sit58.online.citi.com Open in urlscan Pro
104.70.85.47 Public Scan

Go To Rescan
Add Verdict Report

URL:
https://sit58.online.citi.com/
Submission Tags: @phishunt_io
Submission: On January 14 via api (January 14th 2022, 5:41:12 am UTC) from DE — Scanned from DE

Summary HTTP 141 Redirects Links 72 Behaviour Indicators

Summary

This website contacted 27 IPs in 5 countries across 20 domains to perform 141 HTTP transactions. The main IP is 104.70.85.47, located in Frankfurt am Main, Germany and belongs to AKAMAI-AS, US. The main domain is sit58.online.citi.com.
TLS certificate: Issued by DigiCert SHA2 Extended Validation Ser... on July 12th 2021. Valid for: 8 months.

This is the only time sit58.online.citi.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
49	104.70.85.47 104.70.85.47	16625 (AKAMAI-AS) (AKAMAI-AS)
1	104.111.238.178 104.111.238.178	16625 (AKAMAI-AS) (AKAMAI-AS)
1	35.244.174.68 35.244.174.68	15169 (GOOGLE) (GOOGLE)
2	52.24.163.168 52.24.163.168	16509 (AMAZON-02) (AMAZON-02)
15	18.195.42.228 18.195.42.228	16509 (AMAZON-02) (AMAZON-02)
1	2001:4de0:ac1... 2001:4de0:ac18::1:a:1b	20446 (HIGHWINDS3) (HIGHWINDS3)
1 4	34.249.190.190 34.249.190.190	16509 (AMAZON-02) (AMAZON-02)
15	2a00:1450:400... 2a00:1450:4001:809::2008	15169 (GOOGLE) (GOOGLE)
1	104.111.228.137 104.111.228.137	16625 (AKAMAI-AS) (AKAMAI-AS)
1	34.250.180.190 34.250.180.190	16509 (AMAZON-02) (AMAZON-02)
2	15.236.176.210 15.236.176.210	16509 (AMAZON-02) (AMAZON-02)
1 1	52.50.54.3 52.50.54.3	16509 (AMAZON-02) (AMAZON-02)
3	104.117.204.150 104.117.204.150	16625 (AKAMAI-AS) (AKAMAI-AS)
1	52.141.218.213 52.141.218.213	8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1	2600:9000:215... 2600:9000:2156:be00:1:76cf:fe80:93a1	16509 (AMAZON-02) (AMAZON-02)
2	193.0.160.129 193.0.160.129	54312 (ROCKETFUEL) (ROCKETFUEL)
2	151.101.130.133 151.101.130.133	54113 (FASTLY) (FASTLY)
1	143.204.98.36 143.204.98.36	16509 (AMAZON-02) (AMAZON-02)
1	35.190.60.146 35.190.60.146	15169 (GOOGLE) (GOOGLE)
1	104.111.215.191 104.111.215.191	16625 (AKAMAI-AS) (AKAMAI-AS)
1	198.160.105.95 198.160.105.95	15026 (ACXIOM) (ACXIOM)
2	142.250.185.162 142.250.185.162	15169 (GOOGLE) (GOOGLE)
1	151.101.129.175 151.101.129.175	54113 (FASTLY) (FASTLY)
8	2a00:1450:400... 2a00:1450:4001:809::2002	15169 (GOOGLE) (GOOGLE)
1	35.241.45.82 35.241.45.82	15169 (GOOGLE) (GOOGLE)
8	2a00:1450:400... 2a00:1450:4001:82f::2004	15169 (GOOGLE) (GOOGLE)
8	2a00:1450:400... 2a00:1450:4001:808::2003	15169 (GOOGLE) (GOOGLE)
141	27

49 104.70.85.47 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a104-70-85-47.deploy.static.akamaitechnologies.com

sit58.online.citi.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.111.238.178 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a104-111-238-178.deploy.static.akamaitechnologies.com

online.citi.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 35.244.174.68 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 68.174.244.35.bc.googleusercontent.com

idsync.rlcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 52.24.163.168 (Boardman, United States)

ASN16509 (AMAZON-02, US)
PTR: ec2-52-24-163-168.us-west-2.compute.amazonaws.com

ci-mpsnare.iovation.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

15 18.195.42.228 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-18-195-42-228.eu-central-1.compute.amazonaws.com

nexus.ensighten.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2001:4de0:ac18::1:a:1b (Netherlands)

ASN20446 (HIGHWINDS3, US)

code.jquery.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 34.249.190.190 (Dublin, Ireland) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-34-249-190-190.eu-west-1.compute.amazonaws.com

dpm.demdex.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

15 2a00:1450:4001:809::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.111.228.137 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a104-111-228-137.deploy.static.akamaitechnologies.com

tags.bkrtx.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 34.250.180.190 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-34-250-180-190.eu-west-1.compute.amazonaws.com

citi.demdex.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 15.236.176.210 (Paris, France)

ASN16509 (AMAZON-02, US)
PTR: ec2-15-236-176-210.eu-west-3.compute.amazonaws.com

metrics1.citi.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.50.54.3 (Dublin, Ireland) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-52-50-54-3.eu-west-1.compute.amazonaws.com

cm.everesttech.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 104.117.204.150 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a104-117-204-150.deploy.static.akamaitechnologies.com

www.citi.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.141.218.213 (Des Moines, United States)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

contents3.00110.citi.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:2156:be00:1:76cf:fe80:93a1 (United States)

ASN16509 (AMAZON-02, US)

c1.rfihub.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 193.0.160.129 (United States)

ASN54312 (ROCKETFUEL, US)

20766699p.rfihub.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
p.rfihub.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 151.101.130.133 (United States)

ASN54113 (FASTLY, US)

resources.digital-cloud-citi.medallia.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 143.204.98.36 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-143-204-98-36.fra50.r.cloudfront.net

cdn.pbbl.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 35.190.60.146 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 146.60.190.35.bc.googleusercontent.com

sr.rlcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.111.215.191 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a104-111-215-191.deploy.static.akamaitechnologies.com

stags.bluekai.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 198.160.105.95 (Conway, United States)

ASN15026 (ACXIOM, US)

cardoffer.citicards.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 142.250.185.162 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s51-in-f2.1e100.net

www.googleadservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 151.101.129.175 (United States)

ASN54113 (FASTLY, US)

nebula-cdn.kampyle.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 2a00:1450:4001:809::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 35.241.45.82 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 82.45.241.35.bc.googleusercontent.com

udc-neb.kampyle.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 2a00:1450:4001:82f::2004 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 2a00:1450:4001:808::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
56	citi.com sit58.online.citi.com online.citi.com — Cisco Umbrella Rank: 20255 dit1.online.citi.com Failed metrics1.citi.com — Cisco Umbrella Rank: 18959 www.citi.com — Cisco Umbrella Rank: 24967 contents3.00110.citi.com — Cisco Umbrella Rank: 28528	3 MB
15	googletagmanager.com www.googletagmanager.com — Cisco Umbrella Rank: 62	563 KB
15	ensighten.com nexus.ensighten.com — Cisco Umbrella Rank: 2314	160 KB
8	google.de www.google.de — Cisco Umbrella Rank: 6151	1 KB
8	google.com www.google.com — Cisco Umbrella Rank: 8	1 KB
8	doubleclick.net googleads.g.doubleclick.net — Cisco Umbrella Rank: 44	10 KB
5	demdex.net 1 redirects dpm.demdex.net — Cisco Umbrella Rank: 184 citi.demdex.net — Cisco Umbrella Rank: 34910	7 KB
2	kampyle.com nebula-cdn.kampyle.com — Cisco Umbrella Rank: 3000 udc-neb.kampyle.com — Cisco Umbrella Rank: 2374	6 KB
2	googleadservices.com www.googleadservices.com — Cisco Umbrella Rank: 97	29 KB
2	medallia.com resources.digital-cloud-citi.medallia.com — Cisco Umbrella Rank: 22603	89 KB
2	rfihub.com 20766699p.rfihub.com — Cisco Umbrella Rank: 33674 p.rfihub.com — Cisco Umbrella Rank: 606	1 KB
2	iovation.com ci-mpsnare.iovation.com — Cisco Umbrella Rank: 50152	14 KB
2	rlcdn.com idsync.rlcdn.com — Cisco Umbrella Rank: 279 api.rlcdn.com Failed sr.rlcdn.com — Cisco Umbrella Rank: 12108	164 B
1	citicards.com cardoffer.citicards.com — Cisco Umbrella Rank: 626475
1	pbbl.co cdn.pbbl.co — Cisco Umbrella Rank: 7729
1	rfihub.net c1.rfihub.net — Cisco Umbrella Rank: 5721	6 KB
1	everesttech.net 1 redirects cm.everesttech.net — Cisco Umbrella Rank: 776	517 B
1	bkrtx.com tags.bkrtx.com — Cisco Umbrella Rank: 3082	16 KB
1	jquery.com code.jquery.com — Cisco Umbrella Rank: 541	30 KB
1	bluekai.com stags.bluekai.com — Cisco Umbrella Rank: 445 Failed	1 KB
141	20

	Domain	Requested by
49	sit58.online.citi.com	sit58.online.citi.com
15	www.googletagmanager.com	nexus.ensighten.com www.googletagmanager.com
15	nexus.ensighten.com	sit58.online.citi.com nexus.ensighten.com
8	www.google.de
8	www.google.com
8	googleads.g.doubleclick.net	www.googleadservices.com
4	dpm.demdex.net	1 redirects sit58.online.citi.com
3	www.citi.com	sit58.online.citi.com
2	www.googleadservices.com	www.googletagmanager.com
2	resources.digital-cloud-citi.medallia.com	nexus.ensighten.com resources.digital-cloud-citi.medallia.com
2	metrics1.citi.com	sit58.online.citi.com
2	ci-mpsnare.iovation.com	sit58.online.citi.com ci-mpsnare.iovation.com
1	udc-neb.kampyle.com
1	nebula-cdn.kampyle.com	resources.digital-cloud-citi.medallia.com
1	cardoffer.citicards.com
1	sr.rlcdn.com	nexus.ensighten.com
1	cdn.pbbl.co	nexus.ensighten.com
1	p.rfihub.com	c1.rfihub.net
1	20766699p.rfihub.com	c1.rfihub.net
1	c1.rfihub.net	nexus.ensighten.com
1	contents3.00110.citi.com	sit58.online.citi.com
1	cm.everesttech.net	1 redirects
1	citi.demdex.net	nexus.ensighten.com
1	tags.bkrtx.com	nexus.ensighten.com
1	code.jquery.com	sit58.online.citi.com
1	idsync.rlcdn.com	sit58.online.citi.com
1	stags.bluekai.com	sit58.online.citi.com tags.bkrtx.com
1	online.citi.com	sit58.online.citi.com
0	dit1.online.citi.com Failed	sit58.online.citi.com
0	api.rlcdn.com Failed	sit58.online.citi.com
141	30

This site contains links to these domains. Also see Links.

Domain
online.citi.com
www.citi.com
www.citicards.com
marketinsights.citi.com
citigoldprivateclient.citi.com
banking.citi.com
www.lifeandmoney.citi.com
citi.com
www.citigroup.com
jobs.citi.com
citieasydeals.com
www.citiprivatepass.com
www.privatebank.citibank.com
www.citibank.com
play.google.com
itunes.apple.com
www.jdpower.com
www.facebook.com
twitter.com
www.youtube.com

Subject Issuer	Validity	Valid
uat1.online.citi.com DigiCert SHA2 Extended Validation Server CA	`2021-07-12` - `2022-03-15`	8 months	crt.sh
online.citibank.com DigiCert SHA2 Extended Validation Server CA	`2020-03-13` - `2022-05-14`	2 years	crt.sh
*.rlcdn.com Sectigo RSA Domain Validation Secure Server CA	`2021-02-25` - `2022-03-28`	a year	crt.sh
ci-mpsnare.iovation.com DigiCert SHA2 Extended Validation Server CA	`2021-04-21` - `2022-05-10`	a year	crt.sh
nexus.ensighten.com DigiCert TLS RSA SHA256 2020 CA1	`2021-09-14` - `2022-10-12`	a year	crt.sh
*.jquery.com Sectigo RSA Domain Validation Secure Server CA	`2021-07-14` - `2022-08-14`	a year	crt.sh
*.google-analytics.com GTS CA 1C3	`2021-11-29` - `2022-02-21`	3 months	crt.sh
*.bkrtx.com DigiCert SHA2 Secure Server CA	`2021-04-02` - `2022-04-07`	a year	crt.sh
*.demdex.net DigiCert TLS RSA SHA256 2020 CA1	`2021-10-19` - `2022-11-19`	a year	crt.sh
metrics1.citi.com DigiCert SHA2 Extended Validation Server CA	`2020-07-02` - `2022-08-30`	2 years	crt.sh
www.citi.com DigiCert SHA2 Extended Validation Server CA	`2021-11-02` - `2022-12-03`	a year	crt.sh
contents1.00110.citi.com DigiCert SHA2 Extended Validation Server CA	`2020-08-10` - `2022-08-10`	2 years	crt.sh
*.rfihub.net Amazon	`2021-12-29` - `2023-01-27`	a year	crt.sh
*.rfihub.com Sectigo RSA Domain Validation Secure Server CA	`2020-06-18` - `2022-06-18`	2 years	crt.sh
*.digital-cloud-citi.medallia.com SSL.com RSA SSL subCA	`2021-11-15` - `2022-10-20`	a year	crt.sh
*.pbbl.co Amazon	`2021-11-04` - `2022-12-02`	a year	crt.sh
odc-pixel-prod-01.oracle.com DigiCert SHA2 Secure Server CA	`2021-11-24` - `2022-04-26`	5 months	crt.sh
cardoffer.citicards.com DigiCert SHA2 Extended Validation Server CA	`2020-02-14` - `2022-05-08`	2 years	crt.sh
www.googleadservices.com GTS CA 1C3	`2021-12-08` - `2022-03-02`	3 months	crt.sh
*.kampyle.com GlobalSign Atlas R3 DV TLS CA 2020	`2021-03-22` - `2022-04-23`	a year	crt.sh
*.googleadservices.com GTS CA 1C3	`2021-12-08` - `2022-03-02`	3 months	crt.sh
*.g.doubleclick.net GTS CA 1C3	`2021-11-29` - `2022-02-21`	3 months	crt.sh
www.google.com GTS CA 1C3	`2021-12-08` - `2022-03-02`	3 months	crt.sh
www.google.de GTS CA 1C3	`2021-11-29` - `2022-02-21`	3 months	crt.sh
*.google.de GTS CA 1C3	`2021-11-29` - `2022-02-21`	3 months	crt.sh
*.google.com GTS CA 1C3	`2021-12-08` - `2022-03-02`	3 months	crt.sh

This page contains 6 frames:

Primary Page: https://sit58.online.citi.com/
Frame ID: E40A702713986CDEFD266EC533A72450
Requests: 135 HTTP requests in this frame

Frame: https://citi.demdex.net/dest5.html?d_nsid=0
Frame ID: 376AC1E3D923ED28C34C6E557979E289
Requests: 1 HTTP requests in this frame

Frame: https://20766699p.rfihub.com/ca.html?ver=9&ra=477&rb=648&ca=20766699&_o=17169175&_t=noncookiedusernamepassword&ssv_cuuid=&ssv_package=null&ssv_prodlist=null&ssv_pagename=noncookiedusernamepassword&pe=https%3A%2F%2Fsit58.online.citi.com%2F&pf=&ra=828215863033102
Frame ID: A310DEB21FEF316965DF2F8FAD09BD13
Requests: 1 HTTP requests in this frame

Frame: https://p.rfihub.com/ca.html?ver=9&ra=631&rb=648&ca=&_o=17169175&_t=&pe=https%3A%2F%2Fsit58.online.citi.com%2F&pf=&ra=3084066739152409
Frame ID: EE69BAFDD3E7A8EE4B94F57D166FA085
Requests: 1 HTTP requests in this frame

Frame: https://sr.rlcdn.com/425466.html?es=80676&u=da39a3ee5e6b4b0d3255bfef95601890afd80709
Frame ID: CB7EB0E8732B179076BD385DBC80F214
Requests: 1 HTTP requests in this frame

Frame: https://stags.bluekai.com/site/63068?ret=html&phint=language%3Denglish&phint=product&phint=event&phint=category%3DPre-login%20Sign%20on%20page&phint=page%3DNon%20Cookied%20Username%20Password&phint=section1%3DPublic&phint=section2%3DSignOn&phint=section3%3D&phint=section4%3D&phint=bankappstatus&phint=productID&phint=__bk_t%3DOnline%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&phint=__bk_k%3Dbanking%2C%20citi%2C%20financial%20services%2C%20checking%20account%2C%20savings%20account%2C%20credit%20cards&phint=__bk_l%3Dhttps%3A%2F%2Fsit58.online.citi.com%2F&phint=__bk_v%3D3.1.10&limit=10&r=23843018
Frame ID: 3E00C6B16068DD436AA72E6664839C35
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Online Banking, Mortgages, Personal Loans, Investing | Citi.com

Detected technologies

Bootstrap (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js

AngularJS (JavaScript Frameworks) Expand

Overall confidence: 100%
Detected patterns

\bangular.{0,32}\.js

Ensighten (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

//nexus\.ensighten\.com/

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/gtag/js

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery[.-]([\d.]*\d)[^/]*\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

141
Requests

92 %
HTTPS

22 %
IPv6

20
Domains

30
Subdomains

27
IPs

5
Countries

3617 kB
Transfer

11708 kB
Size

41
Cookies

72 Outgoing links

These are links going to different origins than the main page.

URL: https://online.citi.com/US/ag/citibank-location-finder
Title: ATM / BRANCH

Search URL Search Domain Scan URL

URL: https://www.citi.com/credit-cards/compare-credit-cards/citi.action?ID=view-all-credit-cards
Title: View All Credit Cards

Search URL Search Domain Scan URL

URL: https://www.citi.com/credit-cards/compare-credit-cards/citi.action?ID=balance-transfer-credit-cards
Title: Balance Transfer Credit Cards

Search URL Search Domain Scan URL

URL: https://www.citi.com/credit-cards/compare-credit-cards/citi.action?ID=low-interest-credit-card
Title: 0% Intro APR Credit Cards

Search URL Search Domain Scan URL

URL: https://www.citi.com/credit-cards/compare/rewards-credit-cards
Title: Rewards Credit Cards

Search URL Search Domain Scan URL

URL: https://www.citi.com/credit-cards/compare/savings-and-cash-back-credit-cards
Title: Cash Back Credit Cards

Search URL Search Domain Scan URL

URL: https://www.citi.com/credit-cards/compare/travel-reward-credit-cards
Title: Travel Credit Cards

Search URL Search Domain Scan URL

URL: https://www.citi.com/credit-cards/compare-credit-cards/citi.action?ID=all-small-business-credit-cards&m=f
Title: Small Business Credit Cards

Search URL Search Domain Scan URL

URL: https://www.citi.com/credit-cards/knowledge-center
Title: Citi® Credit Knowledge Center

Search URL Search Domain Scan URL

URL: https://www.citicards.com/cards/credit/application/flow.action?isInvitation=Y
Title: Respond to Mail Offer

Search URL Search Domain Scan URL

URL: https://online.citi.com/US/ag/banking/checking-account
Title: Checking

Search URL Search Domain Scan URL

URL: https://online.citi.com/US/banking/citi.action?ID=savings-account-overview
Title: Savings

Search URL Search Domain Scan URL

URL: https://online.citi.com/US/banking/citi.action?ID=banking-overview
Title: Banking Overview

Search URL Search Domain Scan URL

URL: https://online.citi.com/US/banking/citi.action?ID=cd-ira-account-overview
Title: Certificates of Deposit

Search URL Search Domain Scan URL

URL: https://online.citi.com/US/banking/cd-ira/citi.action?ID=citi-ira
Title: Banking IRAs

Search URL Search Domain Scan URL

URL: https://online.citi.com/US/ag/current-interest-rates/checking-saving-accounts
Title: Rates

Search URL Search Domain Scan URL

URL: https://online.citi.com/small-business-banking
Title: Small Business

Search URL Search Domain Scan URL

URL: https://online.citi.com/US/JRS/portal/template.do?ID=your-savings-made-simple
Title: Savings Made Simple

Search URL Search Domain Scan URL

URL: https://online.citi.com/US/ag/banking/special-offers
Title: Citi® Bonus Offers

Search URL Search Domain Scan URL

URL: https://online.citi.com/US/ag/personal-loan
Title: Personal Loans & Lines of Credit

Search URL Search Domain Scan URL

URL: https://online.citi.com/US/JRS/portal/template.do?ID=mortgage_home_mortgage
Title: Home Lending

Search URL Search Domain Scan URL

URL: https://online.citi.com/US/JRS/portal/template.do?ID=mortgage_buy_home
Title: Buy a Home

Search URL Search Domain Scan URL

URL: https://online.citi.com/US/JRS/portal/template.do?ID=mortgage_refinancing
Title: Refinance Your Home

Search URL Search Domain Scan URL

URL: https://online.citi.com/US/JRS/portal/template.do?ID=mortgage_heloc
Title: Use Your Home Equity

Search URL Search Domain Scan URL

URL: https://online.citi.com/US/JRS/portal/template.do?ID=refinance_and_mortgage_calculators
Title: Mortgage Calculators

Search URL Search Domain Scan URL

URL: https://online.citi.com/US/JRS/portal/template.do?ID=home_equity_calculators
Title: Home Equity Calculators

Search URL Search Domain Scan URL

URL: https://online.citi.com/US/ag/investing/investingwithciti
Title: Investing Overview

Search URL Search Domain Scan URL

URL: https://online.citi.com/US/ag/citi-self-invest
Title: Self-Directed Trading

Search URL Search Domain Scan URL

URL: https://online.citi.com/US/ag/citiwealthbuilder/detail/marketing?intc=2~7~51~5~200101~2~BANKACQ~investingwithciti~prelogin~web~all&JFP_TOKEN=PZKYHT3Q
Title: Robo Advisor

Search URL Search Domain Scan URL

URL: https://online.citi.com/JRS/pands/detail.do?ID=InvestWithPersonalAdvisor&JFP_TOKEN=PZKYHT3Q
Title: Working with an Advisor

Search URL Search Domain Scan URL

URL: https://online.citi.com/US/JRS/pands/detail.do?ID=FinancialPlanningTools&JFP_TOKEN=PD3BPM40
Title: Financial Planning

Search URL Search Domain Scan URL

URL: https://marketinsights.citi.com/
Title: Market Insights

Search URL Search Domain Scan URL

URL: https://online.citi.com/US/JRS/pands/detail.do?ID=InvestingProducts&JFP_TOKEN=PZKYHT3Q
Title: Investments & Insurance

Search URL Search Domain Scan URL

URL: https://online.citi.com/US/JRS/pands/detail.do?ID=CitigoldOverview
Title: Citigold

Search URL Search Domain Scan URL

URL: https://online.citi.com/US/ag/citigold-private-client
Title: Citigold® Private Client

Search URL Search Domain Scan URL

URL: https://online.citi.com/US/JRS/pands/detail.do?ID=CitiPriorityOverview
Title: Citi Priority

Search URL Search Domain Scan URL

URL: https://citigoldprivateclient.citi.com/contact/
Title: Find a Wealth Team

Search URL Search Domain Scan URL

URL: https://online.citi.com/US/ag/open-a-bank-account
Title: Open an Account

Search URL Search Domain Scan URL

URL: https://online.citi.com/US/banking/savings/citi.action?ID=citi-savings&intc=1~1~52~6~BANR~2~Generic_Save~XPX
Title: Learn More Easy to access and simple to manage, a Citi Savings Account could be right for you.

Search URL Search Domain Scan URL

URL: https://banking.citi.com/cbol/17/checking/basic/generic/default.htm?Promo_ID=CZ92&intc=1~1~52~6~BANR~2~BasicChk_081017~XPX
Title: Banking Made Easy

Search URL Search Domain Scan URL

URL: https://www.citi.com/credit-cards/credit-card-details/citi.action?ID=citi-rewards-plus-credit-card&afc=106
Title: Earn 15,000 Bonus Points

Search URL Search Domain Scan URL

URL: https://online.citi.com/US/JRS/portal/template.do?ID=compare-savings-checking-cds-and-money-market-accounts&intc=1~1~52~6~BANR~2~Save_Hub2~HP

Search URL Search Domain Scan URL

URL: https://www.lifeandmoney.citi.com/well-being/productivity/how-to-get-organized-with-lauren-tucker

Search URL Search Domain Scan URL

URL: https://citi.com/citi/racial-equity/

Search URL Search Domain Scan URL

URL: http://www.citigroup.com/citi/
Title: Our Story

Search URL Search Domain Scan URL

URL: https://jobs.citi.com/
Title: Careers

Search URL Search Domain Scan URL

URL: https://online.citi.com/US/JRS/pands/detail.do?ID=ServicesOverview
Title: Benefits and Services

Search URL Search Domain Scan URL

URL: https://online.citi.com/US/JRS/pands/detail.do?ID=Rewards
Title: Rewards

Search URL Search Domain Scan URL

URL: https://citieasydeals.com/
Title: Citi Easy DealsSM

Search URL Search Domain Scan URL

URL: http://www.citiprivatepass.com/
Title: Citi Entertainment®

Search URL Search Domain Scan URL

URL: https://online.citi.com/US/JRS/portal/template.do?ID=SpecialOffers
Title: Special Offers

Search URL Search Domain Scan URL

URL: https://www.privatebank.citibank.com/
Title: Citi Private Bank

Search URL Search Domain Scan URL

URL: https://online.citi.com/US/ag/small-business-banking
Title: Small Business Accounts

Search URL Search Domain Scan URL

URL: https://www.citibank.com/commercialbank/en/index.html
Title: Commercial Accounts

Search URL Search Domain Scan URL

URL: https://online.citi.com/US/JRS/portal/template.do?ID=todays_mortgage_rates&type=buy
Title: Mortgage

Search URL Search Domain Scan URL

URL: https://online.citi.com/US/JRS/portal/template.do?ID=home_equity_rates
Title: Home Equity

Search URL Search Domain Scan URL

URL: https://online.citi.com/US/ag/current-interest-rates/personal-loans-and-lines-of-credit
Title: Lending

Search URL Search Domain Scan URL

URL: https://online.citi.com/US/ag/contactus
Title: Contact Us

Search URL Search Domain Scan URL

URL: https://online.citi.com/US/ag/helptopic
Title: Help & FAQs

Search URL Search Domain Scan URL

URL: https://online.citi.com/US/ag/security-center
Title: Security Center

Search URL Search Domain Scan URL

URL: https://play.google.com/store/apps/details?id=com.citi.citimobile
Title: Continue

Search URL Search Domain Scan URL

URL: https://itunes.apple.com/app/citi-mobile-sm/id301724680?mt=8
Title: Continue

Search URL Search Domain Scan URL

URL: http://www.jdpower.com/awards
Title: Continue

Search URL Search Domain Scan URL

URL: https://www.facebook.com/citibank
Title: Continue

Search URL Search Domain Scan URL

URL: https://twitter.com/Citibank/
Title: Continue

Search URL Search Domain Scan URL

URL: https://www.youtube.com/citi
Title: Continue

Search URL Search Domain Scan URL

URL: https://online.citi.com/US/ag/termsdisclaimer/termsdisclaimerhome
Title: Terms & Conditions

Search URL Search Domain Scan URL

URL: https://online.citi.com/US/JRS/portal/template.do?ID=Privacy
Title: Privacy

Search URL Search Domain Scan URL

URL: https://online.citi.com/JRS/portal/template.do?ID=Privacy#notice-at-collection
Title: Notice at Collection

Search URL Search Domain Scan URL

URL: https://online.citi.com/US/ag/dataprivacyhub
Title: CA Privacy Hub

Search URL Search Domain Scan URL

URL: https://online.citi.com/US/JRS/portal/template.do?ID=Accessibility
Title: Accessibility

Search URL Search Domain Scan URL

URL: https://online.citi.com/JRS/portal/template.do?ID=international-personal-bank&l=en&locale=en_US
Title: International Personal Bank U.S.

