fa.citizensbank.com Open in urlscan Pro
2606:4700::6812:7434 Public Scan

Go To Rescan
Add Verdict Report

URL:
https://fa.citizensbank.com/
Submission: On August 29 via automatic, source certstream-suspicious (August 29th 2021, 12:35:38 pm UTC)

Summary HTTP 40 Redirects Links 13 Behaviour Indicators

Summary

This website contacted 16 IPs in 6 countries across 21 domains to perform 40 HTTP transactions. The main IP is 2606:4700::6812:7434, located in United States and belongs to CLOUDFLARENET, US. The main domain is fa.citizensbank.com.
TLS certificate: Issued by Cloudflare Inc ECC CA-3 on August 29th 2021. Valid for: a year.

This is the only time fa.citizensbank.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
16	2606:4700::68... 2606:4700::6812:7434	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	23.21.33.24 23.21.33.24	14618 (AMAZON-AES) (AMAZON-AES)
1	3.124.119.57 3.124.119.57	16509 (AMAZON-02) (AMAZON-02)
8	18.200.233.208 18.200.233.208	16509 (AMAZON-02) (AMAZON-02)
2	18.197.253.20 18.197.253.20	16509 (AMAZON-02) (AMAZON-02)
1	52.19.186.105 52.19.186.105	16509 (AMAZON-02) (AMAZON-02)
2	15.236.176.210 15.236.176.210	16509 (AMAZON-02) (AMAZON-02)
1 1	52.51.88.158 52.51.88.158	16509 (AMAZON-02) (AMAZON-02)
2 2	35.244.174.68 35.244.174.68	15169 (GOOGLE) (GOOGLE)
1 1	104.111.215.191 104.111.215.191	16625 (AKAMAI-AS) (AKAMAI-AS)
2 3	172.217.18.98 172.217.18.98	15169 (GOOGLE) (GOOGLE)
1 1	193.0.160.129 193.0.160.129	54312 (ROCKETFUEL) (ROCKETFUEL)
1 1	52.57.150.20 52.57.150.20	16509 (AMAZON-02) (AMAZON-02)
2 2	52.18.12.237 52.18.12.237	16509 (AMAZON-02) (AMAZON-02)
8 8	151.101.14.49 151.101.14.49	54113 (FASTLY) (FASTLY)
1	69.173.144.138 69.173.144.138	26667 (RUBICONPR...) (RUBICONPROJECT)
1 2	2.18.234.21 2.18.234.21	16625 (AKAMAI-AS) (AKAMAI-AS)
1 2	185.33.221.53 185.33.221.53	29990 (ASN-APPNEX) (ASN-APPNEX)
1 2	35.244.159.8 35.244.159.8	15169 (GOOGLE) (GOOGLE)
1	185.64.189.110 185.64.189.110	62713 (AS-PUBMATIC) (AS-PUBMATIC)
1 2	185.94.180.125 185.94.180.125	35220 (SPOTX-AMS) (SPOTX-AMS)
1	2a03:2880:f12... 2a03:2880:f12d:181:face:b00c:0:25de	32934 (FACEBOOK) (FACEBOOK)
1 2	54.86.40.3 54.86.40.3	14618 (AMAZON-AES) (AMAZON-AES)
40	16

16 2606:4700::6812:7434 (United States)

ASN13335 (CLOUDFLARENET, US)

fa.citizensbank.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
assets.sitescdn.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
answersstatus.pagescdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 23.21.33.24 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-23-21-33-24.compute-1.amazonaws.com

www.yext-pixel.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 3.124.119.57 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-3-124-119-57.eu-central-1.compute.amazonaws.com

agility.citizensbank.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 18.200.233.208 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-18-200-233-208.eu-west-1.compute.amazonaws.com

dpm.demdex.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 18.197.253.20 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-18-197-253-20.eu-central-1.compute.amazonaws.com

nexus.ensighten.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.19.186.105 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-52-19-186-105.eu-west-1.compute.amazonaws.com

citizensbank.demdex.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 15.236.176.210 (Paris, France)

ASN16509 (AMAZON-02, US)
PTR: ec2-15-236-176-210.eu-west-3.compute.amazonaws.com

smetrics.citizensbank.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.51.88.158 (Dublin, Ireland) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-52-51-88-158.eu-west-1.compute.amazonaws.com

cm.everesttech.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 35.244.174.68 (Kansas City, United States) 2 redirects

ASN15169 (GOOGLE, US)
PTR: 68.174.244.35.bc.googleusercontent.com

idsync.rlcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.111.215.191 (Frankfurt am Main, Germany) 1 redirects

ASN16625 (AKAMAI-AS, US)
PTR: a104-111-215-191.deploy.static.akamaitechnologies.com

x.dlx.addthis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 172.217.18.98 (United States) 2 redirects

ASN15169 (GOOGLE, US)
PTR: zrh04s05-in-f98.1e100.net

cm.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 193.0.160.129 (United States) 1 redirects

ASN54312 (ROCKETFUEL, US)

p.rfihub.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.57.150.20 (Frankfurt am Main, Germany) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-52-57-150-20.eu-central-1.compute.amazonaws.com

ps.eyeota.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 52.18.12.237 (Dublin, Ireland) 2 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-52-18-12-237.eu-west-1.compute.amazonaws.com

sync.crwdcntrl.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 151.101.14.49 (Frankfurt am Main, Germany) 8 redirects

ASN54113 (FASTLY, US)

sync-tm.everesttech.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 69.173.144.138 (Frankfurt am Main, Germany)

ASN26667 (RUBICONPROJECT, US)

pixel.rubiconproject.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2.18.234.21 (Frankfurt am Main, Germany) 1 redirects

ASN16625 (AKAMAI-AS, US)
PTR: a2-18-234-21.deploy.static.akamaitechnologies.com

dsum-sec.casalemedia.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 185.33.221.53 (Amsterdam, Netherlands) 1 redirects

ASN29990 (ASN-APPNEX, US)
PTR: 718.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net

ib.adnxs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 35.244.159.8 (Kansas City, United States) 1 redirects

ASN15169 (GOOGLE, US)
PTR: 8.159.244.35.bc.googleusercontent.com

us-u.openx.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 185.64.189.110 (United Kingdom)

ASN62713 (AS-PUBMATIC, US)

image2.pubmatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 185.94.180.125 (Amsterdam, Netherlands) 1 redirects

ASN35220 (SPOTX-AMS, US)

sync.search.spotxchange.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a03:2880:f12d:181:face:b00c:0:25de (Frankfurt am Main, Germany)

ASN32934 (FACEBOOK, US)

www.facebook.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 54.86.40.3 (Ashburn, United States) 1 redirects

ASN14618 (AMAZON-AES, US)
PTR: ec2-54-86-40-3.compute-1.amazonaws.com

mid.rkdms.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
16	citizensbank.com fa.citizensbank.com agility.citizensbank.com smetrics.citizensbank.com	2 MB
9	everesttech.net 9 redirects cm.everesttech.net sync-tm.everesttech.net	2 KB
9	demdex.net dpm.demdex.net citizensbank.demdex.net	12 KB
3	doubleclick.net 2 redirects cm.g.doubleclick.net	920 B
2	rkdms.com 1 redirects mid.rkdms.com	71 B
2	spotxchange.com 1 redirects sync.search.spotxchange.com	1 KB
2	openx.net 1 redirects us-u.openx.net	469 B
2	adnxs.com 1 redirects ib.adnxs.com	2 KB
2	casalemedia.com 1 redirects dsum-sec.casalemedia.com	2 KB
2	crwdcntrl.net 2 redirects sync.crwdcntrl.net	1 KB
2	rlcdn.com 2 redirects idsync.rlcdn.com	803 B
2	ensighten.com nexus.ensighten.com	34 KB
2	sitescdn.net assets.sitescdn.net	217 KB
1	facebook.com www.facebook.com	1 KB
1	pubmatic.com image2.pubmatic.com	546 B
1	rubiconproject.com pixel.rubiconproject.com	239 B
1	eyeota.net 1 redirects ps.eyeota.net	418 B
1	rfihub.com 1 redirects p.rfihub.com	755 B
1	addthis.com 1 redirects x.dlx.addthis.com	175 B
1	pagescdn.com answersstatus.pagescdn.com	745 B
1	yext-pixel.com www.yext-pixel.com	229 B
40	21

	Domain	Requested by
13	fa.citizensbank.com	fa.citizensbank.com
8	sync-tm.everesttech.net	8 redirects
8	dpm.demdex.net	fa.citizensbank.com
3	cm.g.doubleclick.net	2 redirects fa.citizensbank.com
2	mid.rkdms.com	1 redirects
2	sync.search.spotxchange.com	1 redirects
2	us-u.openx.net	1 redirects
2	ib.adnxs.com	1 redirects fa.citizensbank.com
2	dsum-sec.casalemedia.com	1 redirects
2	sync.crwdcntrl.net	2 redirects
2	idsync.rlcdn.com	2 redirects
2	smetrics.citizensbank.com	fa.citizensbank.com
2	nexus.ensighten.com	agility.citizensbank.com
2	assets.sitescdn.net	fa.citizensbank.com assets.sitescdn.net
1	www.facebook.com	fa.citizensbank.com
1	image2.pubmatic.com	fa.citizensbank.com
1	pixel.rubiconproject.com	fa.citizensbank.com
1	ps.eyeota.net	1 redirects
1	p.rfihub.com	1 redirects
1	x.dlx.addthis.com	1 redirects
1	cm.everesttech.net	1 redirects
1	citizensbank.demdex.net	agility.citizensbank.com
1	answersstatus.pagescdn.com	fa.citizensbank.com
1	agility.citizensbank.com	fa.citizensbank.com
1	www.yext-pixel.com	fa.citizensbank.com
40	25

This site contains links to these domains. Also see Links.

Domain
www.citizensbank.com
brokercheck.finra.org
d1so5k0levrfcn.cloudfront.net
www.clarfeld.com
www.facebook.com
twitter.com
linkedin.com
youtube.com

Subject Issuer	Validity	Valid
fa.citizensbank.com Cloudflare Inc ECC CA-3	`2021-08-29` - `2022-08-28`	a year	crt.sh
sitescdn.net Cloudflare Inc ECC CA-3	`2021-02-04` - `2022-02-03`	a year	crt.sh
*.yext-pixel.com Amazon	`2021-08-17` - `2022-09-15`	a year	crt.sh
agility.citizensbank.com DigiCert TLS RSA SHA256 2020 CA1	`2020-11-17` - `2021-11-21`	a year	crt.sh
answersstatus.pagescdn.com Cloudflare Inc ECC CA-3	`2021-06-05` - `2022-06-04`	a year	crt.sh
*.demdex.net DigiCert TLS RSA SHA256 2020 CA1	`2020-12-02` - `2022-01-02`	a year	crt.sh
nexus.ensighten.com DigiCert SHA2 Secure Server CA	`2020-09-09` - `2021-10-11`	a year	crt.sh
smetrics.citizensbank.com DigiCert TLS RSA SHA256 2020 CA1	`2021-06-22` - `2022-07-23`	a year	crt.sh
*.g.doubleclick.net GTS CA 1C3	`2021-08-16` - `2021-11-08`	3 months	crt.sh
*.rubiconproject.com DigiCert TLS RSA SHA256 2020 CA1	`2021-03-30` - `2022-04-04`	a year	crt.sh
san.casalemedia.com GeoTrust RSA CA 2018	`2021-02-05` - `2022-02-09`	a year	crt.sh
*.adnxs.com GeoTrust ECC CA 2018	`2021-03-05` - `2022-02-19`	a year	crt.sh
*.openx.net GeoTrust RSA CA 2018	`2021-07-08` - `2022-08-08`	a year	crt.sh
*.pubmatic.com DigiCert Baltimore TLS RSA SHA256 2020 CA1	`2020-12-07` - `2021-12-14`	a year	crt.sh
*.search.spotxchange.com GeoTrust RSA CA 2018	`2021-04-08` - `2022-05-09`	a year	crt.sh
*.facebook.com DigiCert SHA2 High Assurance Server CA	`2021-07-20` - `2021-10-18`	3 months	crt.sh
*.rkdms.com Entrust Certification Authority - L1K	`2020-10-08` - `2021-10-30`	a year	crt.sh

This page contains 2 frames:

Primary Page: https://fa.citizensbank.com/
Frame ID: B2A4BE80A14300DEEB82A2A39CE515FA
Requests: 24 HTTP requests in this frame

Frame: https://citizensbank.demdex.net/dest5.html?d_nsid=0
Frame ID: F27D7B14E0F66F379F92CB9613CABF27
Requests: 16 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

All Citizens Wealth Management & Financial Planning Services Locations

Detected technologies

CloudFlare (CDN) Expand

Overall confidence: 100%
Detected patterns

headers server /^cloudflare$/i

Page Statistics

40
Requests

100 %
HTTPS

9 %
IPv6

21
Domains

25
Subdomains

16
IPs

6
Countries

2107 kB
Transfer

3643 kB
Size

6
Cookies

13 Outgoing links

These are links going to different origins than the main page.

