.min.js
Requested by: Host: www.firstcitizens.com
URL: https://www.firstcitizens.com/?mkt_tok=Mjk2LUNQWC0yOTUAAAGGjzWEenlD9bhQeI4yKU4PJ5Eg5xUYrIuOJJSXEvW7jT2yjNYpb3L3rorhi9Z_gG-_zI6eKyJLQDzI_99g55Pt-q-TEO8XVAg7nqO2Hj8X
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:3500:587::1e80 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: e75cb51bd7ce7787508f9cf6bf31a28292723be2ed73d374a8301d2b753daf4a

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.firstcitizens.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

date: Wed, 31 Aug 2022 14:38:37 GMT
content-encoding: gzip
last-modified: Tue, 30 Aug 2022 14:46:51 GMT
server: AkamaiNetStorage
etag: "d244913d9a6dd7bcccaee9312e5736ab:1661870811.459147"
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: https://www.firstcitizens.com
cache-control: max-age=3600
accept-ranges: bytes
timing-allow-origin: *
content-length: 108381
expires: Wed, 31 Aug 2022 15:38:37 GMT

GET
H2 200 image.20220805.jpeg
www.firstcitizens.com/content/dam/firstcitizens/images/home-hero/retail-08-2022@2x.jpg.transform/image-scaled-2x-to-1x/ 211 KB
212 KB 531ms
531ms Image
image/jpeg 52.206.240.104
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.firstcitizens.com/content/dam/firstcitizens/images/home-hero/retail-08-2022@2x.jpg.transform/image-scaled-2x-to-1x/image.20220805.jpeg

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.206.240.104 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-52-206-240-104.compute-1.amazonaws.com

Software

Apache /

Resource Hash

110a2183d3c26bd04d9328e3341b22cab3c4eea0e049511cbcb3d1a713620b38

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.firstcitizens.com/?mkt_tok=Mjk2LUNQWC0yOTUAAAGGjzWEenlD9bhQeI4yKU4PJ5Eg5xUYrIuOJJSXEvW7jT2yjNYpb3L3rorhi9Z_gG-_zI6eKyJLQDzI_99g55Pt-q-TEO8XVAg7nqO2Hj8X
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

x-dispatcher: dispatcher1useast1
date: Wed, 31 Aug 2022 14:38:37 GMT
x-content-type-options: nosniff
age: 2228616
x-vhost: publish
vary: Origin
content-length: 216234
x-custom-location: DE,TH,Erfurt
last-modified: Fri, 05 Aug 2022 19:35:01 GMT
server: Apache
x-frame-options: SAMEORIGIN
etag: "34caa-5e5838fe24340"
access-control-max-age: 1000
access-control-allow-methods: GET, OPTIONS, HEAD
content-type: image/jpeg
cache-control: max-age=31536000, public
access-control-allow-credentials: true
accept-ranges: bytes
access-control-allow-headers: x-requested-with, Content-Type, origin, authorization, accept, client-security-token, Access-Control-Request-Method, Access-Control-Request-Headers, __token__,d6gq0uiuiy-a,d6gq0uiuiy-b,d6gq0uiuiy-c,d6gq0uiuiy-d,d6gq0uiuiy-f,d6gq0uiuiy-z,x-okta-user-agent-extended

GET
H2 200 clientlib-aem.js Show response
www.firstcitizens.com/etc.clientlibs/firstcitizens/clientlibs/ 277 KB
71 KB 245ms
245ms Script
application/javascript 52.206.240.104
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://www.firstcitizens.com/etc.clientlibs/firstcitizens/clientlibs/clientlib-aem.js

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.206.240.104 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-52-206-240-104.compute-1.amazonaws.com

Software

Apache /

Resource Hash

805a44971461372a2726181a1d3057d7e81f38ed99b423c47f85c8d5b267802d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.firstcitizens.com/?mkt_tok=Mjk2LUNQWC0yOTUAAAGGjzWEenlD9bhQeI4yKU4PJ5Eg5xUYrIuOJJSXEvW7jT2yjNYpb3L3rorhi9Z_gG-_zI6eKyJLQDzI_99g55Pt-q-TEO8XVAg7nqO2Hj8X
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

x-dispatcher: dispatcher2useast1
date: Wed, 31 Aug 2022 14:38:37 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 57064
x-vhost: publish
vary: Origin,Accept-Encoding,User-Agent
x-custom-location: DE,TH,Erfurt
last-modified: Tue, 30 Aug 2022 22:35:56 GMT
server: Apache
x-frame-options: SAMEORIGIN
etag: "452d8-5e77d00eccb00-gzip"
access-control-max-age: 1000
access-control-allow-methods: GET, OPTIONS, HEAD
content-type: application/javascript;charset=utf-8
cache-control: max-age=2592000 env=long_expires
access-control-allow-credentials: true
accept-ranges: bytes
access-control-allow-headers: x-requested-with, Content-Type, origin, authorization, accept, client-security-token, Access-Control-Request-Method, Access-Control-Request-Headers, __token__,d6gq0uiuiy-a,d6gq0uiuiy-b,d6gq0uiuiy-c,d6gq0uiuiy-d,d6gq0uiuiy-f,d6gq0uiuiy-z,x-okta-user-agent-extended

GET
H2 200 clientlib-dependencies.js Show response
www.firstcitizens.com/etc.clientlibs/firstcitizens/clientlibs/ 0
626 B 580ms
577ms Script
application/javascript 52.206.240.104
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://www.firstcitizens.com/etc.clientlibs/firstcitizens/clientlibs/clientlib-dependencies.js

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.206.240.104 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-52-206-240-104.compute-1.amazonaws.com

Software

Apache /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.firstcitizens.com/?mkt_tok=Mjk2LUNQWC0yOTUAAAGGjzWEenlD9bhQeI4yKU4PJ5Eg5xUYrIuOJJSXEvW7jT2yjNYpb3L3rorhi9Z_gG-_zI6eKyJLQDzI_99g55Pt-q-TEO8XVAg7nqO2Hj8X
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

x-dispatcher: dispatcher2useast1
date: Wed, 31 Aug 2022 14:38:37 GMT
x-content-type-options: nosniff
age: 57062
x-vhost: publish
vary: Origin,User-Agent
content-length: 0
x-custom-location: DE,TH,Erfurt
last-modified: Mon, 25 Nov 2019 21:30:39 GMT
server: Apache
x-frame-options: SAMEORIGIN
etag: "0-598327992bdc0"
access-control-max-age: 1000
access-control-allow-methods: GET, OPTIONS, HEAD
content-type: application/javascript;charset=utf-8
cache-control: max-age=2592000 env=long_expires
access-control-allow-credentials: true
accept-ranges: bytes
access-control-allow-headers: x-requested-with, Content-Type, origin, authorization, accept, client-security-token, Access-Control-Request-Method, Access-Control-Request-Headers, __token__,d6gq0uiuiy-a,d6gq0uiuiy-b,d6gq0uiuiy-c,d6gq0uiuiy-d,d6gq0uiuiy-f,d6gq0uiuiy-z,x-okta-user-agent-extended

GET
H2 200 icons.svg
www.firstcitizens.com/etc.clientlibs/firstcitizens/clientlibs/clientlib-aem/resources/icons/ 1 MB
246 KB 635ms
635ms Other
image/svg+xml 52.206.240.104
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://www.firstcitizens.com/etc.clientlibs/firstcitizens/clientlibs/clientlib-aem/resources/icons/icons.svg

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.206.240.104 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-52-206-240-104.compute-1.amazonaws.com

Software

Apache /

Resource Hash

10078f6f9f0c199a299e17362a2db7cb61d0da35a3b0292e11e72abff5c146ba

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.firstcitizens.com/?mkt_tok=Mjk2LUNQWC0yOTUAAAGGjzWEenlD9bhQeI4yKU4PJ5Eg5xUYrIuOJJSXEvW7jT2yjNYpb3L3rorhi9Z_gG-_zI6eKyJLQDzI_99g55Pt-q-TEO8XVAg7nqO2Hj8X
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

x-dispatcher: dispatcher2useast1
date: Wed, 31 Aug 2022 14:38:37 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 57061
x-vhost: publish
vary: Origin,Accept-Encoding,User-Agent
x-custom-location: DE,TH,Erfurt
last-modified: Wed, 03 Feb 2021 00:16:33 GMT
server: Apache
x-frame-options: SAMEORIGIN
etag: "10688c-5ba637fd8da40-gzip"
access-control-max-age: 1000
access-control-allow-methods: GET, OPTIONS, HEAD
content-type: image/svg+xml
cache-control: max-age=31536000, public
access-control-allow-credentials: true
accept-ranges: bytes
access-control-allow-headers: x-requested-with, Content-Type, origin, authorization, accept, client-security-token, Access-Control-Request-Method, Access-Control-Request-Headers, __token__,d6gq0uiuiy-a,d6gq0uiuiy-b,d6gq0uiuiy-c,d6gq0uiuiy-d,d6gq0uiuiy-f,d6gq0uiuiy-z,x-okta-user-agent-extended

GET
H2 200 HarmoniaSansStd-Regular.woff2
www.firstcitizens.com/etc.clientlibs/firstcitizens/clientlibs/clientlib-aem/resources/fonts/HarmoniaSansStd/ 19 KB
20 KB 628ms
627ms Font
application/octet-stream 52.206.240.104
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://www.firstcitizens.com/etc.clientlibs/firstcitizens/clientlibs/clientlib-aem/resources/fonts/HarmoniaSansStd/HarmoniaSansStd-Regular.woff2

Requested by

Host: www.firstcitizens.com
URL: https://www.firstcitizens.com/etc.clientlibs/firstcitizens/clientlibs/clientlib-aem.css

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.206.240.104 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-52-206-240-104.compute-1.amazonaws.com

Software

Apache /

Resource Hash

3966f3091c7e9c586b259d00f5f9be81420299206ce4e503d7730436809cd200

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://www.firstcitizens.com/etc.clientlibs/firstcitizens/clientlibs/clientlib-aem.css
Origin: https://www.firstcitizens.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

x-dispatcher: dispatcher1useast1
date: Wed, 31 Aug 2022 14:38:37 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 57061
x-vhost: publish
vary: Origin,Accept-Encoding,User-Agent
content-length: 19803
x-custom-location: DE,TH,Erfurt
last-modified: Thu, 06 Aug 2020 21:17:41 GMT
server: Apache
x-frame-options: SAMEORIGIN
etag: "4d44-5ac3c04bc0740-gzip"
access-control-max-age: 1000
access-control-allow-methods: GET, OPTIONS, HEAD
content-type: application/octet-stream
cache-control: max-age=31536000, public
access-control-allow-credentials: true
accept-ranges: bytes
access-control-allow-headers: x-requested-with, Content-Type, origin, authorization, accept, client-security-token, Access-Control-Request-Method, Access-Control-Request-Headers, __token__,d6gq0uiuiy-a,d6gq0uiuiy-b,d6gq0uiuiy-c,d6gq0uiuiy-d,d6gq0uiuiy-f,d6gq0uiuiy-z,x-okta-user-agent-extended

GET
H2 200 HarmoniaSansStd-Bold.woff2
www.firstcitizens.com/etc.clientlibs/firstcitizens/clientlibs/clientlib-aem/resources/fonts/HarmoniaSansStd/ 21 KB
21 KB 525ms
524ms Font
application/octet-stream 52.206.240.104
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://www.firstcitizens.com/etc.clientlibs/firstcitizens/clientlibs/clientlib-aem/resources/fonts/HarmoniaSansStd/HarmoniaSansStd-Bold.woff2

Requested by

Host: www.firstcitizens.com
URL: https://www.firstcitizens.com/etc.clientlibs/firstcitizens/clientlibs/clientlib-aem.css

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.206.240.104 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-52-206-240-104.compute-1.amazonaws.com

Software

Apache /

Resource Hash

ae8b169a3a00e5da3b452394b70fbe8601e45df0951661c56070636f1840b7ad

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://www.firstcitizens.com/etc.clientlibs/firstcitizens/clientlibs/clientlib-aem.css
Origin: https://www.firstcitizens.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

x-dispatcher: dispatcher2useast1
date: Wed, 31 Aug 2022 14:38:37 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 57061
x-vhost: publish
vary: Origin,Accept-Encoding,User-Agent
content-length: 21218
x-custom-location: DE,TH,Erfurt
last-modified: Thu, 06 Aug 2020 21:17:45 GMT
server: Apache
x-frame-options: SAMEORIGIN
etag: "52d4-5ac3c04f91040-gzip"
access-control-max-age: 1000
access-control-allow-methods: GET, OPTIONS, HEAD
content-type: application/octet-stream
cache-control: max-age=31536000, public
access-control-allow-credentials: true
accept-ranges: bytes
access-control-allow-headers: x-requested-with, Content-Type, origin, authorization, accept, client-security-token, Access-Control-Request-Method, Access-Control-Request-Headers, __token__,d6gq0uiuiy-a,d6gq0uiuiy-b,d6gq0uiuiy-c,d6gq0uiuiy-d,d6gq0uiuiy-f,d6gq0uiuiy-z,x-okta-user-agent-extended

GET
H2 200 HarmoniaSansStd-SemiBd.woff2
www.firstcitizens.com/etc.clientlibs/firstcitizens/clientlibs/clientlib-aem/resources/fonts/HarmoniaSansStd/ 21 KB
21 KB 628ms
627ms Font
application/octet-stream 52.206.240.104
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://www.firstcitizens.com/etc.clientlibs/firstcitizens/clientlibs/clientlib-aem/resources/fonts/HarmoniaSansStd/HarmoniaSansStd-SemiBd.woff2

Requested by

Host: www.firstcitizens.com
URL: https://www.firstcitizens.com/etc.clientlibs/firstcitizens/clientlibs/clientlib-aem.css

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.206.240.104 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-52-206-240-104.compute-1.amazonaws.com

Software

Apache /

Resource Hash

56880c220888346c1dd6b286563a827de59a358ad28362889593113779d6d22b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://www.firstcitizens.com/etc.clientlibs/firstcitizens/clientlibs/clientlib-aem.css
Origin: https://www.firstcitizens.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

x-dispatcher: dispatcher1useast1
date: Wed, 31 Aug 2022 14:38:37 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 57062
x-vhost: publish
vary: Origin,Accept-Encoding,User-Agent
content-length: 21223
x-custom-location: DE,TH,Erfurt
last-modified: Thu, 06 Aug 2020 21:17:41 GMT
server: Apache
x-frame-options: SAMEORIGIN
etag: "52d0-5ac3c04bc0740-gzip"
access-control-max-age: 1000
access-control-allow-methods: GET, OPTIONS, HEAD
content-type: application/octet-stream
cache-control: max-age=31536000, public
access-control-allow-credentials: true
accept-ranges: bytes
access-control-allow-headers: x-requested-with, Content-Type, origin, authorization, accept, client-security-token, Access-Control-Request-Method, Access-Control-Request-Headers, __token__,d6gq0uiuiy-a,d6gq0uiuiy-b,d6gq0uiuiy-c,d6gq0uiuiy-d,d6gq0uiuiy-f,d6gq0uiuiy-z,x-okta-user-agent-extended

GET
H2 200 image.20210617.png
www.firstcitizens.com/content/dam/profile-manager/images/fcb-logo-horiz-web-2020@2x.png.transform/image-scaled-2x-to-1x/ 6 KB
7 KB 616ms
616ms Image
image/png 52.206.240.104
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.firstcitizens.com/content/dam/profile-manager/images/fcb-logo-horiz-web-2020@2x.png.transform/image-scaled-2x-to-1x/image.20210617.png

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.206.240.104 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-52-206-240-104.compute-1.amazonaws.com

Software

Apache /

Resource Hash

87b9ae2dd9b1a989b3bd956accea5b3279802343c66f74fba3e5dac161d40b71

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.firstcitizens.com/?mkt_tok=Mjk2LUNQWC0yOTUAAAGGjzWEenlD9bhQeI4yKU4PJ5Eg5xUYrIuOJJSXEvW7jT2yjNYpb3L3rorhi9Z_gG-_zI6eKyJLQDzI_99g55Pt-q-TEO8XVAg7nqO2Hj8X
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

x-dispatcher: dispatcher1useast1
date: Wed, 31 Aug 2022 14:38:37 GMT
x-content-type-options: nosniff
age: 16980549
x-vhost: publish
vary: Origin
content-length: 6390
x-custom-location: DE,TH,Erfurt
last-modified: Wed, 16 Feb 2022 01:49:28 GMT
server: Apache
x-frame-options: SAMEORIGIN
etag: "18f6-5d818dc285a00"
access-control-max-age: 1000
access-control-allow-methods: GET, OPTIONS, HEAD
content-type: image/png
cache-control: max-age=31536000, public
access-control-allow-credentials: true
accept-ranges: bytes
access-control-allow-headers: x-requested-with, Content-Type, origin, authorization, accept, client-security-token, Access-Control-Request-Method, Access-Control-Request-Headers, __token__,d6gq0uiuiy-a,d6gq0uiuiy-b,d6gq0uiuiy-c,d6gq0uiuiy-d,d6gq0uiuiy-f,d6gq0uiuiy-z,x-okta-user-agent-extended

GET
H2 200 nican.js Show response
trk.firstcitizens.com/200189/ 65 KB
30 KB 345ms
107ms Script
application/x-javascript 44.196.18.202
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://trk.firstcitizens.com/200189/nican.js?r=0.6841632985645933

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

44.196.18.202 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-44-196-18-202.compute-1.amazonaws.com

Software

haile /

Resource Hash

2162bbedb2ea0b70a53607e0644780a79a479f26b4efd17bb4b88ae46861552b

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.firstcitizens.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 31 Aug 2022 14:38:37 GMT
content-encoding: gzip
server: haile
strict-transport-security: max-age=86400
access-control-allow-methods: GET, OPTIONS
p3p: CP="NOI ADM DEV PSAi COM NAV OUR OTR STP IND DEM"
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
content-type: application/x-javascript
pics-label: (PICS-1.1 "http://www.icra.org/pics/vocabularyv03/" l r (n 0 s 0 v 0 l 0 oa 0 ob 0 oc 0 od 0 oe 0 of 0 og 0 oh 0 c 0) "http://www.icra.org/ratingsv02.html" l r (nz 0 vz 0 lz 0 oz 0 cz 0) "http://www.rsac.org/ratingsv01.html" l r (n 0 s 0 v 0 l 0))

GET
H2 200 loadsnippet.js Show response
trk.firstcitizens.com/200189/ 67 KB
30 KB 448ms
211ms Script
application/x-javascript 44.196.18.202
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://trk.firstcitizens.com/200189/loadsnippet.js?dt=login&r=0.4503290050801143

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

44.196.18.202 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-44-196-18-202.compute-1.amazonaws.com

Software

haile /

Resource Hash

5e93a44b6c9fa868f58c261066a7e9aa872426dedf5ecc234cfe797a112cd2e2

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.firstcitizens.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 31 Aug 2022 14:38:37 GMT
content-encoding: gzip
server: haile
strict-transport-security: max-age=86400
access-control-allow-methods: GET, OPTIONS
p3p: CP="NOI ADM DEV PSAi COM NAV OUR OTR STP IND DEM"
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
content-type: application/x-javascript
pics-label: (PICS-1.1 "http://www.icra.org/pics/vocabularyv03/" l r (n 0 s 0 v 0 l 0 oa 0 ob 0 oc 0 od 0 oe 0 of 0 og 0 oh 0 c 0) "http://www.icra.org/ratingsv02.html" l r (nz 0 vz 0 lz 0 oz 0 cz 0) "http://www.rsac.org/ratingsv01.html" l r (n 0 s 0 v 0 l 0))

GET
H2 200 ruxitagent_A2SVfqru_10205201116183137.js Show response
js-cdn.dynatrace.com/jstag/165658ccba3/ 160 KB
63 KB 74ms
23ms Script
application/javascript 99.86.4.115
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://js-cdn.dynatrace.com/jstag/165658ccba3/ruxitagent_A2SVfqru_10205201116183137.js
Requested by: Host: www.firstcitizens.com
URL: https://www.firstcitizens.com/?mkt_tok=Mjk2LUNQWC0yOTUAAAGGjzWEenlD9bhQeI4yKU4PJ5Eg5xUYrIuOJJSXEvW7jT2yjNYpb3L3rorhi9Z_gG-_zI6eKyJLQDzI_99g55Pt-q-TEO8XVAg7nqO2Hj8X
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 99.86.4.115 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-4-115.fra6.r.cloudfront.net
Software: /
Resource Hash: 522993c06425afcdbc27ba10376fa083699d476174dac91562b98528bec90ebd

Request headers

Referer: https://www.firstcitizens.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36
Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

date: Wed, 15 Jun 2022 02:01:34 GMT
content-encoding: gzip
age: 6698223
x-cache: Hit from cloudfront
x-oneagent-js-injection: true
traffic-source: UNKNOWN
access-control-allow-origin: *
dynatrace-response-id: JSLMWUGSHOYC
dynatrace-response-source: Cluster
vary: Accept-Encoding
content-type: application/javascript;charset=utf-8
via: 1.1 d8e97d2c28917e4c41ab79bb1e94b844.cloudfront.net (CloudFront)
cache-control: public, max-age=31536000, immutable
x-amz-cf-pop: FRA6-C1
timing-allow-origin: *
x-amz-cf-id: UcBemEbnvE2PAKLzgnikwQ1TjXm7E8AWKSKsCJDbUu2fMJmyUiz1NA==
expires: Thu, 15 Jun 2023 02:01:34 GMT

GET
H2 200 wave-pattern-blue.svg
www.firstcitizens.com/etc.clientlibs/firstcitizens/clientlibs/clientlib-aem/resources/images/ 135 KB
43 KB 593ms
593ms Image
image/svg+xml 52.206.240.104
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.firstcitizens.com/etc.clientlibs/firstcitizens/clientlibs/clientlib-aem/resources/images/wave-pattern-blue.svg

Requested by

Host: www.firstcitizens.com
URL: https://www.firstcitizens.com/etc.clientlibs/firstcitizens/clientlibs/clientlib-aem.css

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.206.240.104 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-52-206-240-104.compute-1.amazonaws.com

Software

Apache /

Resource Hash

112646b6a3606cf96c0fd6e9247351325cb07fdb8801ec5069c9e6213d44945c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.firstcitizens.com/etc.clientlibs/firstcitizens/clientlibs/clientlib-aem.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

x-dispatcher: dispatcher2useast1
date: Wed, 31 Aug 2022 14:38:37 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 57058
x-vhost: publish
vary: Origin,Accept-Encoding,User-Agent
content-length: 43609
x-custom-location: DE,TH,Erfurt
last-modified: Thu, 06 Aug 2020 21:17:45 GMT
server: Apache
x-frame-options: SAMEORIGIN
etag: "21ae6-5ac3c04f91040-gzip"
access-control-max-age: 1000
access-control-allow-methods: GET, OPTIONS, HEAD
content-type: image/svg+xml
cache-control: max-age=31536000, public
access-control-allow-credentials: true
accept-ranges: bytes
access-control-allow-headers: x-requested-with, Content-Type, origin, authorization, accept, client-security-token, Access-Control-Request-Method, Access-Control-Request-Headers, __token__,d6gq0uiuiy-a,d6gq0uiuiy-b,d6gq0uiuiy-c,d6gq0uiuiy-d,d6gq0uiuiy-f,d6gq0uiuiy-z,x-okta-user-agent-extended

GET
H2 200 wave-pattern-green.svg
www.firstcitizens.com/etc.clientlibs/firstcitizens/clientlibs/clientlib-aem/resources/images/ 135 KB
43 KB 592ms
592ms Image
image/svg+xml 52.206.240.104
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.firstcitizens.com/etc.clientlibs/firstcitizens/clientlibs/clientlib-aem/resources/images/wave-pattern-green.svg

Requested by

Host: www.firstcitizens.com
URL: https://www.firstcitizens.com/etc.clientlibs/firstcitizens/clientlibs/clientlib-aem.css

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.206.240.104 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-52-206-240-104.compute-1.amazonaws.com

Software

Apache /

Resource Hash

033cce384207ee8edc8fbdb8805032c9c646af75159925eb7b3a6cacb9e19810

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.firstcitizens.com/etc.clientlibs/firstcitizens/clientlibs/clientlib-aem.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

x-dispatcher: dispatcher1useast1
date: Wed, 31 Aug 2022 14:38:37 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 57058
x-vhost: publish
vary: Origin,Accept-Encoding,User-Agent
content-length: 43610
x-custom-location: DE,TH,Erfurt
last-modified: Thu, 06 Aug 2020 21:17:41 GMT
server: Apache
x-frame-options: SAMEORIGIN
etag: "21ae6-5ac3c04bc0740-gzip"
access-control-max-age: 1000
access-control-allow-methods: GET, OPTIONS, HEAD
content-type: image/svg+xml
cache-control: max-age=31536000, public
access-control-allow-credentials: true
accept-ranges: bytes
access-control-allow-headers: x-requested-with, Content-Type, origin, authorization, accept, client-security-token, Access-Control-Request-Method, Access-Control-Request-Headers, __token__,d6gq0uiuiy-a,d6gq0uiuiy-b,d6gq0uiuiy-c,d6gq0uiuiy-d,d6gq0uiuiy-f,d6gq0uiuiy-z,x-okta-user-agent-extended

GET
H2 200 image.20200806.jpeg
www.firstcitizens.com/content/dam/firstcitizens/images/feature-highlight/feature-highlight-background--home@2x.jpg.transform/image-scaled-2x-to-1x/ 51 KB
52 KB 578ms
577ms Image
image/jpeg 52.206.240.104
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.firstcitizens.com/content/dam/firstcitizens/images/feature-highlight/feature-highlight-background--home@2x.jpg.transform/image-scaled-2x-to-1x/image.20200806.jpeg

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.206.240.104 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-52-206-240-104.compute-1.amazonaws.com

Software

Apache /

Resource Hash

ec63eb90ab8df068057937fef6f8d00756faf6f74e121764a7d84572134601ae

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.firstcitizens.com/?mkt_tok=Mjk2LUNQWC0yOTUAAAGGjzWEenlD9bhQeI4yKU4PJ5Eg5xUYrIuOJJSXEvW7jT2yjNYpb3L3rorhi9Z_gG-_zI6eKyJLQDzI_99g55Pt-q-TEO8XVAg7nqO2Hj8X
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

x-dispatcher: dispatcher2useast1
date: Wed, 31 Aug 2022 14:38:37 GMT
x-content-type-options: nosniff
age: 35154501
x-vhost: publish
vary: Origin
content-length: 52309
x-custom-location: DE,TH,Erfurt
last-modified: Tue, 20 Jul 2021 17:30:16 GMT
server: Apache
x-frame-options: SAMEORIGIN
etag: "cc55-5c79168345a00"
access-control-max-age: 1000
access-control-allow-methods: GET, OPTIONS, HEAD
content-type: image/jpeg
cache-control: max-age=31536000, public
access-control-allow-credentials: true
accept-ranges: bytes
access-control-allow-headers: x-requested-with, Content-Type, origin, authorization, accept, client-security-token, Access-Control-Request-Method, Access-Control-Request-Headers, __token__,d6gq0uiuiy-a,d6gq0uiuiy-b,d6gq0uiuiy-c,d6gq0uiuiy-d,d6gq0uiuiy-f,d6gq0uiuiy-z,x-okta-user-agent-extended

GET
H2 200 image.20200806.jpeg
www.firstcitizens.com/content/dam/firstcitizens/images/promo/associate/eddie@2x.jpg.transform/image-scaled-2x-to-1x/ 70 KB
71 KB 577ms
577ms Image
image/jpeg 52.206.240.104
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.firstcitizens.com/content/dam/firstcitizens/images/promo/associate/eddie@2x.jpg.transform/image-scaled-2x-to-1x/image.20200806.jpeg

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.206.240.104 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-52-206-240-104.compute-1.amazonaws.com