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 40

https://dpm.demdex.net/id?d_visid_ver=3.1.2&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=61834D9B5228A7430A490D45%40AdobeOrg&d_nsid=0&ts=1642138865340 HTTP 302
https://dpm.demdex.net/id/rd?d_visid_ver=3.1.2&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=61834D9B5228A7430A490D45%40AdobeOrg&d_nsid=0&ts=1642138865340

Request Chain 66

https://cm.everesttech.net/cm/dd?d_uuid=63814934763556885350114087948227507924 HTTP 302
https://dpm.demdex.net/ibs:dpid=411&dpuuid=YeEM8QAAABcLvwP0

141 HTTP transactions
2 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request / Show response
sit58.online.citi.com/ 933 KB
152 KB 1128ms
592ms Document
text/html 104.70.85.47
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://sit58.online.citi.com/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.70.85.47 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-70-85-47.deploy.static.akamaitechnologies.com

Software

nginx /

Resource Hash

efcaf36f21e529a5bb6f0c202b1a6a2c2993fff687c059096c0d191e707c0bb8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000 ; includeSubDomains max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1 ; mode=block

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: de-DE,de;q=0.9

Response headers

server: nginx
content-type: text/html; charset=utf-8
content-length: 154101
access-control-allow-headers: action,challengeType,accesstoken,appVersion,,Content-Type,sid,CCPToken,CFIToken,countryCode,businessCode,channelId,uuid,client_id,environmentId
access-control-allow-methods: GET,PUT,POST,DELETE,HEAD
access-control-allow-origin
access-control-expose-headers: action,challengeType,bizToken,eventid,Eventid,Eventidexpirytime,eventidexpirytime,accesstoken,Authorization,sid,SessionId,CCPToken,CFIToken
access-control-max-age: 2147483647
content-encoding: gzip
dclocation: GT1DMSDEV1
etag: W/"e95e9-8V+IYDuQiBjc1fXKnFZoEvyB8aE"
expires: -1
nonce: 3503181067766570
pragma: no-cache
referrer-policy: no-referrer
scope: VISITOR
sid: 5040c699-d49a-48d5-961f-f5e33fd779d4
strict-transport-security: max-age=31536000 ; includeSubDomains max-age=31536000
uuid: 3cce74bd-a455-4d9d-9bbf-2f9dabee626a
vary: Accept-Encoding
x-content-type-options: nosniff
x-vcap-request-id: 608665f7-86ed-4b68-63fc-ab81970eddc5
x-xss-protection: 1 ; mode=block
x-akamai-citisite: GTDC
date: Fri, 14 Jan 2022 05:41:00 GMT
x-robots-tag: noindex, nofollow

GET
H2 200 tagging.min.js Show response
sit58.online.citi.com/cbol-pre-login-static-assets/assets/js/ 42 KB
11 KB 743ms
742ms Script
application/javascript 104.70.85.47
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://sit58.online.citi.com/cbol-pre-login-static-assets/assets/js/tagging.min.js

Requested by

Host: sit58.online.citi.com
URL: https://sit58.online.citi.com/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.70.85.47 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-70-85-47.deploy.static.akamaitechnologies.com

Software

nginx /

Resource Hash

3d594246baf1e88fe62fc2bf1adf9ff76c53e390731f99455eb71d7441ba8f00

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000 ; includeSubDomains, max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1 ; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

strict-transport-security: max-age=31536000 ; includeSubDomains, max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
dclocation: GT1DMSDEV1
vary: Accept-Encoding
content-length: 10211
x-xss-protection: 1 ; mode=block
referrer-policy: no-referrer
last-modified: Tue, 09 Nov 2021 16:22:58 GMT
server: nginx
x-akamai-citisite: GTDC
date: Fri, 14 Jan 2022 05:41:00 GMT
access-control-max-age: 2147483647
access-control-allow-methods: GET,PUT,POST,DELETE,HEAD
content-type: application/javascript; charset=UTF-8
access-control-allow-origin
x-vcap-request-id: 286d282c-d3db-44d6-7a4c-c506fd533e8f
access-control-expose-headers: action,challengeType,bizToken,eventid,Eventid,Eventidexpirytime,eventidexpirytime,accesstoken,Authorization,sid,SessionId,CCPToken,CFIToken
cache-control: public, max-age=0
etag: W/"a8b7-17d05827ed0"
accept-ranges: bytes
x-robots-tag: noindex, nofollow
access-control-allow-headers: action,challengeType,accesstoken,appVersion,,Content-Type,sid,CCPToken,CFIToken,countryCode,businessCode,channelId,uuid,client_id,environmentId

GET
H2 200 banner.min.js Show response
sit58.online.citi.com/cbol-pre-login-static-assets/assets/js/ 15 KB
5 KB 667ms
665ms Script
application/javascript 104.70.85.47
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://sit58.online.citi.com/cbol-pre-login-static-assets/assets/js/banner.min.js

Requested by

Host: sit58.online.citi.com
URL: https://sit58.online.citi.com/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.70.85.47 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-70-85-47.deploy.static.akamaitechnologies.com

Software

nginx /

Resource Hash

e6399fca6cbab33a9b3831e797db3e27e5438340da68f73b02710a3a75f58baf

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000 ; includeSubDomains, max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1 ; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

strict-transport-security: max-age=31536000 ; includeSubDomains, max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
dclocation: GT1DMSDEV1
vary: Accept-Encoding
content-length: 4782
x-xss-protection: 1 ; mode=block
referrer-policy: no-referrer
last-modified: Tue, 09 Nov 2021 16:22:58 GMT
server: nginx
x-akamai-citisite: GTDC
date: Fri, 14 Jan 2022 05:41:00 GMT
access-control-max-age: 2147483647
access-control-allow-methods: GET,PUT,POST,DELETE,HEAD
content-type: application/javascript; charset=UTF-8
access-control-allow-origin
x-vcap-request-id: 42e20274-eadc-41a1-46ea-1310582aa56f
access-control-expose-headers: action,challengeType,bizToken,eventid,Eventid,Eventidexpirytime,eventidexpirytime,accesstoken,Authorization,sid,SessionId,CCPToken,CFIToken
cache-control: public, max-age=0
etag: W/"3c70-17d05827ed0"
accept-ranges: bytes
x-robots-tag: noindex, nofollow
access-control-allow-headers: action,challengeType,accesstoken,appVersion,,Content-Type,sid,CCPToken,CFIToken,countryCode,businessCode,channelId,uuid,client_id,environmentId

GET
H2 200 Interstate-Light.woff
sit58.online.citi.com/cbol-pre-login-static-assets/commonui-assets/fonts/interstate/ 74 KB
75 KB 859ms
858ms Font
font/woff 104.70.85.47
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://sit58.online.citi.com/cbol-pre-login-static-assets/commonui-assets/fonts/interstate/Interstate-Light.woff

Requested by

Host: sit58.online.citi.com
URL: https://sit58.online.citi.com/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.70.85.47 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-70-85-47.deploy.static.akamaitechnologies.com

Software

nginx /

Resource Hash

f327a0ba3e41b1e8154e1c18fc114baff0bd057151e3afe7fa6f33cc0cb18296

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000 ; includeSubDomains, max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1 ; mode=block

Request headers

Referer
Origin: https://sit58.online.citi.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

sid: 00123572-a6a0-4557-9120-d1c90ec2883b
x-content-type-options: nosniff
nonce: 9902603827683430
access-control-max-age: 2147483647
dclocation: GT1DMSDEV1
content-length: 75538
x-xss-protection: 1 ; mode=block
uuid: 45161a18-b6de-4f58-85c9-3d182b58b79f
accept-ranges: bytes
referrer-policy: no-referrer
last-modified: Tue, 09 Nov 2021 16:22:58 GMT
server: nginx
x-akamai-citisite: GTDC
date: Fri, 14 Jan 2022 05:41:00 GMT
strict-transport-security: max-age=31536000 ; includeSubDomains, max-age=31536000
access-control-allow-methods: GET,PUT,POST,DELETE,HEAD
content-type: font/woff
access-control-allow-origin: https://sit58.online.citi.com
x-vcap-request-id: 2ba090fd-2358-4c7b-5d14-0b62f5877f2f
access-control-expose-headers: action,challengeType,bizToken,eventid,Eventid,Eventidexpirytime,eventidexpirytime,accesstoken,Authorization,sid,SessionId,CCPToken,CFIToken
cache-control: public, max-age=0
etag: W/"12712-17d05827ed0"
scope: VISITOR
x-robots-tag: noindex, nofollow
access-control-allow-headers: action,challengeType,accesstoken,appVersion,,Content-Type,sid,CCPToken,CFIToken,countryCode,businessCode,channelId,uuid,client_id,environmentId

GET
H2 200 Interstate-Bold.woff
sit58.online.citi.com/cbol-pre-login-static-assets/commonui-assets/fonts/interstate/ 70 KB
71 KB 793ms
792ms Font
font/woff 104.70.85.47
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://sit58.online.citi.com/cbol-pre-login-static-assets/commonui-assets/fonts/interstate/Interstate-Bold.woff

Requested by

Host: sit58.online.citi.com
URL: https://sit58.online.citi.com/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.70.85.47 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-70-85-47.deploy.static.akamaitechnologies.com

Software

nginx /

Resource Hash

e9e9a67395a0d83b584208a19b95af203df8e8e6c6952fe76c690d60ea9381c7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000 ; includeSubDomains, max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1 ; mode=block

Request headers

Referer
Origin: https://sit58.online.citi.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

sid: 8ad8b430-f426-458f-b551-77b86e4eafaa
x-content-type-options: nosniff
nonce: 2707617315569669
access-control-max-age: 2147483647
dclocation: GT1DMSDEV1
content-length: 71874
x-xss-protection: 1 ; mode=block
uuid: e99396ed-5cde-4bf1-99b1-1fec4611ccea
accept-ranges: bytes
referrer-policy: no-referrer
last-modified: Tue, 09 Nov 2021 16:22:58 GMT
server: nginx
x-akamai-citisite: GTDC
date: Fri, 14 Jan 2022 05:41:00 GMT
strict-transport-security: max-age=31536000 ; includeSubDomains, max-age=31536000
access-control-allow-methods: GET,PUT,POST,DELETE,HEAD
content-type: font/woff
access-control-allow-origin: https://sit58.online.citi.com
x-vcap-request-id: 1ea28ca7-b72e-44ea-4325-2b299de02fbc
access-control-expose-headers: action,challengeType,bizToken,eventid,Eventid,Eventidexpirytime,eventidexpirytime,accesstoken,Authorization,sid,SessionId,CCPToken,CFIToken
cache-control: public, max-age=0
etag: W/"118c2-17d05827ed0"
scope: VISITOR
x-robots-tag: noindex, nofollow
access-control-allow-headers: action,challengeType,accesstoken,appVersion,,Content-Type,sid,CCPToken,CFIToken,countryCode,businessCode,channelId,uuid,client_id,environmentId

GET
H2 200 Interstate-Regular.woff
sit58.online.citi.com/cbol-pre-login-static-assets/commonui-assets/fonts/interstate/ 77 KB
78 KB 860ms
859ms Font
font/woff 104.70.85.47
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://sit58.online.citi.com/cbol-pre-login-static-assets/commonui-assets/fonts/interstate/Interstate-Regular.woff

Requested by

Host: sit58.online.citi.com
URL: https://sit58.online.citi.com/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.70.85.47 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-70-85-47.deploy.static.akamaitechnologies.com

Software

nginx /

Resource Hash

045cd226594cb32ddf9d4db8ee45611f4d0788675ae50180b68da975e66fe1fe

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000 ; includeSubDomains, max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1 ; mode=block

Request headers

Referer
Origin: https://sit58.online.citi.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

sid: c8fbdfb4-6171-4643-ad00-0d3470a42a24
x-content-type-options: nosniff
nonce: 4407255754269896
access-control-max-age: 2147483647
dclocation: GT1DMSDEV1
content-length: 78762
x-xss-protection: 1 ; mode=block
uuid: a226db35-7cf4-440a-815e-483e4003fa41
accept-ranges: bytes
referrer-policy: no-referrer
last-modified: Tue, 09 Nov 2021 16:22:58 GMT
server: nginx
x-akamai-citisite: GTDC
date: Fri, 14 Jan 2022 05:41:00 GMT
strict-transport-security: max-age=31536000 ; includeSubDomains, max-age=31536000
access-control-allow-methods: GET,PUT,POST,DELETE,HEAD
content-type: font/woff
access-control-allow-origin: https://sit58.online.citi.com
x-vcap-request-id: e1cd08cc-d3e6-4ba5-5dca-89af20b50756
access-control-expose-headers: action,challengeType,bizToken,eventid,Eventid,Eventidexpirytime,eventidexpirytime,accesstoken,Authorization,sid,SessionId,CCPToken,CFIToken
cache-control: public, max-age=0
etag: W/"133aa-17d05827ed0"
scope: VISITOR
x-robots-tag: noindex, nofollow
access-control-allow-headers: action,challengeType,accesstoken,appVersion,,Content-Type,sid,CCPToken,CFIToken,countryCode,businessCode,channelId,uuid,client_id,environmentId

GET
H2 200 styles.187a58a1499ec83981b8.css
sit58.online.citi.com/cbol-pre-login-static-assets/ 1 MB
150 KB 1166ms
1165ms Stylesheet
text/css 104.70.85.47
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://sit58.online.citi.com/cbol-pre-login-static-assets/styles.187a58a1499ec83981b8.css

Requested by

Host: sit58.online.citi.com
URL: https://sit58.online.citi.com/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.70.85.47 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-70-85-47.deploy.static.akamaitechnologies.com

Software

nginx /

Resource Hash

54114d6a66ff9b0a463cb8804b869581eb63483f4a78f5fc4367861bb2267a50

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000 ; includeSubDomains, max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1 ; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

strict-transport-security: max-age=31536000 ; includeSubDomains, max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
dclocation: GT1DMSDEV1
vary: Accept-Encoding
x-xss-protection: 1 ; mode=block
referrer-policy: no-referrer
last-modified: Tue, 09 Nov 2021 16:24:56 GMT
server: nginx
x-akamai-citisite: GTDC
date: Fri, 14 Jan 2022 05:41:01 GMT
access-control-max-age: 2147483647
access-control-allow-methods: GET,PUT,POST,DELETE,HEAD
content-type: text/css; charset=UTF-8
access-control-allow-origin
x-vcap-request-id: 234df3b2-a8a1-4ef1-5da8-4b3bf6ad588d
access-control-expose-headers: action,challengeType,bizToken,eventid,Eventid,Eventidexpirytime,eventidexpirytime,accesstoken,Authorization,sid,SessionId,CCPToken,CFIToken
cache-control: public, max-age=0
etag: W/"134055-17d05844bc0"
accept-ranges: bytes
x-robots-tag: noindex, nofollow
access-control-allow-headers: action,challengeType,accesstoken,appVersion,,Content-Type,sid,CCPToken,CFIToken,countryCode,businessCode,channelId,uuid,client_id,environmentId

GET
H2 200 fp.js Show response
sit58.online.citi.com/cbol-pre-login-static-assets/assets/js/ 19 KB
5 KB 236ms
234ms Script
application/javascript 104.70.85.47
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://sit58.online.citi.com/cbol-pre-login-static-assets/assets/js/fp.js

Requested by

Host: sit58.online.citi.com
URL: https://sit58.online.citi.com/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.70.85.47 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-70-85-47.deploy.static.akamaitechnologies.com

Software

nginx /

Resource Hash

dd65a674c821f6a0e0ec4b181532b00c0cc5d5bde623ea98affcb9f383139b57

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000 ; includeSubDomains, max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1 ; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

strict-transport-security: max-age=31536000 ; includeSubDomains, max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
dclocation: GT1DMSDEV1
vary: Accept-Encoding
content-length: 4844
x-xss-protection: 1 ; mode=block
referrer-policy: no-referrer
last-modified: Tue, 09 Nov 2021 16:22:58 GMT
server: nginx
x-akamai-citisite: GTDC
date: Fri, 14 Jan 2022 05:41:01 GMT
access-control-max-age: 2147483647
access-control-allow-methods: GET,PUT,POST,DELETE,HEAD
content-type: application/javascript; charset=UTF-8
access-control-allow-origin
x-vcap-request-id: 0c4c6945-bc32-4685-56c2-1cd406384ba8
access-control-expose-headers: action,challengeType,bizToken,eventid,Eventid,Eventidexpirytime,eventidexpirytime,accesstoken,Authorization,sid,SessionId,CCPToken,CFIToken
cache-control: public, max-age=0
etag: W/"4de4-17d05827ed0"
accept-ranges: bytes
x-robots-tag: noindex, nofollow
access-control-allow-headers: action,challengeType,accesstoken,appVersion,,Content-Type,sid,CCPToken,CFIToken,countryCode,businessCode,channelId,uuid,client_id,environmentId

GET
H2 200 runtime-es2015.d43ecfa67810809a922a.js Show response
sit58.online.citi.com/cbol-pre-login-static-assets/ 2 KB
2 KB 651ms
651ms Script
application/javascript 104.70.85.47
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://sit58.online.citi.com/cbol-pre-login-static-assets/runtime-es2015.d43ecfa67810809a922a.js

Requested by

Host: sit58.online.citi.com
URL: https://sit58.online.citi.com/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.70.85.47 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-70-85-47.deploy.static.akamaitechnologies.com

Software

nginx /

Resource Hash

3a4284fc3091796d852c047a85d6f8d91c95e1bb7b1b2c3bb3e69b1d29064488

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000 ; includeSubDomains, max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1 ; mode=block

Request headers

Referer
Origin: https://sit58.online.citi.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

strict-transport-security: max-age=31536000 ; includeSubDomains, max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
dclocation: GT1DMSDEV1
vary: Accept-Encoding
content-length: 1327
x-xss-protection: 1 ; mode=block
referrer-policy: no-referrer
last-modified: Tue, 09 Nov 2021 16:22:58 GMT
server: nginx
x-akamai-citisite: GTDC
date: Fri, 14 Jan 2022 05:41:00 GMT
access-control-max-age: 2147483647
access-control-allow-methods: GET,PUT,POST,DELETE,HEAD
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: https://sit58.online.citi.com
x-vcap-request-id: f1095d47-00e0-49ae-4788-2635429ed12b
access-control-expose-headers: action,challengeType,bizToken,eventid,Eventid,Eventidexpirytime,eventidexpirytime,accesstoken,Authorization,sid,SessionId,CCPToken,CFIToken
cache-control: public, max-age=0
etag: W/"9d7-17d05827ed0"
accept-ranges: bytes
x-robots-tag: noindex, nofollow
access-control-allow-headers: action,challengeType,accesstoken,appVersion,,Content-Type,sid,CCPToken,CFIToken,countryCode,businessCode,channelId,uuid,client_id,environmentId

GET
H2 200 polyfills-es2015.208e90726d88af943fd8.js Show response
sit58.online.citi.com/cbol-pre-login-static-assets/ 175 KB
60 KB 1149ms
1148ms Script
application/javascript 104.70.85.47
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://sit58.online.citi.com/cbol-pre-login-static-assets/polyfills-es2015.208e90726d88af943fd8.js

Requested by

Host: sit58.online.citi.com
URL: https://sit58.online.citi.com/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.70.85.47 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-70-85-47.deploy.static.akamaitechnologies.com

Software

nginx /

Resource Hash

627660443b6ba8e5a33bb1c0961f9a628a6b956ac4c9cfb3aca7991797d30bc3

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000 ; includeSubDomains, max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1 ; mode=block

Request headers

Referer
Origin: https://sit58.online.citi.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

strict-transport-security: max-age=31536000 ; includeSubDomains, max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
dclocation: GT1DMSDEV1
vary: Accept-Encoding
x-xss-protection: 1 ; mode=block
referrer-policy: no-referrer
last-modified: Tue, 09 Nov 2021 16:24:25 GMT
server: nginx
x-akamai-citisite: GTDC
date: Fri, 14 Jan 2022 05:41:01 GMT
access-control-max-age: 2147483647
access-control-allow-methods: GET,PUT,POST,DELETE,HEAD
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: https://sit58.online.citi.com
x-vcap-request-id: 9ad46dcf-25bc-465b-6114-a73f63d7e2bd
access-control-expose-headers: action,challengeType,bizToken,eventid,Eventid,Eventidexpirytime,eventidexpirytime,accesstoken,Authorization,sid,SessionId,CCPToken,CFIToken
cache-control: public, max-age=0
etag: W/"2bdae-17d0583d2a8"
accept-ranges: bytes
x-robots-tag: noindex, nofollow
access-control-allow-headers: action,challengeType,accesstoken,appVersion,,Content-Type,sid,CCPToken,CFIToken,countryCode,businessCode,channelId,uuid,client_id,environmentId

GET
H2 200 scripts.ccc73c512668b4e837d7.js Show response
sit58.online.citi.com/cbol-pre-login-static-assets/ 49 KB
14 KB 372ms
371ms Script
application/javascript 104.70.85.47
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://sit58.online.citi.com/cbol-pre-login-static-assets/scripts.ccc73c512668b4e837d7.js

Requested by

Host: sit58.online.citi.com
URL: https://sit58.online.citi.com/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.70.85.47 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-70-85-47.deploy.static.akamaitechnologies.com

Software

nginx /

Resource Hash

51c6043803bec020097c7f9559f9f87f1b427daf7590f68f2ce2b3a4feaf661a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000 ; includeSubDomains, max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1 ; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

strict-transport-security: max-age=31536000 ; includeSubDomains, max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
dclocation: GT1DMSDEV1
vary: Accept-Encoding
content-length: 13454
x-xss-protection: 1 ; mode=block
referrer-policy: no-referrer
last-modified: Tue, 09 Nov 2021 16:22:58 GMT
server: nginx
x-akamai-citisite: GTDC
date: Fri, 14 Jan 2022 05:41:01 GMT
access-control-max-age: 2147483647
access-control-allow-methods: GET,PUT,POST,DELETE,HEAD
content-type: application/javascript; charset=UTF-8
access-control-allow-origin
x-vcap-request-id: 23629ed6-70db-4525-6a64-66670fe24107
access-control-expose-headers: action,challengeType,bizToken,eventid,Eventid,Eventidexpirytime,eventidexpirytime,accesstoken,Authorization,sid,SessionId,CCPToken,CFIToken
cache-control: public, max-age=0
etag: W/"c4c8-17d05827ed0"
accept-ranges: bytes
x-robots-tag: noindex, nofollow
access-control-allow-headers: action,challengeType,accesstoken,appVersion,,Content-Type,sid,CCPToken,CFIToken,countryCode,businessCode,channelId,uuid,client_id,environmentId

GET
H2 200 main-es2015.926484ba20d93e7ff0df.js Show response
sit58.online.citi.com/cbol-pre-login-static-assets/ 3 MB
658 KB 1164ms
1164ms Script
application/javascript 104.70.85.47
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://sit58.online.citi.com/cbol-pre-login-static-assets/main-es2015.926484ba20d93e7ff0df.js

Requested by

Host: sit58.online.citi.com
URL: https://sit58.online.citi.com/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.70.85.47 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-70-85-47.deploy.static.akamaitechnologies.com

Software

nginx /

Resource Hash

1ef8a96213dddc1092922838721a9944760936864f654a7975246e377b6271e6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000 ; includeSubDomains, max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1 ; mode=block

Request headers

Referer
Origin: https://sit58.online.citi.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

strict-transport-security: max-age=31536000 ; includeSubDomains, max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
dclocation: GT1DMSDEV1
vary: Accept-Encoding
x-xss-protection: 1 ; mode=block
referrer-policy: no-referrer
last-modified: Tue, 09 Nov 2021 16:24:56 GMT
server: nginx
x-akamai-citisite: GTDC
date: Fri, 14 Jan 2022 05:41:01 GMT
access-control-max-age: 2147483647
access-control-allow-methods: GET,PUT,POST,DELETE,HEAD
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: https://sit58.online.citi.com
x-vcap-request-id: fe7653d8-0a31-4ae6-5461-7b41853a7cf5
access-control-expose-headers: action,challengeType,bizToken,eventid,Eventid,Eventidexpirytime,eventidexpirytime,accesstoken,Authorization,sid,SessionId,CCPToken,CFIToken
cache-control: public, max-age=0
etag: W/"2edcb1-17d05844bc0"
accept-ranges: bytes
x-robots-tag: noindex, nofollow
access-control-allow-headers: action,challengeType,accesstoken,appVersion,,Content-Type,sid,CCPToken,CFIToken,countryCode,businessCode,channelId,uuid,client_id,environmentId