URL: https://www.citizensbank.com/wealth-management/whycitizens.aspx
Title: Link to main website

Search URL Search Domain Scan URL

URL: https://brokercheck.finra.org/
Title: FINRA's BrokerCheck

Search URL Search Domain Scan URL

URL: https://www.citizensbank.com/assets/pdf/iv/CIS-DisasterRecoveryPlan.3.11.11.pdf
Title: Citizens Securities, Inc. Business Continuity Plan Link Opens in New Tab

Search URL Search Domain Scan URL

URL: https://www.citizensbank.com/pdf/iv/MEGA-NE1-2.pdf
Title: Citizens Securities, Inc. Quarterly Trade Execution Report Link Opens in New Tab

Search URL Search Domain Scan URL

URL: https://www.citizensbank.com/assets/CB_PDF/CitizensSecuritiesIncFormADVDisclosureBrochure.pdf
Title: Citizens Securities, Inc. Form ADV Disclosure Brochure Link Opens in New Tab

Search URL Search Domain Scan URL

URL: https://d1so5k0levrfcn.cloudfront.net/citizens/Disclosure+Brochure+and+Form+ADV.pdf
Title: Citizens Securities, Inc. Digital Advisory Program Form ADV Disclosure Brochure Link Opens in New Tab

Search URL Search Domain Scan URL

URL: https://www.citizensbank.com/assets/CB_PDF/RegBI_Disclosure.pdf
Title: Reg.BI Disclosure Link Opens in New Tab

Search URL Search Domain Scan URL

URL: https://www.clarfeld.com/Content/assets/pdfs/form-adv.pdf
Title: Clarfeld Financial Advisors, LLC Form ADV Disclosure Brochure Link Opens in New Tab

Search URL Search Domain Scan URL

URL: https://www.citizensbank.com/assets/CB_PDF/monthly-order-flow.pdf
Title: Monthly Order Flow Link Opens in New Tab

Search URL Search Domain Scan URL

URL: https://www.facebook.com/citizensbank
Title: Link Opens in New Tab

Search URL Search Domain Scan URL

URL: https://twitter.com/citizensbank
Title: Link Opens in New Tab

Search URL Search Domain Scan URL

URL: https://linkedin.com/company/citizens-bank
Title: Link Opens in New Tab

Search URL Search Domain Scan URL

URL: https://youtube.com/citizensbank
Title: Link Opens in New Tab

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 21

https://cm.everesttech.net/cm/dd?d_uuid=09542571185199679022123098596376571057 HTTP 302
https://dpm.demdex.net/ibs:dpid=411&dpuuid=YSt-BwAAAIhs0QP7

Request Chain 23

https://idsync.rlcdn.com/365868.gif?partner_uid=09542571185199679022123098596376571057 HTTP 307
https://idsync.rlcdn.com/1000.gif?memo=CKyqFhIxCi0IARCYEhomMDk1NDI1NzExODUxOTk2NzkwMjIxMjMwOTg1OTYzNzY1NzEwNTcQABoNCIf-rYkGEgUI6AcQAEIASgA HTTP 307
https://dpm.demdex.net/ibs:dpid=477&dpuuid=04eba8f3840103e0886903e98eecef9b87134c72135fac7356be01923fe1295fb0da87c991749652

Request Chain 24

https://x.dlx.addthis.com/e/demdex_sync?na_exid=09542571185199679022123098596376571057&ru=https%3A%2F%2Fdpm.demdex.net%2Fibs%3Adpid%3D134096%26dpuuid%3D%3Cna_id%3E%20 HTTP 301
https://dpm.demdex.net/ibs:dpid=134096&dpuuid=2021082912352000016588551059

Request Chain 25

https://cm.g.doubleclick.net/pixel?google_nid=adobe_dmp&google_cm&gdpr=0&gdpr_consent=&google_hm=MDk1NDI1NzExODUxOTk2NzkwMjIxMjMwOTg1OTYzNzY1NzEwNTc= HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=adobe_dmp&google_cm=&gdpr=0&gdpr_consent=&google_hm=MDk1NDI1NzExODUxOTk2NzkwMjIxMjMwOTg1OTYzNzY1NzEwNTc=&google_tc= HTTP 302
https://dpm.demdex.net/ibs:dpid=771&dpuuid=CAESEITjVMKW9zFUPlAaNladYNA&google_cver=1?gdpr=0&gdpr_consent=

Request Chain 26

https://p.rfihub.com/cm?in=1&pub=7085 HTTP 302
https://dpm.demdex.net/ibs:dpid=1121&dpuuid=2159827873545062039

Request Chain 27

https://ps.eyeota.net/match?bid=6j5b2cv&uid=09542571185199679022123098596376571057&r=https%3A%2F%2Fdpm.demdex.net%2Fibs%3Adpid%3D30064%26dpuuid%3D%7BUUID_6j5b2cv%7D HTTP 302
https://dpm.demdex.net/ibs:dpid=30064&dpuuid=%7BUUID_6j5b2cv%7D

Request Chain 28

https://sync.crwdcntrl.net/map/c=9828/tp=ADBE/tpid=09542571185199679022123098596376571057?https%3A%2F%2Fdpm.demdex.net%2Fibs%3Adpid%3D121998%26dpuuid%3D${profile_id} HTTP 302
https://sync.crwdcntrl.net/map/ct=y/c=9828/tp=ADBE/tpid=09542571185199679022123098596376571057?https%3A%2F%2Fdpm.demdex.net%2Fibs%3Adpid%3D121998%26dpuuid%3D${profile_id} HTTP 302
https://dpm.demdex.net/ibs:dpid=121998&dpuuid=ab2298283fd31df4edfaaa01374f394a

Request Chain 29

https://sync-tm.everesttech.net/upi/pid/5w3jqr4k?redir=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dg8f47s39e399f3fe%26google_push%26google_sc%26google_hm%3D%24%7BTM_USER_ID_BASE64ENC_URLENC%7D HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=g8f47s39e399f3fe&google_push&google_sc&google_hm=WVN0LUJ3QUFBSWhzMFFQNw==

Request Chain 30

https://sync-tm.everesttech.net/upi/pid/btu4jd3a?redir=https%3A%2F%2Fpixel.rubiconproject.com%2Ftap.php%3Fv%3D7941%26nid%3D2243%26put%3D%24%7BUSER_ID%7D%26expires%3D90 HTTP 302
https://pixel.rubiconproject.com/tap.php?v=7941&nid=2243&put=YSt-BwAAAIhs0QP7&expires=90

Request Chain 31

https://sync-tm.everesttech.net/upi/pid/ZMAwryCI?redir=https%3A%2F%2Fdsum-sec.casalemedia.com%2Frum%3Fcm_dsp_id%3D88%26external_user_id%3D%24%7BTM_USER_ID%7D HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=88&external_user_id=YSt-BwAAAIhs0QP7 HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=88&external_user_id=YSt-BwAAAIhs0QP7&C=1

Request Chain 32

https://sync-tm.everesttech.net/upi/pid/UH6TUt9n?redir=https%3A%2F%2Fib.adnxs.com%2Fsetuid%3Fentity%3D158%26code%3D%24%7BTM_USER_ID%7D HTTP 302
https://ib.adnxs.com/setuid?entity=158&code=YSt-BwAAAIhs0QP7 HTTP 307
https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D158%26code%3DYSt-BwAAAIhs0QP7

Request Chain 33

https://sync-tm.everesttech.net/upi/pid/ny75r2x0?redir=https%3A%2F%2Fus-u.openx.net%2Fw%2F1.0%2Fsd%3Fid%3D537148856%26val%3D%24%7BTM_USER_ID%7D HTTP 302
https://us-u.openx.net/w/1.0/sd?id=537148856&val=YSt-BwAAAIhs0QP7 HTTP 302
https://us-u.openx.net/w/1.0/sd?cc=1&id=537148856&val=YSt-BwAAAIhs0QP7

Request Chain 34

https://sync-tm.everesttech.net/upi/pid/b9pj45k4?redir=https%3A%2F%2Fimage2.pubmatic.com%2FAdServer%2FPug%3Fvcode%3Dbz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA%3D%26piggybackCookie%3D%24%7BUSER_ID%7D HTTP 302
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA=&piggybackCookie=YSt-BwAAAIhs0QP7

Request Chain 35

https://sync-tm.everesttech.net/upi/pid/h0r58thg?redir=https%3A%2F%2Fsync.search.spotxchange.com%2Fpartner%3Fadv_id%3D6409%26uid%3D%24%7BUSER_ID%7D%26img%3D1 HTTP 302
https://sync.search.spotxchange.com/partner?adv_id=6409&uid=YSt-BwAAAIhs0QP7&img=1 HTTP 302
https://sync.search.spotxchange.com/partner?adv_id=6409&uid=YSt-BwAAAIhs0QP7&img=1&__user_check__=1&sync_id=935d06ff-08c5-11ec-93f5-1348667f0506

Request Chain 36

https://sync-tm.everesttech.net/upi/pid/r7ifn0SL?redir=https%3A%2F%2Fwww.facebook.com%2Ffr%2Fb.php%3Fp%3D1531105787105294%26e%3D%24%7BTM_USER_ID%7D%26t%3D2592000%26o%3D0 HTTP 302
https://www.facebook.com/fr/b.php?p=1531105787105294&e=YSt-BwAAAIhs0QP7&t=2592000&o=0

Request Chain 37

https://mid.rkdms.com/bct?pid=8bc436aa-e0fc-4baa-9c9a-06fbeca87826&puid=09542571185199679022123098596376571057&_ct=img HTTP 302
https://mid.rkdms.com/restricted

40 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request / Show response
fa.citizensbank.com/ 94 KB
13 KB 97ms
18ms Document
text/html 2606:4700::6812:7434
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://fa.citizensbank.com/

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700::6812:7434 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

3a93befc26b117595f6568824a346bfa6ba15b69e1ef1bd4c712c50f0f9cc4ce

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

:method: GET
:authority: fa.citizensbank.com
:scheme: https
:path: /
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: none
sec-fetch-mode: navigate
sec-fetch-user: ?1
sec-fetch-dest: document
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Sun, 29 Aug 2021 12:35:18 GMT
content-type: text/html; charset=utf-8
cache-control: max-age=0, s-maxage=7200, must-revalidate
content-encoding: gzip
etag: "d91be43edd141e43af04eec6a5b3f2bb"-gzip
last-modified: Fri, 30 Jul 2021 16:20:40 GMT
owner: sitescog-4164
redirectstableidentifier: 4164:State - City Drilldown:en:0:
strict-transport-security: max-age=31536000; includeSubDomains
surrogate-key: fa.citizensbank.com fa.citizensbank.com%2Findex.html
vary: Accept-Encoding
x-amz-id-2: V15AdCXa+wwPDdxU4ksUwJxxfGD/Ci0N7CBRVev6Ujmt+foN1nn4gOhwwnHlt57Z/U21Nq6o8LY=
x-amz-request-id: 1Q885DRA0NK5ZPKA
x-amz-server-side-encryption: AES256
x-amz-version-id: null
x-yext-site: us2
x-yext-subendpoint: static
cf-cache-status: HIT
age: 1
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server: cloudflare
cf-ray: 6865d1864a37c29f-FRA

