urlscan.io logo urlscan.io
SecurityTrails logo

www.firstcitizensrewards.com Open in urlscan Pro
129.159.127.141  Public Scan

Go To Rescan Add Verdict Report
Submitted URL: http://www.rewards.firstcitizens.com/
Effective URL: https://www.firstcitizensrewards.com/pages/main/default.aspx
Submission: On May 31 via api from US — Scanned from DE
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 8 IPs in 2 countries across 9 domains to perform 56 HTTP transactions. The main IP is 129.159.127.141, located in Ashburn, United States and belongs to ORACLE-BMC-31898, US. The main domain is www.firstcitizensrewards.com.
TLS certificate: Issued by DigiCert Global G2 TLS RSA SHA256 202... on December 13th 2023. Valid for: a year.
This is the only time www.firstcitizensrewards.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
3 39 129.159.127.141 31898 (ORACLE-BM...)
1 142.250.184.228 15169 (GOOGLE)
2 2a00:1450:400... 15169 (GOOGLE)
10 2606:4700::68... 13335 (CLOUDFLAR...)
2 2a00:1450:400... 15169 (GOOGLE)
1 2606:4700:440... 13335 (CLOUDFLAR...)
1 2602:816:5001... 54113 (FASTLY)
3 162.247.243.29 54113 (FASTLY)
56 8
39    129.159.127.141 (Ashburn, United States)

ASN31898 (ORACLE-BMC-31898, US)
www.rewards.firstcitizens.com
www.firstcitizensrewards.com
1    142.250.184.228 (United States)

ASN15169 (GOOGLE, US)
PTR: fra24s12-in-f4.1e100.net
www.google.com
2    2a00:1450:4001:81d::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
fonts.googleapis.com
10    2606:4700::6813:b234 (United States)

ASN13335 (CLOUDFLARENET, US)
cdn.cookielaw.org
2    2a00:1450:4001:80b::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.gstatic.com
fonts.gstatic.com
1    2606:4700:4400::6812:2089 (United States)

ASN13335 (CLOUDFLARENET, US)
geolocation.onetrust.com
1    2602:816:5001::39 (United States)

ASN54113 (FASTLY, US)
js-agent.newrelic.com
3    162.247.243.29 (United States)

ASN54113 (FASTLY, US)
bam.nr-data.net
Apex Domain
Subdomains		 Transfer
38 firstcitizensrewards.com
www.firstcitizensrewards.com
2 MB
10 cookielaw.org
cdn.cookielaw.org — Cisco Umbrella Rank: 312
162 KB
3 nr-data.net
bam.nr-data.net — Cisco Umbrella Rank: 245
1 KB
2 gstatic.com
www.gstatic.com
fonts.gstatic.com
257 KB
2 googleapis.com
fonts.googleapis.com — Cisco Umbrella Rank: 33
3 KB
1 newrelic.com
js-agent.newrelic.com — Cisco Umbrella Rank: 636
34 KB
1 onetrust.com
geolocation.onetrust.com — Cisco Umbrella Rank: 533
304 B
1 google.com
www.google.com — Cisco Umbrella Rank: 2
947 B
1 firstcitizens.com
www.rewards.firstcitizens.com
194 B
56 9
Domain Requested by
38 www.firstcitizensrewards.com 2 redirects www.firstcitizensrewards.com
10 cdn.cookielaw.org www.firstcitizensrewards.com
3 bam.nr-data.net www.firstcitizensrewards.com
2 fonts.googleapis.com www.firstcitizensrewards.com
1 js-agent.newrelic.com www.firstcitizensrewards.com
1 geolocation.onetrust.com www.firstcitizensrewards.com
1 fonts.gstatic.com fonts.googleapis.com
1 www.gstatic.com www.firstcitizensrewards.com
1 www.google.com www.firstcitizensrewards.com
1 www.rewards.firstcitizens.com 1 redirects
56 10

This site contains links to these domains. Also see Links.

Domain
www.firstcitizens.com
firstcitizens.com
www.onetrust.com
Subject Issuer Validity Valid
www.firstcitizensrewards.com
DigiCert Global G2 TLS RSA SHA256 2020 CA1		 2023-12-13 -
2024-12-12		 a year crt.sh
*.google.com
WR2		 2024-05-13 -
2024-08-05		 3 months crt.sh
upload.video.google.com
WR2		 2024-05-13 -
2024-08-05		 3 months crt.sh
cookielaw.org
Cloudflare Inc ECC CA-3		 2024-03-01 -
2024-12-31		 10 months crt.sh
*.gstatic.com
WR2		 2024-05-13 -
2024-08-05		 3 months crt.sh
onetrust.com
Cloudflare Inc ECC CA-3		 2023-11-13 -
2024-11-12		 a year crt.sh
js-agent.newrelic.com
GlobalSign Atlas R3 DV TLS CA 2024 Q1		 2024-03-21 -
2025-04-22		 a year crt.sh
*.nr-data.net
DigiCert Global G2 TLS RSA SHA256 2020 CA1		 2023-09-29 -
2024-10-01		 a year crt.sh

This page contains 1 frames:

Primary Page: https://www.firstcitizensrewards.com/pages/main/default.aspx
Frame ID: 471B11FDCCCD91A2CCA52CFD11CE7256
Requests: 56 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

First Citizens Bank

Page URL History Show full URLs

  1. http://www.rewards.firstcitizens.com/ HTTP 307
    https://www.rewards.firstcitizens.com/ HTTP 301
    https://www.firstcitizensrewards.com/ HTTP 301
    https://www.firstcitizensrewards.com/pages/default.aspx HTTP 302
    https://www.firstcitizensrewards.com/pages/main/default.aspx Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • \.aspx?(?:$|\?)
Overall confidence: 100%
Detected patterns
  • ([\d.]+)?/modernizr(?:\.([\d.]+))?.*\.js
Overall confidence: 100%
Detected patterns
  • cdn\.cookielaw\.org
  • otSDKStub\.js
Overall confidence: 100%
Detected patterns
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Overall confidence: 100%
Detected patterns
  • /recaptcha/api\.js

Page Statistics

56
Requests

100 %
HTTPS

63 %
IPv6

9
Domains

10
Subdomains

8
IPs

2
Countries

2421 kB
Transfer

3774 kB
Size

3
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. http://www.rewards.firstcitizens.com/ HTTP 307
    https://www.rewards.firstcitizens.com/ HTTP 301
    https://www.firstcitizensrewards.com/ HTTP 301
    https://www.firstcitizensrewards.com/pages/default.aspx HTTP 302
    https://www.firstcitizensrewards.com/pages/main/default.aspx Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

56 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request default.aspx
www.firstcitizensrewards.com/pages/main/
Redirect Chain
  • http://www.rewards.firstcitizens.com/
  • https://www.rewards.firstcitizens.com/
  • https://www.firstcitizensrewards.com/
  • https://www.firstcitizensrewards.com/pages/default.aspx
  • https://www.firstcitizensrewards.com/pages/main/default.aspx
88 KB
29 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://www.firstcitizensrewards.com/pages/main/default.aspx
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
129.159.127.141 Ashburn, United States, ASN31898 (ORACLE-BMC-31898, US),
Reverse DNS
Software
/ ASP.NET
Resource Hash
ecd8ec94ef579a9300139d41b22445a0b87be7da4d516c933cbd2fb1d0b3087c
Security Headers
Name Value
Content-Security-Policy default-src https: data: 'unsafe-inline' 'unsafe-eval'
Public-Key-Pins pin-sha256='X3pGTSOuJeEVw989IJ/cEtXUEmy52zs1TZQrU06KUKg='; pin-sha256='MHJYVThihUrJcxW6wcqyOISTXIsInsdj3xK8QrZbHec='; pin-sha256='isi41AizREkLvvft0IRW4u3XMFR2Yg7bvrF7padyCJg='; includeSubdomains; max-age=2592000
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Accept-Language
de-DE,de;q=0.9;q=0.9
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36

Response headers

Cache-Control
no-cache, no-store, must-revalidate, max-age=0
Connection
keep-alive
Content-Encoding
gzip
Content-Length
29286
Content-Security-Policy
default-src https: data: 'unsafe-inline' 'unsafe-eval'
Content-Type
text/html; charset=utf-8
Date
Fri, 31 May 2024 22:46:07 GMT
Pragma
no-cache
Public-Key-Pins
pin-sha256='X3pGTSOuJeEVw989IJ/cEtXUEmy52zs1TZQrU06KUKg='; pin-sha256='MHJYVThihUrJcxW6wcqyOISTXIsInsdj3xK8QrZbHec='; pin-sha256='isi41AizREkLvvft0IRW4u3XMFR2Yg7bvrF7padyCJg='; includeSubdomains; max-age=2592000
Strict-Transport-Security
max-age=31536000; includeSubDomains
X-AspNet-Version
4.0.30319
X-Content-Type-Options
nosniff
X-Frame-Options
SAMEORIGIN
X-Permitted-Cross-Domain-Policies
none
X-Powered-By
ASP.NET
X-Xss-Protection
1; mode=block

Redirect headers

Cache-Control
private
Connection
keep-alive
Content-Length
922
Content-Security-Policy
default-src https: data: 'unsafe-inline' 'unsafe-eval'
Content-Type
text/html; charset=utf-8
Date
Fri, 31 May 2024 22:46:07 GMT
Location
/pages/main/default.aspx
Public-Key-Pins
pin-sha256='X3pGTSOuJeEVw989IJ/cEtXUEmy52zs1TZQrU06KUKg='; pin-sha256='MHJYVThihUrJcxW6wcqyOISTXIsInsdj3xK8QrZbHec='; pin-sha256='isi41AizREkLvvft0IRW4u3XMFR2Yg7bvrF7padyCJg='; includeSubdomains; max-age=2592000
Strict-Transport-Security
max-age=31536000; includeSubDomains
X-AspNet-Version
4.0.30319
X-Content-Type-Options
nosniff
X-Frame-Options
SAMEORIGIN
X-Permitted-Cross-Domain-Policies
none
X-Powered-By
ASP.NET
X-Xss-Protection
1; mode=block
api.js
www.google.com/recaptcha/ 		1 KB
947 B 		Script
General
Check archive.org
Download Go to
Full URL
https://www.google.com/recaptcha/api.js
Requested by
Host: www.firstcitizensrewards.com
URL: https://www.firstcitizensrewards.com/pages/main/default.aspx
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.184.228 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s12-in-f4.1e100.net
Software
GSE /
Resource Hash
960c700833a7f1fd2e93d26f721e830f52d8e1ad640446ade139f0ce2a712a04
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self'
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

sec-ch-ua
"Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer
https://www.firstcitizensrewards.com/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Fri, 31 May 2024 22:46:07 GMT
content-encoding
gzip
x-content-type-options
nosniff
content-security-policy
frame-ancestors 'self'
server
GSE
x-frame-options
SAMEORIGIN
content-type
text/javascript; charset=utf-8
cache-control
private, max-age=300
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection
1; mode=block
expires
Fri, 31 May 2024 22:46:07 GMT
css
www.firstcitizensrewards.com/styles/ 		280 KB
44 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www.firstcitizensrewards.com/styles/css?v=1fK4Iiv3WVaW-1rlD53ZS6FJCypPcwRsK81GUUH_SPU1
Requested by
Host: www.firstcitizensrewards.com
URL: https://www.firstcitizensrewards.com/pages/main/default.aspx
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
129.159.127.141 Ashburn, United States, ASN31898 (ORACLE-BMC-31898, US),
Reverse DNS
Software
/ ASP.NET
Resource Hash
27ed27fa82b15a787f3695b439429c6093a8e5ac1b6e4386b67a37fa2b6d8b37
Security Headers
Name Value
Content-Security-Policy default-src https: data: 'unsafe-inline' 'unsafe-eval'
Public-Key-Pins pin-sha256='X3pGTSOuJeEVw989IJ/cEtXUEmy52zs1TZQrU06KUKg='; pin-sha256='MHJYVThihUrJcxW6wcqyOISTXIsInsdj3xK8QrZbHec='; pin-sha256='isi41AizREkLvvft0IRW4u3XMFR2Yg7bvrF7padyCJg='; includeSubdomains; max-age=2592000
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

sec-ch-ua
"Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer
https://www.firstcitizensrewards.com/pages/main/default.aspx
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

Date
Fri, 31 May 2024 22:46:07 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Content-Security-Policy
default-src https: data: 'unsafe-inline' 'unsafe-eval'
X-Permitted-Cross-Domain-Policies
none
X-AspNet-Version
4.0.30319
X-Powered-By
ASP.NET
Strict-Transport-Security
max-age=31536000; includeSubDomains
Connection
keep-alive
Content-Length
44706
X-Xss-Protection
1; mode=block
Public-Key-Pins
pin-sha256='X3pGTSOuJeEVw989IJ/cEtXUEmy52zs1TZQrU06KUKg='; pin-sha256='MHJYVThihUrJcxW6wcqyOISTXIsInsdj3xK8QrZbHec='; pin-sha256='isi41AizREkLvvft0IRW4u3XMFR2Yg7bvrF7padyCJg='; includeSubdomains; max-age=2592000
Last-Modified
Fri, 31 May 2024 22:46:07 GMT
Vary
User-Agent
X-Frame-Options
SAMEORIGIN
Content-Type
text/css; charset=utf-8
Cache-Control
public
Expires
Sat, 31 May 2025 22:46:07 GMT
css
fonts.googleapis.com/ 		1 KB
872 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://fonts.googleapis.com/css?family=Pinyon+Script
Requested by
Host: www.firstcitizensrewards.com
URL: https://www.firstcitizensrewards.com/pages/main/default.aspx
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81d::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
a6ba0427e12a6e987f107a6e6f98da038c40ebcef38872749e874221ef644792
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

sec-ch-ua
"Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer
https://www.firstcitizensrewards.com/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

strict-transport-security
max-age=31536000
date
Fri, 31 May 2024 22:46:07 GMT
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection
0
last-modified
Fri, 31 May 2024 22:46:07 GMT
server
ESF
cross-origin-opener-policy
same-origin-allow-popups
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires
Fri, 31 May 2024 22:46:07 GMT
css2
fonts.googleapis.com/ 		11 KB
2 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://fonts.googleapis.com/css2?family=Open+Sans:ital,wght@0,300..800;1,300..800&display=swap
Requested by
Host: www.firstcitizensrewards.com
URL: https://www.firstcitizensrewards.com/pages/main/default.aspx
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81d::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
631a2253c93d9db42e74c350607229a629b1878c702051b253e1174b889ee3c2
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

sec-ch-ua
"Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer
https://www.firstcitizensrewards.com/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

strict-transport-security
max-age=31536000
date
Fri, 31 May 2024 22:46:07 GMT
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection
0
last-modified
Fri, 31 May 2024 21:20:23 GMT
server
ESF
cross-origin-opener-policy
same-origin-allow-popups
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires
Fri, 31 May 2024 22:46:07 GMT
jquery.min.js
www.firstcitizensrewards.com/scripts/ 		94 KB
43 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.firstcitizensrewards.com/scripts/jquery.min.js
Requested by
Host: www.firstcitizensrewards.com
URL: https://www.firstcitizensrewards.com/pages/main/default.aspx
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
129.159.127.141 Ashburn, United States, ASN31898 (ORACLE-BMC-31898, US),
Reverse DNS
Software
/ ASP.NET
Resource Hash
87981e8062814ca279922ee55276ad14bbdc29649f98e34b2d83c3afb5052a51
Security Headers
Name Value
Content-Security-Policy default-src https: data: 'unsafe-inline' 'unsafe-eval'
Public-Key-Pins pin-sha256='X3pGTSOuJeEVw989IJ/cEtXUEmy52zs1TZQrU06KUKg='; pin-sha256='MHJYVThihUrJcxW6wcqyOISTXIsInsdj3xK8QrZbHec='; pin-sha256='isi41AizREkLvvft0IRW4u3XMFR2Yg7bvrF7padyCJg='; includeSubdomains; max-age=2592000
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

sec-ch-ua
"Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer
https://www.firstcitizensrewards.com/pages/main/default.aspx
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