OPTIONS
H2 200 tagging_transformation_homepage_and_login.json
online.citi.com/gcgapi/prod/public/v1/staticcms/USGCB/en_US/appid/ Frame 0
0 543ms
490ms Preflight 104.111.238.178
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://online.citi.com/gcgapi/prod/public/v1/staticcms/USGCB/en_US/appid/tagging_transformation_homepage_and_login.json

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.111.238.178 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-111-238-178.deploy.static.akamaitechnologies.com

Software

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

Accept: */*
Access-Control-Request-Method: GET
Access-Control-Request-Headers: appversion,client_id
Origin: https://sit58.online.citi.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Sec-Fetch-Mode: cors

Response headers

content-encoding: gzip
content-length: 0
vary: Accept-Encoding
cache-control: max-age=21600
date: Fri, 14 Jan 2022 05:41:01 GMT
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET tagging_transformation_homepage_and_login.json
online.citi.com/gcgapi/prod/public/v1/staticcms/USGCB/en_US/appid/ 0
0

GET 19469
stags.bluekai.com/site/ 0
0

GET
H2 451 463166.gif
idsync.rlcdn.com/ 0
66 B 72ms
23ms Image
text/plain 35.244.174.68
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://idsync.rlcdn.com/463166.gif?partner_uid=82896b93-ce45-43cf-ad7a-b3e0c2a42412
Requested by: Host: sit58.online.citi.com
URL: https://sit58.online.citi.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.174.68 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 68.174.244.35.bc.googleusercontent.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Fri, 14 Jan 2022 05:41:00 GMT
via: 1.1 google
alt-svc: clear
content-length: 0

GET
H/1.1 200
OK snare.js Show response
ci-mpsnare.iovation.com/ 38 KB
13 KB 727ms
177ms Script
text/javascript 52.24.163.168
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://ci-mpsnare.iovation.com/snare.js?_=2246222549044413

Requested by

Host: sit58.online.citi.com
URL: https://sit58.online.citi.com/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.24.163.168 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-52-24-163-168.us-west-2.compute.amazonaws.com

Software

nginx /

Resource Hash

97f75a27ae70cd39192f0c313f9d254d0628f9225b0ee94f35f206c555237241

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Pragma: no-cache
Date: Fri, 14 Jan 2022 05:41:01 GMT
Content-Encoding: gzip
Server: nginx
Strict-Transport-Security: max-age=15552000; includeSubDomains
p3p: CP="NON DSP COR CURa"
Cache-Control: no-cache, private
Transfer-Encoding: chunked
Connection: keep-alive
Content-Type: text/javascript; charset=utf-8
Expires: 0

GET identity
api.rlcdn.com/api/ 0
0

GET
H2 200 jamp-spinner-2x.gif
sit58.online.citi.com/cbol-pre-login-static-assets/commonui-assets/images/ 36 KB
37 KB 360ms
359ms Image
image/gif 104.70.85.47
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://sit58.online.citi.com/cbol-pre-login-static-assets/commonui-assets/images/jamp-spinner-2x.gif

Requested by

Host: sit58.online.citi.com
URL: https://sit58.online.citi.com/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.70.85.47 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-70-85-47.deploy.static.akamaitechnologies.com

Software

nginx /

Resource Hash

79206ccd37edbafc46266406417abb5be984a5d0fb9f38e693d67b6d30cba8bb

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000 ; includeSubDomains, max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1 ; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://sit58.online.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

strict-transport-security: max-age=31536000 ; includeSubDomains, max-age=31536000
x-content-type-options: nosniff
dclocation: GT1DMSDEV1
content-length: 36855
x-xss-protection: 1 ; mode=block
referrer-policy: no-referrer
last-modified: Tue, 09 Nov 2021 16:22:58 GMT
server: nginx
x-akamai-citisite: GTDC
date: Fri, 14 Jan 2022 05:41:01 GMT
access-control-max-age: 2147483647
access-control-allow-methods: GET,PUT,POST,DELETE,HEAD
content-type: image/gif
access-control-allow-origin
x-vcap-request-id: 1b37afa4-bc0c-4294-597d-19cb5d6ccc8b
access-control-expose-headers: action,challengeType,bizToken,eventid,Eventid,Eventidexpirytime,eventidexpirytime,accesstoken,Authorization,sid,SessionId,CCPToken,CFIToken
cache-control: public, max-age=0
etag: W/"8ff7-17d05827ed0"
accept-ranges: bytes
x-robots-tag: noindex, nofollow
access-control-allow-headers: action,challengeType,accesstoken,appVersion,,Content-Type,sid,CCPToken,CFIToken,countryCode,businessCode,channelId,uuid,client_id,environmentId

POST
H2 404 banner Show response
sit58.online.citi.com/gcgapi/prod/api/v1/marketing/offers/ 100 B
2 KB 372ms
372ms XHR
application/json 104.70.85.47
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://sit58.online.citi.com/gcgapi/prod/api/v1/marketing/offers/banner
Requested by: Host: sit58.online.citi.com
URL: https://sit58.online.citi.com/cbol-pre-login-static-assets/polyfills-es2015.208e90726d88af943fd8.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 104.70.85.47 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-70-85-47.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 4935c8acd0d39b219a73b3bacca86332bfee10ce7fb41c2d734f40ad577b12f7

Request headers

client_id: e83e6374-92f0-472c-8a6b-2ded64acc51c
Referer
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Content-Type: application/json

Response headers

date: Fri, 14 Jan 2022 05:41:02 GMT
x-akamai-citisite: gtdc
access-control-allow-methods: GET,POST,PUT,DELETE
content-type: application/json
access-control-allow-origin: https://sit58.online.citi.com
access-control-expose-headers: APIm-Debug-Trans-Id, X-RateLimit-Limit, X-RateLimit-Remaining, X-RateLimit-Reset, X-Global-Transaction-ID,Accept,Accept-Language,Authorization,businessCode,client_id,content-type,countryCode,uuid,x-ibm-client-id,eventid,bizToken,citiuuid,applicationId,channelId,Scope,blackBox,devicePrint,deviceTokenCookie,environmentId,customerType,appId,AMWResponse,TMXSessionId,action,challengeType,tenantName,consumerOrg,categoryCode,screenId,locationId,digitalApplicationType,familyIndicator,TMXDigitalApplicationType,accessToken,RequestUrl,RequestContext,RequestMethod,BioCatchSessionId,tenantId,frameworkVersion,computed,accept-compression-kyc,idseventdata_product,idseventdata_version,idseventdata_csi,deviceId,subscriberId,CitiProfOnly,Otpid,dap-clientId,serviceVersion,X-Migration-Target,x-soz9htcz-a,x-soz9htcz-b,x-soz9htcz-c,x-soz9htcz-d,x-soz9htcz-e,x-soz9htcz-f,x-soz9htcz-z,x-soz9htcz-uniquestatekey,Dclocation,x-ts-client-version,x-apigw-api-id,CITI_AWS,consumerappname,appVersion,fprNgaFlow,flowType,cookiereceived,cookiename,cookieexpected,kore-token,mfaDisable,customersessionid,stateToken,countofusername,eventname,customer-segment,cache-control,businesscode2,sts,AccessToken,serviceauthorization,locale,userIdOverrideFlag,userId,retryIndicator,fti_tradetype,audittrail,errorpage
access-control-allow-credentials: true
x-robots-tag: noindex, nofollow
access-control-allow-headers: Accept,Accept-Language,Authorization,businessCode,client_id,content-type,countryCode,uuid,x-ibm-client-id,eventid,bizToken,citiuuid,applicationId,channelId,Scope,blackBox,devicePrint,deviceTokenCookie,environmentId,customerType,appId,AMWResponse,TMXSessionId,action,challengeType,tenantName,consumerOrg,categoryCode,screenId,locationId,digitalApplicationType,familyIndicator,TMXDigitalApplicationType,accessToken,RequestUrl,RequestContext,RequestMethod,BioCatchSessionId,tenantId,frameworkVersion,computed,accept-compression-kyc,idseventdata_product,idseventdata_version,idseventdata_csi,deviceId,subscriberId,CitiProfOnly,Otpid,dap-clientId,serviceVersion,X-Migration-Target,x-soz9htcz-a,x-soz9htcz-b,x-soz9htcz-c,x-soz9htcz-d,x-soz9htcz-e,x-soz9htcz-f,x-soz9htcz-z,x-soz9htcz-uniquestatekey,Dclocation,x-ts-client-version,x-apigw-api-id,CITI_AWS,consumerappname,appVersion,fprNgaFlow,flowType,cookiereceived,cookiename,cookieexpected,kore-token,mfaDisable,customersessionid,stateToken,countofusername,eventname,customer-segment,cache-control,businesscode2,sts,AccessToken,serviceauthorization,locale,userIdOverrideFlag,userId,retryIndicator,fti_tradetype,audittrail,errorpage
content-length: 100

GET
H/1.1 200
OK logo.js Show response
ci-mpsnare.iovation.com/script/ 96 B
610 B 176ms
176ms Script
text/javascript 52.24.163.168
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://ci-mpsnare.iovation.com/script/logo.js

Requested by

Host: ci-mpsnare.iovation.com
URL: https://ci-mpsnare.iovation.com/snare.js?_=2246222549044413

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.24.163.168 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-52-24-163-168.us-west-2.compute.amazonaws.com

Software

nginx /

Resource Hash

277da2ef5834e2c4327b3ed53e0fa36a7bcb395b6e3ca8af3d2691d17dec3f7b

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Date: Fri, 14 Jan 2022 05:41:01 GMT
Content-Encoding: gzip
Last-Modified: Tue, 06 May 2014 00:01:40 GMT
Server: nginx
Strict-Transport-Security: max-age=15552000; includeSubDomains
p3p: CP="NON DSP COR CURa"
Accept-CH: ua, ua-arch, ua-platform, ua-model, ua-mobile, ua-full-version, ua-platform-version
Cache-Control: private
Transfer-Encoding: chunked
Connection: keep-alive
Content-Type: text/javascript; charset=utf-8
Expires: Sat, 14 Jan 2023 05:41:01 GMT

OPTIONS cbol
dit1.online.citi.com/gcgapi/dev1/public/v1/prelogin/e2eConfig/client/ Frame 0
0

OPTIONS fntc_USCBOL.json
dit1.online.citi.com/gcgapi/dev1/public/v1/staticcms/USGCB/en_US/appid/ Frame 0
0

GET
H2 200 brandingMap.json Show response
sit58.online.citi.com/CBOL/IA/Angular/Branding/preLoginBranding/ 231 B
457 B 189ms
188ms XHR
text/plain 104.70.85.47
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://sit58.online.citi.com/CBOL/IA/Angular/Branding/preLoginBranding/brandingMap.json
Requested by: Host: sit58.online.citi.com
URL: https://sit58.online.citi.com/cbol-pre-login-static-assets/polyfills-es2015.208e90726d88af943fd8.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 104.70.85.47 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-70-85-47.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: d269967a042bb6cbe42c7a937a8829f19c6cebbd9346648758824e887e746735

Request headers

accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Content-Type: application/json
appVersion: CBOL-ANGS-2021-11-00
Accept: application/json
channelId: CBOL
Referer
countryCode: US
businessCode: GCB
environmentId: loginAuth
client_id: 6e919cb7-cdeb-4035-87e8-e55bd4c49c05

Response headers

date: Fri, 14 Jan 2022 05:41:05 GMT
content-encoding: gzip
content-type: text/plain
last-modified: Tue, 10 Aug 2021 15:17:53 GMT
x-akamai-citisite: GTDC
etag: "400a8-e7-5c936016eaa40"
vary: Accept-Encoding
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
cache-control: max-age=3600
accept-ranges: bytes
x-robots-tag: noindex, nofollow
content-length: 133

GET
H2 200 Bootstrap.js Show response
nexus.ensighten.com/citi/na_stage/ 226 KB
69 KB 76ms
33ms Script
application/javascript 18.195.42.228
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://nexus.ensighten.com/citi/na_stage/Bootstrap.js
Requested by: Host: sit58.online.citi.com
URL: https://sit58.online.citi.com/cbol-pre-login-static-assets/main-es2015.926484ba20d93e7ff0df.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 18.195.42.228 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-195-42-228.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: d39a03dcaa2b8733a0acd3f1ba518f58d6144b04752141ef2351dfa68a5313ec

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Fri, 14 Jan 2022 05:41:05 GMT
content-encoding: gzip
last-modified: Thu, 13 Jan 2022 12:17:08 GMT
server: nginx
etag: W/"61e01844-389a5"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
cache-control: max-age=300

GET
H2 200 cedrictest.js Show response
sit58.online.citi.com/cbol-pre-login-static-assets/cbol-core-assets/cedric/ 602 KB
113 KB 476ms
476ms Script
application/javascript 104.70.85.47
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://sit58.online.citi.com/cbol-pre-login-static-assets/cbol-core-assets/cedric/cedrictest.js

Requested by

Host: sit58.online.citi.com
URL: https://sit58.online.citi.com/cbol-pre-login-static-assets/main-es2015.926484ba20d93e7ff0df.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.70.85.47 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-70-85-47.deploy.static.akamaitechnologies.com

Software

nginx /

Resource Hash

c89abea900fefa421105ea0fadab0c32b5133cf1be9d21b4ee61a3306a96572e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000 ; includeSubDomains, max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1 ; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

strict-transport-security: max-age=31536000 ; includeSubDomains, max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
dclocation: GT1DMSDEV1
vary: Accept-Encoding
x-xss-protection: 1 ; mode=block
referrer-policy: no-referrer
last-modified: Tue, 09 Nov 2021 16:22:58 GMT
server: nginx
x-akamai-citisite: GTDC
date: Fri, 14 Jan 2022 05:41:05 GMT
access-control-max-age: 2147483647
access-control-allow-methods: GET,PUT,POST,DELETE,HEAD
content-type: application/javascript; charset=UTF-8
access-control-allow-origin
x-vcap-request-id: 475961a9-38d1-43b5-69af-20def205b506
access-control-expose-headers: action,challengeType,bizToken,eventid,Eventid,Eventidexpirytime,eventidexpirytime,accesstoken,Authorization,sid,SessionId,CCPToken,CFIToken
cache-control: public, max-age=0
etag: W/"96987-17d05827ed0"
accept-ranges: bytes
x-robots-tag: noindex, nofollow
access-control-allow-headers: action,challengeType,accesstoken,appVersion,,Content-Type,sid,CCPToken,CFIToken,countryCode,businessCode,channelId,uuid,client_id,environmentId

GET cbol
dit1.online.citi.com/gcgapi/dev1/public/v1/prelogin/e2eConfig/client/ 0
0

GET fntc_USCBOL.json
dit1.online.citi.com/gcgapi/dev1/public/v1/staticcms/USGCB/en_US/appid/ 0
0

GET
H2 200 jquery-3.5.1.min.js Show response
code.jquery.com/ 87 KB
30 KB 54ms
18ms Script
application/javascript 2001:4de0:ac18::1:a:1b
HIGHWINDS3

General

Check archive.org

Show headers Download Go to

Full URL: https://code.jquery.com/jquery-3.5.1.min.js
Requested by: Host: sit58.online.citi.com
URL: https://sit58.online.citi.com/cbol-pre-login-static-assets/main-es2015.926484ba20d93e7ff0df.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4de0:ac18::1:a:1b , Netherlands, ASN20446 (HIGHWINDS3, US),
Reverse DNS
Software: nginx /
Resource Hash: f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d

Request headers

Referer
Origin: https://sit58.online.citi.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Fri, 14 Jan 2022 05:41:05 GMT
content-encoding: gzip
last-modified: Fri, 20 Aug 2021 17:47:53 GMT
server: nginx
etag: W/"611feac9-15d84"
vary: Accept-Encoding
x-hw: 1642138865.dop098.fr8.t,1642138865.cds250.fr8.hn,1642138865.cds142.fr8.c
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=315360000, public
accept-ranges: bytes
content-length: 30879

GET
H2 200 xmsdk.js Show response
sit58.online.citi.com/cbol-pre-login-static-assets/assets/qrcode/js/ 1 MB
305 KB 606ms
606ms Script
application/javascript 104.70.85.47
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://sit58.online.citi.com/cbol-pre-login-static-assets/assets/qrcode/js/xmsdk.js

Requested by

Host: sit58.online.citi.com
URL: https://sit58.online.citi.com/cbol-pre-login-static-assets/main-es2015.926484ba20d93e7ff0df.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.70.85.47 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-70-85-47.deploy.static.akamaitechnologies.com

Software

nginx /

Resource Hash

1c69468ad43d43f8c701bcd193de8688ba49a17128a730c065c7a06d08106daf

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000 ; includeSubDomains, max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1 ; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

strict-transport-security: max-age=31536000 ; includeSubDomains, max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
dclocation: GT1DMSDEV1
vary: Accept-Encoding
x-xss-protection: 1 ; mode=block
referrer-policy: no-referrer
last-modified: Tue, 09 Nov 2021 16:24:55 GMT
server: nginx
x-akamai-citisite: GTDC
date: Fri, 14 Jan 2022 05:41:05 GMT
access-control-max-age: 2147483647
access-control-allow-methods: GET,PUT,POST,DELETE,HEAD
content-type: application/javascript; charset=UTF-8
access-control-allow-origin
x-vcap-request-id: 79c570b1-4f30-41e8-6b3c-483ffdbe17b0
access-control-expose-headers: action,challengeType,bizToken,eventid,Eventid,Eventidexpirytime,eventidexpirytime,accesstoken,Authorization,sid,SessionId,CCPToken,CFIToken
cache-control: public, max-age=0
etag: W/"145237-17d058447d8"
accept-ranges: bytes
x-robots-tag: noindex, nofollow
access-control-allow-headers: action,challengeType,accesstoken,appVersion,,Content-Type,sid,CCPToken,CFIToken,countryCode,businessCode,channelId,uuid,client_id,environmentId

GET
H2 200 ssrnewBranding_en_US.json Show response
sit58.online.citi.com/CBOL/IA/Angular/Branding/ 34 KB
5 KB 466ms
466ms XHR
text/plain 104.70.85.47
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://sit58.online.citi.com/CBOL/IA/Angular/Branding/ssrnewBranding_en_US.json
Requested by: Host: sit58.online.citi.com
URL: https://sit58.online.citi.com/cbol-pre-login-static-assets/polyfills-es2015.208e90726d88af943fd8.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 104.70.85.47 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-70-85-47.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 4f92161637b73f47f10625fcb60427aed6c9c3a625164a6ab7469d50a89eed0e

Request headers

Accept: application/json, text/plain, */*
Referer
Accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Fri, 14 Jan 2022 05:41:05 GMT
content-encoding: gzip
content-type: text/plain
last-modified: Fri, 29 Oct 2021 14:22:25 GMT
x-akamai-citisite: GTDC
etag: "400c7-8744-5cf7e8e5f6a40"
vary: Accept-Encoding
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
cache-control: max-age=3600
accept-ranges: bytes
x-robots-tag: noindex, nofollow
content-length: 4530

GET
H2 200 newLogosSSR.json Show response
sit58.online.citi.com/CBOL/IA/Angular/Branding/ 9 KB
1 KB 423ms
423ms XHR
text/plain 104.70.85.47
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://sit58.online.citi.com/CBOL/IA/Angular/Branding/newLogosSSR.json
Requested by: Host: sit58.online.citi.com
URL: https://sit58.online.citi.com/cbol-pre-login-static-assets/polyfills-es2015.208e90726d88af943fd8.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 104.70.85.47 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-70-85-47.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: f51c273fe9f0605c9245e17ebcb6f0603dae22cdff498a28ff8cfe6850d453e8

Request headers

Accept: application/json, text/plain, */*
Referer
Accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Fri, 14 Jan 2022 05:41:05 GMT
content-encoding: gzip
content-type: text/plain
last-modified: Wed, 23 Jun 2021 18:56:14 GMT
x-akamai-citisite: GTDC
etag: "400b0-2461-5c57375ee0f80"
vary: Accept-Encoding
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
cache-control: max-age=3600
accept-ranges: bytes
x-robots-tag: noindex, nofollow
content-length: 1029

GET
H2 200 ssrnewTopNavigationIA_en_US.json Show response
sit58.online.citi.com/CBOL/IA/Angular/Branding/ 79 KB
5 KB 508ms
508ms XHR
text/plain 104.70.85.47
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://sit58.online.citi.com/CBOL/IA/Angular/Branding/ssrnewTopNavigationIA_en_US.json
Requested by: Host: sit58.online.citi.com
URL: https://sit58.online.citi.com/cbol-pre-login-static-assets/polyfills-es2015.208e90726d88af943fd8.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 104.70.85.47 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-70-85-47.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 3fb46d467b5ad76174876e5a624ccbaa3ebe201db0f40e63ea58d668d411162c

Request headers

Accept: application/json, text/plain, */*
Referer
Accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Fri, 14 Jan 2022 05:41:05 GMT
content-encoding: gzip
content-type: text/plain
last-modified: Mon, 25 Oct 2021 17:30:22 GMT
x-akamai-citisite: GTDC
etag: "400c8-13c64-5cf30b72b4780"
vary: Accept-Encoding
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
cache-control: max-age=3600
accept-ranges: bytes
x-robots-tag: noindex, nofollow
content-length: 4709

GET
H2 200 citilogoredesign.png
sit58.online.citi.com/cbol-pre-login-static-assets/citi-branding-assets/images/ 2 KB
2 KB 230ms
230ms Image
image/png 104.70.85.47
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://sit58.online.citi.com/cbol-pre-login-static-assets/citi-branding-assets/images/citilogoredesign.png

Requested by

Host: sit58.online.citi.com
URL: https://sit58.online.citi.com/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.70.85.47 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-70-85-47.deploy.static.akamaitechnologies.com

Software

nginx /

Resource Hash

102503acef6077fcf8e42a856fb4904fcd74224a32d5d8efcd13236ac6309fed

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000 ; includeSubDomains, max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1 ; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

strict-transport-security: max-age=31536000 ; includeSubDomains, max-age=31536000
x-content-type-options: nosniff
dclocation: GT1DMSDEV1
content-length: 1799
x-xss-protection: 1 ; mode=block
referrer-policy: no-referrer
last-modified: Tue, 09 Nov 2021 16:22:58 GMT
server: nginx
x-akamai-citisite: GTDC
date: Fri, 14 Jan 2022 05:41:05 GMT
access-control-max-age: 2147483647
access-control-allow-methods: GET,PUT,POST,DELETE,HEAD
content-type: image/png
access-control-allow-origin
x-vcap-request-id: df7693d1-1c03-4eef-7303-f938116fe24b
access-control-expose-headers: action,challengeType,bizToken,eventid,Eventid,Eventidexpirytime,eventidexpirytime,accesstoken,Authorization,sid,SessionId,CCPToken,CFIToken
cache-control: public, max-age=0
etag: W/"707-17d05827ed0"
accept-ranges: bytes
x-robots-tag: noindex, nofollow
access-control-allow-headers: action,challengeType,accesstoken,appVersion,,Content-Type,sid,CCPToken,CFIToken,countryCode,businessCode,channelId,uuid,client_id,environmentId

GET
H2 200 050-location@2x.svg
sit58.online.citi.com/cbol-pre-login-static-assets/citi-branding-assets/images/ 2 KB
2 KB 571ms
571ms Image
image/svg+xml 104.70.85.47
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://sit58.online.citi.com/cbol-pre-login-static-assets/citi-branding-assets/images/050-location@2x.svg

Requested by

Host: sit58.online.citi.com
URL: https://sit58.online.citi.com/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.70.85.47 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-70-85-47.deploy.static.akamaitechnologies.com

Software

nginx /

Resource Hash

6336ae7b60dff18e0a37721a3a19fd5e18568577a64faa662969d35966dbf72b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000 ; includeSubDomains, max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1 ; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

sid: f37cdb47-315b-4874-bcbf-be7e054576d4
content-encoding: gzip
etag: W/"6d8-17d05827ed0"
nonce: 2521576637612979
access-control-max-age: 2147483647
access-control-allow-methods: GET,PUT,POST,DELETE,HEAD
dclocation: GT1DMSDEV1
content-length: 758
x-xss-protection: 1 ; mode=block
uuid: 47f717c8-bd54-4a09-bb87-112b1e426194
referrer-policy: no-referrer
last-modified: Tue, 09 Nov 2021 16:22:58 GMT
server: nginx
x-akamai-citisite: GTDC
date: Fri, 14 Jan 2022 05:41:05 GMT
vary: Accept-Encoding
strict-transport-security: max-age=31536000 ; includeSubDomains, max-age=31536000
content-type: image/svg+xml
access-control-allow-origin
x-vcap-request-id: d30ccbe4-7987-40cc-57bc-d59d0c15e05b
access-control-expose-headers: action,challengeType,bizToken,eventid,Eventid,Eventidexpirytime,eventidexpirytime,accesstoken,Authorization,sid,SessionId,CCPToken,CFIToken
cache-control: public, max-age=0
scope: VISITOR
accept-ranges: bytes
x-robots-tag: noindex, nofollow
access-control-allow-headers: action,challengeType,accesstoken,appVersion,,Content-Type,sid,CCPToken,CFIToken,countryCode,businessCode,channelId,uuid,client_id,environmentId
x-content-type-options: nosniff

GET
H2 200 icon_globe_med-grey@2x.svg
sit58.online.citi.com/cbol-pre-login-static-assets/citi-branding-assets/images/ 3 KB
2 KB 570ms
570ms Image
image/svg+xml 104.70.85.47
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://sit58.online.citi.com/cbol-pre-login-static-assets/citi-branding-assets/images/icon_globe_med-grey@2x.svg

Requested by

Host: sit58.online.citi.com
URL: https://sit58.online.citi.com/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.70.85.47 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-70-85-47.deploy.static.akamaitechnologies.com