GET
H2 200 en.7f132d66.js Show response
fa.citizensbank.com/permanent-b0b701/primary/stateList/ 374 KB
116 KB 119ms
119ms Script
application/javascript 2606:4700::6812:7434
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://fa.citizensbank.com/permanent-b0b701/primary/stateList/en.7f132d66.js

Requested by

Host: fa.citizensbank.com
URL: https://fa.citizensbank.com/

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700::6812:7434 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

b3a65ca95b1810718aaae1cb7a06aaa63d72c40b6020497de794fb632209ea32

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

:path: /permanent-b0b701/primary/stateList/en.7f132d66.js
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: fa.citizensbank.com
referer: https://fa.citizensbank.com/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://fa.citizensbank.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Sun, 29 Aug 2021 12:35:18 GMT
content-encoding: gzip
vary: Accept-Encoding
cf-cache-status: HIT
x-amz-request-id: 07X11FKQVRBT62Y0
x-amz-server-side-encryption: AES256
cf-ray: 6865d1866a78c29f-FRA
x-yext-subendpoint: static
x-amz-version-id: null
x-amz-id-2: F3jZ2VU54D9icK51OOEhMtpD40MN61z24fm5w5zQ0D8o6of9DQRUNY2mIU7l2p8J1mBXJpY3IOU=
surrogate-key: fa.citizensbank.com fa.citizensbank.com%2Fpermanent-b0b701%2Fprimary%2FstateList%2Fen.7f132d66.js
last-modified: Fri, 30 Jul 2021 16:20:39 GMT
server: cloudflare
etag: "cfbe2596e0ca268da159db4ffd274738"-gzip
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains
x-yext-site: jp2
cache-control: max-age=31536000
content-type: application/javascript
owner: sitescog-4164

GET
H2 200 answers.min.js Show response
assets.sitescdn.net/answers/v1.4.2/ 536 KB
158 KB 66ms
39ms Script
application/javascript 2606:4700::6812:7434
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.sitescdn.net/answers/v1.4.2/answers.min.js
Requested by: Host: fa.citizensbank.com
URL: https://fa.citizensbank.com/
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 2606:4700::6812:7434 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b0ff2a24a4fc772a1c0b4ca4898ef5d33e1c4deb243ad0f6be8dee086ca6f5c0

Request headers

Referer: https://fa.citizensbank.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Sun, 29 Aug 2021 12:35:18 GMT
content-encoding: gzip
cf-cache-status: HIT
last-modified: Mon, 29 Jun 2020 21:51:51 GMT
server: cloudflare
age: 10768474
etag: W/"7d430a129f2cc724d0492664998b5e50"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=31536000
cf-ray: 6865d1869b0e4a86-FRA
x-amz-request-id: X9EK0C6T2G64YBJF
x-amz-id-2: 9Lfhq2xYNbAy6KMy0MEVQe8qNFqZNXfBRvbEbyopAYykZZL37NkrXTWtQ3jRsHUICcKFwWGrj4A=

GET
H2 200 logo.baed3369.png
fa.citizensbank.com/permanent-b0b701/assets/icons/ 30 KB
30 KB 128ms
127ms Image
image/png 2606:4700::6812:7434
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://fa.citizensbank.com/permanent-b0b701/assets/icons/logo.baed3369.png

Requested by

Host: fa.citizensbank.com
URL: https://fa.citizensbank.com/

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700::6812:7434 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

3d8eb9b918bb1e5fbd80ba5ea838387fbf00afecf47e90045df6ba8b8ea07f1d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

:path: /permanent-b0b701/assets/icons/logo.baed3369.png
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: fa.citizensbank.com
referer: https://fa.citizensbank.com/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://fa.citizensbank.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Sun, 29 Aug 2021 12:35:18 GMT
vary: Accept-Encoding
cf-cache-status: HIT
x-amz-request-id: ZT5C2DTGRT31TRRR
x-amz-server-side-encryption: AES256
cf-ray: 6865d1867a8bc29f-FRA
x-yext-subendpoint: static
content-length: 30866
x-amz-version-id: null
x-amz-id-2: TNWEbV5kcX5jGwb8m2fUVCuWLNV/8DM9Ipo6UIdWiCxE6LKmTbab77JaUS3m9F+cpkfwVWpbtWQ=
surrogate-key: fa.citizensbank.com fa.citizensbank.com%2Fpermanent-b0b701%2Fassets%2Ficons%2Flogo.baed3369.png
last-modified: Wed, 02 Dec 2020 19:27:22 GMT
server: cloudflare
etag: "1a65dbbe2730c17349243cb83754059a"-gzip
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains
x-yext-site: us2
cache-control: max-age=31536000
accept-ranges: bytes
content-type: image/png
owner: sitescog-4164

GET
H2 200 search.9942daab.svg
fa.citizensbank.com/permanent-b0b701/assets/icons/ 663 B
626 B 117ms
116ms Image
image/svg+xml 2606:4700::6812:7434
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://fa.citizensbank.com/permanent-b0b701/assets/icons/search.9942daab.svg

Requested by

Host: fa.citizensbank.com
URL: https://fa.citizensbank.com/

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700::6812:7434 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

7636f9be9a744b7c05f402ef8f35040fd84ffef490313c5e1752b0208e0ee2a7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

:path: /permanent-b0b701/assets/icons/search.9942daab.svg
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: fa.citizensbank.com
referer: https://fa.citizensbank.com/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://fa.citizensbank.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Sun, 29 Aug 2021 12:35:18 GMT
content-encoding: gzip
vary: Accept-Encoding
cf-cache-status: HIT
x-amz-request-id: ZT5C38EQ55G3JHFT
x-amz-server-side-encryption: AES256
cf-ray: 6865d1867a8cc29f-FRA
x-yext-subendpoint: static
content-length: 357
x-amz-version-id: null
x-amz-id-2: rlnIWD06m5/BhGxLKwQWCYpeYCVbzw+JT8Y7TijHf010xwAaMdt1AhzEZwFqkRTmSUl+eVRp3IE=
surrogate-key: fa.citizensbank.com fa.citizensbank.com%2Fpermanent-b0b701%2Fassets%2Ficons%2Fsearch.9942daab.svg
last-modified: Wed, 02 Dec 2020 19:27:22 GMT
server: cloudflare
etag: "916f6d85dc2ea2cf8a63531650c45dcf"-gzip
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains
x-yext-site: us2
cache-control: max-age=31536000
accept-ranges: bytes
content-type: image/svg+xml
owner: sitescog-4164

GET
H2 200 close.19c361b7.svg
fa.citizensbank.com/permanent-b0b701/assets/icons/ 804 B
681 B 113ms
112ms Image
image/svg+xml 2606:4700::6812:7434
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://fa.citizensbank.com/permanent-b0b701/assets/icons/close.19c361b7.svg

Requested by

Host: fa.citizensbank.com
URL: https://fa.citizensbank.com/

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700::6812:7434 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

6a0b4faa974fc3f8e3b747b8d84e404db767b11b4239e1fb58931f2f3d440431

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

:path: /permanent-b0b701/assets/icons/close.19c361b7.svg
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: fa.citizensbank.com
referer: https://fa.citizensbank.com/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://fa.citizensbank.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Sun, 29 Aug 2021 12:35:18 GMT
content-encoding: gzip
vary: Accept-Encoding
cf-cache-status: HIT
x-amz-request-id: ZT5FJRPP9HTEQ2KW
x-amz-server-side-encryption: AES256
cf-ray: 6865d1867a8ec29f-FRA
x-yext-subendpoint: static
content-length: 367
x-amz-version-id: null
x-amz-id-2: 5KN+jM6O9IPENJ1ZBElE6dB7vMLUgeW/3dGz9NO6Nr3GFOEyKMh8cfSzyB6CXagayUkazNK6Gss=
surrogate-key: fa.citizensbank.com fa.citizensbank.com%2Fpermanent-b0b701%2Fassets%2Ficons%2Fclose.19c361b7.svg
last-modified: Wed, 02 Dec 2020 19:27:22 GMT
server: cloudflare
etag: "31eb9592ff51c384be1797f25edeaee2"-gzip
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains
x-yext-site: us2
cache-control: max-age=31536000
accept-ranges: bytes
content-type: image/svg+xml
owner: sitescog-4164

GET
H2 200 facebook.076099e8.png
fa.citizensbank.com/permanent-b0b701/assets/icons/ 560 B
811 B 139ms
138ms Image
image/png 2606:4700::6812:7434
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://fa.citizensbank.com/permanent-b0b701/assets/icons/facebook.076099e8.png

Requested by

Host: fa.citizensbank.com
URL: https://fa.citizensbank.com/

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700::6812:7434 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

ddd9392f55158029e9f2b00e892c50a36b17ad6771ff94b20e68e2bd642fc653

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

:path: /permanent-b0b701/assets/icons/facebook.076099e8.png
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: fa.citizensbank.com
referer: https://fa.citizensbank.com/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://fa.citizensbank.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Sun, 29 Aug 2021 12:35:18 GMT
vary: Accept-Encoding
cf-cache-status: HIT
x-amz-request-id: ZT5DHJPP8KTV9GR1
x-amz-server-side-encryption: AES256
cf-ray: 6865d1867a90c29f-FRA
x-yext-subendpoint: static
content-length: 560
x-amz-version-id: null
x-amz-id-2: 3EPAwSqyWGW5hzghoc6FDw3j2uvccT4LOODDp2eZBQ6L/exQHMBuuRYu79el376Kwb3pRLqwELs=
surrogate-key: fa.citizensbank.com fa.citizensbank.com%2Fpermanent-b0b701%2Fassets%2Ficons%2Ffacebook.076099e8.png
last-modified: Wed, 02 Dec 2020 19:27:22 GMT
server: cloudflare
etag: "da67ea1d63ea716edd4ed6c348607b96"-gzip
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains
x-yext-site: us2
cache-control: max-age=31536000
accept-ranges: bytes
content-type: image/png
owner: sitescog-4164

GET
H2 200 twitter.10273c79.png
fa.citizensbank.com/permanent-b0b701/assets/icons/ 669 B
972 B 129ms
129ms Image
image/png 2606:4700::6812:7434
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://fa.citizensbank.com/permanent-b0b701/assets/icons/twitter.10273c79.png

Requested by

Host: fa.citizensbank.com
URL: https://fa.citizensbank.com/

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700::6812:7434 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

09373adae1e7d02cf324377e3f50e1059348fd9b30176e04d984bd943ac8cf20

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

:path: /permanent-b0b701/assets/icons/twitter.10273c79.png
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: fa.citizensbank.com
referer: https://fa.citizensbank.com/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://fa.citizensbank.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Sun, 29 Aug 2021 12:35:18 GMT
vary: Accept-Encoding
cf-cache-status: HIT
x-amz-request-id: ZT5216XX2H30VZMC
x-amz-server-side-encryption: AES256
cf-ray: 6865d1867a92c29f-FRA
x-yext-subendpoint: static
content-length: 669
x-amz-version-id: null
x-amz-id-2: RblIeYYPYKp85RD1yQbYgm2tJTjrjZXKKKmbMjDqQTHKewD1g3Tl2j9S6+MgmOWJVFCBXO0IbMQ=
surrogate-key: fa.citizensbank.com fa.citizensbank.com%2Fpermanent-b0b701%2Fassets%2Ficons%2Ftwitter.10273c79.png
last-modified: Wed, 02 Dec 2020 19:27:22 GMT
server: cloudflare
etag: "172364ffb4ac3c59a9e769e968645e8c"-gzip
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains
x-yext-site: us2
cache-control: max-age=31536000
accept-ranges: bytes
content-type: image/png
owner: sitescog-4164

GET
H2 200 linkedin.3cbd7675.png
fa.citizensbank.com/permanent-b0b701/assets/icons/ 636 B
898 B 117ms
116ms Image
image/png 2606:4700::6812:7434
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://fa.citizensbank.com/permanent-b0b701/assets/icons/linkedin.3cbd7675.png