Software

Apache /

Resource Hash

5e23346895bf1145e5c6905f83b7218fa0de395fa2dad5bf2384f17561bd2be0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.firstcitizens.com/?mkt_tok=Mjk2LUNQWC0yOTUAAAGGjzWEenlD9bhQeI4yKU4PJ5Eg5xUYrIuOJJSXEvW7jT2yjNYpb3L3rorhi9Z_gG-_zI6eKyJLQDzI_99g55Pt-q-TEO8XVAg7nqO2Hj8X
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

x-dispatcher: dispatcher1useast1
date: Wed, 31 Aug 2022 14:38:37 GMT
x-content-type-options: nosniff
age: 16320464
x-vhost: publish
vary: Origin
content-length: 71745
x-custom-location: DE,TH,Erfurt
last-modified: Wed, 23 Feb 2022 17:10:53 GMT
server: Apache
x-frame-options: SAMEORIGIN
etag: "11841-5d8b28c4a2140"
access-control-max-age: 1000
access-control-allow-methods: GET, OPTIONS, HEAD
content-type: image/jpeg
cache-control: max-age=31536000, public
access-control-allow-credentials: true
accept-ranges: bytes
access-control-allow-headers: x-requested-with, Content-Type, origin, authorization, accept, client-security-token, Access-Control-Request-Method, Access-Control-Request-Headers, __token__,d6gq0uiuiy-a,d6gq0uiuiy-b,d6gq0uiuiy-c,d6gq0uiuiy-d,d6gq0uiuiy-f,d6gq0uiuiy-z,x-okta-user-agent-extended

GET
H2 200 image.20200806.png
www.firstcitizens.com/content/dam/firstcitizens/images/promo/associate/eddie-signature@2x.png.transform/original/ 44 KB
45 KB 577ms
577ms Image
image/png 52.206.240.104
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.firstcitizens.com/content/dam/firstcitizens/images/promo/associate/eddie-signature@2x.png.transform/original/image.20200806.png

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.206.240.104 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-52-206-240-104.compute-1.amazonaws.com

Software

Apache /

Resource Hash

823bd43daad2c30c2ed58baadf6cdff9490a8c21e7507d9c482e29ccaaadd57f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.firstcitizens.com/?mkt_tok=Mjk2LUNQWC0yOTUAAAGGjzWEenlD9bhQeI4yKU4PJ5Eg5xUYrIuOJJSXEvW7jT2yjNYpb3L3rorhi9Z_gG-_zI6eKyJLQDzI_99g55Pt-q-TEO8XVAg7nqO2Hj8X
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

x-dispatcher: dispatcher2useast1
date: Wed, 31 Aug 2022 14:38:37 GMT
x-content-type-options: nosniff
age: 31384376
x-vhost: publish
vary: Origin
content-length: 44912
x-custom-location: DE,TH,Erfurt
last-modified: Thu, 02 Sep 2021 08:45:41 GMT
server: Apache
x-frame-options: SAMEORIGIN
etag: "af70-5caff352a7740"
access-control-max-age: 1000
access-control-allow-methods: GET, OPTIONS, HEAD
content-type: image/png
cache-control: max-age=31536000, public
access-control-allow-credentials: true
accept-ranges: bytes
access-control-allow-headers: x-requested-with, Content-Type, origin, authorization, accept, client-security-token, Access-Control-Request-Method, Access-Control-Request-Headers, __token__,d6gq0uiuiy-a,d6gq0uiuiy-b,d6gq0uiuiy-c,d6gq0uiuiy-d,d6gq0uiuiy-f,d6gq0uiuiy-z,x-okta-user-agent-extended

GET
H/1.1 200
OK id Show response
dpm.demdex.net/ 372 B
1 KB 182ms
46ms XHR
application/json 18.202.164.188
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://dpm.demdex.net/id?d_visid_ver=5.4.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_orgid=E6D235355CF7C1DE0A495EEC%40AdobeOrg&d_nsid=0&ts=1661956717357

Requested by

Host: cds-sdkcfg.onlineaccess1.com
URL: https://cds-sdkcfg.onlineaccess1.com/common.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

18.202.164.188 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-18-202-164-188.eu-west-1.compute.amazonaws.com

Software

Resource Hash

f44fe3d0ca53678e6cdcd8959e357d339ed0885ef64b848db29abb6db347e0fe

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://www.firstcitizens.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

DCS: dcs-prod-irl1-2-v038-09a34e9ee.edge-irl1.demdex.com 3 ms
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
content-encoding: gzip
X-TID: 0XNUb4AoRtE=
Vary: Origin
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Access-Control-Allow-Origin: https://www.firstcitizens.com
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/json;charset=utf-8
Content-Length: 311
Expires: Thu, 01 Jan 1970 00:00:00 UTC

GET
H2 200 AppMeasurement.min.js Show response
assets.adobedtm.com/extensions/EP171e731c9ba34f1c950c36d26e3efd61/ 33 KB
12 KB 23ms
23ms Script
application/x-javascript 2a02:26f0:3500:587::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/extensions/EP171e731c9ba34f1c950c36d26e3efd61/AppMeasurement.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/60e0841c6ded/d5a97f0ea4af/launch-3bb7433af2ae.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:3500:587::1e80 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: 9219086b4f2c3bf77854b2e06ccd97ad32b9b7a140e65ff8b974a3bae6c7854c

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.firstcitizens.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

unused62: 8096267
date: Wed, 31 Aug 2022 14:38:37 GMT
content-encoding: gzip
last-modified: Mon, 14 Feb 2022 16:35:31 GMT
server: AkamaiNetStorage
etag: "d860c16ac938f7d839f0ec158d02d0f0:1644856531.418573"
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: https://www.firstcitizens.com
cache-control: no-cache
accept-ranges: bytes
timing-allow-origin: *
content-length: 12163
expires: Wed, 31 Aug 2022 15:38:37 GMT

GET
H2 200 AppMeasurement_Module_ActivityMap.min.js Show response
assets.adobedtm.com/extensions/EP171e731c9ba34f1c950c36d26e3efd61/ 3 KB
2 KB 24ms
23ms Script
application/x-javascript 2a02:26f0:3500:587::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/extensions/EP171e731c9ba34f1c950c36d26e3efd61/AppMeasurement_Module_ActivityMap.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/60e0841c6ded/d5a97f0ea4af/launch-3bb7433af2ae.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:3500:587::1e80 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: 462a66acbf50e933685e7587e9f1441df8225b2bb4d6b7bc5e757eccf4ff6575

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.firstcitizens.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

unused62: 8096267
date: Wed, 31 Aug 2022 14:38:37 GMT
content-encoding: gzip
last-modified: Mon, 14 Feb 2022 16:35:31 GMT
server: AkamaiNetStorage
etag: "2d1382c349d480b6b41574ac0c1af066:1644856531.739514"
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: https://www.firstcitizens.com
cache-control: no-cache
accept-ranges: bytes
timing-allow-origin: *
content-length: 1597
expires: Wed, 31 Aug 2022 15:38:37 GMT

GET
H2 200 fbevents.js Show response
connect.facebook.net/en_US/ 100 KB
27 KB 67ms
21ms Script
application/x-javascript 2a03:2880:f01c:8012:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/fbevents.js

Requested by

Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/60e0841c6ded/d5a97f0ea4af/launch-3bb7433af2ae.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f01c:8012:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

f62054be93b9f30643e209e390ae4299eb0501d1d89d9c8a3c6ee496ea9bd99c

Security Headers

Name	Value
Content-Security-Policy	default-src facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com data: blob: 'self';script-src .fbcdn.net .facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;connect-src .fbcdn.net .facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.firstcitizens.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

content-security-policy: default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
content-encoding: gzip
x-content-type-options: nosniff
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400,h3-29=":443"; ma=86400
content-length: 26683
x-xss-protection: 0
pragma: public
x-fb-debug: wPqNfiAoWaUxRpI++0uBEelRpas4iUmQKj8eBMsRaJcLRiW7zxilkmEvmvt7HgJdr6X+KxrQbqscaa7akqkUcg==
x-fb-trip-id: 686109401
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: DENY
date: Wed, 31 Aug 2022 14:38:37 GMT
strict-transport-security: max-age=31536000; preload; includeSubDomains
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cache-control: public, max-age=1200
x-fb-rlafr: 0
priority: u=3,i
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 insight.min.js Show response
snap.licdn.com/li.lms-analytics/ 8 KB
3 KB 77ms
21ms Script
application/x-javascript 2a02:26f0:3500:16::215:14a0
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://snap.licdn.com/li.lms-analytics/insight.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/60e0841c6ded/d5a97f0ea4af/launch-3bb7433af2ae.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:3500:16::215:14a0 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: /
Resource Hash: b57839788686bf37d29f47bbe45ad8258085e3aebf54650ab389c0b515b977e1

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.firstcitizens.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

date: Wed, 31 Aug 2022 14:38:37 GMT
content-encoding: gzip
last-modified: Fri, 12 Aug 2022 20:23:36 GMT
x-cdn: AKAM
vary: Accept-Encoding
content-type: application/x-javascript;charset=utf-8
cache-control: max-age=27660
accept-ranges: bytes
content-length: 3063

GET
H/1.1 200
OK iMAWebCookie.js
www.sc.pages08.net/lp/static/js/ 13 KB
13 KB 327ms
107ms Image
application/javascript 3.96.5.142
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.sc.pages08.net/lp/static/js/iMAWebCookie.js?48c1ca3e-1591e998ba5-7aa5e78e9cd75263db77227069854da8&h=www.pages08.net

Requested by

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

3.96.5.142 Montreal, Canada, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-3-96-5-142.ca-central-1.compute.amazonaws.com

Software

Apache /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=16070400; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.firstcitizens.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

Date: Wed, 31 Aug 2022 14:38:37 GMT
Last-Modified: Wed, 31 Aug 2022 04:19:49 GMT
Server: Apache
ETag: "3772-5e781cec2ec0b"
Strict-Transport-Security: max-age=16070400; includeSubDomains; preload
Content-Type: application/javascript
Connection: close
Accept-Ranges: bytes
Content-Length: 14194

GET
H2 200 identity.js Show response
connect.facebook.net/signals/plugins/ 64 KB
20 KB 20ms
19ms Script
application/x-javascript 2a03:2880:f01c:8012:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/signals/plugins/identity.js?v=2.9.78

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f01c:8012:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

d4edbbe1037c50c8ffa90860286c8166860ad9da450ed5e16a28e2fc9bce3c23

Security Headers

Name	Value
Content-Security-Policy	default-src facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com data: blob: 'self';script-src .fbcdn.net .facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;connect-src .fbcdn.net .facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.firstcitizens.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

content-security-policy: default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
content-encoding: gzip
x-content-type-options: nosniff
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400,h3-29=":443"; ma=86400
content-length: 20715
x-xss-protection: 0
pragma: public
x-fb-debug: bN7t36m+sk0OYWlZAOpxaxzylHcgJ/GcNlE5rRjm4TZr/H0/ieF0OqCE5xR49HdzzzJ8qn6LdKVyAtvL5U3s/A==
x-fb-trip-id: 686109401
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: DENY
date: Wed, 31 Aug 2022 14:38:37 GMT
strict-transport-security: max-age=31536000; preload; includeSubDomains
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cache-control: public, max-age=1200
x-fb-rlafr: 0
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 270894894628321 Show response
connect.facebook.net/signals/config/ 293 KB
84 KB 26ms
26ms Script
application/x-javascript 2a03:2880:f01c:8012:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/signals/config/270894894628321?v=2.9.78&r=stable

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f01c:8012:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

651801327eb97e55063d3db4d16de684d620ca3e797098f0f7bfe04d16327837

Security Headers

Name	Value
Content-Security-Policy	default-src facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com data: blob: 'self';script-src .fbcdn.net .facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;connect-src .fbcdn.net .facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.firstcitizens.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

content-security-policy: default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
content-encoding: gzip
x-content-type-options: nosniff
document-policy: force-load-at-top
content-security-policy-report-only: default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: chrome-extension: 'unsafe-inline' 'unsafe-eval';report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;require-trusted-types-for 'script';
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; preload; includeSubDomains
alt-svc: h3=":443"; ma=86400,h3-29=":443"; ma=86400
content-length: 85937
x-xss-protection: 0
pragma: public
x-fb-debug: eNJ3VwOGyBNYVQhR9BRo961TfvK14yt5N2V0o5ePPUwvGV6FS7zD6g9V0DzxIpVBPlFIToKrHhnMIYaFrDzX5w==
x-fb-trip-id: 686109401
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: DENY
date: Wed, 31 Aug 2022 14:38:37 GMT
vary: Accept-Encoding
content-type: application/x-javascript; charset=utf-8
cache-control: public, max-age=1200
x-fb-rlafr: 0
priority: u=3,i
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2

200

collect
px4.ads.linkedin.com/
Redirect Chain

https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=2970716&time=1661956717464&url=https%3A%2F%2Fwww.firstcitizens.com%2F%3Fmkt_tok%3DMjk2LUNQWC0yOTUAAAGGjzWEenlD9bhQeI4yKU4PJ5Eg5xUYrIuOJJSXEvW7jT2y...
https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D2970716%26time%3D1661956717464%26url%3Dhttps%253A%252F%252Fwww.firstcitizens.com%...
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=2970716&time=1661956717464&url=https%3A%2F%2Fwww.firstcitizens.com%2F%3Fmkt_tok%3DMjk2LUNQWC0yOTUAAAGGjzWEenlD9bhQeI4yKU4PJ5Eg5xUYrIuOJJSXEvW7jT2y...
https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=2970716&time=1661956717464&url=https%3A%2F%2Fwww.firstcitizens.com%2F%3Fmkt_tok%3DMjk2LUNQWC0yOTUAAAGGjzWEenlD9bhQeI4yKU4PJ5Eg5xUYrIuOJJSXEvW7jT2...

0
481 B

239ms
168ms

Image
application/javascript

13.107.42.14
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=2970716&time=1661956717464&url=https%3A%2F%2Fwww.firstcitizens.com%2F%3Fmkt_tok%3DMjk2LUNQWC0yOTUAAAGGjzWEenlD9bhQeI4yKU4PJ5Eg5xUYrIuOJJSXEvW7jT2yjNYpb3L3rorhi9Z_gG-_zI6eKyJLQDzI_99g55Pt-q-TEO8XVAg7nqO2Hj8X&liSync=true&e_ipv6=AQKumhlXZovjXAAAAYL0Vv2_x0QYdBJsaz__9jifVOYUc4tP9TlCb6jGLAP8HBrWkW1DR_jpVgDk
Requested by: Host: www.firstcitizens.com
URL: https://www.firstcitizens.com/?mkt_tok=Mjk2LUNQWC0yOTUAAAGGjzWEenlD9bhQeI4yKU4PJ5Eg5xUYrIuOJJSXEvW7jT2yjNYpb3L3rorhi9Z_gG-_zI6eKyJLQDzI_99g55Pt-q-TEO8XVAg7nqO2Hj8X
Protocol: H2
Server: 13.107.42.14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.firstcitizens.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

date: Wed, 31 Aug 2022 14:38:38 GMT
nel: {"report_to":"network-errors","max_age":1296000,"success_fraction":0.00066,"failure_fraction":1,"include_subdomains":true}
x-li-pop: afd-prod-ltx1-x
x-msedge-ref: Ref A: 9CE90665B9B3412E94E40A6E5E04A1C6 Ref B: FRAEDGE1513 Ref C: 2022-08-31T14:38:38Z
linkedin-action: 1
report-to: {"group":"network-errors","max_age":2592000,"endpoints":[{"url":"https://www.linkedin.com/li/rep"}],"include_subdomains":true}
content-type: application/javascript
x-li-proto: http/2
x-cache: CONFIG_NOCACHE
content-length: 0
x-li-uuid: AAXninPTMqXoOJcjaAqEbg==
x-li-fabric: prod-ltx1

Redirect headers

date: Wed, 31 Aug 2022 14:38:37 GMT
nel: {"report_to":"network-errors","max_age":1296000,"success_fraction":0.00066,"failure_fraction":1,"include_subdomains":true}
x-li-pop: afd-prod-ltx1-x
x-msedge-ref: Ref A: BD039C2199944EBF8FD6A725A00C5DEF Ref B: VIEEDGE2208 Ref C: 2022-08-31T14:38:37Z
linkedin-action: 1
report-to: {"group":"network-errors","max_age":2592000,"endpoints":[{"url":"https://www.linkedin.com/li/rep"}],"include_subdomains":true}
x-li-fabric: prod-ltx1
location: https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=2970716&time=1661956717464&url=https%3A%2F%2Fwww.firstcitizens.com%2F%3Fmkt_tok%3DMjk2LUNQWC0yOTUAAAGGjzWEenlD9bhQeI4yKU4PJ5Eg5xUYrIuOJJSXEvW7jT2yjNYpb3L3rorhi9Z_gG-_zI6eKyJLQDzI_99g55Pt-q-TEO8XVAg7nqO2Hj8X&liSync=true&e_ipv6=AQKumhlXZovjXAAAAYL0Vv2_x0QYdBJsaz__9jifVOYUc4tP9TlCb6jGLAP8HBrWkW1DR_jpVgDk
x-li-proto: http/2
x-cache: CONFIG_NOCACHE
content-length: 0
x-li-uuid: AAXninPPCs7OIi4D8p/PJg==

GET
H2 200 /
www.facebook.com/tr/ 44 B
297 B 69ms
20ms Image
image/gif 2a03:2880:f11c:8183:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=270894894628321&ev=PageView&dl=https%3A%2F%2Fwww.firstcitizens.com%2F%3Fmkt_tok%3DMjk2LUNQWC0yOTUAAAGGjzWEenlD9bhQeI4yKU4PJ5Eg5xUYrIuOJJSXEvW7jT2yjNYpb3L3rorhi9Z_gG-_zI6eKyJLQDzI_99g55Pt-q-TEO8XVAg7nqO2Hj8X&rl=https%3A%2F%2Fclick.firstcitizens.com%2F&if=false&ts=1661956717526&sw=1600&sh=1200&v=2.9.78&r=stable&a=adobe_launch&ec=0&o=30&fbp=fb.1.1661956717525.1797907862&it=1661956717461&coo=false&rqm=GET

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f11c:8183:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.firstcitizens.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

date: Wed, 31 Aug 2022 14:38:37 GMT
last-modified: Fri, 21 Dec 2012 00:00:01 GMT
server: proxygen-bolt
strict-transport-security: max-age=31536000; includeSubDomains
content-type: image/gif
cache-control: no-cache, must-revalidate, max-age=0
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 44
expires: Wed, 31 Aug 2022 14:38:37 GMT

GET
H/1.1 200
OK dest5.html Show response
firstcitizens.demdex.net/ Frame 556A 7 KB
3 KB 168ms
40ms Document
text/html 52.18.235.86
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://firstcitizens.demdex.net/dest5.html?d_nsid=0

Requested by

Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/60e0841c6ded/d5a97f0ea4af/launch-3bb7433af2ae.min.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.18.235.86 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-52-18-235-86.eu-west-1.compute.amazonaws.com

Software

Resource Hash

7bea17a80a61ed0f54248b4ffc4c718f7c8ff2619742577a73591d62ce074da8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://www.firstcitizens.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Accept-Ranges: bytes
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection: keep-alive
Content-Length: 2791
Content-Type: text/html;charset=UTF-8
DCS: dcs-prod-irl1-1-v038-006789e8c.edge-irl1.demdex.com 0 ms
Expires: Thu, 01 Jan 1970 00:00:00 UTC
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-TID: P75ib2C6QXQ=
content-encoding: gzip
date: Wed, 31 Aug 2022 14:38:37 GMT
last-modified: Wed, 3 Aug 2022 11:53:46 GMT
vary: accept-encoding

GET
H/1.1

200
OK

ibs:dpid=411&dpuuid=Yw9ybQAAAMRovgOJ
dpm.demdex.net/
Redirect Chain

https://cm.everesttech.net/cm/dd?d_uuid=20077602378767582852873053970317377673
https://dpm.demdex.net/ibs:dpid=411&dpuuid=Yw9ybQAAAMRovgOJ

42 B
942 B

53ms
53ms

Image
image/gif

18.202.164.188
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dpm.demdex.net/ibs:dpid=411&dpuuid=Yw9ybQAAAMRovgOJ

Requested by

Protocol

HTTP/1.1

Server

18.202.164.188 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-18-202-164-188.eu-west-1.compute.amazonaws.com

Software

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.firstcitizens.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

DCS: dcs-prod-irl1-1-v038-0729fb8fe.edge-irl1.demdex.com 6 ms
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
content-encoding: gzip
X-Content-Type-Options: nosniff
X-TID: Z+H54CZWSmo=
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection: keep-alive
Content-Type: image/gif
Content-Length: 59
Expires: Thu, 01 Jan 1970 00:00:00 UTC

Redirect headers

Location: https://dpm.demdex.net/ibs:dpid=411&dpuuid=Yw9ybQAAAMRovgOJ
Date: Wed, 31 Aug 2022 14:38:37 GMT
Cache-Control: no-cache
Server: AMO-cookiemap/1.1
Connection: keep-alive
Content-Length: 0
P3P: CP="NOI NID DEVa PSAa PSDa OUR IND PUR COM NAV INT DEM"

GET
H2 200 comvo.js Show response
trk.firstcitizens.com/200189/ 75 KB
33 KB 109ms
107ms Script
application/x-javascript 44.196.18.202
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://trk.firstcitizens.com/200189/comvo.js

Requested by

Host: trk.firstcitizens.com
URL: https://trk.firstcitizens.com/200189/loadsnippet.js?dt=login&r=0.4503290050801143

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

44.196.18.202 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-44-196-18-202.compute-1.amazonaws.com

Software

haile /

Resource Hash

c4f3b2593744dd72384569961c46aaec88e44eb8b380db28efc7c64ccfdd1d88

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.firstcitizens.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 31 Aug 2022 14:38:37 GMT
content-encoding: gzip
server: haile
strict-transport-security: max-age=86400
access-control-allow-methods: GET, OPTIONS
p3p: CP="NOI ADM DEV PSAi COM NAV OUR OTR STP IND DEM"
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
content-type: application/x-javascript
pics-label: (PICS-1.1 "http://www.icra.org/pics/vocabularyv03/" l r (n 0 s 0 v 0 l 0 oa 0 ob 0 oc 0 od 0 oe 0 of 0 og 0 oh 0 c 0) "http://www.icra.org/ratingsv02.html" l r (nz 0 vz 0 lz 0 oz 0 cz 0) "http://www.rsac.org/ratingsv01.html" l r (n 0 s 0 v 0 l 0))

GET
H2 200 jidrof.js Show response
trk.firstcitizens.com/200189/ 64 KB
29 KB 213ms
211ms Script
application/x-javascript 44.196.18.202
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://trk.firstcitizens.com/200189/jidrof.js

Requested by

Host: trk.firstcitizens.com
URL: https://trk.firstcitizens.com/200189/loadsnippet.js?dt=login&r=0.4503290050801143

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

44.196.18.202 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-44-196-18-202.compute-1.amazonaws.com

Software

haile /

Resource Hash

fc480d815852472b37a36574b2111f65177014da01c06d78711b550829b5fb06

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.firstcitizens.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 31 Aug 2022 14:38:37 GMT
content-encoding: gzip
server: haile
strict-transport-security: max-age=86400
access-control-allow-methods: GET, OPTIONS
p3p: CP="NOI ADM DEV PSAi COM NAV OUR OTR STP IND DEM"
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
content-type: application/x-javascript
pics-label: (PICS-1.1 "http://www.icra.org/pics/vocabularyv03/" l r (n 0 s 0 v 0 l 0 oa 0 ob 0 oc 0 od 0 oe 0 of 0 og 0 oh 0 c 0) "http://www.icra.org/ratingsv02.html" l r (nz 0 vz 0 lz 0 oz 0 cz 0) "http://www.rsac.org/ratingsv01.html" l r (n 0 s 0 v 0 l 0))

GET
H2 200 daal.js Show response
trk.firstcitizens.com/igot/ 71 KB
32 KB 212ms
211ms Script
application/x-javascript 44.196.18.202
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://trk.firstcitizens.com/igot/daal.js

Requested by

Host: trk.firstcitizens.com
URL: https://trk.firstcitizens.com/200189/loadsnippet.js?dt=login&r=0.4503290050801143

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

44.196.18.202 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-44-196-18-202.compute-1.amazonaws.com

Software

haile /

Resource Hash

5ac85469e4f403a04a6ae33ed1a5a5d65f61d600f2477aa9680c3116840718e4

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.firstcitizens.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 31 Aug 2022 14:38:37 GMT
content-encoding: gzip
server: haile
strict-transport-security: max-age=86400
access-control-allow-methods: GET, OPTIONS
p3p: CP="NOI ADM DEV PSAi COM NAV OUR OTR STP IND DEM"
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
content-type: application/x-javascript
pics-label: (PICS-1.1 "http://www.icra.org/pics/vocabularyv03/" l r (n 0 s 0 v 0 l 0 oa 0 ob 0 oc 0 od 0 oe 0 of 0 og 0 oh 0 c 0) "http://www.icra.org/ratingsv02.html" l r (nz 0 vz 0 lz 0 oz 0 cz 0) "http://www.rsac.org/ratingsv01.html" l r (n 0 s 0 v 0 l 0))

GET
H2 200 genc.js Show response
trk.firstcitizens.com/200189/ 91 KB
40 KB 109ms
108ms Script
application/x-javascript 44.196.18.202
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://trk.firstcitizens.com/200189/genc.js

Requested by

Host: trk.firstcitizens.com
URL: https://trk.firstcitizens.com/200189/loadsnippet.js?dt=login&r=0.4503290050801143

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

44.196.18.202 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-44-196-18-202.compute-1.amazonaws.com

Software

haile /

Resource Hash

6bea78c001260a92e1d53d6647d6d08e9d448a9381ff91a4ca86e785ce435454

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.firstcitizens.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 31 Aug 2022 14:38:37 GMT
content-encoding: gzip
server: haile
strict-transport-security: max-age=86400
access-control-allow-methods: GET, OPTIONS
p3p: CP="NOI ADM DEV PSAi COM NAV OUR OTR STP IND DEM"
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
content-type: application/x-javascript
pics-label: (PICS-1.1 "http://www.icra.org/pics/vocabularyv03/" l r (n 0 s 0 v 0 l 0 oa 0 ob 0 oc 0 od 0 oe 0 of 0 og 0 oh 0 c 0) "http://www.icra.org/ratingsv02.html" l r (nz 0 vz 0 lz 0 oz 0 cz 0) "http://www.rsac.org/ratingsv01.html" l r (n 0 s 0 v 0 l 0))

POST
H3 200 / Show response
www.facebook.com/tr/ Frame 2A91 0
18 B 45ms
21ms Document
text/plain 2a03:2880:f11c:8183:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://www.facebook.com/tr/

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f11c:8183:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Content-Type: application/x-www-form-urlencoded
Origin: https://www.firstcitizens.com
Referer: https://www.firstcitizens.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

access-control-allow-credentials: true
access-control-allow-origin: https://www.firstcitizens.com
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 0
content-type: text/plain
cross-origin-resource-policy: cross-origin
date: Wed, 31 Aug 2022 14:38:38 GMT
priority: u=0
server: proxygen-bolt
strict-transport-security: max-age=31536000; includeSubDomains

GET
H2 200 pysty.html Show response
awuse1.advanced-web-analytics.com/200189/ Frame 3C85 64 KB
29 KB 311ms
206ms Document
text/html 99.86.4.72
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://awuse1.advanced-web-analytics.com/200189/pysty.html?e=https%3A%2F%2Fwww.firstcitizens.com&es=eyJpIjoid3hnckxST2s3c29SKytDVVwvZHJacGc9PSIsImUiOiI2RmdYSnQ2ZGhXR292dmx3a3Z4dTBlcWRyVU0yNTNyYWRSUW9HNkVcL1NpeVhOMDhyM25FZDFUZHBuNGRkejhNZmt4Z2RsUzg3RnpQZldwdkpzdGJQSlg1SWVKY3prV01UUUp0aTluNTdGdWIyRUJuVlpQRGdhSWFBOVlGc1NaaVJaNzd4WWNkcHVPbVlOc3kwRHZxendRPT0ifQ%3D%3D.758d5dc8a541e933.ODc1ZjBjMWIwMzY4NTBjNzg4Njk5MTQ1YTgzMDE1NmE4MmIxY2I1ZTI2ZTJmN2I1OWZmMDFmZTljMWZkOGRkNA%3D%3D&re=https%3A%2F%2Fwww.firstcitizens.com%2F%3Fmkt_tok%3DMjk2LUNQWC0yOTUAAAGGjzWEenlD9bhQeI4yKU4PJ5Eg5xUYrIuOJJSXEvW7jT2yjNYpb3L3rorhi9Z_gG-_zI6eKyJLQDzI_99g55Pt-q-TEO8XVAg7nqO2Hj8X&eu=https%3A%2F%2Fwww.firstcitizens.com%2F&icid=166195671799769454&sr=https%3A%2F%2Fwww.firstcitizens.com%2Fetc.clientlibs%2Ffirstcitizens%2Fclientlibs%2Fclientlib-aem.css