Software

nginx /

Resource Hash

a593628f2d5ba814f37fbcd3963162f094c2764d4b15d82464c2d1aef92f150f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000 ; includeSubDomains, max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1 ; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

sid: 94789f05-723e-43a9-985a-c58644c5d5ab
content-encoding: gzip
etag: W/"dc3-17d05827ed0"
nonce: 6984017159164492
access-control-max-age: 2147483647
access-control-allow-methods: GET,PUT,POST,DELETE,HEAD
dclocation: GT1DMSDEV1
content-length: 1419
x-xss-protection: 1 ; mode=block
uuid: ceb71050-9525-4e30-b104-775536af5768
referrer-policy: no-referrer
last-modified: Tue, 09 Nov 2021 16:22:58 GMT
server: nginx
x-akamai-citisite: GTDC
date: Fri, 14 Jan 2022 05:41:05 GMT
vary: Accept-Encoding
strict-transport-security: max-age=31536000 ; includeSubDomains, max-age=31536000
content-type: image/svg+xml
access-control-allow-origin
x-vcap-request-id: 0cc64bfe-d4c4-4cb2-645e-9b3ba395bef8
access-control-expose-headers: action,challengeType,bizToken,eventid,Eventid,Eventidexpirytime,eventidexpirytime,accesstoken,Authorization,sid,SessionId,CCPToken,CFIToken
cache-control: public, max-age=0
scope: VISITOR
accept-ranges: bytes
x-robots-tag: noindex, nofollow
access-control-allow-headers: action,challengeType,accesstoken,appVersion,,Content-Type,sid,CCPToken,CFIToken,countryCode,businessCode,channelId,uuid,client_id,environmentId
x-content-type-options: nosniff

GET
H2 200 right-white-chevi.svg
sit58.online.citi.com/cbol-pre-login-static-assets/citi-branding-assets/images/ 2 KB
2 KB 546ms
546ms Image
image/svg+xml 104.70.85.47
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://sit58.online.citi.com/cbol-pre-login-static-assets/citi-branding-assets/images/right-white-chevi.svg

Requested by

Host: sit58.online.citi.com
URL: https://sit58.online.citi.com/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.70.85.47 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-70-85-47.deploy.static.akamaitechnologies.com

Software

nginx /

Resource Hash

6dae862525bc15cc9ca50bbdfcfa1eea606f15777a11047e5905d1cc34816d37

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000 ; includeSubDomains, max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1 ; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://sit58.online.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

sid: 4c203814-ead6-4101-b889-25fdc0e6478f
content-encoding: gzip
etag: W/"75b-17d05827ed0"
nonce: 5320694814651472
access-control-max-age: 2147483647
access-control-allow-methods: GET,PUT,POST,DELETE,HEAD
dclocation: GT1DMSDEV1
content-length: 743
x-xss-protection: 1 ; mode=block
uuid: 270f87a1-83c5-46bc-a860-b82d18777ab9
referrer-policy: no-referrer
last-modified: Tue, 09 Nov 2021 16:22:58 GMT
server: nginx
x-akamai-citisite: GTDC
date: Fri, 14 Jan 2022 05:41:05 GMT
vary: Accept-Encoding
strict-transport-security: max-age=31536000 ; includeSubDomains, max-age=31536000
content-type: image/svg+xml
access-control-allow-origin
x-vcap-request-id: 495c0788-9523-4aa6-5dd3-b28511485bd6
access-control-expose-headers: action,challengeType,bizToken,eventid,Eventid,Eventidexpirytime,eventidexpirytime,accesstoken,Authorization,sid,SessionId,CCPToken,CFIToken
cache-control: public, max-age=0
scope: VISITOR
accept-ranges: bytes
x-robots-tag: noindex, nofollow
access-control-allow-headers: action,challengeType,accesstoken,appVersion,,Content-Type,sid,CCPToken,CFIToken,countryCode,businessCode,channelId,uuid,client_id,environmentId
x-content-type-options: nosniff

GET
H2 200 search.svg
sit58.online.citi.com/cbol-pre-login-static-assets/citi-branding-assets/images/ 1 KB
2 KB 532ms
531ms Image
image/svg+xml 104.70.85.47
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://sit58.online.citi.com/cbol-pre-login-static-assets/citi-branding-assets/images/search.svg

Requested by

Host: sit58.online.citi.com
URL: https://sit58.online.citi.com/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.70.85.47 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-70-85-47.deploy.static.akamaitechnologies.com

Software

nginx /

Resource Hash

390c36ad787c04f4acc3f3022a0bb787c9046941c5516d8412a85a959991e4d8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000 ; includeSubDomains, max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1 ; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://sit58.online.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

sid: 70f4a27a-a841-44d0-b4a0-c20c06f075bf
content-encoding: gzip
etag: W/"590-17d05827ed0"
nonce: 7361131415428651
access-control-max-age: 2147483647
access-control-allow-methods: GET,PUT,POST,DELETE,HEAD
dclocation: GT1DMSDEV1
content-length: 717
x-xss-protection: 1 ; mode=block
uuid: 7e505469-46a1-4691-83ea-bb25ebc548e6
referrer-policy: no-referrer
last-modified: Tue, 09 Nov 2021 16:22:58 GMT
server: nginx
x-akamai-citisite: GTDC
date: Fri, 14 Jan 2022 05:41:05 GMT
vary: Accept-Encoding
strict-transport-security: max-age=31536000 ; includeSubDomains, max-age=31536000
content-type: image/svg+xml
access-control-allow-origin
x-vcap-request-id: 6efe4f37-0e3a-4a3c-5785-57f88bc5dc91
access-control-expose-headers: action,challengeType,bizToken,eventid,Eventid,Eventidexpirytime,eventidexpirytime,accesstoken,Authorization,sid,SessionId,CCPToken,CFIToken
cache-control: public, max-age=0
scope: VISITOR
accept-ranges: bytes
x-robots-tag: noindex, nofollow
access-control-allow-headers: action,challengeType,accesstoken,appVersion,,Content-Type,sid,CCPToken,CFIToken,countryCode,businessCode,channelId,uuid,client_id,environmentId
x-content-type-options: nosniff

GET
H2 200 H1_HP417.jpg
sit58.online.citi.com/JRS/banners/ 193 KB
194 KB 178ms
178ms Image
image/jpeg 104.70.85.47
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sit58.online.citi.com/JRS/banners/H1_HP417.jpg
Requested by: Host: sit58.online.citi.com
URL: https://sit58.online.citi.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 104.70.85.47 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-70-85-47.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 9e1aa3b46d82fb1fc803dbb1aa5bacb618bbafff98199bc178135e797b6f698d

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Fri, 14 Jan 2022 05:41:05 GMT
last-modified: Wed, 22 Apr 2020 19:06:32 GMT
x-akamai-citisite: GTDC
etag: "5025a-30584-5a3e5d486de00"
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
x-robots-tag: noindex, nofollow
accept-ranges: bytes
content-type: image/jpeg
content-length: 198020

GET
DATA 200
OK truncated
/ 35 B
0 Image
image/gif

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 8d29865aa51f76ae96b1968abe50d09a1540ca0b5b4a085cb471ab454ff90725

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Content-Type: image/gif

GET
DATA 200
OK truncated
/ 918 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: e90fb0eba512ed6473f6fb8acf4cd09b38732f150f43c396246c12bb2aacbb67

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Content-Type: image/svg+xml;charset=US-ASCII

GET
H/1.1

200
OK

rd Show response
dpm.demdex.net/id/
Redirect Chain

https://dpm.demdex.net/id?d_visid_ver=3.1.2&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=61834D9B5228A7430A490D45%40AdobeOrg&d_nsid=0&ts=1642138865340
https://dpm.demdex.net/id/rd?d_visid_ver=3.1.2&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=61834D9B5228A7430A490D45%40AdobeOrg&d_nsid=0&ts=1642138865340

363 B
1 KB

44ms
43ms

XHR
application/json

34.249.190.190
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://dpm.demdex.net/id/rd?d_visid_ver=3.1.2&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=61834D9B5228A7430A490D45%40AdobeOrg&d_nsid=0&ts=1642138865340

Requested by

Host: sit58.online.citi.com
URL: https://sit58.online.citi.com/

Protocol

HTTP/1.1

Server

34.249.190.190 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-34-249-190-190.eu-west-1.compute.amazonaws.com

Software

Resource Hash

e89a0eca65394c8b1131887334cc05eb627b6bd4b61d470bd0e4f3bb49fdc4bc

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

DCS: dcs-prod-irl1-1-v026-0b7196de5.edge-irl1.demdex.com UNKNOWN
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
content-encoding: gzip
X-TID: /eDeDArQTXo=
Vary: Origin
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Access-Control-Allow-Origin: https://sit58.online.citi.com
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/json;charset=utf-8
Content-Length: 306
Expires: Thu, 01 Jan 1970 00:00:00 UTC

Redirect headers

DCS: dcs-prod-irl1-1-v026-0a1171374.edge-irl1.demdex.com UNKNOWN
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
Access-Control-Allow-Origin: https://sit58.online.citi.com
X-TID: 7D7jj4lCTvs=
Vary: Origin
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Location: https://dpm.demdex.net/id/rd?d_visid_ver=3.1.2&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=61834D9B5228A7430A490D45%40AdobeOrg&d_nsid=0&ts=1642138865340
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 0
Expires: Thu, 01 Jan 1970 00:00:00 UTC

GET
H2 200 serverComponent.php Show response
nexus.ensighten.com/citi/na_stage/ 2 KB
852 B 28ms
28ms Script
text/javascript 18.195.42.228
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://nexus.ensighten.com/citi/na_stage/serverComponent.php?namespace=Bootstrapper&staticJsPath=nexus.ensighten.com/citi/na_stage/code/&publishedOn=Thu%20Jan%2013%2012:17:05%20GMT%202022&ClientID=1129&PageID=https%3A%2F%2Fsit58.online.citi.com%2F
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_stage/Bootstrap.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 18.195.42.228 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-195-42-228.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 86e0b0862ec46454e54661cdbc43fdb400c2bf2181f024bb06b8dcf87ea3fc0c

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Fri, 14 Jan 2022 05:41:05 GMT
cache-control: no-cache, no-store
content-type: text/javascript
server: nginx
content-encoding: gzip
vary: Accept-Encoding
expires: Fri, 14 Jan 2022 05:41:04 GMT

GET
H2 200 1106464b92c342a3c2fa0b71543bda48.js Show response
nexus.ensighten.com/citi/na_stage/code/ 989 B
1 KB 17ms
17ms Script
application/javascript 18.195.42.228
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://nexus.ensighten.com/citi/na_stage/code/1106464b92c342a3c2fa0b71543bda48.js?conditionId0=4849963
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_stage/Bootstrap.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 18.195.42.228 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-195-42-228.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 275cf9d336d8a29dd3a8cc8bc22761e96bfdd81c75a24bc5f48e10bfcc54d4fb

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Fri, 14 Jan 2022 05:41:05 GMT
last-modified: Mon, 28 Dec 2020 17:49:03 GMT
server: nginx
etag: "5fea1a8f-3dd"
content-type: application/javascript; charset=utf-8
cache-control: max-age=315360000
accept-ranges: bytes
content-length: 989

GET
H2 200 ea69f1cd96f513131dc19512b0ff4290.js Show response
nexus.ensighten.com/citi/na_stage/code/ 13 KB
4 KB 18ms
17ms Script
application/javascript 18.195.42.228
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://nexus.ensighten.com/citi/na_stage/code/ea69f1cd96f513131dc19512b0ff4290.js?conditionId0=462132
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_stage/Bootstrap.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 18.195.42.228 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-195-42-228.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 198f5d63443524a293ae8cdc33d2463e571dc668248581439c0c96781a206e05

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Fri, 14 Jan 2022 05:41:05 GMT
content-encoding: gzip
last-modified: Mon, 29 Nov 2021 16:48:12 GMT
server: nginx
etag: W/"61a5044c-324c"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
cache-control: max-age=315360000

GET
H2 200 30785cec0af3ef7e9061f666b2b0f15f.js Show response
nexus.ensighten.com/citi/na_stage/code/ 10 KB
4 KB 18ms
17ms Script
application/javascript 18.195.42.228
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://nexus.ensighten.com/citi/na_stage/code/30785cec0af3ef7e9061f666b2b0f15f.js?conditionId0=4897099
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_stage/Bootstrap.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 18.195.42.228 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-195-42-228.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 07b8ed0a756c84e6eefa24e1f5b04173739c17cb090be37878b3a8189846f9a6

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Fri, 14 Jan 2022 05:41:05 GMT
content-encoding: gzip
last-modified: Tue, 30 Nov 2021 13:04:09 GMT
server: nginx
etag: W/"61a62149-2858"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
cache-control: max-age=315360000

GET
H2 200 daf17cf3adb07b9f460815b5237591c5.js Show response
nexus.ensighten.com/citi/na_stage/code/ 2 KB
960 B 19ms
18ms Script
application/javascript 18.195.42.228
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://nexus.ensighten.com/citi/na_stage/code/daf17cf3adb07b9f460815b5237591c5.js?conditionId0=4837456
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_stage/Bootstrap.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 18.195.42.228 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-195-42-228.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 600263e9bde3fb2c66b5ccb8c59efd8bcb9224b5e2481aa3a336d7843803e8f6

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Fri, 14 Jan 2022 05:41:05 GMT
content-encoding: gzip
last-modified: Mon, 28 Dec 2020 17:49:03 GMT
server: nginx
etag: W/"5fea1a8f-887"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
cache-control: max-age=315360000

GET
H2 200 4f43f12abd09e86ea611c265586937c3.js Show response
nexus.ensighten.com/citi/na_stage/code/ 2 KB
863 B 18ms
17ms Script
application/javascript 18.195.42.228
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://nexus.ensighten.com/citi/na_stage/code/4f43f12abd09e86ea611c265586937c3.js?conditionId0=480881
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_stage/Bootstrap.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 18.195.42.228 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-195-42-228.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 6ea89010cb1d1fda56574d22ae56f7bdb66e7419e90a2dcb2bf35ed914571adb

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Fri, 14 Jan 2022 05:41:05 GMT
content-encoding: gzip
last-modified: Mon, 29 Nov 2021 16:48:12 GMT
server: nginx
etag: W/"61a5044c-631"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
cache-control: max-age=315360000

GET
H2 200 d4735fd843d57a69f9e83da44aed18d7.js Show response
nexus.ensighten.com/citi/na_stage/code/ 278 B
460 B 19ms
18ms Script
application/javascript 18.195.42.228
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://nexus.ensighten.com/citi/na_stage/code/d4735fd843d57a69f9e83da44aed18d7.js?conditionId0=494377
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_stage/Bootstrap.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 18.195.42.228 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-195-42-228.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: c4d822793b2eab5f9bf345ce530487844b1aeaca83f5fd906f2e9987f6842028

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Fri, 14 Jan 2022 05:41:05 GMT
last-modified: Fri, 03 May 2019 18:11:56 GMT
server: nginx
etag: "5ccc846c-116"
content-type: application/javascript; charset=utf-8
cache-control: max-age=315360000
accept-ranges: bytes
content-length: 278

GET
H2 200 81decd75c24b715b24a3d31dcd9c5108.js Show response
nexus.ensighten.com/citi/na_stage/code/ 162 KB
35 KB 32ms
31ms Script
application/javascript 18.195.42.228
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://nexus.ensighten.com/citi/na_stage/code/81decd75c24b715b24a3d31dcd9c5108.js?conditionId0=421908
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_stage/Bootstrap.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 18.195.42.228 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-195-42-228.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: f3b3ce0b74c9de2f12673b3d437febec89d18f60f294546f1cc30fb017f3c756

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Fri, 14 Jan 2022 05:41:05 GMT
content-encoding: gzip
last-modified: Thu, 13 Jan 2022 12:17:08 GMT
server: nginx
etag: W/"61e01844-286cb"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
cache-control: max-age=315360000

GET
H2 200 ef72263151bbee03f74ed4cee09f2ed0.js Show response
nexus.ensighten.com/citi/na_stage/code/ 2 KB
1 KB 23ms
23ms Script
application/javascript 18.195.42.228
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://nexus.ensighten.com/citi/na_stage/code/ef72263151bbee03f74ed4cee09f2ed0.js?conditionId0=4827153
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_stage/Bootstrap.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 18.195.42.228 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-195-42-228.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: ce08fd02ade613214c6416ccac773f24a7bed68f52af453adf7c8a5a2d42ba71

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Fri, 14 Jan 2022 05:41:05 GMT
content-encoding: gzip
last-modified: Tue, 24 Aug 2021 21:40:26 GMT
server: nginx
etag: W/"6125674a-752"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
cache-control: max-age=315360000

GET
H2 200 2f7d53a3328917f13bb85642dd369341.js Show response
nexus.ensighten.com/citi/na_stage/code/ 132 KB
35 KB 24ms
24ms Script
application/javascript 18.195.42.228
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://nexus.ensighten.com/citi/na_stage/code/2f7d53a3328917f13bb85642dd369341.js?conditionId0=486757
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_stage/Bootstrap.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 18.195.42.228 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-195-42-228.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: e25677f311488dc1509becefd07e120d402caa678322607b9375566631eb0a4d

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Fri, 14 Jan 2022 05:41:05 GMT
content-encoding: gzip
last-modified: Mon, 03 Jan 2022 08:22:32 GMT
server: nginx
etag: W/"61d2b248-20f75"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
cache-control: max-age=315360000

GET
H2 200 da2bd0415ac607436f65fae897a3745f.js Show response
nexus.ensighten.com/citi/na_stage/code/ 35 KB
8 KB 33ms
33ms Script
application/javascript 18.195.42.228
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://nexus.ensighten.com/citi/na_stage/code/da2bd0415ac607436f65fae897a3745f.js?conditionId0=467299
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_stage/Bootstrap.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 18.195.42.228 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-195-42-228.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 3b65cdd967c27148cb83596be9995df19e8fff1e5c16497dfd2e441fd9bd0ed1

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Fri, 14 Jan 2022 05:41:05 GMT
content-encoding: gzip
last-modified: Mon, 03 Jan 2022 08:22:32 GMT
server: nginx
etag: W/"61d2b248-8d0c"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
cache-control: max-age=315360000

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 88 KB
36 KB 65ms
25ms Script
application/javascript 2a00:1450:4001:809::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=DC-6260004

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_stage/Bootstrap.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

7dcde11c1744824fdb6160c37a7b333d087637510bc149648ca2356c9c197a6a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Fri, 14 Jan 2022 05:41:05 GMT
content-encoding: br
vary: Accept-Encoding
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 36241
x-xss-protection: 0
last-modified: Fri, 14 Jan 2022 03:00:00 GMT
server: Google Tag Manager
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Fri, 14 Jan 2022 05:41:05 GMT

GET
H/1.1 200
OK bk-coretag.js Show response
tags.bkrtx.com/js/ 51 KB
16 KB 63ms
16ms Script
application/javascript 104.111.228.137
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://tags.bkrtx.com/js/bk-coretag.js

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_stage/code/da2bd0415ac607436f65fae897a3745f.js?conditionId0=467299

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.111.228.137 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-111-228-137.deploy.static.akamaitechnologies.com

Software

nginx/1.15.8 /

Resource Hash

88cd43c3f5453f7b4db2cbe884b47db3c8317860a2ce6e9b2bc934ff4b8e32eb

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Strict-Transport-Security: max-age=15724800; includeSubDomains
Content-Encoding: gzip
Last-Modified: Fri, 21 May 2021 19:14:21 GMT
Server: nginx/1.15.8
ETag: W/"60a8068d-cbc2"
Vary: Accept-Encoding
Content-Type: application/javascript
Cache-Control: max-age=604800
Date: Fri, 14 Jan 2022 05:41:05 GMT
Connection: keep-alive
Content-Length: 16078
Expires: Fri, 21 Jan 2022 05:41:05 GMT

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 88 KB
35 KB 81ms
41ms Script
application/javascript 2a00:1450:4001:809::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=DC-6268858

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_stage/Bootstrap.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

0a6b7bd0b381108f1dcd81aefbebbb670a56c7a885f043735be2c9479a68f332

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Fri, 14 Jan 2022 05:41:05 GMT
content-encoding: br
vary: Accept-Encoding
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 36250
x-xss-protection: 0
last-modified: Fri, 14 Jan 2022 03:00:00 GMT
server: Google Tag Manager
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Fri, 14 Jan 2022 05:41:05 GMT

GET
H2 204 e.gif
nexus.ensighten.com/error/ 0
106 B 16ms
16ms Image
text/plain 18.195.42.228
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://nexus.ensighten.com/error/e.gif?msg=%22ReferenceError%3A%20cookiepref%20is%20not%20defined%22%20error%20caught%20in%20Data%20Definition%20trigger%3A%20ccpa_cookiepref%2C%20ID%3A64079.%20Using%20bottom%20of%20body%20trigger.&lnn=-1&fn=&cid=1129&client=citi&publishPath=na_stage&rid=-1&did=-1&errorName=DataDefinitionException
Requested by: Host: sit58.online.citi.com
URL: https://sit58.online.citi.com/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 18.195.42.228 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-195-42-228.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Fri, 14 Jan 2022 05:41:05 GMT
cache-control: no-cache, no-store
server: nginx
expires: Fri, 14 Jan 2022 05:41:04 GMT

GET
H2 200 HP358_M1.jpg
sit58.online.citi.com/JRS/banners/modules/ 93 KB
94 KB 447ms
447ms Image
image/jpeg 104.70.85.47
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sit58.online.citi.com/JRS/banners/modules/HP358_M1.jpg
Requested by: Host: sit58.online.citi.com
URL: https://sit58.online.citi.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 104.70.85.47 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-70-85-47.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 3b937262381be3786c1ee9b1a8e59b0ac400f70f88d8cffb42d9ed75df8b18b5

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Fri, 14 Jan 2022 05:41:05 GMT
last-modified: Wed, 22 Apr 2020 19:06:32 GMT
x-akamai-citisite: GTDC
etag: "4fe58-17424-5a3e5d486de00"
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
x-robots-tag: noindex, nofollow
accept-ranges: bytes
content-type: image/jpeg
content-length: 95268

GET
H2 200 HP417_M.jpg
sit58.online.citi.com/JRS/banners/modules/ 92 KB
92 KB 447ms
447ms Image
image/jpeg 104.70.85.47
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sit58.online.citi.com/JRS/banners/modules/HP417_M.jpg
Requested by: Host: sit58.online.citi.com
URL: https://sit58.online.citi.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 104.70.85.47 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-70-85-47.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 52541e17b026b0a2a1edefe177cdd7597acf5ca74c519799809fe9f38402157b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Fri, 14 Jan 2022 05:41:05 GMT
last-modified: Wed, 22 Apr 2020 19:06:32 GMT
x-akamai-citisite: GTDC
etag: "4ff26-16f59-5a3e5d486de00"
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
x-robots-tag: noindex, nofollow
accept-ranges: bytes
content-type: image/jpeg
content-length: 94041

GET
H2 200 HP3443_M.jpg
sit58.online.citi.com/JRS/banners/modules/ 73 KB
73 KB 453ms
453ms Image
image/jpeg 104.70.85.47
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sit58.online.citi.com/JRS/banners/modules/HP3443_M.jpg
Requested by: Host: sit58.online.citi.com
URL: https://sit58.online.citi.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 104.70.85.47 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-70-85-47.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 83cc188d4995293f90c32fc37fbf1d9c749b7af5de6619e108cfe4e62753738d

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Fri, 14 Jan 2022 05:41:05 GMT
last-modified: Wed, 22 Apr 2020 19:06:32 GMT
x-akamai-citisite: GTDC
etag: "4fee6-123eb-5a3e5d486de00"
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
x-robots-tag: noindex, nofollow
accept-ranges: bytes
content-type: image/jpeg
content-length: 74731

GET
H2 204 e.gif
nexus.ensighten.com/error/ 0
106 B 16ms
16ms Image
text/plain 18.195.42.228
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://nexus.ensighten.com/error/e.gif?msg=%22ReferenceError%3A%20cookiepref%20is%20not%20defined%22%20error%20caught%20in%20Data%20Definition%20extractor%3A%20ccpa_cookiepref%2C%20ID%3A64079.&lnn=-1&fn=&cid=1129&client=citi&publishPath=na_stage&rid=2736057&did=562734&errorName=DataDefinitionException
Requested by: Host: sit58.online.citi.com
URL: https://sit58.online.citi.com/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 18.195.42.228 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-195-42-228.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Fri, 14 Jan 2022 05:41:05 GMT
cache-control: no-cache, no-store
server: nginx
expires: Fri, 14 Jan 2022 05:41:04 GMT

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 88 KB
35 KB 35ms
34ms Script
application/javascript 2a00:1450:4001:809::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=DC-6269322&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=DC-6260004

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

2b6efb6500fc71964aa36181a05af0f6ab1018fcb4ecddb7b657c112d1a9674d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Fri, 14 Jan 2022 05:41:05 GMT
content-encoding: br
vary: Accept-Encoding
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 36246
x-xss-protection: 0
last-modified: Fri, 14 Jan 2022 03:00:00 GMT
server: Google Tag Manager
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Fri, 14 Jan 2022 05:41:05 GMT

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 88 KB
36 KB 28ms
28ms Script
application/javascript 2a00:1450:4001:809::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=DC-6256710&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=DC-6260004

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

23e003b0d053963c54a24b5a4949c7ac2dee0337747b6cf3ccc3715d35508104

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Fri, 14 Jan 2022 05:41:05 GMT
content-encoding: br
vary: Accept-Encoding
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 36274
x-xss-protection: 0
last-modified: Fri, 14 Jan 2022 03:00:00 GMT
server: Google Tag Manager
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Fri, 14 Jan 2022 05:41:05 GMT

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 88 KB
35 KB 26ms
26ms Script
application/javascript 2a00:1450:4001:809::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=DC-6415812&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=DC-6260004

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

d19b04b1e2461a50b59769e8978cbbb8483b05d7dac2ae6cf590fca9544be990

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Fri, 14 Jan 2022 05:41:05 GMT
content-encoding: br
vary: Accept-Encoding
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 36245
x-xss-protection: 0
last-modified: Fri, 14 Jan 2022 03:00:00 GMT
server: Google Tag Manager
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Fri, 14 Jan 2022 05:41:05 GMT

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 88 KB
35 KB 37ms
36ms Script
application/javascript 2a00:1450:4001:809::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=DC-6268858&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=DC-6260004

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

5341f9e17a9893850169aa24e2a9171feff8734d87d92d6713c4a96bf269d7e7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Fri, 14 Jan 2022 05:41:05 GMT
content-encoding: br
vary: Accept-Encoding
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 36247
x-xss-protection: 0
last-modified: Fri, 14 Jan 2022 03:00:00 GMT
server: Google Tag Manager
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Fri, 14 Jan 2022 05:41:05 GMT