Requested by

Host: fa.citizensbank.com
URL: https://fa.citizensbank.com/

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700::6812:7434 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

afcaed2060508f0e2547af967979f7a785ed5e30d9afafc5584c6d1c635400ae

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

:path: /permanent-b0b701/assets/icons/linkedin.3cbd7675.png
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: fa.citizensbank.com
referer: https://fa.citizensbank.com/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://fa.citizensbank.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Sun, 29 Aug 2021 12:35:18 GMT
vary: Accept-Encoding
cf-cache-status: HIT
x-amz-request-id: ZT50K6B8HEP3ERSX
x-amz-server-side-encryption: AES256
cf-ray: 6865d1867a93c29f-FRA
x-yext-subendpoint: static
content-length: 636
x-amz-version-id: null
x-amz-id-2: zFb+Q5GVpMDlZpz2kKlvrt6iMtf6M3PKQyTUEIjyV8x9LMsowFIG5WbkN5nIvDumdgnUv0PfvWw=
surrogate-key: fa.citizensbank.com fa.citizensbank.com%2Fpermanent-b0b701%2Fassets%2Ficons%2Flinkedin.3cbd7675.png
last-modified: Wed, 02 Dec 2020 19:27:22 GMT
server: cloudflare
etag: "aec3ccef4d3334dd32965e95383e3f89"-gzip
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains
x-yext-site: us2
cache-control: max-age=31536000
accept-ranges: bytes
content-type: image/png
owner: sitescog-4164

GET
H2 200 youtube.deb12b0a.png
fa.citizensbank.com/permanent-b0b701/assets/icons/ 639 B
889 B 118ms
118ms Image
image/png 2606:4700::6812:7434
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://fa.citizensbank.com/permanent-b0b701/assets/icons/youtube.deb12b0a.png

Requested by

Host: fa.citizensbank.com
URL: https://fa.citizensbank.com/

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700::6812:7434 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

4fda2773a559f9a364698bda996961eb784bb730ce34d00dd865281c25c94e6c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

:path: /permanent-b0b701/assets/icons/youtube.deb12b0a.png
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: fa.citizensbank.com
referer: https://fa.citizensbank.com/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://fa.citizensbank.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Sun, 29 Aug 2021 12:35:18 GMT
vary: Accept-Encoding
cf-cache-status: HIT
x-amz-request-id: ZT533TQ12PQYK2MB
x-amz-server-side-encryption: AES256
cf-ray: 6865d1867a94c29f-FRA
x-yext-subendpoint: static
content-length: 639
x-amz-version-id: null
x-amz-id-2: a7hKXiAQKaGbOmGMXB8H/hTm50C1a4InSs1RGcvXgx6tvJyCIlTH2DqW+QXpRYqcExIA5RC6ug8=
surrogate-key: fa.citizensbank.com fa.citizensbank.com%2Fpermanent-b0b701%2Fassets%2Ficons%2Fyoutube.deb12b0a.png
last-modified: Wed, 02 Dec 2020 19:27:22 GMT
server: cloudflare
etag: "fb29418c8ee356b7c919becd645d34eb"-gzip
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains
x-yext-site: us2
cache-control: max-age=31536000
accept-ranges: bytes
content-type: image/png
owner: sitescog-4164

GET
H2 200 background.76a903c4.jpg
fa.citizensbank.com/permanent-b0b701/assets/images/ 1 MB
1 MB 1039ms
1039ms Image
image/jpeg 2606:4700::6812:7434
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://fa.citizensbank.com/permanent-b0b701/assets/images/background.76a903c4.jpg

Requested by

Host: fa.citizensbank.com
URL: https://fa.citizensbank.com/

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700::6812:7434 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

357ed9cbd91e02a80f4f0467860fc4e6033f80e535ba090415ed56fd2ca3787e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

:path: /permanent-b0b701/assets/images/background.76a903c4.jpg
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: fa.citizensbank.com
referer: https://fa.citizensbank.com/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://fa.citizensbank.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Sun, 29 Aug 2021 12:35:19 GMT
vary: Accept-Encoding
cf-cache-status: MISS
x-guploader-uploadid: ADPycdsSkaGe_4C_rDRqtG6t6Fau0ItO40D2MuewKMS5MHLgZfTqX2iKVwSXuVB1-Vbe7PSQimjeUkcPjkfoNPqGs6c
x-goog-storage-class: STANDARD
x-goog-metageneration: 1
x-yext-subendpoint: static
x-goog-stored-content-encoding: identity
content-type: image/jpeg
content-length: 1269470
surrogate-key: fa.citizensbank.com fa.citizensbank.com%2Fpermanent-b0b701%2Fassets%2Fimages%2Fbackground.76a903c4.jpg
last-modified: Wed, 02 Dec 2020 19:27:21 GMT
server: cloudflare
etag: "4a017838e0bb449f65d8e30f950e758a"-gzip
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains
x-goog-hash: md5=SgF4OOC7RJ9l2OMPlQ51ig==
x-yext-site: gcp-euw3a-prod
x-goog-generation: 1606937241923552
cache-control: max-age=31536000
x-goog-stored-content-length: 1269470
accept-ranges: bytes
cf-ray: 6865d1867a95c29f-FRA
owner: sitescog-4164
expires: Sun, 29 Aug 2021 12:35:18 GMT

GET
H2 200 FiraSans-Regular.5107932f.ttf
fa.citizensbank.com/permanent-b0b701/assets/fonts/ 394 KB
182 KB 18ms
18ms Font
application/font-sfnt 2606:4700::6812:7434
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://fa.citizensbank.com/permanent-b0b701/assets/fonts/FiraSans-Regular.5107932f.ttf

Requested by

Host: fa.citizensbank.com
URL: https://fa.citizensbank.com/

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700::6812:7434 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

a389cef71891df1232370fcebd7cfde5f74e741967070399adc91fd069b2094b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

:path: /permanent-b0b701/assets/fonts/FiraSans-Regular.5107932f.ttf
pragma: no-cache
origin: https://fa.citizensbank.com
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode: cors
accept: */*
cache-control: no-cache
sec-fetch-dest: font
:authority: fa.citizensbank.com
referer: https://fa.citizensbank.com/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Origin: https://fa.citizensbank.com
Referer: https://fa.citizensbank.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Sun, 29 Aug 2021 12:35:18 GMT
content-encoding: gzip
vary: Accept-Encoding
cf-cache-status: HIT
age: 11957
x-guploader-uploadid: ADPycds7jkHSAypQeJGFt_Hqz70nOVHug5xAz_03SehgPn07jeQBflrNhOMxBPMavn0OvUh1Nwz2nhbdS9FGkduqSiA
x-goog-storage-class: STANDARD
x-goog-metageneration: 1
x-yext-subendpoint: static
x-goog-stored-content-encoding: identity
content-type: application/font-sfnt
surrogate-key: fa.citizensbank.com fa.citizensbank.com%2Fpermanent-b0b701%2Fassets%2Ffonts%2FFiraSans-Regular.5107932f.ttf
last-modified: Wed, 02 Dec 2020 19:27:21 GMT
server: cloudflare
etag: W/"b0aa1958e34c16cede8af5643a9c285c"-gzip
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains
x-goog-hash: md5=sKoZWONMFs7eivVkOpwoXA==
x-yext-site: gcp-euw3a-prod
x-goog-generation: 1606937241859686
cache-control: max-age=31536000
x-goog-stored-content-length: 403924
cf-ray: 6865d1867a97c29f-FRA
owner: sitescog-4164
expires: Sun, 29 Aug 2021 08:43:04 GMT

GET
H2 200 citisans-webfont_1-webfont.fc6d1502.ttf
fa.citizensbank.com/permanent-b0b701/assets/fonts/ 44 KB
25 KB 22ms
22ms Font
application/font-sfnt 2606:4700::6812:7434
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://fa.citizensbank.com/permanent-b0b701/assets/fonts/citisans-webfont_1-webfont.fc6d1502.ttf

Requested by

Host: fa.citizensbank.com
URL: https://fa.citizensbank.com/

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700::6812:7434 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

44132f3390f53c7bd4ddb00c1d0430f43ad46581dea45055a892cadf762a1919

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

:path: /permanent-b0b701/assets/fonts/citisans-webfont_1-webfont.fc6d1502.ttf
pragma: no-cache
origin: https://fa.citizensbank.com
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode: cors
accept: */*
cache-control: no-cache
sec-fetch-dest: font
:authority: fa.citizensbank.com
referer: https://fa.citizensbank.com/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Origin: https://fa.citizensbank.com
Referer: https://fa.citizensbank.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Sun, 29 Aug 2021 12:35:18 GMT
content-encoding: gzip
vary: Accept-Encoding
cf-cache-status: HIT
age: 11957
x-guploader-uploadid: ADPycduA9CNzgTkrdeoJZ8lqZr8v09TbOIeMQ1SjRQY5OA7UoBC_flskLchmYrwJb1i4Dzzba3LCMjRoJVQbz9KAxHh0BpKDhA
x-goog-storage-class: STANDARD
x-goog-metageneration: 1
x-yext-subendpoint: static
x-goog-stored-content-encoding: identity
content-type: application/font-sfnt
surrogate-key: fa.citizensbank.com fa.citizensbank.com%2Fpermanent-b0b701%2Fassets%2Ffonts%2Fcitisans-webfont_1-webfont.fc6d1502.ttf
last-modified: Wed, 02 Dec 2020 19:27:21 GMT
server: cloudflare
etag: W/"d15ba5ec6e37ab7e6ae5003ca0208c19"-gzip
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains
x-goog-hash: md5=0Vul7G43q35q5QA8oCCMGQ==
x-yext-site: gcp-euw3a-prod
x-goog-generation: 1606937241777769
cache-control: max-age=31536000
x-goog-stored-content-length: 44720
cf-ray: 6865d1868aa8c29f-FRA
owner: sitescog-4164
expires: Sun, 29 Aug 2021 08:43:03 GMT

GET
H2 200 FiraSans-Medium.46e414be.ttf
fa.citizensbank.com/permanent-b0b701/assets/fonts/ 395 KB
186 KB 24ms
24ms Font
application/font-sfnt 2606:4700::6812:7434
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://fa.citizensbank.com/permanent-b0b701/assets/fonts/FiraSans-Medium.46e414be.ttf

Requested by

Host: fa.citizensbank.com
URL: https://fa.citizensbank.com/

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700::6812:7434 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

1fe7499bd5d53879025c7d3f1220ba975b820eb214176cfb7d9e423ec671f28d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

:path: /permanent-b0b701/assets/fonts/FiraSans-Medium.46e414be.ttf
pragma: no-cache
origin: https://fa.citizensbank.com
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode: cors
accept: */*
cache-control: no-cache
sec-fetch-dest: font
:authority: fa.citizensbank.com
referer: https://fa.citizensbank.com/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Origin: https://fa.citizensbank.com
Referer: https://fa.citizensbank.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Sun, 29 Aug 2021 12:35:18 GMT
content-encoding: gzip
vary: Accept-Encoding
cf-cache-status: HIT
age: 11957
x-guploader-uploadid: ADPycdvCVfaODEGL1SCOsiKMQyDP_RZhxWsAidFAjeHz4WNbErY4JYU-QcftD_TO1kb3--7Jj6YXeFiDhVy8dZz5eyz6dFNzmA
x-goog-storage-class: STANDARD
x-goog-metageneration: 1
x-yext-subendpoint: static
x-goog-stored-content-encoding: identity
content-type: application/font-sfnt
surrogate-key: fa.citizensbank.com fa.citizensbank.com%2Fpermanent-b0b701%2Fassets%2Ffonts%2FFiraSans-Medium.46e414be.ttf
last-modified: Wed, 02 Dec 2020 19:27:21 GMT
server: cloudflare
etag: W/"54b83b537f536ffab4528d8a635f865d"-gzip
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains
x-goog-hash: md5=VLg7U39Tb/q0Uo2KY1+GXQ==
x-yext-site: gcp-euw3a-prod
x-goog-generation: 1606937241870140
cache-control: max-age=31536000
x-goog-stored-content-length: 404728
cf-ray: 6865d1868aaac29f-FRA
owner: sitescog-4164
expires: Sun, 29 Aug 2021 08:43:06 GMT