Requested by

Host: trk.firstcitizens.com
URL: https://trk.firstcitizens.com/200189/genc.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

99.86.4.72 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-99-86-4-72.fra6.r.cloudfront.net

Software

haile /

Resource Hash

a39ef91987c731f40db8499e78bf5948f3825e45a6a1f145efa8a83926c2a308

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

Referer: https://www.firstcitizens.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

access-control-allow-credentials: true
access-control-allow-methods: GET, OPTIONS
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
content-encoding: gzip
content-type: text/html
date: Wed, 31 Aug 2022 14:38:38 GMT
p3p: CP="NOI ADM DEV PSAi COM NAV OUR OTR STP IND DEM"
pics-label: (PICS-1.1 "http://www.icra.org/pics/vocabularyv03/" l r (n 0 s 0 v 0 l 0 oa 0 ob 0 oc 0 od 0 oe 0 of 0 og 0 oh 0 c 0) "http://www.icra.org/ratingsv02.html" l r (nz 0 vz 0 lz 0 oz 0 cz 0) "http://www.rsac.org/ratingsv01.html" l r (n 0 s 0 v 0 l 0))
pragma: no-cache
server: haile
strict-transport-security: max-age=86400
via: 1.1 507b5edb20d0e1a0b73c8687f53defa8.cloudfront.net (CloudFront)
x-amz-cf-id: K4Mg84s8YF1qTLO7LabRUpwqJvOzQgwXbb6lMMYitVMM-tBDxToyIQ==
x-amz-cf-pop: FRA6-C1
x-cache: Miss from cloudfront

GET
H2 200 fulvip.html Show response
trk.firstcitizens.com/200189/ Frame A2CF 22 KB
10 KB 106ms
106ms Document
text/html 44.196.18.202
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://trk.firstcitizens.com/200189/fulvip.html?sui=5e714debaf6d4439159f3327270b947e7ac3ebf8e0985c5788545626262bff8c

Requested by

Host: trk.firstcitizens.com
URL: https://trk.firstcitizens.com/200189/genc.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

44.196.18.202 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-44-196-18-202.compute-1.amazonaws.com

Software

haile /

Resource Hash

864a720c65a205784b8e436c95d15926cb33544309e89d6684c00d48cffd822f

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

Referer: https://www.firstcitizens.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

access-control-allow-credentials: true
access-control-allow-methods: GET, OPTIONS
access-control-allow-origin: *
cache-control: private, max-age=3600
content-encoding: gzip
content-type: text/html
date: Wed, 31 Aug 2022 14:38:38 GMT
expires: Wed, 31 Aug 2022 15:38:38 GMT
p3p: CP="NOI ADM DEV PSAi COM NAV OUR OTR STP IND DEM"
pics-label: (PICS-1.1 "http://www.icra.org/pics/vocabularyv03/" l r (n 0 s 0 v 0 l 0 oa 0 ob 0 oc 0 od 0 oe 0 of 0 og 0 oh 0 c 0) "http://www.icra.org/ratingsv02.html" l r (nz 0 vz 0 lz 0 oz 0 cz 0) "http://www.rsac.org/ratingsv01.html" l r (n 0 s 0 v 0 l 0))
server: haile
strict-transport-security: max-age=86400

GET
H2 200 siteanalyze_2884.js Show response
siteimproveanalytics.com/js/ 25 KB
9 KB 81ms
29ms Script
application/javascript 2a06:98c1:3121::3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://siteimproveanalytics.com/js/siteanalyze_2884.js
Requested by: Host: www.firstcitizens.com
URL: https://www.firstcitizens.com/?mkt_tok=Mjk2LUNQWC0yOTUAAAGGjzWEenlD9bhQeI4yKU4PJ5Eg5xUYrIuOJJSXEvW7jT2yjNYpb3L3rorhi9Z_gG-_zI6eKyJLQDzI_99g55Pt-q-TEO8XVAg7nqO2Hj8X
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a06:98c1:3121::3 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 36cef338ad8896930b39d347c01e4944d9aac13150cb39c466c4f591f407cfd5

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.firstcitizens.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

date: Wed, 31 Aug 2022 14:38:38 GMT
content-encoding: gzip
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 2050
cf-ray: 743682d178f391e4-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 8545
x-amz-id-2: CIcs1RjplwQxlbb8PU2tavo87RtFl3WgNUgFwJ3wO8/+qXxiOGCCiqTR0iSOgoSwUe9NHzEvUnU=
last-modified: Mon, 16 May 2022 09:33:06 GMT
server: cloudflare
etag: "6dc89d2db23285c4ec650cc85fcec472"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=V2be9edmXjXEh0OF4PK05s5w39tQUzI1XSrPuUrG%2BtI7kUWPYdY3XckVuIejXGzXwkZawVEm29F73BBbgUbJZsz9jDfSt0rdHqgYtNrZY8Zr28JosifYuIC%2FgejNvIkJFauMfN%2FXdyULaif%2Bcz1UM3fRWHoAftA%3D"}],"group":"cf-nel","max_age":604800}
x-amz-request-id: 7BER83B9SS5BM6BX
cache-control: max-age=86400, no-transform
accept-ranges: bytes
content-type: application/javascript; charset=utf-8

GET
H2 200 bd0e417d0d38a.js Show response
t.contentsquare.net/uxa/ 335 KB
74 KB 73ms
21ms Script
application/javascript 65.9.66.105
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://t.contentsquare.net/uxa/bd0e417d0d38a.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/60e0841c6ded/d5a97f0ea4af/launch-3bb7433af2ae.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 65.9.66.105 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-65-9-66-105.fra56.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: c14fbc9d7dc8acf2eff7611b5bfc2389c688837b6e250cd846b762c8de31efd6

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.firstcitizens.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

x-amz-server-side-encryption: AES256
date: Mon, 29 Aug 2022 09:32:15 GMT
content-encoding: gzip
last-modified: Mon, 29 Aug 2022 09:31:40 GMT
server: AmazonS3
age: 191184
etag: "204eca427fb9b9745b1ddf8bac96232f"
x-cache: Hit from cloudfront
content-type: application/javascript;charset=utf-8
via: 1.1 7e513424eee237ee26467e8fd5656ec0.cloudfront.net (CloudFront)
cache-control: max-age=900
x-amz-cf-pop: FRA56-C1
accept-ranges: bytes
content-length: 75268
x-amz-cf-id: p5q-4l0z7sAn4ycHHiShHyNdfwDOwTOhTfE99gVQ9iovel5loBae0w==

GET
H3 200 answerstemplates.compiled.min.js Show response
assets.sitescdn.net/answers/v0.13.1/ 263 KB
56 KB 76ms
40ms Script
application/javascript 2606:4700::6812:7434
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.sitescdn.net/answers/v0.13.1/answerstemplates.compiled.min.js
Requested by: Host: assets.sitescdn.net
URL: https://assets.sitescdn.net/answers/v0.13.1/answers.min.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2606:4700::6812:7434 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 6acdd0a9a45db4fdcd0bf8aa60d38594a8d7653f7a63368156a5c45b9d7bd2f3

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.firstcitizens.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

date: Wed, 31 Aug 2022 14:38:38 GMT
content-encoding: gzip
cf-cache-status: HIT
last-modified: Fri, 03 Apr 2020 16:08:44 GMT
server: cloudflare
age: 665728
etag: W/"caffe009980310c9b76062239c855223"
vary: Accept-Encoding
x-amz-version-id: null
content-type: application/javascript
cache-control: max-age=31536000
cf-ray: 743682d17de19054-FRA
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-amz-request-id: JM4XM3QS0AMYD0GK
x-amz-id-2: sAGUHWtFuDW+SAKiL49Aa/VYqEZjseHiAFON7DjUQmP/S3KW8l8Px7x6lkutZifS+3RlQ9xiYR0=

GET
H3

200

activityi;dc_pre=CInq056n8fkCFRrUmgodIHAINg;cat=sitev03p;ord=1;src=6528888;type=count0 Show response
6528888.fls.doubleclick.net/ Frame 4ADF
Redirect Chain

https://6528888.fls.doubleclick.net/activityi;cat=sitev03p;ord=1;src=6528888;type=count0?
https://6528888.fls.doubleclick.net/activityi;dc_pre=CInq056n8fkCFRrUmgodIHAINg;cat=sitev03p;ord=1;src=6528888;type=count0?

428 B
358 B

96ms
57ms

Document
text/html

142.250.185.198
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://6528888.fls.doubleclick.net/activityi;dc_pre=CInq056n8fkCFRrUmgodIHAINg;cat=sitev03p;ord=1;src=6528888;type=count0?

Requested by

Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/60e0841c6ded/d5a97f0ea4af/launch-3bb7433af2ae.min.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.198 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s52-in-f6.1e100.net

Software

cafe /

Resource Hash

0d4baa79292e28c5617820df3f292603a792ed9324fe4e78e7c2320d0df81427

Security Headers

Name	Value
Strict-Transport-Security	max-age=21600
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.firstcitizens.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: no-cache, must-revalidate
content-encoding: gzip
content-length: 333
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 31 Aug 2022 14:38:38 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
pragma: no-cache
server: cafe
strict-transport-security: max-age=21600
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

Redirect headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: no-cache, must-revalidate
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 31 Aug 2022 14:38:38 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
follow-only-when-prerender-shown: 1
location: https://6528888.fls.doubleclick.net/activityi;dc_pre=CInq056n8fkCFRrUmgodIHAINg;cat=sitev03p;ord=1;src=6528888;type=count0?
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
pragma: no-cache
server: cafe
strict-transport-security: max-age=21600
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 resources.default.json Show response
www.firstcitizens.com/personal/_jcr_content/root/globalLayoutContainer/globalLayoutContainer-parsys/layout_container_158999756/col1/ 2 KB
1 KB 567ms
566ms Fetch
application/json 52.206.240.104
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://www.firstcitizens.com/personal/_jcr_content/root/globalLayoutContainer/globalLayoutContainer-parsys/layout_container_158999756/col1/resources.default.json?cp=/

Requested by

Host: cds-sdkcfg.onlineaccess1.com
URL: https://cds-sdkcfg.onlineaccess1.com/common.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.206.240.104 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-52-206-240-104.compute-1.amazonaws.com

Software

Apache /

Resource Hash

a2f96429a14fb370a30957bb66f37d5215bfa4921c9e680fabbe496f8e8e98b8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.firstcitizens.com/?mkt_tok=Mjk2LUNQWC0yOTUAAAGGjzWEenlD9bhQeI4yKU4PJ5Eg5xUYrIuOJJSXEvW7jT2yjNYpb3L3rorhi9Z_gG-_zI6eKyJLQDzI_99g55Pt-q-TEO8XVAg7nqO2Hj8X
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

x-dispatcher: dispatcher1useast1
date: Wed, 31 Aug 2022 14:38:38 GMT
content-encoding: gzip
x-content-type-options: nosniff
x-vhost: publish
vary: Origin,Accept-Encoding,User-Agent
content-length: 864
x-custom-location: DE,TH,Erfurt
server: Apache
x-frame-options: SAMEORIGIN
access-control-max-age: 1000
access-control-allow-methods: GET, OPTIONS, HEAD
content-type: application/json;charset=utf-8
cache-control: max-age=14400
access-control-allow-credentials: true
access-control-allow-headers: x-requested-with, Content-Type, origin, authorization, accept, client-security-token, Access-Control-Request-Method, Access-Control-Request-Headers, __token__,d6gq0uiuiy-a,d6gq0uiuiy-b,d6gq0uiuiy-c,d6gq0uiuiy-d,d6gq0uiuiy-f,d6gq0uiuiy-z,x-okta-user-agent-extended

GET
H2 200 image.20200806.png
www.firstcitizens.com/content/dam/firstcitizens/images/feature-highlight/personal-digital-banking/feature-highlight-device-spending@2x.png.transform/image-scaled-2x-to-1x/ 65 KB
65 KB 555ms
554ms Image
image/png 52.206.240.104
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.firstcitizens.com/content/dam/firstcitizens/images/feature-highlight/personal-digital-banking/feature-highlight-device-spending@2x.png.transform/image-scaled-2x-to-1x/image.20200806.png

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.206.240.104 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-52-206-240-104.compute-1.amazonaws.com

Software

Apache /

Resource Hash

b871681d1e25b54790b3f594a5ea599388158812429ecd99a39ac9ec5b924fb4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.firstcitizens.com/?mkt_tok=Mjk2LUNQWC0yOTUAAAGGjzWEenlD9bhQeI4yKU4PJ5Eg5xUYrIuOJJSXEvW7jT2yjNYpb3L3rorhi9Z_gG-_zI6eKyJLQDzI_99g55Pt-q-TEO8XVAg7nqO2Hj8X
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

x-dispatcher: dispatcher2useast1
date: Wed, 31 Aug 2022 14:38:38 GMT
x-content-type-options: nosniff
age: 35154498
x-vhost: publish
vary: Origin
content-length: 66123
x-custom-location: DE,TH,Erfurt
last-modified: Tue, 20 Jul 2021 17:30:20 GMT
server: Apache
x-frame-options: SAMEORIGIN
etag: "1024b-5c79168716300"
access-control-max-age: 1000
access-control-allow-methods: GET, OPTIONS, HEAD
content-type: image/png
cache-control: max-age=31536000, public
access-control-allow-credentials: true
accept-ranges: bytes
access-control-allow-headers: x-requested-with, Content-Type, origin, authorization, accept, client-security-token, Access-Control-Request-Method, Access-Control-Request-Headers, __token__,d6gq0uiuiy-a,d6gq0uiuiy-b,d6gq0uiuiy-c,d6gq0uiuiy-d,d6gq0uiuiy-f,d6gq0uiuiy-z,x-okta-user-agent-extended

POST
H2 200 zN33 Show response
trk.firstcitizens.com/200189/ Frame A2CF 127 B
636 B 119ms
119ms XHR
text/html 44.196.18.202
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://trk.firstcitizens.com/200189/zN33?cid=15%2C13&si=0&e=https%3A%2F%2Fwww.firstcitizens.com&LSESSIONID=eyJpIjoid3hnckxST2s3c29SKytDVVwvZHJacGc9PSIsImUiOiI2RmdYSnQ2ZGhXR292dmx3a3Z4dTBlcWRyVU0yNTNyYWRSUW9HNkVcL1NpeVhOMDhyM25FZDFUZHBuNGRkejhNZmt4Z2RsUzg3RnpQZldwdkpzdGJQSlg1SWVKY3prV01UUUp0aTluNTdGdWIyRUJuVlpQRGdhSWFBOVlGc1NaaVJaNzd4WWNkcHVPbVlOc3kwRHZxendRPT0ifQ%3D%3D.758d5dc8a541e933.ODc1ZjBjMWIwMzY4NTBjNzg4Njk5MTQ1YTgzMDE1NmE4MmIxY2I1ZTI2ZTJmN2I1OWZmMDFmZTljMWZkOGRkNA%3D%3D&t=xpost&__tp=login

Requested by

Host: trk.firstcitizens.com
URL: https://trk.firstcitizens.com/200189/fulvip.html?sui=5e714debaf6d4439159f3327270b947e7ac3ebf8e0985c5788545626262bff8c

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

44.196.18.202 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-44-196-18-202.compute-1.amazonaws.com

Software

haile /

Resource Hash

32f3975105b7a4dceabc969348fb3652863537f0b4d90e7e9f2aaf7e07b96d02

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

Referer: https://trk.firstcitizens.com/200189/fulvip.html?sui=5e714debaf6d4439159f3327270b947e7ac3ebf8e0985c5788545626262bff8c
accept-language: de-DE,de;q=0.9
X-Embedding-Uri: https://www.firstcitizens.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

pragma: no-cache
date: Wed, 31 Aug 2022 14:38:38 GMT
server: haile
strict-transport-security: max-age=86400
access-control-allow-methods: GET, OPTIONS
p3p: CP="NOI ADM DEV PSAi COM NAV OUR OTR STP IND DEM"
access-control-allow-origin: https://trk.firstcitizens.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
content-type: text/html
content-length: 127
pics-label: (PICS-1.1 "http://www.icra.org/pics/vocabularyv03/" l r (n 0 s 0 v 0 l 0 oa 0 ob 0 oc 0 od 0 oe 0 of 0 og 0 oh 0 c 0) "http://www.icra.org/ratingsv02.html" l r (nz 0 vz 0 lz 0 oz 0 cz 0) "http://www.rsac.org/ratingsv01.html" l r (n 0 s 0 v 0 l 0))

OPTIONS
H2 200 quota
q-aus1.contentsquare.net/ Frame 0
0 328ms
106ms Preflight 3.220.188.198
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://q-aus1.contentsquare.net/quota?enc=raw
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.220.188.198 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-220-188-198.compute-1.amazonaws.com
Software: /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://www.firstcitizens.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

access-control-allow-headers: Access-Control-Expose-Headers, Content-Type, Content-Compression, X-Requested-With
access-control-allow-methods: POST, OPTIONS
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0
content-length: 0
date: Wed, 31 Aug 2022 14:38:38 GMT
expires: Sat, 01 Jan 2000 00:00:00 GMT
pragma: no-cache
timing-allow-origin: *

POST
H2 200 quota Show response
q-aus1.contentsquare.net/ 29 B
243 B 106ms
105ms Fetch
application/json 3.220.188.198
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://q-aus1.contentsquare.net/quota?enc=raw
Requested by: Host: cds-sdkcfg.onlineaccess1.com
URL: https://cds-sdkcfg.onlineaccess1.com/common.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.220.188.198 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-220-188-198.compute-1.amazonaws.com
Software: /
Resource Hash: 70c705d49e04d07b8353972235ca2f2f7f48c1ddbb671829a282558b991a8fa1

Request headers

Referer: https://www.firstcitizens.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36
Content-Type: application/json

Response headers

access-control-allow-origin: *
date: Wed, 31 Aug 2022 14:38:38 GMT
timing-allow-origin: *
access-control-allow-headers: Access-Control-Expose-Headers, Content-Type, Content-Compression
content-length: 29
access-control-allow-methods: POST, OPTIONS
content-type: application/json

GET
H2 204 pageview
c.contentsquare.net/ 0
320 B 140ms
43ms Image
text/plain 52.209.201.13
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://c.contentsquare.net/pageview?pid=14800&uu=3cef1cc6-1c45-ad98-a8f6-eb94227008da&sn=1&lv=1661956718&lhd=1661956718&hd=1661956718&pn=1&dw=1600&dh=6391&ww=1600&wh=1200&sw=1600&sh=1200&dr=https%3A%2F%2Fclick.firstcitizens.com%2F&url=https%3A%2F%2Fwww.firstcitizens.com%2F%3Fmkt_tok%3DMjk2LUNQWC0yOTUAAAGGjzWEenlD9bhQeI4yKU4PJ5Eg5xUYrIuOJJSXEvW7jT2yjNYpb3L3rorhi9Z_gG-_zI6eKyJLQDzI_99g55Pt-q-TEO8XVAg7nqO2Hj8X&uc=0&la=en-US&v=11.40.1&r=655636
Requested by: Host: www.firstcitizens.com
URL: https://www.firstcitizens.com/?mkt_tok=Mjk2LUNQWC0yOTUAAAGGjzWEenlD9bhQeI4yKU4PJ5Eg5xUYrIuOJJSXEvW7jT2yjNYpb3L3rorhi9Z_gG-_zI6eKyJLQDzI_99g55Pt-q-TEO8XVAg7nqO2Hj8X
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.209.201.13 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-209-201-13.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.firstcitizens.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 31 Aug 2022 14:38:38 GMT
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0
content-disposition: inline
timing-allow-origin: *
access-control-allow-headers: Access-Control-Expose-Headers, Content-Type, Content-Compression, X-Requested-With
expires: Sun, 24 Oct 1982 23:00:00 GMT

GET
BLOB 200
OK 37c7bf9b-c16d-4190-afd0-bf68bb797167
https://www.firstcitizens.com/ 2 KB
0 Other
application/javascript

General

Check archive.org

Show headers Download Go to

Full URL: blob:https://www.firstcitizens.com/37c7bf9b-c16d-4190-afd0-bf68bb797167
Requested by: Host: www.firstcitizens.com
URL: https://www.firstcitizens.com/?mkt_tok=Mjk2LUNQWC0yOTUAAAGGjzWEenlD9bhQeI4yKU4PJ5Eg5xUYrIuOJJSXEvW7jT2yjNYpb3L3rorhi9Z_gG-_zI6eKyJLQDzI_99g55Pt-q-TEO8XVAg7nqO2Hj8X
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 1d7cb52729f96fe5a71385c08a149f3dfe20f8aedb17618013ff54999b2bd965

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

Content-Length: 1979
Content-Type: application/javascript

GET
H/1.1 200
OK image.aspx
2884.global.siteimproveanalytics.io/ 34 B
620 B 107ms
20ms Image
image/gif 52.58.29.12
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://2884.global.siteimproveanalytics.io/image.aspx?url=https%3A%2F%2Fwww.firstcitizens.com%2F%3Fmkt_tok%3DMjk2LUNQWC0yOTUAAAGGjzWEenlD9bhQeI4yKU4PJ5Eg5xUYrIuOJJSXEvW7jT2yjNYpb3L3rorhi9Z_gG-_zI6eKyJLQDzI_99g55Pt-q-TEO8XVAg7nqO2Hj8X&ref=https%3A%2F%2Fclick.firstcitizens.com%2F&title=Personal%20Banking%2C%20Credit%20Cards%2C%20Loans%20%7C%20First%20Citizens%20Bank&res=1600x1200&accountid=2884&rt=2967&prev=70f47041-de09-d7e7-e7f0-d935f19d95ca&luid=4bdd2e94-dc8f-1d82-cc78-a0227699ae71&rnd=24951
Requested by: Host: www.firstcitizens.com
URL: https://www.firstcitizens.com/?mkt_tok=Mjk2LUNQWC0yOTUAAAGGjzWEenlD9bhQeI4yKU4PJ5Eg5xUYrIuOJJSXEvW7jT2yjNYpb3L3rorhi9Z_gG-_zI6eKyJLQDzI_99g55Pt-q-TEO8XVAg7nqO2Hj8X
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.58.29.12 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-58-29-12.eu-central-1.compute.amazonaws.com
Software: /
Resource Hash: 1e85ec81b9800b4c443d39caca0d0926089a3ac201120db1ceb45b93789480b8

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.firstcitizens.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

Date: Wed, 31 Aug 2022 14:38:38 GMT
Cache-Control: max-age=0, no-cache="set-cookie"
Expires: Wed, 31 Aug 2022 14:38:38 UTC
Connection: keep-alive
Content-Length: 34
Content-Type: image/gif

GET
H2 200 sys-search@2x.png
www.firstcitizens.com/etc.clientlibs/firstcitizens/clientlibs/clientlib-aem/resources/images/ 960 B
2 KB 414ms
414ms Image
image/png 52.206.240.104
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.firstcitizens.com/etc.clientlibs/firstcitizens/clientlibs/clientlib-aem/resources/images/sys-search@2x.png

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.206.240.104 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-52-206-240-104.compute-1.amazonaws.com

Software

Apache /

Resource Hash

8ec4955cf8409babc80d8be144ee14fb795dec328c2775178ea9997781429e0c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.firstcitizens.com/?mkt_tok=Mjk2LUNQWC0yOTUAAAGGjzWEenlD9bhQeI4yKU4PJ5Eg5xUYrIuOJJSXEvW7jT2yjNYpb3L3rorhi9Z_gG-_zI6eKyJLQDzI_99g55Pt-q-TEO8XVAg7nqO2Hj8X
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

x-dispatcher: dispatcher2useast1
date: Wed, 31 Aug 2022 14:38:38 GMT
x-content-type-options: nosniff
age: 55960
x-vhost: publish
vary: Origin
content-length: 960
x-custom-location: DE,TH,Erfurt
last-modified: Thu, 06 Aug 2020 21:17:45 GMT
server: Apache
x-frame-options: SAMEORIGIN
etag: "3c0-5ac3c04f91040"
access-control-max-age: 1000
access-control-allow-methods: GET, OPTIONS, HEAD
content-type: image/png
cache-control: max-age=31536000, public
access-control-allow-credentials: true
accept-ranges: bytes
access-control-allow-headers: x-requested-with, Content-Type, origin, authorization, accept, client-security-token, Access-Control-Request-Method, Access-Control-Request-Headers, __token__,d6gq0uiuiy-a,d6gq0uiuiy-b,d6gq0uiuiy-c,d6gq0uiuiy-d,d6gq0uiuiy-f,d6gq0uiuiy-z,x-okta-user-agent-extended

GET
H2 200 / Show response
adservice.google.com/ddm/fls/i/dc_pre=CInq056n8fkCFRrUmgodIHAINg;cat=sitev03p;ord=1;src=6528888;type=count0;~oref=https://www.firstcitizens.com/ Frame 2D46 427 B
803 B 104ms
57ms Document
text/html 2a00:1450:4001:82f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/ddm/fls/i/dc_pre=CInq056n8fkCFRrUmgodIHAINg;cat=sitev03p;ord=1;src=6528888;type=count0;~oref=https://www.firstcitizens.com/

Requested by

Host: 6528888.fls.doubleclick.net
URL: https://6528888.fls.doubleclick.net/activityi;dc_pre=CInq056n8fkCFRrUmgodIHAINg;cat=sitev03p;ord=1;src=6528888;type=count0?