GET
H/1.1 200
OK dest5.html Show response
citi.demdex.net/ Frame 376A 7 KB
3 KB 157ms
38ms Document
text/html 34.250.180.190
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://citi.demdex.net/dest5.html?d_nsid=0

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_stage/Bootstrap.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

34.250.180.190 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-34-250-180-190.eu-west-1.compute.amazonaws.com

Software

Resource Hash

7bea17a80a61ed0f54248b4ffc4c718f7c8ff2619742577a73591d62ce074da8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: de-DE,de;q=0.9

Response headers

Accept-Ranges: bytes
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
content-encoding: gzip
Content-Type: text/html;charset=UTF-8
date: Fri, 14 Jan 2022 05:41:05 GMT
DCS: dcs-prod-irl1-2-v026-0a187fe98.edge-irl1.demdex.com UNKNOWN
Expires: Thu, 01 Jan 1970 00:00:00 UTC
last-modified: Mon, 20 Dec 2021 14:46:51 GMT
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
vary: accept-encoding
X-TID: DwKj55TgSJg=
transfer-encoding: chunked
Connection: keep-alive

GET
H2 200 id Show response
metrics1.citi.com/ 89 B
676 B 146ms
30ms XHR
application/x-javascript 15.236.176.210
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://metrics1.citi.com/id?d_visid_ver=3.1.2&d_fieldgroup=A&mcorgid=61834D9B5228A7430A490D45%40AdobeOrg&mid=58490552051940357000591880697583161207&ts=1642138865591

Requested by

Host: sit58.online.citi.com
URL: https://sit58.online.citi.com/cbol-pre-login-static-assets/polyfills-es2015.208e90726d88af943fd8.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

15.236.176.210 Paris, France, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-15-236-176-210.eu-west-3.compute.amazonaws.com

Software

jag /

Resource Hash

7d7a9f9308dca2b45bf80f8caa2a0db25c60a6f12b4eef322b570514fd515b89

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

date: Fri, 14 Jan 2022 05:41:05 GMT
x-content-type-options: nosniff
server: jag
xserver: anedge-cdfbd77b-bb2qn
vary: Origin
x-c: main-1585.I7afc85.M0-540
p3p: CP="This is not a P3P policy"
access-control-allow-origin: https://sit58.online.citi.com
cache-control: no-cache, no-store, max-age=0, no-transform, private
access-control-allow-credentials: true
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/x-javascript;charset=utf-8
content-length: 89
x-xss-protection: 1; mode=block

GET
H/1.1

200
OK

ibs:dpid=411&dpuuid=YeEM8QAAABcLvwP0
dpm.demdex.net/
Redirect Chain

https://cm.everesttech.net/cm/dd?d_uuid=63814934763556885350114087948227507924
https://dpm.demdex.net/ibs:dpid=411&dpuuid=YeEM8QAAABcLvwP0

42 B
945 B

44ms
44ms

Image
image/gif

34.249.190.190
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dpm.demdex.net/ibs:dpid=411&dpuuid=YeEM8QAAABcLvwP0

Requested by

Host: sit58.online.citi.com
URL: https://sit58.online.citi.com/

Protocol

HTTP/1.1

Server

34.249.190.190 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-34-249-190-190.eu-west-1.compute.amazonaws.com

Software

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

DCS: dcs-prod-irl1-2-v026-07b63819a.edge-irl1.demdex.com UNKNOWN
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
content-encoding: gzip
X-Content-Type-Options: nosniff
X-TID: NBsgriHtTa4=
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection: keep-alive
Content-Type: image/gif
Content-Length: 59
Expires: Thu, 01 Jan 1970 00:00:00 UTC

Redirect headers

Location: https://dpm.demdex.net/ibs:dpid=411&dpuuid=YeEM8QAAABcLvwP0
Date: Fri, 14 Jan 2022 05:41:05 GMT
Cache-Control: no-cache
Server: AMO-cookiemap/1.1
Connection: keep-alive
Content-Length: 0
P3P: CP="NOI NID DEVa PSAa PSDa OUR IND PUR COM NAV INT DEM"

GET
H2 200 528-Citibank_Illustrations_Article_01.jpg
sit58.online.citi.com/JRS/banners/modules/ 71 KB
71 KB 431ms
431ms Image
image/jpeg 104.70.85.47
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sit58.online.citi.com/JRS/banners/modules/528-Citibank_Illustrations_Article_01.jpg
Requested by: Host: sit58.online.citi.com
URL: https://sit58.online.citi.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 104.70.85.47 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-70-85-47.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 325a26c8139c8f943abdb7d23fc5bab7fb9b4444a0b2716f684b14babe4636ef

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Fri, 14 Jan 2022 05:41:06 GMT
last-modified: Tue, 03 Nov 2020 21:59:32 GMT
x-akamai-citisite: GTDC
etag: "4feab-11a05-5b33afa473900"
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
x-robots-tag: noindex, nofollow
accept-ranges: bytes
content-type: image/jpeg
content-length: 72197

GET
H2 200 ssrnewbase_en_US.json Show response
sit58.online.citi.com/CBOL/IA/Angular/Branding/preLoginBranding/ 38 KB
7 KB 424ms
423ms XHR
text/plain 104.70.85.47
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://sit58.online.citi.com/CBOL/IA/Angular/Branding/preLoginBranding/ssrnewbase_en_US.json
Requested by: Host: sit58.online.citi.com
URL: https://sit58.online.citi.com/cbol-pre-login-static-assets/polyfills-es2015.208e90726d88af943fd8.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 104.70.85.47 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-70-85-47.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 5181a421b3bfb613ccfee1ca7fd0001d6f1ad650a29f704004d01375d3aaeb06

Request headers

Accept: application/json, text/plain, */*
Referer
Accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Fri, 14 Jan 2022 05:41:06 GMT
content-encoding: gzip
content-type: text/plain
last-modified: Mon, 25 Oct 2021 04:24:58 GMT
x-akamai-citisite: GTDC
etag: "400c0-960d-5cf25be5c1a80"
vary: Accept-Encoding
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
cache-control: max-age=3600
accept-ranges: bytes
x-robots-tag: noindex, nofollow
content-length: 7033

GET
H2 200 newLogosSSR.json Show response
sit58.online.citi.com/CBOL/IA/Angular/Branding/ 9 KB
1 KB 427ms
426ms XHR
text/plain 104.70.85.47
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://sit58.online.citi.com/CBOL/IA/Angular/Branding/newLogosSSR.json
Requested by: Host: sit58.online.citi.com
URL: https://sit58.online.citi.com/cbol-pre-login-static-assets/polyfills-es2015.208e90726d88af943fd8.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 104.70.85.47 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-70-85-47.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: f51c273fe9f0605c9245e17ebcb6f0603dae22cdff498a28ff8cfe6850d453e8

Request headers

Accept: application/json, text/plain, */*
Referer
Accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Fri, 14 Jan 2022 05:41:06 GMT
content-encoding: gzip
content-type: text/plain
last-modified: Wed, 23 Jun 2021 18:56:14 GMT
x-akamai-citisite: GTDC
etag: "400b0-2461-5c57375ee0f80"
vary: Accept-Encoding
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
cache-control: max-age=3600
accept-ranges: bytes
x-robots-tag: noindex, nofollow
content-length: 1029

GET
H2 200 320_Citi-PLT@3x.png
sit58.online.citi.com/cbol-pre-login-static-assets/citi-branding-assets/images/ 11 KB
12 KB 248ms
247ms Image
image/png 104.70.85.47
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://sit58.online.citi.com/cbol-pre-login-static-assets/citi-branding-assets/images/320_Citi-PLT@3x.png

Requested by

Host: sit58.online.citi.com
URL: https://sit58.online.citi.com/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.70.85.47 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-70-85-47.deploy.static.akamaitechnologies.com

Software

nginx /

Resource Hash

f378974fe6a831ae2f48d9191ea74eb21877d4964d5eedbc2810d8756ed13631

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000 ; includeSubDomains, max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1 ; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

strict-transport-security: max-age=31536000 ; includeSubDomains, max-age=31536000
x-content-type-options: nosniff
dclocation: GT1DMSDEV1
content-length: 11562
x-xss-protection: 1 ; mode=block
referrer-policy: no-referrer
last-modified: Tue, 09 Nov 2021 16:22:58 GMT
server: nginx
x-akamai-citisite: GTDC
date: Fri, 14 Jan 2022 05:41:05 GMT
access-control-max-age: 2147483647
access-control-allow-methods: GET,PUT,POST,DELETE,HEAD
content-type: image/png
access-control-allow-origin
x-vcap-request-id: 33722806-57cc-4c79-611a-551777d2d81c
access-control-expose-headers: action,challengeType,bizToken,eventid,Eventid,Eventidexpirytime,eventidexpirytime,accesstoken,Authorization,sid,SessionId,CCPToken,CFIToken
cache-control: public, max-age=0
etag: W/"2d2a-17d05827ed0"
accept-ranges: bytes
x-robots-tag: noindex, nofollow
access-control-allow-headers: action,challengeType,accesstoken,appVersion,,Content-Type,sid,CCPToken,CFIToken,countryCode,businessCode,channelId,uuid,client_id,environmentId

GET
H2 200 1440_Citi-PLT@3x.png
sit58.online.citi.com/cbol-pre-login-static-assets/citi-branding-assets/images/ 27 KB
28 KB 361ms
360ms Image
image/png 104.70.85.47
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://sit58.online.citi.com/cbol-pre-login-static-assets/citi-branding-assets/images/1440_Citi-PLT@3x.png

Requested by

Host: sit58.online.citi.com
URL: https://sit58.online.citi.com/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.70.85.47 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-70-85-47.deploy.static.akamaitechnologies.com

Software

nginx /

Resource Hash

6dfa343a68ef79e83fef5f7c705119d2473352190c609cf94c67ea99a29fa452

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000 ; includeSubDomains, max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1 ; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

strict-transport-security: max-age=31536000 ; includeSubDomains, max-age=31536000
x-content-type-options: nosniff
dclocation: GT1DMSDEV1
content-length: 28149
x-xss-protection: 1 ; mode=block
referrer-policy: no-referrer
last-modified: Tue, 09 Nov 2021 16:22:58 GMT
server: nginx
x-akamai-citisite: GTDC
date: Fri, 14 Jan 2022 05:41:06 GMT
access-control-max-age: 2147483647
access-control-allow-methods: GET,PUT,POST,DELETE,HEAD
content-type: image/png
access-control-allow-origin
x-vcap-request-id: b2eefd2e-c6f1-46ad-60b0-d022944f5d74
access-control-expose-headers: action,challengeType,bizToken,eventid,Eventid,Eventidexpirytime,eventidexpirytime,accesstoken,Authorization,sid,SessionId,CCPToken,CFIToken
cache-control: public, max-age=0
etag: W/"6df5-17d05827ed0"
accept-ranges: bytes
x-robots-tag: noindex, nofollow
access-control-allow-headers: action,challengeType,accesstoken,appVersion,,Content-Type,sid,CCPToken,CFIToken,countryCode,businessCode,channelId,uuid,client_id,environmentId

GET
H/1.1 200
OK id Show response
dpm.demdex.net/ 363 B
1 KB 44ms
44ms XHR
application/json 34.249.190.190
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://dpm.demdex.net/id?d_visid_ver=3.1.2&d_fieldgroup=AAM&d_rtbd=json&d_ver=2&d_orgid=61834D9B5228A7430A490D45%40AdobeOrg&d_nsid=0&d_mid=58490552051940357000591880697583161207&d_blob=RKhpRz8krg2tLO6pguXWp5olkAcUniQYPHaMWWgdJ3xzPWQmdj0y&d_cid_ic=AVID%0130F0867884AA8EC3-40001F14933E172B&ts=1642138865770

Requested by

Host: sit58.online.citi.com
URL: https://sit58.online.citi.com/cbol-pre-login-static-assets/polyfills-es2015.208e90726d88af943fd8.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

34.249.190.190 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-34-249-190-190.eu-west-1.compute.amazonaws.com

Software

Resource Hash

235b98a2254def315c7e17bbb8bfa25c4e35be0da4297b8bf1808ea437f67400

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

DCS: dcs-prod-irl1-1-v026-0691d5f67.edge-irl1.demdex.com UNKNOWN
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
content-encoding: gzip
X-TID: CVCPSV1sTtM=
Vary: Origin
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Access-Control-Allow-Origin: https://sit58.online.citi.com
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/json;charset=utf-8
Content-Length: 306
Expires: Thu, 01 Jan 1970 00:00:00 UTC

GET
H2 200 Citi-Branding-Sprite.png
sit58.online.citi.com/cbol-pre-login-static-assets/citi-branding-assets/images/ 5 KB
6 KB 246ms
246ms Image
image/png 104.70.85.47
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://sit58.online.citi.com/cbol-pre-login-static-assets/citi-branding-assets/images/Citi-Branding-Sprite.png

Requested by

Host: sit58.online.citi.com
URL: https://sit58.online.citi.com/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.70.85.47 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-70-85-47.deploy.static.akamaitechnologies.com

Software

nginx /

Resource Hash

3fca3de24621f0f10186594054444d608016297c2e853e548710b3521e42a609

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000 ; includeSubDomains, max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1 ; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://sit58.online.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

strict-transport-security: max-age=31536000 ; includeSubDomains, max-age=31536000
x-content-type-options: nosniff
dclocation: GT1DMSDEV1
content-length: 4952
x-xss-protection: 1 ; mode=block
referrer-policy: no-referrer
last-modified: Tue, 09 Nov 2021 16:22:58 GMT
server: nginx
x-akamai-citisite: GTDC
date: Fri, 14 Jan 2022 05:41:05 GMT
access-control-max-age: 2147483647
access-control-allow-methods: GET,PUT,POST,DELETE,HEAD
content-type: image/png
access-control-allow-origin
x-vcap-request-id: e0ab2c8d-eea3-45cf-60c2-a54e534ff899
access-control-expose-headers: action,challengeType,bizToken,eventid,Eventid,Eventidexpirytime,eventidexpirytime,accesstoken,Authorization,sid,SessionId,CCPToken,CFIToken
cache-control: public, max-age=0
etag: W/"1358-17d05827ed0"
accept-ranges: bytes
x-robots-tag: noindex, nofollow
access-control-allow-headers: action,challengeType,accesstoken,appVersion,,Content-Type,sid,CCPToken,CFIToken,countryCode,businessCode,channelId,uuid,client_id,environmentId

GET
H2 200 Appstore-Googleplay-JDPower-Sprite.png
sit58.online.citi.com/cbol-pre-login-static-assets/citi-branding-assets/images/ 44 KB
45 KB 340ms
340ms Image
image/png 104.70.85.47
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://sit58.online.citi.com/cbol-pre-login-static-assets/citi-branding-assets/images/Appstore-Googleplay-JDPower-Sprite.png

Requested by

Host: sit58.online.citi.com
URL: https://sit58.online.citi.com/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.70.85.47 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-70-85-47.deploy.static.akamaitechnologies.com

Software

nginx /

Resource Hash

b8e446605f92c29a178dd6494688103ac268004592afe06643df46f4bff68577

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000 ; includeSubDomains, max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1 ; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://sit58.online.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

strict-transport-security: max-age=31536000 ; includeSubDomains, max-age=31536000
x-content-type-options: nosniff
dclocation: GT1DMSDEV1
content-length: 44996
x-xss-protection: 1 ; mode=block
referrer-policy: no-referrer
last-modified: Tue, 09 Nov 2021 16:22:58 GMT
server: nginx
x-akamai-citisite: GTDC
date: Fri, 14 Jan 2022 05:41:06 GMT
access-control-max-age: 2147483647
access-control-allow-methods: GET,PUT,POST,DELETE,HEAD
content-type: image/png
access-control-allow-origin
x-vcap-request-id: aee37e5b-34bf-425f-7843-68b93e095d3d
access-control-expose-headers: action,challengeType,bizToken,eventid,Eventid,Eventidexpirytime,eventidexpirytime,accesstoken,Authorization,sid,SessionId,CCPToken,CFIToken
cache-control: public, max-age=0
etag: W/"afc4-17d05827ed0"
accept-ranges: bytes
x-robots-tag: noindex, nofollow
access-control-allow-headers: action,challengeType,accesstoken,appVersion,,Content-Type,sid,CCPToken,CFIToken,countryCode,businessCode,channelId,uuid,client_id,environmentId

GET
H2 200 social-media_facebook@3x.png
sit58.online.citi.com/cbol-pre-login-static-assets/citi-branding-assets/images/ 445 B
1 KB 249ms
249ms Image
image/png 104.70.85.47
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://sit58.online.citi.com/cbol-pre-login-static-assets/citi-branding-assets/images/social-media_facebook@3x.png

Requested by

Host: sit58.online.citi.com
URL: https://sit58.online.citi.com/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.70.85.47 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-70-85-47.deploy.static.akamaitechnologies.com

Software

nginx /

Resource Hash

695788dc05d94be3b32060ffea15c1a4d74897bd32e5da7811e7ca76d82fc86b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000 ; includeSubDomains, max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1 ; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://sit58.online.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

strict-transport-security: max-age=31536000 ; includeSubDomains, max-age=31536000
x-content-type-options: nosniff
dclocation: GT1DMSDEV1
content-length: 445
x-xss-protection: 1 ; mode=block
referrer-policy: no-referrer
last-modified: Tue, 09 Nov 2021 16:22:58 GMT
server: nginx
x-akamai-citisite: GTDC
date: Fri, 14 Jan 2022 05:41:05 GMT
access-control-max-age: 2147483647
access-control-allow-methods: GET,PUT,POST,DELETE,HEAD
content-type: image/png
access-control-allow-origin
x-vcap-request-id: d326f10e-c210-451f-4327-a55a6c743574
access-control-expose-headers: action,challengeType,bizToken,eventid,Eventid,Eventidexpirytime,eventidexpirytime,accesstoken,Authorization,sid,SessionId,CCPToken,CFIToken
cache-control: public, max-age=0
etag: W/"1bd-17d05827ed0"
accept-ranges: bytes
x-robots-tag: noindex, nofollow
access-control-allow-headers: action,challengeType,accesstoken,appVersion,,Content-Type,sid,CCPToken,CFIToken,countryCode,businessCode,channelId,uuid,client_id,environmentId

GET
H2 200 social-media_twitter@3x.png
sit58.online.citi.com/cbol-pre-login-static-assets/citi-branding-assets/images/ 1 KB
2 KB 250ms
250ms Image
image/png 104.70.85.47
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://sit58.online.citi.com/cbol-pre-login-static-assets/citi-branding-assets/images/social-media_twitter@3x.png

Requested by

Host: sit58.online.citi.com
URL: https://sit58.online.citi.com/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.70.85.47 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-70-85-47.deploy.static.akamaitechnologies.com

Software

nginx /

Resource Hash

5394d11ec8ad7a5494bcdb65cd95f885388532e14fb45a747e249112389bd837

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000 ; includeSubDomains, max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1 ; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://sit58.online.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

strict-transport-security: max-age=31536000 ; includeSubDomains, max-age=31536000
x-content-type-options: nosniff
dclocation: GT1DMSDEV1
content-length: 1277
x-xss-protection: 1 ; mode=block
referrer-policy: no-referrer
last-modified: Tue, 09 Nov 2021 16:22:58 GMT
server: nginx
x-akamai-citisite: GTDC
date: Fri, 14 Jan 2022 05:41:06 GMT
access-control-max-age: 2147483647
access-control-allow-methods: GET,PUT,POST,DELETE,HEAD
content-type: image/png
access-control-allow-origin
x-vcap-request-id: c3c93fe2-3c4f-4336-6a71-8cf48b8b1f6a
access-control-expose-headers: action,challengeType,bizToken,eventid,Eventid,Eventidexpirytime,eventidexpirytime,accesstoken,Authorization,sid,SessionId,CCPToken,CFIToken
cache-control: public, max-age=0
etag: W/"4fd-17d05827ed0"
accept-ranges: bytes
x-robots-tag: noindex, nofollow
access-control-allow-headers: action,challengeType,accesstoken,appVersion,,Content-Type,sid,CCPToken,CFIToken,countryCode,businessCode,channelId,uuid,client_id,environmentId

GET
H2 200 social-media_youtube@3x.png
sit58.online.citi.com/cbol-pre-login-static-assets/citi-branding-assets/images/ 1 KB
2 KB 249ms
249ms Image
image/png 104.70.85.47
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://sit58.online.citi.com/cbol-pre-login-static-assets/citi-branding-assets/images/social-media_youtube@3x.png

Requested by

Host: sit58.online.citi.com
URL: https://sit58.online.citi.com/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.70.85.47 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-70-85-47.deploy.static.akamaitechnologies.com

Software

nginx /

Resource Hash

be9b5382b4526ffd3306d0292122ce3599123f1cd543f52f3035b4f24fbf9de8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000 ; includeSubDomains, max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1 ; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://sit58.online.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

strict-transport-security: max-age=31536000 ; includeSubDomains, max-age=31536000
x-content-type-options: nosniff
dclocation: GT1DMSDEV1
content-length: 1175
x-xss-protection: 1 ; mode=block
referrer-policy: no-referrer
last-modified: Tue, 09 Nov 2021 16:22:58 GMT
server: nginx
x-akamai-citisite: GTDC
date: Fri, 14 Jan 2022 05:41:06 GMT
access-control-max-age: 2147483647
access-control-allow-methods: GET,PUT,POST,DELETE,HEAD
content-type: image/png
access-control-allow-origin
x-vcap-request-id: b46e77a3-c9d6-46da-7e2c-3282b0884892
access-control-expose-headers: action,challengeType,bizToken,eventid,Eventid,Eventidexpirytime,eventidexpirytime,accesstoken,Authorization,sid,SessionId,CCPToken,CFIToken
cache-control: public, max-age=0
etag: W/"497-17d05827ed0"
accept-ranges: bytes
x-robots-tag: noindex, nofollow
access-control-allow-headers: action,challengeType,accesstoken,appVersion,,Content-Type,sid,CCPToken,CFIToken,countryCode,businessCode,channelId,uuid,client_id,environmentId

GET
H2 200 HP5904_M.jpg
sit58.online.citi.com/JRS/banners/modules/ 98 KB
99 KB 419ms
419ms Image
image/jpeg 104.70.85.47
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sit58.online.citi.com/JRS/banners/modules/HP5904_M.jpg
Requested by: Host: sit58.online.citi.com
URL: https://sit58.online.citi.com/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 104.70.85.47 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-70-85-47.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 4999a8bcfc1f9fd95a0c4e42cfbac1abdf5a6c9e26734abbe4bc157b8c2b49ab

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Fri, 14 Jan 2022 05:41:06 GMT
last-modified: Wed, 22 Apr 2020 19:06:32 GMT
x-akamai-citisite: GTDC
etag: "4fe6f-18939-5a3e5d486de00"
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
x-robots-tag: noindex, nofollow
accept-ranges: bytes
content-type: image/jpeg
content-length: 100665

GET
BLOB 200
OK 8ec835b2-96b6-4f18-bcf4-992c618b7985
https://sit58.online.citi.com/ 161 KB
0 Other
text/plain

General

Check archive.org

Show headers Download Go to

Full URL: blob:https://sit58.online.citi.com/8ec835b2-96b6-4f18-bcf4-992c618b7985
Requested by: Host: sit58.online.citi.com
URL: https://sit58.online.citi.com/
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: c8bc330a07fc8ba4ead1f924570b2eeb220dfb170e86ea6594f7a2daef2efc16

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Content-Length: 165178

GET
H2 200 Interstate-Bold.woff
sit58.online.citi.com/cbol-pre-login-static-assets/cds-assets/fonts/interstate/ 70 KB
71 KB 344ms
344ms Font
font/woff 104.70.85.47
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://sit58.online.citi.com/cbol-pre-login-static-assets/cds-assets/fonts/interstate/Interstate-Bold.woff

Requested by

Host: sit58.online.citi.com
URL: https://sit58.online.citi.com/cbol-pre-login-static-assets/styles.187a58a1499ec83981b8.css

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.70.85.47 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-70-85-47.deploy.static.akamaitechnologies.com

Software

nginx /

Resource Hash

e9e9a67395a0d83b584208a19b95af203df8e8e6c6952fe76c690d60ea9381c7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000 ; includeSubDomains, max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1 ; mode=block

Request headers

Referer
Origin: https://sit58.online.citi.com
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

sid: 00add49a-e198-4428-8a18-3748dd1c02a5
x-content-type-options: nosniff
nonce: 9454843424008371
access-control-max-age: 2147483647
dclocation: GT1DMSDEV1
content-length: 71874
x-xss-protection: 1 ; mode=block
uuid: a0f2c4fe-60a2-436c-8b20-69212c77ce0a
accept-ranges: bytes
referrer-policy: no-referrer
last-modified: Tue, 09 Nov 2021 16:22:58 GMT
server: nginx
x-akamai-citisite: GTDC
date: Fri, 14 Jan 2022 05:41:06 GMT
strict-transport-security: max-age=31536000 ; includeSubDomains, max-age=31536000
access-control-allow-methods: GET,PUT,POST,DELETE,HEAD
content-type: font/woff
access-control-allow-origin: https://sit58.online.citi.com
x-vcap-request-id: 627123cf-e9ca-4aaa-5415-4d8232bc9158
access-control-expose-headers: action,challengeType,bizToken,eventid,Eventid,Eventidexpirytime,eventidexpirytime,accesstoken,Authorization,sid,SessionId,CCPToken,CFIToken
cache-control: public, max-age=0
etag: W/"118c2-17d05827ed0"
scope: VISITOR
x-robots-tag: noindex, nofollow
access-control-allow-headers: action,challengeType,accesstoken,appVersion,,Content-Type,sid,CCPToken,CFIToken,countryCode,businessCode,channelId,uuid,client_id,environmentId

GET
H/1.1 200
OK citilogoredesign.png
www.citi.com/cbol-pre-login-static-assets/citi-branding-assets/images/ 2 KB
3 KB 94ms
24ms Image
image/png 104.117.204.150
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.citi.com/cbol-pre-login-static-assets/citi-branding-assets/images/citilogoredesign.png

Requested by

Host: sit58.online.citi.com
URL: https://sit58.online.citi.com/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.117.204.150 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-117-204-150.deploy.static.akamaitechnologies.com