GET
H2 200 answerstemplates.compiled.min.js Show response
assets.sitescdn.net/answers/v1.4.2/ 293 KB
59 KB 21ms
20ms Script
application/javascript 2606:4700::6812:7434
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.sitescdn.net/answers/v1.4.2/answerstemplates.compiled.min.js
Requested by: Host: assets.sitescdn.net
URL: https://assets.sitescdn.net/answers/v1.4.2/answers.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 2606:4700::6812:7434 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 08d5dfb025517ed5570ecb83b0c255e545dcff53d76981e140edb829ddc1c358

Request headers

Referer: https://fa.citizensbank.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Sun, 29 Aug 2021 12:35:18 GMT
content-encoding: gzip
cf-cache-status: HIT
last-modified: Mon, 29 Jun 2020 21:51:51 GMT
server: cloudflare
age: 10768438
etag: W/"4f6efd2f1ad26c04f2d2b5c122c61b01"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=31536000
cf-ray: 6865d1875c514a86-FRA
x-amz-request-id: FQHAY81BH62BJF0D
x-amz-id-2: k3dT88Zocv9GrJo98Rv1TQNku1CY7POD2CMJiVsdKNupS4iSGcalIsgoEB9ti8PNxrQ6t2QYSuk=

GET
H2 200 store_pagespixel
www.yext-pixel.com/ 43 B
229 B 670ms
393ms Image
image/gif 23.21.33.24
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.yext-pixel.com/store_pagespixel?product=storepages&v=1630240518722&pageurl=%2F&pagesReferrer=&businessids=1049031&siteId=4164&isStaging=false&directoryId=State%20-%20City%20Drilldown&directoryPath=&eventType=pageview

Requested by

Host: fa.citizensbank.com
URL: https://fa.citizensbank.com/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

23.21.33.24 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-23-21-33-24.compute-1.amazonaws.com

Software

Resource Hash

42cb846e07917f6731406e500f24aeb2e88c42cda124eaa59e08c5331cad8bcb

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://fa.citizensbank.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 29 Aug 2021 12:35:18 GMT
cache-control: no-cache, must-revalidate
expires: Fri, 01 Jan 1990 00:00:00 GMT
content-length: 43
strict-transport-security: max-age=31536000; includeSubDomains
content-type: image/gif

GET
H2 200 Bootstrap.js Show response
agility.citizensbank.com/citizensbank/cbadvisorprod/ 116 KB
37 KB 655ms
296ms Script
application/javascript 3.124.119.57
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://agility.citizensbank.com/citizensbank/cbadvisorprod/Bootstrap.js
Requested by: Host: fa.citizensbank.com
URL: https://fa.citizensbank.com/permanent-b0b701/primary/stateList/en.7f132d66.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 3.124.119.57 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-124-119-57.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 139201e9992ba0df9d712f97e59edfea6e6109e3f2bb8553ad1926ea1d17a75f

Request headers

Referer: https://fa.citizensbank.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Sun, 29 Aug 2021 12:35:18 GMT
content-encoding: gzip
last-modified: Thu, 05 Aug 2021 15:24:20 GMT
server: nginx
etag: W/"610c02a4-1ce94"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
cache-control: max-age=300

GET
H2 200 status.json Show response
answersstatus.pagescdn.com/1919349b1689c56ff11fedc59f641065/citizensconfig/ 18 B
745 B 36ms
19ms Fetch
application/json 2606:4700::6812:7434
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://answersstatus.pagescdn.com/1919349b1689c56ff11fedc59f641065/citizensconfig/status.json?v=20190101&api_key=1919349b1689c56ff11fedc59f641065&jsLibVersion=v1.4.2&sessionTrackingEnabled=true

Requested by

Host: fa.citizensbank.com
URL: https://fa.citizensbank.com/permanent-b0b701/primary/stateList/en.7f132d66.js

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2606:4700::6812:7434 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

1d11441a60f0c81871548ccecf0b533ae2fff9f3b47aeb8d8d25ff1f2f10f54f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://fa.citizensbank.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Sun, 29 Aug 2021 12:35:18 GMT
content-encoding: gzip
vary: Accept-Encoding, Origin
cf-cache-status: HIT
age: 4100
x-amz-server-side-encryption: AES256
cf-ray: 6865d187de6c2fa5-FRA
x-yext-subendpoint: static
x-amz-request-id: YJP9AT8RHA3N1DWP
x-amz-id-2: 3zTk1B3qbTn9MDZb74rS50dzw9n1gWCy2nOG8PiBuJRjFItcaT6/jqT9ULaDCqcLzOLhIXZyyN4=
accept-ranges: bytes
surrogate-key: answersstatus.pagescdn.com answersstatus.pagescdn.com%2F1919349b1689c56ff11fedc59f641065%2Fcitizensconfig%2Fstatus.json
last-modified: Mon, 18 May 2020 18:32:26 GMT
server: cloudflare
etag: "4310463ea3535c60c436d48d1e97769a"-gzip
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-methods: OPTIONS, GET, HEAD
x-yext-site: us2
access-control-allow-origin: https://fa.citizensbank.com
cache-control: max-age=0, s-maxage=7200, must-revalidate
x-amz-version-id: null
content-length: 43
content-type: application/json
owner: AnswersSdkOverrides

GET
H/1.1 200
OK id Show response
dpm.demdex.net/ 4 KB
2 KB 412ms
292ms XHR
application/json 18.200.233.208
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://dpm.demdex.net/id?d_visid_ver=5.0.1&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_orgid=4C3B0C3755C3822E7F000101%40AdobeOrg&d_nsid=0&ts=1630240519017

Requested by

Host: fa.citizensbank.com
URL: https://fa.citizensbank.com/permanent-b0b701/primary/stateList/en.7f132d66.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

18.200.233.208 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-18-200-233-208.eu-west-1.compute.amazonaws.com

Software

Resource Hash

e6df7dc1360ce0c13787a5c015fce2d5b01b666cae5bc93ddf0a5e15731e0513

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://fa.citizensbank.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

DCS: dcs-prod-irl1-1-v015-0f682881c.edge-irl1.demdex.com UNKNOWN
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
content-encoding: gzip
X-TID: umoD7to7TOI=
Vary: Origin
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Access-Control-Allow-Origin: https://fa.citizensbank.com
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/json;charset=utf-8
Content-Length: 1311
Expires: Thu, 01 Jan 1970 00:00:00 UTC

GET
H2 200 serverComponent.php Show response
nexus.ensighten.com/citizensbank/cbadvisorprod/ 287 B
430 B 639ms
38ms Script
text/javascript 18.197.253.20
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://nexus.ensighten.com/citizensbank/cbadvisorprod/serverComponent.php?namespace=Bootstrapper&staticJsPath=nexus.ensighten.com/citizensbank/cbadvisorprod/code/&publishedOn=Thu%20Aug%2005%2015:24:19%20GMT%202021&ClientID=397&PageID=https%3A%2F%2Ffa.citizensbank.com%2F
Requested by: Host: agility.citizensbank.com
URL: https://agility.citizensbank.com/citizensbank/cbadvisorprod/Bootstrap.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 18.197.253.20 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-197-253-20.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 1522d405d153f33233db3656609ef47eebb08a80fea7bc4a263b4345ce280e79

Request headers

Referer: https://fa.citizensbank.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Sun, 29 Aug 2021 12:35:19 GMT
cache-control: no-cache, no-store
server: nginx
content-type: text/javascript
content-length: 287
expires: Sun, 29 Aug 2021 12:35:18 GMT

GET
H/1.1 200
OK dest5.html Show response
citizensbank.demdex.net/ Frame F27D 7 KB
3 KB 415ms
67ms Document
text/html 52.19.186.105
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://citizensbank.demdex.net/dest5.html?d_nsid=0

Requested by

Host: agility.citizensbank.com
URL: https://agility.citizensbank.com/citizensbank/cbadvisorprod/Bootstrap.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.19.186.105 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-52-19-186-105.eu-west-1.compute.amazonaws.com

Software

Resource Hash

7bea17a80a61ed0f54248b4ffc4c718f7c8ff2619742577a73591d62ce074da8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Host: citizensbank.demdex.net
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Referer: https://fa.citizensbank.com/
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Cookie: demdex=09542571185199679022123098596376571057
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Referer: https://fa.citizensbank.com/

Response headers

Accept-Ranges: bytes
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
content-encoding: gzip
Content-Type: text/html;charset=UTF-8
date: Sun, 29 Aug 2021 12:35:19 GMT
DCS: dcs-prod-irl1-1-v015-0f8e570e7.edge-irl1.demdex.com UNKNOWN
Expires: Thu, 01 Jan 1970 00:00:00 UTC
last-modified: Thu, 26 Aug 2021 10:18:42 GMT
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
vary: accept-encoding
X-TID: txb7i/BrRf0=
Content-Length: 2791
Connection: keep-alive

GET
H2 200 id Show response
smetrics.citizensbank.com/ 48 B
513 B 144ms
40ms XHR
application/x-javascript 15.236.176.210
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://smetrics.citizensbank.com/id?d_visid_ver=5.0.1&d_fieldgroup=A&mcorgid=4C3B0C3755C3822E7F000101%40AdobeOrg&mid=09505412132819269052123993772381115094&ts=1630240519437

Requested by

Host: fa.citizensbank.com
URL: https://fa.citizensbank.com/permanent-b0b701/primary/stateList/en.7f132d66.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

15.236.176.210 Paris, France, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-15-236-176-210.eu-west-3.compute.amazonaws.com

Software

jag /

Resource Hash

21f9699d7e786e1bfe0bafd85702534883f3daf2d9e655ea53d7e4fb516d138e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://fa.citizensbank.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

date: Sun, 29 Aug 2021 12:35:19 GMT
x-content-type-options: nosniff
server: jag
xserver: anedge-f47784dbf-vgx42
vary: Origin
x-c: main-1506.I6462f6.M0-512
p3p: CP="This is not a P3P policy"
access-control-allow-origin: https://fa.citizensbank.com
cache-control: no-cache, no-store, max-age=0, no-transform, private
access-control-allow-credentials: true
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/x-javascript;charset=utf-8
content-length: 48
x-xss-protection: 1; mode=block

GET
H/1.1

200
OK

ibs:dpid=411&dpuuid=YSt-BwAAAIhs0QP7
dpm.demdex.net/
Redirect Chain

https://cm.everesttech.net/cm/dd?d_uuid=09542571185199679022123098596376571057
https://dpm.demdex.net/ibs:dpid=411&dpuuid=YSt-BwAAAIhs0QP7

42 B
945 B

39ms
38ms

Image
image/gif

18.200.233.208
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dpm.demdex.net/ibs:dpid=411&dpuuid=YSt-BwAAAIhs0QP7

Requested by

Host: fa.citizensbank.com
URL: https://fa.citizensbank.com/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

18.200.233.208 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-18-200-233-208.eu-west-1.compute.amazonaws.com

Software

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Referer: https://fa.citizensbank.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

DCS: dcs-prod-irl1-2-v015-06e2d9998.edge-irl1.demdex.com UNKNOWN
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
content-encoding: gzip
X-Content-Type-Options: nosniff
X-TID: x0ekXQSPR0U=
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection: keep-alive
Content-Type: image/gif
Content-Length: 59
Expires: Thu, 01 Jan 1970 00:00:00 UTC

Redirect headers

Location: https://dpm.demdex.net/ibs:dpid=411&dpuuid=YSt-BwAAAIhs0QP7
Date: Sun, 29 Aug 2021 12:35:19 GMT
Cache-Control: no-cache
Server: AMO-cookiemap/1.1
Connection: keep-alive
Content-Length: 0
P3P: CP="NOI NID DEVa PSAa PSDa OUR IND PUR COM NAV INT DEM"