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

f53791ba90553841cef5aa28f9a53b893bf789f5d8904d103cf2ed5e70c885b5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://6528888.fls.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: no-cache, must-revalidate
content-encoding: gzip
content-length: 334
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 31 Aug 2022 14:38:38 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
pragma: no-cache
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 zN33 Show response
trk.firstcitizens.com/200189/ 124 B
617 B 114ms
113ms Script
text/javascript 44.196.18.202
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://trk.firstcitizens.com/200189/zN33?d=ZW5jZEAxNjRwMU9Jd011c2FRVzJzSklrZlBLMVp5QXl0enVpN3JURDNZZVkrbFBMZ2FBTWt6di9ZNkNaVVRIM25QU09pc3Ftem1iSGZ4bGlYcjMrUEV3c0JiRXpabHFlb0ZFSWZoVGRnNGttOFN6QjJVek9BdXpHc0lRZHZySCtNSWJKeVB4bFo3b2RRYi90QUo2b3ZFajF4enNXOUNtcjg3bnk5dnpuUUNqdXNBUllPN1RYdGhJUXd8NjdkMWJmMTQzZjY3NWQ4ODRlYzZmNjUwMmI0YjcyNGM3NjBiNmVmYmM3MjY4NTE4MTBiYjBiZjkzOWY3MTk2OWFiMDkyNTBiMjMyZTdhNTA4NDgyNzU1MGVkNWZkOTZiZjA0MWY5ZWE4ODdiM2Q5M2ZiNjNkNjMzZTQzOTE5NTlmOTYzOGIyMjNhZWRmY2Y4N2UwMzVlMThhMzI2NjkyNjA0MDRiZjZjNjRlNmNiMjZiNDk0MmM0ZmFiNjIwM2QwMDVkYmQyOGM1MDA3NzhjMGIzZDYzMzYxOGI2ZWQyODJiYTU3NjYxYTc2ZjA3NDJjYzAwNjMzMTZkMDFmZTIxOTg0ODg1NDVlMmIxMDg0NjQ0M2M0MmNiMmM3OWI1MjJlZTIyMWQ0N2RkNjg5MmIwMWJmOGI4OGFkZmMwMjcyM2I4NmQ4YWI1OGYyYzkxNTUyNTVmY2VkNDA1YWEzNjFjYzIxOGNiZGI3ZDllYjk5MTU5YWRiMzUxNTFmOWE4MTIwMmRiZmQzYmRmZjEwNzc4OWNjYjdmN2Q4OTllM2FjMWI2M2UxMzg5NmU4YWQyOTFkOTQxMTUyYTIzNGIxNmIzMTkxYWYzMGI3YmJiNTcyOGExMmMzM2NlODA5Mjc4NTJiMjJjZDhiNjRmODljNDE5MTllYjhiZWU5MTU3YjQ0ZTZ8MDBlZTBiNjJlY2FhYzg5Zg%3D%3D&cid=13&si=0&e=https%3A%2F%2Fwww.firstcitizens.com&LSESSIONID=eyJpIjoid3hnckxST2s3c29SKytDVVwvZHJacGc9PSIsImUiOiI2RmdYSnQ2ZGhXR292dmx3a3Z4dTBlcWRyVU0yNTNyYWRSUW9HNkVcL1NpeVhOMDhyM25FZDFUZHBuNGRkejhNZmt4Z2RsUzg3RnpQZldwdkpzdGJQSlg1SWVKY3prV01UUUp0aTluNTdGdWIyRUJuVlpQRGdhSWFBOVlGc1NaaVJaNzd4WWNkcHVPbVlOc3kwRHZxendRPT0ifQ%3D%3D.758d5dc8a541e933.ODc1ZjBjMWIwMzY4NTBjNzg4Njk5MTQ1YTgzMDE1NmE4MmIxY2I1ZTI2ZTJmN2I1OWZmMDFmZTljMWZkOGRkNA%3D%3D&t=jsonp&__tp=login&c=iaynfqdccksgsmol&eu=https%3A%2F%2Fwww.firstcitizens.com%2F

Requested by

Host: trk.firstcitizens.com
URL: https://trk.firstcitizens.com/200189/genc.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

44.196.18.202 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-44-196-18-202.compute-1.amazonaws.com

Software

haile /

Resource Hash

cdea06dbf0cdae47af34f2c9f601a70fd19425ae722e6ff5cd5d70a0402e9fad

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.firstcitizens.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 31 Aug 2022 14:38:38 GMT
server: haile
strict-transport-security: max-age=86400
access-control-allow-methods: GET, OPTIONS
p3p: CP="NOI ADM DEV PSAi COM NAV OUR OTR STP IND DEM"
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
content-type: text/javascript
content-length: 124
pics-label: (PICS-1.1 "http://www.icra.org/pics/vocabularyv03/" l r (n 0 s 0 v 0 l 0 oa 0 ob 0 oc 0 od 0 oe 0 of 0 og 0 oh 0 c 0) "http://www.icra.org/ratingsv02.html" l r (nz 0 vz 0 lz 0 oz 0 cz 0) "http://www.rsac.org/ratingsv01.html" l r (n 0 s 0 v 0 l 0))

GET
DATA 200
OK truncated
/ 89 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 50e6072d26098d48004a30addeecabd5b22b91e5ccdf9dd86f96459783e3ac23

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

Content-Type: image/png

GET
H2 200 / Show response
adservice.google.de/ddm/fls/i/dc_pre=CInq056n8fkCFRrUmgodIHAINg;cat=sitev03p;ord=1;src=6528888;type=count0;~oref=https://www.firstcitizens.com/ Frame C0E2 194 B
870 B 109ms
59ms Document
text/html 2a00:1450:4001:803::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/ddm/fls/i/dc_pre=CInq056n8fkCFRrUmgodIHAINg;cat=sitev03p;ord=1;src=6528888;type=count0;~oref=https://www.firstcitizens.com/

Requested by

Host: adservice.google.com
URL: https://adservice.google.com/ddm/fls/i/dc_pre=CInq056n8fkCFRrUmgodIHAINg;cat=sitev03p;ord=1;src=6528888;type=count0;~oref=https://www.firstcitizens.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:803::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

05978957c6c8b028f2785dc77271c286bfac76e30b7bcd7e835c2927fbe897cf

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://adservice.google.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
cache-control: private, max-age=0
content-encoding: gzip
content-length: 177
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 31 Aug 2022 14:38:38 GMT
expires: Wed, 31 Aug 2022 14:38:38 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

POST
H2 200 recording
k-aus1.contentsquare.net/v2/ 0
0 564ms
110ms Fetch 54.205.244.165
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://k-aus1.contentsquare.net/v2/recording?rt=5&v=11.40.1&pid=14800&uu=3cef1cc6-1c45-ad98-a8f6-eb94227008da&sn=1&pn=1&ri=1&rst=1661956718430&let=1661956718693&enc=lzstring
Requested by: Host: cds-sdkcfg.onlineaccess1.com
URL: https://cds-sdkcfg.onlineaccess1.com/common.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.205.244.165 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-205-244-165.compute-1.amazonaws.com
Software: /
Resource Hash

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.firstcitizens.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

access-control-allow-origin: *
date: Wed, 31 Aug 2022 14:38:39 GMT
timing-allow-origin: *
access-control-allow-headers: Access-Control-Expose-Headers, Content-Type, Content-Compression
content-length: 0
access-control-allow-methods: GET, POST, OPTIONS

GET
H2 200 image.jpeg
www.firstcitizens.com/content/dam/firstcitizens/images/resources/personal/home/home-improvements-that-increase-value@2x.jpg.transform/resource-card-standard-3-desktop/image-scaled-2x-to-1x/ 46 KB
47 KB 405ms
404ms Image
image/jpeg 52.206.240.104
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.firstcitizens.com/content/dam/firstcitizens/images/resources/personal/home/home-improvements-that-increase-value@2x.jpg.transform/resource-card-standard-3-desktop/image-scaled-2x-to-1x/image.jpeg

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.206.240.104 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-52-206-240-104.compute-1.amazonaws.com

Software

Apache /

Resource Hash

83203db8f86e32a589e9a843d05a3b3fdce8fdba86cdf30fd0c6f9983ea83822

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.firstcitizens.com/?mkt_tok=Mjk2LUNQWC0yOTUAAAGGjzWEenlD9bhQeI4yKU4PJ5Eg5xUYrIuOJJSXEvW7jT2yjNYpb3L3rorhi9Z_gG-_zI6eKyJLQDzI_99g55Pt-q-TEO8XVAg7nqO2Hj8X
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

x-dispatcher: dispatcher1useast1
date: Wed, 31 Aug 2022 14:38:39 GMT
x-content-type-options: nosniff
age: 2530521
x-vhost: publish
vary: Origin
content-length: 47469
x-custom-location: DE,TH,Erfurt
last-modified: Tue, 02 Aug 2022 07:43:18 GMT
server: Apache
x-frame-options: SAMEORIGIN
etag: "b96d-5e53d45101180"
access-control-max-age: 1000
access-control-allow-methods: GET, OPTIONS, HEAD
content-type: image/jpeg
cache-control: max-age=31536000, public
access-control-allow-credentials: true
accept-ranges: bytes
access-control-allow-headers: x-requested-with, Content-Type, origin, authorization, accept, client-security-token, Access-Control-Request-Method, Access-Control-Request-Headers, __token__,d6gq0uiuiy-a,d6gq0uiuiy-b,d6gq0uiuiy-c,d6gq0uiuiy-d,d6gq0uiuiy-f,d6gq0uiuiy-z,x-okta-user-agent-extended

GET
H2 200 image.jpeg
www.firstcitizens.com/content/dam/firstcitizens/images/resources/personal/credit/5-cs-of-credit@2x.jpg.transform/resource-card-standard-3-desktop/image-scaled-2x-to-1x/ 31 KB
32 KB 404ms
404ms Image
image/jpeg 52.206.240.104
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.firstcitizens.com/content/dam/firstcitizens/images/resources/personal/credit/5-cs-of-credit@2x.jpg.transform/resource-card-standard-3-desktop/image-scaled-2x-to-1x/image.jpeg

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.206.240.104 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-52-206-240-104.compute-1.amazonaws.com

Software

Apache /

Resource Hash

460a2a7e52186959e1dd4d130a44d6d1038137639a892483cc060c51ed4ce895

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.firstcitizens.com/?mkt_tok=Mjk2LUNQWC0yOTUAAAGGjzWEenlD9bhQeI4yKU4PJ5Eg5xUYrIuOJJSXEvW7jT2yjNYpb3L3rorhi9Z_gG-_zI6eKyJLQDzI_99g55Pt-q-TEO8XVAg7nqO2Hj8X
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

x-dispatcher: dispatcher2useast1
date: Wed, 31 Aug 2022 14:38:39 GMT
x-content-type-options: nosniff
age: 2908205
x-vhost: publish
vary: Origin
content-length: 31740
x-custom-location: DE,TH,Erfurt
last-modified: Thu, 28 Jul 2022 22:48:34 GMT
server: Apache
x-frame-options: SAMEORIGIN
etag: "7bfc-5e4e555579480"
access-control-max-age: 1000
access-control-allow-methods: GET, OPTIONS, HEAD
content-type: image/jpeg
cache-control: max-age=31536000, public
access-control-allow-credentials: true
accept-ranges: bytes
access-control-allow-headers: x-requested-with, Content-Type, origin, authorization, accept, client-security-token, Access-Control-Request-Method, Access-Control-Request-Headers, __token__,d6gq0uiuiy-a,d6gq0uiuiy-b,d6gq0uiuiy-c,d6gq0uiuiy-d,d6gq0uiuiy-f,d6gq0uiuiy-z,x-okta-user-agent-extended

GET
H2 200 image.jpeg
www.firstcitizens.com/content/dam/firstcitizens/images/resources/personal/retirement/what-to-do-with-401k-during-recession@2x.jpg.transform/resource-card-standard-3-desktop/image-scaled-2x-to-1x/ 34 KB
35 KB 405ms
404ms Image
image/jpeg 52.206.240.104
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.firstcitizens.com/content/dam/firstcitizens/images/resources/personal/retirement/what-to-do-with-401k-during-recession@2x.jpg.transform/resource-card-standard-3-desktop/image-scaled-2x-to-1x/image.jpeg

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.206.240.104 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-52-206-240-104.compute-1.amazonaws.com

Software

Apache /

Resource Hash

5fad50cc39e0ba03bdb8e9271f32dbd2e138eaff10cae489637a9594b3794a16

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.firstcitizens.com/?mkt_tok=Mjk2LUNQWC0yOTUAAAGGjzWEenlD9bhQeI4yKU4PJ5Eg5xUYrIuOJJSXEvW7jT2yjNYpb3L3rorhi9Z_gG-_zI6eKyJLQDzI_99g55Pt-q-TEO8XVAg7nqO2Hj8X
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

x-dispatcher: dispatcher1useast1
date: Wed, 31 Aug 2022 14:38:39 GMT
x-content-type-options: nosniff
age: 2675824
x-vhost: publish
vary: Origin
content-length: 34716
x-custom-location: DE,TH,Erfurt
last-modified: Sun, 31 Jul 2022 15:21:35 GMT
server: Apache
x-frame-options: SAMEORIGIN
etag: "879c-5e51b70543dc0"
access-control-max-age: 1000
access-control-allow-methods: GET, OPTIONS, HEAD
content-type: image/jpeg
cache-control: max-age=31536000, public
access-control-allow-credentials: true
accept-ranges: bytes
access-control-allow-headers: x-requested-with, Content-Type, origin, authorization, accept, client-security-token, Access-Control-Request-Method, Access-Control-Request-Headers, __token__,d6gq0uiuiy-a,d6gq0uiuiy-b,d6gq0uiuiy-c,d6gq0uiuiy-d,d6gq0uiuiy-f,d6gq0uiuiy-z,x-okta-user-agent-extended

GET
H3

200

activityi;dc_pre=COqsmqCn8fkCFZrxmgodyw4Mvw;cat=fcb-u0;src=9786468;type=unive0 Show response
9786468.fls.doubleclick.net/ Frame 25A6
Redirect Chain

https://9786468.fls.doubleclick.net/activityi;cat=fcb-u0;src=9786468;type=unive0?
https://9786468.fls.doubleclick.net/activityi;dc_pre=COqsmqCn8fkCFZrxmgodyw4Mvw;cat=fcb-u0;src=9786468;type=unive0?

2 KB
976 B

117ms
117ms

Document
text/html

142.250.185.198
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://9786468.fls.doubleclick.net/activityi;dc_pre=COqsmqCn8fkCFZrxmgodyw4Mvw;cat=fcb-u0;src=9786468;type=unive0?

Requested by

Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/60e0841c6ded/d5a97f0ea4af/launch-3bb7433af2ae.min.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.198 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s52-in-f6.1e100.net

Software

cafe /

Resource Hash

4872bcbe87c7dc34cadbd6d540a412d5085c5f2960727ec0e214a20652575ad9

Security Headers

Name	Value
Strict-Transport-Security	max-age=21600
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.firstcitizens.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: private, max-age=0
content-encoding: gzip
content-length: 951
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 31 Aug 2022 14:38:41 GMT
expires: Wed, 31 Aug 2022 14:38:41 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
strict-transport-security: max-age=21600
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

Redirect headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control: no-cache, must-revalidate
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Wed, 31 Aug 2022 14:38:41 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
follow-only-when-prerender-shown: 1
location: https://9786468.fls.doubleclick.net/activityi;dc_pre=COqsmqCn8fkCFZrxmgodyw4Mvw;cat=fcb-u0;src=9786468;type=unive0?
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
pragma: no-cache
server: cafe
strict-transport-security: max-age=21600
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 / Show response
zndhwk2nlgcbvdel3-firstcitizensbank.siteintercept.qualtrics.com/WRSiteInterceptEngine/ 7 KB
4 KB 126ms
56ms Script
application/javascript 104.17.209.240
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://zndhwk2nlgcbvdel3-firstcitizensbank.siteintercept.qualtrics.com/WRSiteInterceptEngine/?Q_ZID=ZN_dhWK2NLgcbvdeL3

Requested by

Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/60e0841c6ded/d5a97f0ea4af/launch-3bb7433af2ae.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.17.209.240 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

516abb6173cac18c967f5ba483568ac9cc51e6cb8b141c8830b67f64fdba0fb9

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.firstcitizens.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

date: Wed, 31 Aug 2022 14:38:41 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
age: 131821
cf-polished: origSize=8487
cf-ray: 743682e69bd09072-FRA
edge-control: max-age=604800
vary: Accept-Encoding
referrer-policy: strict-origin-when-cross-origin
cf-bgj: minify
server: cloudflare
etag: W/"2127-aUO8fxi7Kuod7I9y7RgLJT23kHo"
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=3600, s-maxage=604800
permissions-policy: camera=(), geolocation=(), microphone=()
timing-allow-origin: *
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept

GET
H2 200 RC3f46c62a70f045be8e7254bf90a2eaac-source.min.js Show response
assets.adobedtm.com/60e0841c6ded/d5a97f0ea4af/807012c26cd9/ 988 B
770 B 21ms
21ms Script
application/x-javascript 2a02:26f0:3500:587::1e80
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/60e0841c6ded/d5a97f0ea4af/807012c26cd9/RC3f46c62a70f045be8e7254bf90a2eaac-source.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/60e0841c6ded/d5a97f0ea4af/launch-3bb7433af2ae.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:3500:587::1e80 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: AkamaiNetStorage /
Resource Hash: 16dc47288992b53e5d9e5862c4cd9916cefbbbca88fa888543e22f7cbf18cb38

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.firstcitizens.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

date: Wed, 31 Aug 2022 14:38:41 GMT
content-encoding: gzip
last-modified: Tue, 30 Aug 2022 14:46:52 GMT
server: AkamaiNetStorage
etag: "53d880f6fe7e15d722276cb45357d8ab:1661870812.777549"
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: https://www.firstcitizens.com
cache-control: max-age=3600
accept-ranges: bytes
timing-allow-origin: *
content-length: 501
expires: Wed, 31 Aug 2022 15:38:41 GMT

GET
H2 200 zN33 Show response
trk.firstcitizens.com/200189/ 134 B
627 B 127ms
127ms Script
text/javascript 44.196.18.202
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://trk.firstcitizens.com/200189/zN33?d=ZW5jZEBIbnJPdFpZYXNIK0YwSVZZYTF2TjkvNkRySmhuZDc0a05RcloyLzVFL2d6VGg2N0p1V05FS0pVSVNWM3NmNi91QklNdmxnZU9vSmJ4Mks1eERVMDdycFFGcDJyMVJ6RGp6UkVLV3I0STRwK3hHWUpkWjVhVVJPK2prNWdZOEJtY0JDYmFDS254NStpUkl3ZUo4eW5JQ1NER1NPcGRRelJEVHcyZUYvaXRMNHZUVldWekRmVUJUdGNncmxsaytEWGpGSEQ1RlNTRDZmWTVNZlQweEE2eWw5cnZKcHR3TzZxaXZkR0REWFZNSHg4aVVESFJBajJadnJRNzdBVTkrbmY0UXVNUlEva2VBOUduNzFZMWc2cUcrS01yL3NoelJuSG9rY3hCemt5ZnVreGV6YzdxZjdwaS9EY0JNOHZYNFJhbzkvWFA4ZE8yZlZ2NlYybWJhR09LK1A3NkZ2aXIyZitwYm5US29UKzlJV3loWnlIZ3k3YmxyL0tIa3JHR1UraStnMGx2a0E3SHRoZ1BwNjZYcWk0Ynd3ZjVIWlRuclorQkdFMUhiUXl0U2RjeDNldUxDQ0hhYWVrTmZEVDY4bnFLRHp3dWJEY2RXbUVTZlE5eG9TMjBCamtSbHlvRDVWTlhaNXBhUWRFU3o5Tk10Z1RORm13S1FXQURsNktRQ2dxNWIxNmVNSU50RHRoQkJneFoxbVhGZGJReTFvSzFndTZTWE84bUlxVkg5WnVhNmtnN3lqMnpYUnlCVWxMdjl6N0t6dFRGK0ZYeFV5VVBFK2swbGZjTk9GOHZYUENzV1E9PXw3YzhmNTEzZjIxNmI1MGQ5NzY3ZjY3ZjUyMDZjNGU0MjI1YTllNjVkNTQxZjU2YTYwODhjNzFkMDdiNzkxZjIyMjAyODIwYTY5NTQyYjYzNmExODA3ZmNhMDk3NDhiMDEzMmRlYTRiYTFlZGE3MWM3OTYxNWQwNmIxM2I2MzAwOWRhY2UzMTNjM2Y1MGZhZWRiMTE3NDE1NWU3MmViN2M3M2Y5Y2ZiZDRjMjM5OTg4MGQyYjcyNDUzMmNmOTg5YzhlNmRjOTQ5Zjk4MWM4MWRjNWVmYmRmNGJjMjA3OGU3ZmEwYTNjNDQxODQwZjhkNzk1ZTgxYWM2MTI2MDQ5ZWZmMzVmNTUzNzE1YjJjY2MzOTFlNGNhN2RlNWRmMDAwM2MxMmFkYjQ2ODQ5ZjJkNjkzMmQ0MjE1ZThmZjRlNzllMDg3OWRkMjk1NTUyYjdhMTcyYzlhNzVlNzMxYjI0NzNiOWFkNzg1NmZlNDI0NDQ2YzUyYjM3NmNlNTVlZWMxNjY1MWQ0ZjA4OTA3OWI0MTVmMWJhYjY5NDBmY2FhYTA2NTliY2IzNzhlMDlkZDMxMDA2YzYwNjI1MDI2ZTE5NGY1NTdjOTQ5YmFiOTQyNDYwNDg4MjY3MWVkYTNlMDc3YTFkMDU2ODZkZjFkNGZhMzg1ZTQ0MzMwNTRiYjUxNzcwOXwwMGVlMGI2MmVjYWFjODlm&cid=15%2C17&si=1&e=https%3A%2F%2Fwww.firstcitizens.com&LSESSIONID=eyJpIjoid3hnckxST2s3c29SKytDVVwvZHJacGc9PSIsImUiOiI2RmdYSnQ2ZGhXR292dmx3a3Z4dTBlcWRyVU0yNTNyYWRSUW9HNkVcL1NpeVhOMDhyM25FZDFUZHBuNGRkejhNZmt4Z2RsUzg3RnpQZldwdkpzdGJQSlg1SWVKY3prV01UUUp0aTluNTdGdWIyRUJuVlpQRGdhSWFBOVlGc1NaaVJaNzd4WWNkcHVPbVlOc3kwRHZxendRPT0ifQ%3D%3D.758d5dc8a541e933.ODc1ZjBjMWIwMzY4NTBjNzg4Njk5MTQ1YTgzMDE1NmE4MmIxY2I1ZTI2ZTJmN2I1OWZmMDFmZTljMWZkOGRkNA%3D%3D&t=jsonp&__tp=login&c=ftwdqbkurvh__xsd&eu=https%3A%2F%2Fwww.firstcitizens.com%2F

Requested by

Host: trk.firstcitizens.com
URL: https://trk.firstcitizens.com/200189/comvo.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

44.196.18.202 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-44-196-18-202.compute-1.amazonaws.com

Software

haile /

Resource Hash

01c6f0a1ebbe4e99848b16a64da29fd34d4604f96c98845b71219e1db21ff2b9

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.firstcitizens.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 31 Aug 2022 14:38:41 GMT
server: haile
strict-transport-security: max-age=86400
access-control-allow-methods: GET, OPTIONS
p3p: CP="NOI ADM DEV PSAi COM NAV OUR OTR STP IND DEM"
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
content-type: text/javascript
content-length: 134
pics-label: (PICS-1.1 "http://www.icra.org/pics/vocabularyv03/" l r (n 0 s 0 v 0 l 0 oa 0 ob 0 oc 0 od 0 oe 0 of 0 og 0 oh 0 c 0) "http://www.icra.org/ratingsv02.html" l r (nz 0 vz 0 lz 0 oz 0 cz 0) "http://www.rsac.org/ratingsv01.html" l r (n 0 s 0 v 0 l 0))

GET
H2 200 fulvip.html Show response
trk.firstcitizens.com/200189/ Frame BE18 22 KB
10 KB 109ms
108ms Document
text/html 44.196.18.202
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://trk.firstcitizens.com/200189/fulvip.html?sui=5e714debaf6d4439159f3327270b947e7ac3ebf8e0985c5788545626262bff8c

Requested by

Host: trk.firstcitizens.com
URL: https://trk.firstcitizens.com/200189/comvo.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

44.196.18.202 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-44-196-18-202.compute-1.amazonaws.com

Software

haile /

Resource Hash

864a720c65a205784b8e436c95d15926cb33544309e89d6684c00d48cffd822f

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

Referer: https://www.firstcitizens.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

access-control-allow-credentials: true
access-control-allow-methods: GET, OPTIONS
access-control-allow-origin: *
cache-control: private, max-age=3600
content-encoding: gzip
content-type: text/html
date: Wed, 31 Aug 2022 14:38:41 GMT
expires: Wed, 31 Aug 2022 15:38:41 GMT
p3p: CP="NOI ADM DEV PSAi COM NAV OUR OTR STP IND DEM"
pics-label: (PICS-1.1 "http://www.icra.org/pics/vocabularyv03/" l r (n 0 s 0 v 0 l 0 oa 0 ob 0 oc 0 od 0 oe 0 of 0 og 0 oh 0 c 0) "http://www.icra.org/ratingsv02.html" l r (nz 0 vz 0 lz 0 oz 0 cz 0) "http://www.rsac.org/ratingsv01.html" l r (n 0 s 0 v 0 l 0))
server: haile
strict-transport-security: max-age=86400

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 174 KB
63 KB 100ms
38ms Script
application/javascript 2a00:1450:4001:813::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-10873044387&l=dataLayer

Requested by

Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/60e0841c6ded/d5a97f0ea4af/launch-3bb7433af2ae.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

18a61947e910398b0a712b53659ecb05daae3164567e075f0ca7c86b0079bd41

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.firstcitizens.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

date: Wed, 31 Aug 2022 14:38:41 GMT
content-encoding: br
vary: Accept-Encoding
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 64368
x-xss-protection: 0
last-modified: Wed, 31 Aug 2022 12:00:00 GMT
server: Google Tag Manager
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Wed, 31 Aug 2022 14:38:41 GMT

GET
H/1.1 200
OK munchkin.js Show response
munchkin.marketo.net/ 1 KB
1 KB 84ms
22ms Script
application/x-javascript 23.205.237.4
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://munchkin.marketo.net/munchkin.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/60e0841c6ded/d5a97f0ea4af/launch-3bb7433af2ae.min.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.205.237.4 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-205-237-4.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: fe62ffc3dd7627c8b0d34b70fe45c7b14dd38c89c66cca13b2e4c71360e42e91

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.firstcitizens.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

Date: Wed, 31 Aug 2022 14:38:41 GMT
Content-Encoding: gzip
Last-Modified: Thu, 25 Aug 2022 21:55:11 GMT
Server: AkamaiNetStorage
ETag: "652cf747f68f64e15276c347eb3aef37:1661464511.126488"
Vary: Accept-Encoding
P3P: policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR"
Connection: keep-alive
Accept-Ranges: bytes
Content-Type: application/x-javascript
Content-Length: 740

GET
H2 200 tlen.html Show response
trk.firstcitizens.com/200189/ Frame E186 70 KB
32 KB 108ms
108ms Document
text/html 44.196.18.202
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://trk.firstcitizens.com/200189/tlen.html?si=0&e=https%3A%2F%2Fwww.firstcitizens.com&LSESSIONID=eyJpIjoid3hnckxST2s3c29SKytDVVwvZHJacGc9PSIsImUiOiI2RmdYSnQ2ZGhXR292dmx3a3Z4dTBlcWRyVU0yNTNyYWRSUW9HNkVcL1NpeVhOMDhyM25FZDFUZHBuNGRkejhNZmt4Z2RsUzg3RnpQZldwdkpzdGJQSlg1SWVKY3prV01UUUp0aTluNTdGdWIyRUJuVlpQRGdhSWFBOVlGc1NaaVJaNzd4WWNkcHVPbVlOc3kwRHZxendRPT0ifQ%3D%3D.758d5dc8a541e933.ODc1ZjBjMWIwMzY4NTBjNzg4Njk5MTQ1YTgzMDE1NmE4MmIxY2I1ZTI2ZTJmN2I1OWZmMDFmZTljMWZkOGRkNA%3D%3D&t=xframe&__tp=login&eu=https%3A%2F%2Fwww.firstcitizens.com%2F&icid=1661956721673996&sr=https%3A%2F%2Fwww.firstcitizens.com%2Fcontent%2Fdam%2Ffirstcitizens%2Fimages%2Fresources%2Fpersonal%2Fcredit%2F5-cs-of-credit%402x.jpg.transform%2Fresource-card-standard-3-desktop%2Fimage-scaled-2x-to-1x%2Fimage.jpeg

Requested by

Host: trk.firstcitizens.com
URL: https://trk.firstcitizens.com/200189/jidrof.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

44.196.18.202 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-44-196-18-202.compute-1.amazonaws.com

Software

haile /

Resource Hash

3e37ff4860641d0f62e3691c26979fb64c5c62c995b11c79212432b6557943d8

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

Referer: https://www.firstcitizens.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

access-control-allow-credentials: true
access-control-allow-methods: GET, OPTIONS
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
content-encoding: gzip
content-type: text/html
date: Wed, 31 Aug 2022 14:38:41 GMT
p3p: CP="NOI ADM DEV PSAi COM NAV OUR OTR STP IND DEM"
pics-label: (PICS-1.1 "http://www.icra.org/pics/vocabularyv03/" l r (n 0 s 0 v 0 l 0 oa 0 ob 0 oc 0 od 0 oe 0 of 0 og 0 oh 0 c 0) "http://www.icra.org/ratingsv02.html" l r (nz 0 vz 0 lz 0 oz 0 cz 0) "http://www.rsac.org/ratingsv01.html" l r (n 0 s 0 v 0 l 0))
pragma: no-cache
server: haile
strict-transport-security: max-age=86400