Date
Fri, 31 May 2024 22:46:07 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Content-Security-Policy
default-src https: data: 'unsafe-inline' 'unsafe-eval'
X-Permitted-Cross-Domain-Policies
none
Strict-Transport-Security
max-age=31536000; includeSubDomains
X-Powered-By
ASP.NET
Connection
keep-alive
Content-Length
42750
X-Xss-Protection
1; mode=block
Public-Key-Pins
pin-sha256='X3pGTSOuJeEVw989IJ/cEtXUEmy52zs1TZQrU06KUKg='; pin-sha256='MHJYVThihUrJcxW6wcqyOISTXIsInsdj3xK8QrZbHec='; pin-sha256='isi41AizREkLvvft0IRW4u3XMFR2Yg7bvrF7padyCJg='; includeSubdomains; max-age=2592000
Last-Modified
Fri, 08 Dec 2023 16:18:57 GMT
ETag
"2189e63ef229da1:0"
Vary
Accept-Encoding
X-Frame-Options
SAMEORIGIN
Content-Type
application/javascript
Accept-Ranges
bytes
modernizr.js
www.firstcitizensrewards.com/scripts/ 		10 KB
6 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.firstcitizensrewards.com/scripts/modernizr.js
Requested by
Host: www.firstcitizensrewards.com
URL: https://www.firstcitizensrewards.com/pages/main/default.aspx
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
129.159.127.141 Ashburn, United States, ASN31898 (ORACLE-BMC-31898, US),
Reverse DNS
Software
/ ASP.NET
Resource Hash
ac7f7d8b7179ddc263d366be0a8c7133a1914fa167f726591b26a3e69c02520c
Security Headers
Name Value
Content-Security-Policy default-src https: data: 'unsafe-inline' 'unsafe-eval'
Public-Key-Pins pin-sha256='X3pGTSOuJeEVw989IJ/cEtXUEmy52zs1TZQrU06KUKg='; pin-sha256='MHJYVThihUrJcxW6wcqyOISTXIsInsdj3xK8QrZbHec='; pin-sha256='isi41AizREkLvvft0IRW4u3XMFR2Yg7bvrF7padyCJg='; includeSubdomains; max-age=2592000
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

sec-ch-ua
"Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer
https://www.firstcitizensrewards.com/pages/main/default.aspx
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

Date
Fri, 31 May 2024 22:46:07 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Content-Security-Policy
default-src https: data: 'unsafe-inline' 'unsafe-eval'
X-Permitted-Cross-Domain-Policies
none
Strict-Transport-Security
max-age=31536000; includeSubDomains
X-Powered-By
ASP.NET
Connection
keep-alive
Content-Length
5198
X-Xss-Protection
1; mode=block
Public-Key-Pins
pin-sha256='X3pGTSOuJeEVw989IJ/cEtXUEmy52zs1TZQrU06KUKg='; pin-sha256='MHJYVThihUrJcxW6wcqyOISTXIsInsdj3xK8QrZbHec='; pin-sha256='isi41AizREkLvvft0IRW4u3XMFR2Yg7bvrF7padyCJg='; includeSubdomains; max-age=2592000
Last-Modified
Fri, 08 Dec 2023 16:18:57 GMT
ETag
"9dcea3ef229da1:0"
Vary
Accept-Encoding
X-Frame-Options
SAMEORIGIN
Content-Type
application/javascript
Accept-Ranges
bytes
refresh.css
www.firstcitizensrewards.com/styles/ 		6 KB
3 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www.firstcitizensrewards.com/styles/refresh.css
Requested by
Host: www.firstcitizensrewards.com
URL: https://www.firstcitizensrewards.com/pages/main/default.aspx
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
129.159.127.141 Ashburn, United States, ASN31898 (ORACLE-BMC-31898, US),
Reverse DNS
Software
/ ASP.NET
Resource Hash
c5fbb516039cff75d6252b354fdacc9b09f78db817fe9f0e829a8b9318956034
Security Headers
Name Value
Content-Security-Policy default-src https: data: 'unsafe-inline' 'unsafe-eval'
Public-Key-Pins pin-sha256='X3pGTSOuJeEVw989IJ/cEtXUEmy52zs1TZQrU06KUKg='; pin-sha256='MHJYVThihUrJcxW6wcqyOISTXIsInsdj3xK8QrZbHec='; pin-sha256='isi41AizREkLvvft0IRW4u3XMFR2Yg7bvrF7padyCJg='; includeSubdomains; max-age=2592000
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

sec-ch-ua
"Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer
https://www.firstcitizensrewards.com/pages/main/default.aspx
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

Date
Fri, 31 May 2024 22:46:07 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Content-Security-Policy
default-src https: data: 'unsafe-inline' 'unsafe-eval'
X-Permitted-Cross-Domain-Policies
none
Strict-Transport-Security
max-age=31536000; includeSubDomains
X-Powered-By
ASP.NET
Connection
keep-alive
Content-Length
1902
X-Xss-Protection
1; mode=block
Public-Key-Pins
pin-sha256='X3pGTSOuJeEVw989IJ/cEtXUEmy52zs1TZQrU06KUKg='; pin-sha256='MHJYVThihUrJcxW6wcqyOISTXIsInsdj3xK8QrZbHec='; pin-sha256='isi41AizREkLvvft0IRW4u3XMFR2Yg7bvrF7padyCJg='; includeSubdomains; max-age=2592000
Last-Modified
Tue, 07 May 2024 18:52:51 GMT
ETag
"db4573c3afa0da1:0"
Vary
Accept-Encoding
X-Frame-Options
SAMEORIGIN
Content-Type
text/css
Accept-Ranges
bytes
otSDKStub.js
cdn.cookielaw.org/scripttemplates/ 		21 KB
7 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.cookielaw.org/scripttemplates/otSDKStub.js
Requested by
Host: www.firstcitizensrewards.com
URL: https://www.firstcitizensrewards.com/pages/main/default.aspx
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6813:b234 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
fdfea52427fb822bebdd32b325768e73b40637bd203c100827d4dece88e431c3
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

sec-ch-ua
"Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer
https://www.firstcitizensrewards.com/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

x-ms-blob-type
BlockBlob
date
Fri, 31 May 2024 22:46:07 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
content-md5
YmFgVUTeB0lXZXM9YgX19A==
age
7573
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-length
6882
x-ms-lease-status
unlocked
last-modified
Thu, 30 May 2024 19:49:44 GMT
server
cloudflare
etag
0x8DC80E1A7B58E98
vary
Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
x-ms-request-id
5d7ad16c-d01e-0020-6f75-b32da5000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
max-age=86400
x-ms-version
2009-09-19
accept-ranges
bytes
cf-ray
88ca7f89cf87994e-FRA
WebResource.axd
www.firstcitizensrewards.com/ 		23 KB
7 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.firstcitizensrewards.com/WebResource.axd?d=qIK7C_Hji4WKKPZ0WLZbMfAwhuQXiTkFiWhjwDCe85d5sNgbNpXyaSu1Mi76oC4_2MtpASu4oI9JUR0dw-7hgk4gfPs1&t=638459680569584809
Requested by
Host: www.firstcitizensrewards.com
URL: https://www.firstcitizensrewards.com/pages/main/default.aspx
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
129.159.127.141 Ashburn, United States, ASN31898 (ORACLE-BMC-31898, US),
Reverse DNS
Software
/ ASP.NET
Resource Hash
40732e9dcfa704cf615e4691bb07aecfd1cc5e063220a46e4a7ff6560c77f5db
Security Headers
Name Value
Content-Security-Policy default-src https: data: 'unsafe-inline' 'unsafe-eval'
Public-Key-Pins pin-sha256='X3pGTSOuJeEVw989IJ/cEtXUEmy52zs1TZQrU06KUKg='; pin-sha256='MHJYVThihUrJcxW6wcqyOISTXIsInsdj3xK8QrZbHec='; pin-sha256='isi41AizREkLvvft0IRW4u3XMFR2Yg7bvrF7padyCJg='; includeSubdomains; max-age=2592000
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

sec-ch-ua
"Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer
https://www.firstcitizensrewards.com/pages/main/default.aspx
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

Date
Fri, 31 May 2024 22:46:07 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Content-Security-Policy
default-src https: data: 'unsafe-inline' 'unsafe-eval'
X-Permitted-Cross-Domain-Policies
none
X-AspNet-Version
4.0.30319
X-Powered-By
ASP.NET
Strict-Transport-Security
max-age=31536000; includeSubDomains
Connection
keep-alive
Content-Length
6007
X-Xss-Protection
1; mode=block
Public-Key-Pins
pin-sha256='X3pGTSOuJeEVw989IJ/cEtXUEmy52zs1TZQrU06KUKg='; pin-sha256='MHJYVThihUrJcxW6wcqyOISTXIsInsdj3xK8QrZbHec='; pin-sha256='isi41AizREkLvvft0IRW4u3XMFR2Yg7bvrF7padyCJg='; includeSubdomains; max-age=2592000
Last-Modified
Thu, 14 Mar 2024 03:07:36 GMT
Vary
Accept-Encoding
X-Frame-Options
SAMEORIGIN
Content-Type
application/x-javascript
Cache-Control
public
Expires
Sat, 31 May 2025 05:34:27 GMT
ScriptResource.axd
www.firstcitizensrewards.com/ 		89 KB
35 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.firstcitizensrewards.com/ScriptResource.axd?d=PoPN1ICqx_BlrpFAIFK4ewX2alG1EDe74tw4W9zkhsWKoZStDXB9kyfqiC6k_DqVlLSoiyYfE893viPGkZgqOwifNi5xBkimWZahTKhKXlBnEG28fza8PkuUWQjpclNB0GZbew2&t=51e37521
Requested by
Host: www.firstcitizensrewards.com
URL: https://www.firstcitizensrewards.com/pages/main/default.aspx
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
129.159.127.141 Ashburn, United States, ASN31898 (ORACLE-BMC-31898, US),
Reverse DNS
Software
/ ASP.NET
Resource Hash
21e1dff4ea91f8d053603d4b774c47bd7c047ff31d854793abd13da79a4a8a6b
Security Headers
Name Value
Content-Security-Policy default-src https: data: 'unsafe-inline' 'unsafe-eval'
Public-Key-Pins pin-sha256='X3pGTSOuJeEVw989IJ/cEtXUEmy52zs1TZQrU06KUKg='; pin-sha256='MHJYVThihUrJcxW6wcqyOISTXIsInsdj3xK8QrZbHec='; pin-sha256='isi41AizREkLvvft0IRW4u3XMFR2Yg7bvrF7padyCJg='; includeSubdomains; max-age=2592000
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

sec-ch-ua
"Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer
https://www.firstcitizensrewards.com/pages/main/default.aspx
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

Date
Fri, 31 May 2024 22:46:07 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Content-Security-Policy
default-src https: data: 'unsafe-inline' 'unsafe-eval'
X-Permitted-Cross-Domain-Policies
none
X-AspNet-Version
4.0.30319
X-Powered-By
ASP.NET
Strict-Transport-Security
max-age=31536000; includeSubDomains
Connection
keep-alive
Content-Length
34485
X-Xss-Protection
1; mode=block
Public-Key-Pins
pin-sha256='X3pGTSOuJeEVw989IJ/cEtXUEmy52zs1TZQrU06KUKg='; pin-sha256='MHJYVThihUrJcxW6wcqyOISTXIsInsdj3xK8QrZbHec='; pin-sha256='isi41AizREkLvvft0IRW4u3XMFR2Yg7bvrF7padyCJg='; includeSubdomains; max-age=2592000
Last-Modified
Fri, 31 May 2024 05:34:27 GMT
Vary
Accept-Encoding
X-Frame-Options
SAMEORIGIN
Content-Type
application/x-javascript; charset=utf-8
Cache-Control
public
Expires
Sat, 31 May 2025 05:34:27 GMT
ScriptResource.axd
www.firstcitizensrewards.com/ 		38 KB
13 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.firstcitizensrewards.com/ScriptResource.axd?d=QIpkq-RC60GWgcFH4uiyAPWJRG5RzzjHzSN34Daff-xEsAjiKM0xBl3EIRCiEwtj0jf-o4WK72G5S5TA-_5V5fxLr7OyMONudVlfu6K6ixb6ttp_8o5vctJGlAsiBVDWqKSVOg2&t=51e37521
Requested by
Host: www.firstcitizensrewards.com
URL: https://www.firstcitizensrewards.com/pages/main/default.aspx
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
129.159.127.141 Ashburn, United States, ASN31898 (ORACLE-BMC-31898, US),
Reverse DNS
Software
/ ASP.NET
Resource Hash
3405ac070a16f48cbef78ca93ac5f6fd3695e748ad05da409a652bf2a7886d1c
Security Headers
Name Value
Content-Security-Policy default-src https: data: 'unsafe-inline' 'unsafe-eval'
Public-Key-Pins pin-sha256='X3pGTSOuJeEVw989IJ/cEtXUEmy52zs1TZQrU06KUKg='; pin-sha256='MHJYVThihUrJcxW6wcqyOISTXIsInsdj3xK8QrZbHec='; pin-sha256='isi41AizREkLvvft0IRW4u3XMFR2Yg7bvrF7padyCJg='; includeSubdomains; max-age=2592000
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

sec-ch-ua
"Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer
https://www.firstcitizensrewards.com/pages/main/default.aspx
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

Date
Fri, 31 May 2024 22:46:07 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Content-Security-Policy
default-src https: data: 'unsafe-inline' 'unsafe-eval'
X-Permitted-Cross-Domain-Policies
none
X-AspNet-Version
4.0.30319
X-Powered-By
ASP.NET
Strict-Transport-Security
max-age=31536000; includeSubDomains
Connection
keep-alive
Content-Length
12395
X-Xss-Protection
1; mode=block
Public-Key-Pins
pin-sha256='X3pGTSOuJeEVw989IJ/cEtXUEmy52zs1TZQrU06KUKg='; pin-sha256='MHJYVThihUrJcxW6wcqyOISTXIsInsdj3xK8QrZbHec='; pin-sha256='isi41AizREkLvvft0IRW4u3XMFR2Yg7bvrF7padyCJg='; includeSubdomains; max-age=2592000
Last-Modified
Fri, 31 May 2024 05:34:27 GMT
Vary
Accept-Encoding
X-Frame-Options
SAMEORIGIN
Content-Type
application/x-javascript; charset=utf-8
Cache-Control
public
Expires
Sat, 31 May 2025 05:34:27 GMT
webkit.js
www.firstcitizensrewards.com/scripts/ 		360 B
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.firstcitizensrewards.com/scripts/webkit.js
Requested by
Host: www.firstcitizensrewards.com
URL: https://www.firstcitizensrewards.com/pages/main/default.aspx
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
129.159.127.141 Ashburn, United States, ASN31898 (ORACLE-BMC-31898, US),
Reverse DNS
Software
/ ASP.NET
Resource Hash
6083f0dabd659d673464f2ef3b355c4b9d8ac4174602cd918374b9508cef59ef
Security Headers
Name Value
Content-Security-Policy default-src https: data: 'unsafe-inline' 'unsafe-eval'
Public-Key-Pins pin-sha256='X3pGTSOuJeEVw989IJ/cEtXUEmy52zs1TZQrU06KUKg='; pin-sha256='MHJYVThihUrJcxW6wcqyOISTXIsInsdj3xK8QrZbHec='; pin-sha256='isi41AizREkLvvft0IRW4u3XMFR2Yg7bvrF7padyCJg='; includeSubdomains; max-age=2592000
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

sec-ch-ua
"Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer
https://www.firstcitizensrewards.com/pages/main/default.aspx
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