GET
H2 200 31304ec92727f8651bc57d30296a2c32.js Show response
nexus.ensighten.com/citizensbank/cbadvisorprod/code/ 112 KB
34 KB 322ms
321ms Script
application/javascript 18.197.253.20
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://nexus.ensighten.com/citizensbank/cbadvisorprod/code/31304ec92727f8651bc57d30296a2c32.js?conditionId0=421909
Requested by: Host: agility.citizensbank.com
URL: https://agility.citizensbank.com/citizensbank/cbadvisorprod/Bootstrap.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 18.197.253.20 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-197-253-20.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 10158c79a679ce7fbafacc02e0b97aa28c2f73c76cbefd3900b6abe204760cb6

Request headers

Referer: https://fa.citizensbank.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Sun, 29 Aug 2021 12:35:19 GMT
content-encoding: gzip
last-modified: Thu, 05 Aug 2021 15:24:20 GMT
server: nginx
etag: W/"610c02a4-1c01c"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
cache-control: max-age=315360000

GET
H/1.1

200
OK

ibs:dpid=477&dpuuid=04eba8f3840103e0886903e98eecef9b87134c72135fac7356be01923fe1295fb0da87c991749652
dpm.demdex.net/ Frame F27D
Redirect Chain

https://idsync.rlcdn.com/365868.gif?partner_uid=09542571185199679022123098596376571057
https://idsync.rlcdn.com/1000.gif?memo=CKyqFhIxCi0IARCYEhomMDk1NDI1NzExODUxOTk2NzkwMjIxMjMwOTg1OTYzNzY1NzEwNTcQABoNCIf-rYkGEgUI6AcQAEIASgA
https://dpm.demdex.net/ibs:dpid=477&dpuuid=04eba8f3840103e0886903e98eecef9b87134c72135fac7356be01923fe1295fb0da87c991749652

42 B
945 B

43ms
42ms

Image
image/gif

18.200.233.208
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dpm.demdex.net/ibs:dpid=477&dpuuid=04eba8f3840103e0886903e98eecef9b87134c72135fac7356be01923fe1295fb0da87c991749652

Requested by

Host: fa.citizensbank.com
URL: https://fa.citizensbank.com/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

18.200.233.208 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-18-200-233-208.eu-west-1.compute.amazonaws.com

Software

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Referer: https://citizensbank.demdex.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

DCS: dcs-prod-irl1-2-v015-0918d3d88.edge-irl1.demdex.com UNKNOWN
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
content-encoding: gzip
X-Content-Type-Options: nosniff
X-TID: XeC4MTssQno=
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection: keep-alive
Content-Type: image/gif
Content-Length: 59
Expires: Thu, 01 Jan 1970 00:00:00 UTC

Redirect headers

date: Sun, 29 Aug 2021 12:35:20 GMT
via: 1.1 google
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
location: https://dpm.demdex.net/ibs:dpid=477&dpuuid=04eba8f3840103e0886903e98eecef9b87134c72135fac7356be01923fe1295fb0da87c991749652
cache-control: no-cache, no-store
timing-allow-origin: *
alt-svc: clear
content-length: 0

GET
H/1.1

200
OK

ibs:dpid=134096&dpuuid=2021082912352000016588551059
dpm.demdex.net/ Frame F27D
Redirect Chain

https://x.dlx.addthis.com/e/demdex_sync?na_exid=09542571185199679022123098596376571057&ru=https%3A%2F%2Fdpm.demdex.net%2Fibs%3Adpid%3D134096%26dpuuid%3D%3Cna_id%3E%20
https://dpm.demdex.net/ibs:dpid=134096&dpuuid=2021082912352000016588551059

42 B
945 B

117ms
43ms

Image
image/gif

18.200.233.208
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dpm.demdex.net/ibs:dpid=134096&dpuuid=2021082912352000016588551059

Requested by

Host: fa.citizensbank.com
URL: https://fa.citizensbank.com/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

18.200.233.208 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-18-200-233-208.eu-west-1.compute.amazonaws.com

Software

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Referer: https://citizensbank.demdex.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

DCS: dcs-prod-irl1-2-v015-064a7714a.edge-irl1.demdex.com UNKNOWN
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
content-encoding: gzip
X-Content-Type-Options: nosniff
X-TID: IxP0XovXQ9o=
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection: keep-alive
Content-Type: image/gif
Content-Length: 59
Expires: Thu, 01 Jan 1970 00:00:00 UTC

Redirect headers

location: https://dpm.demdex.net/ibs:dpid=134096&dpuuid=2021082912352000016588551059
pragma: no-cache
date: Sun, 29 Aug 2021 12:35:20 GMT
cache-control: max-age=0, no-cache, no-store
content-length: 0
strict-transport-security: max-age=2628000
expires: Sun, 29 Aug 2021 12:35:20 GMT

GET
H/1.1

200
OK

ibs:dpid=771&dpuuid=CAESEITjVMKW9zFUPlAaNladYNA&google_cver=1
dpm.demdex.net/ Frame F27D
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=adobe_dmp&google_cm&gdpr=0&gdpr_consent=&google_hm=MDk1NDI1NzExODUxOTk2NzkwMjIxMjMwOTg1OTYzNzY1NzEwNTc=
https://cm.g.doubleclick.net/pixel?google_nid=adobe_dmp&google_cm=&gdpr=0&gdpr_consent=&google_hm=MDk1NDI1NzExODUxOTk2NzkwMjIxMjMwOTg1OTYzNzY1NzEwNTc=&google_tc=
https://dpm.demdex.net/ibs:dpid=771&dpuuid=CAESEITjVMKW9zFUPlAaNladYNA&google_cver=1?gdpr=0&gdpr_consent=

42 B
945 B

273ms
265ms

Image
image/gif

18.200.233.208
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dpm.demdex.net/ibs:dpid=771&dpuuid=CAESEITjVMKW9zFUPlAaNladYNA&google_cver=1?gdpr=0&gdpr_consent=

Requested by

Host: fa.citizensbank.com
URL: https://fa.citizensbank.com/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

18.200.233.208 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-18-200-233-208.eu-west-1.compute.amazonaws.com

Software

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Referer: https://citizensbank.demdex.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

DCS: dcs-prod-irl1-1-v015-0e48b9666.edge-irl1.demdex.com UNKNOWN
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
content-encoding: gzip
X-Content-Type-Options: nosniff
X-TID: X81kXc+qSd8=
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection: keep-alive
Content-Type: image/gif
Content-Length: 59
Expires: Thu, 01 Jan 1970 00:00:00 UTC

Redirect headers

pragma: no-cache
date: Sun, 29 Aug 2021 12:35:20 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dpm.demdex.net/ibs:dpid=771&dpuuid=CAESEITjVMKW9zFUPlAaNladYNA&google_cver=1?gdpr=0&gdpr_consent=
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 314
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1

200
OK

ibs:dpid=1121&dpuuid=2159827873545062039
dpm.demdex.net/ Frame F27D
Redirect Chain

https://p.rfihub.com/cm?in=1&pub=7085
https://dpm.demdex.net/ibs:dpid=1121&dpuuid=2159827873545062039

42 B
945 B

497ms
496ms

Image
image/gif

18.200.233.208
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dpm.demdex.net/ibs:dpid=1121&dpuuid=2159827873545062039

Requested by

Host: fa.citizensbank.com
URL: https://fa.citizensbank.com/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

18.200.233.208 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-18-200-233-208.eu-west-1.compute.amazonaws.com

Software

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Referer: https://citizensbank.demdex.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

DCS: dcs-prod-irl1-1-v015-046276664.edge-irl1.demdex.com UNKNOWN
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
content-encoding: gzip
X-Content-Type-Options: nosniff
X-TID: w8MTD0chTkc=
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection: keep-alive
Content-Type: image/gif
Content-Length: 59
Expires: Thu, 01 Jan 1970 00:00:00 UTC

Redirect headers

Location: https://dpm.demdex.net/ibs:dpid=1121&dpuuid=2159827873545062039
Date: Sun, 29 Aug 2021 12:35:20 GMT
Server: Jetty(9.3.29.v20201019)
Content-Length: 0
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

GET
H/1.1

200
OK

ibs:dpid=30064&dpuuid=%7BUUID_6j5b2cv%7D
dpm.demdex.net/ Frame F27D
Redirect Chain

https://ps.eyeota.net/match?bid=6j5b2cv&uid=09542571185199679022123098596376571057&r=https%3A%2F%2Fdpm.demdex.net%2Fibs%3Adpid%3D30064%26dpuuid%3D%7BUUID_6j5b2cv%7D
https://dpm.demdex.net/ibs:dpid=30064&dpuuid=%7BUUID_6j5b2cv%7D

42 B
963 B

283ms
283ms

Image
image/gif

18.200.233.208
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dpm.demdex.net/ibs:dpid=30064&dpuuid=%7BUUID_6j5b2cv%7D

Requested by

Host: fa.citizensbank.com
URL: https://fa.citizensbank.com/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

18.200.233.208 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-18-200-233-208.eu-west-1.compute.amazonaws.com

Software

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Referer: https://citizensbank.demdex.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

DCS: dcs-prod-irl1-2-v015-0f38eef05.edge-irl1.demdex.com UNKNOWN
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
content-encoding: gzip
X-Content-Type-Options: nosniff
X-Error: 104,303
X-TID: TaXKlPuJQAI=
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection: keep-alive
Content-Type: image/gif
Content-Length: 59
Expires: Thu, 01 Jan 1970 00:00:00 UTC

Redirect headers

Location: https://dpm.demdex.net/ibs:dpid=30064&dpuuid={UUID_6j5b2cv}
Date: Sun, 29 Aug 2021 12:35:20 GMT
Content-Length: 0
P3P: CP="CURa ADMa DEVa TAIo PSAo PSDo OUR SAMo BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR", policyref="http://ps.eyeota.net/w3c/p3p.xml"

GET
H/1.1

200
OK

ibs:dpid=121998&dpuuid=ab2298283fd31df4edfaaa01374f394a
dpm.demdex.net/ Frame F27D
Redirect Chain

https://sync.crwdcntrl.net/map/c=9828/tp=ADBE/tpid=09542571185199679022123098596376571057?https%3A%2F%2Fdpm.demdex.net%2Fibs%3Adpid%3D121998%26dpuuid%3D${profile_id}
https://sync.crwdcntrl.net/map/ct=y/c=9828/tp=ADBE/tpid=09542571185199679022123098596376571057?https%3A%2F%2Fdpm.demdex.net%2Fibs%3Adpid%3D121998%26dpuuid%3D${profile_id}
https://dpm.demdex.net/ibs:dpid=121998&dpuuid=ab2298283fd31df4edfaaa01374f394a

42 B
945 B

48ms
46ms

Image
image/gif

18.200.233.208
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dpm.demdex.net/ibs:dpid=121998&dpuuid=ab2298283fd31df4edfaaa01374f394a

Requested by

Host: fa.citizensbank.com
URL: https://fa.citizensbank.com/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

18.200.233.208 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-18-200-233-208.eu-west-1.compute.amazonaws.com

Software

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Referer: https://citizensbank.demdex.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

DCS: dcs-prod-irl1-2-v015-0b4dd7f9c.edge-irl1.demdex.com UNKNOWN
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
content-encoding: gzip
X-Content-Type-Options: nosniff
X-TID: 2XzMLKujSP0=
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection: keep-alive
Content-Type: image/gif
Content-Length: 59
Expires: Thu, 01 Jan 1970 00:00:00 UTC

Redirect headers

pragma: no-cache
date: Sun, 29 Aug 2021 12:35:20 GMT
server: Jetty(9.4.38.v20210224)
p3p: CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
location: https://dpm.demdex.net/ibs:dpid=121998&dpuuid=ab2298283fd31df4edfaaa01374f394a
cache-control: no-cache
x-server: 10.45.3.72
content-length: 0
expires: 0

GET
H3-29

200

pixel
cm.g.doubleclick.net/ Frame F27D
Redirect Chain

https://sync-tm.everesttech.net/upi/pid/5w3jqr4k?redir=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dg8f47s39e399f3fe%26google_push%26google_sc%26google_hm%3D%24%7BTM_USER_ID_BASE64ENC_...
https://cm.g.doubleclick.net/pixel?google_nid=g8f47s39e399f3fe&google_push&google_sc&google_hm=WVN0LUJ3QUFBSWhzMFFQNw==