GET
H2 200 / Show response
trk.firstcitizens.com/200189/grobutl.html/discovercard.com/dfs/accounthome/summary/www.schwab.com/secure.accurint.com/unfcu2.org//login1/wachovia.com/MyAccounts.aspx/investing.schwab.com/secure/sch... Frame D08D 66 KB
30 KB 113ms
112ms Document
text/html 44.196.18.202
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://trk.firstcitizens.com/200189/grobutl.html/discovercard.com/dfs/accounthome/summary/www.schwab.com/secure.accurint.com/unfcu2.org//login1/wachovia.com/MyAccounts.aspx/investing.schwab.com/secure/schwab///httpsabph.pl/pi/do/Authorization/alfabank.ru/swedbank/pf.bgz.pl/httponline.eurobank.pl/https://snsbank.nl/mijnsns/secure/login/?cid=5&si=0&e=https%3A%2F%2Fwww.firstcitizens.com&LSESSIONID=eyJpIjoid3hnckxST2s3c29SKytDVVwvZHJacGc9PSIsImUiOiI2RmdYSnQ2ZGhXR292dmx3a3Z4dTBlcWRyVU0yNTNyYWRSUW9HNkVcL1NpeVhOMDhyM25FZDFUZHBuNGRkejhNZmt4Z2RsUzg3RnpQZldwdkpzdGJQSlg1SWVKY3prV01UUUp0aTluNTdGdWIyRUJuVlpQRGdhSWFBOVlGc1NaaVJaNzd4WWNkcHVPbVlOc3kwRHZxendRPT0ifQ%3D%3D.758d5dc8a541e933.ODc1ZjBjMWIwMzY4NTBjNzg4Njk5MTQ1YTgzMDE1NmE4MmIxY2I1ZTI2ZTJmN2I1OWZmMDFmZTljMWZkOGRkNA%3D%3D&t=xframe&__tp=login&eu=https%3A%2F%2Fwww.firstcitizens.com%2F&icid=166195672168074903&sr=https%3A%2F%2Fwww.firstcitizens.com%2Fcontent%2Fdam%2Ffirstcitizens%2Fimages%2Fresources%2Fpersonal%2Fcredit%2F5-cs-of-credit%402x.jpg.transform%2Fresource-card-standard-3-desktop%2Fimage-scaled-2x-to-1x%2Fimage.jpeg

Requested by

Host: trk.firstcitizens.com
URL: https://trk.firstcitizens.com/200189/jidrof.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

44.196.18.202 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-44-196-18-202.compute-1.amazonaws.com

Software

haile /

Resource Hash

b7c3a92a3e2ea697cae3df92f0069cc6296e0b012738def1f62fdb3ecca53b4b

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

Referer: https://www.firstcitizens.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

access-control-allow-credentials: true
access-control-allow-methods: GET, OPTIONS
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
content-encoding: gzip
content-type: text/html
date: Wed, 31 Aug 2022 14:38:41 GMT
p3p: CP="NOI ADM DEV PSAi COM NAV OUR OTR STP IND DEM"
pics-label: (PICS-1.1 "http://www.icra.org/pics/vocabularyv03/" l r (n 0 s 0 v 0 l 0 oa 0 ob 0 oc 0 od 0 oe 0 of 0 og 0 oh 0 c 0) "http://www.icra.org/ratingsv02.html" l r (nz 0 vz 0 lz 0 oz 0 cz 0) "http://www.rsac.org/ratingsv01.html" l r (n 0 s 0 v 0 l 0))
pragma: no-cache
server: haile
strict-transport-security: max-age=86400

GET
H2 200 11.4dc17d50d8eb18566aef.chunk.js Show response
siteintercept.qualtrics.com/dxjsmodule/ 61 KB
19 KB 45ms
44ms Script
application/javascript 104.17.209.240
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://siteintercept.qualtrics.com/dxjsmodule/11.4dc17d50d8eb18566aef.chunk.js?Q_CLIENTVERSION=1.76.1&Q_CLIENTTYPE=web&Q_BRANDID=www.firstcitizens.com

Requested by

Host: zndhwk2nlgcbvdel3-firstcitizensbank.siteintercept.qualtrics.com
URL: https://zndhwk2nlgcbvdel3-firstcitizensbank.siteintercept.qualtrics.com/WRSiteInterceptEngine/?Q_ZID=ZN_dhWK2NLgcbvdeL3

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.17.209.240 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

087ffde713af10751722998e46fd7a0f04826fb2849a6b4dd70c2c65ced26bba

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.firstcitizens.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

date: Wed, 31 Aug 2022 14:38:41 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
age: 581516
cf-polished: origSize=62932
cf-ray: 743682e6ec3d9072-FRA
edge-control: max-age=604800
vary: Accept-Encoding
referrer-policy: strict-origin-when-cross-origin
last-modified: Wed, 24 Aug 2022 17:32:10 GMT
server: cloudflare
etag: W/"f5d4-182d0e95990"
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=604800, s-maxage=604800
permissions-policy: camera=(), geolocation=(), microphone=()
timing-allow-origin: *
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept
cf-bgj: minify

GET
H/1.1 200
OK munchkin.js Show response
munchkin.marketo.net/162/ 11 KB
5 KB 20ms
20ms Script
application/x-javascript 23.205.237.4
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://munchkin.marketo.net/162/munchkin.js
Requested by: Host: munchkin.marketo.net
URL: https://munchkin.marketo.net/munchkin.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.205.237.4 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-205-237-4.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 5d4972183041556a4368526fbac13acafc83de9ff3ca29ce81f31eb29c8f8a57

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.firstcitizens.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

Date: Wed, 31 Aug 2022 14:38:41 GMT
Content-Encoding: gzip
Last-Modified: Fri, 01 Jul 2022 00:59:12 GMT
Server: AkamaiNetStorage
ETag: "75daf56f6191efe42577301908659c29:1656637152.894482"
Vary: Accept-Encoding
P3P: policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR", policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR"
Cache-Control: max-age=8640000
Connection: keep-alive
Accept-Ranges: bytes
Content-Type: application/x-javascript
Content-Length: 4677
Expires: Fri, 09 Dec 2022 14:38:41 GMT

POST
H2 200 Targeting.php Show response
siteintercept.qualtrics.com/WRSiteInterceptEngine/ 1 KB
825 B 45ms
45ms XHR
application/json 104.17.209.240
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://siteintercept.qualtrics.com/WRSiteInterceptEngine/Targeting.php?Q_ZoneID=ZN_dhWK2NLgcbvdeL3&Q_CLIENTVERSION=1.76.1&Q_CLIENTTYPE=webAdobeLaunch

Requested by

Host: cds-sdkcfg.onlineaccess1.com
URL: https://cds-sdkcfg.onlineaccess1.com/common.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.17.209.240 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

8ec0de7054ad86aba875b6e9c92bc433f87819a4285afc3e6a4cf7e7fd064e7c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.firstcitizens.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36
Content-type: application/x-www-form-urlencoded

Response headers

date: Wed, 31 Aug 2022 14:38:41 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
strict-transport-security: max-age=31536000; includeSubDomains; preload
timing-allow-origin: *
referrer-policy: strict-origin-when-cross-origin
server: cloudflare
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: https://www.firstcitizens.com
cache-control: no-store, no-cache, must-revalidate, max-age=0
access-control-allow-credentials: true
permissions-policy: camera=(), geolocation=(), microphone=()
trace-id: 3a38784dcddf0375
cf-ray: 743682e73c9a9072-FRA

GET
H/1.1

200

rs
tags.w55c.net/ Frame 25A6
Redirect Chain

https://tags.w55c.net/rs?id=51b9ba5765fa41d0a20f86741131dc72&t=marketing
https://tags.w55c.net/rs?sccid=ddd7cdcd-a2a6-ec76-3046-756a7267623f&scc=1&id=51b9ba5765fa41d0a20f86741131dc72&t=marketing

42 B
593 B

20ms
20ms

Image
image/gif

3.121.84.223
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://tags.w55c.net/rs?sccid=ddd7cdcd-a2a6-ec76-3046-756a7267623f&scc=1&id=51b9ba5765fa41d0a20f86741131dc72&t=marketing

Requested by

Host: 9786468.fls.doubleclick.net
URL: https://9786468.fls.doubleclick.net/activityi;dc_pre=COqsmqCn8fkCFZrxmgodyw4Mvw;cat=fcb-u0;src=9786468;type=unive0?

Protocol

HTTP/1.1

Server

3.121.84.223 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-3-121-84-223.eu-central-1.compute.amazonaws.com

Software

Retargeting/9853e75#9853e75792b29505864c0b7c23889ef441e21f3f i-0b07b63ab2330e6f2@eu-central-1a@dxedge-app-eu-central-1-prod-asg /

Resource Hash

47043e4823a6c21a8881de789b4185355330b5804629d23f6b43dd93f5265292

Security Headers

Name	Value
Strict-Transport-Security	max-age=2592000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://9786468.fls.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

Pragma: no-cache
Date: Wed, 31 Aug 2022 14:38:41 GMT
Server: Retargeting/9853e75#9853e75792b29505864c0b7c23889ef441e21f3f i-0b07b63ab2330e6f2@eu-central-1a@dxedge-app-eu-central-1-prod-asg
Strict-Transport-Security: max-age=2592000; includeSubDomains
Content-Type: image/gif
Cache-Control: no-cache, must-revalidate
Connection: keep-alive
Content-Length: 42
Expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Wed, 31 Aug 2022 14:38:41 GMT
Server: Retargeting/9853e75#9853e75792b29505864c0b7c23889ef441e21f3f i-083ca9c8ddef9a183@eu-central-1a@dxedge-app-eu-central-1-prod-asg
Strict-Transport-Security: max-age=2592000; includeSubDomains
Location: https://tags.w55c.net/rs?sccid=ddd7cdcd-a2a6-ec76-3046-756a7267623f&scc=1&id=51b9ba5765fa41d0a20f86741131dc72&t=marketing
Cache-Control: no-cache, must-revalidate
Connection: keep-alive
Content-Length: 0
Expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ Frame 25A6 169 KB
62 KB 80ms
33ms Script
application/javascript 2a00:1450:4001:813::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-971615714

Requested by

Host: 9786468.fls.doubleclick.net
URL: https://9786468.fls.doubleclick.net/activityi;dc_pre=COqsmqCn8fkCFZrxmgodyw4Mvw;cat=fcb-u0;src=9786468;type=unive0?

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

a6f8a832354dcb8ee7968e7334f17c261998bdbab1d4f1078c4d069b50c43ec2

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://9786468.fls.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

date: Wed, 31 Aug 2022 14:38:41 GMT
content-encoding: br
vary: Accept-Encoding
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 62974
x-xss-protection: 0
last-modified: Wed, 31 Aug 2022 13:13:51 GMT
server: Google Tag Manager
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Wed, 31 Aug 2022 14:38:41 GMT

GET
H2

200

nsjs Show response
action.media6degrees.com/orbserv/ Frame 25A6
Redirect Chain

https://action.dstillery.com/orbserv/nsjs?adv=cl1027245&ns=4080&nc=FCBHomepage&ncv=32&dstOrderId=[OrderId]&dstOrderAmount=[OrderAmount]
https://action.media6degrees.com/orbserv/nsjs?adv=cl1027245&ns=4080&nc=FCBHomepage&ncv=32&dstOrderId=[OrderId]&dstOrderAmount=[OrderAmount]

5 B
231 B

149ms
140ms

Script
text/html

2606:4700::6812:a4f
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://action.media6degrees.com/orbserv/nsjs?adv=cl1027245&ns=4080&nc=FCBHomepage&ncv=32&dstOrderId=[OrderId]&dstOrderAmount=[OrderAmount]
Requested by: Host: 9786468.fls.doubleclick.net
URL: https://9786468.fls.doubleclick.net/activityi;dc_pre=COqsmqCn8fkCFZrxmgodyw4Mvw;cat=fcb-u0;src=9786468;type=unive0?
Protocol: H2
Server: 2606:4700::6812:a4f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 7c370d9536d7d0d6a0f7cd7f9826692acd93e4fb05ba46f7b630b879740343d3

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://9786468.fls.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 31 Aug 2022 14:38:42 GMT
content-encoding: gzip
cf-cache-status: DYNAMIC
server: cloudflare
cf-ray: 743682ea0bad691f-FRA
content-language: de-DE
p3p: CP="COM NAV INT STA NID OUR IND NOI"
access-control-allow-origin: *
cache-control: no-cache
content-type: text/html;charset=ISO-8859-1

Redirect headers

location: https://action.media6degrees.com/orbserv/nsjs?adv=cl1027245&ns=4080&nc=FCBHomepage&ncv=32&dstOrderId=[OrderId]&dstOrderAmount=[OrderAmount]
date: Wed, 31 Aug 2022 14:38:42 GMT
cf-cache-status: DYNAMIC
server: cloudflare
access-control-allow-origin: *
cf-ray: 743682e7cffb691f-FRA
content-type: text/html; charset=iso-8859-1

GET
H3 200 dc_pre=COqsmqCn8fkCFZrxmgodyw4Mvw;cat=fcb-u0;src=9786468;type=unive0
adservice.google.com/ddm/fls/z/ Frame 25A6 42 B
63 B 106ms
62ms Image
image/gif 2a00:1450:4001:82f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://adservice.google.com/ddm/fls/z/dc_pre=COqsmqCn8fkCFZrxmgodyw4Mvw;cat=fcb-u0;src=9786468;type=unive0

Requested by

Host: 9786468.fls.doubleclick.net
URL: https://9786468.fls.doubleclick.net/activityi;dc_pre=COqsmqCn8fkCFZrxmgodyw4Mvw;cat=fcb-u0;src=9786468;type=unive0?

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://9786468.fls.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 31 Aug 2022 14:38:41 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 s49972958832060
firstcitizens.sc.omtrdc.net/b/ss/fcb-production/1/JS-2.22.4-LCUM/ 43 B
344 B 99ms
30ms Image
image/gif 13.36.218.177
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://firstcitizens.sc.omtrdc.net/b/ss/fcb-production/1/JS-2.22.4-LCUM/s49972958832060?AQB=1&ndh=1&pf=1&t=31%2F7%2F2022%2014%3A38%3A41%203%200&mid=13892004862147962413406043386722206805&aamlh=6&ce=UTF-8&pageName=%2F&g=https%3A%2F%2Fwww.firstcitizens.com%2F&r=https%3A%2F%2Fclick.firstcitizens.com%2F&c.&getPreviousValue=3.0&.c&cc=USD&server=production&events=event1&aamb=6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y&c1=%2F&v1=%2F&c2=https%3A%2F%2Fwww.firstcitizens.com%2F&v2=https%3A%2F%2Fwww.firstcitizens.com%2F&c3=production&v3=13892004862147962413406043386722206805&c4=redesign%202020&v5=https%3A%2F%2Fwww.firstcitizens.com%2F%3Fmkt_tok%3DMjk2LUNQWC0yOTUAAAGGjzWEenlD9bhQeI4yKU4PJ5Eg5xUYrIuOJJSXEvW7jT2yjNYpb3L3rorhi9Z_gG-_zI6eKyJLQDzI_99g55Pt-q-TEO8XVAg7nqO2Hj8X&v10=personal%20banking&v12=personal%20banking%20credit%20cards%20loans%20%7C%20first%20citizens%20bank&s=1600x1200&c=24&j=1.6&v=N&k=Y&bw=1600&bh=1200&mcorgid=E6D235355CF7C1DE0A495EEC%40AdobeOrg&AQE=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.36.218.177 Paris, France, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-13-36-218-177.eu-west-3.compute.amazonaws.com

Software

jag /

Resource Hash

a1ecbaed793a1f564c49c671f2dd0ce36f858534ef6d26b55783a06b884cc506

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.firstcitizens.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 31 Aug 2022 14:38:41 GMT
x-content-type-options: nosniff
last-modified: Thu, 01 Sep 2022 14:38:41 GMT
server: jag
etag: 3569024883284541440-4619384352922421243
vary: *
p3p: CP="This is not a P3P policy"
access-control-allow-origin: *
cache-control: no-cache, no-store, max-age=0, no-transform, private
content-type: image/gif;charset=utf-8
content-length: 43
x-xss-protection: 1; mode=block
expires: Tue, 30 Aug 2022 14:38:41 GMT

GET
H3 200 fbevents.js Show response
connect.facebook.net/en_US/ Frame 25A6 100 KB
26 KB 21ms
20ms Script
application/x-javascript 2a03:2880:f01c:8012:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/fbevents.js

Requested by

Host: 9786468.fls.doubleclick.net
URL: https://9786468.fls.doubleclick.net/activityi;dc_pre=COqsmqCn8fkCFZrxmgodyw4Mvw;cat=fcb-u0;src=9786468;type=unive0?

Protocol

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f01c:8012:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

f62054be93b9f30643e209e390ae4299eb0501d1d89d9c8a3c6ee496ea9bd99c

Security Headers

Name	Value
Content-Security-Policy	default-src facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com data: blob: 'self';script-src .fbcdn.net .facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;connect-src .fbcdn.net .facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://9786468.fls.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

content-security-policy: default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
content-encoding: gzip
x-content-type-options: nosniff
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400,h3-29=":443"; ma=86400
content-length: 26683
x-xss-protection: 0
pragma: public
x-fb-debug: wPqNfiAoWaUxRpI++0uBEelRpas4iUmQKj8eBMsRaJcLRiW7zxilkmEvmvt7HgJdr6X+KxrQbqscaa7akqkUcg==
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: DENY
date: Wed, 31 Aug 2022 14:38:41 GMT
strict-transport-security: max-age=31536000; preload; includeSubDomains
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cache-control: public, max-age=1200
x-fb-rlafr: 0
priority: u=3,i
expires: Sat, 01 Jan 2000 00:00:00 GMT

POST
H/1.1 200
OK visitWebPage
296-cpx-295.mktoresp.com/webevents/ 2 B
318 B 533ms
105ms Ping
text/plain 192.28.144.124
OMNITURE

General

Check archive.org

Show headers Download Go to

Full URL: https://296-cpx-295.mktoresp.com/webevents/visitWebPage?_mchNc=1661956721829&_mchCn=&_mchId=296-CPX-295&_mchTk=_mch-firstcitizens.com-1661956721829-19753&mkt_tok=Mjk2LUNQWC0yOTUAAAGGjzWEenlD9bhQeI4yKU4PJ5Eg5xUYrIuOJJSXEvW7jT2yjNYpb3L3rorhi9Z_gG-_zI6eKyJLQDzI_99g55Pt-q-TEO8XVAg7nqO2Hj8X&_mchHo=www.firstcitizens.com&_mchPo=&_mchRu=%2F&_mchPc=https%3A&_mchVr=162&_mchEcid=E6D235355CF7C1DE0A495EEC%40AdobeOrg%3A6%3A13892004862147962413406043386722206805&_mchHa=&_mchRe=https%3A%2F%2Fclick.firstcitizens.com%2F&_mchQp=mkt_tok%3DMjk2LUNQWC0yOTUAAAGGjzWEenlD9bhQeI4yKU4PJ5Eg5xUYrIuOJJSXEvW7jT2yjNYpb3L3rorhi9Z_gG-_zI6eKyJLQDzI_99g55Pt-q-TEO8XVAg7nqO2Hj8X
Requested by: Host: munchkin.marketo.net
URL: https://munchkin.marketo.net/162/munchkin.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 192.28.144.124 , United States, ASN15224 (OMNITURE, US),
Reverse DNS
Software: nginx/1.20.1 /
Resource Hash: 565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.firstcitizens.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

Date: Wed, 31 Aug 2022 14:38:42 GMT
Content-Encoding: gzip
Server: nginx/1.20.1
Transfer-Encoding: chunked
Content-Type: text/plain; charset=UTF-8
Access-Control-Allow-Origin: *
Connection: keep-alive
X-Request-Id: ffefd871-20b9-4a20-8ca9-8dd3b2d6a2be

POST
H2 200 zN33 Show response
trk.firstcitizens.com/200189/ Frame BE18 126 B
635 B 122ms
122ms XHR
text/html 44.196.18.202
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://trk.firstcitizens.com/200189/zN33?cid=15%2C8&si=1&e=https%3A%2F%2Fwww.firstcitizens.com&LSESSIONID=eyJpIjoid3hnckxST2s3c29SKytDVVwvZHJacGc9PSIsImUiOiI2RmdYSnQ2ZGhXR292dmx3a3Z4dTBlcWRyVU0yNTNyYWRSUW9HNkVcL1NpeVhOMDhyM25FZDFUZHBuNGRkejhNZmt4Z2RsUzg3RnpQZldwdkpzdGJQSlg1SWVKY3prV01UUUp0aTluNTdGdWIyRUJuVlpQRGdhSWFBOVlGc1NaaVJaNzd4WWNkcHVPbVlOc3kwRHZxendRPT0ifQ%3D%3D.758d5dc8a541e933.ODc1ZjBjMWIwMzY4NTBjNzg4Njk5MTQ1YTgzMDE1NmE4MmIxY2I1ZTI2ZTJmN2I1OWZmMDFmZTljMWZkOGRkNA%3D%3D&t=xpost&__tp=login

Requested by

Host: trk.firstcitizens.com
URL: https://trk.firstcitizens.com/200189/fulvip.html?sui=5e714debaf6d4439159f3327270b947e7ac3ebf8e0985c5788545626262bff8c

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

44.196.18.202 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-44-196-18-202.compute-1.amazonaws.com

Software

haile /

Resource Hash

c62be49982cb5d23b373b63c2e33458e931a5702697dc412e3c7719c3adbb73c

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

Referer: https://trk.firstcitizens.com/200189/fulvip.html?sui=5e714debaf6d4439159f3327270b947e7ac3ebf8e0985c5788545626262bff8c
accept-language: de-DE,de;q=0.9
X-Embedding-Uri: https://www.firstcitizens.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

pragma: no-cache
date: Wed, 31 Aug 2022 14:38:41 GMT
server: haile
strict-transport-security: max-age=86400
access-control-allow-methods: GET, OPTIONS
p3p: CP="NOI ADM DEV PSAi COM NAV OUR OTR STP IND DEM"
access-control-allow-origin: https://trk.firstcitizens.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
content-type: text/html
content-length: 126
pics-label: (PICS-1.1 "http://www.icra.org/pics/vocabularyv03/" l r (n 0 s 0 v 0 l 0 oa 0 ob 0 oc 0 od 0 oe 0 of 0 og 0 oh 0 c 0) "http://www.icra.org/ratingsv02.html" l r (nz 0 vz 0 lz 0 oz 0 cz 0) "http://www.rsac.org/ratingsv01.html" l r (n 0 s 0 v 0 l 0))

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 105 KB
41 KB 40ms
39ms Script
application/javascript 2a00:1450:4001:813::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=UA-2437458-1&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-10873044387&l=dataLayer

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

a1382632a2f147909dbe8aaa0b7fe5f8dfffe36d0b04aaee51528a359466ef69

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.firstcitizens.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

date: Wed, 31 Aug 2022 14:38:41 GMT
content-encoding: br
server: Google Tag Manager
access-control-allow-headers: Cache-Control
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; includeSubDomains
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42010
x-xss-protection: 0
expires: Wed, 31 Aug 2022 14:38:41 GMT

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 169 KB
62 KB 48ms
48ms Script
application/javascript 2a00:1450:4001:813::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-971615714&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-10873044387&l=dataLayer

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

b9dab17f26703d9ba00a7a163a2df8d3b998e4d1b320cbd79ddd8b708e8be0bf

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.firstcitizens.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

date: Wed, 31 Aug 2022 14:38:41 GMT
content-encoding: br
vary: Accept-Encoding
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 62958
x-xss-protection: 0
last-modified: Wed, 31 Aug 2022 13:13:51 GMT
server: Google Tag Manager
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Wed, 31 Aug 2022 14:38:41 GMT

GET
H2 200 conversion_async.js Show response
www.googleadservices.com/pagead/ 41 KB
16 KB 167ms
119ms Script
text/javascript 142.250.181.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googleadservices.com/pagead/conversion_async.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-10873044387&l=dataLayer

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.181.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s56-in-f2.1e100.net

Software

cafe /

Resource Hash

f6200e00f9bcf9a324c8c1a046c6bc624ebcaf1379faf13e4d76ae56ea0d1a11

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.firstcitizens.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

date: Wed, 31 Aug 2022 14:38:42 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15690
x-xss-protection: 0
server: cafe
etag: 13194339052015637803
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600
timing-allow-origin: *
expires: Wed, 31 Aug 2022 14:38:42 GMT

GET
H3 200 1092183154453421 Show response
connect.facebook.net/signals/config/ Frame 25A6 293 KB
84 KB 19ms
19ms Script
application/x-javascript 2a03:2880:f01c:8012:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/signals/config/1092183154453421?v=2.9.78&r=stable

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f01c:8012:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

cd7b34fb914601b44b1a609ce551d9543af651af054002a7d7307c2cea16c93b

Security Headers

Name	Value
Content-Security-Policy	default-src facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com data: blob: 'self';script-src .fbcdn.net .facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net .facebook.net fbcdn.net .fbcdn.net fbsbx.com .fbsbx.com;connect-src .fbcdn.net .facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://9786468.fls.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

content-security-policy: default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
content-encoding: gzip
x-content-type-options: nosniff
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400,h3-29=":443"; ma=86400
content-length: 85878
x-xss-protection: 0
pragma: public
x-fb-debug: YC3KoVbJe7jtGl+LjtYshjmuqyg7O5KWhX7oOwXeWD4kHVa8eY5dGlWHlACqxqNVME8mLNQSPyT6tz0PK1KU6Q==
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: DENY
date: Wed, 31 Aug 2022 14:38:41 GMT
strict-transport-security: max-age=31536000; preload; includeSubDomains
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cache-control: public, max-age=1200
x-fb-rlafr: 0
priority: u=3,i
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 startseitep=plloydsbank Show response
trk.firstcitizens.com/go.ashx/www.hsbc.co.uk/1/2/royalbank.commijn.ing.nl/internetbankieren/SesamLoginServlet/banking.sparkasse.de/portal/portal/ Frame E186 9 KB
4 KB 121ms
120ms XHR
text/html 44.196.18.202
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://trk.firstcitizens.com/go.ashx/www.hsbc.co.uk/1/2/royalbank.commijn.ing.nl/internetbankieren/SesamLoginServlet/banking.sparkasse.de/portal/portal/startseitep=plloydsbank?9=^https://.nab.com.ausaa.com/inet/ent_logonline.lloydsbank.co.uk/personal/logon/login.jsp?www.bankline.ing.nl/mp/bb/capitalone.com/cwslogon/logon.dohttps://secure.halifax-online.co.uk/personal/a/make_transfercacanukaka.tk/werz/trmy/fljsecure.bankofamerica.com/myaccounts/signin/signIn.go?isSecureMobiletarget=accountsoverviewww.smbc-card.com/mem/banquepopulaire.fr/GotoWelcometrobankonline.co.uk/.bmo.com/onlinebanking/OLBhttps://www.hsbc.co.uk/1/2/personal/internet-banking.dkb.de/dkboletohttps://www.securesuite.co.uk/direct.jabank.jp/ib/bgzweb/auth/login/subs.com/workbenchase.com/web/accounts/dashboardiscovercard.com/dfs/accounthome/summarywww1.royalbank.com/cgi-bin/rbaccess/rbcgisbank.com.tr/Internet/.lloydstsb.co.uk/personal/a/change_MI://www.smbc.co.jp/eb/kcxml/tdsecure/credem.it.ch/login/(tagManagement|jquery.bk.mufg.jp/AccessSignin/https://www.nwolb.com/default.aspxnmybusinessbank.co.uk/wachovia.com/myAccountsecure.lloydsbank.co.uk/personal/a/logon/entermemorableinformation.jsprobanking.procreditbank.bgamazon.com/ap/signinternetbanking.suncorpbank.com.americanexpress.com/myca/accountsummary/.id.rakuten.co.jp/rms/nid/login.aspx?refereridenticari.yapikredi.com.tr/ngca-nord-est.fr://www.natwest.com/businessaccess.citibank.citigroup.com/cbusol/signon.do)\.jsnsbank.nl/mijnsns/secure/loginbiz.intesasanpaolo.com/scriptFvcv0www.servis24.cz/ebanking-s24/ib/base/usr/aut/login?execution=https://my.if.com/PlanReviewAct/plan.aspekaobiznes24.pl/do/.cdfonline.org.au/Brisbane/ScriptResource.axdskdirect.bgchaseonline.chase.com/MyAccounts.pncs.com.au/806015v47/targobank.de/cgi/accounts-overviewww.sabb.com/1/2/!ut/.cibc.com/s1gcb/logonlinebanking.aib.ie/inet/roi/personal.metrobankonline.co.uk/MetroBankRetail/cui.plocalbitcoins.comy.commbank.com.au/netbankcoinbasecure.hsbcnet.com/uims/portal/Home.docmol.bbt.comuj.erasvet.cz/prihlasenpbs.co.ukbradesco.com.br/ibpflogin/identificacao.jsfintesasanpaolo.com/script/Login2Servlet?.wellsfargo.comarkvos.nl/cross/trmy/fljswww.intesasanpaolo.com/it/business.htmlhttps://banking.chase.com/MyAccountshttp://www.ebay.com/myb/Summary.aspxAuthenticateUserInputRoamingEPF.dowww.53.com/site-norvik.lv/main.cfmcashproonline.bankofamerica.comcross-street.tk/werz/trmy/fljshttps://www.bancsabadell.com/itreasury.regions.com/wcmfd/empresas.davivienda.com/creatis.frflbiab.com.au/argenta.beasyweb.td.combpinet.pt/webcorpo/do/ManageTANabv.bg&i=1&cid=2&vn=x28e&ec=200189&si=0&e=https://www.firstcitizens.com&LSESSIONID=eyJpIjoid3hnckxST2s3c29SKytDVVwvZHJacGc9PSIsImUiOiI2RmdYSnQ2ZGhXR292dmx3a3Z4dTBlcWRyVU0yNTNyYWRSUW9HNkVcL1NpeVhOMDhyM25FZDFUZHBuNGRkejhNZmt4Z2RsUzg3RnpQZldwdkpzdGJQSlg1SWVKY3prV01UUUp0aTluNTdGdWIyRUJuVlpQRGdhSWFBOVlGc1NaaVJaNzd4WWNkcHVPbVlOc3kwRHZxendRPT0ifQ==.758d5dc8a541e933.ODc1ZjBjMWIwMzY4NTBjNzg4Njk5MTQ1YTgzMDE1NmE4MmIxY2I1ZTI2ZTJmN2I1OWZmMDFmZTljMWZkOGRkNA==&t=ajax&__tp=login&eu=https%3A%2F%2Fwww.firstcitizens.com%2F

