www.cardbenefits.citi.com Open in urlscan Pro
198.160.105.71 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://click.info15.citi.com/?qs=088db14c64a2c4bb39dcc5d0877ce9582133be68d75049a0977b79c86eb0e046768b0f6f3562b3ddd8f80f5f9ccf...
Effective URL:
https://www.cardbenefits.citi.com/
Submission Tags: falconsandbox
Submission: On April 15 via api (April 15th 2023, 8:33:31 pm UTC) from US — Scanned from DE

Summary HTTP 141 Redirects Links 16 Behaviour Indicators

Summary

This website contacted 23 IPs in 6 countries across 16 domains to perform 141 HTTP transactions. The main IP is 198.160.105.71, located in Conway, United States and belongs to ACXIOM, US. The main domain is www.cardbenefits.citi.com. The Cisco Umbrella rank of the primary domain is 256416.
TLS certificate: Issued by DigiCert EV RSA CA G2 on March 28th 2023. Valid for: a year.

This is the only time www.cardbenefits.citi.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1 1	13.111.71.127 13.111.71.127	22606 (EXACT-7) (EXACT-7)
28	198.160.105.71 198.160.105.71	15026 (ACXIOM) (ACXIOM)
11	18.154.63.96 18.154.63.96	16509 (AMAZON-02) (AMAZON-02)
1 4	52.212.210.65 52.212.210.65	16509 (AMAZON-02) (AMAZON-02)
8	3.124.119.57 3.124.119.57	16509 (AMAZON-02) (AMAZON-02)
24	104.102.43.113 104.102.43.113	16625 (AKAMAI-AS) (AKAMAI-AS)
1	63.33.154.254 63.33.154.254	16509 (AMAZON-02) (AMAZON-02)
2	15.236.125.10 15.236.125.10	16509 (AMAZON-02) (AMAZON-02)
1 1	52.215.88.8 52.215.88.8	16509 (AMAZON-02) (AMAZON-02)
14	2a00:1450:400... 2a00:1450:4001:806::2008	15169 (GOOGLE) (GOOGLE)
1	18.66.248.114 18.66.248.114	16509 (AMAZON-02) (AMAZON-02)
1	2600:9000:224... 2600:9000:224a:b200:1:76cf:fe80:93a1	16509 (AMAZON-02) (AMAZON-02)
1	52.18.34.243 52.18.34.243	16509 (AMAZON-02) (AMAZON-02)
2	193.0.160.130 193.0.160.130	54312 (ROCKETFUEL) (ROCKETFUEL)
1	18.173.233.43 18.173.233.43	16509 (AMAZON-02) (AMAZON-02)
1	35.190.60.146 35.190.60.146	15169 (GOOGLE) (GOOGLE)
11	104.17.208.240 104.17.208.240	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1 2	52.46.151.131 52.46.151.131	16509 (AMAZON-02) (AMAZON-02)
1	192.193.179.248 192.193.179.248	25883 (CITIGROUP) (CITIGROUP)
1	52.35.185.48 52.35.185.48	16509 (AMAZON-02) (AMAZON-02)
9	2a00:1450:400... 2a00:1450:4001:82a::2002	15169 (GOOGLE) (GOOGLE)
9	2a00:1450:400... 2a00:1450:4001:806::2004	15169 (GOOGLE) (GOOGLE)
9	2a00:1450:400... 2a00:1450:4001:810::2003	15169 (GOOGLE) (GOOGLE)
1	2.18.232.194 2.18.232.194	16625 (AKAMAI-AS) (AKAMAI-AS)
141	23

1 13.111.71.127 (United States) 1 redirects

ASN22606 (EXACT-7, US)
PTR: click.info15.citi.com

click.info15.citi.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

28 198.160.105.71 (Conway, United States)

ASN15026 (ACXIOM, US)

www.cardbenefits.citi.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

11 18.154.63.96 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-18-154-63-96.dus51.r.cloudfront.net

nexus.ensighten.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 52.212.210.65 (Dublin, Ireland) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-52-212-210-65.eu-west-1.compute.amazonaws.com

dpm.demdex.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 3.124.119.57 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-3-124-119-57.eu-central-1.compute.amazonaws.com

tagmanager1.citi.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
data.privacy.ensighten.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

24 104.102.43.113 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a104-102-43-113.deploy.static.akamaitechnologies.com

online.citi.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 63.33.154.254 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-63-33-154-254.eu-west-1.compute.amazonaws.com

citi.demdex.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 15.236.125.10 (Paris, France)

ASN16509 (AMAZON-02, US)
PTR: ec2-15-236-125-10.eu-west-3.compute.amazonaws.com

metrics1.citi.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.215.88.8 (Dublin, Ireland) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-52-215-88-8.eu-west-1.compute.amazonaws.com

cm.everesttech.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

14 2a00:1450:4001:806::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 18.66.248.114 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-18-66-248-114.dus51.r.cloudfront.net

static.site24x7rum.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:224a:b200:1:76cf:fe80:93a1 (United States)

ASN16509 (AMAZON-02, US)

c1.rfihub.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.18.34.243 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-52-18-34-243.eu-west-1.compute.amazonaws.com

citicorpcreditservic.tt.omtrdc.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 193.0.160.130 (United States)

ASN54312 (ROCKETFUEL, US)

20766699p.rfihub.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
p.rfihub.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 18.173.233.43 (London, United Kingdom)

ASN16509 (AMAZON-02, US)
PTR: server-18-173-233-43.dus51.r.cloudfront.net

cdn.pbbl.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 35.190.60.146 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 146.60.190.35.bc.googleusercontent.com

sr.rlcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

11 104.17.208.240 (None, )

ASN13335 (CLOUDFLARENET, US)

znbro6yehc0hrkllk-citifeedback.siteintercept.qualtrics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
siteintercept.qualtrics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 52.46.151.131 (Ashburn, United States) 1 redirects

ASN16509 (AMAZON-02, US)

s.amazon-adsystem.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 192.193.179.248 (United States)

ASN25883 (CITIGROUP, US)

prod.report.nacustomerexperience.citi.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.35.185.48 (Boardman, United States)

ASN16509 (AMAZON-02, US)
PTR: ec2-52-35-185-48.us-west-2.compute.amazonaws.com

col.site24x7rum.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

9 2a00:1450:4001:82a::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

9 2a00:1450:4001:806::2004 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

9 2a00:1450:4001:810::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2.18.232.194 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a2-18-232-194.deploy.static.akamaitechnologies.com

iad1.qualtrics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
57	citi.com 1 redirects click.info15.citi.com — Cisco Umbrella Rank: 78417 www.cardbenefits.citi.com — Cisco Umbrella Rank: 256416 tagmanager1.citi.com — Cisco Umbrella Rank: 47440 online.citi.com — Cisco Umbrella Rank: 23054 metrics1.citi.com — Cisco Umbrella Rank: 26897 prod.report.nacustomerexperience.citi.com — Cisco Umbrella Rank: 19543	1 MB
18	ensighten.com nexus.ensighten.com — Cisco Umbrella Rank: 2963 data.privacy.ensighten.com — Cisco Umbrella Rank: 8634	363 KB
14	googletagmanager.com www.googletagmanager.com — Cisco Umbrella Rank: 48	703 KB
12	qualtrics.com znbro6yehc0hrkllk-citifeedback.siteintercept.qualtrics.com — Cisco Umbrella Rank: 332447 siteintercept.qualtrics.com — Cisco Umbrella Rank: 905 iad1.qualtrics.com — Cisco Umbrella Rank: 9852	93 KB
9	google.de www.google.de — Cisco Umbrella Rank: 6074	1 KB
9	google.com www.google.com — Cisco Umbrella Rank: 2	1 KB
9	doubleclick.net googleads.g.doubleclick.net — Cisco Umbrella Rank: 35	12 KB
5	demdex.net 1 redirects dpm.demdex.net — Cisco Umbrella Rank: 204 citi.demdex.net — Cisco Umbrella Rank: 43923	7 KB
2	amazon-adsystem.com 1 redirects s.amazon-adsystem.com — Cisco Umbrella Rank: 292	763 B
2	rfihub.com 20766699p.rfihub.com — Cisco Umbrella Rank: 100711 p.rfihub.com — Cisco Umbrella Rank: 811	1 KB
2	site24x7rum.com static.site24x7rum.com — Cisco Umbrella Rank: 20704 col.site24x7rum.com — Cisco Umbrella Rank: 24321	22 KB
1	rlcdn.com sr.rlcdn.com — Cisco Umbrella Rank: 14048	98 B
1	pbbl.co cdn.pbbl.co — Cisco Umbrella Rank: 7444
1	omtrdc.net citicorpcreditservic.tt.omtrdc.net — Cisco Umbrella Rank: 31110	1 KB
1	rfihub.net c1.rfihub.net — Cisco Umbrella Rank: 4830	6 KB
1	everesttech.net 1 redirects cm.everesttech.net — Cisco Umbrella Rank: 1079	517 B
141	16

	Domain	Requested by
28	www.cardbenefits.citi.com	www.cardbenefits.citi.com nexus.ensighten.com
24	online.citi.com	nexus.ensighten.com online.citi.com
14	www.googletagmanager.com	nexus.ensighten.com
11	nexus.ensighten.com	www.cardbenefits.citi.com nexus.ensighten.com
10	siteintercept.qualtrics.com	nexus.ensighten.com
9	www.google.de
9	www.google.com
9	googleads.g.doubleclick.net	nexus.ensighten.com
7	data.privacy.ensighten.com	www.cardbenefits.citi.com
4	dpm.demdex.net	1 redirects www.cardbenefits.citi.com nexus.ensighten.com
2	s.amazon-adsystem.com	1 redirects
2	metrics1.citi.com	nexus.ensighten.com www.cardbenefits.citi.com
1	iad1.qualtrics.com
1	col.site24x7rum.com	nexus.ensighten.com
1	prod.report.nacustomerexperience.citi.com	nexus.ensighten.com
1	znbro6yehc0hrkllk-citifeedback.siteintercept.qualtrics.com	nexus.ensighten.com
1	sr.rlcdn.com	nexus.ensighten.com
1	cdn.pbbl.co	nexus.ensighten.com
1	p.rfihub.com	nexus.ensighten.com
1	20766699p.rfihub.com	nexus.ensighten.com
1	citicorpcreditservic.tt.omtrdc.net	nexus.ensighten.com
1	c1.rfihub.net	nexus.ensighten.com
1	static.site24x7rum.com	nexus.ensighten.com
1	cm.everesttech.net	1 redirects
1	citi.demdex.net	nexus.ensighten.com
1	tagmanager1.citi.com	nexus.ensighten.com
1	click.info15.citi.com	1 redirects
141	27

This site contains links to these domains. Also see Links.

Domain
online.citi.com
citientertainment.com
www.citigroup.com

Subject Issuer	Validity	Valid
www.cardbenefits.citi.com DigiCert EV RSA CA G2	`2023-03-28` - `2024-04-09`	a year	crt.sh
nexus.ensighten.com DigiCert TLS RSA SHA256 2020 CA1	`2022-10-07` - `2023-10-14`	a year	crt.sh
tagmanager1.citi.com DigiCert EV RSA CA G2	`2022-09-21` - `2023-09-22`	a year	crt.sh
online.citibank.com DigiCert SHA2 Extended Validation Server CA	`2022-05-03` - `2023-05-16`	a year	crt.sh
*.demdex.com DigiCert TLS RSA SHA256 2020 CA1	`2022-09-26` - `2023-10-27`	a year	crt.sh
metrics1.citi.com DigiCert EV RSA CA G2	`2022-07-22` - `2023-08-22`	a year	crt.sh
*.google-analytics.com GTS CA 1C3	`2023-03-28` - `2023-06-20`	3 months	crt.sh
*.site24x7rum.com Amazon RSA 2048 M01	`2023-02-28` - `2023-08-29`	6 months	crt.sh
*.privacy.ensighten.com DigiCert TLS RSA SHA256 2020 CA1	`2023-02-03` - `2024-02-16`	a year	crt.sh
*.rfihub.net Amazon RSA 2048 M01	`2023-02-24` - `2023-12-29`	10 months	crt.sh
*.tt.omtrdc.net DigiCert TLS RSA SHA256 2020 CA1	`2022-08-01` - `2023-09-01`	a year	crt.sh
*.rfihub.com Sectigo RSA Domain Validation Secure Server CA	`2022-05-24` - `2023-05-24`	a year	crt.sh
*.pbbl.co Amazon RSA 2048 M02	`2023-02-28` - `2023-11-02`	8 months	crt.sh
*.rlcdn.com Sectigo RSA Domain Validation Secure Server CA	`2023-02-02` - `2024-03-03`	a year	crt.sh
*.qualtrics.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2023-03-27` - `2024-03-26`	a year	crt.sh
prod.report.nacustomerexperience.citi.com DigiCert EV RSA CA G2	`2022-05-31` - `2023-07-01`	a year	crt.sh
*.g.doubleclick.net GTS CA 1C3	`2023-03-28` - `2023-06-20`	3 months	crt.sh
www.google.com GTS CA 1C3	`2023-03-28` - `2023-06-20`	3 months	crt.sh
www.google.de GTS CA 1C3	`2023-03-28` - `2023-06-20`	3 months	crt.sh