Software

nginx /

Resource Hash

102503acef6077fcf8e42a856fb4904fcd74224a32d5d8efcd13236ac6309fed

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000 ; includeSubDomains, max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Strict-Transport-Security: max-age=31536000 ; includeSubDomains, max-age=31536000; includeSubDomains
X-Content-Type-Options: nosniff
Connection: keep-alive
Content-Length: 1799
X-Xss-Protection: 1; mode=block
Last-Modified: Sun, 14 Nov 2021 08:29:44 GMT
Server: nginx
X-Akamai-CITISITE: GTDC
X-Frame-Options: DENY
Date: Fri, 14 Jan 2022 05:41:06 GMT
Access-Control-Max-Age: 2147483647
Access-Control-Allow-Methods: GET,PUT,POST,DELETE,HEAD
Content-Type: image/png
Access-Control-Allow-Origin: https://citimobile.citibankonline.com
X-Vcap-Request-Id: 04ddeb67-8143-4e27-4d37-721b42f0568b
Access-Control-Expose-Headers: action,challengeType,bizToken,eventid,Eventid,Eventidexpirytime,eventidexpirytime,accesstoken,Authorization,sid,SessionId,CCPToken,CFIToken
Cache-Control: public, no-transform, max-age=21600
Access-Control-Allow-Credentials: true
ETag: W/"707-17d1d9108c0"
Accept-Ranges: bytes
Access-Control-Allow-Headers: action,challengeType,accesstoken,appVersion,,Content-Type,sid,CCPToken,CFIToken,countryCode,businessCode,channelId,uuid,client_id,environmentId
Expires: Fri, 14 Jan 2022 11:41:06 GMT

GET
H/1.1 200
OK 050-location@2x.svg
www.citi.com/cbol-pre-login-static-assets/citi-branding-assets/images/ 2 KB
2 KB 95ms
23ms Image
image/svg+xml 104.117.204.150
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.citi.com/cbol-pre-login-static-assets/citi-branding-assets/images/050-location@2x.svg

Requested by

Host: sit58.online.citi.com
URL: https://sit58.online.citi.com/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.117.204.150 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-117-204-150.deploy.static.akamaitechnologies.com

Software

nginx /

Resource Hash

6336ae7b60dff18e0a37721a3a19fd5e18568577a64faa662969d35966dbf72b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000 ; includeSubDomains, max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Sid: 8f20b42a-13cb-4d41-a158-7e170635e012
Content-Encoding: gzip
ETag: W/"6d8-17d1d9108c0"
Nonce: 2364975921233978
Access-Control-Max-Age: 2147483647
Access-Control-Allow-Methods: GET,PUT,POST,DELETE,HEAD
Connection: keep-alive
Content-Length: 758
X-Xss-Protection: 1; mode=block
Uuid: 3147dfbb-30d7-40cf-87bb-95be1141789a
Last-Modified: Sun, 14 Nov 2021 08:29:44 GMT
Server: nginx
Cache-Control: public, no-transform, max-age=21600
X-Akamai-CITISITE: GTDC
X-Frame-Options: DENY
Date: Fri, 14 Jan 2022 05:41:06 GMT
Vary: Accept-Encoding
Strict-Transport-Security: max-age=31536000 ; includeSubDomains, max-age=31536000; includeSubDomains
Content-Type: image/svg+xml
Access-Control-Allow-Origin: https://citimobile.citibankonline.com
X-Vcap-Request-Id: b43c9a73-c5d6-4a17-43a2-b16ffd3826ae
Access-Control-Expose-Headers: action,challengeType,bizToken,eventid,Eventid,Eventidexpirytime,eventidexpirytime,accesstoken,Authorization,sid,SessionId,CCPToken,CFIToken
Scope: VISITOR
Access-Control-Allow-Credentials: true
Accept-Ranges: bytes
Access-Control-Allow-Headers: action,challengeType,accesstoken,appVersion,,Content-Type,sid,CCPToken,CFIToken,countryCode,businessCode,channelId,uuid,client_id,environmentId
X-Content-Type-Options: nosniff
Dclocation: GT1DMS
Expires: Fri, 14 Jan 2022 11:41:06 GMT

GET
H/1.1 200
OK icon_globe_med-grey@2x.svg
www.citi.com/cbol-pre-login-static-assets/citi-branding-assets/images/ 3 KB
3 KB 95ms
24ms Image
image/svg+xml 104.117.204.150
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.citi.com/cbol-pre-login-static-assets/citi-branding-assets/images/icon_globe_med-grey@2x.svg

Requested by

Host: sit58.online.citi.com
URL: https://sit58.online.citi.com/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.117.204.150 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-117-204-150.deploy.static.akamaitechnologies.com

Software

nginx /

Resource Hash

a593628f2d5ba814f37fbcd3963162f094c2764d4b15d82464c2d1aef92f150f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000 ; includeSubDomains, max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

Sid: 2588edbf-4134-4972-9591-63781aaa6019
Content-Encoding: gzip
ETag: W/"dc3-17d1d9108c0"
Nonce: 5840660591535589
Access-Control-Max-Age: 2147483647
Access-Control-Allow-Methods: GET,PUT,POST,DELETE,HEAD
Connection: keep-alive
Content-Length: 1419
X-Xss-Protection: 1; mode=block
Uuid: 5c9a6a8f-d907-4cdd-8660-5dbf96092187
Last-Modified: Sun, 14 Nov 2021 08:29:44 GMT
Server: nginx
Cache-Control: public, no-transform, max-age=21600
X-Akamai-CITISITE: GTDC
X-Frame-Options: DENY
Date: Fri, 14 Jan 2022 05:41:06 GMT
Vary: Accept-Encoding
Strict-Transport-Security: max-age=31536000 ; includeSubDomains, max-age=31536000; includeSubDomains
Content-Type: image/svg+xml
Access-Control-Allow-Origin: https://citimobile.citibankonline.com
X-Vcap-Request-Id: 7753f5e7-713d-4f8c-708a-4879355494f0
Access-Control-Expose-Headers: action,challengeType,bizToken,eventid,Eventid,Eventidexpirytime,eventidexpirytime,accesstoken,Authorization,sid,SessionId,CCPToken,CFIToken
Scope: VISITOR
Access-Control-Allow-Credentials: true
Accept-Ranges: bytes
Access-Control-Allow-Headers: action,challengeType,accesstoken,appVersion,,Content-Type,sid,CCPToken,CFIToken,countryCode,businessCode,channelId,uuid,client_id,environmentId
X-Content-Type-Options: nosniff
Dclocation: GT1DMS
Expires: Fri, 14 Jan 2022 11:41:06 GMT

POST metrics
sit58.online.citi.com/gcgapi/dev1/public/v1/digital/reporting/ 0
0

GET
H/1.1 200
OK cr.png Show response
contents3.00110.citi.com/api/v1/ 4 B
350 B 537ms
135ms XHR
application/json 52.141.218.213
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://contents3.00110.citi.com/api/v1/cr.png?cid=cedrictest&snum=1642138866442-sjn0000627-de095864-9e0a-464e-bbd2-fd0cf0322b46&muid=1642138865927-E530FDE6-3809-45FE-B755-FC26795F3F64
Requested by: Host: sit58.online.citi.com
URL: https://sit58.online.citi.com/cbol-pre-login-static-assets/polyfills-es2015.208e90726d88af943fd8.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.141.218.213 Des Moines, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: nginx /
Resource Hash: 74234e98afe7498fb5daf1f36ac2d78acc339464f950703b8c019892f982b90b

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
Date: Fri, 14 Jan 2022 05:41:07 GMT
Server: nginx
tail-id: 72229619-609c-4ed9-a261-8bf13d960c1d
Content-Type: application/json
access-control-allow-origin: https://sit58.online.citi.com
cache-control: no-cache, no-store
access-control-allow-credentials: true
Connection: keep-alive
Content-Length: 4

GET
H2 200 qrsignon.js Show response
sit58.online.citi.com/cbol-pre-login-static-assets/assets/qrcode/js/ 6 KB
3 KB 197ms
197ms Script
application/javascript 104.70.85.47
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://sit58.online.citi.com/cbol-pre-login-static-assets/assets/qrcode/js/qrsignon.js

Requested by

Host: sit58.online.citi.com
URL: https://sit58.online.citi.com/cbol-pre-login-static-assets/main-es2015.926484ba20d93e7ff0df.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.70.85.47 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-70-85-47.deploy.static.akamaitechnologies.com

Software

nginx /

Resource Hash

463364c237ac33fd5ce60338742b888edad01bfa59b7271db12210071fc41c6a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000 ; includeSubDomains, max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1 ; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

strict-transport-security: max-age=31536000 ; includeSubDomains, max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
dclocation: GT1DMSDEV1
vary: Accept-Encoding
content-length: 2139
x-xss-protection: 1 ; mode=block
referrer-policy: no-referrer
last-modified: Tue, 09 Nov 2021 16:22:58 GMT
server: nginx
x-akamai-citisite: GTDC
date: Fri, 14 Jan 2022 05:41:07 GMT
access-control-max-age: 2147483647
access-control-allow-methods: GET,PUT,POST,DELETE,HEAD
content-type: application/javascript; charset=UTF-8
access-control-allow-origin
x-vcap-request-id: 84d0cda2-34b5-4829-6353-19c213138b1a
access-control-expose-headers: action,challengeType,bizToken,eventid,Eventid,Eventidexpirytime,eventidexpirytime,accesstoken,Authorization,sid,SessionId,CCPToken,CFIToken
cache-control: public, max-age=0
etag: W/"1926-17d05827ed0"
accept-ranges: bytes
x-robots-tag: noindex, nofollow
access-control-allow-headers: action,challengeType,accesstoken,appVersion,,Content-Type,sid,CCPToken,CFIToken,countryCode,businessCode,channelId,uuid,client_id,environmentId

GET
H2 200 tc.min.js Show response
c1.rfihub.net/js/ 19 KB
6 KB 71ms
15ms Script
application/x-javascript 2600:9000:2156:be00:1:76cf:fe80:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c1.rfihub.net/js/tc.min.js
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_stage/code/30785cec0af3ef7e9061f666b2b0f15f.js?conditionId0=4897099
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2156:be00:1:76cf:fe80:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: Jetty(9.3.29.v20201019) /
Resource Hash: 7ef97b12890fc6fee67f869c6e1f74b6719de7d66ac0d649c8d7386a80b4c30f

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Fri, 14 Jan 2022 04:51:01 GMT
content-encoding: gzip
last-modified: Fri, 14 Jan 2022 04:50:51 GMT
server: Jetty(9.3.29.v20201019)
age: 3006
x-cache: Hit from cloudfront
p3p: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
via: 1.1 6b8ac2d6d64dc42007741d312e2d73aa.cloudfront.net (CloudFront)
cache-control: public, max-age=3600
x-amz-cf-pop: FRA50-C1
content-type: application/x-javascript
content-length: 6162
x-amz-cf-id: FkMkSMOIiRiHo0aatXXWmRxk60H6nz6UYopl9T_LKrOzjGCrqfio_Q==
expires: Fri, 14 Jan 2022 05:51:01 GMT

GET
H2 200 s9121851773451
metrics1.citi.com/b/ss/citinadev/1/JS-2.0.0/ 43 B
367 B 31ms
30ms Image
image/gif 15.236.176.210
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://metrics1.citi.com/b/ss/citinadev/1/JS-2.0.0/s9121851773451?AQB=1&ndh=1&pf=1&t=14%2F0%2F2022%205%3A41%3A7%205%200&fid=44E3A4F95E66EA3C-3959C123F4D76892&ce=UTF-8&g=https%3A%2F%2Fsit58.online.citi.com%2F&c.&visitStart=1&.c&cc=USD&c25=%5BCS%5Dv1%7C30F0867884AA8EC3-40001F14933E172B%5BCE%5D&c61=60&c63=https%3A%2F%2Fsit58.online.citi.com%2F&c64=12%3A41AM&v64=12%3A41AM&c65=Friday&v65=Friday&c66=Friday%7C12%3A41AM&v67=New&v68=1&s=1600x1200&c=24&j=1.6&v=N&k=Y&bw=1600&bh=1200&AQE=1

Requested by

Host: sit58.online.citi.com
URL: https://sit58.online.citi.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

15.236.176.210 Paris, France, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-15-236-176-210.eu-west-3.compute.amazonaws.com

Software

jag /

Resource Hash

a1ecbaed793a1f564c49c671f2dd0ce36f858534ef6d26b55783a06b884cc506

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Fri, 14 Jan 2022 05:41:07 GMT
x-content-type-options: nosniff
x-c: main-1585.I7afc85.M0-540
p3p: CP="This is not a P3P policy"
vary: *
content-length: 43
x-xss-protection: 1; mode=block
pragma: no-cache
last-modified: Sat, 15 Jan 2022 05:41:07 GMT
server: jag
xserver: anedge-cdfbd77b-bwcpn
etag: 3526466366489919488-4619681336595457652
strict-transport-security: max-age=31536000; includeSubDomains
content-type: image/gif;charset=utf-8
access-control-allow-origin: *
cache-control: no-cache, no-store, max-age=0, no-transform, private
expires: Thu, 13 Jan 2022 05:41:07 GMT

GET
H/1.1 200
OK ca.html Show response
20766699p.rfihub.com/ Frame A310 118 B
704 B 138ms
29ms Document
text/html 193.0.160.129
ROCKETFUEL

General

Check archive.org

Show headers Download Go to

Full URL: https://20766699p.rfihub.com/ca.html?ver=9&ra=477&rb=648&ca=20766699&_o=17169175&_t=noncookiedusernamepassword&ssv_cuuid=&ssv_package=null&ssv_prodlist=null&ssv_pagename=noncookiedusernamepassword&pe=https%3A%2F%2Fsit58.online.citi.com%2F&pf=&ra=828215863033102
Requested by: Host: c1.rfihub.net
URL: https://c1.rfihub.net/js/tc.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_256_CBC
Server: 193.0.160.129 , United States, ASN54312 (ROCKETFUEL, US),
Reverse DNS
Software: Jetty(9.3.29.v20201019) /
Resource Hash: c437eb764a99e6cd5172d63c3fae564bbc51eda4981058d5edebd2bf0700eb76

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: de-DE,de;q=0.9

Response headers

Date: Fri, 14 Jan 2022 05:41:07 GMT
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Cache-Control: no-cache
Content-Type: text/html;charset=utf-8
Content-Length: 118
Server: Jetty(9.3.29.v20201019)

GET
H2 200 config.js Show response
sit58.online.citi.com/CBOL/taggingTransformation/ 0
331 B 156ms
156ms Script
application/x-javascript 104.70.85.47
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://sit58.online.citi.com/CBOL/taggingTransformation/config.js
Requested by: Host: sit58.online.citi.com
URL: https://sit58.online.citi.com/cbol-pre-login-static-assets/main-es2015.926484ba20d93e7ff0df.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 104.70.85.47 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-70-85-47.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Fri, 14 Jan 2022 05:41:07 GMT
content-encoding: gzip
content-type: application/x-javascript
last-modified: Wed, 22 Apr 2020 19:06:30 GMT
x-akamai-citisite: GTDC
etag: "5d8d7-0-5a3e5d4685980"
vary: Accept-Encoding
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
cache-control: max-age=21600
accept-ranges: bytes
x-robots-tag: noindex, nofollow
content-length: 20
expires: Fri, 14 Jan 2022 11:41:07 GMT

GET
H2 200 phone.png
sit58.online.citi.com/cbol-pre-login-static-assets/assets/qrcode/images/ 10 KB
10 KB 228ms
226ms Image
image/png 104.70.85.47
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://sit58.online.citi.com/cbol-pre-login-static-assets/assets/qrcode/images/phone.png

Requested by

Host: sit58.online.citi.com
URL: https://sit58.online.citi.com/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.70.85.47 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-70-85-47.deploy.static.akamaitechnologies.com

Software

nginx /

Resource Hash

5df469ee4da2bc124065cb8df0e24173c5cbc8b9e0c807960fc39c93ffb640c8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000 ; includeSubDomains, max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1 ; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

strict-transport-security: max-age=31536000 ; includeSubDomains, max-age=31536000
x-content-type-options: nosniff
dclocation: GT1DMSDEV1
content-length: 9873
x-xss-protection: 1 ; mode=block
referrer-policy: no-referrer
last-modified: Tue, 09 Nov 2021 16:22:58 GMT
server: nginx
x-akamai-citisite: GTDC
date: Fri, 14 Jan 2022 05:41:07 GMT
access-control-max-age: 2147483647
access-control-allow-methods: GET,PUT,POST,DELETE,HEAD
content-type: image/png
access-control-allow-origin
x-vcap-request-id: 5dd23efc-a5f1-4fea-7b68-90ff929a1c50
access-control-expose-headers: action,challengeType,bizToken,eventid,Eventid,Eventidexpirytime,eventidexpirytime,accesstoken,Authorization,sid,SessionId,CCPToken,CFIToken
cache-control: public, max-age=0
etag: W/"2691-17d05827ed0"
accept-ranges: bytes
x-robots-tag: noindex, nofollow
access-control-allow-headers: action,challengeType,accesstoken,appVersion,,Content-Type,sid,CCPToken,CFIToken,countryCode,businessCode,channelId,uuid,client_id,environmentId

GET
H2 200 qrsignon.png
sit58.online.citi.com/cbol-pre-login-static-assets/assets/qrcode/images/ 741 B
1 KB 234ms
232ms Image
image/png 104.70.85.47
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://sit58.online.citi.com/cbol-pre-login-static-assets/assets/qrcode/images/qrsignon.png

Requested by

Host: sit58.online.citi.com
URL: https://sit58.online.citi.com/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.70.85.47 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-70-85-47.deploy.static.akamaitechnologies.com

Software

nginx /

Resource Hash

dc876f814074650acde84db7a7f34c583f043b83130e5de49de65f18d1ee2683

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000 ; includeSubDomains, max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1 ; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

strict-transport-security: max-age=31536000 ; includeSubDomains, max-age=31536000
x-content-type-options: nosniff
dclocation: GT1DMSDEV1
content-length: 741
x-xss-protection: 1 ; mode=block
referrer-policy: no-referrer
last-modified: Tue, 09 Nov 2021 16:22:58 GMT
server: nginx
x-akamai-citisite: GTDC
date: Fri, 14 Jan 2022 05:41:07 GMT
access-control-max-age: 2147483647
access-control-allow-methods: GET,PUT,POST,DELETE,HEAD
content-type: image/png
access-control-allow-origin
x-vcap-request-id: 1b098fd7-76c4-4b56-67dc-8bd9807b1af5
access-control-expose-headers: action,challengeType,bizToken,eventid,Eventid,Eventidexpirytime,eventidexpirytime,accesstoken,Authorization,sid,SessionId,CCPToken,CFIToken
cache-control: public, max-age=0
etag: W/"2e5-17d05827ed0"
accept-ranges: bytes
x-robots-tag: noindex, nofollow
access-control-allow-headers: action,challengeType,accesstoken,appVersion,,Content-Type,sid,CCPToken,CFIToken,countryCode,businessCode,channelId,uuid,client_id,environmentId

GET
H2 200 laptop-and-phone-pairing.png
sit58.online.citi.com/cbol-pre-login-static-assets/assets/qrcode/images/ 17 KB
18 KB 351ms
350ms Image
image/png 104.70.85.47
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://sit58.online.citi.com/cbol-pre-login-static-assets/assets/qrcode/images/laptop-and-phone-pairing.png

Requested by

Host: sit58.online.citi.com
URL: https://sit58.online.citi.com/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.70.85.47 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-70-85-47.deploy.static.akamaitechnologies.com

Software

nginx /

Resource Hash

ff5150ab5741a5c8345bc7861cb1cab8f574fe17f2cdb2fbc2058311f3d65817

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000 ; includeSubDomains, max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1 ; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

strict-transport-security: max-age=31536000 ; includeSubDomains, max-age=31536000
x-content-type-options: nosniff
dclocation: GT1DMSDEV1
content-length: 17241
x-xss-protection: 1 ; mode=block
referrer-policy: no-referrer
last-modified: Tue, 09 Nov 2021 16:22:58 GMT
server: nginx
x-akamai-citisite: GTDC
date: Fri, 14 Jan 2022 05:41:07 GMT
access-control-max-age: 2147483647
access-control-allow-methods: GET,PUT,POST,DELETE,HEAD
content-type: image/png
access-control-allow-origin
x-vcap-request-id: edf603a2-6e3d-472e-5663-da5c6ed0621d
access-control-expose-headers: action,challengeType,bizToken,eventid,Eventid,Eventidexpirytime,eventidexpirytime,accesstoken,Authorization,sid,SessionId,CCPToken,CFIToken
cache-control: public, max-age=0
etag: W/"4359-17d05827ed0"
accept-ranges: bytes
x-robots-tag: noindex, nofollow
access-control-allow-headers: action,challengeType,accesstoken,appVersion,,Content-Type,sid,CCPToken,CFIToken,countryCode,businessCode,channelId,uuid,client_id,environmentId

GET
H2 200 laptop-and-phone-success.png
sit58.online.citi.com/cbol-pre-login-static-assets/assets/qrcode/images/ 13 KB
14 KB 366ms
365ms Image
image/png 104.70.85.47
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://sit58.online.citi.com/cbol-pre-login-static-assets/assets/qrcode/images/laptop-and-phone-success.png

Requested by

Host: sit58.online.citi.com
URL: https://sit58.online.citi.com/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.70.85.47 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-70-85-47.deploy.static.akamaitechnologies.com

Software

nginx /

Resource Hash

bb1fdd5be17ce6cbeb21411a9ba10b99f11bbe232a93b34bec7c4722d763bf52

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000 ; includeSubDomains, max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1 ; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

strict-transport-security: max-age=31536000 ; includeSubDomains, max-age=31536000
x-content-type-options: nosniff
dclocation: GT1DMSDEV1
content-length: 13305
x-xss-protection: 1 ; mode=block
referrer-policy: no-referrer
last-modified: Tue, 09 Nov 2021 16:22:58 GMT
server: nginx
x-akamai-citisite: GTDC
date: Fri, 14 Jan 2022 05:41:07 GMT
access-control-max-age: 2147483647
access-control-allow-methods: GET,PUT,POST,DELETE,HEAD
content-type: image/png
access-control-allow-origin
x-vcap-request-id: 485bddde-4929-4559-5459-394e74ccec9e
access-control-expose-headers: action,challengeType,bizToken,eventid,Eventid,Eventidexpirytime,eventidexpirytime,accesstoken,Authorization,sid,SessionId,CCPToken,CFIToken
cache-control: public, max-age=0
etag: W/"33f9-17d05827ed0"
accept-ranges: bytes
x-robots-tag: noindex, nofollow
access-control-allow-headers: action,challengeType,accesstoken,appVersion,,Content-Type,sid,CCPToken,CFIToken,countryCode,businessCode,channelId,uuid,client_id,environmentId

GET
H2 200 qrsignon-b.png
sit58.online.citi.com/cbol-pre-login-static-assets/assets/qrcode/images/ 462 B
1 KB 227ms
227ms Image
image/png 104.70.85.47
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://sit58.online.citi.com/cbol-pre-login-static-assets/assets/qrcode/images/qrsignon-b.png

Requested by

Host: sit58.online.citi.com
URL: https://sit58.online.citi.com/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.70.85.47 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-70-85-47.deploy.static.akamaitechnologies.com

Software

nginx /

Resource Hash

ddec013d5b71070fbeec6a1d0616c67b5c1931baf6c56f5b0dbbefb1e6e9728a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000 ; includeSubDomains, max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1 ; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://sit58.online.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

strict-transport-security: max-age=31536000 ; includeSubDomains, max-age=31536000
x-content-type-options: nosniff
dclocation: GT1DMSDEV1
content-length: 462
x-xss-protection: 1 ; mode=block
referrer-policy: no-referrer
last-modified: Tue, 09 Nov 2021 16:22:58 GMT
server: nginx
x-akamai-citisite: GTDC
date: Fri, 14 Jan 2022 05:41:07 GMT
access-control-max-age: 2147483647
access-control-allow-methods: GET,PUT,POST,DELETE,HEAD
content-type: image/png
access-control-allow-origin
x-vcap-request-id: c2c12d81-4c48-4eac-5a9f-f88d47018040
access-control-expose-headers: action,challengeType,bizToken,eventid,Eventid,Eventidexpirytime,eventidexpirytime,accesstoken,Authorization,sid,SessionId,CCPToken,CFIToken
cache-control: public, max-age=0
etag: W/"1ce-17d05827ed0"
accept-ranges: bytes
x-robots-tag: noindex, nofollow
access-control-allow-headers: action,challengeType,accesstoken,appVersion,,Content-Type,sid,CCPToken,CFIToken,countryCode,businessCode,channelId,uuid,client_id,environmentId

GET
H2 200 embed.js Show response
resources.digital-cloud-citi.medallia.com/wdcusciti/50/onsite/ 2 KB
1 KB 61ms
14ms Script
application/javascript 151.101.130.133
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://resources.digital-cloud-citi.medallia.com/wdcusciti/50/onsite/embed.js
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_stage/code/1106464b92c342a3c2fa0b71543bda48.js?conditionId0=4849963
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.130.133 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 5fe69ec1159868ad3ff04bafba6232d612837f729d7cec2f131968be2eab2365

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

x-amz-version-id: xG6_vRjl.Bp1EBSvT2MliR1rnmbgrjkn
content-encoding: gzip
etag: "4bd2a0aeb7370fccf549aacc6263e4f8"
age: 46638
via: 1.1 varnish
x-cache: HIT
content-length: 675
x-amz-id-2: MK04F7e0DBFqfxfJxRhKjv61WYYaniR6ttYRByui+VwQgPtqj4yWRWUs0cJYY4fO4oWWHybhoIA=
x-served-by: cache-hhn4027-HHN
last-modified: Thu, 13 Jan 2022 16:43:28 GMT
server: AmazonS3
x-timer: S1642138868.738375,VS0,VE0
date: Fri, 14 Jan 2022 05:41:07 GMT
vary: Accept-Encoding
x-amz-request-id: 5XQR9775001E7C27
access-control-allow-origin: *
cache-control: max-age=0,must-revalidate
accept-ranges: bytes
content-type: application/javascript
x-cache-hits: 47

GET
H/1.1 200
OK ca.html Show response
p.rfihub.com/ Frame EE69 118 B
704 B 95ms
26ms Document
text/html 193.0.160.129
ROCKETFUEL