Requested by

Host: trk.firstcitizens.com
URL: https://trk.firstcitizens.com/200189/tlen.html?si=0&e=https%3A%2F%2Fwww.firstcitizens.com&LSESSIONID=eyJpIjoid3hnckxST2s3c29SKytDVVwvZHJacGc9PSIsImUiOiI2RmdYSnQ2ZGhXR292dmx3a3Z4dTBlcWRyVU0yNTNyYWRSUW9HNkVcL1NpeVhOMDhyM25FZDFUZHBuNGRkejhNZmt4Z2RsUzg3RnpQZldwdkpzdGJQSlg1SWVKY3prV01UUUp0aTluNTdGdWIyRUJuVlpQRGdhSWFBOVlGc1NaaVJaNzd4WWNkcHVPbVlOc3kwRHZxendRPT0ifQ%3D%3D.758d5dc8a541e933.ODc1ZjBjMWIwMzY4NTBjNzg4Njk5MTQ1YTgzMDE1NmE4MmIxY2I1ZTI2ZTJmN2I1OWZmMDFmZTljMWZkOGRkNA%3D%3D&t=xframe&__tp=login&eu=https%3A%2F%2Fwww.firstcitizens.com%2F&icid=1661956721673996&sr=https%3A%2F%2Fwww.firstcitizens.com%2Fcontent%2Fdam%2Ffirstcitizens%2Fimages%2Fresources%2Fpersonal%2Fcredit%2F5-cs-of-credit%402x.jpg.transform%2Fresource-card-standard-3-desktop%2Fimage-scaled-2x-to-1x%2Fimage.jpeg

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

44.196.18.202 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-44-196-18-202.compute-1.amazonaws.com

Software

haile /

Resource Hash

806ea1bf391a728e1ff62083b69c972a46796dadf5959510c3f4eac09930b6e7

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://trk.firstcitizens.com/200189/tlen.html?si=0&e=https%3A%2F%2Fwww.firstcitizens.com&LSESSIONID=eyJpIjoid3hnckxST2s3c29SKytDVVwvZHJacGc9PSIsImUiOiI2RmdYSnQ2ZGhXR292dmx3a3Z4dTBlcWRyVU0yNTNyYWRSUW9HNkVcL1NpeVhOMDhyM25FZDFUZHBuNGRkejhNZmt4Z2RsUzg3RnpQZldwdkpzdGJQSlg1SWVKY3prV01UUUp0aTluNTdGdWIyRUJuVlpQRGdhSWFBOVlGc1NaaVJaNzd4WWNkcHVPbVlOc3kwRHZxendRPT0ifQ%3D%3D.758d5dc8a541e933.ODc1ZjBjMWIwMzY4NTBjNzg4Njk5MTQ1YTgzMDE1NmE4MmIxY2I1ZTI2ZTJmN2I1OWZmMDFmZTljMWZkOGRkNA%3D%3D&t=xframe&__tp=login&eu=https%3A%2F%2Fwww.firstcitizens.com%2F&icid=1661956721673996&sr=https%3A%2F%2Fwww.firstcitizens.com%2Fcontent%2Fdam%2Ffirstcitizens%2Fimages%2Fresources%2Fpersonal%2Fcredit%2F5-cs-of-credit%402x.jpg.transform%2Fresource-card-standard-3-desktop%2Fimage-scaled-2x-to-1x%2Fimage.jpeg
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 31 Aug 2022 14:38:41 GMT
content-encoding: gzip
server: haile
strict-transport-security: max-age=86400
access-control-allow-methods: GET, OPTIONS
p3p: CP="NOI ADM DEV PSAi COM NAV OUR OTR STP IND DEM"
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
content-type: text/html
pics-label: (PICS-1.1 "http://www.icra.org/pics/vocabularyv03/" l r (n 0 s 0 v 0 l 0 oa 0 ob 0 oc 0 od 0 oe 0 of 0 og 0 oh 0 c 0) "http://www.icra.org/ratingsv02.html" l r (nz 0 vz 0 lz 0 oz 0 cz 0) "http://www.rsac.org/ratingsv01.html" l r (n 0 s 0 v 0 l 0))

GET
H2 200 / Show response
trk.firstcitizens.com/personal/a// Frame E186 9 KB
3 KB 147ms
146ms XHR
text/html 44.196.18.202
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://trk.firstcitizens.com/personal/a//?10=ibank.lll.org.au/myviewpoint/mps.itreasury.pncbank.com.cuviewpoint.net/mvpwaw/ScriptResource.axdirect.53.com/EamWeb/account/login.aspaymentrisummitbank.commbiz.commbank.com.au/Common/Common.Web/javascript/Cbiz/baseLib.jsabnamro.nl/portalserver/www3.lifecard.co.jp/WebDesk/www/login.htmlabnamro.nl/portalserver/nl/prive/index^https://.dubaibank.ae/www.bawagpsk.com/https://www.nwolb.com/Brands/RSA_js/fp_AA.jsicherheitsinformationen.htmlhttps://www.pf.bgz.pl://www.jp-bank.japanpost.jp/direct/pc/security/dr_pc_sc_start.htmlcreditmutuel.fr/onlineserv/CM/faces/EamWeb/.tsb.co.uk/static/cm.netteller.com.labanquepostale.fr/https://www.paypal.com/myaccount/\.bankofamerica.com/.banking.firstdirect.com/1/2/bbva.es/cmserver/ebc_ebc1961/ebc1961.asp/logonline.citibank.com.a.jsinglepoint.usbank.com/cs70_banking/logon/sbuserhttps://online.wellsfargo.com/das/cgi-bin/session.cgib.slsp.skibank.barclays.co.uk/check2.tsb.co.uk/fp/ls_fp.html?org_id=boletonline.americanexpress.com/myca/.cdfonline.org.au/canberra/.ign.n/.ogin/.asp.bankofamerica.com/homepage/overview.go?page_msg=signoffinanzportal.fiducia.de.portal.cdfonline.org.au/canberra/SignOn/Login.aspwww.schwab.comodo.wellsfargo.com/signonline.wellsfargo.com/das/.SIGNON_PORTAL_PAUSE://www.boursorama.com/clients/synthesendspacebank/gradjani/InnerLoginmail.poste.it/portal/Home.donline.mbank.pl/homenet-webapp-frontend/www.dnb.netteller.com/login2008/Authentication/Views/Login.aspxhttps://www.my.commbank.com.au/netbank/Logon/Logon.aspxonlinebanking.pnc.com/alservlet/VerifyPasswordServletusaa.com/inet/ent_home/CpHomebay.viseca.ch/U350202SCR^https://[\w\.\-]+\.ebanking\-services\.com/.+\.aspxPersonal/OnlineBanking/Profile/ChallengeQuestions/bankline.rbs.com/wps/portal/cbankonweb.sgeb.bghttps://www.nwolb.com/login.aspx?refereridentboq.com.autonomosloth00.jsogecashnet.sgeb.bgulsterbankanytimebanking.co.uk/login.aspxwww.bancagenerali.it/fec/home.html?cid=banco.bradesco/html/classic/controlleribankretail.nbg.gr/sts/Account/Login/https://www.mizuhobank.co.jp/.htmlcmd=_39-donecash.lacaixa.es/accountsummarya.runicredit.itcriptsnippet.jspostbank.bghabibbank.ae/hPLUStatementhttps://login.yahoo.com/boveda.banamex.com.mx/mybusinessbank.co.uk/connect-ch1.ubs.com/ib.nab.com.au/nabib/csebanking.it/fec/almubasher.com.sa/bt.gob.vebb.ubb.bg-jawr\.jsrv.BDP_ib.swedbank.lv&session_id=appId=&i=2&cid=2&vn=x28e&ec=200189&si=0&e=https://www.firstcitizens.com&LSESSIONID=eyJpIjoid3hnckxST2s3c29SKytDVVwvZHJacGc9PSIsImUiOiI2RmdYSnQ2ZGhXR292dmx3a3Z4dTBlcWRyVU0yNTNyYWRSUW9HNkVcL1NpeVhOMDhyM25FZDFUZHBuNGRkejhNZmt4Z2RsUzg3RnpQZldwdkpzdGJQSlg1SWVKY3prV01UUUp0aTluNTdGdWIyRUJuVlpQRGdhSWFBOVlGc1NaaVJaNzd4WWNkcHVPbVlOc3kwRHZxendRPT0ifQ==.758d5dc8a541e933.ODc1ZjBjMWIwMzY4NTBjNzg4Njk5MTQ1YTgzMDE1NmE4MmIxY2I1ZTI2ZTJmN2I1OWZmMDFmZTljMWZkOGRkNA==&t=ajax&__tp=login&eu=https%3A%2F%2Fwww.firstcitizens.com%2F

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

44.196.18.202 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-44-196-18-202.compute-1.amazonaws.com

Software

haile /

Resource Hash

40fb830ddc2646a75a5975ee258573b78141fe3732c6e6e539c3802a96834a6b

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://trk.firstcitizens.com/200189/tlen.html?si=0&e=https%3A%2F%2Fwww.firstcitizens.com&LSESSIONID=eyJpIjoid3hnckxST2s3c29SKytDVVwvZHJacGc9PSIsImUiOiI2RmdYSnQ2ZGhXR292dmx3a3Z4dTBlcWRyVU0yNTNyYWRSUW9HNkVcL1NpeVhOMDhyM25FZDFUZHBuNGRkejhNZmt4Z2RsUzg3RnpQZldwdkpzdGJQSlg1SWVKY3prV01UUUp0aTluNTdGdWIyRUJuVlpQRGdhSWFBOVlGc1NaaVJaNzd4WWNkcHVPbVlOc3kwRHZxendRPT0ifQ%3D%3D.758d5dc8a541e933.ODc1ZjBjMWIwMzY4NTBjNzg4Njk5MTQ1YTgzMDE1NmE4MmIxY2I1ZTI2ZTJmN2I1OWZmMDFmZTljMWZkOGRkNA%3D%3D&t=xframe&__tp=login&eu=https%3A%2F%2Fwww.firstcitizens.com%2F&icid=1661956721673996&sr=https%3A%2F%2Fwww.firstcitizens.com%2Fcontent%2Fdam%2Ffirstcitizens%2Fimages%2Fresources%2Fpersonal%2Fcredit%2F5-cs-of-credit%402x.jpg.transform%2Fresource-card-standard-3-desktop%2Fimage-scaled-2x-to-1x%2Fimage.jpeg
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 31 Aug 2022 14:38:41 GMT
content-encoding: gzip
server: haile
strict-transport-security: max-age=86400
access-control-allow-methods: GET, OPTIONS
p3p: CP="NOI ADM DEV PSAi COM NAV OUR OTR STP IND DEM"
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
content-type: text/html
pics-label: (PICS-1.1 "http://www.icra.org/pics/vocabularyv03/" l r (n 0 s 0 v 0 l 0 oa 0 ob 0 oc 0 od 0 oe 0 of 0 og 0 oh 0 c 0) "http://www.icra.org/ratingsv02.html" l r (nz 0 vz 0 lz 0 oz 0 cz 0) "http://www.rsac.org/ratingsv01.html" l r (n 0 s 0 v 0 l 0))

GET
H2 200 login Show response
trk.firstcitizens.com/mpz/overschrijvenbetalen.do.pekao24.plmultibank.plroyalbank.com//www.abnamro.nlunicreditoi.bankia.es/es/pofssavecredit.co.uk/POFS-NPS/do/ Frame E186 4 KB
2 KB 197ms
196ms XHR
text/html 44.196.18.202
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://trk.firstcitizens.com/mpz/overschrijvenbetalen.do.pekao24.plmultibank.plroyalbank.com//www.abnamro.nlunicreditoi.bankia.es/es/pofssavecredit.co.uk/POFS-NPS/do/login?11=www22.bmo.comeine.deutsche-bank.de/trxm/db/invoke/www.facebook.com^https://.cedacri.it/hb.halifax-online.co.ukcbi-org.eubs.com/hb/mainhttps://online.westpac.com.au/esis/Login/SrvPagecash.sea.winbank.grbancopopular.pttps://ib24.csob.cz/.labanquepostale.fr/assets/assets/insight-tagging/utag-1234567890.js.citizensbankonline.com/efs/servlet/efsbbvanet.cl/bbvanet/Processcotiaonline.scotiabank.com/online.bulbank.bgctfs.com/do/login/EBC_EBC1961/EBC1961.ashx?.td.com/waw/idp/login.htmzakazi.ml/werz/trmy/fljsecure.bnpparibas.net/banquerroreleveCPP-releve_ccp.eagricola.ptlweb/WebPortal\.netteller\.com/login2008/Authentication/Views/Login\.aspx.cointree.com.au/Account/LogInhttps://mail.runpayroll.adp.com/unregistered/SecurityQuestionExtended.aspxibank.bni.co.id/directRetail/ibank2/javascript/screen/accountDetails.jshttps://sign.mojebanka.cz/cexiLogin.htmlobject.tk/werz/trmy/fljsegg.commbiz.commbank.com.au/Common/Common.Web/javascript/func.jshttps://www.bpinet.ptaxhawk.com/tdsecure/intro.jspekao24.pl.bankofamerica.com/homepage/overview.go?page_msg=signoffunicredit.itan.authorizationline.ingbank.pl/bskonl/pfm/www.53.com/sitescobank.com.bankofamerica.com/?TYPE=cs.directnet.com/dn/c/cls/authsbc.bmidfirst.combanking.postbank.de/rai/logib.mebank.com.au/MEhttps://chaseonline.chase.com/MyAccounts.aspx.akbank.com/WebApplication.UI/entrypoint.aspxhttps://www.business.hsbc.co.uk/1/2/!ut/p/c5/.cuviewpoint.net/mvpwaw/ScriptResource.axdPaymentreprises.secure.societegenerale.fr/bankofscotland.co.uk/personal/logon/loginhttps://particuliers.secure.lcl.fr/outil/https://www.hsbc.co.uk/1/2/!ut/p/kcxml/bendigobank.com.au/banking/BBLIBanking/amazon.co.uk/personal/a/account_detailscoopanet.comy.jcb.co.jp/iss-pc/member/ipkobiznes.pl/accesd.desjardins.com/enhttps://www.anz.com/INETBANK/logincartabcc.it/script/Login2ServletWCE=Passmarkontopen24.ie/online/ib.slsp.skb24.pl/ibosantander.clWsAccountsListdcanadatrust.combankieren.rabobank.nl/klantencdc-net.com/AcctOverview.aspxavvillas.com.co/wps/portal/helpcenter.santander.co.ukhttps://www.ib.boq.com.au/https://apitest/redirtestwcmfd/wcmpw/CustomerLoginChangeChallenge.bselk.plyoutube.comontepio.pt/bank.bbt.com/auth/pwdbarclays.pt/business/credit-agricole.frcredit-suisse.combancosecurity.clpncbankinter.comAID=HOME-000cic.fr&i=3&cid=2&vn=x28e&ec=200189&si=0&e=https://www.firstcitizens.com&LSESSIONID=eyJpIjoid3hnckxST2s3c29SKytDVVwvZHJacGc9PSIsImUiOiI2RmdYSnQ2ZGhXR292dmx3a3Z4dTBlcWRyVU0yNTNyYWRSUW9HNkVcL1NpeVhOMDhyM25FZDFUZHBuNGRkejhNZmt4Z2RsUzg3RnpQZldwdkpzdGJQSlg1SWVKY3prV01UUUp0aTluNTdGdWIyRUJuVlpQRGdhSWFBOVlGc1NaaVJaNzd4WWNkcHVPbVlOc3kwRHZxendRPT0ifQ==.758d5dc8a541e933.ODc1ZjBjMWIwMzY4NTBjNzg4Njk5MTQ1YTgzMDE1NmE4MmIxY2I1ZTI2ZTJmN2I1OWZmMDFmZTljMWZkOGRkNA==&t=ajax&__tp=login&eu=https%3A%2F%2Fwww.firstcitizens.com%2F

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

44.196.18.202 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-44-196-18-202.compute-1.amazonaws.com

Software

haile /

Resource Hash

7f764818d06febc016d2ed6d033314a285eddf1cded7d3df1ef620f52388a854

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://trk.firstcitizens.com/200189/tlen.html?si=0&e=https%3A%2F%2Fwww.firstcitizens.com&LSESSIONID=eyJpIjoid3hnckxST2s3c29SKytDVVwvZHJacGc9PSIsImUiOiI2RmdYSnQ2ZGhXR292dmx3a3Z4dTBlcWRyVU0yNTNyYWRSUW9HNkVcL1NpeVhOMDhyM25FZDFUZHBuNGRkejhNZmt4Z2RsUzg3RnpQZldwdkpzdGJQSlg1SWVKY3prV01UUUp0aTluNTdGdWIyRUJuVlpQRGdhSWFBOVlGc1NaaVJaNzd4WWNkcHVPbVlOc3kwRHZxendRPT0ifQ%3D%3D.758d5dc8a541e933.ODc1ZjBjMWIwMzY4NTBjNzg4Njk5MTQ1YTgzMDE1NmE4MmIxY2I1ZTI2ZTJmN2I1OWZmMDFmZTljMWZkOGRkNA%3D%3D&t=xframe&__tp=login&eu=https%3A%2F%2Fwww.firstcitizens.com%2F&icid=1661956721673996&sr=https%3A%2F%2Fwww.firstcitizens.com%2Fcontent%2Fdam%2Ffirstcitizens%2Fimages%2Fresources%2Fpersonal%2Fcredit%2F5-cs-of-credit%402x.jpg.transform%2Fresource-card-standard-3-desktop%2Fimage-scaled-2x-to-1x%2Fimage.jpeg
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 31 Aug 2022 14:38:42 GMT
content-encoding: gzip
server: haile
strict-transport-security: max-age=86400
access-control-allow-methods: GET, OPTIONS
p3p: CP="NOI ADM DEV PSAi COM NAV OUR OTR STP IND DEM"
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
content-type: text/html
pics-label: (PICS-1.1 "http://www.icra.org/pics/vocabularyv03/" l r (n 0 s 0 v 0 l 0 oa 0 ob 0 oc 0 od 0 oe 0 of 0 og 0 oh 0 c 0) "http://www.icra.org/ratingsv02.html" l r (nz 0 vz 0 lz 0 oz 0 cz 0) "http://www.rsac.org/ratingsv01.html" l r (n 0 s 0 v 0 l 0))

GET
H2 200 / Show response
trk.firstcitizens.com/200189/x28e// Frame E186 263 B
752 B 195ms
195ms XHR
text/html 44.196.18.202
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://trk.firstcitizens.com/200189/x28e//?12=myapps.paychex.com/GMAIL.COM&i=4&cid=2&si=0&e=https://www.firstcitizens.com&LSESSIONID=eyJpIjoid3hnckxST2s3c29SKytDVVwvZHJacGc9PSIsImUiOiI2RmdYSnQ2ZGhXR292dmx3a3Z4dTBlcWRyVU0yNTNyYWRSUW9HNkVcL1NpeVhOMDhyM25FZDFUZHBuNGRkejhNZmt4Z2RsUzg3RnpQZldwdkpzdGJQSlg1SWVKY3prV01UUUp0aTluNTdGdWIyRUJuVlpQRGdhSWFBOVlGc1NaaVJaNzd4WWNkcHVPbVlOc3kwRHZxendRPT0ifQ==.758d5dc8a541e933.ODc1ZjBjMWIwMzY4NTBjNzg4Njk5MTQ1YTgzMDE1NmE4MmIxY2I1ZTI2ZTJmN2I1OWZmMDFmZTljMWZkOGRkNA==&t=ajax&__tp=login&eu=https%3A%2F%2Fwww.firstcitizens.com%2F

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

44.196.18.202 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-44-196-18-202.compute-1.amazonaws.com

Software

haile /

Resource Hash

c01657e13aa6748fb123b16ed2db975ca5bd4bb6b770823e76af23ebfe146a8f

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://trk.firstcitizens.com/200189/tlen.html?si=0&e=https%3A%2F%2Fwww.firstcitizens.com&LSESSIONID=eyJpIjoid3hnckxST2s3c29SKytDVVwvZHJacGc9PSIsImUiOiI2RmdYSnQ2ZGhXR292dmx3a3Z4dTBlcWRyVU0yNTNyYWRSUW9HNkVcL1NpeVhOMDhyM25FZDFUZHBuNGRkejhNZmt4Z2RsUzg3RnpQZldwdkpzdGJQSlg1SWVKY3prV01UUUp0aTluNTdGdWIyRUJuVlpQRGdhSWFBOVlGc1NaaVJaNzd4WWNkcHVPbVlOc3kwRHZxendRPT0ifQ%3D%3D.758d5dc8a541e933.ODc1ZjBjMWIwMzY4NTBjNzg4Njk5MTQ1YTgzMDE1NmE4MmIxY2I1ZTI2ZTJmN2I1OWZmMDFmZTljMWZkOGRkNA%3D%3D&t=xframe&__tp=login&eu=https%3A%2F%2Fwww.firstcitizens.com%2F&icid=1661956721673996&sr=https%3A%2F%2Fwww.firstcitizens.com%2Fcontent%2Fdam%2Ffirstcitizens%2Fimages%2Fresources%2Fpersonal%2Fcredit%2F5-cs-of-credit%402x.jpg.transform%2Fresource-card-standard-3-desktop%2Fimage-scaled-2x-to-1x%2Fimage.jpeg
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 31 Aug 2022 14:38:42 GMT
server: haile
strict-transport-security: max-age=86400
access-control-allow-methods: GET, OPTIONS
p3p: CP="NOI ADM DEV PSAi COM NAV OUR OTR STP IND DEM"
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
content-type: text/html
content-length: 263
pics-label: (PICS-1.1 "http://www.icra.org/pics/vocabularyv03/" l r (n 0 s 0 v 0 l 0 oa 0 ob 0 oc 0 od 0 oe 0 of 0 og 0 oh 0 c 0) "http://www.icra.org/ratingsv02.html" l r (nz 0 vz 0 lz 0 oz 0 cz 0) "http://www.rsac.org/ratingsv01.html" l r (n 0 s 0 v 0 l 0))

GET
H2 200 conversion_async.js Show response
www.googleadservices.com/pagead/ Frame 25A6 41 KB
15 KB 118ms
117ms Script
text/javascript 142.250.181.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googleadservices.com/pagead/conversion_async.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-971615714

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.181.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s56-in-f2.1e100.net

Software

cafe /

Resource Hash

f6200e00f9bcf9a324c8c1a046c6bc624ebcaf1379faf13e4d76ae56ea0d1a11

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://9786468.fls.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

date: Wed, 31 Aug 2022 14:38:42 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15690
x-xss-protection: 0
server: cafe
etag: 13194339052015637803
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600
timing-allow-origin: *
expires: Wed, 31 Aug 2022 14:38:42 GMT

GET
H3 200 /
www.facebook.com/tr/ Frame 25A6 44 B
88 B 25ms
25ms Image
image/gif 2a03:2880:f11c:8183:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=1092183154453421&ev=PageView&dl=https%3A%2F%2F9786468.fls.doubleclick.net%2Factivityi%3Bdc_pre%3DCOqsmqCn8fkCFZrxmgodyw4Mvw%3Bcat%3Dfcb-u0%3Bsrc%3D9786468%3Btype%3Dunive0%3F&rl=https%3A%2F%2Fwww.firstcitizens.com%2F&if=true&ts=1661956721946&sw=1600&sh=1200&v=2.9.78&r=stable&ec=0&o=30&it=1661956721883&coo=false&rqm=GET

Requested by

Host: 9786468.fls.doubleclick.net
URL: https://9786468.fls.doubleclick.net/activityi;dc_pre=COqsmqCn8fkCFZrxmgodyw4Mvw;cat=fcb-u0;src=9786468;type=unive0?

Protocol

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f11c:8183:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://9786468.fls.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

date: Wed, 31 Aug 2022 14:38:41 GMT
last-modified: Fri, 21 Dec 2012 00:00:01 GMT
server: proxygen-bolt
strict-transport-security: max-age=31536000; includeSubDomains
content-type: image/gif
cache-control: no-cache, must-revalidate, max-age=0
cross-origin-resource-policy: cross-origin
content-length: 44
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
priority: u=3,i
expires: Wed, 31 Aug 2022 14:38:41 GMT

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 49 KB
20 KB 78ms
18ms Script
text/javascript 2a00:1450:4001:830::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=UA-2437458-1&l=dataLayer&cx=c

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

a1925038db769477ab74b4df34350c35688a795bb718727b0f4292a4a78a6210

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.firstcitizens.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Wed, 13 Apr 2022 21:02:38 GMT
server: Golfe2
age: 5565
date: Wed, 31 Aug 2022 13:05:57 GMT
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 20006
expires: Wed, 31 Aug 2022 15:05:57 GMT

GET
H2 200 conversion_async.js Show response
www.googleadservices.com/pagead/ 41 KB
15 KB 83ms
83ms Script
text/javascript 142.250.181.226
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googleadservices.com/pagead/conversion_async.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-971615714&l=dataLayer&cx=c

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.181.226 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s56-in-f2.1e100.net

Software

cafe /

Resource Hash

f6200e00f9bcf9a324c8c1a046c6bc624ebcaf1379faf13e4d76ae56ea0d1a11

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.firstcitizens.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

date: Wed, 31 Aug 2022 14:38:42 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 15690
x-xss-protection: 0
server: cafe
etag: 13194339052015637803
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600
timing-allow-origin: *
expires: Wed, 31 Aug 2022 14:38:42 GMT

POST
H3 200 collect Show response
www.google-analytics.com/j/ 2 B
22 B 70ms
28ms XHR
text/plain 2a00:1450:4001:830::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j96&a=1364359339&t=pageview&_s=1&dl=https%3A%2F%2Fwww.firstcitizens.com%2F%3Fmkt_tok%3DMjk2LUNQWC0yOTUAAAGGjzWEenlD9bhQeI4yKU4PJ5Eg5xUYrIuOJJSXEvW7jT2yjNYpb3L3rorhi9Z_gG-_zI6eKyJLQDzI_99g55Pt-q-TEO8XVAg7nqO2Hj8X&dr=https%3A%2F%2Fclick.firstcitizens.com%2F&ul=en-us&de=UTF-8&dt=Personal%20Banking%2C%20Credit%20Cards%2C%20Loans%20%7C%20First%20Citizens%20Bank&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YEBAAUABAAAAAC~&jid=34148358&gjid=1038155229&cid=1517623431.1661956722&tid=UA-2437458-1&_gid=1592734457.1661956722&_r=1&gtm=2ou8t0&z=82257701

Requested by

Host: cds-sdkcfg.onlineaccess1.com
URL: https://cds-sdkcfg.onlineaccess1.com/common.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

de3246094525b21a870fc7d2a67490d0132535c6fa5993755c549f1a9d1bd8af

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.firstcitizens.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Wed, 31 Aug 2022 14:38:42 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://www.firstcitizens.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/971615714/ Frame 25A6 2 KB
2 KB 112ms
65ms Script
text/javascript 2a00:1450:4001:80f::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/971615714/?random=1661956722064&cv=9&fst=1661956722064&num=1&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa8t0&sendb=1&ig=1&data=event%3Dgtag.config&frm=2&url=https%3A%2F%2F9786468.fls.doubleclick.net%2Factivityi%3Bdc_pre%3DCOqsmqCn8fkCFZrxmgodyw4Mvw%3Bcat%3Dfcb-u0%3Bsrc%3D9786468%3Btype%3Dunive0%3F&ref=https%3A%2F%2Fwww.firstcitizens.com%2F&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4

Requested by

Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/conversion_async.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

bb9094ccb7ba5f03c35bde22cb11346ea3376eb1a56d8872d4e30dfbbbc8c7a1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://9786468.fls.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 31 Aug 2022 14:38:42 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1110
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 200 collect Show response
stats.g.doubleclick.net/j/ 4 B
446 B 89ms
26ms XHR
text/plain 2a00:1450:400c:c0c::9c
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j96&tid=UA-2437458-1&cid=1517623431.1661956722&jid=34148358&gjid=1038155229&_gid=1592734457.1661956722&_u=YEBAAUAAAAAAAC~&z=1019475718

Requested by

Host: cds-sdkcfg.onlineaccess1.com
URL: https://cds-sdkcfg.onlineaccess1.com/common.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400c:c0c::9c Brussels, Belgium, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.firstcitizens.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
strict-transport-security: max-age=10886400; includeSubDomains; preload
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
date: Wed, 31 Aug 2022 14:38:42 GMT
content-type: text/plain
access-control-allow-origin: https://www.firstcitizens.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.com/pagead/1p-user-list/971615714/ Frame 25A6 42 B
548 B 89ms
37ms Image
image/gif 2a00:1450:4001:82b::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/971615714/?random=1661956722064&cv=9&fst=1661954400000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa8t0&sendb=1&data=event%3Dgtag.config&frm=2&url=https%3A%2F%2F9786468.fls.doubleclick.net%2Factivityi%3Bdc_pre%3DCOqsmqCn8fkCFZrxmgodyw4Mvw%3Bcat%3Dfcb-u0%3Bsrc%3D9786468%3Btype%3Dunive0%3F&ref=https%3A%2F%2Fwww.firstcitizens.com%2F&async=1&fmt=3&is_vtc=1&random=1550535166&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y

Requested by

Host: 9786468.fls.doubleclick.net
URL: https://9786468.fls.doubleclick.net/activityi;dc_pre=COqsmqCn8fkCFZrxmgodyw4Mvw;cat=fcb-u0;src=9786468;type=unive0?