This page contains 5 frames:

Primary Page: https://www.cardbenefits.citi.com/
Frame ID: 322004A3663F7897AFD04DCCAF2EFCE0
Requests: 136 HTTP requests in this frame

Frame: https://citi.demdex.net/dest5.html?d_nsid=0
Frame ID: 653CAEBEAB7F90F683970487DCBD8BE2
Requests: 1 HTTP requests in this frame

Frame: https://20766699p.rfihub.com/ca.html?ver=9&ra=606&rb=648&ca=20766699&_o=17169175&_t=benefitshome&_rev=1&_pcode=1&_orderid=1&ssv_cuuid=&ssv_package=null&ssv_prodlist=null&ssv_pagename=benefitshome&pe=https%3A%2F%2Fwww.cardbenefits.citi.com%2F&pf=&ra=37360917615609224
Frame ID: 0BBB542F8ADDE05629C0F158BBA60CF9
Requests: 1 HTTP requests in this frame

Frame: https://p.rfihub.com/ca.html?ver=9&ra=1198&rb=648&ca=&_o=17169175&_t=&pe=https%3A%2F%2Fwww.cardbenefits.citi.com%2F&pf=&ra=16712557739443
Frame ID: 3CEBC2647C2ACDF4937006F3AB89810A
Requests: 1 HTTP requests in this frame

Frame: https://sr.rlcdn.com/425466.html?es=80676&u=da39a3ee5e6b4b0d3255bfef95601890afd80709
Frame ID: 89B1FBB0B15088D9434B0B7B190FAD60
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Citi® Card Benefits - Credit Card Benefits for Citi Customers

Page URL History Show full URLs

https://click.info15.citi.com/?qs=088db14c64a2c4bb39dcc5d0877ce9582133be68d75049a0977b79c86eb0e046768b0f6f... HTTP 302
https://www.cardbenefits.citi.com/ Page URL

Detected technologies

Bootstrap (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css
bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js

Ensighten (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

//nexus\.ensighten\.com/

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/gtag/js

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

jQuery UI (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery-ui[.-]([\d.]*\d)[^/]*\.js
jquery-ui.*\.js

Page Statistics

141
Requests

97 %
HTTPS

21 %
IPv6

16
Domains

27
Subdomains

23
IPs

6
Countries

2449 kB
Transfer

7633 kB
Size

41
Cookies

16 Outgoing links

These are links going to different origins than the main page.

URL: https://online.citi.com/US/JSO/loginpage/retarget.action?next_page=jfp%7cjjba_common_BenefitBuilder&deepdrop=true&loginscreenId=CardBenefitsLandingPage
Title: Sign On

Search URL Search Domain Scan URL

URL: https://online.citi.com/US/JRS/infrastructure/retarget.do?next_page=jfp|jcbol_quickLock_CqlLanding
Title: Citi® Quick Lock

Search URL Search Domain Scan URL

URL: https://online.citi.com/US/JRS/portal.c?ID=CitiDigitalServices&section=Citi-Mobile-App
Title: Citi® Mobile App

Search URL Search Domain Scan URL

URL: https://citientertainment.com/
Title: Citi Entertainment®

Search URL Search Domain Scan URL

URL: https://online.citi.com/US/JPS/portal/Index.do
Title: Accounts

Search URL Search Domain Scan URL

URL: https://www.citigroup.com/citi/homepage/
Title: About Citigroup

Search URL Search Domain Scan URL

URL: https://online.citi.com/US/JRS/pands/detail.do?ID=SecurityCenter&JFP_TOKEN=NDGKWLC
Title: Security

Search URL Search Domain Scan URL

URL: https://online.citi.com/US/JRS/portal/template.do?ID=TermsDisclaimer&JFP_TOKEN=U7YG5FI0
Title: Terms & Conditions

Search URL Search Domain Scan URL

URL: https://online.citi.com/US/JRS/portal/template.do?ID=Privacy&JFP_TOKEN=0BBXJ7ZQ
Title: Privacy

Search URL Search Domain Scan URL

URL: https://online.citi.com/credit-cards/creditcards/CitiHome.do
Title: Citicards.com

Search URL Search Domain Scan URL

URL: https://online.citi.com/US/JRS/portal/template.do?ID=Privacy#notice-at-collection
Title: Notice At Collection

Search URL Search Domain Scan URL

URL: https://online.citi.com/US/ag/dataprivacyhub
Title: CA Privacy Hub

Search URL Search Domain Scan URL

URL: https://online.citi.com/US/JRS/pands/detail.do?ID=SecurityCenter&JFP_TOKEN=NDGKWLC8
Title: Security

Search URL Search Domain Scan URL

URL: https://online.citi.com/US/JRS/helpcenter/main.do?JFP_TOKEN=2RD9J9XF
Title: Help

Search URL Search Domain Scan URL

URL: https://online.citi.com/US/ag/contactus
Title: Contact Us

Search URL Search Domain Scan URL

URL: https://online.citi.com/US/JRS/portal/template.do?ID=Privacy#info-manage
Title: Privacy Policy

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://click.info15.citi.com/?qs=088db14c64a2c4bb39dcc5d0877ce9582133be68d75049a0977b79c86eb0e046768b0f6f3562b3ddd8f80f5f9ccf28888431525c25467a82740b15822a557c6e HTTP 302
https://www.cardbenefits.citi.com/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 22

https://dpm.demdex.net/id?d_visid_ver=4.4.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=61834D9B5228A7430A490D45%40AdobeOrg&d_nsid=0&ts=1681590803186 HTTP 302
https://dpm.demdex.net/id/rd?d_visid_ver=4.4.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=61834D9B5228A7430A490D45%40AdobeOrg&d_nsid=0&ts=1681590803186

Request Chain 44

https://cm.everesttech.net/cm/dd?d_uuid=75154193643650581252082693921030427431 HTTP 302
https://dpm.demdex.net/ibs:dpid=411&dpuuid=ZDsKFAAAAN7_QwNe

Request Chain 63

https://s.amazon-adsystem.com/iu3?pid=c3702eea-109e-48b0-9ef4-c856bdd405e2&event=PageView HTTP 302
https://s.amazon-adsystem.com/iu3?pid=c3702eea-109e-48b0-9ef4-c856bdd405e2&event=PageView&dcc=t

141 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1

200
OK

Primary Request / Show response
www.cardbenefits.citi.com/
Redirect Chain

https://click.info15.citi.com/?qs=088db14c64a2c4bb39dcc5d0877ce9582133be68d75049a0977b79c86eb0e046768b0f6f3562b3ddd8f80f5f9ccf28888431525c25467a82740b15822a557c6e
https://www.cardbenefits.citi.com/

54 KB
10 KB

1285ms
608ms

Document
text/html

198.160.105.71
ACXIOM

General

Check archive.org

Show headers Download Go to

Full URL

https://www.cardbenefits.citi.com/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

198.160.105.71 Conway, United States, ASN15026 (ACXIOM, US),

Reverse DNS

Software

Resource Hash

1e0e6122c92a80dbf98084bdcd33e8c41cc58a26945ce8fac8318f63427663d2

Security Headers

Name	Value
Strict-Transport-Security	max-age=157680000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.49 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Cache-Control: public, no-cache="Set-Cookie", no-store, max-age=0
Content-Encoding: gzip
Content-Length: 9433
Content-Type: text/html; charset=utf-8
Cteonnt-Length: 55477
Date: Sat, 15 Apr 2023 20:33:19 GMT
Expires: Sat, 15 Apr 2023 20:33:19 GMT
Last-Modified: Sat, 15 Apr 2023 20:33:19 GMT
Strict-Transport-Security: max-age=157680000; includeSubDomains
Vary: *
X-Content-Type-Options: nosniff
X-Frame-Options: SAMEORIGIN
X-UA-Compatible: IE=edge
X-XSS-Protection: 1; mode=block

Redirect headers

Cache-Control: private
Connection: close
Content-Length: 150
Content-Type: text/html; charset=utf-8
Date: Sat, 15 Apr 2023 20:33:20 GMT
Location: https://www.cardbenefits.citi.com

GET
H/1.1 200
OK bootstrap.min.css
www.cardbenefits.citi.com/dist/css/bootstrap/ 119 KB
22 KB 160ms
159ms Stylesheet
text/css 198.160.105.71
ACXIOM

General

Check archive.org

Show headers Download Go to

Full URL

https://www.cardbenefits.citi.com/dist/css/bootstrap/bootstrap.min.css

Requested by

Host: www.cardbenefits.citi.com
URL: https://www.cardbenefits.citi.com/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

198.160.105.71 Conway, United States, ASN15026 (ACXIOM, US),

Reverse DNS

Software

Resource Hash

dc6ffe00ea357a0f8ce9d0104243cd52ed4a09e4c4594d27dbe5b44c3af92c4d

Security Headers

Name	Value
Strict-Transport-Security	max-age=157680000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.49 Safari/537.36

Response headers

Cteonnt-Length: 121462
Date: Sat, 15 Apr 2023 20:33:20 GMT
Strict-Transport-Security: max-age=157680000; includeSubDomains
X-Content-Type-Options: nosniff
Last-Modified: Thu, 07 Jan 2021 03:35:30 GMT
Content-Encoding: gzip
ETag: "06d9125a6e4d61:0"
X-Frame-Options: SAMEORIGIN
Transfer-Encoding: chunked
Content-Type: text/css
Cache-Control: max-age=600
Accept-Ranges: bytes
X-XSS-Protection: 1; mode=block
X-UA-Compatible: IE=edge

GET
H/1.1 200
OK normalize.css
www.cardbenefits.citi.com/dist/css/normalize/ 8 KB
3 KB 308ms
147ms Stylesheet
text/css 198.160.105.71
ACXIOM

General

Check archive.org

Show headers Download Go to

Full URL

https://www.cardbenefits.citi.com/dist/css/normalize/normalize.css

Requested by

Host: www.cardbenefits.citi.com
URL: https://www.cardbenefits.citi.com/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

198.160.105.71 Conway, United States, ASN15026 (ACXIOM, US),

Reverse DNS

Software

Resource Hash

055395b01212455e2e3cf174208947ef347110b0a0d8710f097237698d8eee2b

Security Headers

Name	Value
Strict-Transport-Security	max-age=157680000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.49 Safari/537.36

Response headers

Cteonnt-Length: 8223
Date: Sat, 15 Apr 2023 20:33:20 GMT
Strict-Transport-Security: max-age=157680000; includeSubDomains
X-Content-Type-Options: nosniff
Last-Modified: Thu, 07 Jan 2021 03:35:30 GMT
Content-Encoding: gzip
ETag: "06d9125a6e4d61:0"
X-Frame-Options: SAMEORIGIN
Content-Type: text/css
Cache-Control: max-age=600
Accept-Ranges: bytes
Content-Length: 2721
X-XSS-Protection: 1; mode=block
X-UA-Compatible: IE=edge

GET
H/1.1 200
OK main.css
www.cardbenefits.citi.com/dist/css/ 546 KB
71 KB 454ms
144ms Stylesheet
text/css 198.160.105.71
ACXIOM

General

Check archive.org

Show headers Download Go to

Full URL

https://www.cardbenefits.citi.com/dist/css/main.css

Requested by

Host: www.cardbenefits.citi.com
URL: https://www.cardbenefits.citi.com/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

198.160.105.71 Conway, United States, ASN15026 (ACXIOM, US),

Reverse DNS

Software

Resource Hash

d93e11694f5d600c28cb6aca785fc6fb0a199bb1185a4a18eef5794ed9c64fc4

Security Headers

Name	Value
Strict-Transport-Security	max-age=157680000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.49 Safari/537.36

Response headers

Date: Sat, 15 Apr 2023 20:33:20 GMT
Strict-Transport-Security: max-age=157680000; includeSubDomains
X-Content-Type-Options: nosniff
Last-Modified: Wed, 26 Oct 2022 19:50:34 GMT
Content-Encoding: gzip
ETag: "d2394c3674e9d81:0"
ntCoent-Length: 558643
X-Frame-Options: SAMEORIGIN
Transfer-Encoding: chunked
Content-Type: text/css
Cache-Control: max-age=600
Accept-Ranges: bytes
X-XSS-Protection: 1; mode=block
X-UA-Compatible: IE=edge

GET jquery-ui.css
www.cardbenefits.citi.com/dist/css/ 0
0

GET
H2 200 Bootstrap.js Show response
nexus.ensighten.com/citi/na_prod/ 672 KB
156 KB 115ms
27ms Script
application/javascript 18.154.63.96
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Requested by: Host: www.cardbenefits.citi.com
URL: https://www.cardbenefits.citi.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.154.63.96 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-154-63-96.dus51.r.cloudfront.net
Software: CloudFront /
Resource Hash: 1c8b26febbe628f7d600bf1c0e1f2f5a22bfa052068f0dd1b14aa11d69c1bfcf