Date
Fri, 31 May 2024 22:46:08 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Content-Security-Policy
default-src https: data: 'unsafe-inline' 'unsafe-eval'
X-Permitted-Cross-Domain-Policies
none
Strict-Transport-Security
max-age=31536000; includeSubDomains
X-Powered-By
ASP.NET
Connection
keep-alive
Content-Length
333
X-Xss-Protection
1; mode=block
Public-Key-Pins
pin-sha256='X3pGTSOuJeEVw989IJ/cEtXUEmy52zs1TZQrU06KUKg='; pin-sha256='MHJYVThihUrJcxW6wcqyOISTXIsInsdj3xK8QrZbHec='; pin-sha256='isi41AizREkLvvft0IRW4u3XMFR2Yg7bvrF7padyCJg='; includeSubdomains; max-age=2592000
Last-Modified
Fri, 08 Dec 2023 16:18:57 GMT
ETag
"b337ec3ef229da1:0"
Vary
Accept-Encoding
X-Frame-Options
SAMEORIGIN
Content-Type
application/javascript
Accept-Ranges
bytes
alert-close.png
www.firstcitizensrewards.com/images/ 		2 KB
3 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.firstcitizensrewards.com/images/alert-close.png
Requested by
Host: www.firstcitizensrewards.com
URL: https://www.firstcitizensrewards.com/pages/main/default.aspx
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
129.159.127.141 Ashburn, United States, ASN31898 (ORACLE-BMC-31898, US),
Reverse DNS
Software
/ ASP.NET
Resource Hash
6d645dd2170b161a872020a02f6e3f157d829f233833588202084590565b1264
Security Headers
Name Value
Content-Security-Policy default-src https: data: 'unsafe-inline' 'unsafe-eval'
Public-Key-Pins pin-sha256='X3pGTSOuJeEVw989IJ/cEtXUEmy52zs1TZQrU06KUKg='; pin-sha256='MHJYVThihUrJcxW6wcqyOISTXIsInsdj3xK8QrZbHec='; pin-sha256='isi41AizREkLvvft0IRW4u3XMFR2Yg7bvrF7padyCJg='; includeSubdomains; max-age=2592000
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

sec-ch-ua
"Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer
https://www.firstcitizensrewards.com/pages/main/default.aspx
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

Date
Fri, 31 May 2024 22:46:08 GMT
Content-Security-Policy
default-src https: data: 'unsafe-inline' 'unsafe-eval'
X-Content-Type-Options
nosniff
Strict-Transport-Security
max-age=31536000; includeSubDomains
Last-Modified
Fri, 30 Sep 2022 17:56:38 GMT
X-Permitted-Cross-Domain-Policies
none
ETag
"0cfc0fcf5d4d81:0"
X-Powered-By
ASP.NET
X-Frame-Options
SAMEORIGIN
Content-Type
image/png
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
2024
X-Xss-Protection
1; mode=block
Public-Key-Pins
pin-sha256='X3pGTSOuJeEVw989IJ/cEtXUEmy52zs1TZQrU06KUKg='; pin-sha256='MHJYVThihUrJcxW6wcqyOISTXIsInsdj3xK8QrZbHec='; pin-sha256='isi41AizREkLvvft0IRW4u3XMFR2Yg7bvrF7padyCJg='; includeSubdomains; max-age=2592000
New_logo.png
www.firstcitizensrewards.com/images/ 		10 KB
11 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.firstcitizensrewards.com/images/New_logo.png
Requested by
Host: www.firstcitizensrewards.com
URL: https://www.firstcitizensrewards.com/pages/main/default.aspx
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
129.159.127.141 Ashburn, United States, ASN31898 (ORACLE-BMC-31898, US),
Reverse DNS
Software
/ ASP.NET
Resource Hash
43950b99d7660f2d926f2d17fe9dc74b02d86bbbe4d2f52cf2ab5cc1f9c80d0a
Security Headers
Name Value
Content-Security-Policy default-src https: data: 'unsafe-inline' 'unsafe-eval'
Public-Key-Pins pin-sha256='X3pGTSOuJeEVw989IJ/cEtXUEmy52zs1TZQrU06KUKg='; pin-sha256='MHJYVThihUrJcxW6wcqyOISTXIsInsdj3xK8QrZbHec='; pin-sha256='isi41AizREkLvvft0IRW4u3XMFR2Yg7bvrF7padyCJg='; includeSubdomains; max-age=2592000
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

sec-ch-ua
"Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer
https://www.firstcitizensrewards.com/pages/main/default.aspx
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

Date
Fri, 31 May 2024 22:46:08 GMT
Content-Security-Policy
default-src https: data: 'unsafe-inline' 'unsafe-eval'
X-Content-Type-Options
nosniff
Strict-Transport-Security
max-age=31536000; includeSubDomains
Last-Modified
Fri, 30 Sep 2022 17:56:38 GMT
X-Permitted-Cross-Domain-Policies
none
ETag
"0cfc0fcf5d4d81:0"
X-Powered-By
ASP.NET
X-Frame-Options
SAMEORIGIN
Content-Type
image/png
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
10502
X-Xss-Protection
1; mode=block
Public-Key-Pins
pin-sha256='X3pGTSOuJeEVw989IJ/cEtXUEmy52zs1TZQrU06KUKg='; pin-sha256='MHJYVThihUrJcxW6wcqyOISTXIsInsdj3xK8QrZbHec='; pin-sha256='isi41AizREkLvvft0IRW4u3XMFR2Yg7bvrF7padyCJg='; includeSubdomains; max-age=2592000
New_mobile-logo.png
www.firstcitizensrewards.com/images/ 		8 KB
8 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.firstcitizensrewards.com/images/New_mobile-logo.png
Requested by
Host: www.firstcitizensrewards.com
URL: https://www.firstcitizensrewards.com/pages/main/default.aspx
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
129.159.127.141 Ashburn, United States, ASN31898 (ORACLE-BMC-31898, US),
Reverse DNS
Software
/ ASP.NET
Resource Hash
c104f24454cb98ba2ff67a8bbe0ea495703cc82f5ed2fe56fe295b612d6eaaab
Security Headers
Name Value
Content-Security-Policy default-src https: data: 'unsafe-inline' 'unsafe-eval'
Public-Key-Pins pin-sha256='X3pGTSOuJeEVw989IJ/cEtXUEmy52zs1TZQrU06KUKg='; pin-sha256='MHJYVThihUrJcxW6wcqyOISTXIsInsdj3xK8QrZbHec='; pin-sha256='isi41AizREkLvvft0IRW4u3XMFR2Yg7bvrF7padyCJg='; includeSubdomains; max-age=2592000
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

sec-ch-ua
"Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer
https://www.firstcitizensrewards.com/pages/main/default.aspx
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

Date
Fri, 31 May 2024 22:46:08 GMT
Content-Security-Policy
default-src https: data: 'unsafe-inline' 'unsafe-eval'
X-Content-Type-Options
nosniff
Strict-Transport-Security
max-age=31536000; includeSubDomains
Last-Modified
Fri, 30 Sep 2022 17:56:38 GMT
X-Permitted-Cross-Domain-Policies
none
ETag
"0cfc0fcf5d4d81:0"
X-Powered-By
ASP.NET
X-Frame-Options
SAMEORIGIN
Content-Type
image/png
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
7702
X-Xss-Protection
1; mode=block
Public-Key-Pins
pin-sha256='X3pGTSOuJeEVw989IJ/cEtXUEmy52zs1TZQrU06KUKg='; pin-sha256='MHJYVThihUrJcxW6wcqyOISTXIsInsdj3xK8QrZbHec='; pin-sha256='isi41AizREkLvvft0IRW4u3XMFR2Yg7bvrF7padyCJg='; includeSubdomains; max-age=2592000
New_logo-mobile-small.png
www.firstcitizensrewards.com/images/ 		8 KB
8 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.firstcitizensrewards.com/images/New_logo-mobile-small.png
Requested by
Host: www.firstcitizensrewards.com
URL: https://www.firstcitizensrewards.com/pages/main/default.aspx
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
129.159.127.141 Ashburn, United States, ASN31898 (ORACLE-BMC-31898, US),
Reverse DNS
Software
/ ASP.NET
Resource Hash
d07666d005831d406475474a607cd18800ff7451a3181e629fa345dd30f583c7
Security Headers
Name Value
Content-Security-Policy default-src https: data: 'unsafe-inline' 'unsafe-eval'
Public-Key-Pins pin-sha256='X3pGTSOuJeEVw989IJ/cEtXUEmy52zs1TZQrU06KUKg='; pin-sha256='MHJYVThihUrJcxW6wcqyOISTXIsInsdj3xK8QrZbHec='; pin-sha256='isi41AizREkLvvft0IRW4u3XMFR2Yg7bvrF7padyCJg='; includeSubdomains; max-age=2592000
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

sec-ch-ua
"Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer
https://www.firstcitizensrewards.com/pages/main/default.aspx
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

Date
Fri, 31 May 2024 22:46:08 GMT
Content-Security-Policy
default-src https: data: 'unsafe-inline' 'unsafe-eval'
X-Content-Type-Options
nosniff
Strict-Transport-Security
max-age=31536000; includeSubDomains
Last-Modified
Fri, 30 Sep 2022 17:56:38 GMT
X-Permitted-Cross-Domain-Policies
none
ETag
"0cfc0fcf5d4d81:0"
X-Powered-By
ASP.NET
X-Frame-Options
SAMEORIGIN
Content-Type
image/png
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
7689
X-Xss-Protection
1; mode=block
Public-Key-Pins
pin-sha256='X3pGTSOuJeEVw989IJ/cEtXUEmy52zs1TZQrU06KUKg='; pin-sha256='MHJYVThihUrJcxW6wcqyOISTXIsInsdj3xK8QrZbHec='; pin-sha256='isi41AizREkLvvft0IRW4u3XMFR2Yg7bvrF7padyCJg='; includeSubdomains; max-age=2592000
79003b61-b829-45fe-a5a9-d06f4514ebc9.png
www.firstcitizensrewards.com/graphics/ 		1 MB
1 MB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.firstcitizensrewards.com/graphics/79003b61-b829-45fe-a5a9-d06f4514ebc9.png
Requested by
Host: www.firstcitizensrewards.com
URL: https://www.firstcitizensrewards.com/pages/main/default.aspx
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
129.159.127.141 Ashburn, United States, ASN31898 (ORACLE-BMC-31898, US),
Reverse DNS
Software
/ ASP.NET
Resource Hash
40ef3a508a4df47da46c1c3c9cd35f89277db282caa46e5ae1cbbcf6bf60bbee
Security Headers
Name Value
Content-Security-Policy default-src https: data: 'unsafe-inline' 'unsafe-eval'
Public-Key-Pins pin-sha256='X3pGTSOuJeEVw989IJ/cEtXUEmy52zs1TZQrU06KUKg='; pin-sha256='MHJYVThihUrJcxW6wcqyOISTXIsInsdj3xK8QrZbHec='; pin-sha256='isi41AizREkLvvft0IRW4u3XMFR2Yg7bvrF7padyCJg='; includeSubdomains; max-age=2592000
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

sec-ch-ua
"Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer
https://www.firstcitizensrewards.com/pages/main/default.aspx
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

Date
Fri, 31 May 2024 22:46:08 GMT
Content-Security-Policy
default-src https: data: 'unsafe-inline' 'unsafe-eval'
X-Content-Type-Options
nosniff
Strict-Transport-Security
max-age=31536000; includeSubDomains
Last-Modified
Thu, 19 May 2022 09:46:24 GMT
X-Permitted-Cross-Domain-Policies
none
ETag
"0184a4d656bd81:0"
X-Powered-By
ASP.NET
X-Frame-Options
SAMEORIGIN
Content-Type
image/png
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
1195487
X-Xss-Protection
1; mode=block
Public-Key-Pins
pin-sha256='X3pGTSOuJeEVw989IJ/cEtXUEmy52zs1TZQrU06KUKg='; pin-sha256='MHJYVThihUrJcxW6wcqyOISTXIsInsdj3xK8QrZbHec='; pin-sha256='isi41AizREkLvvft0IRW4u3XMFR2Yg7bvrF7padyCJg='; includeSubdomains; max-age=2592000
4cb21422-bbc7-4ec5-866a-5b38524f7879.png
www.firstcitizensrewards.com/graphics/ 		315 KB
316 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.firstcitizensrewards.com/graphics/4cb21422-bbc7-4ec5-866a-5b38524f7879.png
Requested by
Host: www.firstcitizensrewards.com
URL: https://www.firstcitizensrewards.com/pages/main/default.aspx
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
129.159.127.141 Ashburn, United States, ASN31898 (ORACLE-BMC-31898, US),
Reverse DNS
Software
/ ASP.NET
Resource Hash
2c690abc65232a93c89dc14b3a4e0bf461eb6e42e55aee8ce4f00361f9f6d524
Security Headers
Name Value
Content-Security-Policy default-src https: data: 'unsafe-inline' 'unsafe-eval'
Public-Key-Pins pin-sha256='X3pGTSOuJeEVw989IJ/cEtXUEmy52zs1TZQrU06KUKg='; pin-sha256='MHJYVThihUrJcxW6wcqyOISTXIsInsdj3xK8QrZbHec='; pin-sha256='isi41AizREkLvvft0IRW4u3XMFR2Yg7bvrF7padyCJg='; includeSubdomains; max-age=2592000
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

sec-ch-ua
"Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer
https://www.firstcitizensrewards.com/pages/main/default.aspx
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

Date
Fri, 31 May 2024 22:46:08 GMT
Content-Security-Policy
default-src https: data: 'unsafe-inline' 'unsafe-eval'
X-Content-Type-Options
nosniff
Strict-Transport-Security
max-age=31536000; includeSubDomains
Last-Modified
Tue, 11 Oct 2022 13:54:20 GMT
X-Permitted-Cross-Domain-Policies
none
ETag
"04ef9f578ddd81:0"
X-Powered-By
ASP.NET
X-Frame-Options
SAMEORIGIN
Content-Type
image/png
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
322835
X-Xss-Protection
1; mode=block
Public-Key-Pins
pin-sha256='X3pGTSOuJeEVw989IJ/cEtXUEmy52zs1TZQrU06KUKg='; pin-sha256='MHJYVThihUrJcxW6wcqyOISTXIsInsdj3xK8QrZbHec='; pin-sha256='isi41AizREkLvvft0IRW4u3XMFR2Yg7bvrF7padyCJg='; includeSubdomains; max-age=2592000
icon-white_gas.png
www.firstcitizensrewards.com/images/icons/ 		15 KB
16 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.firstcitizensrewards.com/images/icons/icon-white_gas.png
Requested by
Host: www.firstcitizensrewards.com
URL: https://www.firstcitizensrewards.com/pages/main/default.aspx
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
129.159.127.141 Ashburn, United States, ASN31898 (ORACLE-BMC-31898, US),
Reverse DNS
Software
/ ASP.NET
Resource Hash
5a4e98e4199894be49adff3642753711ec805292607447f0a59297c24ad2bb9f
Security Headers
Name Value
Content-Security-Policy default-src https: data: 'unsafe-inline' 'unsafe-eval'
Public-Key-Pins pin-sha256='X3pGTSOuJeEVw989IJ/cEtXUEmy52zs1TZQrU06KUKg='; pin-sha256='MHJYVThihUrJcxW6wcqyOISTXIsInsdj3xK8QrZbHec='; pin-sha256='isi41AizREkLvvft0IRW4u3XMFR2Yg7bvrF7padyCJg='; includeSubdomains; max-age=2592000
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

sec-ch-ua
"Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer
https://www.firstcitizensrewards.com/pages/main/default.aspx
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