General

Check archive.org

Show headers Download Go to

Full URL: https://p.rfihub.com/ca.html?ver=9&ra=631&rb=648&ca=&_o=17169175&_t=&pe=https%3A%2F%2Fsit58.online.citi.com%2F&pf=&ra=3084066739152409
Requested by: Host: c1.rfihub.net
URL: https://c1.rfihub.net/js/tc.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_256_CBC
Server: 193.0.160.129 , United States, ASN54312 (ROCKETFUEL, US),
Reverse DNS
Software: Jetty(9.3.29.v20201019) /
Resource Hash: c437eb764a99e6cd5172d63c3fae564bbc51eda4981058d5edebd2bf0700eb76

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: de-DE,de;q=0.9

Response headers

Date: Fri, 14 Jan 2022 05:41:07 GMT
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Cache-Control: no-cache
Content-Type: text/html;charset=utf-8
Content-Length: 118
Server: Jetty(9.3.29.v20201019)

GET
H2 403 1560.js
cdn.pbbl.co/r/ 0
0 86ms
15ms Script
text/html 143.204.98.36
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.pbbl.co/r/1560.js
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_stage/code/30785cec0af3ef7e9061f666b2b0f15f.js?conditionId0=4897099
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 143.204.98.36 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-143-204-98-36.fra50.r.cloudfront.net
Software: /
Resource Hash

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

GET
H2 451 425466.html Show response
sr.rlcdn.com/ Frame CB7E 0
98 B 174ms
122ms Document
text/plain 35.190.60.146
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://sr.rlcdn.com/425466.html?es=80676&u=da39a3ee5e6b4b0d3255bfef95601890afd80709
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_stage/code/30785cec0af3ef7e9061f666b2b0f15f.js?conditionId0=4897099
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.190.60.146 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 146.60.190.35.bc.googleusercontent.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: de-DE,de;q=0.9

Response headers

date: Fri, 14 Jan 2022 05:41:07 GMT
content-length: 0
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 98 KB
39 KB 30ms
29ms Script
application/javascript 2a00:1450:4001:809::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-916451471

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_stage/Bootstrap.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

f8e44b81ee836ff4807d1f89207fd206753a447bda06d845092f6531da1ee331

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Fri, 14 Jan 2022 05:41:07 GMT
content-encoding: br
vary: Accept-Encoding
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 39732
x-xss-protection: 0
last-modified: Fri, 14 Jan 2022 03:00:00 GMT
server: Google Tag Manager
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Fri, 14 Jan 2022 05:41:07 GMT

GET
H/1.1 200
OK 63068 Show response
stags.bluekai.com/site/ Frame 3E00 71 B
1 KB 155ms
155ms Document
text/html 104.111.215.191
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://stags.bluekai.com/site/63068?ret=html&phint=language%3Denglish&phint=product&phint=event&phint=category%3DPre-login%20Sign%20on%20page&phint=page%3DNon%20Cookied%20Username%20Password&phint=section1%3DPublic&phint=section2%3DSignOn&phint=section3%3D&phint=section4%3D&phint=bankappstatus&phint=productID&phint=__bk_t%3DOnline%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&phint=__bk_k%3Dbanking%2C%20citi%2C%20financial%20services%2C%20checking%20account%2C%20savings%20account%2C%20credit%20cards&phint=__bk_l%3Dhttps%3A%2F%2Fsit58.online.citi.com%2F&phint=__bk_v%3D3.1.10&limit=10&r=23843018
Requested by: Host: tags.bkrtx.com
URL: https://tags.bkrtx.com/js/bk-coretag.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 104.111.215.191 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-111-215-191.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 53350525edba0b889e87ea52a16ed843a928a2557e9f8d6747acd7ff991c95c3

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36
Accept-Language: de-DE,de;q=0.9

Response headers

Content-Type: text/html
Content-Length: 71
P3P: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV", policyref="http://tags.bluekai.com/w3c/p3p.xml"
BK-Server: ace8
Date: Fri, 14 Jan 2022 05:41:07 GMT
Connection: keep-alive

GET
H/1.1 200
OK trigger.jsp
cardoffer.citicards.com/PORB/tl/api/event/ 0
0 562ms
144ms Image
image/avif 198.160.105.95
ACXIOM

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cardoffer.citicards.com/PORB/tl/api/event/trigger.jsp?ev=PDM&p=Non%20Cookied%20Username%20Password&cu=82896b93-ce45-43cf-ad7a-b3e0c2a42412&idl=
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 198.160.105.95 Conway, United States, ASN15026 (ACXIOM, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

GET
H2 204 e.gif
nexus.ensighten.com/error/ 0
106 B 16ms
16ms Image
text/plain 18.195.42.228
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://nexus.ensighten.com/error/e.gif?msg=Error%20resolving%20data%20definitions%3A%2017005%2C64072.%20Details%3A%20TypeError%3A%20Cannot%20read%20properties%20of%20null%20(reading%20%27appendChild%27)&lnn=-1&fn=&cid=1129&client=citi&publishPath=na_stage&rid=-1&did=-1&errorName=DataDefinitionException
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 18.195.42.228 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-195-42-228.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Fri, 14 Jan 2022 05:41:07 GMT
cache-control: no-cache, no-store
server: nginx
expires: Fri, 14 Jan 2022 05:41:06 GMT

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 98 KB
39 KB 31ms
31ms Script
application/javascript 2a00:1450:4001:809::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-916451471&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=DC-6260004

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

d94c792491d06150083da8c76512bacad8c6e27770230518306fdcd4fe75a2bc

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Fri, 14 Jan 2022 05:41:07 GMT
content-encoding: br
vary: Accept-Encoding
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 39747
x-xss-protection: 0
last-modified: Fri, 14 Jan 2022 03:00:00 GMT
server: Google Tag Manager
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Fri, 14 Jan 2022 05:41:07 GMT

GET
H2 200 conversion_async.js Show response
www.googleadservices.com/pagead/ 38 KB
15 KB 66ms
29ms Script
text/javascript 142.250.185.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googleadservices.com/pagead/conversion_async.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-916451471

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s51-in-f2.1e100.net

Software

cafe /

Resource Hash

1fe7c9b04cd9ebd46cd5a636bd2c2b1d54054f3995db24951c0d0318ec71d70c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Fri, 14 Jan 2022 05:41:07 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 14835
x-xss-protection: 0
server: cafe
etag: 2630088915750441828
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600
timing-allow-origin: *
expires: Fri, 14 Jan 2022 05:41:07 GMT

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 98 KB
39 KB 31ms
31ms Script
application/javascript 2a00:1450:4001:809::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-960621875&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=DC-6260004

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

30d4fd7e3d90ff2f7f74788bf64393ca8d0ba1211c415f04646d4307c020b714

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Fri, 14 Jan 2022 05:41:07 GMT
content-encoding: br
vary: Accept-Encoding
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 39746
x-xss-protection: 0
last-modified: Fri, 14 Jan 2022 03:00:00 GMT
server: Google Tag Manager
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Fri, 14 Jan 2022 05:41:07 GMT

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 98 KB
39 KB 41ms
41ms Script
application/javascript 2a00:1450:4001:809::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-644574043&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=DC-6260004

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

bf57df538e41bf2eda3a3f1e8df7897ec6434dddba526e4d58cf2119fc7ac03c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Fri, 14 Jan 2022 05:41:07 GMT
content-encoding: br
vary: Accept-Encoding
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 39828
x-xss-protection: 0
last-modified: Fri, 14 Jan 2022 03:00:00 GMT
server: Google Tag Manager
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Fri, 14 Jan 2022 05:41:07 GMT

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 98 KB
39 KB 35ms
35ms Script
application/javascript 2a00:1450:4001:809::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-975701947&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=DC-6260004

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

c4cb43931d4a762bdaffcf2cd5cbe853f461724a94b41e6c4eee4064cdfe5f90

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Fri, 14 Jan 2022 05:41:07 GMT
content-encoding: br
vary: Accept-Encoding
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 39746
x-xss-protection: 0
last-modified: Fri, 14 Jan 2022 03:00:00 GMT
server: Google Tag Manager
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Fri, 14 Jan 2022 05:41:07 GMT

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 98 KB
39 KB 43ms
43ms Script
application/javascript 2a00:1450:4001:809::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-830907969&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=DC-6260004

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

943c6b6dfd232ceb82743d02e609adc02913653dd81cf93d1684fc58a17618f2

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Fri, 14 Jan 2022 05:41:07 GMT
content-encoding: br
vary: Accept-Encoding
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 39869
x-xss-protection: 0
last-modified: Fri, 14 Jan 2022 03:00:00 GMT
server: Google Tag Manager
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Fri, 14 Jan 2022 05:41:07 GMT

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 98 KB
39 KB 58ms
58ms Script
application/javascript 2a00:1450:4001:809::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-695231162&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=DC-6260004

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

c587a8456339e494f74977ee721b58e4e6bbe979aab78b8776717a6c54f1495c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Fri, 14 Jan 2022 05:41:07 GMT
content-encoding: br
vary: Accept-Encoding
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 39748
x-xss-protection: 0
last-modified: Fri, 14 Jan 2022 03:00:00 GMT
server: Google Tag Manager
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Fri, 14 Jan 2022 05:41:07 GMT

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 98 KB
39 KB 47ms
47ms Script
application/javascript 2a00:1450:4001:809::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-819500023&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=DC-6260004

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

c02ce56fd35592056b2edfa1f543773abbd447c1cdec9177f5a54ca101d74e30

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Fri, 14 Jan 2022 05:41:07 GMT
content-encoding: br
vary: Accept-Encoding
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 39868
x-xss-protection: 0
last-modified: Fri, 14 Jan 2022 03:00:00 GMT
server: Google Tag Manager
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Fri, 14 Jan 2022 05:41:07 GMT

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 98 KB
39 KB 48ms
47ms Script
application/javascript 2a00:1450:4001:809::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-959299794&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=DC-6260004

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

91116d494d2154aef7cd478e5bad4f02e9dfd486da97b4e22c7a6062483dbf40

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Fri, 14 Jan 2022 05:41:07 GMT
content-encoding: br
vary: Accept-Encoding
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 39870
x-xss-protection: 0
last-modified: Fri, 14 Jan 2022 03:00:00 GMT
server: Google Tag Manager
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Fri, 14 Jan 2022 05:41:07 GMT

GET
H2 200 generic1642092206405.js Show response
resources.digital-cloud-citi.medallia.com/wdcusciti/50/onsite/ 529 KB
88 KB 16ms
16ms Script
application/javascript 151.101.130.133
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://resources.digital-cloud-citi.medallia.com/wdcusciti/50/onsite/generic1642092206405.js
Requested by: Host: resources.digital-cloud-citi.medallia.com
URL: https://resources.digital-cloud-citi.medallia.com/wdcusciti/50/onsite/embed.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.130.133 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: d3ef72e238c35ddcebe71c4d49669e2e4410b6228f6298a6a67fba471c3b8b81

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

x-amz-version-id: 46k.n1uNvsAphQ_kTM6zr7ztY5VcnMgh
content-encoding: gzip
etag: "48d1b6734d14a74938505f86fa027c59"
age: 46658
via: 1.1 varnish
x-cache: HIT
content-length: 89374
x-amz-id-2: 22cifVIQwqjbijdEL+DpcLJn/lvmgMtJ08iVmDgtHhhr46HDHSEfPIZMesqI2rQNIvPeOr3ZHbs=
x-served-by: cache-hhn4027-HHN
last-modified: Thu, 13 Jan 2022 16:43:28 GMT
server: AmazonS3
x-timer: S1642138868.763814,VS0,VE0
date: Fri, 14 Jan 2022 05:41:07 GMT
vary: Accept-Encoding
x-amz-request-id: QKJZS6T6SFS3Z71X
access-control-allow-origin: *
cache-control: max-age=0,must-revalidate
accept-ranges: bytes
content-type: application/javascript
x-cache-hits: 59

GET
H2 200 cool-2.1.15.min.js Show response
nebula-cdn.kampyle.com/resources/onsite/js/ 14 KB
5 KB 55ms
14ms Script
application/javascript 151.101.129.175
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://nebula-cdn.kampyle.com/resources/onsite/js/cool-2.1.15.min.js
Requested by: Host: resources.digital-cloud-citi.medallia.com
URL: https://resources.digital-cloud-citi.medallia.com/wdcusciti/50/onsite/generic1642092206405.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.129.175 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 3e72de5de67d6d80b65a114af684eaf880c53c250155a663cb17d677ff064bc1

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

x-amz-version-id: 9HCXbKZTbCJZkS8s9IuB.pE0JEvI0TGW
content-encoding: gzip
etag: "80dd5e3be5152c5c72d552c6a26ef6ff"
age: 150168
via: 1.1 varnish
x-cache: HIT
content-length: 5197
x-amz-id-2: 2Rqcsnqc7u6qr5RePJPgkBiDQObsrQuT7+satPB20rDqRCp9iEuwtIT4vebpJreufjB6IPMRLZ0=
x-served-by: cache-hhn4036-HHN
last-modified: Sun, 24 Jan 2021 11:03:10 GMT
server: AmazonS3
x-timer: S1642138868.854856,VS0,VE0
date: Fri, 14 Jan 2022 05:41:07 GMT
vary: Accept-Encoding
x-amz-request-id: T9HXMK5FZ5ARRFW8
access-control-allow-origin: *
cache-control: max-age=31622400
accept-ranges: bytes
content-type: application/javascript
x-cache-hits: 72822

GET
H3 200 conversion_async.js Show response
www.googleadservices.com/pagead/ 38 KB
15 KB 57ms
33ms Script
text/javascript 142.250.185.162
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googleadservices.com/pagead/conversion_async.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-960621875&l=dataLayer&cx=c

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.162 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s51-in-f2.1e100.net

Software

cafe /

Resource Hash

1fe7c9b04cd9ebd46cd5a636bd2c2b1d54054f3995db24951c0d0318ec71d70c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Fri, 14 Jan 2022 05:41:07 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 14835
x-xss-protection: 0
server: cafe
etag: 2630088915750441828
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600
timing-allow-origin: *
expires: Fri, 14 Jan 2022 05:41:07 GMT

GET
H2 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/916451471/ 2 KB
2 KB 67ms
27ms Script
text/javascript 2a00:1450:4001:809::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/916451471/?random=1642138867878&cv=9&fst=1642138867878&num=1&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa1c0&sendb=1&ig=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fsit58.online.citi.com%2F&tiba=Online%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4

Requested by

Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/conversion_async.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a48e0275b7d9070bcacd31b9c0783f64311179a59736e5d406d7aa710f0530d8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 14 Jan 2022 05:41:07 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1065
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 __cool.gif
udc-neb.kampyle.com/egw/5/qceuv8449dzg58ptt1bhda9g8ue19c7s/track/ 0
349 B 143ms
103ms Image
image/gif 35.241.45.82
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://udc-neb.kampyle.com/egw/5/qceuv8449dzg58ptt1bhda9g8ue19c7s/track/__cool.gif?data=eyJldmVudHMiOiBbCiAgICB7InNlc3Npb25fc2NyZWVuX3NpemUiOiAiMTYwMHgxMjAwIiwic2Vzc2lvbl9kdWEiOiAiTW96aWxsYS81LjAgKFdpbmRvd3MgTlQgMTAuMDsgV2luNjQ7IHg2NCkgQXBwbGVXZWJLaXQvNTM3LjM2IChLSFRNTCwgbGlrZSBHZWNrbykgQ2hyb21lLzk3LjAuNDY5Mi43MSBTYWZhcmkvNTM3LjM2Iiwic2Vzc2lvbl9wbGF0Zm9ybSI6ICJMaW51eCB4ODZfNjQiLCJ0cmFja2VyX3R5cGUiOiAiamF2YXNjcmlwdCIsInRyYWNrZXJfdmVyc2lvbiI6ICIyLjEuMTUiLCJldmVudF9uYW1lIjogIm5lYnVsYV9wYWdlX3ZpZXciLCJldmVudF90aW1lc3RhbXBfZXBvY2giOiAiMTY0MjEzODg2NzkxOCIsImV2ZW50X3RpbWV6b25lX29mZnNldCI6IDAsInVzZXJfaWQiOiAiMTdlNTcxYTk4Y2MxNy0wYjNlMThkOWVkMTExOC1mNzkxYjMxLTFkNGMwMC0xN2U1NzFhOThjZGI5NyIsImVudmlyb21lbnQiOiAiZGlnaXRhbC1jbG91ZC11cy1jaXRpIiwiYWNjb3VudElkIjogNDksInVybCI6ICJodHRwczovL3NpdDU4Lm9ubGluZS5jaXRpLmNvbS8iLCJ3ZWJzaXRlSWQiOiA1MCwiZm9ybUlkIjogbnVsbCwiZm9ybVRyaWdnZXJUeXBlIjogbnVsbCwia2FtcHlsZV9kYXRhIjogeyJMQVNUX0lOVklUQVRJT05fVklFVyI6ICIiLCJERUNMSU5FRF9EQVRFIjogIiIsImthbXB5bGVJbnZpdGVQcmVzZW50ZWQiOiAiIiwia2FtcHlsZV91c2VyaWQiOiAiMTk2ZC0xNmQyLTZmNGItMmMyMS01NDE3LTU0ZTUtYmI5NC1iOTY4Iiwia2FtcHlsZVVzZXJTZXNzaW9uIjogIjE2NDIxMzg4Njc4MTIiLCJrYW1weWxlVXNlclBlcmNlbnRpbGUiOiAiIiwiU1VCTUlUVEVEX0RBVEUiOiAiIn0sImNvb2tpZV9zaXplIjogMTcwOSwia2FtcHlsZV92ZXJzaW9uIjogIjIuNDIuMSIsIm9uc2l0ZV92ZXJzaW9uIjogIjIuNDIuMSIsImhpc3RvcnlfbGVuZ3RoIjogMiwiZXZlbnRfbG9jYWxfdGltZXN0YW1wIjogMTY0MjEzODg2NzgxNiwicG9zaXRpb24iOiBudWxsLCJpc1VzZXJJZGVudGlmaWVkIjogZmFsc2UsImZlZWRiYWNrX2NvcnJlbGF0aW9uX3V1aWQiOiBudWxsfQpdfQ==
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.241.45.82 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 82.45.241.35.bc.googleusercontent.com
Software: Jetty(9.2.11.v20150529) /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

x-me: prod-instance-gatewayservice-blue-428z
date: Fri, 14 Jan 2022 05:41:08 GMT
via: 1.1 google
server: Jetty(9.2.11.v20150529)
access-control-allow-headers: X-Requested-With, Origin, Content-Type, Accept
access-control-max-age: 1800
access-control-allow-methods: GET, POST, PUT, DELETE
content-type: image/gif; charset=UTF-8
access-control-allow-origin: *
access-control-allow-credentials: true
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-application-context: application:9090

GET
H2 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/644574043/ 2 KB
1 KB 27ms
27ms Script
text/javascript 2a00:1450:4001:809::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/644574043/?random=1642138867923&cv=9&fst=1642138867923&num=1&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa1c0&sendb=1&ig=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fsit58.online.citi.com%2F&tiba=Online%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4

Requested by

Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/conversion_async.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

78f4d37a408dce061a6f0af855deb33f7213cf42ce9f1303c64472d65ba87d55

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 14 Jan 2022 05:41:07 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1066
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/959299794/ 2 KB
1 KB 27ms
27ms Script
text/javascript 2a00:1450:4001:809::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/959299794/?random=1642138867925&cv=9&fst=1642138867925&num=1&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa1c0&sendb=1&ig=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fsit58.online.citi.com%2F&tiba=Online%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4

Requested by

Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/conversion_async.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

64443f40139dc0b4715fbb1c9d921ecf1bd7566b5a65646431412aee4755bfc1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 14 Jan 2022 05:41:07 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1067
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/695231162/ 2 KB
1 KB 28ms
28ms Script
text/javascript 2a00:1450:4001:809::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/695231162/?random=1642138867927&cv=9&fst=1642138867927&num=1&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa1c0&sendb=1&ig=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fsit58.online.citi.com%2F&tiba=Online%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4

Requested by

Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/conversion_async.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

398d255e752aae2ae02f14920444fc84d8fdebea2818374e712a41b58129234b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 14 Jan 2022 05:41:07 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1065
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/819500023/ 2 KB
1 KB 27ms
27ms Script
text/javascript 2a00:1450:4001:809::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/819500023/?random=1642138867928&cv=9&fst=1642138867928&num=1&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa1c0&sendb=1&ig=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fsit58.online.citi.com%2F&tiba=Online%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4

Requested by

Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/conversion_async.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ff5227eec311b65ef7c4057363428eda1fd1a9769713e3d021dc3b7ba73b1fd9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 14 Jan 2022 05:41:07 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1067
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/975701947/ 2 KB
1 KB 27ms
27ms Script
text/javascript 2a00:1450:4001:809::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/975701947/?random=1642138867929&cv=9&fst=1642138867929&num=1&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa1c0&sendb=1&ig=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fsit58.online.citi.com%2F&tiba=Online%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4

Requested by

Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/conversion_async.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b3358698f44fb7f78990298b1bc66475813b8137848a1ade1940f5d2c297c978

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 14 Jan 2022 05:41:07 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1061
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/960621875/ 2 KB
1 KB 27ms
26ms Script
text/javascript 2a00:1450:4001:809::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/960621875/?random=1642138867931&cv=9&fst=1642138867931&num=1&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa1c0&sendb=1&ig=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fsit58.online.citi.com%2F&tiba=Online%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4

Requested by

Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/conversion_async.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

176572a9f1e99d297d8222f567a80593c6001a684d0f1c963b6554963f6a6207

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 14 Jan 2022 05:41:07 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1065
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/830907969/ 2 KB
1 KB 30ms
30ms Script
text/javascript 2a00:1450:4001:809::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/830907969/?random=1642138867932&cv=9&fst=1642138867932&num=1&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa1c0&sendb=1&ig=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fsit58.online.citi.com%2F&tiba=Online%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4

Requested by

Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/conversion_async.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d6213b65a08828f1022b9a019486a430e5e79c99bb31136d162281dd8aa208cb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 14 Jan 2022 05:41:07 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 1066
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 HP8564_M.jpg
sit58.online.citi.com/JRS/banners/modules/ 68 KB
68 KB 150ms
150ms Image
image/jpeg 104.70.85.47
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sit58.online.citi.com/JRS/banners/modules/HP8564_M.jpg
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 104.70.85.47 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-70-85-47.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 48f649a58460116c321bd0f8437ca535d9175e2cb6c3a02417abe3f52feaedb0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

date: Fri, 14 Jan 2022 05:41:08 GMT
last-modified: Thu, 17 Sep 2020 13:55:44 GMT
x-akamai-citisite: GTDC
etag: "4fea5-10e41-5af82bd887800"
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
x-robots-tag: noindex, nofollow
accept-ranges: bytes
content-type: image/jpeg
content-length: 69185

GET
H2 200 /
www.google.com/pagead/1p-user-list/916451471/ 42 B
108 B 73ms
30ms Image
image/gif 2a00:1450:4001:82f::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/916451471/?random=1642138867878&cv=9&fst=1642136400000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa1c0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fsit58.online.citi.com%2F&tiba=Online%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&async=1&fmt=3&is_vtc=1&random=829058439&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 14 Jan 2022 05:41:08 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.de/pagead/1p-user-list/916451471/ 42 B
108 B 70ms
30ms Image
image/gif 2a00:1450:4001:808::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/916451471/?random=1642138867878&cv=9&fst=1642136400000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa1c0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fsit58.online.citi.com%2F&tiba=Online%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&async=1&fmt=3&is_vtc=1&random=829058439&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 14 Jan 2022 05:41:08 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.com/pagead/1p-user-list/644574043/ 42 B
108 B 68ms
28ms Image
image/gif 2a00:1450:4001:82f::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/644574043/?random=1642138867923&cv=9&fst=1642136400000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa1c0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fsit58.online.citi.com%2F&tiba=Online%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&async=1&fmt=3&is_vtc=1&random=645831952&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 14 Jan 2022 05:41:08 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.de/pagead/1p-user-list/644574043/ 42 B
548 B 65ms
29ms Image
image/gif 2a00:1450:4001:808::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/644574043/?random=1642138867923&cv=9&fst=1642136400000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa1c0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fsit58.online.citi.com%2F&tiba=Online%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&async=1&fmt=3&is_vtc=1&random=645831952&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 14 Jan 2022 05:41:08 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.com/pagead/1p-user-list/959299794/ 42 B
548 B 64ms
28ms Image
image/gif 2a00:1450:4001:82f::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/959299794/?random=1642138867925&cv=9&fst=1642136400000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa1c0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fsit58.online.citi.com%2F&tiba=Online%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&async=1&fmt=3&is_vtc=1&random=1104808907&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 14 Jan 2022 05:41:08 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.de/pagead/1p-user-list/959299794/ 42 B
108 B 62ms
29ms Image
image/gif 2a00:1450:4001:808::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/959299794/?random=1642138867925&cv=9&fst=1642136400000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa1c0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fsit58.online.citi.com%2F&tiba=Online%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&async=1&fmt=3&is_vtc=1&random=1104808907&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 14 Jan 2022 05:41:08 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.com/pagead/1p-user-list/695231162/ 42 B
108 B 62ms
28ms Image
image/gif 2a00:1450:4001:82f::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/695231162/?random=1642138867927&cv=9&fst=1642136400000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa1c0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fsit58.online.citi.com%2F&tiba=Online%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&async=1&fmt=3&is_vtc=1&random=1843252293&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 14 Jan 2022 05:41:08 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.de/pagead/1p-user-list/695231162/ 42 B
108 B 59ms
29ms Image
image/gif 2a00:1450:4001:808::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/695231162/?random=1642138867927&cv=9&fst=1642136400000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa1c0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fsit58.online.citi.com%2F&tiba=Online%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&async=1&fmt=3&is_vtc=1&random=1843252293&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 14 Jan 2022 05:41:08 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.com/pagead/1p-user-list/819500023/ 42 B
108 B 30ms
27ms Image
image/gif 2a00:1450:4001:82f::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/819500023/?random=1642138867928&cv=9&fst=1642136400000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa1c0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fsit58.online.citi.com%2F&tiba=Online%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&async=1&fmt=3&is_vtc=1&random=2899054879&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 14 Jan 2022 05:41:08 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 /
www.google.de/pagead/1p-user-list/819500023/ 42 B
64 B 57ms
29ms Image
image/gif 2a00:1450:4001:808::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/819500023/?random=1642138867928&cv=9&fst=1642136400000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa1c0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fsit58.online.citi.com%2F&tiba=Online%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&async=1&fmt=3&is_vtc=1&random=2899054879&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 14 Jan 2022 05:41:08 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.com/pagead/1p-user-list/975701947/ 42 B
108 B 29ms
26ms Image
image/gif 2a00:1450:4001:82f::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/975701947/?random=1642138867929&cv=9&fst=1642136400000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa1c0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fsit58.online.citi.com%2F&tiba=Online%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&async=1&fmt=3&is_vtc=1&random=141984984&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 14 Jan 2022 05:41:08 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 /
www.google.de/pagead/1p-user-list/975701947/ 42 B
64 B 55ms
28ms Image
image/gif 2a00:1450:4001:808::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/975701947/?random=1642138867929&cv=9&fst=1642136400000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa1c0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fsit58.online.citi.com%2F&tiba=Online%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&async=1&fmt=3&is_vtc=1&random=141984984&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 14 Jan 2022 05:41:08 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.com/pagead/1p-user-list/960621875/ 42 B
108 B 33ms
30ms Image
image/gif 2a00:1450:4001:82f::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/960621875/?random=1642138867931&cv=9&fst=1642136400000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa1c0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fsit58.online.citi.com%2F&tiba=Online%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&async=1&fmt=3&is_vtc=1&random=1041004281&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82f::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 14 Jan 2022 05:41:08 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 /
www.google.de/pagead/1p-user-list/960621875/ 42 B
64 B 55ms
27ms Image
image/gif 2a00:1450:4001:808::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/960621875/?random=1642138867931&cv=9&fst=1642136400000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa1c0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fsit58.online.citi.com%2F&tiba=Online%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&async=1&fmt=3&is_vtc=1&random=1041004281&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 14 Jan 2022 05:41:08 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 /
www.google.com/pagead/1p-user-list/830907969/ 42 B
64 B 53ms
25ms Image
image/gif 2a00:1450:4001:82f::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/830907969/?random=1642138867932&cv=9&fst=1642136400000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa1c0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fsit58.online.citi.com%2F&tiba=Online%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&async=1&fmt=3&is_vtc=1&random=740513617&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82f::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 14 Jan 2022 05:41:08 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 /
www.google.de/pagead/1p-user-list/830907969/ 42 B
64 B 56ms
28ms Image
image/gif 2a00:1450:4001:808::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/830907969/?random=1642138867932&cv=9&fst=1642136400000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa1c0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fsit58.online.citi.com%2F&tiba=Online%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&async=1&fmt=3&is_vtc=1&random=740513617&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 14 Jan 2022 05:41:08 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: online.citi.com
URL: https://online.citi.com/gcgapi/prod/public/v1/staticcms/USGCB/en_US/appid/tagging_transformation_homepage_and_login.json