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.49 Safari/537.36

Response headers

date: Wed, 05 Apr 2023 13:55:43 GMT
x-amz-version-id: _br49G5SAbV3fClp.KC2Rz.4kgoAkVPZ
content-encoding: br
via: 1.1 7965c3a45d2bf992e197c959a86e759c.cloudfront.net (CloudFront)
x-amz-cf-pop: DUS51-P4
age: 887860
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: PENDING
last-modified: Wed, 05 Apr 2023 13:55:26 GMT
server: CloudFront
etag: W/"6b8d95dde33245c8b98b6b0e43303671"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
cache-control: max-age=300
x-amz-cf-id: gdFl5xUBX0uLJCoBoII4aKxY-L1nt1kEExX7pvNdQ39pTTYgccXyRQ==

GET
H/1.1 200
OK citi-logo.ashx
www.cardbenefits.citi.com/~/media/CPP/Images/Mobile%20Header%20Images/ 1 KB
2 KB 166ms
164ms Image
image/svg+xml 198.160.105.71
ACXIOM

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.cardbenefits.citi.com/~/media/CPP/Images/Mobile%20Header%20Images/citi-logo.ashx?h=35&la=en&hash=BBAE62BB1D9D4FEB7848F3938B8C223CE16EB6B5

Requested by

Host: www.cardbenefits.citi.com
URL: https://www.cardbenefits.citi.com/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

198.160.105.71 Conway, United States, ASN15026 (ACXIOM, US),

Reverse DNS

Software

Resource Hash

d3bbc6374810ab19b58d5c46134a0957d4c24d78a6f459b941697bb9f5006416

Security Headers

Name	Value
Strict-Transport-Security	max-age=157680000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.49 Safari/537.36

Response headers

Date: Sat, 15 Apr 2023 20:33:21 GMT
Strict-Transport-Security: max-age=157680000; includeSubDomains
X-Content-Type-Options: nosniff
Last-Modified: Tue, 18 Sep 2018 18:32:01 GMT
X-Frame-Options: SAMEORIGIN
Content-Type: image/svg+xml
Cache-Control: private
Content-Disposition: inline; filename="citi-logo.svg"
Accept-Ranges: bytes
Content-Length: 1110
X-XSS-Protection: 1; mode=block
X-UA-Compatible: IE=edge

GET
H/1.1 200
OK Hero_DSK2B-1.ashx
www.cardbenefits.citi.com/~/media/CPP/Images/Hero/ 83 KB
83 KB 166ms
165ms Image
image/jpeg 198.160.105.71
ACXIOM

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.cardbenefits.citi.com/~/media/CPP/Images/Hero/Hero_DSK2B-1.ashx?h=270&w=1200&la=en&hash=504917D0E1CA596DC03365CE73BAEB85A9E12521

Requested by

Host: www.cardbenefits.citi.com
URL: https://www.cardbenefits.citi.com/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

198.160.105.71 Conway, United States, ASN15026 (ACXIOM, US),

Reverse DNS

Software

Resource Hash

42807acf8a1f94395ba975771af6eb599e8e016605a8d52560caaf32d6622088

Security Headers

Name	Value
Strict-Transport-Security	max-age=157680000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.49 Safari/537.36

Response headers

Date: Sat, 15 Apr 2023 20:33:21 GMT
Strict-Transport-Security: max-age=157680000; includeSubDomains
X-Content-Type-Options: nosniff
Last-Modified: Tue, 07 Nov 2017 21:41:51 GMT
X-Frame-Options: SAMEORIGIN
Content-Type: image/jpeg
Cache-Control: private
Content-Disposition: inline; filename="Hero_DSK2B-1.jpg"
Accept-Ranges: bytes
Content-Length: 84553
X-XSS-Protection: 1; mode=block
X-UA-Compatible: IE=edge

GET
H/1.1 200
OK Hero_MOB2.ashx
www.cardbenefits.citi.com/~/media/CPP/Images/Hero/Mobile/ 16 KB
17 KB 169ms
168ms Image
image/jpeg 198.160.105.71
ACXIOM

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.cardbenefits.citi.com/~/media/CPP/Images/Hero/Mobile/Hero_MOB2.ashx?h=100&w=320&la=en&hash=C97B872C7DBBBE1101F8DCB4FDD3D0B0CE0B15D2

Requested by

Host: www.cardbenefits.citi.com
URL: https://www.cardbenefits.citi.com/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

198.160.105.71 Conway, United States, ASN15026 (ACXIOM, US),

Reverse DNS

Software

Resource Hash

ad484c2e3d0b602969f1217b2e2485bfb17d53e319a77ade0d513c15ceed6d75

Security Headers

Name	Value
Strict-Transport-Security	max-age=157680000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.49 Safari/537.36

Response headers

Date: Sat, 15 Apr 2023 20:33:21 GMT
Strict-Transport-Security: max-age=157680000; includeSubDomains
X-Content-Type-Options: nosniff
Last-Modified: Mon, 09 May 2016 14:07:26 GMT
X-Frame-Options: SAMEORIGIN
Content-Type: image/jpeg
Cache-Control: private
Content-Disposition: inline; filename="Hero_MOB2.jpg"
Accept-Ranges: bytes
Content-Length: 16525
X-XSS-Protection: 1; mode=block
X-UA-Compatible: IE=edge

GET
H/1.1 200
OK TravelBenefitsIcon.ashx
www.cardbenefits.citi.com/~/media/CPP/Images/Category/Icons/ 399 B
1 KB 842ms
150ms Image
image/png 198.160.105.71
ACXIOM

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.cardbenefits.citi.com/~/media/CPP/Images/Category/Icons/TravelBenefitsIcon.ashx?h=18&w=23&la=en&hash=64473774D00235420EF8408DEAA6C6C34A8903BC

Requested by

Host: www.cardbenefits.citi.com
URL: https://www.cardbenefits.citi.com/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

198.160.105.71 Conway, United States, ASN15026 (ACXIOM, US),

Reverse DNS

Software

Resource Hash

fbc8f05345ac48ed8255d901fcf2c119ff9fe774762ec9a04aba3f3a4697aa90

Security Headers

Name	Value
Strict-Transport-Security	max-age=157680000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.49 Safari/537.36

Response headers

Date: Sat, 15 Apr 2023 20:33:21 GMT
Strict-Transport-Security: max-age=157680000; includeSubDomains
X-Content-Type-Options: nosniff
Last-Modified: Thu, 25 Feb 2016 19:00:53 GMT
X-Frame-Options: SAMEORIGIN
Content-Type: image/png
Cache-Control: private
Content-Disposition: inline; filename="TravelBenefitsIcon.png"
Accept-Ranges: bytes
Content-Length: 399
X-XSS-Protection: 1; mode=block
X-UA-Compatible: IE=edge

GET
H/1.1 200
OK travel2.ashx
www.cardbenefits.citi.com/~/media/CPP/Images/Category/Hero/ 17 KB
18 KB 849ms
147ms Image
image/jpeg 198.160.105.71
ACXIOM

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.cardbenefits.citi.com/~/media/CPP/Images/Category/Hero/travel2.ashx?h=125&w=660&la=en&hash=D9922AB1BABBBEF7E9E37DF7F18625DF8116F1C3

Requested by

Host: www.cardbenefits.citi.com
URL: https://www.cardbenefits.citi.com/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

198.160.105.71 Conway, United States, ASN15026 (ACXIOM, US),

Reverse DNS

Software

Resource Hash

4ad163bc0b11d1be18088e84afc86ab7e863f2c88015c54700b5ce0327a2b2ea

Security Headers

Name	Value
Strict-Transport-Security	max-age=157680000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.49 Safari/537.36

Response headers

Date: Sat, 15 Apr 2023 20:33:21 GMT
Strict-Transport-Security: max-age=157680000; includeSubDomains
X-Content-Type-Options: nosniff
Last-Modified: Fri, 06 May 2016 15:28:17 GMT
X-Frame-Options: SAMEORIGIN
Content-Type: image/jpeg
Cache-Control: private
Content-Disposition: inline; filename="travel2.jpg"
Accept-Ranges: bytes
Content-Length: 17496
X-XSS-Protection: 1; mode=block
X-UA-Compatible: IE=edge

GET
H/1.1 200
OK ShoppingBenefitsIcons.ashx
www.cardbenefits.citi.com/~/media/CPP/Images/Category/Icons/ 392 B
1 KB 661ms
149ms Image
image/png 198.160.105.71
ACXIOM

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.cardbenefits.citi.com/~/media/CPP/Images/Category/Icons/ShoppingBenefitsIcons.ashx?h=18&w=14&la=en&hash=7D37BDFDC185BBD7C8FA112E05EBD55AECE53B19

Requested by

Host: www.cardbenefits.citi.com
URL: https://www.cardbenefits.citi.com/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

198.160.105.71 Conway, United States, ASN15026 (ACXIOM, US),

Reverse DNS

Software

Resource Hash

2f4c746d966ec923f094efcffe16b9e6319cfb49348b3c9b7fde387784494419

Security Headers

Name	Value
Strict-Transport-Security	max-age=157680000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.49 Safari/537.36

Response headers

Date: Sat, 15 Apr 2023 20:33:21 GMT
Strict-Transport-Security: max-age=157680000; includeSubDomains
X-Content-Type-Options: nosniff
Last-Modified: Thu, 25 Feb 2016 19:00:48 GMT
X-Frame-Options: SAMEORIGIN
Content-Type: image/png
Cache-Control: private
Content-Disposition: inline; filename="ShoppingBenefitsIcons.png"
Accept-Ranges: bytes
Content-Length: 392
X-XSS-Protection: 1; mode=block
X-UA-Compatible: IE=edge

GET
H/1.1 200
OK shopping2.ashx
www.cardbenefits.citi.com/~/media/CPP/Images/Category/Hero/ 12 KB
12 KB 510ms
155ms Image
image/jpeg 198.160.105.71
ACXIOM

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.cardbenefits.citi.com/~/media/CPP/Images/Category/Hero/shopping2.ashx?h=125&w=660&la=en&hash=4710E9A61F9E03DD0F550DB50567569CF5F7D831

Requested by

Host: www.cardbenefits.citi.com
URL: https://www.cardbenefits.citi.com/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

198.160.105.71 Conway, United States, ASN15026 (ACXIOM, US),

Reverse DNS

Software

Resource Hash

8ef89f069ba574abd891892cf4a8d628a02c4959108604bf06d5965e1aba262e

Security Headers

Name	Value
Strict-Transport-Security	max-age=157680000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.49 Safari/537.36

Response headers

Date: Sat, 15 Apr 2023 20:33:21 GMT
Strict-Transport-Security: max-age=157680000; includeSubDomains
X-Content-Type-Options: nosniff
Last-Modified: Fri, 06 May 2016 15:28:16 GMT
X-Frame-Options: SAMEORIGIN
Content-Type: image/jpeg
Cache-Control: private
Content-Disposition: inline; filename="shopping2.jpg"
Accept-Ranges: bytes
Content-Length: 11906
X-XSS-Protection: 1; mode=block
X-UA-Compatible: IE=edge

GET
H/1.1 200
OK CreditandAcctIcon.ashx
www.cardbenefits.citi.com/~/media/CPP/Images/Category/Icons/ 496 B
1 KB 672ms
146ms Image
image/png 198.160.105.71
ACXIOM

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.cardbenefits.citi.com/~/media/CPP/Images/Category/Icons/CreditandAcctIcon.ashx?h=20&w=14&la=en&hash=6ECE14EDECED6AEA66A6D6DA54C6908AB5B9BDFC

Requested by

Host: www.cardbenefits.citi.com
URL: https://www.cardbenefits.citi.com/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

198.160.105.71 Conway, United States, ASN15026 (ACXIOM, US),

Reverse DNS

Software

Resource Hash

3dca846f585486c23de116f5d0c0b335876f8b297ec59f2bc71b0fdbbf4af734

Security Headers

Name	Value
Strict-Transport-Security	max-age=157680000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.49 Safari/537.36

Response headers

Date: Sat, 15 Apr 2023 20:33:21 GMT
Strict-Transport-Security: max-age=157680000; includeSubDomains
X-Content-Type-Options: nosniff
Last-Modified: Thu, 25 Feb 2016 19:00:40 GMT
X-Frame-Options: SAMEORIGIN
Content-Type: image/png
Cache-Control: private
Content-Disposition: inline; filename="CreditandAcctIcon.png"
Accept-Ranges: bytes
Content-Length: 496
X-XSS-Protection: 1; mode=block
X-UA-Compatible: IE=edge

GET
H/1.1 200
OK credit2.ashx
www.cardbenefits.citi.com/~/media/CPP/Images/Category/Hero/ 12 KB
13 KB 542ms
147ms Image
image/jpeg 198.160.105.71
ACXIOM

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.cardbenefits.citi.com/~/media/CPP/Images/Category/Hero/credit2.ashx?h=125&w=660&la=en&hash=598CE6931A582950C56D17B56AFC7EBB736135C5

Requested by

Host: www.cardbenefits.citi.com
URL: https://www.cardbenefits.citi.com/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

198.160.105.71 Conway, United States, ASN15026 (ACXIOM, US),

Reverse DNS

Software

Resource Hash

01f511247bc8f93f4fb4117396a63b2659a0f3d75dee6473f75dc748749899b0

Security Headers

Name	Value
Strict-Transport-Security	max-age=157680000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.49 Safari/537.36