Date
Fri, 31 May 2024 22:46:08 GMT
Content-Security-Policy
default-src https: data: 'unsafe-inline' 'unsafe-eval'
X-Content-Type-Options
nosniff
Strict-Transport-Security
max-age=31536000; includeSubDomains
Last-Modified
Fri, 30 Sep 2022 17:56:38 GMT
X-Permitted-Cross-Domain-Policies
none
ETag
"0cfc0fcf5d4d81:0"
X-Powered-By
ASP.NET
X-Frame-Options
SAMEORIGIN
Content-Type
image/png
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
15429
X-Xss-Protection
1; mode=block
Public-Key-Pins
pin-sha256='X3pGTSOuJeEVw989IJ/cEtXUEmy52zs1TZQrU06KUKg='; pin-sha256='MHJYVThihUrJcxW6wcqyOISTXIsInsdj3xK8QrZbHec='; pin-sha256='isi41AizREkLvvft0IRW4u3XMFR2Yg7bvrF7padyCJg='; includeSubdomains; max-age=2592000
icon-white_dining.png
www.firstcitizensrewards.com/images/icons/ 		16 KB
17 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.firstcitizensrewards.com/images/icons/icon-white_dining.png
Requested by
Host: www.firstcitizensrewards.com
URL: https://www.firstcitizensrewards.com/pages/main/default.aspx
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
129.159.127.141 Ashburn, United States, ASN31898 (ORACLE-BMC-31898, US),
Reverse DNS
Software
/ ASP.NET
Resource Hash
b8f709b278ef98077988ebfdffb5e348522f8ab0c10c6963dad35e4a3d629096
Security Headers
Name Value
Content-Security-Policy default-src https: data: 'unsafe-inline' 'unsafe-eval'
Public-Key-Pins pin-sha256='X3pGTSOuJeEVw989IJ/cEtXUEmy52zs1TZQrU06KUKg='; pin-sha256='MHJYVThihUrJcxW6wcqyOISTXIsInsdj3xK8QrZbHec='; pin-sha256='isi41AizREkLvvft0IRW4u3XMFR2Yg7bvrF7padyCJg='; includeSubdomains; max-age=2592000
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

sec-ch-ua
"Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer
https://www.firstcitizensrewards.com/pages/main/default.aspx
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

Date
Fri, 31 May 2024 22:46:08 GMT
Content-Security-Policy
default-src https: data: 'unsafe-inline' 'unsafe-eval'
X-Content-Type-Options
nosniff
Strict-Transport-Security
max-age=31536000; includeSubDomains
Last-Modified
Fri, 30 Sep 2022 17:56:38 GMT
X-Permitted-Cross-Domain-Policies
none
ETag
"0cfc0fcf5d4d81:0"
X-Powered-By
ASP.NET
X-Frame-Options
SAMEORIGIN
Content-Type
image/png
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
16669
X-Xss-Protection
1; mode=block
Public-Key-Pins
pin-sha256='X3pGTSOuJeEVw989IJ/cEtXUEmy52zs1TZQrU06KUKg='; pin-sha256='MHJYVThihUrJcxW6wcqyOISTXIsInsdj3xK8QrZbHec='; pin-sha256='isi41AizREkLvvft0IRW4u3XMFR2Yg7bvrF7padyCJg='; includeSubdomains; max-age=2592000
icon-white_shopping.png
www.firstcitizensrewards.com/images/icons/ 		2 KB
3 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.firstcitizensrewards.com/images/icons/icon-white_shopping.png
Requested by
Host: www.firstcitizensrewards.com
URL: https://www.firstcitizensrewards.com/pages/main/default.aspx
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
129.159.127.141 Ashburn, United States, ASN31898 (ORACLE-BMC-31898, US),
Reverse DNS
Software
/ ASP.NET
Resource Hash
f5fece0d25a46b78f20a9e20b928c52b530417af417c997f3e9e25b504a43d6d
Security Headers
Name Value
Content-Security-Policy default-src https: data: 'unsafe-inline' 'unsafe-eval'
Public-Key-Pins pin-sha256='X3pGTSOuJeEVw989IJ/cEtXUEmy52zs1TZQrU06KUKg='; pin-sha256='MHJYVThihUrJcxW6wcqyOISTXIsInsdj3xK8QrZbHec='; pin-sha256='isi41AizREkLvvft0IRW4u3XMFR2Yg7bvrF7padyCJg='; includeSubdomains; max-age=2592000
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

sec-ch-ua
"Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer
https://www.firstcitizensrewards.com/pages/main/default.aspx
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

Date
Fri, 31 May 2024 22:46:08 GMT
Content-Security-Policy
default-src https: data: 'unsafe-inline' 'unsafe-eval'
X-Content-Type-Options
nosniff
Strict-Transport-Security
max-age=31536000; includeSubDomains
Last-Modified
Fri, 30 Sep 2022 17:56:38 GMT
X-Permitted-Cross-Domain-Policies
none
ETag
"0cfc0fcf5d4d81:0"
X-Powered-By
ASP.NET
X-Frame-Options
SAMEORIGIN
Content-Type
image/png
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
2094
X-Xss-Protection
1; mode=block
Public-Key-Pins
pin-sha256='X3pGTSOuJeEVw989IJ/cEtXUEmy52zs1TZQrU06KUKg='; pin-sha256='MHJYVThihUrJcxW6wcqyOISTXIsInsdj3xK8QrZbHec='; pin-sha256='isi41AizREkLvvft0IRW4u3XMFR2Yg7bvrF7padyCJg='; includeSubdomains; max-age=2592000
icon-white_travel.png
www.firstcitizensrewards.com/images/icons/ 		16 KB
16 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.firstcitizensrewards.com/images/icons/icon-white_travel.png
Requested by
Host: www.firstcitizensrewards.com
URL: https://www.firstcitizensrewards.com/pages/main/default.aspx
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
129.159.127.141 Ashburn, United States, ASN31898 (ORACLE-BMC-31898, US),
Reverse DNS
Software
/ ASP.NET
Resource Hash
8f3afe36f81d30bc8033f69a9791facbf99c7b6fa74c7187bc526472460558b2
Security Headers
Name Value
Content-Security-Policy default-src https: data: 'unsafe-inline' 'unsafe-eval'
Public-Key-Pins pin-sha256='X3pGTSOuJeEVw989IJ/cEtXUEmy52zs1TZQrU06KUKg='; pin-sha256='MHJYVThihUrJcxW6wcqyOISTXIsInsdj3xK8QrZbHec='; pin-sha256='isi41AizREkLvvft0IRW4u3XMFR2Yg7bvrF7padyCJg='; includeSubdomains; max-age=2592000
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

sec-ch-ua
"Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer
https://www.firstcitizensrewards.com/pages/main/default.aspx
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

Date
Fri, 31 May 2024 22:46:08 GMT
Content-Security-Policy
default-src https: data: 'unsafe-inline' 'unsafe-eval'
X-Content-Type-Options
nosniff
Strict-Transport-Security
max-age=31536000; includeSubDomains
Last-Modified
Fri, 30 Sep 2022 17:56:38 GMT
X-Permitted-Cross-Domain-Policies
none
ETag
"0cfc0fcf5d4d81:0"
X-Powered-By
ASP.NET
X-Frame-Options
SAMEORIGIN
Content-Type
image/png
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
16118
X-Xss-Protection
1; mode=block
Public-Key-Pins
pin-sha256='X3pGTSOuJeEVw989IJ/cEtXUEmy52zs1TZQrU06KUKg='; pin-sha256='MHJYVThihUrJcxW6wcqyOISTXIsInsdj3xK8QrZbHec='; pin-sha256='isi41AizREkLvvft0IRW4u3XMFR2Yg7bvrF7padyCJg='; includeSubdomains; max-age=2592000
icon-white_pooling.png
www.firstcitizensrewards.com/images/icons/ 		16 KB
17 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.firstcitizensrewards.com/images/icons/icon-white_pooling.png
Requested by
Host: www.firstcitizensrewards.com
URL: https://www.firstcitizensrewards.com/pages/main/default.aspx
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
129.159.127.141 Ashburn, United States, ASN31898 (ORACLE-BMC-31898, US),
Reverse DNS
Software
/ ASP.NET
Resource Hash
f980a61903248079a4bfa278d1ece2209c747604cd58b9eba9e80f433db3c39a
Security Headers
Name Value
Content-Security-Policy default-src https: data: 'unsafe-inline' 'unsafe-eval'
Public-Key-Pins pin-sha256='X3pGTSOuJeEVw989IJ/cEtXUEmy52zs1TZQrU06KUKg='; pin-sha256='MHJYVThihUrJcxW6wcqyOISTXIsInsdj3xK8QrZbHec='; pin-sha256='isi41AizREkLvvft0IRW4u3XMFR2Yg7bvrF7padyCJg='; includeSubdomains; max-age=2592000
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

sec-ch-ua
"Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer
https://www.firstcitizensrewards.com/pages/main/default.aspx
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

Date
Fri, 31 May 2024 22:46:08 GMT
Content-Security-Policy
default-src https: data: 'unsafe-inline' 'unsafe-eval'
X-Content-Type-Options
nosniff
Strict-Transport-Security
max-age=31536000; includeSubDomains
Last-Modified
Fri, 30 Sep 2022 17:56:38 GMT
X-Permitted-Cross-Domain-Policies
none
ETag
"0cfc0fcf5d4d81:0"
X-Powered-By
ASP.NET
X-Frame-Options
SAMEORIGIN
Content-Type
image/png
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
16885
X-Xss-Protection
1; mode=block
Public-Key-Pins
pin-sha256='X3pGTSOuJeEVw989IJ/cEtXUEmy52zs1TZQrU06KUKg='; pin-sha256='MHJYVThihUrJcxW6wcqyOISTXIsInsdj3xK8QrZbHec='; pin-sha256='isi41AizREkLvvft0IRW4u3XMFR2Yg7bvrF7padyCJg='; includeSubdomains; max-age=2592000
icon-white-gift_points.png
www.firstcitizensrewards.com/images/icons/ 		15 KB
16 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.firstcitizensrewards.com/images/icons/icon-white-gift_points.png
Requested by
Host: www.firstcitizensrewards.com
URL: https://www.firstcitizensrewards.com/pages/main/default.aspx
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
129.159.127.141 Ashburn, United States, ASN31898 (ORACLE-BMC-31898, US),
Reverse DNS
Software
/ ASP.NET
Resource Hash
7841131e25c56e0629fc0d09618882b7271f7c318f57e848dd5b77c74030a0f3
Security Headers
Name Value
Content-Security-Policy default-src https: data: 'unsafe-inline' 'unsafe-eval'
Public-Key-Pins pin-sha256='X3pGTSOuJeEVw989IJ/cEtXUEmy52zs1TZQrU06KUKg='; pin-sha256='MHJYVThihUrJcxW6wcqyOISTXIsInsdj3xK8QrZbHec='; pin-sha256='isi41AizREkLvvft0IRW4u3XMFR2Yg7bvrF7padyCJg='; includeSubdomains; max-age=2592000
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

sec-ch-ua
"Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer
https://www.firstcitizensrewards.com/pages/main/default.aspx
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

Date
Fri, 31 May 2024 22:46:08 GMT
Content-Security-Policy
default-src https: data: 'unsafe-inline' 'unsafe-eval'
X-Content-Type-Options
nosniff
Strict-Transport-Security
max-age=31536000; includeSubDomains
Last-Modified
Fri, 30 Sep 2022 17:56:38 GMT
X-Permitted-Cross-Domain-Policies
none
ETag
"0cfc0fcf5d4d81:0"
X-Powered-By
ASP.NET
X-Frame-Options
SAMEORIGIN
Content-Type
image/png
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
15728
X-Xss-Protection
1; mode=block
Public-Key-Pins
pin-sha256='X3pGTSOuJeEVw989IJ/cEtXUEmy52zs1TZQrU06KUKg='; pin-sha256='MHJYVThihUrJcxW6wcqyOISTXIsInsdj3xK8QrZbHec='; pin-sha256='isi41AizREkLvvft0IRW4u3XMFR2Yg7bvrF7padyCJg='; includeSubdomains; max-age=2592000
icon-darkblue-travel.png
www.firstcitizensrewards.com/images/icons/ 		1 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.firstcitizensrewards.com/images/icons/icon-darkblue-travel.png
Requested by
Host: www.firstcitizensrewards.com
URL: https://www.firstcitizensrewards.com/pages/main/default.aspx
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
129.159.127.141 Ashburn, United States, ASN31898 (ORACLE-BMC-31898, US),
Reverse DNS
Software
/ ASP.NET
Resource Hash
0085b16186957822940d8bcca5fb3c4b8c2d25ec43218dd1830d050e401f9f79
Security Headers
Name Value
Content-Security-Policy default-src https: data: 'unsafe-inline' 'unsafe-eval'
Public-Key-Pins pin-sha256='X3pGTSOuJeEVw989IJ/cEtXUEmy52zs1TZQrU06KUKg='; pin-sha256='MHJYVThihUrJcxW6wcqyOISTXIsInsdj3xK8QrZbHec='; pin-sha256='isi41AizREkLvvft0IRW4u3XMFR2Yg7bvrF7padyCJg='; includeSubdomains; max-age=2592000
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

sec-ch-ua
"Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer
https://www.firstcitizensrewards.com/pages/main/default.aspx
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

Date
Fri, 31 May 2024 22:46:08 GMT
Content-Security-Policy
default-src https: data: 'unsafe-inline' 'unsafe-eval'
X-Content-Type-Options
nosniff
Strict-Transport-Security
max-age=31536000; includeSubDomains
Last-Modified
Fri, 30 Sep 2022 17:56:38 GMT
X-Permitted-Cross-Domain-Policies
none
ETag
"0cfc0fcf5d4d81:0"
X-Powered-By
ASP.NET
X-Frame-Options
SAMEORIGIN
Content-Type
image/png
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
1344
X-Xss-Protection
1; mode=block
Public-Key-Pins
pin-sha256='X3pGTSOuJeEVw989IJ/cEtXUEmy52zs1TZQrU06KUKg='; pin-sha256='MHJYVThihUrJcxW6wcqyOISTXIsInsdj3xK8QrZbHec='; pin-sha256='isi41AizREkLvvft0IRW4u3XMFR2Yg7bvrF7padyCJg='; includeSubdomains; max-age=2592000
icon-darkblue-merchandise.png
www.firstcitizensrewards.com/images/icons/ 		2 KB
3 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.firstcitizensrewards.com/images/icons/icon-darkblue-merchandise.png
Requested by
Host: www.firstcitizensrewards.com
URL: https://www.firstcitizensrewards.com/pages/main/default.aspx
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
129.159.127.141 Ashburn, United States, ASN31898 (ORACLE-BMC-31898, US),
Reverse DNS
Software
/ ASP.NET
Resource Hash
19a88567b84481ed390493b76efdb52c1ca480a41565713cbdfc5660add6dba2
Security Headers
Name Value
Content-Security-Policy default-src https: data: 'unsafe-inline' 'unsafe-eval'
Public-Key-Pins pin-sha256='X3pGTSOuJeEVw989IJ/cEtXUEmy52zs1TZQrU06KUKg='; pin-sha256='MHJYVThihUrJcxW6wcqyOISTXIsInsdj3xK8QrZbHec='; pin-sha256='isi41AizREkLvvft0IRW4u3XMFR2Yg7bvrF7padyCJg='; includeSubdomains; max-age=2592000
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

sec-ch-ua
"Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer
https://www.firstcitizensrewards.com/pages/main/default.aspx
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