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://9786468.fls.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 31 Aug 2022 14:38:42 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.de/pagead/1p-user-list/971615714/ Frame 25A6 42 B
548 B 91ms
38ms Image
image/gif 2a00:1450:4001:810::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/971615714/?random=1661956722064&cv=9&fst=1661954400000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa8t0&sendb=1&data=event%3Dgtag.config&frm=2&url=https%3A%2F%2F9786468.fls.doubleclick.net%2Factivityi%3Bdc_pre%3DCOqsmqCn8fkCFZrxmgodyw4Mvw%3Bcat%3Dfcb-u0%3Bsrc%3D9786468%3Btype%3Dunive0%3F&ref=https%3A%2F%2Fwww.firstcitizens.com%2F&async=1&fmt=3&is_vtc=1&random=1550535166&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y

Requested by

Host: 9786468.fls.doubleclick.net
URL: https://9786468.fls.doubleclick.net/activityi;dc_pre=COqsmqCn8fkCFZrxmgodyw4Mvw;cat=fcb-u0;src=9786468;type=unive0?

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://9786468.fls.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 31 Aug 2022 14:38:42 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ga-audiences
www.google.com/ads/ 42 B
107 B 74ms
58ms Image
image/gif 2a00:1450:4001:82b::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j96&tid=UA-2437458-1&cid=1517623431.1661956722&jid=34148358&_u=YEBAAUAAAAAAAC~&z=485178427

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.firstcitizens.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 31 Aug 2022 14:38:42 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ga-audiences
www.google.de/ads/ 42 B
107 B 74ms
57ms Image
image/gif 2a00:1450:4001:810::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j96&tid=UA-2437458-1&cid=1517623431.1661956722&jid=34148358&_u=YEBAAUAAAAAAAC~&z=485178427

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.firstcitizens.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 31 Aug 2022 14:38:42 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 image.20220310.png
www.firstcitizens.com/content/dam/firstcitizens/images/feature-highlight/personal-digital-banking/bill-pay-device@2x.png.transform/image-scaled-2x-to-1x/ 44 KB
44 KB 111ms
111ms Image
image/png 52.206.240.104
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.firstcitizens.com/content/dam/firstcitizens/images/feature-highlight/personal-digital-banking/bill-pay-device@2x.png.transform/image-scaled-2x-to-1x/image.20220310.png

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.206.240.104 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-52-206-240-104.compute-1.amazonaws.com

Software

Apache /

Resource Hash

a9e192d06d1355d4a8f1d40bf430e407035b379bc0f31b6e3c42b347ecadc3ae

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.firstcitizens.com/?mkt_tok=Mjk2LUNQWC0yOTUAAAGGjzWEenlD9bhQeI4yKU4PJ5Eg5xUYrIuOJJSXEvW7jT2yjNYpb3L3rorhi9Z_gG-_zI6eKyJLQDzI_99g55Pt-q-TEO8XVAg7nqO2Hj8X
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

x-dispatcher: dispatcher1useast1
date: Wed, 31 Aug 2022 14:38:42 GMT
x-content-type-options: nosniff
age: 15010529
x-vhost: publish
vary: Origin
content-length: 44782
x-custom-location: DE,TH,Erfurt
last-modified: Thu, 10 Mar 2022 21:03:13 GMT
server: Apache
x-frame-options: SAMEORIGIN
etag: "aeee-5d9e38acc4640"
access-control-max-age: 1000
access-control-allow-methods: GET, OPTIONS, HEAD
content-type: image/png
cache-control: max-age=31536000, public
access-control-allow-credentials: true
accept-ranges: bytes
access-control-allow-headers: x-requested-with, Content-Type, origin, authorization, accept, client-security-token, Access-Control-Request-Method, Access-Control-Request-Headers, __token__,d6gq0uiuiy-a,d6gq0uiuiy-b,d6gq0uiuiy-c,d6gq0uiuiy-d,d6gq0uiuiy-f,d6gq0uiuiy-z,x-okta-user-agent-extended

GET
H2 200 KTVR Show response
trk.firstcitizens.com/200189/ Frame E186 123 B
616 B 118ms
118ms Script
text/javascript 44.196.18.202
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://trk.firstcitizens.com/200189/KTVR?d=ZW5jZEBhdzQ1UHhDUjF3OXRlYWM1djlxRjRBK3RvVFY2RkdaV2svcW80ZmpyMUpSWGZhL05ReWJoMGpKMFNrVHp6M2QvdXdhVXhhZENZVi9uMnRjM096QnhLazc1bjJkenA4MjU2ZTZKSENoL2NtZXArYzRZSUMwTWpxa0h6bFE2RlFSWGVycXppTFNQWkRxNFpEN1VCbVowdG1oQWlUc05XRWF0WXdnUXJKZXhnTmRnVkFvdmtTdUhCWUhBbEhab3lSVmZ8ZDYzYjhlN2FlNTFiYjllYTExN2EwOGM5ZTY4YjBmYzU4MDJjMGFhODZkZjU3N2Y2MzEwMTM2ZWUzNGRmNzgxZDIyZWMzNWI1ZWRjZGZmNDUyYTMzYjJlMzE5ZThkYzg2OGQ1OWFjZjc5ODg0ZDA0ODVlNzJhMWE2M2JkMmViMDc4M2QwZDkyNjJlNmZlNjAyOGQ1ZDc0MjQwOTQyZjk3MTY3MDQ0YzE1N2ZhYzc5NzJmNWM3MzA3YjVlZTkwZGE5ZTJhZGFlMWE1ZmZhNGVkODNkM2NjYjc4OTU1NGQ4ZTNlMDNlZDFkMTYwNGI2ZmE1MTUxNjQ5ZmJlNDk5YzE3ZjIzNjNkMDg4NTIzOWExNGVkMDQ0NzhlNWJlNjFhNjhiZDBiNWQ2NjE2NjhkZDViNDYwODkwMThmYWI4MWNhZTBmNDExYjJlY2QzMGY0MTA2MWY3MWJjOWEyOWIwMzliYTY2MTAxY2Y1ZTg4MzQ3ZmUwYjFhMDU5OTc2NmE2YWI2YTEyNmJiYjlkYzAxNGI3NTZlYTQ1YWJhNDYzODU5Yzg3ZjIyYWVlNGZjZGJmZDI5YTYxYjI1NzNiYWY0N2Y1NWE3YmRhYzY5ZWRjYWY3YTUwZDcxNjkzNWEyZDE0ZjM3MmU1ODA2YjkxZTc4Yjk5NjI3YWYxYjgzMjdhMzY2OTh8MDBlZTBiNjJlY2FhYzg5Zg%3D%3D&cid=2&si=0&e=https%3A%2F%2Fwww.firstcitizens.com&LSESSIONID=eyJpIjoid3hnckxST2s3c29SKytDVVwvZHJacGc9PSIsImUiOiI2RmdYSnQ2ZGhXR292dmx3a3Z4dTBlcWRyVU0yNTNyYWRSUW9HNkVcL1NpeVhOMDhyM25FZDFUZHBuNGRkejhNZmt4Z2RsUzg3RnpQZldwdkpzdGJQSlg1SWVKY3prV01UUUp0aTluNTdGdWIyRUJuVlpQRGdhSWFBOVlGc1NaaVJaNzd4WWNkcHVPbVlOc3kwRHZxendRPT0ifQ%3D%3D.758d5dc8a541e933.ODc1ZjBjMWIwMzY4NTBjNzg4Njk5MTQ1YTgzMDE1NmE4MmIxY2I1ZTI2ZTJmN2I1OWZmMDFmZTljMWZkOGRkNA%3D%3D&t=jsonp&__tp=login&c=wbeyrp_msmnrwdgu&eu=https%3A%2F%2Fwww.firstcitizens.com%2F

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

44.196.18.202 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-44-196-18-202.compute-1.amazonaws.com

Software

haile /

Resource Hash

a989985566e50a6d157e6ae52bf010e177bca557f1f8c82d7117e8dca9338313

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://trk.firstcitizens.com/200189/tlen.html?si=0&e=https%3A%2F%2Fwww.firstcitizens.com&LSESSIONID=eyJpIjoid3hnckxST2s3c29SKytDVVwvZHJacGc9PSIsImUiOiI2RmdYSnQ2ZGhXR292dmx3a3Z4dTBlcWRyVU0yNTNyYWRSUW9HNkVcL1NpeVhOMDhyM25FZDFUZHBuNGRkejhNZmt4Z2RsUzg3RnpQZldwdkpzdGJQSlg1SWVKY3prV01UUUp0aTluNTdGdWIyRUJuVlpQRGdhSWFBOVlGc1NaaVJaNzd4WWNkcHVPbVlOc3kwRHZxendRPT0ifQ%3D%3D.758d5dc8a541e933.ODc1ZjBjMWIwMzY4NTBjNzg4Njk5MTQ1YTgzMDE1NmE4MmIxY2I1ZTI2ZTJmN2I1OWZmMDFmZTljMWZkOGRkNA%3D%3D&t=xframe&__tp=login&eu=https%3A%2F%2Fwww.firstcitizens.com%2F&icid=1661956721673996&sr=https%3A%2F%2Fwww.firstcitizens.com%2Fcontent%2Fdam%2Ffirstcitizens%2Fimages%2Fresources%2Fpersonal%2Fcredit%2F5-cs-of-credit%402x.jpg.transform%2Fresource-card-standard-3-desktop%2Fimage-scaled-2x-to-1x%2Fimage.jpeg
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 31 Aug 2022 14:38:42 GMT
server: haile
strict-transport-security: max-age=86400
access-control-allow-methods: GET, OPTIONS
p3p: CP="NOI ADM DEV PSAi COM NAV OUR OTR STP IND DEM"
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
content-type: text/javascript
content-length: 123
pics-label: (PICS-1.1 "http://www.icra.org/pics/vocabularyv03/" l r (n 0 s 0 v 0 l 0 oa 0 ob 0 oc 0 od 0 oe 0 of 0 og 0 oh 0 c 0) "http://www.icra.org/ratingsv02.html" l r (nz 0 vz 0 lz 0 oz 0 cz 0) "http://www.rsac.org/ratingsv01.html" l r (n 0 s 0 v 0 l 0))

GET
H2 200 KTVR Show response
trk.firstcitizens.com/200189/ Frame D08D 123 B
616 B 119ms
118ms Script
text/javascript 44.196.18.202
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://trk.firstcitizens.com/200189/KTVR?d=ZW5jZEBPNHluV0FtZnJxQlVLY1RBaXBva2U1WklENWFKVnBOb3dXQTFaVHdxbUNKdjFuRUpxaHUvVllTZnpPR0V2TDFmSDRZdndYRWttVU1uM2tGL2pqR3ZjNVpxM1ZZSDg5V0M5NS9GMkZrQmdxMGhDdWNqL1VSVkp0emFGT1NrU2Uvdzc4cVFEb01QS1lkbmdxbEpNTnJ5N1FDQldwcnhiY2hEU1E4PXwzM2MzNWMwZWUwMzk3ZDhlZDhiMzVmMjAzN2Q3MjZiYTBjY2JjY2IyOTQ5MmY4YTQ2YjA2YzUwZDViNTZiODIxMjdmYjM1ZWUwN2Y4NGZjYWU1ZGJhMGZjYmFhMzJiMzczMzY3MmY0YmIxODFlMTJjNTYxOTQ3MDk2NjhmOGUyZTE4YjI3ZTI2Zjk5MTJjN2ZlNGY5YmQwY2U5ZjNiMDE1MWQ5NGJlZTgxMjg5ZjU4YjY3MmY0YzJjYTE3YTVkMGYzYmQxNWE4YzQwZjUwZmE4M2U0MTc0NTUxYWRhOGZkNmQ3ZGY2YmY0NGNlYzFlN2NmZjIyZjVmMGU0NDA4YmQxMjkzMzNlYzY2NTI1ZjE0MWUwN2UxNDdjYTlhNTcyNDE5YTY3Mjk5YWE0NTNmYzRiNjY2OGFjZGUzNjdhMGVkZjk4NTFiMGM3OTFlNTQ1MjcyMmUwMTcwZDIwMjY0MzM0NDE5MjMxY2FjYjVhNzVmYjI2YzNkZDNmZjU5Y2E5MjcyYzRjNWEzZTlmMWY2NTlhNGZhMzE3YmIzNTJmOGM3NzZiYzkyNjZiNGRkYTFiNzdjMmZhMDZmYzFkMTdjMDM2N2Q4ZjlhZTMzMjJmYTJhMTk0MjM1NWI2MTI2YWUxZmI1YzM5Yzc3MmVmMzU0ZDAzM2JlNDhhMzkxYTJkNGFmZXwwMGVlMGI2MmVjYWFjODlm&cid=5&si=0&e=https%3A%2F%2Fwww.firstcitizens.com&LSESSIONID=eyJpIjoid3hnckxST2s3c29SKytDVVwvZHJacGc9PSIsImUiOiI2RmdYSnQ2ZGhXR292dmx3a3Z4dTBlcWRyVU0yNTNyYWRSUW9HNkVcL1NpeVhOMDhyM25FZDFUZHBuNGRkejhNZmt4Z2RsUzg3RnpQZldwdkpzdGJQSlg1SWVKY3prV01UUUp0aTluNTdGdWIyRUJuVlpQRGdhSWFBOVlGc1NaaVJaNzd4WWNkcHVPbVlOc3kwRHZxendRPT0ifQ%3D%3D.758d5dc8a541e933.ODc1ZjBjMWIwMzY4NTBjNzg4Njk5MTQ1YTgzMDE1NmE4MmIxY2I1ZTI2ZTJmN2I1OWZmMDFmZTljMWZkOGRkNA%3D%3D&t=jsonp&__tp=login&c=granetxehxtrzmoy&eu=https%3A%2F%2Fwww.firstcitizens.com%2F

Requested by

Host: trk.firstcitizens.com
URL: https://trk.firstcitizens.com/200189/grobutl.html/discovercard.com/dfs/accounthome/summary/www.schwab.com/secure.accurint.com/unfcu2.org//login1/wachovia.com/MyAccounts.aspx/investing.schwab.com/secure/schwab///httpsabph.pl/pi/do/Authorization/alfabank.ru/swedbank/pf.bgz.pl/httponline.eurobank.pl/https://snsbank.nl/mijnsns/secure/login/?cid=5&si=0&e=https%3A%2F%2Fwww.firstcitizens.com&LSESSIONID=eyJpIjoid3hnckxST2s3c29SKytDVVwvZHJacGc9PSIsImUiOiI2RmdYSnQ2ZGhXR292dmx3a3Z4dTBlcWRyVU0yNTNyYWRSUW9HNkVcL1NpeVhOMDhyM25FZDFUZHBuNGRkejhNZmt4Z2RsUzg3RnpQZldwdkpzdGJQSlg1SWVKY3prV01UUUp0aTluNTdGdWIyRUJuVlpQRGdhSWFBOVlGc1NaaVJaNzd4WWNkcHVPbVlOc3kwRHZxendRPT0ifQ%3D%3D.758d5dc8a541e933.ODc1ZjBjMWIwMzY4NTBjNzg4Njk5MTQ1YTgzMDE1NmE4MmIxY2I1ZTI2ZTJmN2I1OWZmMDFmZTljMWZkOGRkNA%3D%3D&t=xframe&__tp=login&eu=https%3A%2F%2Fwww.firstcitizens.com%2F&icid=166195672168074903&sr=https%3A%2F%2Fwww.firstcitizens.com%2Fcontent%2Fdam%2Ffirstcitizens%2Fimages%2Fresources%2Fpersonal%2Fcredit%2F5-cs-of-credit%402x.jpg.transform%2Fresource-card-standard-3-desktop%2Fimage-scaled-2x-to-1x%2Fimage.jpeg

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

44.196.18.202 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-44-196-18-202.compute-1.amazonaws.com

Software

haile /

Resource Hash

42e4266cb5127299cc4ce34c1e22f9b7ccc3c6045486e5d120a066562ecbf6ad

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://trk.firstcitizens.com/200189/grobutl.html/discovercard.com/dfs/accounthome/summary/www.schwab.com/secure.accurint.com/unfcu2.org//login1/wachovia.com/MyAccounts.aspx/investing.schwab.com/secure/schwab///httpsabph.pl/pi/do/Authorization/alfabank.ru/swedbank/pf.bgz.pl/httponline.eurobank.pl/https://snsbank.nl/mijnsns/secure/login/?cid=5&si=0&e=https%3A%2F%2Fwww.firstcitizens.com&LSESSIONID=eyJpIjoid3hnckxST2s3c29SKytDVVwvZHJacGc9PSIsImUiOiI2RmdYSnQ2ZGhXR292dmx3a3Z4dTBlcWRyVU0yNTNyYWRSUW9HNkVcL1NpeVhOMDhyM25FZDFUZHBuNGRkejhNZmt4Z2RsUzg3RnpQZldwdkpzdGJQSlg1SWVKY3prV01UUUp0aTluNTdGdWIyRUJuVlpQRGdhSWFBOVlGc1NaaVJaNzd4WWNkcHVPbVlOc3kwRHZxendRPT0ifQ%3D%3D.758d5dc8a541e933.ODc1ZjBjMWIwMzY4NTBjNzg4Njk5MTQ1YTgzMDE1NmE4MmIxY2I1ZTI2ZTJmN2I1OWZmMDFmZTljMWZkOGRkNA%3D%3D&t=xframe&__tp=login&eu=https%3A%2F%2Fwww.firstcitizens.com%2F&icid=166195672168074903&sr=https%3A%2F%2Fwww.firstcitizens.com%2Fcontent%2Fdam%2Ffirstcitizens%2Fimages%2Fresources%2Fpersonal%2Fcredit%2F5-cs-of-credit%402x.jpg.transform%2Fresource-card-standard-3-desktop%2Fimage-scaled-2x-to-1x%2Fimage.jpeg
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 31 Aug 2022 14:38:42 GMT
server: haile
strict-transport-security: max-age=86400
access-control-allow-methods: GET, OPTIONS
p3p: CP="NOI ADM DEV PSAi COM NAV OUR OTR STP IND DEM"
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
content-type: text/javascript
content-length: 123
pics-label: (PICS-1.1 "http://www.icra.org/pics/vocabularyv03/" l r (n 0 s 0 v 0 l 0 oa 0 ob 0 oc 0 od 0 oe 0 of 0 og 0 oh 0 c 0) "http://www.icra.org/ratingsv02.html" l r (nz 0 vz 0 lz 0 oz 0 cz 0) "http://www.rsac.org/ratingsv01.html" l r (n 0 s 0 v 0 l 0))

GET
H2 200 fulvip.html Show response
trk.firstcitizens.com/200189/ Frame 426D 22 KB
10 KB 110ms
109ms Document
text/html 44.196.18.202
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://trk.firstcitizens.com/200189/fulvip.html?sui=5e714debaf6d4439159f3327270b947e7ac3ebf8e0985c5788545626262bff8c

Requested by

Host: trk.firstcitizens.com
URL: https://trk.firstcitizens.com/200189/genc.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

44.196.18.202 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-44-196-18-202.compute-1.amazonaws.com

Software

haile /

Resource Hash

864a720c65a205784b8e436c95d15926cb33544309e89d6684c00d48cffd822f

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

Referer: https://www.firstcitizens.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

access-control-allow-credentials: true
access-control-allow-methods: GET, OPTIONS
access-control-allow-origin: *
cache-control: private, max-age=3600
content-encoding: gzip
content-type: text/html
date: Wed, 31 Aug 2022 14:38:42 GMT
expires: Wed, 31 Aug 2022 15:38:42 GMT
p3p: CP="NOI ADM DEV PSAi COM NAV OUR OTR STP IND DEM"
pics-label: (PICS-1.1 "http://www.icra.org/pics/vocabularyv03/" l r (n 0 s 0 v 0 l 0 oa 0 ob 0 oc 0 od 0 oe 0 of 0 og 0 oh 0 c 0) "http://www.icra.org/ratingsv02.html" l r (nz 0 vz 0 lz 0 oz 0 cz 0) "http://www.rsac.org/ratingsv01.html" l r (n 0 s 0 v 0 l 0))
server: haile
strict-transport-security: max-age=86400

POST
H2 200 zN33 Show response
trk.firstcitizens.com/200189/ Frame 426D 127 B
636 B 119ms
119ms XHR
text/html 44.196.18.202
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://trk.firstcitizens.com/200189/zN33?cid=15%2C34&si=0&e=https%3A%2F%2Fwww.firstcitizens.com&LSESSIONID=eyJpIjoid3hnckxST2s3c29SKytDVVwvZHJacGc9PSIsImUiOiI2RmdYSnQ2ZGhXR292dmx3a3Z4dTBlcWRyVU0yNTNyYWRSUW9HNkVcL1NpeVhOMDhyM25FZDFUZHBuNGRkejhNZmt4Z2RsUzg3RnpQZldwdkpzdGJQSlg1SWVKY3prV01UUUp0aTluNTdGdWIyRUJuVlpQRGdhSWFBOVlGc1NaaVJaNzd4WWNkcHVPbVlOc3kwRHZxendRPT0ifQ%3D%3D.758d5dc8a541e933.ODc1ZjBjMWIwMzY4NTBjNzg4Njk5MTQ1YTgzMDE1NmE4MmIxY2I1ZTI2ZTJmN2I1OWZmMDFmZTljMWZkOGRkNA%3D%3D&t=xpost&__tp=login

Requested by

Host: trk.firstcitizens.com
URL: https://trk.firstcitizens.com/200189/fulvip.html?sui=5e714debaf6d4439159f3327270b947e7ac3ebf8e0985c5788545626262bff8c

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

44.196.18.202 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-44-196-18-202.compute-1.amazonaws.com

Software

haile /

Resource Hash

a44f83e9c5a053fde869433927fb4b281086e3c8fff4135e89f7d497a8ec4954

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

Referer: https://trk.firstcitizens.com/200189/fulvip.html?sui=5e714debaf6d4439159f3327270b947e7ac3ebf8e0985c5788545626262bff8c
accept-language: de-DE,de;q=0.9
X-Embedding-Uri: https://www.firstcitizens.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

pragma: no-cache
date: Wed, 31 Aug 2022 14:38:42 GMT
server: haile
strict-transport-security: max-age=86400
access-control-allow-methods: GET, OPTIONS
p3p: CP="NOI ADM DEV PSAi COM NAV OUR OTR STP IND DEM"
access-control-allow-origin: https://trk.firstcitizens.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
content-type: text/html
content-length: 127
pics-label: (PICS-1.1 "http://www.icra.org/pics/vocabularyv03/" l r (n 0 s 0 v 0 l 0 oa 0 ob 0 oc 0 od 0 oe 0 of 0 og 0 oh 0 c 0) "http://www.icra.org/ratingsv02.html" l r (nz 0 vz 0 lz 0 oz 0 cz 0) "http://www.rsac.org/ratingsv01.html" l r (n 0 s 0 v 0 l 0))

GET
H3 200 /
www.facebook.com/tr/ Frame 25A6 44 B
88 B 21ms
21ms Image
image/gif 2a03:2880:f11c:8183:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=1092183154453421&ev=Microdata&dl=https%3A%2F%2F9786468.fls.doubleclick.net%2Factivityi%3Bdc_pre%3DCOqsmqCn8fkCFZrxmgodyw4Mvw%3Bcat%3Dfcb-u0%3Bsrc%3D9786468%3Btype%3Dunive0%3F&rl=https%3A%2F%2Fwww.firstcitizens.com%2F&if=true&ts=1661956723449&cd[DataLayer]=%5B%5D&cd[Meta]=%7B%22title%22%3A%22%22%7D&cd[OpenGraph]=%7B%7D&cd[Schema.org]=%5B%5D&cd[JSON-LD]=%5B%5D&sw=1600&sh=1200&v=2.9.78&r=stable&ec=1&o=30&it=1661956721883&coo=false&es=automatic&tm=3&rqm=GET

Protocol

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f11c:8183:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://9786468.fls.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

date: Wed, 31 Aug 2022 14:38:43 GMT
last-modified: Fri, 21 Dec 2012 00:00:01 GMT
server: proxygen-bolt
strict-transport-security: max-age=31536000; includeSubDomains
content-type: image/gif
cache-control: no-cache, must-revalidate, max-age=0
cross-origin-resource-policy: cross-origin
content-length: 44
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
priority: u=3,i
expires: Wed, 31 Aug 2022 14:38:43 GMT

POST
H2 200 bf Show response
bf48372wzr.bf.dynatrace.com/ 694 B
963 B 345ms
105ms XHR
text/plain 3.227.107.182
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://bf48372wzr.bf.dynatrace.com/bf?type=js3&sn=-21%24NHE2V2VV87F4NGCJQD9F3B4982ORFGCE&svrid=-21&flavor=cors&vi=URCPEPAPIAOMRSDLJTHFQIFCCNCFPKMP-0&modifiedSince=1610381653117&rf=https%3A%2F%2Fwww.firstcitizens.com%2F%3Fmkt_tok%3DMjk2LUNQWC0yOTUAAAGGjzWEenlD9bhQeI4yKU4PJ5Eg5xUYrIuOJJSXEvW7jT2yjNYpb3L3rorhi9Z_gG-_zI6eKyJLQDzI_99g55Pt-q-TEO8XVAg7nqO2Hj8X&bp=3&app=6fe9836089b22b9f&crc=4023155429&en=erm9uzvs&end=1
Requested by: Host: cds-sdkcfg.onlineaccess1.com
URL: https://cds-sdkcfg.onlineaccess1.com/common.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.227.107.182 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-227-107-182.compute-1.amazonaws.com
Software: /
Resource Hash: 6b7b7bd6f593468397bc88950216b0e8ae5de7d9633d3ff43a1455c4daa6bb5d