Response headers

Date: Sat, 15 Apr 2023 20:33:21 GMT
Strict-Transport-Security: max-age=157680000; includeSubDomains
X-Content-Type-Options: nosniff
Last-Modified: Mon, 13 Jul 2020 19:02:32 GMT
X-Frame-Options: SAMEORIGIN
Content-Type: image/jpeg
Cache-Control: private
Content-Disposition: inline; filename="credit2.jpg"
Accept-Ranges: bytes
Content-Length: 12409
X-XSS-Protection: 1; mode=block
X-UA-Compatible: IE=edge

GET
H/1.1 200
OK plus-box.png
www.cardbenefits.citi.com/dist/imgs/ 1 KB
2 KB 636ms
142ms Image
image/png 198.160.105.71
ACXIOM

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.cardbenefits.citi.com/dist/imgs/plus-box.png

Requested by

Host: www.cardbenefits.citi.com
URL: https://www.cardbenefits.citi.com/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

198.160.105.71 Conway, United States, ASN15026 (ACXIOM, US),

Reverse DNS

Software

Resource Hash

c3e16766123a0f9a90724242f8ea37b32e9138b60d8b3fed3b45e7f06b6f8b9e

Security Headers

Name	Value
Strict-Transport-Security	max-age=157680000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.49 Safari/537.36

Response headers

Date: Sat, 15 Apr 2023 20:33:21 GMT
Strict-Transport-Security: max-age=157680000; includeSubDomains
X-Content-Type-Options: nosniff
Last-Modified: Thu, 07 Jan 2021 03:35:30 GMT
ETag: "06d9125a6e4d61:0"
X-Frame-Options: SAMEORIGIN
Content-Type: image/png
Cache-Control: max-age=600
Accept-Ranges: bytes
Content-Length: 1024
X-XSS-Protection: 1; mode=block
X-UA-Compatible: IE=edge

GET
H/1.1 200
OK DiningIcon.ashx
www.cardbenefits.citi.com/~/media/CPP/Images/Category/Icons/ 583 B
1 KB 525ms
151ms Image
image/png 198.160.105.71
ACXIOM

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.cardbenefits.citi.com/~/media/CPP/Images/Category/Icons/DiningIcon.ashx?h=21&w=19&la=en&hash=49221EA4810DF6A47BCC619D2F939FDFC976B194

Requested by

Host: www.cardbenefits.citi.com
URL: https://www.cardbenefits.citi.com/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

198.160.105.71 Conway, United States, ASN15026 (ACXIOM, US),

Reverse DNS

Software

Resource Hash

d31442e80150b0898d0d5598d6b0d828cf70f8b0fdf347969478139b9e956adb

Security Headers

Name	Value
Strict-Transport-Security	max-age=157680000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.49 Safari/537.36

Response headers

Date: Sat, 15 Apr 2023 20:33:21 GMT
Strict-Transport-Security: max-age=157680000; includeSubDomains
X-Content-Type-Options: nosniff
Last-Modified: Thu, 25 Feb 2016 19:00:41 GMT
X-Frame-Options: SAMEORIGIN
Content-Type: image/png
Cache-Control: private
Content-Disposition: inline; filename="DiningIcon.png"
Accept-Ranges: bytes
Content-Length: 583
X-XSS-Protection: 1; mode=block
X-UA-Compatible: IE=edge

GET
H/1.1 200
OK 251201_ImageUpdate_C_660x125.ashx
www.cardbenefits.citi.com/~/media/CPP/Images/Category/Hero/ 20 KB
20 KB 147ms
146ms Image
image/jpeg 198.160.105.71
ACXIOM

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.cardbenefits.citi.com/~/media/CPP/Images/Category/Hero/251201_ImageUpdate_C_660x125.ashx?h=125&w=660&la=en&hash=743B7EC45BE956EF060A21556182FD408777F4BF

Requested by

Host: www.cardbenefits.citi.com
URL: https://www.cardbenefits.citi.com/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

198.160.105.71 Conway, United States, ASN15026 (ACXIOM, US),

Reverse DNS

Software

Resource Hash

26a10d37ec90a75c776be14d420d658a5dfa21e8a02cb5089c0cc7736fd18e72

Security Headers

Name	Value
Strict-Transport-Security	max-age=157680000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.49 Safari/537.36

Response headers

Date: Sat, 15 Apr 2023 20:33:21 GMT
Strict-Transport-Security: max-age=157680000; includeSubDomains
X-Content-Type-Options: nosniff
Last-Modified: Thu, 07 May 2020 16:01:02 GMT
X-Frame-Options: SAMEORIGIN
Content-Type: image/jpeg
Cache-Control: private
Content-Disposition: inline; filename="251201_ImageUpdate_C_660x125.jpg"
Accept-Ranges: bytes
Content-Length: 20280
X-XSS-Protection: 1; mode=block
X-UA-Compatible: IE=edge

GET
H/1.1 200
OK back_to_top_arrow.png
www.cardbenefits.citi.com/dist/imgs/ 1018 B
2 KB 144ms
144ms Image
image/png 198.160.105.71
ACXIOM

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.cardbenefits.citi.com/dist/imgs/back_to_top_arrow.png

Requested by

Host: www.cardbenefits.citi.com
URL: https://www.cardbenefits.citi.com/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

198.160.105.71 Conway, United States, ASN15026 (ACXIOM, US),

Reverse DNS

Software

Resource Hash

46457c35c25b4611c5c93a9ce12446e4deb3d574d4238149e7666f274cdbfee1

Security Headers

Name	Value
Strict-Transport-Security	max-age=157680000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.49 Safari/537.36

Response headers

Date: Sat, 15 Apr 2023 20:33:21 GMT
Strict-Transport-Security: max-age=157680000; includeSubDomains
X-Content-Type-Options: nosniff
Last-Modified: Thu, 07 Jan 2021 03:35:30 GMT
ETag: "06d9125a6e4d61:0"
X-Frame-Options: SAMEORIGIN
Content-Type: image/png
Cache-Control: max-age=600
Accept-Ranges: bytes
Content-Length: 1018
X-XSS-Protection: 1; mode=block
X-UA-Compatible: IE=edge

GET
H/1.1 200
OK site-logo.ashx
www.cardbenefits.citi.com/~/media/CPP/Images/Logos/ 3 KB
3 KB 142ms
142ms Image
image/png 198.160.105.71
ACXIOM

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.cardbenefits.citi.com/~/media/CPP/Images/Logos/site-logo.ashx?h=40&la=en&w=67&hash=CD812D61EF81FAEA356E7A86ED7038D143EC9FC2

Requested by

Host: www.cardbenefits.citi.com
URL: https://www.cardbenefits.citi.com/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

198.160.105.71 Conway, United States, ASN15026 (ACXIOM, US),

Reverse DNS

Software

Resource Hash

839317a8bb731ea99e1a77bf48525baddcf5d65cb2fbd4f8d188934c336f4530

Security Headers

Name	Value
Strict-Transport-Security	max-age=157680000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.49 Safari/537.36

Response headers

Date: Sat, 15 Apr 2023 20:33:21 GMT
Strict-Transport-Security: max-age=157680000; includeSubDomains
X-Content-Type-Options: nosniff
Last-Modified: Fri, 29 Apr 2016 21:56:45 GMT
X-Frame-Options: SAMEORIGIN
Content-Type: image/png
Cache-Control: private
Content-Disposition: inline; filename="site-logo.png"
Accept-Ranges: bytes
Content-Length: 2710
X-XSS-Protection: 1; mode=block
X-UA-Compatible: IE=edge

GET
H/1.1 200
OK scripts.min.js Show response
www.cardbenefits.citi.com/dist/js/vendors/ 98 KB
36 KB 144ms
144ms Script
application/javascript 198.160.105.71
ACXIOM

General

Check archive.org

Show headers Download Go to

Full URL

https://www.cardbenefits.citi.com/dist/js/vendors/scripts.min.js

Requested by

Host: www.cardbenefits.citi.com
URL: https://www.cardbenefits.citi.com/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

198.160.105.71 Conway, United States, ASN15026 (ACXIOM, US),

Reverse DNS

Software

Resource Hash

2ed294ef47169b6130caa2bff97d546695d6fe42d9539ce6d87980141d2dd411

Security Headers

Name	Value
Strict-Transport-Security	max-age=157680000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.49 Safari/537.36

Response headers

Cteonnt-Length: 100400
Date: Sat, 15 Apr 2023 20:33:20 GMT
Strict-Transport-Security: max-age=157680000; includeSubDomains
X-Content-Type-Options: nosniff
Last-Modified: Thu, 07 Jan 2021 03:35:30 GMT
Content-Encoding: gzip
ETag: "06d9125a6e4d61:0"
X-Frame-Options: SAMEORIGIN
Transfer-Encoding: chunked
Content-Type: application/javascript
Cache-Control: max-age=600
Accept-Ranges: bytes
X-XSS-Protection: 1; mode=block
X-UA-Compatible: IE=edge

GET
H/1.1 200
OK js Show response
www.cardbenefits.citi.com/bundles/ 237 KB
55 KB 162ms
162ms Script
text/javascript 198.160.105.71
ACXIOM

General

Check archive.org

Show headers Download Go to

Full URL

https://www.cardbenefits.citi.com/bundles/js?v=mpI5gkNcBF2v8mPZvzMrOdxRwDv69dM4NaoPI0SAHNc1

Requested by

Host: www.cardbenefits.citi.com
URL: https://www.cardbenefits.citi.com/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

198.160.105.71 Conway, United States, ASN15026 (ACXIOM, US),

Reverse DNS

Software

Resource Hash

14875cf677222a019e070a208c8e6d4abe1842c4442c38d76308199a21a9bf57

Security Headers

Name	Value
Strict-Transport-Security	max-age=157680000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.49 Safari/537.36

Response headers

X-UA-Compatible: IE=edge
Cteonnt-Length: 242673
Date: Sat, 15 Apr 2023 20:33:20 GMT
Strict-Transport-Security: max-age=157680000; includeSubDomains
X-Content-Type-Options: nosniff
Last-Modified: Sat, 15 Apr 2023 20:33:21 GMT
Content-Encoding: gzip
Vary: User-Agent
X-Frame-Options: SAMEORIGIN
Content-Type: text/javascript; charset=utf-8
Transfer-Encoding: chunked
Cache-Control: private
X-XSS-Protection: 1; mode=block
Expires: Sun, 14 Apr 2024 20:33:21 GMT

GET
H/1.1 200
OK nomonitoringjs Show response
www.cardbenefits.citi.com/bundles/ 220 B
838 B 144ms
143ms Script
text/javascript 198.160.105.71
ACXIOM

General

Check archive.org

Show headers Download Go to

Full URL

https://www.cardbenefits.citi.com/bundles/nomonitoringjs?v=zFfibhfnj-le3sEpb3aooTT5X_uSIC1FlM--3sTAcok1

Requested by

Host: www.cardbenefits.citi.com
URL: https://www.cardbenefits.citi.com/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

198.160.105.71 Conway, United States, ASN15026 (ACXIOM, US),

Reverse DNS

Software

Resource Hash

65ce6d53148f1b3471942b6789c7126bbce7c257be2cf5a474dd68768513a86e

Security Headers

Name	Value
Strict-Transport-Security	max-age=157680000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.49 Safari/537.36

Response headers

X-UA-Compatible: IE=edge
Cteonnt-Length: 220
Date: Sat, 15 Apr 2023 20:33:21 GMT
Strict-Transport-Security: max-age=157680000; includeSubDomains
X-Content-Type-Options: nosniff
Last-Modified: Sat, 15 Apr 2023 20:33:21 GMT
Content-Encoding: gzip
Vary: User-Agent
X-Frame-Options: SAMEORIGIN
Content-Type: text/javascript; charset=utf-8
Cache-Control: private
Content-Length: 186
X-XSS-Protection: 1; mode=block
Expires: Sun, 14 Apr 2024 20:33:21 GMT

GET
H/1.1

200
OK

rd Show response
dpm.demdex.net/id/
Redirect Chain

https://dpm.demdex.net/id?d_visid_ver=4.4.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=61834D9B5228A7430A490D45%40AdobeOrg&d_nsid=0&ts=1681590803186
https://dpm.demdex.net/id/rd?d_visid_ver=4.4.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=61834D9B5228A7430A490D45%40AdobeOrg&d_nsid=0&ts=1681590803186

363 B
1 KB

51ms
51ms

XHR
application/json

52.212.210.65
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://dpm.demdex.net/id/rd?d_visid_ver=4.4.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=61834D9B5228A7430A490D45%40AdobeOrg&d_nsid=0&ts=1681590803186

Requested by

Host: www.cardbenefits.citi.com
URL: https://www.cardbenefits.citi.com/

Protocol

HTTP/1.1

Server

52.212.210.65 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-52-212-210-65.eu-west-1.compute.amazonaws.com

Software

Resource Hash

09e83612e0e15e2be2a4e1ab29a718f014595bec63c3d8a961c5c71894888c0c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.49 Safari/537.36