Date
Fri, 31 May 2024 22:46:08 GMT
Content-Security-Policy
default-src https: data: 'unsafe-inline' 'unsafe-eval'
X-Content-Type-Options
nosniff
Strict-Transport-Security
max-age=31536000; includeSubDomains
Last-Modified
Fri, 30 Sep 2022 17:56:38 GMT
X-Permitted-Cross-Domain-Policies
none
ETag
"0cfc0fcf5d4d81:0"
X-Powered-By
ASP.NET
X-Frame-Options
SAMEORIGIN
Content-Type
image/png
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
1926
X-Xss-Protection
1; mode=block
Public-Key-Pins
pin-sha256='X3pGTSOuJeEVw989IJ/cEtXUEmy52zs1TZQrU06KUKg='; pin-sha256='MHJYVThihUrJcxW6wcqyOISTXIsInsdj3xK8QrZbHec='; pin-sha256='isi41AizREkLvvft0IRW4u3XMFR2Yg7bvrF7padyCJg='; includeSubdomains; max-age=2592000
icon-darkblue-gift_cards.png
www.firstcitizensrewards.com/images/icons/ 		2 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.firstcitizensrewards.com/images/icons/icon-darkblue-gift_cards.png
Requested by
Host: www.firstcitizensrewards.com
URL: https://www.firstcitizensrewards.com/pages/main/default.aspx
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
129.159.127.141 Ashburn, United States, ASN31898 (ORACLE-BMC-31898, US),
Reverse DNS
Software
/ ASP.NET
Resource Hash
98824ad5e4abf947dbe64c19947e540a7879aec44e65b330653a865890410dd4
Security Headers
Name Value
Content-Security-Policy default-src https: data: 'unsafe-inline' 'unsafe-eval'
Public-Key-Pins pin-sha256='X3pGTSOuJeEVw989IJ/cEtXUEmy52zs1TZQrU06KUKg='; pin-sha256='MHJYVThihUrJcxW6wcqyOISTXIsInsdj3xK8QrZbHec='; pin-sha256='isi41AizREkLvvft0IRW4u3XMFR2Yg7bvrF7padyCJg='; includeSubdomains; max-age=2592000
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

sec-ch-ua
"Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer
https://www.firstcitizensrewards.com/pages/main/default.aspx
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

Date
Fri, 31 May 2024 22:46:08 GMT
Content-Security-Policy
default-src https: data: 'unsafe-inline' 'unsafe-eval'
X-Content-Type-Options
nosniff
Strict-Transport-Security
max-age=31536000; includeSubDomains
Last-Modified
Fri, 30 Sep 2022 17:56:38 GMT
X-Permitted-Cross-Domain-Policies
none
ETag
"0cfc0fcf5d4d81:0"
X-Powered-By
ASP.NET
X-Frame-Options
SAMEORIGIN
Content-Type
image/png
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
1652
X-Xss-Protection
1; mode=block
Public-Key-Pins
pin-sha256='X3pGTSOuJeEVw989IJ/cEtXUEmy52zs1TZQrU06KUKg='; pin-sha256='MHJYVThihUrJcxW6wcqyOISTXIsInsdj3xK8QrZbHec='; pin-sha256='isi41AizREkLvvft0IRW4u3XMFR2Yg7bvrF7padyCJg='; includeSubdomains; max-age=2592000
icon-darkblue-gift_box.png
www.firstcitizensrewards.com/images/icons/ 		2 KB
3 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.firstcitizensrewards.com/images/icons/icon-darkblue-gift_box.png
Requested by
Host: www.firstcitizensrewards.com
URL: https://www.firstcitizensrewards.com/pages/main/default.aspx
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
129.159.127.141 Ashburn, United States, ASN31898 (ORACLE-BMC-31898, US),
Reverse DNS
Software
/ ASP.NET
Resource Hash
3ca430568c6bde1a3fba7fbe5283014c8fc12885e9450fe7c632f6977b322daf
Security Headers
Name Value
Content-Security-Policy default-src https: data: 'unsafe-inline' 'unsafe-eval'
Public-Key-Pins pin-sha256='X3pGTSOuJeEVw989IJ/cEtXUEmy52zs1TZQrU06KUKg='; pin-sha256='MHJYVThihUrJcxW6wcqyOISTXIsInsdj3xK8QrZbHec='; pin-sha256='isi41AizREkLvvft0IRW4u3XMFR2Yg7bvrF7padyCJg='; includeSubdomains; max-age=2592000
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

sec-ch-ua
"Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer
https://www.firstcitizensrewards.com/pages/main/default.aspx
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

Date
Fri, 31 May 2024 22:46:08 GMT
Content-Security-Policy
default-src https: data: 'unsafe-inline' 'unsafe-eval'
X-Content-Type-Options
nosniff
Strict-Transport-Security
max-age=31536000; includeSubDomains
Last-Modified
Fri, 30 Sep 2022 17:56:38 GMT
X-Permitted-Cross-Domain-Policies
none
ETag
"0cfc0fcf5d4d81:0"
X-Powered-By
ASP.NET
X-Frame-Options
SAMEORIGIN
Content-Type
image/png
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
1901
X-Xss-Protection
1; mode=block
Public-Key-Pins
pin-sha256='X3pGTSOuJeEVw989IJ/cEtXUEmy52zs1TZQrU06KUKg='; pin-sha256='MHJYVThihUrJcxW6wcqyOISTXIsInsdj3xK8QrZbHec='; pin-sha256='isi41AizREkLvvft0IRW4u3XMFR2Yg7bvrF7padyCJg='; includeSubdomains; max-age=2592000
ico-paymeback.png
www.firstcitizensrewards.com/images/ 		5 KB
6 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.firstcitizensrewards.com/images/ico-paymeback.png
Requested by
Host: www.firstcitizensrewards.com
URL: https://www.firstcitizensrewards.com/pages/main/default.aspx
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
129.159.127.141 Ashburn, United States, ASN31898 (ORACLE-BMC-31898, US),
Reverse DNS
Software
/ ASP.NET
Resource Hash
ff82e79f2a1b80b68510c46cd0693a87a8d27a6984fd69c8613329fc0ba523b3
Security Headers
Name Value
Content-Security-Policy default-src https: data: 'unsafe-inline' 'unsafe-eval'
Public-Key-Pins pin-sha256='X3pGTSOuJeEVw989IJ/cEtXUEmy52zs1TZQrU06KUKg='; pin-sha256='MHJYVThihUrJcxW6wcqyOISTXIsInsdj3xK8QrZbHec='; pin-sha256='isi41AizREkLvvft0IRW4u3XMFR2Yg7bvrF7padyCJg='; includeSubdomains; max-age=2592000
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

sec-ch-ua
"Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer
https://www.firstcitizensrewards.com/pages/main/default.aspx
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

Date
Fri, 31 May 2024 22:46:08 GMT
Content-Security-Policy
default-src https: data: 'unsafe-inline' 'unsafe-eval'
X-Content-Type-Options
nosniff
Strict-Transport-Security
max-age=31536000; includeSubDomains
Last-Modified
Fri, 30 Sep 2022 17:56:38 GMT
X-Permitted-Cross-Domain-Policies
none
ETag
"0cfc0fcf5d4d81:0"
X-Powered-By
ASP.NET
X-Frame-Options
SAMEORIGIN
Content-Type
image/png
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
5047
X-Xss-Protection
1; mode=block
Public-Key-Pins
pin-sha256='X3pGTSOuJeEVw989IJ/cEtXUEmy52zs1TZQrU06KUKg='; pin-sha256='MHJYVThihUrJcxW6wcqyOISTXIsInsdj3xK8QrZbHec='; pin-sha256='isi41AizREkLvvft0IRW4u3XMFR2Yg7bvrF7padyCJg='; includeSubdomains; max-age=2592000
skrollr.min.js
www.firstcitizensrewards.com/scripts/ 		11 KB
7 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.firstcitizensrewards.com/scripts/skrollr.min.js
Requested by
Host: www.firstcitizensrewards.com
URL: https://www.firstcitizensrewards.com/pages/main/default.aspx
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
129.159.127.141 Ashburn, United States, ASN31898 (ORACLE-BMC-31898, US),
Reverse DNS
Software
/ ASP.NET
Resource Hash
c2c10abb0f3eb00cfe81e422269b2c8f27b33ddbfa33507a1687aae45305f606
Security Headers
Name Value
Content-Security-Policy default-src https: data: 'unsafe-inline' 'unsafe-eval'
Public-Key-Pins pin-sha256='X3pGTSOuJeEVw989IJ/cEtXUEmy52zs1TZQrU06KUKg='; pin-sha256='MHJYVThihUrJcxW6wcqyOISTXIsInsdj3xK8QrZbHec='; pin-sha256='isi41AizREkLvvft0IRW4u3XMFR2Yg7bvrF7padyCJg='; includeSubdomains; max-age=2592000
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

sec-ch-ua
"Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer
https://www.firstcitizensrewards.com/pages/main/default.aspx
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

Date
Fri, 31 May 2024 22:46:08 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Content-Security-Policy
default-src https: data: 'unsafe-inline' 'unsafe-eval'
X-Permitted-Cross-Domain-Policies
none
Strict-Transport-Security
max-age=31536000; includeSubDomains
X-Powered-By
ASP.NET
Connection
keep-alive
Content-Length
5953
X-Xss-Protection
1; mode=block
Public-Key-Pins
pin-sha256='X3pGTSOuJeEVw989IJ/cEtXUEmy52zs1TZQrU06KUKg='; pin-sha256='MHJYVThihUrJcxW6wcqyOISTXIsInsdj3xK8QrZbHec='; pin-sha256='isi41AizREkLvvft0IRW4u3XMFR2Yg7bvrF7padyCJg='; includeSubdomains; max-age=2592000
Last-Modified
Fri, 08 Dec 2023 16:18:57 GMT
ETag
"bd20eb3ef229da1:0"
Vary
Accept-Encoding
X-Frame-Options
SAMEORIGIN
Content-Type
application/javascript
Accept-Ranges
bytes
jquery.nicescroll.min.js
www.firstcitizensrewards.com/scripts/ 		57 KB
22 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.firstcitizensrewards.com/scripts/jquery.nicescroll.min.js
Requested by
Host: www.firstcitizensrewards.com
URL: https://www.firstcitizensrewards.com/pages/main/default.aspx
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
129.159.127.141 Ashburn, United States, ASN31898 (ORACLE-BMC-31898, US),
Reverse DNS
Software
/ ASP.NET
Resource Hash
286f2ddd2a473e6a567380ecb5f6440b8943865ba4690e4ae15a2f34a8a3b297
Security Headers
Name Value
Content-Security-Policy default-src https: data: 'unsafe-inline' 'unsafe-eval'
Public-Key-Pins pin-sha256='X3pGTSOuJeEVw989IJ/cEtXUEmy52zs1TZQrU06KUKg='; pin-sha256='MHJYVThihUrJcxW6wcqyOISTXIsInsdj3xK8QrZbHec='; pin-sha256='isi41AizREkLvvft0IRW4u3XMFR2Yg7bvrF7padyCJg='; includeSubdomains; max-age=2592000
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

sec-ch-ua
"Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer
https://www.firstcitizensrewards.com/pages/main/default.aspx
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

Date
Fri, 31 May 2024 22:46:08 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Content-Security-Policy
default-src https: data: 'unsafe-inline' 'unsafe-eval'
X-Permitted-Cross-Domain-Policies
none
Strict-Transport-Security
max-age=31536000; includeSubDomains
X-Powered-By
ASP.NET
Connection
keep-alive
Content-Length
21277
X-Xss-Protection
1; mode=block
Public-Key-Pins
pin-sha256='X3pGTSOuJeEVw989IJ/cEtXUEmy52zs1TZQrU06KUKg='; pin-sha256='MHJYVThihUrJcxW6wcqyOISTXIsInsdj3xK8QrZbHec='; pin-sha256='isi41AizREkLvvft0IRW4u3XMFR2Yg7bvrF7padyCJg='; includeSubdomains; max-age=2592000
Last-Modified
Fri, 08 Dec 2023 16:18:57 GMT
ETag
"fdd6e63ef229da1:0"
Vary
Accept-Encoding
X-Frame-Options
SAMEORIGIN
Content-Type
application/javascript
Accept-Ranges
bytes
jquery.nicescroll.plus.js
www.firstcitizensrewards.com/scripts/ 		3 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.firstcitizensrewards.com/scripts/jquery.nicescroll.plus.js
Requested by
Host: www.firstcitizensrewards.com
URL: https://www.firstcitizensrewards.com/pages/main/default.aspx
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
129.159.127.141 Ashburn, United States, ASN31898 (ORACLE-BMC-31898, US),
Reverse DNS
Software
/ ASP.NET
Resource Hash
dad91c0601fccbf443d580da55ebae4bf031190be711132e62bc7fb66040a3a3
Security Headers
Name Value
Content-Security-Policy default-src https: data: 'unsafe-inline' 'unsafe-eval'
Public-Key-Pins pin-sha256='X3pGTSOuJeEVw989IJ/cEtXUEmy52zs1TZQrU06KUKg='; pin-sha256='MHJYVThihUrJcxW6wcqyOISTXIsInsdj3xK8QrZbHec='; pin-sha256='isi41AizREkLvvft0IRW4u3XMFR2Yg7bvrF7padyCJg='; includeSubdomains; max-age=2592000
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

sec-ch-ua
"Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer
https://www.firstcitizensrewards.com/pages/main/default.aspx
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

Date
Fri, 31 May 2024 22:46:08 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Content-Security-Policy
default-src https: data: 'unsafe-inline' 'unsafe-eval'
X-Permitted-Cross-Domain-Policies
none
Strict-Transport-Security
max-age=31536000; includeSubDomains
X-Powered-By
ASP.NET
Connection
keep-alive
Content-Length
1284
X-Xss-Protection
1; mode=block
Public-Key-Pins
pin-sha256='X3pGTSOuJeEVw989IJ/cEtXUEmy52zs1TZQrU06KUKg='; pin-sha256='MHJYVThihUrJcxW6wcqyOISTXIsInsdj3xK8QrZbHec='; pin-sha256='isi41AizREkLvvft0IRW4u3XMFR2Yg7bvrF7padyCJg='; includeSubdomains; max-age=2592000
Last-Modified
Fri, 08 Dec 2023 16:18:57 GMT
ETag
"eefde63ef229da1:0"
Vary
Accept-Encoding
X-Frame-Options
SAMEORIGIN
Content-Type
application/javascript
Accept-Ranges
bytes
home.js
www.firstcitizensrewards.com/scripts/ 		11 KB
4 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.firstcitizensrewards.com/scripts/home.js
Requested by
Host: www.firstcitizensrewards.com
URL: https://www.firstcitizensrewards.com/pages/main/default.aspx
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
129.159.127.141 Ashburn, United States, ASN31898 (ORACLE-BMC-31898, US),
Reverse DNS
Software
/ ASP.NET
Resource Hash
baa7c3be80b75737198e340b51dd58300611afe62e67488f1856a20494ee98cd
Security Headers
Name Value
Content-Security-Policy default-src https: data: 'unsafe-inline' 'unsafe-eval'
Public-Key-Pins pin-sha256='X3pGTSOuJeEVw989IJ/cEtXUEmy52zs1TZQrU06KUKg='; pin-sha256='MHJYVThihUrJcxW6wcqyOISTXIsInsdj3xK8QrZbHec='; pin-sha256='isi41AizREkLvvft0IRW4u3XMFR2Yg7bvrF7padyCJg='; includeSubdomains; max-age=2592000
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

sec-ch-ua
"Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer
https://www.firstcitizensrewards.com/pages/main/default.aspx
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