170 B
188 B

95ms
95ms

Image
image/png

172.217.18.98
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cm.g.doubleclick.net/pixel?google_nid=g8f47s39e399f3fe&google_push&google_sc&google_hm=WVN0LUJ3QUFBSWhzMFFQNw==

Requested by

Host: fa.citizensbank.com
URL: https://fa.citizensbank.com/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

172.217.18.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

zrh04s05-in-f98.1e100.net

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://citizensbank.demdex.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 29 Aug 2021 12:35:20 GMT
server: HTTP server (unknown)
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Sun, 29 Aug 2021 12:35:20 GMT
via: 1.1 varnish
server: Varnish
x-timer: S1630240521.630699,VS0,VE0
x-served-by: cache-fra19154-FRA
x-cache: HIT
location: https://cm.g.doubleclick.net/pixel?google_nid=g8f47s39e399f3fe&google_push&google_sc&google_hm=WVN0LUJ3QUFBSWhzMFFQNw==
cache-control: no-cache
accept-ranges: bytes
content-length: 0
retry-after: 0
x-cache-hits: 0

GET
H/1.1

204
No Content

tap.php
pixel.rubiconproject.com/ Frame F27D
Redirect Chain

https://sync-tm.everesttech.net/upi/pid/btu4jd3a?redir=https%3A%2F%2Fpixel.rubiconproject.com%2Ftap.php%3Fv%3D7941%26nid%3D2243%26put%3D%24%7BUSER_ID%7D%26expires%3D90
https://pixel.rubiconproject.com/tap.php?v=7941&nid=2243&put=YSt-BwAAAIhs0QP7&expires=90

0
239 B

128ms
36ms

Image
image/gif

69.173.144.138
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.rubiconproject.com/tap.php?v=7941&nid=2243&put=YSt-BwAAAIhs0QP7&expires=90
Requested by: Host: fa.citizensbank.com
URL: https://fa.citizensbank.com/
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_128_GCM
Server: 69.173.144.138 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://citizensbank.demdex.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost: a66cbf3142c6ef39e3614b84a34262cf
Content-Type: image/gif

Redirect headers

pragma: no-cache
date: Sun, 29 Aug 2021 12:35:20 GMT
via: 1.1 varnish
server: Varnish
x-timer: S1630240521.630679,VS0,VE0
x-served-by: cache-fra19154-FRA
x-cache: HIT
location: https://pixel.rubiconproject.com/tap.php?v=7941&nid=2243&put=YSt-BwAAAIhs0QP7&expires=90
cache-control: no-cache
accept-ranges: bytes
content-length: 0
retry-after: 0
x-cache-hits: 0

GET
H/1.1

200
OK

rum
dsum-sec.casalemedia.com/ Frame F27D
Redirect Chain

https://sync-tm.everesttech.net/upi/pid/ZMAwryCI?redir=https%3A%2F%2Fdsum-sec.casalemedia.com%2Frum%3Fcm_dsp_id%3D88%26external_user_id%3D%24%7BTM_USER_ID%7D
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=88&external_user_id=YSt-BwAAAIhs0QP7
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=88&external_user_id=YSt-BwAAAIhs0QP7&C=1

43 B
1003 B

257ms
256ms

Image
image/gif

2.18.234.21
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=88&external_user_id=YSt-BwAAAIhs0QP7&C=1
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2.18.234.21 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a2-18-234-21.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Referer: https://citizensbank.demdex.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Pragma: no-cache
Date: Sun, 29 Aug 2021 12:35:21 GMT
Server: Apache
Vary: Is-Traffic-Usersync
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
Expires: Sun, 29 Aug 2021 12:35:21 GMT

Redirect headers

Pragma: no-cache
Date: Sun, 29 Aug 2021 12:35:21 GMT
Server: Apache
P3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
Location: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=88&external_user_id=YSt-BwAAAIhs0QP7&C=1
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Type: text/html; charset=iso-8859-1
Content-Length: 279
Expires: Sun, 29 Aug 2021 12:35:21 GMT

GET
H/1.1

200
OK

bounce
ib.adnxs.com/ Frame F27D
Redirect Chain

https://sync-tm.everesttech.net/upi/pid/UH6TUt9n?redir=https%3A%2F%2Fib.adnxs.com%2Fsetuid%3Fentity%3D158%26code%3D%24%7BTM_USER_ID%7D
https://ib.adnxs.com/setuid?entity=158&code=YSt-BwAAAIhs0QP7
https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D158%26code%3DYSt-BwAAAIhs0QP7

43 B
1 KB

74ms
74ms

Image
image/gif

185.33.221.53
ASN-APPNEX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D158%26code%3DYSt-BwAAAIhs0QP7

Requested by

Host: fa.citizensbank.com
URL: https://fa.citizensbank.com/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.33.221.53 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),

Reverse DNS

718.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net

Software

nginx/1.17.9 /

Resource Hash

4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

Referer: https://citizensbank.demdex.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Pragma: no-cache
Date: Sun, 29 Aug 2021 12:35:21 GMT
X-Proxy-Origin: 82.102.19.136; 82.102.19.136; 718.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
AN-X-Request-Uuid: 028e4ca9-d7c8-4493-b40d-caf8b651416c
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

Redirect headers

Pragma: no-cache
Date: Sun, 29 Aug 2021 12:35:21 GMT
X-Proxy-Origin: 82.102.19.136; 82.102.19.136; 718.bm-nginx-loadbalancer.mgmt.ams1; adnxs.com
AN-X-Request-Uuid: fc21b0ea-d954-4dcf-bf3e-a4898dfee419
Server: nginx/1.17.9
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location: https://ib.adnxs.com/bounce?%2Fsetuid%3Fentity%3D158%26code%3DYSt-BwAAAIhs0QP7
Cache-Control: no-store, no-cache, private
Connection: keep-alive
Content-Type: text/html; charset=utf-8
Content-Length: 0
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H2

200

sd
us-u.openx.net/w/1.0/ Frame F27D
Redirect Chain

https://sync-tm.everesttech.net/upi/pid/ny75r2x0?redir=https%3A%2F%2Fus-u.openx.net%2Fw%2F1.0%2Fsd%3Fid%3D537148856%26val%3D%24%7BTM_USER_ID%7D
https://us-u.openx.net/w/1.0/sd?id=537148856&val=YSt-BwAAAIhs0QP7
https://us-u.openx.net/w/1.0/sd?cc=1&id=537148856&val=YSt-BwAAAIhs0QP7

43 B
180 B

260ms
259ms

Image
image/gif

35.244.159.8
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://us-u.openx.net/w/1.0/sd?cc=1&id=537148856&val=YSt-BwAAAIhs0QP7
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.159.8 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 8.159.244.35.bc.googleusercontent.com
Software: OXGW/16.214.0 /
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Referer: https://citizensbank.demdex.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 29 Aug 2021 12:35:21 GMT
via: 1.1 google
server: OXGW/16.214.0
vary: Accept
p3p: CP="CUR ADM OUR NOR STA NID"
cache-control: private, max-age=0, no-cache
content-type: image/gif
alt-svc: clear
content-length: 43
expires: Mon, 26 Jul 1997 05:00:00 GMT

Redirect headers

location: https://us-u.openx.net/w/1.0/sd?cc=1&id=537148856&val=YSt-BwAAAIhs0QP7
date: Sun, 29 Aug 2021 12:35:21 GMT
via: 1.1 google
server: OXGW/16.214.0
alt-svc: clear
content-length: 0
p3p: CP="CUR ADM OUR NOR STA NID"

GET
H2

200

Pug
image2.pubmatic.com/AdServer/ Frame F27D
Redirect Chain

https://sync-tm.everesttech.net/upi/pid/b9pj45k4?redir=https%3A%2F%2Fimage2.pubmatic.com%2FAdServer%2FPug%3Fvcode%3Dbz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA%3D%26piggybackCookie%3D%24%7BUSER...
https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA=&piggybackCookie=YSt-BwAAAIhs0QP7

1 B
546 B

301ms
20ms

Image
text/html

185.64.189.110
AS-PUBMATIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA=&piggybackCookie=YSt-BwAAAIhs0QP7
Requested by: Host: fa.citizensbank.com
URL: https://fa.citizensbank.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 185.64.189.110 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://citizensbank.demdex.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Sun, 29 Aug 2021 12:35:19 GMT
cache-control: no-store, no-cache, private
x-lat: amspug009:0:606
server: nginx
content-type: text/html; charset=utf-8
content-length: 1
p3p: CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"

Redirect headers

pragma: no-cache
date: Sun, 29 Aug 2021 12:35:20 GMT
via: 1.1 varnish
server: Varnish
x-timer: S1630240521.983580,VS0,VE0
x-served-by: cache-fra19154-FRA
x-cache: HIT
location: https://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZqcz0xJmNvZGU9MjE5MSZ0bD0yNTkyMDA=&piggybackCookie=YSt-BwAAAIhs0QP7
cache-control: no-cache
accept-ranges: bytes
content-length: 0
retry-after: 0
x-cache-hits: 0

GET
H/1.1

200

partner
sync.search.spotxchange.com/ Frame F27D
Redirect Chain

https://sync-tm.everesttech.net/upi/pid/h0r58thg?redir=https%3A%2F%2Fsync.search.spotxchange.com%2Fpartner%3Fadv_id%3D6409%26uid%3D%24%7BUSER_ID%7D%26img%3D1
https://sync.search.spotxchange.com/partner?adv_id=6409&uid=YSt-BwAAAIhs0QP7&img=1
https://sync.search.spotxchange.com/partner?adv_id=6409&uid=YSt-BwAAAIhs0QP7&img=1&__user_check__=1&sync_id=935d06ff-08c5-11ec-93f5-1348667f0506

43 B
549 B

261ms
261ms

Image
image/gif

185.94.180.125
SPOTX-AMS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sync.search.spotxchange.com/partner?adv_id=6409&uid=YSt-BwAAAIhs0QP7&img=1&__user_check__=1&sync_id=935d06ff-08c5-11ec-93f5-1348667f0506
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 185.94.180.125 Amsterdam, Netherlands, ASN35220 (SPOTX-AMS, US),
Reverse DNS
Software: nginx /
Resource Hash: e586a84d8523747f42e510d78e141015b6424cf67d612854e892a7bcedc8ec9e

Request headers

Referer: https://citizensbank.demdex.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Date: Sun, 29 Aug 2021 12:35:21 GMT
Server: nginx
Access-Control-Allow-Methods: GET, POST, OPTIONS
Content-Type: image/gif
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
Access-Control-Allow-Credentials: false
X-fe: 113
Connection: keep-alive
Content-Length: 43

Redirect headers

Date: Sun, 29 Aug 2021 12:35:21 GMT
Server: nginx
Location: /partner?adv_id=6409&uid=YSt-BwAAAIhs0QP7&img=1&__user_check__=1&sync_id=935d06ff-08c5-11ec-93f5-1348667f0506
Access-Control-Allow-Methods: GET, POST, OPTIONS
Content-Type: text/plain
Access-Control-Allow-Origin: *
Cache-Control: no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0
Access-Control-Allow-Credentials: false
X-fe: 141
Connection: keep-alive
Content-Length: 0

GET
H2

200

b.php
www.facebook.com/fr/ Frame F27D
Redirect Chain

https://sync-tm.everesttech.net/upi/pid/r7ifn0SL?redir=https%3A%2F%2Fwww.facebook.com%2Ffr%2Fb.php%3Fp%3D1531105787105294%26e%3D%24%7BTM_USER_ID%7D%26t%3D2592000%26o%3D0
https://www.facebook.com/fr/b.php?p=1531105787105294&e=YSt-BwAAAIhs0QP7&t=2592000&o=0

43 B
1 KB

59ms
38ms

Image
image/gif

2a03:2880:f12d:181:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/fr/b.php?p=1531105787105294&e=YSt-BwAAAIhs0QP7&t=2592000&o=0