Response headers

DCS: dcs-prod-irl1-1-v047-0039aee26.edge-irl1.demdex.com 1 ms
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
content-encoding: gzip
X-TID: wMni+2xSTLc=
Vary: Origin
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Access-Control-Allow-Origin: https://www.cardbenefits.citi.com
Content-Type: application/json;charset=utf-8
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 306
Expires: Thu, 01 Jan 1970 00:00:00 UTC

Redirect headers

DCS: dcs-prod-irl1-1-v047-004bb6ee2.edge-irl1.demdex.com 0 ms
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-TID: LYvoyLPRQ7c=
Vary: Origin
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Access-Control-Allow-Origin: https://www.cardbenefits.citi.com
Location: https://dpm.demdex.net/id/rd?d_visid_ver=4.4.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=61834D9B5228A7430A490D45%40AdobeOrg&d_nsid=0&ts=1681590803186
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 0
Expires: Thu, 01 Jan 1970 00:00:00 UTC

GET
H2 200 6294e3492dd780fb2f4f6fe21b227d3251745290943511bf3a200934c776b68e Show response
tagmanager1.citi.com/one/v1/profiles/ 582 B
646 B 315ms
60ms XHR
application/json 3.124.119.57
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tagmanager1.citi.com/one/v1/profiles/6294e3492dd780fb2f4f6fe21b227d3251745290943511bf3a200934c776b68e
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 3.124.119.57 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-124-119-57.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: d8aa932749cab7020563ca74e6720637e6c12b11d517f02aef6a18ca1973b422

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.49 Safari/537.36

Response headers

date: Sat, 15 Apr 2023 20:33:23 GMT
content-encoding: gzip
server: nginx
x-ens-one-is-anonymous: true
vary: Accept-Encoding
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS
content-type: application/json
access-control-allow-origin: *
access-control-expose-headers: *
access-control-allow-headers: *
x-ens-one-ttl: 1689255929
apigw-requestid: Db6DJiAlFiAEJCw=

GET
H2 204 e.gif
nexus.ensighten.com/error/ 0
250 B 25ms
24ms Image
text/plain 18.154.63.96
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://nexus.ensighten.com/error/e.gif?msg=_dl%20is%20not%20defined&lnn=-1&fn=&cid=1129&client=citi&publishPath=na_prod&rid=3092996&did=622672&errorName=ReferenceError
Requested by: Host: www.cardbenefits.citi.com
URL: https://www.cardbenefits.citi.com/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.154.63.96 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-154-63-96.dus51.r.cloudfront.net
Software: CloudFront /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.49 Safari/537.36

Response headers

date: Sat, 15 Apr 2023 00:49:16 GMT
via: 1.1 7965c3a45d2bf992e197c959a86e759c.cloudfront.net (CloudFront)
server: CloudFront
x-amz-cf-pop: DUS51-P4
age: 71047
x-cache: Hit from cloudfront
cache-control: no-cache, no-store
x-amz-cf-id: vd2kpTqH_jeHKviP8netyBuZdmSxPW022dz6Fig02Uf9IjPgfCZbVQ==

GET
H2 200 serverComponent.php Show response
nexus.ensighten.com/citi/na_prod/ 1 KB
956 B 49ms
48ms Script
text/javascript 18.154.63.96
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://nexus.ensighten.com/citi/na_prod/serverComponent.php?namespace=Bootstrapper&staticJsPath=nexus.ensighten.com/citi/na_prod/code/&publishedOn=Wed%20Apr%2005%2013:55:22%20GMT%202023&ClientID=1129&PageID=https%3A%2F%2Fwww.cardbenefits.citi.com%2F
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.154.63.96 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-154-63-96.dus51.r.cloudfront.net
Software: CloudFront /
Resource Hash: 896100123281db500d93da27fdc5638ccb1317311fe3010ea27be6283e33a7c0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.49 Safari/537.36

Response headers

date: Sat, 15 Apr 2023 20:33:24 GMT
content-encoding: gzip
via: 1.1 7965c3a45d2bf992e197c959a86e759c.cloudfront.net (CloudFront)
server: CloudFront
x-amz-cf-pop: DUS51-P4
vary: Accept-Encoding
x-cache: Miss from cloudfront
content-type: text/javascript
cache-control: no-cache, no-store
x-amz-cf-id: 2r5fWQp0MvhO9uWSs3XS0T0xBFxB2Pord2tUod-t0a7lwgOaMH5AVQ==
expires: Sat, 15 Apr 2023 20:33:23 GMT

GET
H/1.1 200
OK Hero_DSK2B-1.ashx
www.cardbenefits.citi.com/~/media/CPP/Images/Hero/ 83 KB
83 KB 393ms
148ms Image
image/jpeg 198.160.105.71
ACXIOM

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.cardbenefits.citi.com/~/media/CPP/Images/Hero/Hero_DSK2B-1.ashx

Requested by

Host: www.cardbenefits.citi.com
URL: https://www.cardbenefits.citi.com/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

198.160.105.71 Conway, United States, ASN15026 (ACXIOM, US),

Reverse DNS

Software

Resource Hash

42807acf8a1f94395ba975771af6eb599e8e016605a8d52560caaf32d6622088

Security Headers

Name	Value
Strict-Transport-Security	max-age=157680000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.49 Safari/537.36

Response headers

Date: Sat, 15 Apr 2023 20:33:21 GMT
Strict-Transport-Security: max-age=157680000; includeSubDomains
X-Content-Type-Options: nosniff
Last-Modified: Tue, 07 Nov 2017 21:41:51 GMT
X-Frame-Options: SAMEORIGIN
Content-Type: image/jpeg
Cache-Control: private
Content-Disposition: inline; filename="Hero_DSK2B-1.jpg"
Accept-Ranges: bytes
Content-Length: 84553
X-XSS-Protection: 1; mode=block
X-UA-Compatible: IE=edge

GET
H/1.1 200
OK accordian-arrow.png
www.cardbenefits.citi.com/dist/imgs/ 18 KB
19 KB 492ms
141ms Image
image/png 198.160.105.71
ACXIOM

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.cardbenefits.citi.com/dist/imgs/accordian-arrow.png

Requested by

Host: www.cardbenefits.citi.com
URL: https://www.cardbenefits.citi.com/dist/css/main.css

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

198.160.105.71 Conway, United States, ASN15026 (ACXIOM, US),

Reverse DNS

Software

Resource Hash

0ffab593a942ff4d16420a89a9a3bba85f5dd24016a0a860cc876f574c699a88

Security Headers

Name	Value
Strict-Transport-Security	max-age=157680000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/dist/css/main.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.49 Safari/537.36

Response headers

Date: Sat, 15 Apr 2023 20:33:21 GMT
Strict-Transport-Security: max-age=157680000; includeSubDomains
X-Content-Type-Options: nosniff
Last-Modified: Thu, 07 Jan 2021 03:35:30 GMT
ETag: "06d9125a6e4d61:0"
X-Frame-Options: SAMEORIGIN
Content-Type: image/png
Cache-Control: max-age=600
Accept-Ranges: bytes
Content-Length: 18864
X-XSS-Protection: 1; mode=block
X-UA-Compatible: IE=edge

GET
H/1.1 200
OK Interstate-ExtraLight.woff
www.cardbenefits.citi.com/dist/fonts/ 38 KB
38 KB 227ms
139ms Font
application/font-woff 198.160.105.71
ACXIOM

General

Check archive.org

Show headers Download Go to

Full URL

https://www.cardbenefits.citi.com/dist/fonts/Interstate-ExtraLight.woff

Requested by

Host: www.cardbenefits.citi.com
URL: https://www.cardbenefits.citi.com/dist/css/main.css

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

198.160.105.71 Conway, United States, ASN15026 (ACXIOM, US),

Reverse DNS

Software

Resource Hash

9a93b0d48f5d73e23d7eff3e2c5f855b84398c37939253ce5eb3c2873a99a8bc

Security Headers

Name	Value
Strict-Transport-Security	max-age=157680000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.cardbenefits.citi.com/dist/css/main.css
Origin: https://www.cardbenefits.citi.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.49 Safari/537.36

Response headers

Date: Sat, 15 Apr 2023 20:33:21 GMT
Strict-Transport-Security: max-age=157680000; includeSubDomains
X-Content-Type-Options: nosniff
Last-Modified: Thu, 07 Jan 2021 03:35:30 GMT
ETag: "06d9125a6e4d61:0"
X-Frame-Options: SAMEORIGIN
Content-Type: application/font-woff
Cache-Control: max-age=600
Accept-Ranges: bytes
Content-Length: 38470
X-XSS-Protection: 1; mode=block
X-UA-Compatible: IE=edge

GET
H/1.1 200
OK Interstate-Bold.woff
www.cardbenefits.citi.com/dist/fonts/ 70 KB
71 KB 251ms
140ms Font
application/font-woff 198.160.105.71
ACXIOM

General

Check archive.org

Show headers Download Go to

Full URL

https://www.cardbenefits.citi.com/dist/fonts/Interstate-Bold.woff

Requested by

Host: www.cardbenefits.citi.com
URL: https://www.cardbenefits.citi.com/dist/css/main.css

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

198.160.105.71 Conway, United States, ASN15026 (ACXIOM, US),

Reverse DNS

Software

Resource Hash

e9e9a67395a0d83b584208a19b95af203df8e8e6c6952fe76c690d60ea9381c7

Security Headers

Name	Value
Strict-Transport-Security	max-age=157680000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.cardbenefits.citi.com/dist/css/main.css
Origin: https://www.cardbenefits.citi.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.49 Safari/537.36

Response headers

Date: Sat, 15 Apr 2023 20:33:21 GMT
Strict-Transport-Security: max-age=157680000; includeSubDomains
X-Content-Type-Options: nosniff
Last-Modified: Thu, 07 Jan 2021 03:35:30 GMT
ETag: "06d9125a6e4d61:0"
X-Frame-Options: SAMEORIGIN
Content-Type: application/font-woff
Cache-Control: max-age=600
Accept-Ranges: bytes
Content-Length: 71874
X-XSS-Protection: 1; mode=block
X-UA-Compatible: IE=edge

GET
H/1.1 200
OK Interstate-Light.woff
www.cardbenefits.citi.com/dist/fonts/ 74 KB
74 KB 367ms
139ms Font
application/font-woff 198.160.105.71
ACXIOM

General

Check archive.org

Show headers Download Go to

Full URL

https://www.cardbenefits.citi.com/dist/fonts/Interstate-Light.woff

Requested by

Host: www.cardbenefits.citi.com
URL: https://www.cardbenefits.citi.com/dist/css/main.css

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

198.160.105.71 Conway, United States, ASN15026 (ACXIOM, US),

Reverse DNS

Software

Resource Hash

f327a0ba3e41b1e8154e1c18fc114baff0bd057151e3afe7fa6f33cc0cb18296

Security Headers

Name	Value
Strict-Transport-Security	max-age=157680000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.cardbenefits.citi.com/dist/css/main.css
Origin: https://www.cardbenefits.citi.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.49 Safari/537.36

Response headers

Date: Sat, 15 Apr 2023 20:33:21 GMT
Strict-Transport-Security: max-age=157680000; includeSubDomains
X-Content-Type-Options: nosniff
Last-Modified: Thu, 07 Jan 2021 03:35:30 GMT
ETag: "06d9125a6e4d61:0"
X-Frame-Options: SAMEORIGIN
Content-Type: application/font-woff
Cache-Control: max-age=600
Accept-Ranges: bytes
Content-Length: 75538
X-XSS-Protection: 1; mode=block
X-UA-Compatible: IE=edge

GET
H/1.1 200
OK Interstate-Regular.woff
www.cardbenefits.citi.com/dist/fonts/ 77 KB
77 KB 392ms
143ms Font
application/font-woff 198.160.105.71
ACXIOM

General

Check archive.org

Show headers Download Go to

Full URL

https://www.cardbenefits.citi.com/dist/fonts/Interstate-Regular.woff

Requested by

Host: www.cardbenefits.citi.com
URL: https://www.cardbenefits.citi.com/dist/css/main.css

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

198.160.105.71 Conway, United States, ASN15026 (ACXIOM, US),

Reverse DNS

Software

Resource Hash

045cd226594cb32ddf9d4db8ee45611f4d0788675ae50180b68da975e66fe1fe

Security Headers

Name	Value
Strict-Transport-Security	max-age=157680000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.cardbenefits.citi.com/dist/css/main.css
Origin: https://www.cardbenefits.citi.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.49 Safari/537.36

Response headers

Date: Sat, 15 Apr 2023 20:33:21 GMT
Strict-Transport-Security: max-age=157680000; includeSubDomains
X-Content-Type-Options: nosniff
Last-Modified: Thu, 07 Jan 2021 03:35:30 GMT
ETag: "06d9125a6e4d61:0"
X-Frame-Options: SAMEORIGIN
Content-Type: application/font-woff
Cache-Control: max-age=600
Accept-Ranges: bytes
Content-Length: 78762
X-XSS-Protection: 1; mode=block
X-UA-Compatible: IE=edge