Date
Fri, 31 May 2024 22:46:08 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Content-Security-Policy
default-src https: data: 'unsafe-inline' 'unsafe-eval'
X-Permitted-Cross-Domain-Policies
none
Strict-Transport-Security
max-age=31536000; includeSubDomains
X-Powered-By
ASP.NET
Connection
keep-alive
Content-Length
3152
X-Xss-Protection
1; mode=block
Public-Key-Pins
pin-sha256='X3pGTSOuJeEVw989IJ/cEtXUEmy52zs1TZQrU06KUKg='; pin-sha256='MHJYVThihUrJcxW6wcqyOISTXIsInsdj3xK8QrZbHec='; pin-sha256='isi41AizREkLvvft0IRW4u3XMFR2Yg7bvrF7padyCJg='; includeSubdomains; max-age=2592000
Last-Modified
Fri, 08 Dec 2023 16:18:57 GMT
ETag
"9f78e53ef229da1:0"
Vary
Accept-Encoding
X-Frame-Options
SAMEORIGIN
Content-Type
application/javascript
Accept-Ranges
bytes
privacy-icon.png
www.firstcitizensrewards.com/images/icons/ 		3 KB
4 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.firstcitizensrewards.com/images/icons/privacy-icon.png
Requested by
Host: www.firstcitizensrewards.com
URL: https://www.firstcitizensrewards.com/pages/main/default.aspx
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
129.159.127.141 Ashburn, United States, ASN31898 (ORACLE-BMC-31898, US),
Reverse DNS
Software
/ ASP.NET
Resource Hash
0fe16f6f55669395a1a4e28b1b13bbc4f45c89609d07a9022aa5909c4ba8be45
Security Headers
Name Value
Content-Security-Policy default-src https: data: 'unsafe-inline' 'unsafe-eval'
Public-Key-Pins pin-sha256='X3pGTSOuJeEVw989IJ/cEtXUEmy52zs1TZQrU06KUKg='; pin-sha256='MHJYVThihUrJcxW6wcqyOISTXIsInsdj3xK8QrZbHec='; pin-sha256='isi41AizREkLvvft0IRW4u3XMFR2Yg7bvrF7padyCJg='; includeSubdomains; max-age=2592000
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

sec-ch-ua
"Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer
https://www.firstcitizensrewards.com/pages/main/default.aspx
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

Date
Fri, 31 May 2024 22:46:08 GMT
Content-Security-Policy
default-src https: data: 'unsafe-inline' 'unsafe-eval'
X-Content-Type-Options
nosniff
Strict-Transport-Security
max-age=31536000; includeSubDomains
Last-Modified
Thu, 21 Mar 2024 14:33:26 GMT
X-Permitted-Cross-Domain-Policies
none
ETag
"881c67bc9c7bda1:0"
X-Powered-By
ASP.NET
X-Frame-Options
SAMEORIGIN
Content-Type
image/png
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
3060
X-Xss-Protection
1; mode=block
Public-Key-Pins
pin-sha256='X3pGTSOuJeEVw989IJ/cEtXUEmy52zs1TZQrU06KUKg='; pin-sha256='MHJYVThihUrJcxW6wcqyOISTXIsInsdj3xK8QrZbHec='; pin-sha256='isi41AizREkLvvft0IRW4u3XMFR2Yg7bvrF7padyCJg='; includeSubdomains; max-age=2592000
js
www.firstcitizensrewards.com/scripts/ 		64 KB
17 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.firstcitizensrewards.com/scripts/js?v=i4XAIYifWI6huCxVnvhGaTJ9YD5rjk6aiAF_BqobFHw1
Requested by
Host: www.firstcitizensrewards.com
URL: https://www.firstcitizensrewards.com/pages/main/default.aspx
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
129.159.127.141 Ashburn, United States, ASN31898 (ORACLE-BMC-31898, US),
Reverse DNS
Software
/ ASP.NET
Resource Hash
14375c33a937b11eb428ebad24b3e649f72046191e9b1af18e23dbcfd987a2bf
Security Headers
Name Value
Content-Security-Policy default-src https: data: 'unsafe-inline' 'unsafe-eval'
Public-Key-Pins pin-sha256='X3pGTSOuJeEVw989IJ/cEtXUEmy52zs1TZQrU06KUKg='; pin-sha256='MHJYVThihUrJcxW6wcqyOISTXIsInsdj3xK8QrZbHec='; pin-sha256='isi41AizREkLvvft0IRW4u3XMFR2Yg7bvrF7padyCJg='; includeSubdomains; max-age=2592000
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

sec-ch-ua
"Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer
https://www.firstcitizensrewards.com/pages/main/default.aspx
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

Date
Fri, 31 May 2024 22:46:08 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Content-Security-Policy
default-src https: data: 'unsafe-inline' 'unsafe-eval'
X-Permitted-Cross-Domain-Policies
none
X-AspNet-Version
4.0.30319
X-Powered-By
ASP.NET
Strict-Transport-Security
max-age=31536000; includeSubDomains
Connection
keep-alive
Content-Length
16346
X-Xss-Protection
1; mode=block
Public-Key-Pins
pin-sha256='X3pGTSOuJeEVw989IJ/cEtXUEmy52zs1TZQrU06KUKg='; pin-sha256='MHJYVThihUrJcxW6wcqyOISTXIsInsdj3xK8QrZbHec='; pin-sha256='isi41AizREkLvvft0IRW4u3XMFR2Yg7bvrF7padyCJg='; includeSubdomains; max-age=2592000
Last-Modified
Fri, 31 May 2024 22:46:08 GMT
Vary
User-Agent
X-Frame-Options
SAMEORIGIN
Content-Type
text/javascript; charset=utf-8
Cache-Control
public
Expires
Sat, 31 May 2025 22:46:08 GMT
recaptcha__de.js
www.gstatic.com/recaptcha/releases/DH3nyJMamEclyfe-nztbfV8S/ 		528 KB
210 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.gstatic.com/recaptcha/releases/DH3nyJMamEclyfe-nztbfV8S/recaptcha__de.js
Requested by
Host: www.firstcitizensrewards.com
URL: https://www.firstcitizensrewards.com/pages/main/default.aspx
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80b::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
772ba4e7c02a03b95bd8fef71e44798097c7c37dc97d513843dceee897354738
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

sec-ch-ua
"Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer
https://www.firstcitizensrewards.com/
Origin
https://www.firstcitizensrewards.com
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Fri, 31 May 2024 17:22:15 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
19433
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
214205
x-xss-protection
0
last-modified
Mon, 27 May 2024 02:00:43 GMT
server
sffe
cross-origin-opener-policy
same-origin-allow-popups; report-to="recaptcha"
vary
Accept-Encoding
report-to
{"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-type
text/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
expires
Sat, 31 May 2025 17:22:15 GMT
memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2
fonts.gstatic.com/s/opensans/v40/ 		47 KB
48 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/opensans/v40/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Open+Sans:ital,wght@0,300..800;1,300..800&display=swap
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80b::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
3c4d6a1421c7ddb7e404521fe8c4cd5be5af446d7689cd880be26612eaad3cfa
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

sec-ch-ua
"Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer
https://fonts.googleapis.com/
Origin
https://www.firstcitizensrewards.com
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Tue, 28 May 2024 00:50:53 GMT
x-content-type-options
nosniff
age
338115
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
48236
x-xss-protection
0
last-modified
Thu, 14 Dec 2023 02:08:40 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="apps-themes"
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Wed, 28 May 2025 00:50:53 GMT
e639ac4f-3e52-415f-bdff-64af748bcb40.json
cdn.cookielaw.org/consent/e639ac4f-3e52-415f-bdff-64af748bcb40/ 		4 KB
2 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://cdn.cookielaw.org/consent/e639ac4f-3e52-415f-bdff-64af748bcb40/e639ac4f-3e52-415f-bdff-64af748bcb40.json
Requested by
Host: www.firstcitizensrewards.com
URL: https://www.firstcitizensrewards.com/pages/main/default.aspx
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6813:b234 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
2be1c3e225ee5c8ca6e57bfb832c5d1f36a09618d6123fc70b8a012271492e83
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

sec-ch-ua
"Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer
https://www.firstcitizensrewards.com/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

x-ms-blob-type
BlockBlob
date
Fri, 31 May 2024 22:46:08 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
strict-transport-security
max-age=31536000; includeSubDomains; preload
age
730
content-md5
F/74Cj0btvJZ9Oysp50RGw==
content-length
1562
x-ms-lease-status
unlocked
last-modified
Thu, 28 Mar 2024 18:06:35 GMT
server
cloudflare
etag
0x8DC4F51CE3BB248
vary
Accept-Encoding
content-type
application/x-javascript
access-control-allow-origin
*
x-ms-request-id
07a2ff8b-201e-004a-3c3a-819a0c000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
public, max-age=86400
x-ms-version
2009-09-19
accept-ranges
bytes
cf-ray
88ca7f8e0fee3633-FRA
expires
Sat, 01 Jun 2024 22:46:08 GMT
ajax-loader.gif
www.firstcitizensrewards.com/images/ 		35 KB
35 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.firstcitizensrewards.com/images/ajax-loader.gif
Requested by
Host: www.firstcitizensrewards.com
URL: https://www.firstcitizensrewards.com/styles/css?v=1fK4Iiv3WVaW-1rlD53ZS6FJCypPcwRsK81GUUH_SPU1
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
129.159.127.141 Ashburn, United States, ASN31898 (ORACLE-BMC-31898, US),
Reverse DNS
Software
/ ASP.NET
Resource Hash
76507a6f9071663991ae6cae6a64803966acdee47d09aad3a6cff802bd88d1ad
Security Headers
Name Value
Content-Security-Policy default-src https: data: 'unsafe-inline' 'unsafe-eval'
Public-Key-Pins pin-sha256='X3pGTSOuJeEVw989IJ/cEtXUEmy52zs1TZQrU06KUKg='; pin-sha256='MHJYVThihUrJcxW6wcqyOISTXIsInsdj3xK8QrZbHec='; pin-sha256='isi41AizREkLvvft0IRW4u3XMFR2Yg7bvrF7padyCJg='; includeSubdomains; max-age=2592000
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

sec-ch-ua
"Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer
https://www.firstcitizensrewards.com/styles/css?v=1fK4Iiv3WVaW-1rlD53ZS6FJCypPcwRsK81GUUH_SPU1
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

Date
Fri, 31 May 2024 22:46:08 GMT
Content-Security-Policy
default-src https: data: 'unsafe-inline' 'unsafe-eval'
X-Content-Type-Options
nosniff
Strict-Transport-Security
max-age=31536000; includeSubDomains
Last-Modified
Fri, 30 Sep 2022 17:56:38 GMT
X-Permitted-Cross-Domain-Policies
none
ETag
"0cfc0fcf5d4d81:0"
X-Powered-By
ASP.NET
X-Frame-Options
SAMEORIGIN
Content-Type
image/gif
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
35487
X-Xss-Protection
1; mode=block
Public-Key-Pins
pin-sha256='X3pGTSOuJeEVw989IJ/cEtXUEmy52zs1TZQrU06KUKg='; pin-sha256='MHJYVThihUrJcxW6wcqyOISTXIsInsdj3xK8QrZbHec='; pin-sha256='isi41AizREkLvvft0IRW4u3XMFR2Yg7bvrF7padyCJg='; includeSubdomains; max-age=2592000
95820211-5ad1-4e37-86d2-ae8298fb66dc.jpeg
www.firstcitizensrewards.com/graphics/ 		70 KB
71 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.firstcitizensrewards.com/graphics/95820211-5ad1-4e37-86d2-ae8298fb66dc.jpeg
Requested by
Host: www.firstcitizensrewards.com
URL: https://www.firstcitizensrewards.com/pages/main/default.aspx
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
129.159.127.141 Ashburn, United States, ASN31898 (ORACLE-BMC-31898, US),
Reverse DNS
Software
/ ASP.NET
Resource Hash
de627a6e09cb3acb54527014037130f35fb8a5037a7b98bc6d48d0f1a1eb9d32
Security Headers
Name Value
Content-Security-Policy default-src https: data: 'unsafe-inline' 'unsafe-eval'
Public-Key-Pins pin-sha256='X3pGTSOuJeEVw989IJ/cEtXUEmy52zs1TZQrU06KUKg='; pin-sha256='MHJYVThihUrJcxW6wcqyOISTXIsInsdj3xK8QrZbHec='; pin-sha256='isi41AizREkLvvft0IRW4u3XMFR2Yg7bvrF7padyCJg='; includeSubdomains; max-age=2592000
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

sec-ch-ua
"Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer
https://www.firstcitizensrewards.com/pages/main/default.aspx
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

Date
Fri, 31 May 2024 22:46:08 GMT
Content-Security-Policy
default-src https: data: 'unsafe-inline' 'unsafe-eval'
X-Content-Type-Options
nosniff
Strict-Transport-Security
max-age=31536000; includeSubDomains
Last-Modified
Mon, 04 Mar 2024 20:14:28 GMT
X-Permitted-Cross-Domain-Policies
none
ETag
"fe71a68f706eda1:0"
X-Powered-By
ASP.NET
X-Frame-Options
SAMEORIGIN
Content-Type
image/jpeg
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
71611
X-Xss-Protection
1; mode=block
Public-Key-Pins
pin-sha256='X3pGTSOuJeEVw989IJ/cEtXUEmy52zs1TZQrU06KUKg='; pin-sha256='MHJYVThihUrJcxW6wcqyOISTXIsInsdj3xK8QrZbHec='; pin-sha256='isi41AizREkLvvft0IRW4u3XMFR2Yg7bvrF7padyCJg='; includeSubdomains; max-age=2592000
location
geolocation.onetrust.com/cookieconsentpub/v1/geo/ 		59 B
304 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://geolocation.onetrust.com/cookieconsentpub/v1/geo/location
Requested by
Host: www.firstcitizensrewards.com
URL: https://www.firstcitizensrewards.com/pages/main/default.aspx
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:4400::6812:2089 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
2157361193375a79ade3559e960f982daa8d599cf7f4a92d36e3eef257738f16
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

sec-ch-ua
"Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
accept
application/json
Referer
https://www.firstcitizensrewards.com/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Fri, 31 May 2024 22:46:08 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-encoding
gzip
server
cloudflare
vary
Accept-Encoding
access-control-allow-methods
GET, OPTIONS
content-type
application/json
access-control-allow-origin
*
cf-ray
88ca7f8f5c2719a0-FRA
access-control-allow-headers
Content-Type
skrollrOn.js
www.firstcitizensrewards.com/(S(aovfgoe32fvgrpgcxyp0eaez))/scripts/ 		471 B
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.firstcitizensrewards.com/(S(aovfgoe32fvgrpgcxyp0eaez))/scripts/skrollrOn.js
Requested by
Host: www.firstcitizensrewards.com
URL: https://www.firstcitizensrewards.com/pages/main/default.aspx
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
129.159.127.141 Ashburn, United States, ASN31898 (ORACLE-BMC-31898, US),
Reverse DNS
Software
/ ASP.NET
Resource Hash
cd5a3f1c1f93534dc249e34e094d9f59c542db4f49ec710f4f6b1c36dae5458c
Security Headers
Name Value
Content-Security-Policy default-src https: data: 'unsafe-inline' 'unsafe-eval'
Public-Key-Pins pin-sha256='X3pGTSOuJeEVw989IJ/cEtXUEmy52zs1TZQrU06KUKg='; pin-sha256='MHJYVThihUrJcxW6wcqyOISTXIsInsdj3xK8QrZbHec='; pin-sha256='isi41AizREkLvvft0IRW4u3XMFR2Yg7bvrF7padyCJg='; includeSubdomains; max-age=2592000
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

sec-ch-ua
"Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer
https://www.firstcitizensrewards.com/pages/main/default.aspx
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