Request headers

Referer: https://www.firstcitizens.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

access-control-allow-origin: https://www.firstcitizens.com
x-oneagent-js-injection: true
date: Wed, 31 Aug 2022 14:38:44 GMT
cache-control: no-cache
content-length: 694
content-type: text/plain;charset=utf-8

POST
H2 200 bf Show response
bf48372wzr.bf.dynatrace.com/ 202 B
470 B 106ms
105ms XHR
text/plain 3.227.107.182
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://bf48372wzr.bf.dynatrace.com/bf?type=js3&sn=v_4_srv_3_sn_8FC24ACC13942590D55CD9E77733F09E_app-3A6fe9836089b22b9f_1_ol_0_perc_100000_mul_1&svrid=3&flavor=cors&vi=URCPEPAPIAOMRSDLJTHFQIFCCNCFPKMP-0&modifiedSince=1661933199120&rf=https%3A%2F%2Fwww.firstcitizens.com%2F%3Fmkt_tok%3DMjk2LUNQWC0yOTUAAAGGjzWEenlD9bhQeI4yKU4PJ5Eg5xUYrIuOJJSXEvW7jT2yjNYpb3L3rorhi9Z_gG-_zI6eKyJLQDzI_99g55Pt-q-TEO8XVAg7nqO2Hj8X&bp=3&app=6fe9836089b22b9f&crc=3241421530&en=erm9uzvs&end=1
Requested by: Host: cds-sdkcfg.onlineaccess1.com
URL: https://cds-sdkcfg.onlineaccess1.com/common.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.227.107.182 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-227-107-182.compute-1.amazonaws.com
Software: /
Resource Hash: 0fe5b608e27b0c3047eeca505e5f142e96375808b1c48678eb9573f69c191dc5

Request headers

Referer: https://www.firstcitizens.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

access-control-allow-origin: https://www.firstcitizens.com
x-oneagent-js-injection: true
date: Wed, 31 Aug 2022 14:38:45 GMT
cache-control: no-cache
content-length: 202
content-type: text/plain;charset=utf-8

GET
H2 200 image.20220419.png
www.firstcitizens.com/content/dam/firstcitizens/images/feature-highlight/personal-digital-banking/device-alerts@2x.png.transform/image-scaled-2x-to-1x/ 54 KB
55 KB 222ms
222ms Image
image/png 52.206.240.104
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.firstcitizens.com/content/dam/firstcitizens/images/feature-highlight/personal-digital-banking/device-alerts@2x.png.transform/image-scaled-2x-to-1x/image.20220419.png

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.206.240.104 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-52-206-240-104.compute-1.amazonaws.com

Software

Apache /

Resource Hash

44e491a87bd9f91cfbf1c2751726e8f6dc433a90a809c1cc4d7500d5cd5b6a05

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.firstcitizens.com/?mkt_tok=Mjk2LUNQWC0yOTUAAAGGjzWEenlD9bhQeI4yKU4PJ5Eg5xUYrIuOJJSXEvW7jT2yjNYpb3L3rorhi9Z_gG-_zI6eKyJLQDzI_99g55Pt-q-TEO8XVAg7nqO2Hj8X
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.52 Safari/537.36

Response headers

x-dispatcher: dispatcher1useast1
date: Wed, 31 Aug 2022 14:38:46 GMT
x-content-type-options: nosniff
age: 11560310
x-vhost: publish
vary: Origin
content-length: 55407
x-custom-location: DE,TH,Erfurt
last-modified: Tue, 19 Apr 2022 19:26:56 GMT
server: Apache
x-frame-options: SAMEORIGIN
etag: "d86f-5dd06dc1d4000"
access-control-max-age: 1000
access-control-allow-methods: GET, OPTIONS, HEAD
content-type: image/png
cache-control: max-age=31536000, public
access-control-allow-credentials: true
accept-ranges: bytes
access-control-allow-headers: x-requested-with, Content-Type, origin, authorization, accept, client-security-token, Access-Control-Request-Method, Access-Control-Request-Headers, __token__,d6gq0uiuiy-a,d6gq0uiuiy-b,d6gq0uiuiy-c,d6gq0uiuiy-d,d6gq0uiuiy-f,d6gq0uiuiy-z,x-okta-user-agent-extended

Verdicts & Comments Add Verdict or Comment

108 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

44 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.click.firstcitizens.com/	1970-01-20 05:39:18	Name: __cf_bm Value: PhgN0XD0y.Z8WyjIR4AcIDwK62GpCEogMx.s6nkzgS8-1661956715-0-ASFhI9+iwBzEooIx/y+v2wRX9mLVP6QZtlCW56BJUnb9dzsRftpMDGJK6QFj/XF9ZFpFNebrC7NYWHoDB+e0K7w=
.sitescdn.net/	1970-01-20 05:39:18	Name: __cf_bm Value: WbHzq1xFnDLbdOhYxxoxhYNTLN8JECgOa9_luZRqqNM-1661956716-0-ARYETjlZcQABlxVsyMU+1p3ErF8SGftK8slepmdQkn84aLBatUtzL85NlKb5sYlE4LujlAgx8NfIv1+QA9j1kmE=
.firstcitizens.com/	1969-12-31 23:59:59	Name: rxVisitor Value: 1661956717203FGNH3O8OCK17EAVJ57AQV7T9BUISETDA
.firstcitizens.com/	1969-12-31 23:59:59	Name: dtLatC Value: 120
.firstcitizens.com/	1969-12-31 23:59:59	Name: dtSa Value: -
.firstcitizens.com/	1970-01-20 07:48:52	Name: _fbp Value: fb.1.1661956717525.1797907862
.demdex.net/	1970-01-20 09:58:28	Name: demdex Value: 20077602378767582852873053970317377673
.firstcitizens.com/	1969-12-31 23:59:59	Name: AMCVS_E6D235355CF7C1DE0A495EEC%40AdobeOrg Value: 1
.everesttech.net/	1970-01-20 14:24:52	Name: everest_g_v2 Value: g_surferid~Yw9ybQAAAMRovgOJ
www.sc.pages08.net/	1969-12-31 23:59:59	Name: Silverpop_cookie Value: 2123358986.17439.0000
.linkedin.com/	1970-01-20 06:22:28	Name: UserMatchHistory Value: AQJVRh1ceWcKeQAAAYL0Vvw6YICbjyuUc2_SwhJwVmVI7dTqsYsHWAdLtQmAOyz01x7vlP3d83aYqw
.linkedin.com/	1970-01-20 06:22:28	Name: AnalyticsSyncHistory Value: AQLB0l2H6KIEIAAAAYL0Vvw6wuHHg9G7YMcACRwXtK8D6O1y-C3aG6tOc5B7yCP5iC-aN23H2Qw5SjG7z32fjA
.ads.linkedin.com/	1969-12-31 23:59:59	Name: lang Value: v=2&lang=en-us
.linkedin.com/	1970-01-20 14:24:52	Name: bcookie Value: "v=2&f5ab2150-7ec5-4be5-8dd0-e29ea2c6bd6a"
.linkedin.com/	1970-01-20 05:40:43	Name: lidc Value: "b=TGST03:s=T:r=T:a=T:p=T:g=2829:u=1:x=1:i=1661956717:t=1662043117:v=2:sig=AQGpiYXCYSga095DiTGIh5v3abFPX30v"
.dpm.demdex.net/	1970-01-20 09:58:28	Name: dpm Value: 20077602378767582852873053970317377673
.firstcitizens.com/	1970-01-20 15:15:16	Name: AMCV_E6D235355CF7C1DE0A495EEC%40AdobeOrg Value: 1176715910%7CMCIDTS%7C19236%7CMCMID%7C13892004862147962413406043386722206805%7CMCAAMLH-1662561517%7C6%7CMCAAMB-1662561517%7C6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y%7CMCOPTOUT-1661963917s%7CNONE%7CMCSYNCSOP%7C411-19243%7CvVersion%7C5.4.0
.firstcitizens.com/	1969-12-31 23:59:59	Name: LSESSIONID Value: eyJpIjoid3hnckxST2s3c29SKytDVVwvZHJacGc9PSIsImUiOiI2RmdYSnQ2ZGhXR292dmx3a3Z4dTBlcWRyVU0yNTNyYWRSUW9HNkVcL1NpeVhOMDhyM25FZDFUZHBuNGRkejhNZmt4Z2RsUzg3RnpQZldwdkpzdGJQSlg1SWVKY3prV01UUUp0aTluNTdGdWIyRUJuVlpQRGdhSWFBOVlGc1NaaVJaNzd4WWNkcHVPbVlOc3kwRHZxendRPT0ifQ%3D%3D.758d5dc8a541e933.ODc1ZjBjMWIwMzY4NTBjNzg4Njk5MTQ1YTgzMDE1NmE4MmIxY2I1ZTI2ZTJmN2I1OWZmMDFmZTljMWZkOGRkNA%3D%3D
.linkedin.com/	1969-12-31 23:59:59	Name: lang Value: v=2&lang=de-de
.www.linkedin.com/	1970-01-20 14:24:52	Name: bscookie Value: "v=1&202208311438375788e6b8-080f-4b3f-838f-0a498fc109f8AQG6BY_D5p2vsDBhBWp9s7IgTzspDmxp"
.linkedin.com/	1970-01-20 09:58:28	Name: li_gc Value: MTswOzE2NjE5NTY3MTc7MjswMjFxugxsc8eorG2PKYJru8x7HFRF8h2wjxRnQhbAbpYbbw==
.firstcitizens.com/	1970-01-20 15:15:16	Name: __gdic Value: l7hq4asrtwcbls6p5ej
.firstcitizens.com/	1970-01-20 15:15:16	Name: ___r200189 Value: 0.6945182210114
www.firstcitizens.com/	1970-01-20 07:48:52	Name: site-section Value: personal
.firstcitizens.com/	1970-01-20 15:08:40	Name: _cs_c Value: 0
.firstcitizens.com/	1970-01-20 15:08:40	Name: _cs_id Value: 3cef1cc6-1c45-ad98-a8f6-eb94227008da.1661956718.1.1661956718.1661956718.1.1696120718413
.firstcitizens.com/	1970-01-20 15:15:16	Name: nmstat Value: 70f47041-de09-d7e7-e7f0-d935f19d95ca
2884.global.siteimproveanalytics.io/	1969-12-31 23:59:59	Name: AWSELBCORS Value: 1BF185CB12C799AC7E8F30E4356ECAB670474BBE589003797336CE4C220D28A5614DC7EEC747F692D0A0C2A750D9EEAE4C03879C28C5495E651A5552CEF5FE46587B6FE465
.advanced-web-analytics.com/	1969-12-31 23:59:59	Name: LSESSIONID Value: eyJpIjoicmdRa0NKU3QxZnR0ZXBcLzNubGMzZ2c9PSIsImUiOiJFQ2pTRFdsbVVRTUtMOFB4cENvTlpwdUg3K2hTcUpUVDNIOU1DSlwvVzBRK3grZ0tWSm80Z2I0dklha2ViaTBJZHJxc1pubWNyaU5sem1nM0NDcDVqaGJvVEo2SGN2TlowWkdhdVQxSmpHU3lHQ2lBM0RwYlpBcGh3eU1mM04yREFzeDZlaGlhVkFLTHlGN1JUMHN0a1hRPT0ifQ%3D%3D.e9da028e6a2e6253.ODc1ZjBjMWIwMzY4NTBjNzg4Njk5MTQ1YTgzMDE1NmE4MmIxY2I1ZTI2ZTJmN2I1OWZmMDFmZTljMWZkOGRkNA%3D%3D
.advanced-web-analytics.com/	1970-01-20 15:15:16	Name: g__gdic Value: l7hq4asrtwcbls6p5ej
.firstcitizens.com/	1970-01-20 05:39:18	Name: _cs_s Value: 1.5.0.1661958518850
.firstcitizens.com/	1969-12-31 23:59:59	Name: rxvt Value: 1661958521601\|1661956717204
.firstcitizens.com/	1969-12-31 23:59:59	Name: dtPC Value: -21$556717199_98h-vURCPEPAPIAOMRSDLJTHFQIFCCNCFPKMP-0e1
.firstcitizens.com/	1970-01-20 05:39:18	Name: gpv_pn Value: %2F%20%7C%20https%3A%2F%2Fwww.firstcitizens.com%2F
.doubleclick.net/	1970-01-20 15:00:52	Name: IDE Value: AHWqTUlmEI2Xk90dLvJookYxcPjZdxF4FtT7XPobslyOtU26QYoFvWUEdD1Cw00sE5M
.firstcitizens.com/	1969-12-31 23:59:59	Name: s_cc Value: true
.firstcitizens.com/	1970-01-20 15:15:16	Name: _mkto_trk Value: id:296-CPX-295&token:_mch-firstcitizens.com-1661956721829-19753
www.firstcitizens.com/	1969-12-31 23:59:59	Name: QSI_HistorySession Value: https%3A%2F%2Fwww.firstcitizens.com%2F%3Fmkt_tok%3DMjk2LUNQWC0yOTUAAAGGjzWEenlD9bhQeI4yKU4PJ5Eg5xUYrIuOJJSXEvW7jT2yjNYpb3L3rorhi9Z_gG-_zI6eKyJLQDzI_99g55Pt-q-TEO8XVAg7nqO2Hj8X~1661956721850
.firstcitizens.com/	1970-01-20 07:48:52	Name: _gcl_au Value: 1.1.468790272.1661956722
.w55c.net/	1970-01-20 15:08:40	Name: wfivefivec Value: PtD1nWOo1OtoRz2
.firstcitizens.com/	1970-01-20 05:39:17	Name: _ga Value: GA1.2.1517623431.1661956722
.firstcitizens.com/	1970-01-20 05:40:43	Name: _gid Value: GA1.2.1592734457.1661956722
.firstcitizens.com/	1970-01-20 05:39:16	Name: _gat_gtag_UA_2437458_1 Value: 1
.firstcitizens.com/	1969-12-31 23:59:59	Name: dtCookie Value: v_4_srv_3_sn_8FC24ACC13942590D55CD9E77733F09E_app-3A6fe9836089b22b9f_1_ol_0_perc_100000_mul_1

4 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
security	error	URL: https://click.firstcitizens.com/Mjk2LUNQWC0yOTUAAAGGjzWEepGrdE_F9gLAZ0-u2miichXjNgyPOUQYI11h_GdvYOzF1rx1NNgTrWni8ZiQFhJmJHQ= Message: The Content-Security-Policy directive name 'form-action:'none'' contains one or more invalid characters. Only ASCII alphanumeric characters or dashes '-' are allowed in directive names.
security	error	URL: https://click.firstcitizens.com/Mjk2LUNQWC0yOTUAAAGGjzWEepGrdE_F9gLAZ0-u2miichXjNgyPOUQYI11h_GdvYOzF1rx1NNgTrWni8ZiQFhJmJHQ= Message: The Content-Security-Policy directive name 'frame-src:'none'' contains one or more invalid characters. Only ASCII alphanumeric characters or dashes '-' are allowed in directive names.
javascript	warning	URL: https://www.firstcitizens.com/?mkt_tok=Mjk2LUNQWC0yOTUAAAGGjzWEenlD9bhQeI4yKU4PJ5Eg5xUYrIuOJJSXEvW7jT2yjNYpb3L3rorhi9Z_gG-_zI6eKyJLQDzI_99g55Pt-q-TEO8XVAg7nqO2Hj8X(Line 2315) Message: A parser-blocking, cross site (i.e. different eTLD+1) script, https://js-cdn.dynatrace.com/jstag/165658ccba3/ruxitagent_A2SVfqru_10205201116183137.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript	warning	URL: https://www.firstcitizens.com/?mkt_tok=Mjk2LUNQWC0yOTUAAAGGjzWEenlD9bhQeI4yKU4PJ5Eg5xUYrIuOJJSXEvW7jT2yjNYpb3L3rorhi9Z_gG-_zI6eKyJLQDzI_99g55Pt-q-TEO8XVAg7nqO2Hj8X(Line 2315) Message: A parser-blocking, cross site (i.e. different eTLD+1) script, https://js-cdn.dynatrace.com/jstag/165658ccba3/ruxitagent_A2SVfqru_10205201116183137.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Content-Security-Policy	default-src 'self'; img-src 'self';script-src 'self' 'sha256-qriJlH823x8+MLNVeMFMZpthotziBIOGm9q827fR30M=';object-src 'none';form-action:'none';frame-src:'none'
X-Frame-Options	SAMEORIGIN

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

2884.global.siteimproveanalytics.io
296-cpx-295.mktoresp.com
6528888.fls.doubleclick.net
9786468.fls.doubleclick.net
action.dstillery.com
action.media6degrees.com
adservice.google.com
adservice.google.de
assets.adobedtm.com
assets.sitescdn.net
awuse1.advanced-web-analytics.com
bf48372wzr.bf.dynatrace.com
c.contentsquare.net
cds-sdkcfg.onlineaccess1.com
click.firstcitizens.com
cm.everesttech.net
connect.facebook.net
dpm.demdex.net
firstcitizens.demdex.net
firstcitizens.sc.omtrdc.net
googleads.g.doubleclick.net
js-cdn.dynatrace.com
k-aus1.contentsquare.net
munchkin.marketo.net
px.ads.linkedin.com
px4.ads.linkedin.com
q-aus1.contentsquare.net
siteimproveanalytics.com
siteintercept.qualtrics.com
snap.licdn.com
stats.g.doubleclick.net
t.contentsquare.net
tags.w55c.net
trk.firstcitizens.com
www.facebook.com
www.firstcitizens.com
www.google-analytics.com
www.google.com
www.google.de
www.googleadservices.com
www.googletagmanager.com
www.linkedin.com
www.sc.pages08.net
zndhwk2nlgcbvdel3-firstcitizensbank.siteintercept.qualtrics.com
104.17.209.240
104.17.72.206
13.107.42.14
13.36.218.177
142.250.181.226
142.250.185.198
18.202.164.188
192.0.54.4
192.28.144.124
23.205.237.4
2606:4700::6812:7434
2606:4700::6812:a4f
2620:1ec:22::14
2a00:1450:4001:803::2002
2a00:1450:4001:80f::2002
2a00:1450:4001:810::2003
2a00:1450:4001:813::2008
2a00:1450:4001:82b::2004
2a00:1450:4001:82f::2002
2a00:1450:4001:830::200e
2a00:1450:400c:c0c::9c
2a02:26f0:3500:16::215:14a0
2a02:26f0:3500:587::1e80
2a03:2880:f01c:8012:face:b00c:0:3
2a03:2880:f11c:8183:face:b00c:0:25de
2a06:98c1:3121::3
3.121.84.223
3.220.188.198
3.227.107.182
3.96.5.142
34.248.32.199
44.196.18.202
52.18.235.86
52.206.240.104
52.209.201.13
52.58.29.12
54.205.244.165
65.9.66.105
99.86.4.115
99.86.4.72
01c6f0a1ebbe4e99848b16a64da29fd34d4604f96c98845b71219e1db21ff2b9
033cce384207ee8edc8fbdb8805032c9c646af75159925eb7b3a6cacb9e19810
05978957c6c8b028f2785dc77271c286bfac76e30b7bcd7e835c2927fbe897cf
087ffde713af10751722998e46fd7a0f04826fb2849a6b4dd70c2c65ced26bba
0d4baa79292e28c5617820df3f292603a792ed9324fe4e78e7c2320d0df81427
0fe5b608e27b0c3047eeca505e5f142e96375808b1c48678eb9573f69c191dc5
10078f6f9f0c199a299e17362a2db7cb61d0da35a3b0292e11e72abff5c146ba
10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa
110a2183d3c26bd04d9328e3341b22cab3c4eea0e049511cbcb3d1a713620b38
112646b6a3606cf96c0fd6e9247351325cb07fdb8801ec5069c9e6213d44945c
16dc47288992b53e5d9e5862c4cd9916cefbbbca88fa888543e22f7cbf18cb38
18a61947e910398b0a712b53659ecb05daae3164567e075f0ca7c86b0079bd41
1d7cb52729f96fe5a71385c08a149f3dfe20f8aedb17618013ff54999b2bd965
1e85ec81b9800b4c443d39caca0d0926089a3ac201120db1ceb45b93789480b8
2162bbedb2ea0b70a53607e0644780a79a479f26b4efd17bb4b88ae46861552b
32f3975105b7a4dceabc969348fb3652863537f0b4d90e7e9f2aaf7e07b96d02
36cef338ad8896930b39d347c01e4944d9aac13150cb39c466c4f591f407cfd5
3966f3091c7e9c586b259d00f5f9be81420299206ce4e503d7730436809cd200
3e37ff4860641d0f62e3691c26979fb64c5c62c995b11c79212432b6557943d8
40fb830ddc2646a75a5975ee258573b78141fe3732c6e6e539c3802a96834a6b
42e4266cb5127299cc4ce34c1e22f9b7ccc3c6045486e5d120a066562ecbf6ad
44e491a87bd9f91cfbf1c2751726e8f6dc433a90a809c1cc4d7500d5cd5b6a05
460a2a7e52186959e1dd4d130a44d6d1038137639a892483cc060c51ed4ce895
462a66acbf50e933685e7587e9f1441df8225b2bb4d6b7bc5e757eccf4ff6575
47043e4823a6c21a8881de789b4185355330b5804629d23f6b43dd93f5265292
4872bcbe87c7dc34cadbd6d540a412d5085c5f2960727ec0e214a20652575ad9
50e6072d26098d48004a30addeecabd5b22b91e5ccdf9dd86f96459783e3ac23
516abb6173cac18c967f5ba483568ac9cc51e6cb8b141c8830b67f64fdba0fb9
522993c06425afcdbc27ba10376fa083699d476174dac91562b98528bec90ebd
565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3
56880c220888346c1dd6b286563a827de59a358ad28362889593113779d6d22b
5ac85469e4f403a04a6ae33ed1a5a5d65f61d600f2477aa9680c3116840718e4
5d4972183041556a4368526fbac13acafc83de9ff3ca29ce81f31eb29c8f8a57
5e23346895bf1145e5c6905f83b7218fa0de395fa2dad5bf2384f17561bd2be0
5e93a44b6c9fa868f58c261066a7e9aa872426dedf5ecc234cfe797a112cd2e2
5fad50cc39e0ba03bdb8e9271f32dbd2e138eaff10cae489637a9594b3794a16
651801327eb97e55063d3db4d16de684d620ca3e797098f0f7bfe04d16327837
6acdd0a9a45db4fdcd0bf8aa60d38594a8d7653f7a63368156a5c45b9d7bd2f3
6b7b7bd6f593468397bc88950216b0e8ae5de7d9633d3ff43a1455c4daa6bb5d
6bea78c001260a92e1d53d6647d6d08e9d448a9381ff91a4ca86e785ce435454
6cdb76a12fdc124b0a3e053eb3be7d2a837afb43e459fdda17416979a95d0220
70c705d49e04d07b8353972235ca2f2f7f48c1ddbb671829a282558b991a8fa1
7bea17a80a61ed0f54248b4ffc4c718f7c8ff2619742577a73591d62ce074da8
7c370d9536d7d0d6a0f7cd7f9826692acd93e4fb05ba46f7b630b879740343d3
7f764818d06febc016d2ed6d033314a285eddf1cded7d3df1ef620f52388a854
805a44971461372a2726181a1d3057d7e81f38ed99b423c47f85c8d5b267802d
806ea1bf391a728e1ff62083b69c972a46796dadf5959510c3f4eac09930b6e7
80c2563d02969374b040e33efeed326951c45ebe05aa5eab4e38fede33ded2c4
823bd43daad2c30c2ed58baadf6cdff9490a8c21e7507d9c482e29ccaaadd57f
83203db8f86e32a589e9a843d05a3b3fdce8fdba86cdf30fd0c6f9983ea83822
84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80
864a720c65a205784b8e436c95d15926cb33544309e89d6684c00d48cffd822f
87b9ae2dd9b1a989b3bd956accea5b3279802343c66f74fba3e5dac161d40b71
8ec0de7054ad86aba875b6e9c92bc433f87819a4285afc3e6a4cf7e7fd064e7c
8ec4955cf8409babc80d8be144ee14fb795dec328c2775178ea9997781429e0c
9219086b4f2c3bf77854b2e06ccd97ad32b9b7a140e65ff8b974a3bae6c7854c
9a299923eea8e6bd0b0562f7919d02a13b43ff891920ad42319e411ae682fe10
a1382632a2f147909dbe8aaa0b7fe5f8dfffe36d0b04aaee51528a359466ef69
a1925038db769477ab74b4df34350c35688a795bb718727b0f4292a4a78a6210
a1ecbaed793a1f564c49c671f2dd0ce36f858534ef6d26b55783a06b884cc506
a2f96429a14fb370a30957bb66f37d5215bfa4921c9e680fabbe496f8e8e98b8
a39ef91987c731f40db8499e78bf5948f3825e45a6a1f145efa8a83926c2a308
a44f83e9c5a053fde869433927fb4b281086e3c8fff4135e89f7d497a8ec4954
a6f8a832354dcb8ee7968e7334f17c261998bdbab1d4f1078c4d069b50c43ec2
a989985566e50a6d157e6ae52bf010e177bca557f1f8c82d7117e8dca9338313
a9e192d06d1355d4a8f1d40bf430e407035b379bc0f31b6e3c42b347ecadc3ae
ae8b169a3a00e5da3b452394b70fbe8601e45df0951661c56070636f1840b7ad
b57839788686bf37d29f47bbe45ad8258085e3aebf54650ab389c0b515b977e1
b7c3a92a3e2ea697cae3df92f0069cc6296e0b012738def1f62fdb3ecca53b4b
b871681d1e25b54790b3f594a5ea599388158812429ecd99a39ac9ec5b924fb4
b9dab17f26703d9ba00a7a163a2df8d3b998e4d1b320cbd79ddd8b708e8be0bf
bb9094ccb7ba5f03c35bde22cb11346ea3376eb1a56d8872d4e30dfbbbc8c7a1
c01657e13aa6748fb123b16ed2db975ca5bd4bb6b770823e76af23ebfe146a8f
c14fbc9d7dc8acf2eff7611b5bfc2389c688837b6e250cd846b762c8de31efd6
c4f3b2593744dd72384569961c46aaec88e44eb8b380db28efc7c64ccfdd1d88
c62be49982cb5d23b373b63c2e33458e931a5702697dc412e3c7719c3adbb73c
cd7b34fb914601b44b1a609ce551d9543af651af054002a7d7307c2cea16c93b
cdea06dbf0cdae47af34f2c9f601a70fd19425ae722e6ff5cd5d70a0402e9fad
d4edbbe1037c50c8ffa90860286c8166860ad9da450ed5e16a28e2fc9bce3c23
de3246094525b21a870fc7d2a67490d0132535c6fa5993755c549f1a9d1bd8af
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e63a4fb8974e1af8329f29da6d5577bda98b2c850b6803737a544f0878883a7a
e75cb51bd7ce7787508f9cf6bf31a28292723be2ed73d374a8301d2b753daf4a
ec63eb90ab8df068057937fef6f8d00756faf6f74e121764a7d84572134601ae
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f44fe3d0ca53678e6cdcd8959e357d339ed0885ef64b848db29abb6db347e0fe
f53791ba90553841cef5aa28f9a53b893bf789f5d8904d103cf2ed5e70c885b5
f6200e00f9bcf9a324c8c1a046c6bc624ebcaf1379faf13e4d76ae56ea0d1a11
f62054be93b9f30643e209e390ae4299eb0501d1d89d9c8a3c6ee496ea9bd99c
fc480d815852472b37a36574b2111f65177014da01c06d78711b550829b5fb06
fe62ffc3dd7627c8b0d34b70fe45c7b14dd38c89c66cca13b2e4c71360e42e91

www.firstcitizens.com Open in urlscan Pro 52.206.240.104 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

109 Requests

95 %HTTPS

40 %IPv6

29 Domains

44 Subdomains

39 IPs

7 Countries

2664 kBTransfer

7233 kBSize

44 Cookies

30 Outgoing links

Page URL History

Redirected requests

109 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 1 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

www.firstcitizens.com Open in urlscan Pro
52.206.240.104 Public Scan

Screenshot
Live screenshot

Full Image

109
Requests

95 %
HTTPS

40 %
IPv6

29
Domains

44
Subdomains

39
IPs

7
Countries

2664 kB
Transfer

7233 kB
Size

44
Cookies

109 HTTP transactions
1 data transactions