OPTIONS
H2 200 branding
online.citi.com/gcgapi/prod/public/v1/prelogin/digital/customerEntitlement/browser/vendor/ Frame 0
0 288ms
201ms Preflight 104.102.43.113
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://online.citi.com/gcgapi/prod/public/v1/prelogin/digital/customerEntitlement/browser/vendor/branding?vendorId=BenefitBuilder&userType=BB

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.102.43.113 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-102-43-113.deploy.static.akamaitechnologies.com

Software

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

Accept: */*
Access-Control-Request-Headers: businesscode,channelid,client_id,countrycode
Access-Control-Request-Method: GET
Origin: https://www.cardbenefits.citi.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.49 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Accept,Accept-Language,Authorization,businessCode,client_id,content-type,countryCode,uuid,x-ibm-client-id,eventid,sessionID,bizToken,citiuuid,applicationId,channelId,Scope,blackBox,devicePrint,deviceTokenCookie,AMWResponse,action,challengeType,TMXSessionId,tenantName,TMXDigitalApplicationType,accessToken,familyIndicator,Otpid,deviceId,subscriberId,CitiProfOnly,digitalApplicationType,environmentId,BioCatchSessionId,X-Migration-Target,x-soz9htcz-a,x-soz9htcz-b,x-soz9htcz-c,x-soz9htcz-d,x-soz9htcz-e,x-soz9htcz-f,x-soz9htcz-z,x-soz9htcz-uniquestatekey,tenantId,appid,X-Akamai-CITISITE,Dclocation,Uuid,appVersion,devicemodelname,kore-token,x-ts-client-version,stateToken
access-control-allow-methods: GET,POST,PUT,DELETE
access-control-allow-origin: https://www.cardbenefits.citi.com
access-control-expose-headers: Accept,Accept-Language,Authorization,businessCode,client_id,content-type,countryCode,uuid,x-ibm-client-id,eventid,sessionID,bizToken,citiuuid,applicationId,channelId,Scope,blackBox,devicePrint,deviceTokenCookie,AMWResponse,action,challengeType,TMXSessionId,tenantName,TMXDigitalApplicationType,accessToken,familyIndicator,Otpid,deviceId,subscriberId,CitiProfOnly,digitalApplicationType,environmentId,BioCatchSessionId,X-Migration-Target,x-soz9htcz-a,x-soz9htcz-b,x-soz9htcz-c,x-soz9htcz-d,x-soz9htcz-e,x-soz9htcz-f,x-soz9htcz-z,x-soz9htcz-uniquestatekey,tenantId,appid,X-Akamai-CITISITE,Dclocation,Uuid,appVersion,devicemodelname,kore-token,x-ts-client-version,stateToken
content-encoding: gzip
content-length: 0
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
date: Sat, 15 Apr 2023 20:33:24 GMT
vary: Accept-Encoding
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 200 branding Show response
online.citi.com/gcgapi/prod/public/v1/prelogin/digital/customerEntitlement/browser/vendor/ 7 KB
4 KB 1083ms
1082ms XHR
text/html 104.102.43.113
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://online.citi.com/gcgapi/prod/public/v1/prelogin/digital/customerEntitlement/browser/vendor/branding?vendorId=BenefitBuilder&userType=BB

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.102.43.113 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-102-43-113.deploy.static.akamaitechnologies.com

Software

Resource Hash

f943107aff6f4e820528f733ff3e1e4ad76618ac28927217cc258d9c78de2e1e

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=31536000 ; includeSubDomains
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.49 Safari/537.36
Accept: */*
channelId: CBOL
Referer: https://www.cardbenefits.citi.com/
countryCode: US
businessCode: GCB
client_id: 3d5b04ff-3586-44cd-b3a4-a094d139cdce

Response headers

expires: 0
strict-transport-security: max-age=31536000 ; includeSubDomains
content-encoding: gzip
x-content-type-options: nosniff
x-route-target: DEFAULT:DEFAULT
date: Sat, 15 Apr 2023 20:33:25 GMT
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-global-transaction-id: 9b162b09643b0a141cb947f3
dclocation: SW1DMS
uuid: 4b2348ae-1f75-4a2c-b919-e8084dfd5d10
content-length: 1916
x-xss-protection: 1; mode=block
pragma: no-cache
referrer-policy: no-referrer
biztoken: +7OUe8tM0jxvfcq96il1jpuKek8NGW3R1CUzfM9l0UAE0XdVqpcizYiyGblNa5nmOrln2f2IUwIuG58Yp4M28RrQSqarAi3+24Kksg0Z+cGw3zu+HJ0KfsmbT98B+o2M
x-akamai-citisite: SWDC
access-control-max-age: 2147483647
access-control-allow-methods: GET,PUT,POST,DELETE,HEAD,GET,POST,PUT,DELETE
content-language: en
access-control-allow-origin: https://www.cardbenefits.citi.com
access-control-expose-headers: action,challengeType,bizToken,eventid,Eventid,Eventidexpirytime,eventidexpirytime,accesstoken,Authorization,sid,SessionId,CCPToken,CFIToken,Accept,Accept-Language,Authorization,businessCode,client_id,content-type,countryCode,uuid,x-ibm-client-id,eventid,sessionID,bizToken,citiuuid,applicationId,channelId,Scope,blackBox,devicePrint,deviceTokenCookie,AMWResponse,action,challengeType,TMXSessionId,tenantName,TMXDigitalApplicationType,accessToken,familyIndicator,Otpid,deviceId,subscriberId,CitiProfOnly,digitalApplicationType,environmentId,BioCatchSessionId,X-Migration-Target,x-soz9htcz-a,x-soz9htcz-b,x-soz9htcz-c,x-soz9htcz-d,x-soz9htcz-e,x-soz9htcz-f,x-soz9htcz-z,x-soz9htcz-uniquestatekey,tenantId,appid,X-Akamai-CITISITE,Dclocation,Uuid,appVersion,devicemodelname,kore-token,x-ts-client-version,stateToken
cache-control: no-cache, no-store, max-age=0, must-revalidate
access-control-allow-credentials: true
content-type: text/html
vary: Accept-Encoding
access-control-allow-headers: action,challengeType,accesstoken,appVersion,,Content-Type,sid,CCPToken,CFIToken,countryCode,businessCode,channelId,uuid,client_id,environmentId,Accept,Accept-Language,Authorization,businessCode,client_id,content-type,countryCode,uuid,x-ibm-client-id,eventid,sessionID,bizToken,citiuuid,applicationId,channelId,Scope,blackBox,devicePrint,deviceTokenCookie,AMWResponse,action,challengeType,TMXSessionId,tenantName,TMXDigitalApplicationType,accessToken,familyIndicator,Otpid,deviceId,subscriberId,CitiProfOnly,digitalApplicationType,environmentId,BioCatchSessionId,X-Migration-Target,x-soz9htcz-a,x-soz9htcz-b,x-soz9htcz-c,x-soz9htcz-d,x-soz9htcz-e,x-soz9htcz-f,x-soz9htcz-z,x-soz9htcz-uniquestatekey,tenantId,appid,X-Akamai-CITISITE,Dclocation,Uuid,appVersion,devicemodelname,kore-token,x-ts-client-version,stateToken
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 200 34feda9290c1e4ae5a46d111874e9711.js Show response
nexus.ensighten.com/citi/na_prod/code/ 15 KB
4 KB 25ms
25ms Script
application/javascript 18.154.63.96
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://nexus.ensighten.com/citi/na_prod/code/34feda9290c1e4ae5a46d111874e9711.js?conditionId0=462132
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.154.63.96 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-154-63-96.dus51.r.cloudfront.net
Software: CloudFront /
Resource Hash: 59374b2d6bced61bc1e03384f26d88c7ac21a8028d8c19a65074571606d1a9d7

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.49 Safari/537.36

Response headers

date: Wed, 05 Apr 2023 13:55:36 GMT
x-amz-version-id: YvCrZ4igvKDot7c9XXqnM.UmHgGlWwb9
content-encoding: br
via: 1.1 7965c3a45d2bf992e197c959a86e759c.cloudfront.net (CloudFront)
x-amz-cf-pop: DUS51-P4
age: 887869
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: PENDING
last-modified: Wed, 05 Apr 2023 13:55:27 GMT
server: CloudFront
etag: W/"85c17df929ce1e2b3cd3b81691cfdcc4"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
cache-control: max-age=315360000
x-amz-cf-id: orWRiBDq5XdH7yVJOnc8ENkpeYNKU34A-34_2NeToBoJQLvO6Vrf4A==

GET
H2 200 af3b21070dd01ab22a4f331056324374.js Show response
nexus.ensighten.com/citi/na_prod/code/ 7 KB
2 KB 26ms
26ms Script
application/javascript 18.154.63.96
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://nexus.ensighten.com/citi/na_prod/code/af3b21070dd01ab22a4f331056324374.js?conditionId0=4897099
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.154.63.96 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-154-63-96.dus51.r.cloudfront.net
Software: CloudFront /
Resource Hash: d2751a84e6a70913798dd8b2aede47ab49b7a701618cd151d89755638f71aa02

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.49 Safari/537.36

Response headers

date: Mon, 23 Jan 2023 02:28:18 GMT
x-amz-version-id: QTYOdEvDbSbtudwcv3X6K9qpVGIDVLJs
content-encoding: br
via: 1.1 7965c3a45d2bf992e197c959a86e759c.cloudfront.net (CloudFront)
x-amz-cf-pop: DUS51-P4
age: 7149907
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
last-modified: Tue, 16 Aug 2022 21:43:05 GMT
server: CloudFront
etag: W/"412eb38d6a797c24fd5d7e30e1b9799d"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
cache-control: max-age=315360000
x-amz-cf-id: jMmQ4p78-5Xzh6u4iHIsi-9CzR_21UR-ufPnho0_geFRgwvQ1TxFgA==

GET
H2 200 c65a3609e1beed72955b88afac8cd31d.js Show response
nexus.ensighten.com/citi/na_prod/code/ 2 KB
1 KB 30ms
30ms Script
application/javascript 18.154.63.96
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://nexus.ensighten.com/citi/na_prod/code/c65a3609e1beed72955b88afac8cd31d.js?conditionId0=480881
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.154.63.96 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-154-63-96.dus51.r.cloudfront.net
Software: CloudFront /
Resource Hash: 686eb5d7c927dd741ef72adda5c719b478d36f1e29520ee16d5121854c174b10

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.49 Safari/537.36

Response headers

date: Thu, 23 Feb 2023 16:17:54 GMT
x-amz-version-id: wXRQEmBG4QJsg2TZDdHUFOaVLJIZHKhf
content-encoding: br
via: 1.1 7965c3a45d2bf992e197c959a86e759c.cloudfront.net (CloudFront)
x-amz-cf-pop: DUS51-P4
age: 4421731
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
last-modified: Thu, 15 Dec 2022 04:55:25 GMT
server: CloudFront
etag: W/"e9bda8e342fda2a02ffa59c9064942d8"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
cache-control: max-age=315360000
x-amz-cf-id: UEeJ3z_9I4BW421qDzf9uS4bsZEF4DVs8ac6DzUbbQTOjxsL2yp3wA==

GET
H2 200 33f8f30f7c7074eec84dc42e42840b01.js Show response
nexus.ensighten.com/citi/na_prod/code/ 320 KB
45 KB 30ms
30ms Script
application/javascript 18.154.63.96
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://nexus.ensighten.com/citi/na_prod/code/33f8f30f7c7074eec84dc42e42840b01.js?conditionId0=421908
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.154.63.96 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-154-63-96.dus51.r.cloudfront.net
Software: CloudFront /
Resource Hash: a625452ec4e298366c604ba857a4468a51496024a96d6b55a126881e40c2ab79

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.49 Safari/537.36

Response headers

date: Wed, 05 Apr 2023 13:55:33 GMT
x-amz-version-id: U4hR3SiGrNsPLNiKP0i.3bD9_nB6p_o_
content-encoding: br
via: 1.1 7965c3a45d2bf992e197c959a86e759c.cloudfront.net (CloudFront)
x-amz-cf-pop: DUS51-P4
age: 887871
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: PENDING
last-modified: Wed, 05 Apr 2023 13:55:27 GMT
server: CloudFront
etag: W/"4c5ba99350326bb0ba347f6b56d9ce3b"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
cache-control: max-age=315360000
x-amz-cf-id: 1mel5Pw_LGiqgvy-FIY1RqRs1yNJYiEZ7bTGtf4vOCkcrfyEthwYww==

GET
H2 200 51aba9f62787efbaa13e53a8d1ae3892.js Show response
nexus.ensighten.com/citi/na_prod/code/ 1 KB
1 KB 29ms
29ms Script
application/javascript 18.154.63.96
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://nexus.ensighten.com/citi/na_prod/code/51aba9f62787efbaa13e53a8d1ae3892.js?conditionId0=4827153
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.154.63.96 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-154-63-96.dus51.r.cloudfront.net
Software: CloudFront /
Resource Hash: bf8892a953595eb96b9ca68c5756849d404115dcf2ee9bf87e8b4e7b3cf8e650