Date
Fri, 31 May 2024 22:46:08 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Content-Security-Policy
default-src https: data: 'unsafe-inline' 'unsafe-eval'
X-Permitted-Cross-Domain-Policies
none
Strict-Transport-Security
max-age=31536000; includeSubDomains
X-Powered-By
ASP.NET
Connection
keep-alive
Content-Length
390
X-Xss-Protection
1; mode=block
Public-Key-Pins
pin-sha256='X3pGTSOuJeEVw989IJ/cEtXUEmy52zs1TZQrU06KUKg='; pin-sha256='MHJYVThihUrJcxW6wcqyOISTXIsInsdj3xK8QrZbHec='; pin-sha256='isi41AizREkLvvft0IRW4u3XMFR2Yg7bvrF7padyCJg='; includeSubdomains; max-age=2592000
Last-Modified
Fri, 08 Dec 2023 16:18:57 GMT
ETag
"2f4eeb3ef229da1:0"
Vary
Accept-Encoding
X-Frame-Options
SAMEORIGIN
Content-Type
application/javascript
Accept-Ranges
bytes
otBannerSdk.js
cdn.cookielaw.org/scripttemplates/202307.1.0/ 		405 KB
98 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.cookielaw.org/scripttemplates/202307.1.0/otBannerSdk.js
Requested by
Host: www.firstcitizensrewards.com
URL: https://www.firstcitizensrewards.com/pages/main/default.aspx
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6813:b234 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
71d07479f4b2b809e5769a352f4f55b84690289026ace7ed5395230002551a11
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

sec-ch-ua
"Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer
https://www.firstcitizensrewards.com/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

x-ms-blob-type
BlockBlob
date
Fri, 31 May 2024 22:46:08 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
content-md5
orDm7smwsr/pjTi/DOTSGQ==
age
17087
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-length
99815
x-ms-lease-status
unlocked
last-modified
Wed, 02 Aug 2023 03:24:04 GMT
server
cloudflare
etag
0x8DB9307EC3B2CDE
vary
Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
x-ms-request-id
1e317a27-c01e-0099-0a64-14463e000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
max-age=86400
x-ms-version
2009-09-19
accept-ranges
bytes
cf-ray
88ca7f8fab52994e-FRA
en.json
cdn.cookielaw.org/consent/e639ac4f-3e52-415f-bdff-64af748bcb40/4eb8737b-b622-444e-954d-f9c9d20eff66/ 		38 KB
11 KB 		Fetch
General
Check archive.org
Download Go to
Full URL
https://cdn.cookielaw.org/consent/e639ac4f-3e52-415f-bdff-64af748bcb40/4eb8737b-b622-444e-954d-f9c9d20eff66/en.json
Requested by
Host: www.firstcitizensrewards.com
URL: https://www.firstcitizensrewards.com/pages/main/default.aspx
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6813:b234 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
762016311d50e94c745622bc807da9ffaad8d1b552324c25d24faedaddb0755e
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

sec-ch-ua
"Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer
https://www.firstcitizensrewards.com/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

x-ms-blob-type
BlockBlob
date
Fri, 31 May 2024 22:46:08 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
strict-transport-security
max-age=31536000; includeSubDomains; preload
age
730
content-md5
gNXFv7PIx4LUP0XhjDSJFA==
content-length
11464
x-ms-lease-status
unlocked
last-modified
Thu, 28 Mar 2024 18:06:39 GMT
server
cloudflare
etag
0x8DC4F51D0D313DA
vary
Accept-Encoding
content-type
application/x-javascript
access-control-allow-origin
*
x-ms-request-id
e66433b8-c01e-0030-0a3e-81874c000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
public, max-age=86400
x-ms-version
2009-09-19
accept-ranges
bytes
cf-ray
88ca7f902a043633-FRA
expires
Sat, 01 Jun 2024 22:46:08 GMT
otFlat.json
cdn.cookielaw.org/scripttemplates/202307.1.0/assets/ 		13 KB
3 KB 		Fetch
General
Check archive.org
Download Go to
Full URL
https://cdn.cookielaw.org/scripttemplates/202307.1.0/assets/otFlat.json
Requested by
Host: www.firstcitizensrewards.com
URL: https://www.firstcitizensrewards.com/pages/main/default.aspx
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6813:b234 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
ea5db5581e262d77d1a43fbb3f0fa3661b51d097b40ca38f584b4943f47cf2e0
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

sec-ch-ua
"Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer
https://www.firstcitizensrewards.com/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

x-ms-blob-type
BlockBlob
date
Fri, 31 May 2024 22:46:08 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
content-md5
Ouu54lzG2wJaO/UHcdVWaA==
age
730
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-length
3017
x-ms-lease-status
unlocked
last-modified
Wed, 02 Aug 2023 03:23:58 GMT
server
cloudflare
etag
0x8DB9307E8B8F39C
vary
Accept-Encoding
content-type
application/json
access-control-allow-origin
*
x-ms-request-id
0b5647b5-f01e-0073-50d3-9b31aa000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
max-age=86400
x-ms-version
2009-09-19
accept-ranges
bytes
cf-ray
88ca7f908a5b3633-FRA
otPcPanel.json
cdn.cookielaw.org/scripttemplates/202307.1.0/assets/v2/ 		63 KB
13 KB 		Fetch
General
Check archive.org
Download Go to
Full URL
https://cdn.cookielaw.org/scripttemplates/202307.1.0/assets/v2/otPcPanel.json
Requested by
Host: www.firstcitizensrewards.com
URL: https://www.firstcitizensrewards.com/pages/main/default.aspx
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6813:b234 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
00b7928237d68d4ee4ee4d9c48e47ca0295e1d93ad19da367f813595efc7c539
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

sec-ch-ua
"Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer
https://www.firstcitizensrewards.com/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

x-ms-blob-type
BlockBlob
date
Fri, 31 May 2024 22:46:08 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
content-md5
i1GPeZv2eEVMAO6Y1rzktA==
age
730
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-length
12707
x-ms-lease-status
unlocked
last-modified
Wed, 02 Aug 2023 03:24:00 GMT
server
cloudflare
etag
0x8DB9307EA219D0E
vary
Accept-Encoding
content-type
application/json
access-control-allow-origin
*
x-ms-request-id
59084f2f-301e-0047-29d3-9b9e02000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
max-age=86400
x-ms-version
2009-09-19
accept-ranges
bytes
cf-ray
88ca7f908a5e3633-FRA
otCommonStyles.css
cdn.cookielaw.org/scripttemplates/202307.1.0/assets/ 		21 KB
4 KB 		Fetch
General
Check archive.org
Download Go to
Full URL
https://cdn.cookielaw.org/scripttemplates/202307.1.0/assets/otCommonStyles.css
Requested by
Host: www.firstcitizensrewards.com
URL: https://www.firstcitizensrewards.com/pages/main/default.aspx
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6813:b234 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
9ed6388d56fc9f2044791e0559ab4a283381791e359dc2981449955e702de56d
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

sec-ch-ua
"Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer
https://www.firstcitizensrewards.com/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

x-ms-blob-type
BlockBlob
date
Fri, 31 May 2024 22:46:08 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-content-type-options
nosniff
cf-cache-status
HIT
content-encoding
gzip
content-md5
/b68gAlvQhCuyX9fCPcDyg==
age
730
x-ms-lease-status
unlocked
last-modified
Wed, 02 Aug 2023 03:24:08 GMT
server
cloudflare
vary
Accept-Encoding
content-type
text/css
access-control-allow-origin
*
x-ms-request-id
f53f2197-201e-003e-08d3-9bf748000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
max-age=86400
x-ms-version
2009-09-19
cf-ray
88ca7f908a5f3633-FRA
ot_guard_logo.svg
cdn.cookielaw.org/logos/static/ 		497 B
490 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://cdn.cookielaw.org/logos/static/ot_guard_logo.svg
Requested by
Host: www.firstcitizensrewards.com
URL: https://www.firstcitizensrewards.com/pages/main/default.aspx
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6813:b234 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
691dcdb24853a0f5ce4e6597e5713dea66799b57ffe2c2a10f28f98e0b569b19
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

sec-ch-ua
"Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer
https://www.firstcitizensrewards.com/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

x-ms-blob-type
BlockBlob
date
Fri, 31 May 2024 22:46:08 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-content-type-options
nosniff
cf-cache-status
HIT
content-encoding
gzip
content-md5
tXyZydHjxQshFMbbBT1/8A==
age
730
x-ms-lease-status
unlocked
last-modified
Thu, 30 May 2024 19:49:46 GMT
server
cloudflare
vary
Accept-Encoding
content-type
image/svg+xml
access-control-allow-origin
*
x-ms-request-id
4368028a-a01e-0006-02ea-b2b611000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
max-age=86400
x-ms-version
2009-09-19
cf-ray
88ca7f90eab13633-FRA
FCB_logo@2x.png
cdn.cookielaw.org/logos/d2bc0e29-67e0-421a-b86a-5279e81b9a6d/c04cd3c2-56b3-4a0a-a5f8-fa7f77eeccec/4589db89-3dd1-4abc-831d-926355bb8433/ 		21 KB
21 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cdn.cookielaw.org/logos/d2bc0e29-67e0-421a-b86a-5279e81b9a6d/c04cd3c2-56b3-4a0a-a5f8-fa7f77eeccec/4589db89-3dd1-4abc-831d-926355bb8433/FCB_logo@2x.png
Requested by
Host: www.firstcitizensrewards.com
URL: https://www.firstcitizensrewards.com/pages/main/default.aspx
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6813:b234 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
23ddceb8b21381a5d53e5d415e3e0f0a3f7700fbed16966cb04e9e66eae80ebd
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

sec-ch-ua
"Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer
https://www.firstcitizensrewards.com/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

x-ms-blob-type
BlockBlob
date
Fri, 31 May 2024 22:46:08 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-content-type-options
nosniff
cf-cache-status
HIT
content-md5
B7zZ6Qf3UBM788LBSPntGA==
age
730
content-length
21714
x-ms-lease-status
unlocked
last-modified
Thu, 03 Aug 2023 15:31:15 GMT
server
cloudflare
etag
0x8DB9436AD3187C6
vary
Accept-Encoding
content-type
image/png
access-control-allow-origin
*
x-ms-request-id
2445307f-201e-0028-3f31-7c582b000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
max-age=86400
x-ms-version
2009-09-19
accept-ranges
bytes
cf-ray
88ca7f90fc12994e-FRA
powered_by_logo.svg
cdn.cookielaw.org/logos/static/ 		5 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cdn.cookielaw.org/logos/static/powered_by_logo.svg
Requested by
Host: www.firstcitizensrewards.com
URL: https://www.firstcitizensrewards.com/pages/main/default.aspx
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6813:b234 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
5fa00d047acd959697b9d7772c31dcd37bec33c70c6fbf80ab8316205d1d286d
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

sec-ch-ua
"Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer
https://www.firstcitizensrewards.com/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

x-ms-blob-type
BlockBlob
date
Fri, 31 May 2024 22:46:08 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-content-type-options
nosniff
cf-cache-status
HIT
content-encoding
gzip
content-md5
Y+c301RBZNK39PvKQWrIBw==
age
80877
x-ms-lease-status
unlocked
last-modified
Wed, 29 May 2024 06:37:40 GMT
server
cloudflare
vary
Accept-Encoding
content-type
image/svg+xml
access-control-allow-origin
*
x-ms-request-id
8764927a-001e-004f-63fb-b18571000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
max-age=86400
x-ms-version
2009-09-19
cf-ray
88ca7f90fc13994e-FRA
nr-spa-1.260.1.min.js
js-agent.newrelic.com/ 		106 KB
34 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://js-agent.newrelic.com/nr-spa-1.260.1.min.js
Requested by
Host: www.firstcitizensrewards.com
URL: https://www.firstcitizensrewards.com/pages/main/default.aspx
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2602:816:5001::39 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
f941e01a27c4568da7a81f5cb516b5d2056b14b88cccf3c53f647bde767e0919
Security Headers
Name Value
Strict-Transport-Security max-age=300

Request headers

sec-ch-ua
"Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer
https://www.firstcitizensrewards.com/
Origin
https://www.firstcitizensrewards.com
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

x-amz-version-id
Yrbdc1GL627m.B3Rf5_UelmBfBfYfLKU
content-encoding
br
via
1.1 varnish
date
Fri, 31 May 2024 22:46:09 GMT
strict-transport-security
max-age=300
x-amz-request-id
C18Q9GZGDB76CJP0
x-amz-server-side-encryption
AES256
x-cache
HIT
cross-origin-resource-policy
cross-origin
content-length
34121
x-amz-id-2
I4CtaVD3/eXa3oqlW9MTF7VBxUZO5h7vaoHIdfibg6XM7vGmbEkSqaX1jOHmNKquyhCQ3Dp/eO8=
x-served-by
cache-fra-eddf8230059-FRA
last-modified
Mon, 20 May 2024 17:44:49 GMT
server
AmazonS3
etag
"1221654800ab387071aa9e0bf5b47dde"
vary
Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000, stale-while-revalidate=86400, stale-if-error=86400
accept-ranges
bytes
x-cache-hits
712109
favicon.ico
www.firstcitizensrewards.com/ 		4 KB
5 KB 		Other
General
Check archive.org
Download Go to
Full URL
https://www.firstcitizensrewards.com/favicon.ico
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
129.159.127.141 Ashburn, United States, ASN31898 (ORACLE-BMC-31898, US),
Reverse DNS
Software
/ ASP.NET
Resource Hash
fbee6d88708a48fa23e90c886e63bd7e0efd667d65081764b1aa6b6337734294
Security Headers
Name Value
Content-Security-Policy default-src https: data: 'unsafe-inline' 'unsafe-eval'
Public-Key-Pins pin-sha256='X3pGTSOuJeEVw989IJ/cEtXUEmy52zs1TZQrU06KUKg='; pin-sha256='MHJYVThihUrJcxW6wcqyOISTXIsInsdj3xK8QrZbHec='; pin-sha256='isi41AizREkLvvft0IRW4u3XMFR2Yg7bvrF7padyCJg='; includeSubdomains; max-age=2592000
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

sec-ch-ua
"Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer
https://www.firstcitizensrewards.com/pages/main/default.aspx
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