Domain: stags.bluekai.com
URL: https://stags.bluekai.com/site/19469?ret=json

Domain: api.rlcdn.com
URL: https://api.rlcdn.com/api/identity?pid=1&rt=idl

Domain: dit1.online.citi.com
URL: https://dit1.online.citi.com/gcgapi/dev1/public/v1/prelogin/e2eConfig/client/cbol

Domain: dit1.online.citi.com
URL: https://dit1.online.citi.com/gcgapi/dev1/public/v1/staticcms/USGCB/en_US/appid/fntc_USCBOL.json

Domain: dit1.online.citi.com
URL: https://dit1.online.citi.com/gcgapi/dev1/public/v1/prelogin/e2eConfig/client/cbol

Domain: dit1.online.citi.com
URL: https://dit1.online.citi.com/gcgapi/dev1/public/v1/staticcms/USGCB/en_US/appid/fntc_USCBOL.json

Domain: sit58.online.citi.com
URL: https://sit58.online.citi.com/gcgapi/dev1/public/v1/digital/reporting/metrics

Verdicts & Comments Add Verdict or Comment

435 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

41 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.citi.com/	1969-12-31 23:59:59	Name: CITI_SITE Value: gtdc
.citi.com/	1969-12-31 23:59:59	Name: experience Value: Uncookied
.citi.com/	1970-01-20 08:54:34	Name: CUUID Value: 82896b93-ce45-43cf-ad7a-b3e0c2a42412
.citi.com/	1970-01-20 08:54:34	Name: CB_popsplit Value: 55
ci-mpsnare.iovation.com/	1970-01-20 08:54:34	Name: io_token_7c6a6574-f011-4c9a-abdd-9894a102ccef Value: 1iiesbNTyRj64VtTXzUpZQLKOzPNV3yMsQ3SxAZTq6M=
.citi.com/	1970-01-20 00:09:00	Name: tenantId Value: CBOL
.citi.com/	1969-12-31 23:59:59	Name: bcsid Value: 76BA2B1E80BE8B92D9B7C6F996A8A0D7
sit58.online.citi.com/	1969-12-31 23:59:59	Name: makeBannerCall Value: Y
sit58.online.citi.com/	1970-01-20 00:09:00	Name: 7830 Value: error
sit58.online.citi.com/	1970-01-20 00:09:00	Name: 7018 Value: 82896b93-ce45-43cf-ad7a-b3e0c2a42412
sit58.online.citi.com/	1970-01-20 02:18:34	Name: 64072 Value:
.citi.com/	1970-01-20 02:18:34	Name: _gcl_au Value: 1.1.1009740258.1642138866
.demdex.net/	1970-01-20 04:28:10	Name: demdex Value: 63814934763556885350114087948227507924
.citi.com/	1969-12-31 23:59:59	Name: AMCVS_61834D9B5228A7430A490D45%40AdobeOrg Value: 1
.everesttech.net/	1970-01-20 08:54:34	Name: everest_g_v2 Value: g_surferid~YeEM8QAAABcLvwP0
.citi.com/	1970-01-20 17:40:10	Name: s_vi Value: [CS]v1\|30F0867884AA8EC3-40001F14933E172B[CE]
.citi.com/	1970-01-20 17:40:10	Name: s_ecid Value: MCMID%7C58490552051940357000591880697583161207
.dpm.demdex.net/	1970-01-20 04:28:10	Name: dpm Value: 63814934763556885350114087948227507924
.citi.com/	1970-01-20 17:40:10	Name: AMCV_61834D9B5228A7430A490D45%40AdobeOrg Value: -330454231%7CMCIDTS%7C19007%7CMCMID%7C58490552051940357000591880697583161207%7CMCAAMLH-1642743665%7C6%7CMCAAMB-1642743665%7CRKhpRz8krg2tLO6pguXWp5olkAcUniQYPHaMWWgdJ3xzPWQmdj0y%7CMCOPTOUT-1642146065s%7CNONE%7CMCAID%7C30F0867884AA8EC3-40001F14933E172B%7CMCSYNCSOP%7C411-19014%7CvVersion%7C3.1.2
.citi.com/	1970-01-20 08:54:34	Name: bmuid Value: 1642138865927-E530FDE6-3809-45FE-B755-FC26795F3F64
.citi.com/	1969-12-31 23:59:59	Name: cdContextId Value: 2
.online.citi.com/	1969-12-31 23:59:59	Name: cdContextId Value: 2
.sit58.online.citi.com/	1969-12-31 23:59:59	Name: cdContextId Value: 2
.citi.com/	1969-12-31 23:59:59	Name: AKMTLTSID Value: 896AE8E62B1BD759A38A638BE0E6A73F
.citi.com/	1970-01-20 08:54:34	Name: cdSNum Value: 1642138866442-sjn0000627-de095864-9e0a-464e-bbd2-fd0cf0322b46
.citi.com/	1970-01-21 19:58:25	Name: s_fid Value: 44E3A4F95E66EA3C-3959C123F4D76892
.citi.com/	1969-12-31 23:59:59	Name: s_sess Value: %20SC_LINKS%3D%3B
.citi.com/	1970-01-21 19:56:58	Name: s_pers Value: %20gpv_p7%3Dno%2520value%7C1642140667069%3B%20s_visit%3D1%7C1642140667070%3B%20s_vnum%3D1643673600071%2526vn%253D1%7C1643673600071%3B%20s_invisit%3Dtrue%7C1642140667071%3B%20s_nr%3D1642138867074-New%7C1799818867074%3B
.citi.com/	1969-12-31 23:59:59	Name: s_cc Value: true
.rfihub.com/	1969-12-31 23:59:59	Name: ruds Value: H4sIAAAAAAAAAOMSNjU0MTCwMLE0tDQztbQwNTQyNRLiM9TNdS0p93KtcnO2KKsCAA3AuNglAAAA
.rfihub.com/	1970-01-20 09:30:34	Name: rud Value: H4sIAAAAAAAAAOMSNjU0MTCwMLE0tDQztbQwNTQyNRLiM9TNdS0p93KtcnO2KKuS4jU0MzEyNLawMDM3MjUGAPKfUDc0AAAA
sit58.online.citi.com/	1970-01-20 08:54:34	Name: mdLogger Value: false
sit58.online.citi.com/	1970-01-20 08:54:34	Name: kampyle_userid Value: 196d-16d2-6f4b-2c21-5417-54e5-bb94-b968
sit58.online.citi.com/	1970-01-20 08:54:34	Name: kampyleUserSession Value: 1642138867812
sit58.online.citi.com/	1970-01-20 08:54:34	Name: kampyleUserSessionsCount Value: 1
sit58.online.citi.com/	1970-01-20 08:54:34	Name: kampyleSessionPageCounter Value: 1
.bluekai.com/	1970-01-20 04:28:10	Name: bkdc Value: phx
.bluekai.com/	1970-01-20 04:28:10	Name: bkpa Value: KJh5Ak+gCe9xCUIBINqU0lqgi8HtutsCkTUu80UsB9fsiuuMo4IITTN3x4EA1IKzMnMlxsodEvBM5rXD8HDNj+5VQJxqQqGEVQUoA6J+ya4pi2qjLo16gNuFzBauABnVdqekT+uBLHGyuv/w61weegKVW8Kzv4h+8Y5gSN9k36IFc/osLqy/ffI+vtKeP8n9RMpW5TDOrKDJXbc3cqzXjqTkCp2uYvhatlGuNw7+Qm5kpdPSNa5ippLSymaQMIyYNWa0TLVg5SH8aMX+nXo8iXvy4nWYjlgsU7ASwPayB89EW/EuBrruZArv5qqAEjwb9CxGRzpkn2ueU9okoKEAi/uD+AmSrOz2DdX4ub5vGWW/PdoNrIcti3MNx4GxJ12XX52hZTPtcerDXTsjgN62r2/yerBGjb9O0kZTwWZpxhgatu2tqzlj
.bluekai.com/	1970-01-20 04:28:10	Name: bku Value: UwR99w11TVsevsW3
.online.citi.com/	1970-01-20 08:54:34	Name: cd_user_id Value: 17e571a98cc17-0b3e18d9ed1118-f791b31-1d4c00-17e571a98cdb97
.doubleclick.net/	1970-01-20 00:08:59	Name: test_cookie Value: CheckForPermission

12 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://idsync.rlcdn.com/463166.gif?partner_uid=82896b93-ce45-43cf-ad7a-b3e0c2a42412 Message: Failed to load resource: the server responded with a status of 451 ()
javascript	error	URL: https://sit58.online.citi.com/ Message: Access to XMLHttpRequest at 'https://api.rlcdn.com/api/identity?pid=1&rt=idl' from origin 'https://sit58.online.citi.com' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network	error	URL: https://api.rlcdn.com/api/identity?pid=1&rt=idl Message: Failed to load resource: net::ERR_FAILED
javascript	error	URL: https://sit58.online.citi.com/ Message: Access to XMLHttpRequest at 'https://stags.bluekai.com/site/19469?ret=json' from origin 'https://sit58.online.citi.com' has been blocked by CORS policy: The 'Access-Control-Allow-Origin' header has a value 'https://.citi.com' that is not equal to the supplied origin.
network	error	URL: https://stags.bluekai.com/site/19469?ret=json Message: Failed to load resource: net::ERR_FAILED
javascript	error	URL: https://sit58.online.citi.com/ Message: Access to XMLHttpRequest at 'https://online.citi.com/gcgapi/prod/public/v1/staticcms/USGCB/en_US/appid/tagging_transformation_homepage_and_login.json' from origin 'https://sit58.online.citi.com' has been blocked by CORS policy: Response to preflight request doesn't pass access control check: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network	error	URL: https://online.citi.com/gcgapi/prod/public/v1/staticcms/USGCB/en_US/appid/tagging_transformation_homepage_and_login.json Message: Failed to load resource: net::ERR_FAILED
network	error	URL: https://sit58.online.citi.com/gcgapi/prod/api/v1/marketing/offers/banner Message: Failed to load resource: the server responded with a status of 404 ()
network	error	URL: https://dit1.online.citi.com/gcgapi/dev1/public/v1/prelogin/e2eConfig/client/cbol Message: Failed to load resource: net::ERR_NAME_NOT_RESOLVED
network	error	URL: https://dit1.online.citi.com/gcgapi/dev1/public/v1/staticcms/USGCB/en_US/appid/fntc_USCBOL.json Message: Failed to load resource: net::ERR_NAME_NOT_RESOLVED
network	error	URL: https://cdn.pbbl.co/r/1560.js Message: Failed to load resource: the server responded with a status of 403 ()
network	error	URL: https://sr.rlcdn.com/425466.html?es=80676&u=da39a3ee5e6b4b0d3255bfef95601890afd80709 Message: Failed to load resource: the server responded with a status of 451 ()

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=31536000 ; includeSubDomains max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1 ; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

20766699p.rfihub.com
api.rlcdn.com
c1.rfihub.net
cardoffer.citicards.com
cdn.pbbl.co
ci-mpsnare.iovation.com
citi.demdex.net
cm.everesttech.net
code.jquery.com
contents3.00110.citi.com
dit1.online.citi.com
dpm.demdex.net
googleads.g.doubleclick.net
idsync.rlcdn.com
metrics1.citi.com
nebula-cdn.kampyle.com
nexus.ensighten.com
online.citi.com
p.rfihub.com
resources.digital-cloud-citi.medallia.com
sit58.online.citi.com
sr.rlcdn.com
stags.bluekai.com
tags.bkrtx.com
udc-neb.kampyle.com
www.citi.com
www.google.com
www.google.de
www.googleadservices.com
www.googletagmanager.com
api.rlcdn.com
dit1.online.citi.com
online.citi.com
sit58.online.citi.com
stags.bluekai.com
104.111.215.191
104.111.228.137
104.111.238.178
104.117.204.150
104.70.85.47
142.250.185.162
143.204.98.36
15.236.176.210
151.101.129.175
151.101.130.133
18.195.42.228
193.0.160.129
198.160.105.95
2001:4de0:ac18::1:a:1b
2600:9000:2156:be00:1:76cf:fe80:93a1
2a00:1450:4001:808::2003
2a00:1450:4001:809::2002
2a00:1450:4001:809::2008
2a00:1450:4001:82f::2004
34.249.190.190
34.250.180.190
35.190.60.146
35.241.45.82
35.244.174.68
52.141.218.213
52.24.163.168
52.50.54.3
045cd226594cb32ddf9d4db8ee45611f4d0788675ae50180b68da975e66fe1fe
07b8ed0a756c84e6eefa24e1f5b04173739c17cb090be37878b3a8189846f9a6
0a6b7bd0b381108f1dcd81aefbebbb670a56c7a885f043735be2c9479a68f332
102503acef6077fcf8e42a856fb4904fcd74224a32d5d8efcd13236ac6309fed
176572a9f1e99d297d8222f567a80593c6001a684d0f1c963b6554963f6a6207
198f5d63443524a293ae8cdc33d2463e571dc668248581439c0c96781a206e05
1c69468ad43d43f8c701bcd193de8688ba49a17128a730c065c7a06d08106daf
1ef8a96213dddc1092922838721a9944760936864f654a7975246e377b6271e6
1fe7c9b04cd9ebd46cd5a636bd2c2b1d54054f3995db24951c0d0318ec71d70c
235b98a2254def315c7e17bbb8bfa25c4e35be0da4297b8bf1808ea437f67400
23e003b0d053963c54a24b5a4949c7ac2dee0337747b6cf3ccc3715d35508104
275cf9d336d8a29dd3a8cc8bc22761e96bfdd81c75a24bc5f48e10bfcc54d4fb
277da2ef5834e2c4327b3ed53e0fa36a7bcb395b6e3ca8af3d2691d17dec3f7b
2b6efb6500fc71964aa36181a05af0f6ab1018fcb4ecddb7b657c112d1a9674d
30d4fd7e3d90ff2f7f74788bf64393ca8d0ba1211c415f04646d4307c020b714
325a26c8139c8f943abdb7d23fc5bab7fb9b4444a0b2716f684b14babe4636ef
390c36ad787c04f4acc3f3022a0bb787c9046941c5516d8412a85a959991e4d8
398d255e752aae2ae02f14920444fc84d8fdebea2818374e712a41b58129234b
3a4284fc3091796d852c047a85d6f8d91c95e1bb7b1b2c3bb3e69b1d29064488
3b65cdd967c27148cb83596be9995df19e8fff1e5c16497dfd2e441fd9bd0ed1
3b937262381be3786c1ee9b1a8e59b0ac400f70f88d8cffb42d9ed75df8b18b5
3d594246baf1e88fe62fc2bf1adf9ff76c53e390731f99455eb71d7441ba8f00
3e72de5de67d6d80b65a114af684eaf880c53c250155a663cb17d677ff064bc1
3fb46d467b5ad76174876e5a624ccbaa3ebe201db0f40e63ea58d668d411162c
3fca3de24621f0f10186594054444d608016297c2e853e548710b3521e42a609
463364c237ac33fd5ce60338742b888edad01bfa59b7271db12210071fc41c6a
48f649a58460116c321bd0f8437ca535d9175e2cb6c3a02417abe3f52feaedb0
4935c8acd0d39b219a73b3bacca86332bfee10ce7fb41c2d734f40ad577b12f7
4999a8bcfc1f9fd95a0c4e42cfbac1abdf5a6c9e26734abbe4bc157b8c2b49ab
4f92161637b73f47f10625fcb60427aed6c9c3a625164a6ab7469d50a89eed0e
5181a421b3bfb613ccfee1ca7fd0001d6f1ad650a29f704004d01375d3aaeb06
51c6043803bec020097c7f9559f9f87f1b427daf7590f68f2ce2b3a4feaf661a
52541e17b026b0a2a1edefe177cdd7597acf5ca74c519799809fe9f38402157b
53350525edba0b889e87ea52a16ed843a928a2557e9f8d6747acd7ff991c95c3
5341f9e17a9893850169aa24e2a9171feff8734d87d92d6713c4a96bf269d7e7
5394d11ec8ad7a5494bcdb65cd95f885388532e14fb45a747e249112389bd837
54114d6a66ff9b0a463cb8804b869581eb63483f4a78f5fc4367861bb2267a50
5df469ee4da2bc124065cb8df0e24173c5cbc8b9e0c807960fc39c93ffb640c8
5fe69ec1159868ad3ff04bafba6232d612837f729d7cec2f131968be2eab2365
600263e9bde3fb2c66b5ccb8c59efd8bcb9224b5e2481aa3a336d7843803e8f6
627660443b6ba8e5a33bb1c0961f9a628a6b956ac4c9cfb3aca7991797d30bc3
6336ae7b60dff18e0a37721a3a19fd5e18568577a64faa662969d35966dbf72b
64443f40139dc0b4715fbb1c9d921ecf1bd7566b5a65646431412aee4755bfc1
695788dc05d94be3b32060ffea15c1a4d74897bd32e5da7811e7ca76d82fc86b
6dae862525bc15cc9ca50bbdfcfa1eea606f15777a11047e5905d1cc34816d37
6dfa343a68ef79e83fef5f7c705119d2473352190c609cf94c67ea99a29fa452
6ea89010cb1d1fda56574d22ae56f7bdb66e7419e90a2dcb2bf35ed914571adb
74234e98afe7498fb5daf1f36ac2d78acc339464f950703b8c019892f982b90b
78f4d37a408dce061a6f0af855deb33f7213cf42ce9f1303c64472d65ba87d55
79206ccd37edbafc46266406417abb5be984a5d0fb9f38e693d67b6d30cba8bb
7bea17a80a61ed0f54248b4ffc4c718f7c8ff2619742577a73591d62ce074da8
7d7a9f9308dca2b45bf80f8caa2a0db25c60a6f12b4eef322b570514fd515b89
7dcde11c1744824fdb6160c37a7b333d087637510bc149648ca2356c9c197a6a
7ef97b12890fc6fee67f869c6e1f74b6719de7d66ac0d649c8d7386a80b4c30f
83cc188d4995293f90c32fc37fbf1d9c749b7af5de6619e108cfe4e62753738d
86e0b0862ec46454e54661cdbc43fdb400c2bf2181f024bb06b8dcf87ea3fc0c
88cd43c3f5453f7b4db2cbe884b47db3c8317860a2ce6e9b2bc934ff4b8e32eb
8d29865aa51f76ae96b1968abe50d09a1540ca0b5b4a085cb471ab454ff90725
91116d494d2154aef7cd478e5bad4f02e9dfd486da97b4e22c7a6062483dbf40
943c6b6dfd232ceb82743d02e609adc02913653dd81cf93d1684fc58a17618f2
97f75a27ae70cd39192f0c313f9d254d0628f9225b0ee94f35f206c555237241
9e1aa3b46d82fb1fc803dbb1aa5bacb618bbafff98199bc178135e797b6f698d
a1ecbaed793a1f564c49c671f2dd0ce36f858534ef6d26b55783a06b884cc506
a48e0275b7d9070bcacd31b9c0783f64311179a59736e5d406d7aa710f0530d8
a593628f2d5ba814f37fbcd3963162f094c2764d4b15d82464c2d1aef92f150f
b3358698f44fb7f78990298b1bc66475813b8137848a1ade1940f5d2c297c978
b8e446605f92c29a178dd6494688103ac268004592afe06643df46f4bff68577
bb1fdd5be17ce6cbeb21411a9ba10b99f11bbe232a93b34bec7c4722d763bf52
be9b5382b4526ffd3306d0292122ce3599123f1cd543f52f3035b4f24fbf9de8
bf57df538e41bf2eda3a3f1e8df7897ec6434dddba526e4d58cf2119fc7ac03c
c02ce56fd35592056b2edfa1f543773abbd447c1cdec9177f5a54ca101d74e30
c437eb764a99e6cd5172d63c3fae564bbc51eda4981058d5edebd2bf0700eb76
c4cb43931d4a762bdaffcf2cd5cbe853f461724a94b41e6c4eee4064cdfe5f90
c4d822793b2eab5f9bf345ce530487844b1aeaca83f5fd906f2e9987f6842028
c587a8456339e494f74977ee721b58e4e6bbe979aab78b8776717a6c54f1495c
c89abea900fefa421105ea0fadab0c32b5133cf1be9d21b4ee61a3306a96572e
c8bc330a07fc8ba4ead1f924570b2eeb220dfb170e86ea6594f7a2daef2efc16
ce08fd02ade613214c6416ccac773f24a7bed68f52af453adf7c8a5a2d42ba71
d19b04b1e2461a50b59769e8978cbbb8483b05d7dac2ae6cf590fca9544be990
d269967a042bb6cbe42c7a937a8829f19c6cebbd9346648758824e887e746735
d39a03dcaa2b8733a0acd3f1ba518f58d6144b04752141ef2351dfa68a5313ec
d3ef72e238c35ddcebe71c4d49669e2e4410b6228f6298a6a67fba471c3b8b81
d6213b65a08828f1022b9a019486a430e5e79c99bb31136d162281dd8aa208cb
d94c792491d06150083da8c76512bacad8c6e27770230518306fdcd4fe75a2bc
dc876f814074650acde84db7a7f34c583f043b83130e5de49de65f18d1ee2683
dd65a674c821f6a0e0ec4b181532b00c0cc5d5bde623ea98affcb9f383139b57
ddec013d5b71070fbeec6a1d0616c67b5c1931baf6c56f5b0dbbefb1e6e9728a
e25677f311488dc1509becefd07e120d402caa678322607b9375566631eb0a4d
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e6399fca6cbab33a9b3831e797db3e27e5438340da68f73b02710a3a75f58baf
e89a0eca65394c8b1131887334cc05eb627b6bd4b61d470bd0e4f3bb49fdc4bc
e90fb0eba512ed6473f6fb8acf4cd09b38732f150f43c396246c12bb2aacbb67
e9e9a67395a0d83b584208a19b95af203df8e8e6c6952fe76c690d60ea9381c7
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
efcaf36f21e529a5bb6f0c202b1a6a2c2993fff687c059096c0d191e707c0bb8
f327a0ba3e41b1e8154e1c18fc114baff0bd057151e3afe7fa6f33cc0cb18296
f378974fe6a831ae2f48d9191ea74eb21877d4964d5eedbc2810d8756ed13631
f3b3ce0b74c9de2f12673b3d437febec89d18f60f294546f1cc30fb017f3c756
f51c273fe9f0605c9245e17ebcb6f0603dae22cdff498a28ff8cfe6850d453e8
f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d
f8e44b81ee836ff4807d1f89207fd206753a447bda06d845092f6531da1ee331
ff5150ab5741a5c8345bc7861cb1cab8f574fe17f2cdb2fbc2058311f3d65817
ff5227eec311b65ef7c4057363428eda1fd1a9769713e3d021dc3b7ba73b1fd9

sit58.online.citi.com Open in urlscan Pro 104.70.85.47 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

141 Requests

92 %HTTPS

22 %IPv6

20 Domains

30 Subdomains

27 IPs

5 Countries

3617 kBTransfer

11708 kBSize

41 Cookies

72 Outgoing links

Redirected requests

141 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 2 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

sit58.online.citi.com Open in urlscan Pro
104.70.85.47 Public Scan

Screenshot
Live screenshot

Full Image

141
Requests

92 %
HTTPS

22 %
IPv6

20
Domains

30
Subdomains

27
IPs

5
Countries

3617 kB
Transfer

11708 kB
Size

41
Cookies

141 HTTP transactions
2 data transactions