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.49 Safari/537.36

Response headers

date: Tue, 10 Jan 2023 01:21:59 GMT
x-amz-version-id: wbqnWd5jL63548esNkWLxT1ImQDA0TC0
content-encoding: gzip
via: 1.1 7965c3a45d2bf992e197c959a86e759c.cloudfront.net (CloudFront)
x-amz-cf-pop: DUS51-P4
age: 8277086
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
last-modified: Tue, 31 Aug 2021 17:19:04 GMT
server: CloudFront
etag: W/"4d37444c012a76a0557182615bf5cdd3"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
cache-control: max-age=315360000
x-amz-cf-id: SovXSTJn1PkuVPzQia83D9aqNFrFq7BjrV0QodC882MzL1r5T4X6Mw==

GET
H2 200 e5cf33996985b171b9372e25a908f089.js Show response
nexus.ensighten.com/citi/na_prod/code/ 116 KB
36 KB 39ms
39ms Script
application/javascript 18.154.63.96
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://nexus.ensighten.com/citi/na_prod/code/e5cf33996985b171b9372e25a908f089.js?conditionId0=432794
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.154.63.96 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-154-63-96.dus51.r.cloudfront.net
Software: CloudFront /
Resource Hash: 319d89af33fd866acddc109d87bb5415e8dc8ba84bea381c8f945127b9031525

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.49 Safari/537.36

Response headers

date: Sat, 07 Jan 2023 01:43:01 GMT
x-amz-version-id: aQJOuiSqoVGLq3QlV.gNiWSyyXJ7Gi7M
content-encoding: br
via: 1.1 7965c3a45d2bf992e197c959a86e759c.cloudfront.net (CloudFront)
x-amz-cf-pop: DUS51-P4
age: 8535024
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
last-modified: Tue, 18 Oct 2022 17:52:59 GMT
server: CloudFront
etag: W/"da2848edc6ea7f6f2ad45aa8a9e20671"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
cache-control: max-age=315360000
x-amz-cf-id: MRsfMFnPJaomTY3pFP1QbI6fhe0776YHDhVh2RkZBGFOC2ogW4mq7A==

GET
H2 200 9d9a7667eda16421b759d3e4ae34d25f.js Show response
nexus.ensighten.com/citi/na_prod/code/ 27 KB
7 KB 29ms
29ms Script
application/javascript 18.154.63.96
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://nexus.ensighten.com/citi/na_prod/code/9d9a7667eda16421b759d3e4ae34d25f.js?conditionId0=467299
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.154.63.96 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-154-63-96.dus51.r.cloudfront.net
Software: CloudFront /
Resource Hash: 696482c2e2d088086d19d0fc4406632415e35b741ecc23151a75a39b8766a5d5

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.49 Safari/537.36

Response headers

date: Thu, 23 Feb 2023 16:17:54 GMT
x-amz-version-id: iCANwNDAYzzLjFfP7PabUgezx4DdR6XE
content-encoding: br
via: 1.1 7965c3a45d2bf992e197c959a86e759c.cloudfront.net (CloudFront)
x-amz-cf-pop: DUS51-P4
age: 4421731
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
last-modified: Thu, 16 Feb 2023 18:50:31 GMT
server: CloudFront
etag: W/"d7a7f92dbb8927a61cb31e29eea41b11"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
cache-control: max-age=315360000
x-amz-cf-id: viObeHatKEFFOp6GXd_xFdaWQqmYygNyCn7b56k1mwnYwYP299MPPw==

GET
H2 200 f15302b0772bbd45fd3bb7244e9386ba.js Show response
nexus.ensighten.com/citi/na_prod/code/ 396 KB
108 KB 30ms
30ms Script
application/javascript 18.154.63.96
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://nexus.ensighten.com/citi/na_prod/code/f15302b0772bbd45fd3bb7244e9386ba.js?conditionId0=3013337
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.154.63.96 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-154-63-96.dus51.r.cloudfront.net
Software: CloudFront /
Resource Hash: 6c5466a549e41202c96f43d2af9187ef17e76c8903939eef5e23132878fe02c3

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.49 Safari/537.36

Response headers

date: Tue, 28 Mar 2023 19:48:48 GMT
x-amz-version-id: 8ZlqxOkMjV3WlOB267CCqJcdtPLmN2KG
content-encoding: br
via: 1.1 7965c3a45d2bf992e197c959a86e759c.cloudfront.net (CloudFront)
x-amz-cf-pop: DUS51-P4
age: 1557877
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: PENDING
last-modified: Tue, 28 Mar 2023 19:48:37 GMT
server: CloudFront
etag: W/"b8646248343985ab80e5d2c18e66dcba"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
cache-control: max-age=315360000
x-amz-cf-id: wT_UpY7-MdLN0AUzIXYExsqZffPU9FMbMDAPm7cTx3bkkS3qOJRM6A==

GET
H/1.1 200
OK dest5.html Show response
citi.demdex.net/ Frame 653C 7 KB
3 KB 202ms
47ms Document
text/html 63.33.154.254
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://citi.demdex.net/dest5.html?d_nsid=0

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

63.33.154.254 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-63-33-154-254.eu-west-1.compute.amazonaws.com

Software

Resource Hash

7bea17a80a61ed0f54248b4ffc4c718f7c8ff2619742577a73591d62ce074da8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://www.cardbenefits.citi.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.49 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Accept-Ranges: bytes
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection: keep-alive
Content-Length: 2791
Content-Type: text/html;charset=UTF-8
DCS: dcs-prod-irl1-1-v047-0d0f75f57.edge-irl1.demdex.com 0 ms
Expires: Thu, 01 Jan 1970 00:00:00 UTC
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-TID: KKmA0H7aQFk=
content-encoding: gzip
date: Sat, 15 Apr 2023 20:33:24 GMT
last-modified: Wed, 12 Apr 2023 09:58:14 GMT
vary: accept-encoding

GET
H2 200 id Show response
metrics1.citi.com/ 89 B
631 B 116ms
33ms XHR
application/x-javascript 15.236.125.10
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://metrics1.citi.com/id?d_visid_ver=4.4.0&d_fieldgroup=A&mcorgid=61834D9B5228A7430A490D45%40AdobeOrg&mid=70570616501048755021532540192894249604&ts=1681590804049

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

15.236.125.10 Paris, France, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-15-236-125-10.eu-west-3.compute.amazonaws.com

Software

jag /

Resource Hash

3aad0543d3b63be29a3b353b23efd0c94359a1d20f207defc88a112ae55119ea

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.cardbenefits.citi.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.49 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

date: Sat, 15 Apr 2023 20:33:24 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
server: jag
vary: Origin
content-type: application/x-javascript;charset=utf-8
access-control-allow-origin: https://www.cardbenefits.citi.com
p3p: CP="This is not a P3P policy"
cache-control: no-cache, no-store, max-age=0, no-transform, private
access-control-allow-credentials: true
content-length: 89
x-xss-protection: 1; mode=block

GET
H/1.1

200
OK

ibs:dpid=411&dpuuid=ZDsKFAAAAN7_QwNe
dpm.demdex.net/
Redirect Chain

https://cm.everesttech.net/cm/dd?d_uuid=75154193643650581252082693921030427431
https://dpm.demdex.net/ibs:dpid=411&dpuuid=ZDsKFAAAAN7_QwNe

42 B
942 B

52ms
52ms

Image
image/gif

52.212.210.65
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dpm.demdex.net/ibs:dpid=411&dpuuid=ZDsKFAAAAN7_QwNe

Requested by

Host: www.cardbenefits.citi.com
URL: https://www.cardbenefits.citi.com/

Protocol

HTTP/1.1

Server

52.212.210.65 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-52-212-210-65.eu-west-1.compute.amazonaws.com

Software

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.49 Safari/537.36

Response headers

DCS: dcs-prod-irl1-1-v047-090a32a7c.edge-irl1.demdex.com 2 ms
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
content-encoding: gzip
X-Content-Type-Options: nosniff
X-TID: iKuEYlOVSrw=
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Content-Type: image/gif
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection: keep-alive
Content-Length: 59
Expires: Thu, 01 Jan 1970 00:00:00 UTC

Redirect headers

Location: https://dpm.demdex.net/ibs:dpid=411&dpuuid=ZDsKFAAAAN7_QwNe
Date: Sat, 15 Apr 2023 20:33:24 GMT
Cache-Control: no-cache
Server: AMO-cookiemap/1.1
Connection: keep-alive
Content-Length: 0
P3P: CP="NOI NID DEVa PSAa PSDa OUR IND PUR COM NAV INT DEM"

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 113 KB
44 KB 87ms
35ms Script
application/javascript 2a00:1450:4001:806::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=DC-6260004

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:806::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

d0f6beeab8cabab3951c4c34364a5e48f56aa4464bfe2422791b225f46f42c0f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.49 Safari/537.36

Response headers

date: Sat, 15 Apr 2023 20:33:24 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 44783
x-xss-protection: 0
last-modified: Sat, 15 Apr 2023 18:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Sat, 15 Apr 2023 20:33:24 GMT

GET
H/1.1 200
OK site24x7rum-min.js Show response
static.site24x7rum.com/beacon/ 86 KB
22 KB 110ms
36ms Script
application/javascript 18.66.248.114
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://static.site24x7rum.com/beacon/site24x7rum-min.js?appKey=75fe844fd60bb69fece8cfef490edb7c
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 18.66.248.114 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-66-248-114.dus51.r.cloudfront.net
Software: ZGS /
Resource Hash: ee9935ca1b9f86df52ab78c4c4a5e2aa7975ebe85da1d8792023ee89ff76e976

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.49 Safari/537.36

Response headers

Date: Sat, 15 Apr 2023 18:59:43 GMT
Content-Encoding: gzip
Via: 1.1 63d9e08bce2adee06986125b699b4cec.cloudfront.net (CloudFront)
Server: ZGS
X-Amz-Cf-Pop: DUS51-P1
Age: 5621
Transfer-Encoding: chunked
Vary: accept-encoding
Content-Type: application/javascript;charset=ISO-8859-1
Access-Control-Allow-Origin: *
X-Cache: Hit from cloudfront
Connection: keep-alive
X-Amz-Cf-Id: jWuu9X1oVRM91hiwSUJ3WQ1M8dmwe8wzLQ5BRHcmAkOgwbvr_jqAEA==

GET
H2 204 r.rnc
data.privacy.ensighten.com/privacy/v1/b/ 0
107 B 104ms
27ms Image
text/plain 3.124.119.57
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://data.privacy.ensighten.com/privacy/v1/b/r.rnc?n=0&c=1129&i=57y38a&p=na_prod&s=354&d=8HB7InZlcnNpb24iOiIxLjAuMCIsImdhdGV3YXkiOiIyLjMuNjExIiwiY2xpZW50SWQiOjExMjksInB1Ymxpc2hQYXRoIjoibmFfcHJvZCIsImluc3RhbmNlSWQiOiI1N3kzOGEiLCJwYWNrZXQiOjAsIm1vZGUiOiJlbmZvcmNlWgDwCG9va2llcyI6eyJCQU5ORVJfTE9BREVEkQDyJyJ9LCJlbnZpcm9ubWVudCI6IkNCT0wgUHJpdmFjeSIsInJlcXVlc3RzIjpbeyJkZXN0aW5hdM4A8BkiLCJ0eXBlIjoiYmlsbGluZyIsInN0YXJ0IjoxNjgxNTkwODA0MTM2YgDAZCI6LTEsInNvdXJjMgACKwBhdHVzIjoiZgBAYXNvbmUA1F0sImRhdGFQYXR0ZXISALBsaXN0IjpbXSwiaSAB8AA2ODE1OTA4MDQxMzZ9XX0
Requested by: Host: www.cardbenefits.citi.com
URL: https://www.cardbenefits.citi.com/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 3.124.119.57 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-124-119-57.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.49 Safari/537.36

Response headers

date: Sat, 15 Apr 2023 20:33:24 GMT
cache-control: no-cache, no-store
server: nginx
expires: Sat, 15 Apr 2023 20:33:23 GMT

GET
H2 204 r.rnc
data.privacy.ensighten.com/privacy/v1/c/ 0
106 B 101ms
29ms Image
text/plain 3.124.119.57
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://data.privacy.ensighten.com/privacy/v1/c/r.rnc?n=0&c=1129&i=7487qg&p=na_prod&s=381&d=9Cd7InZlcnNpb24iOiIxLjAuMCIsImdhdGV3YXkiOiIyLjMuNjExIiwiY2xpZW50SWQiOjExMjkQAPAaTmFtZSI6ImNpdGkiLCJwdWJsaXNoUGF0aCI6Im5hX3Byb2QiLCJtb2QmAJBibGFja2xpc3RPAPAfb29raWVzIjp7IkNJVElfRU5TSUdIVEVOX1BSSVZBQ1lfQkFOTkVSX0xPQURFRJ0A8Q8ifSwiZHQiOjE2ODE1OTA4MDQxNDMsInNldHRpbmdLAPEqbW9kYWwiOiJlbnRlcnByaXNlIiwiZW52aXJvbm1lbnQiOiJDQk9MIFByaXZhY3kiLCJkZWZhdWx0PgD0CFBlcmZvcm1hbmNlLUFuYWx5dGljcyBDqgD5CDEsIkVzc2VudGlhbC1GdW5jdGlvbmFsIQDwAkFkdmVydGlzaW5nLVRhcmdlmwAHIgDwAH19LCJldmVudHMiOltdfQ
Requested by: Host: www.cardbenefits.citi.com
URL: https://www.cardbenefits.citi.com/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 3.124.119.57 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-124-119-57.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.49 Safari/537.36