Requested by

Host: fa.citizensbank.com
URL: https://fa.citizensbank.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f12d:181:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://citizensbank.demdex.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Sun, 29 Aug 2021 05:35:21 PDT
content-encoding: br
x-content-type-options: nosniff
content-security-policy-report-only: default-src 'self' data: blob: https://*.fbsbx.com 'unsafe-inline' *.facebook.com 'unsafe-eval' *.fbcdn.net;script-src static.xx.fbcdn.net 'unsafe-inline' *.facebook.com 'unsafe-eval' *.fbcdn.net data:;connect-src wss://gateway.facebook.com wss://edge-chat.facebook.com *.facebook.com *.fbcdn.net wss://snaptu-d.facebook.com wss://kaios-d-test.facebook.com/ wss://kaios-d.facebook.com/;font-src data: *.facebook.com *.fbcdn.net;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com facebook.com *.cdninstagram.com fbsbx.com fbcdn.net blob: android-webview-video-poster:;frame-src *.facebook.com *.fbsbx.com;worker-src blob:;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
x-fb-rlafr: 0
pragma: public
x-fb-debug: E5pTk6mJoymS9VzIe3KkomQTZZRU/CWq8lgJnrHOz38FXyZiSQEqV/yOW4+C10xwntIgWmp8wbNc+AZ6Rpf3CA==
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
cross-origin-opener-policy: same-origin-allow-popups
strict-transport-security: max-age=15552000; preload
report-to: {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/"}],"group":"coep_report"}
content-type: image/gif
vary: Accept-Encoding
cache-control: public, max-age=0
priority: u=3,i
expires: Sun, 29 Aug 2021 05:35:21 PDT

Redirect headers

pragma: no-cache
date: Sun, 29 Aug 2021 12:35:21 GMT
via: 1.1 varnish
server: Varnish
x-timer: S1630240521.199392,VS0,VE0
x-served-by: cache-fra19154-FRA
x-cache: HIT
location: https://www.facebook.com/fr/b.php?p=1531105787105294&e=YSt-BwAAAIhs0QP7&t=2592000&o=0
cache-control: no-cache
accept-ranges: bytes
content-length: 0
retry-after: 0
x-cache-hits: 0

GET
H2

200

restricted
mid.rkdms.com/ Frame F27D
Redirect Chain

https://mid.rkdms.com/bct?pid=8bc436aa-e0fc-4baa-9c9a-06fbeca87826&puid=09542571185199679022123098596376571057&_ct=img
https://mid.rkdms.com/restricted

0
0

112ms
111ms

Image
text/html

54.86.40.3
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://mid.rkdms.com/restricted
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.86.40.3 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-54-86-40-3.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://citizensbank.demdex.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Redirect headers

location: /restricted
date: Sun, 29 Aug 2021 12:35:22 GMT
server: nginx
content-length: 0

GET
H2 200 s88406777761689
smetrics.citizensbank.com/b/ss/citizensbankmarketingprod,citizensbankglobalprod/1/JS-2.21.0/ 43 B
463 B 35ms
34ms Image
image/gif 15.236.176.210
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://smetrics.citizensbank.com/b/ss/citizensbankmarketingprod,citizensbankglobalprod/1/JS-2.21.0/s88406777761689?AQB=1&ndh=1&pf=1&t=29%2F7%2F2021%2014%3A35%3A21%200%20-120&mid=09505412132819269052123993772381115094&aamlh=6&ce=UTF-8&ns=citizensbank&pageName=marketing%7Cwealth%7Cadvisor%7Csearchlandingpage%7Cstate%7Cview&g=https%3A%2F%2Ffa.citizensbank.com%2F&c.&expWidth=1600&expOrientation=landscape&getTimeParting=8%3A35%20AM%7CSunday&getDateParting=7%3A35%20AM%7CSunday&newRepeat=New&visitnum=1&lastVisitDay=First%20Visit&EVENTS=event403%2C&.c&cc=USD&ch=advisor%7Csearchlandingpage&events=event403&aamb=6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y&c1=D%3Dv1&v1=us%7Ceng&c2=D%3Dv2&v2=marketing&c3=D%3Dv3&v3=desk&c4=D%3Dv4&v4=wealth&c5=D%3Dv5&v5=consumer&c6=D%3Dv6&c7=D%3Dv7&v7=advisor&c8=D%3Dv8&v8=searchlandingpage&c9=D%3Dv9&v9=state&c10=D%3Dv10&v10=view&c11=D%3Dv11&c12=D%3Dv12&v12=view&v27=D%3Dg&c35=D%3Dv35&v35=wealth%7Cadvisor%7Csearchlandingpage%7Cstate%7Cview&c62=VisitorAPI%20Present&v62=09505412132819269052123993772381115094&c71=D%3Dv71&v71=20956927776473&c73=D%3Dv73&v73=cb&c74=D%3Dv74&v90=wealth%7Cadvisor%7Csearchlandingpage%7Cstate%7Cview&s=1600x1200&c=24&j=1.6&v=N&k=Y&bw=1600&bh=1200&mcorgid=4C3B0C3755C3822E7F000101%40AdobeOrg&AQE=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

15.236.176.210 Paris, France, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-15-236-176-210.eu-west-3.compute.amazonaws.com

Software

jag /

Resource Hash

a1ecbaed793a1f564c49c671f2dd0ce36f858534ef6d26b55783a06b884cc506

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://fa.citizensbank.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Sun, 29 Aug 2021 12:35:21 GMT
x-content-type-options: nosniff
x-c: main-1506.I6462f6.M0-512
p3p: CP="This is not a P3P policy"
vary: *
content-length: 43
x-xss-protection: 1; mode=block
pragma: no-cache
last-modified: Mon, 30 Aug 2021 12:35:21 GMT
server: jag
xserver: anedge-f47784dbf-xzcjs
etag: 3500914861892403200-4619753783139311173
strict-transport-security: max-age=31536000; includeSubDomains
content-type: image/gif;charset=utf-8
access-control-allow-origin: *
cache-control: no-cache, no-store, max-age=0, no-transform, private
expires: Sat, 28 Aug 2021 12:35:21 GMT

Verdicts & Comments Add Verdict or Comment

71 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

6 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.demdex.net/	1970-01-20 01:09:52	Name: dextp Value: 60-1-1630240519860\|843-1-1630240519963\|771-1-1630240520065\|1121-1-1630240520168\|30064-1-1630240520269\|121998-1-1630240520370\|144230-1-1630240520471\|144231-1-1630240520571\|144232-1-1630240520672\|144233-1-1630240520773\|144234-1-1630240520874\|144235-1-1630240520975\|144236-1-1630240521076\|144237-1-1630240521177\|129099-1-1630240521280
.demdex.net/	1970-01-20 01:09:52	Name: demdex Value: 09542571185199679022123098596376571057
.citizensbank.com/	1970-01-20 14:21:52	Name: AMCV_4C3B0C3755C3822E7F000101%40AdobeOrg Value: 359503849%7CMCIDTS%7C18869%7CMCMID%7C09505412132819269052123993772381115094%7CMCAAMLH-1630845319%7C6%7CMCAAMB-1630845319%7C6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y%7CMCOPTOUT-1630247719s%7CNONE%7CMCAID%7CNONE%7CMCSYNCSOP%7C411-18876%7CvVersion%7C5.0.1
.citizensbank.com/	1969-12-31 23:59:59	Name: AMCVS_4C3B0C3755C3822E7F000101%40AdobeOrg Value: 1
.citizensbank.com/	1970-01-20 14:21:52	Name: s_ecid Value: MCMID%7C09505412132819269052123993772381115094
fa.citizensbank.com/	1970-01-19 20:50:42	Name: current_session Value: 20956927776473

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

agility.citizensbank.com
answersstatus.pagescdn.com
assets.sitescdn.net
citizensbank.demdex.net
cm.everesttech.net
cm.g.doubleclick.net
dpm.demdex.net
dsum-sec.casalemedia.com
fa.citizensbank.com
ib.adnxs.com
idsync.rlcdn.com
image2.pubmatic.com
mid.rkdms.com
nexus.ensighten.com
p.rfihub.com
pixel.rubiconproject.com
ps.eyeota.net
smetrics.citizensbank.com
sync-tm.everesttech.net
sync.crwdcntrl.net
sync.search.spotxchange.com
us-u.openx.net
www.facebook.com
www.yext-pixel.com
x.dlx.addthis.com
104.111.215.191
15.236.176.210
151.101.14.49
172.217.18.98
18.197.253.20
18.200.233.208
185.33.221.53
185.64.189.110
185.94.180.125
193.0.160.129
2.18.234.21
23.21.33.24
2606:4700::6812:7434
2a03:2880:f12d:181:face:b00c:0:25de
3.124.119.57
35.244.159.8
35.244.174.68
52.18.12.237
52.19.186.105
52.51.88.158
52.57.150.20
54.86.40.3
69.173.144.138
08d5dfb025517ed5570ecb83b0c255e545dcff53d76981e140edb829ddc1c358
09373adae1e7d02cf324377e3f50e1059348fd9b30176e04d984bd943ac8cf20
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
10158c79a679ce7fbafacc02e0b97aa28c2f73c76cbefd3900b6abe204760cb6
139201e9992ba0df9d712f97e59edfea6e6109e3f2bb8553ad1926ea1d17a75f
1522d405d153f33233db3656609ef47eebb08a80fea7bc4a263b4345ce280e79
1d11441a60f0c81871548ccecf0b533ae2fff9f3b47aeb8d8d25ff1f2f10f54f
1fe7499bd5d53879025c7d3f1220ba975b820eb214176cfb7d9e423ec671f28d
21f9699d7e786e1bfe0bafd85702534883f3daf2d9e655ea53d7e4fb516d138e
357ed9cbd91e02a80f4f0467860fc4e6033f80e535ba090415ed56fd2ca3787e
3a93befc26b117595f6568824a346bfa6ba15b69e1ef1bd4c712c50f0f9cc4ce
3d8eb9b918bb1e5fbd80ba5ea838387fbf00afecf47e90045df6ba8b8ea07f1d
42cb846e07917f6731406e500f24aeb2e88c42cda124eaa59e08c5331cad8bcb
44132f3390f53c7bd4ddb00c1d0430f43ad46581dea45055a892cadf762a1919
4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49
4fda2773a559f9a364698bda996961eb784bb730ce34d00dd865281c25c94e6c
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87
6a0b4faa974fc3f8e3b747b8d84e404db767b11b4239e1fb58931f2f3d440431
7636f9be9a744b7c05f402ef8f35040fd84ffef490313c5e1752b0208e0ee2a7
7bea17a80a61ed0f54248b4ffc4c718f7c8ff2619742577a73591d62ce074da8
a1ecbaed793a1f564c49c671f2dd0ce36f858534ef6d26b55783a06b884cc506
a389cef71891df1232370fcebd7cfde5f74e741967070399adc91fd069b2094b
afcaed2060508f0e2547af967979f7a785ed5e30d9afafc5584c6d1c635400ae
b0ff2a24a4fc772a1c0b4ca4898ef5d33e1c4deb243ad0f6be8dee086ca6f5c0
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
b3a65ca95b1810718aaae1cb7a06aaa63d72c40b6020497de794fb632209ea32
ddd9392f55158029e9f2b00e892c50a36b17ad6771ff94b20e68e2bd642fc653
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e586a84d8523747f42e510d78e141015b6424cf67d612854e892a7bcedc8ec9e
e6df7dc1360ce0c13787a5c015fce2d5b01b666cae5bc93ddf0a5e15731e0513
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

fa.citizensbank.com Open in urlscan Pro 2606:4700::6812:7434 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

40 Requests

100 %HTTPS

9 %IPv6

21 Domains

25 Subdomains

16 IPs

6 Countries

2107 kBTransfer

3643 kBSize

6 Cookies

13 Outgoing links

Redirected requests

40 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Redirect headers

Request headers

fa.citizensbank.com Open in urlscan Pro
2606:4700::6812:7434 Public Scan

Screenshot
Live screenshot

Full Image

40
Requests

100 %
HTTPS

9 %
IPv6

21
Domains

25
Subdomains

16
IPs

6
Countries

2107 kB
Transfer

3643 kB
Size

6
Cookies

40 HTTP transactions
0 data transactions