Date
Fri, 31 May 2024 22:46:09 GMT
Content-Security-Policy
default-src https: data: 'unsafe-inline' 'unsafe-eval'
X-Content-Type-Options
nosniff
Strict-Transport-Security
max-age=31536000; includeSubDomains
Last-Modified
Fri, 08 Dec 2023 16:18:53 GMT
X-Permitted-Cross-Domain-Policies
none
ETag
"1b47c13cf229da1:0"
X-Powered-By
ASP.NET
X-Frame-Options
SAMEORIGIN
Content-Type
image/x-icon
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
4286
X-Xss-Protection
1; mode=block
Public-Key-Pins
pin-sha256='X3pGTSOuJeEVw989IJ/cEtXUEmy52zs1TZQrU06KUKg='; pin-sha256='MHJYVThihUrJcxW6wcqyOISTXIsInsdj3xK8QrZbHec='; pin-sha256='isi41AizREkLvvft0IRW4u3XMFR2Yg7bvrF7padyCJg='; includeSubdomains; max-age=2592000
7a0c53188b
bam.nr-data.net/1/ 		151 B
624 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://bam.nr-data.net/1/7a0c53188b?a=1740101401&v=1.260.1&to=ZQEAYBRTCEUFUxFYWFxLI2c2HRZXA1UWHlpTDQwbAlcAVxFcER9WQRQa&rst=3194&ck=0&s=ac362003cc166caf&ref=https://www.firstcitizensrewards.com/pages/main/default.aspx&ptid=dafd2df55a3bc338&af=err,xhr,stn,ins,spa&ap=24&be=1218&fe=1793&dc=1076&fsh=1&perf=%7B%22timing%22:%7B%22of%22:1717195566145,%22n%22:0,%22f%22:1039,%22dn%22:1039,%22dne%22:1039,%22c%22:1039,%22s%22:1039,%22ce%22:1039,%22rq%22:1042,%22rp%22:1219,%22rpe%22:1362,%22di%22:2288,%22ds%22:2288,%22de%22:2294,%22dc%22:2998,%22l%22:2998,%22le%22:3011%7D,%22navigation%22:%7B%7D%7D&fp=2170&fcp=2170
Requested by
Host: www.firstcitizensrewards.com
URL: https://www.firstcitizensrewards.com/pages/main/default.aspx
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
162.247.243.29 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
f6ed88e8b62002d94a050129963c4f83666c1894bcb8d2661c02d2b6c8f3491f

Request headers

sec-ch-ua
"Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
sec-ch-ua-platform
"Win32"
Referer
https://www.firstcitizensrewards.com/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
content-type
text/plain

Response headers

date
Fri, 31 May 2024 22:46:09 GMT
access-control-allow-methods
GET, POST, PUT, HEAD, OPTIONS
content-type
text/plain
access-control-allow-origin
https://www.firstcitizensrewards.com
access-control-expose-headers
Date
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
Connection
keep-alive
timing-allow-origin
https://www.firstcitizensrewards.com
Content-Length
151
x-served-by
cache-fra-eddf8230123-FRA
blobs
bam.nr-data.net/browser/ 		24 B
355 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://bam.nr-data.net/browser/blobs?browser_monitoring_key=7a0c53188b&type=BrowserSessionChunk&app_id=1740101401&protocol_version=0&timestamp=1717195565621&attributes=entityGuid%3DMTY0MzE4NHxCUk9XU0VSfEFQUExJQ0FUSU9OfDE4MzUwNDY0MDk%26harvestId%3Dac362003cc166caf_dafd2df55a3bc338_1%26trace.firstTimestamp%3D1717195565621%26trace.lastTimestamp%3D1717195568632%26trace.nodes%3D26%26trace.originTimestamp%3D1717195565621%26agentVersion%3D1.260.1%26firstSessionHarvest%3Dtrue%26ptid%3Ddafd2df55a3bc338%26session%3Dac362003cc166caf
Requested by
Host: www.firstcitizensrewards.com
URL: https://www.firstcitizensrewards.com/pages/main/default.aspx
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
162.247.243.29 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
0c9cf152a0ad00d4f102c93c613c104914be5517ac8f8e0831727f8bfbe8b300

Request headers

sec-ch-ua
"Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
sec-ch-ua-platform
"Win32"
Referer
https://www.firstcitizensrewards.com/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
content-type
text/plain

Response headers

date
Fri, 31 May 2024 22:46:09 GMT
access-control-allow-methods
GET, POST, PUT, HEAD, OPTIONS
content-type
image/gif
access-control-allow-origin
https://www.firstcitizensrewards.com
access-control-allow-credentials
true
Connection
keep-alive
Content-Length
24
x-served-by
cache-fra-eddf8230123-FRA
7a0c53188b
bam.nr-data.net/events/1/ 		24 B
355 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://bam.nr-data.net/events/1/7a0c53188b?a=1740101401&v=1.260.1&to=ZQEAYBRTCEUFUxFYWFxLI2c2HRZXA1UWHlpTDQwbAlcAVxFcER9WQRQa&rst=3834&ck=0&s=ac362003cc166caf&ref=https://www.firstcitizensrewards.com/pages/main/default.aspx&ptid=dafd2df55a3bc338
Requested by
Host: www.firstcitizensrewards.com
URL: https://www.firstcitizensrewards.com/pages/main/default.aspx
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
162.247.243.29 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
0c9cf152a0ad00d4f102c93c613c104914be5517ac8f8e0831727f8bfbe8b300

Request headers

sec-ch-ua
"Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
sec-ch-ua-platform
"Win32"
Referer
https://www.firstcitizensrewards.com/
Accept-Language
de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
content-type
text/plain

Response headers

date
Fri, 31 May 2024 22:46:10 GMT
access-control-allow-methods
GET, POST, PUT, HEAD, OPTIONS
content-type
image/gif
access-control-allow-origin
https://www.firstcitizensrewards.com
access-control-allow-credentials
true
Connection
keep-alive
Content-Length
24
x-served-by
cache-fra-eddf8230123-FRA

Verdicts & Comments Add Verdict or Comment

113 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| 1 object| NREUM object| webpackChunk:NRBA-1.260.1.PROD object| newrelic object| ___grecaptcha_cfg object| grecaptcha string| __recaptcha_api boolean| __google_recaptcha_client function| $ function| jQuery object| html5 object| Modernizr function| yepnope object| OneTrustStub function| OptanonWrapper object| theForm function| __doPostBack function| WebForm_PostBackOptions function| WebForm_DoPostBackWithOptions object| __pendingCallbacks number| __synchronousCallBackIndex function| WebForm_DoCallback function| WebForm_CallbackComplete function| WebForm_ExecuteCallback function| WebForm_FillFirstAvailableSlot boolean| __nonMSDOMBrowser string| __theFormPostData object| __theFormPostCollection object| __callbackTextTypes function| WebForm_InitCallback function| WebForm_InitCallbackAddField function| WebForm_EncodeCallback object| __disabledControlArray function| WebForm_ReEnableControls function| WebForm_ReDisableControls function| WebForm_SimulateClick function| WebForm_FireDefaultButton function| WebForm_GetScrollX function| WebForm_GetScrollY function| WebForm_SaveScrollPositionSubmit function| WebForm_SaveScrollPositionOnSubmit function| WebForm_RestoreScrollPosition function| WebForm_TextBoxKeyHandler function| WebForm_TrimString function| WebForm_AppendToClassName function| WebForm_RemoveClassName function| WebForm_GetElementById function| WebForm_GetElementByTagName function| WebForm_GetElementsByTagName function| WebForm_GetElementDir function| WebForm_GetElementPosition function| WebForm_GetParentByTagName function| WebForm_SetElementHeight function| WebForm_SetElementWidth function| WebForm_SetElementX function| WebForm_SetElementY function| $get function| $create function| $addHandler function| $addHandlers function| $clearHandlers object| Sys function| Type function| $removeHandler object| _events function| $find function| PageMethods object| skrollr object| NiceScroll boolean| animationOn object| docElem undefined| didScroll undefined| scrollPosition function| noScrollFn function| noScroll function| scrollFn function| canScroll function| scrollHandler function| scrollPage function| handleVideoFunction function| unhandleVideoFunction object| jQuery1111028820681486703403 object| head object| script number| maxTime function| keepMeAlive number| elapsedTime undefined| oneSecond function| timeoutCheck function| isMoney function| checkDecimals function| handleVideoFunctionRewards function| unhandleVideoFunctionRewards function| refreshsession function| validateRegistration function| LTrim function| RTrim function| trim function| charsleft number| maxChars object| App function| UIMorphingButton object| recaptcha string| OnetrustActiveGroups string| OptanonActiveGroups object| dataLayer object| otStubData object| Optanon object| OneTrust object| general_vars_object object| skrollr_var function| BezierClass

3 Cookies

Domain/Path Name / Value
www.firstcitizensrewards.com/ Name: X-Oracle-BMC-LBS-Route
Value: aacc460046ff9882e64ec67302eb4f4bdb7e0121
www.firstcitizensrewards.com/ Name: ASP.NET_SessionId
Value: j2tfabepes4jjywpgvczgihpbhQ19NzJJK5EDyoXsqQIqEd2FYI=
.firstcitizensrewards.com/ Name: OptanonConsent
Value: isGpcEnabled=0&datestamp=Sat+Jun+01+2024+00%3A46%3A08+GMT%2B0200+(Mitteleurop%C3%A4ische+Sommerzeit)&version=202307.1.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=6cb16f71-cf3f-4a94-9544-659017ff4ace&interactionCount=0&landingPath=https%3A%2F%2Fwww.firstcitizensrewards.com%2Fpages%2Fmain%2Fdefault.aspx&groups=C0001%3A1%2CC0002%3A0

1 Console Messages

Source Level URL
Text
recommendation verbose URL: https://www.firstcitizensrewards.com/pages/main/default.aspx
Message:
[DOM] Multiple forms should be contained in their own form elements; break up complex forms into ones that represent a single action: (More info: https://goo.gl/9p2vKq) %o

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Content-Security-Policy default-src https: data: 'unsafe-inline' 'unsafe-eval'
Public-Key-Pins pin-sha256='X3pGTSOuJeEVw989IJ/cEtXUEmy52zs1TZQrU06KUKg='; pin-sha256='MHJYVThihUrJcxW6wcqyOISTXIsInsdj3xK8QrZbHec='; pin-sha256='isi41AizREkLvvft0IRW4u3XMFR2Yg7bvrF7padyCJg='; includeSubdomains; max-age=2592000
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

bam.nr-data.net
cdn.cookielaw.org
fonts.googleapis.com
fonts.gstatic.com
geolocation.onetrust.com
js-agent.newrelic.com
www.firstcitizensrewards.com
www.google.com
www.gstatic.com
www.rewards.firstcitizens.com
129.159.127.141
142.250.184.228
162.247.243.29
2602:816:5001::39
2606:4700:4400::6812:2089
2606:4700::6813:b234
2a00:1450:4001:80b::2003
2a00:1450:4001:81d::200a
0085b16186957822940d8bcca5fb3c4b8c2d25ec43218dd1830d050e401f9f79
00b7928237d68d4ee4ee4d9c48e47ca0295e1d93ad19da367f813595efc7c539
0c9cf152a0ad00d4f102c93c613c104914be5517ac8f8e0831727f8bfbe8b300
0fe16f6f55669395a1a4e28b1b13bbc4f45c89609d07a9022aa5909c4ba8be45
14375c33a937b11eb428ebad24b3e649f72046191e9b1af18e23dbcfd987a2bf
19a88567b84481ed390493b76efdb52c1ca480a41565713cbdfc5660add6dba2
2157361193375a79ade3559e960f982daa8d599cf7f4a92d36e3eef257738f16
21e1dff4ea91f8d053603d4b774c47bd7c047ff31d854793abd13da79a4a8a6b
23ddceb8b21381a5d53e5d415e3e0f0a3f7700fbed16966cb04e9e66eae80ebd
27ed27fa82b15a787f3695b439429c6093a8e5ac1b6e4386b67a37fa2b6d8b37
286f2ddd2a473e6a567380ecb5f6440b8943865ba4690e4ae15a2f34a8a3b297
2be1c3e225ee5c8ca6e57bfb832c5d1f36a09618d6123fc70b8a012271492e83
2c690abc65232a93c89dc14b3a4e0bf461eb6e42e55aee8ce4f00361f9f6d524
3405ac070a16f48cbef78ca93ac5f6fd3695e748ad05da409a652bf2a7886d1c
3c4d6a1421c7ddb7e404521fe8c4cd5be5af446d7689cd880be26612eaad3cfa
3ca430568c6bde1a3fba7fbe5283014c8fc12885e9450fe7c632f6977b322daf
40732e9dcfa704cf615e4691bb07aecfd1cc5e063220a46e4a7ff6560c77f5db
40ef3a508a4df47da46c1c3c9cd35f89277db282caa46e5ae1cbbcf6bf60bbee
43950b99d7660f2d926f2d17fe9dc74b02d86bbbe4d2f52cf2ab5cc1f9c80d0a
5a4e98e4199894be49adff3642753711ec805292607447f0a59297c24ad2bb9f
5fa00d047acd959697b9d7772c31dcd37bec33c70c6fbf80ab8316205d1d286d
6083f0dabd659d673464f2ef3b355c4b9d8ac4174602cd918374b9508cef59ef
631a2253c93d9db42e74c350607229a629b1878c702051b253e1174b889ee3c2
691dcdb24853a0f5ce4e6597e5713dea66799b57ffe2c2a10f28f98e0b569b19
6d645dd2170b161a872020a02f6e3f157d829f233833588202084590565b1264
71d07479f4b2b809e5769a352f4f55b84690289026ace7ed5395230002551a11
762016311d50e94c745622bc807da9ffaad8d1b552324c25d24faedaddb0755e
76507a6f9071663991ae6cae6a64803966acdee47d09aad3a6cff802bd88d1ad
772ba4e7c02a03b95bd8fef71e44798097c7c37dc97d513843dceee897354738
7841131e25c56e0629fc0d09618882b7271f7c318f57e848dd5b77c74030a0f3
87981e8062814ca279922ee55276ad14bbdc29649f98e34b2d83c3afb5052a51
8f3afe36f81d30bc8033f69a9791facbf99c7b6fa74c7187bc526472460558b2
960c700833a7f1fd2e93d26f721e830f52d8e1ad640446ade139f0ce2a712a04
98824ad5e4abf947dbe64c19947e540a7879aec44e65b330653a865890410dd4
9ed6388d56fc9f2044791e0559ab4a283381791e359dc2981449955e702de56d
a6ba0427e12a6e987f107a6e6f98da038c40ebcef38872749e874221ef644792
ac7f7d8b7179ddc263d366be0a8c7133a1914fa167f726591b26a3e69c02520c
b8f709b278ef98077988ebfdffb5e348522f8ab0c10c6963dad35e4a3d629096
baa7c3be80b75737198e340b51dd58300611afe62e67488f1856a20494ee98cd
c104f24454cb98ba2ff67a8bbe0ea495703cc82f5ed2fe56fe295b612d6eaaab
c2c10abb0f3eb00cfe81e422269b2c8f27b33ddbfa33507a1687aae45305f606
c5fbb516039cff75d6252b354fdacc9b09f78db817fe9f0e829a8b9318956034
cd5a3f1c1f93534dc249e34e094d9f59c542db4f49ec710f4f6b1c36dae5458c
d07666d005831d406475474a607cd18800ff7451a3181e629fa345dd30f583c7
dad91c0601fccbf443d580da55ebae4bf031190be711132e62bc7fb66040a3a3
de627a6e09cb3acb54527014037130f35fb8a5037a7b98bc6d48d0f1a1eb9d32
ea5db5581e262d77d1a43fbb3f0fa3661b51d097b40ca38f584b4943f47cf2e0
ecd8ec94ef579a9300139d41b22445a0b87be7da4d516c933cbd2fb1d0b3087c
f5fece0d25a46b78f20a9e20b928c52b530417af417c997f3e9e25b504a43d6d
f6ed88e8b62002d94a050129963c4f83666c1894bcb8d2661c02d2b6c8f3491f
f941e01a27c4568da7a81f5cb516b5d2056b14b88cccf3c53f647bde767e0919
f980a61903248079a4bfa278d1ece2209c747604cd58b9eba9e80f433db3c39a
fbee6d88708a48fa23e90c886e63bd7e0efd667d65081764b1aa6b6337734294
fdfea52427fb822bebdd32b325768e73b40637bd203c100827d4dece88e431c3
ff82e79f2a1b80b68510c46cd0693a87a8d27a6984fd69c8613329fc0ba523b3