Response headers

date: Sat, 15 Apr 2023 20:33:24 GMT
cache-control: no-cache, no-store
server: nginx
expires: Sat, 15 Apr 2023 20:33:23 GMT

POST
H/1.1 200
OK PageView Show response
www.cardbenefits.citi.com/Logging/ 0
645 B 608ms
205ms XHR
text/html 198.160.105.71
ACXIOM

General

Check archive.org

Show headers Download Go to

Full URL

https://www.cardbenefits.citi.com/Logging/PageView

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

198.160.105.71 Conway, United States, ASN15026 (ACXIOM, US),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=157680000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept: */*
Referer: https://www.cardbenefits.citi.com/
X-Requested-With: XMLHttpRequest
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.49 Safari/537.36
Content-Type: application/json; charset=UTF-8

Response headers

X-UA-Compatible: IE=edge
Date: Sat, 15 Apr 2023 20:33:21 GMT
Strict-Transport-Security: max-age=157680000; includeSubDomains
X-Content-Type-Options: nosniff
Last-Modified: Sat, 15 Apr 2023 20:33:22 GMT
Vary: *
X-Frame-Options: SAMEORIGIN
Content-Type: text/html
Cache-Control: public, no-cache="Set-Cookie", no-store, max-age=0
Content-Length: 0
X-XSS-Protection: 1; mode=block
Expires: Sat, 15 Apr 2023 20:33:22 GMT

GET
H2 200 tc.min.js Show response
c1.rfihub.net/js/ 19 KB
6 KB 106ms
25ms Script
application/x-javascript 2600:9000:224a:b200:1:76cf:fe80:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c1.rfihub.net/js/tc.min.js
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:224a:b200:1:76cf:fe80:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: Jetty(9.3.29.v20201019) /
Resource Hash: 7ef97b12890fc6fee67f869c6e1f74b6719de7d66ac0d649c8d7386a80b4c30f

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.49 Safari/537.36

Response headers

date: Sat, 15 Apr 2023 20:12:05 GMT
content-encoding: gzip
via: 1.1 c114c55bb579a01518cf64c447d45272.cloudfront.net (CloudFront)
last-modified: Sat, 15 Apr 2023 20:11:55 GMT
server: Jetty(9.3.29.v20201019)
x-amz-cf-pop: DUS51-P1
age: 1279
x-cache: Hit from cloudfront
content-type: application/x-javascript
p3p: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
cache-control: public, max-age=3600
content-length: 6162
x-amz-cf-id: bOyWfD2Z2frUahZrtiDlvLMf3mUJH4FZcDtgDwWaLUkFdZS_wluZbQ==
expires: Sat, 15 Apr 2023 21:12:05 GMT

GET
H/1.1 200
OK id Show response
dpm.demdex.net/ 363 B
1 KB 51ms
51ms XHR
application/json 52.212.210.65
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://dpm.demdex.net/id?d_visid_ver=4.4.0&d_fieldgroup=AAM&d_rtbd=json&d_ver=2&d_orgid=61834D9B5228A7430A490D45%40AdobeOrg&d_nsid=0&d_mid=70570616501048755021532540192894249604&d_blob=RKhpRz8krg2tLO6pguXWp5olkAcUniQYPHaMWWgdJ3xzPWQmdj0y&d_cid_ic=AVID%01321D850A242AC5F9-600002B19E336DA9&ts=1681590804170

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.212.210.65 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-52-212-210-65.eu-west-1.compute.amazonaws.com

Software

Resource Hash

f049bfffec4b94ee7d0948f98b2a0d131a89baffdf21fd61cafb82b3155bd9c2

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://www.cardbenefits.citi.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.49 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

DCS: dcs-prod-irl1-1-v047-058f91efc.edge-irl1.demdex.com 2 ms
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
content-encoding: gzip
X-TID: NXLKHcLPRbQ=
Vary: Origin
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Access-Control-Allow-Origin: https://www.cardbenefits.citi.com
Content-Type: application/json;charset=utf-8
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 306
Expires: Thu, 01 Jan 1970 00:00:00 UTC

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 118 KB
46 KB 60ms
59ms Script
application/javascript 2a00:1450:4001:806::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=DC-6269322&l=dataLayer&cx=c

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:806::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

6b0061d304f90f867c7d89b7a06d8203d35c7d9e72eda2e15a30174f594b27b8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.49 Safari/537.36

Response headers

date: Sat, 15 Apr 2023 20:33:24 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 46609
x-xss-protection: 0
last-modified: Sat, 15 Apr 2023 18:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Sat, 15 Apr 2023 20:33:24 GMT

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 113 KB
44 KB 34ms
33ms Script
application/javascript 2a00:1450:4001:806::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=DC-6256710&l=dataLayer&cx=c

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:806::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

b058a1f558d6c191a9d483bb7f9e151b80bb365c3230ffb0ff0d3efc1b8e0dbb

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.49 Safari/537.36

Response headers

date: Sat, 15 Apr 2023 20:33:24 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 44772
x-xss-protection: 0
last-modified: Sat, 15 Apr 2023 18:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Sat, 15 Apr 2023 20:33:24 GMT

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 113 KB
44 KB 43ms
42ms Script
application/javascript 2a00:1450:4001:806::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=DC-6415812&l=dataLayer&cx=c

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:806::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

9431927bcc4452d078e9d47384ae572530c340dae3b5b385e40b9df3b67e283b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.49 Safari/537.36

Response headers

date: Sat, 15 Apr 2023 20:33:24 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 44833
x-xss-protection: 0
last-modified: Sat, 15 Apr 2023 18:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Sat, 15 Apr 2023 20:33:24 GMT

POST
H2 200 delivery Show response
citicorpcreditservic.tt.omtrdc.net/rest/v1/ 363 B
1 KB 182ms
56ms XHR
application/json 52.18.34.243
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://citicorpcreditservic.tt.omtrdc.net/rest/v1/delivery?client=citicorpcreditservic&sessionId=a28d2f31d0604954a2cc60fc6139de05&version=2.10.0

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.18.34.243 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-52-18-34-243.eu-west-1.compute.amazonaws.com

Software

Resource Hash

8a3898d8de6fee76cf386e4da3df1db7533f921a700ee0dcf00075add1f1334e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.cardbenefits.citi.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.49 Safari/537.36
Content-Type: text/plain

Response headers

date: Sat, 15 Apr 2023 20:33:24 GMT
content-encoding: gzip
referrer-policy: strict-origin-when-cross-origin
strict-transport-security: max-age=31536000; includeSubDomains
accept-ch: Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version-List
x-content-type-options: nosniff
vary: origin,access-control-request-method,access-control-request-headers,accept-encoding
p3p: CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
access-control-allow-origin: https://www.cardbenefits.citi.com
content-type: application/json;charset=UTF-8
access-control-allow-credentials: true
timing-allow-origin: *
x-xss-protection: 1; mode=block
x-request-id: da6ccc1b8058745275a81adebb007544

GET
H/1.1 200
OK ca.html Show response
20766699p.rfihub.com/ Frame 0BBB 118 B
684 B 322ms
31ms Document
text/html 193.0.160.130
ROCKETFUEL

General

Check archive.org

Show headers Download Go to

Full URL: https://20766699p.rfihub.com/ca.html?ver=9&ra=606&rb=648&ca=20766699&_o=17169175&_t=benefitshome&_rev=1&_pcode=1&_orderid=1&ssv_cuuid=&ssv_package=null&ssv_prodlist=null&ssv_pagename=benefitshome&pe=https%3A%2F%2Fwww.cardbenefits.citi.com%2F&pf=&ra=37360917615609224
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 193.0.160.130 , United States, ASN54312 (ROCKETFUEL, US),
Reverse DNS
Software: Jetty(9.3.29.v20201019) /
Resource Hash: c437eb764a99e6cd5172d63c3fae564bbc51eda4981058d5edebd2bf0700eb76

Request headers

Referer: https://www.cardbenefits.citi.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.49 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Cache-Control: no-cache
Content-Length: 118
Content-Type: text/html;charset=utf-8
Date: Sat, 15 Apr 2023 20:33:24 GMT
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Server: Jetty(9.3.29.v20201019)

GET
H2 200 s29200884620189
metrics1.citi.com/b/ss/citibbprod/1/JS-2.1.0/ 43 B
323 B 35ms
35ms Image
image/gif 15.236.125.10
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://metrics1.citi.com/b/ss/citibbprod/1/JS-2.1.0/s29200884620189?AQB=1&ndh=1&pf=1&t=15%2F3%2F2023%2020%3A33%3A24%206%200&fid=0AAE963D3F2B3F4B-0340C2638A1BFDE4&ce=UTF-8&pageName=BenefitBuilder%3Adefault&g=https%3A%2F%2Fwww.cardbenefits.citi.com%2F&c.&page_name=BenefitBuilder%3Adefault&.c&cc=USD&ch=CARDS&server=cardbenefits.citi.com&events=event11&c1=Acxiom&c2=BenefitBuilder&c3=BBUILDER&v12=0&c20=0&v20=0&c21=4%3A30PM&v21=4%3A30PM&c22=Saturday&v22=Saturday&c23=New&v23=New&c24=1&v24=1&c25=First%20page%20view%20or%20cookies%20not%20supported&v25=First%20page%20view%20or%20cookies%20not%20supported&c74=https%3A%2F%2Fwww.cardbenefits.citi.com%2F&c75=Citi%20BB%20s_code%20v6.0%20-%2020171003%20%7C%20SC%20AppMeasurement%20Base%20Code%20v2.1&s=1600x1200&c=24&j=1.6&v=N&k=Y&bw=1600&bh=1200&AQE=1

Requested by

Host: www.cardbenefits.citi.com
URL: https://www.cardbenefits.citi.com/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

15.236.125.10 Paris, France, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-15-236-125-10.eu-west-3.compute.amazonaws.com

Software

jag /

Resource Hash

a1ecbaed793a1f564c49c671f2dd0ce36f858534ef6d26b55783a06b884cc506

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.49 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 15 Apr 2023 20:33:24 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
last-modified: Sun, 16 Apr 2023 20:33:24 GMT
server: jag
etag: 3611188755782926336-4619636750186523881
vary: *
p3p: CP="This is not a P3P policy"
access-control-allow-origin: *
content-type: image/gif;charset=utf-8
cache-control: no-cache, no-store, max-age=0, no-transform, private
content-length: 43
x-xss-protection: 1; mode=block
expires: Fri, 14 Apr 2023 20:33:24 GMT

GET
H/1.1 200
OK ca.html Show response
p.rfihub.com/ Frame 3CEB 118 B
684 B 481ms
30ms Document
text/html 193.0.160.130
ROCKETFUEL

General

Check archive.org

Show headers Download Go to

Full URL: https://p.rfihub.com/ca.html?ver=9&ra=1198&rb=648&ca=&_o=17169175&_t=&pe=https%3A%2F%2Fwww.cardbenefits.citi.com%2F&pf=&ra=16712557739443
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 193.0.160.130 , United States, ASN54312 (ROCKETFUEL, US),
Reverse DNS
Software: Jetty(9.3.29.v20201019) /
Resource Hash: c437eb764a99e6cd5172d63c3fae564bbc51eda4981058d5edebd2bf0700eb76

Request headers

Referer: https://www.cardbenefits.citi.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.49 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Cache-Control: no-cache
Content-Length: 118
Content-Type: text/html;charset=utf-8
Date: Sat, 15 Apr 2023 20:33:25 GMT
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Server: Jetty(9.3.29.v20201019)

GET
H2 403 1560.js
cdn.pbbl.co/r/ 0
0 388ms
295ms Script
text/html 18.173.233.43
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.pbbl.co/r/1560.js
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.173.233.43 London, United Kingdom, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-173-233-43.dus51.r.cloudfront.net
Software: /
Resource Hash

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.49 Safari/537.36

Response headers

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 176 KB
64 KB 38ms
37ms Script
application/javascript 2a00:1450:4001:806::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-916451471

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

798c1f09661daf19fcaedf28a599db2c692dee36abbbe437eda587ea523bc1ab

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.49 Safari/537.36

Response headers

date: Sat, 15 Apr 2023 20:33:24 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 65773
x-xss-protection: 0
last-modified: Sat, 15 Apr 2023 18:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Sat, 15 Apr 2023 20:33:24 GMT

GET
H2 451 425466.html Show response
sr.rlcdn.com/ Frame 89B1 0
98 B 755ms
687ms Document
text/plain 35.190.60.146
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://sr.rlcdn.com/425466.html?es=80676&u=da39a3ee5e6b4b0d3255bfef95601890afd80709
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.190.60.146 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 146.60.190.35.bc.googleusercontent.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.cardbenefits.citi.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.49 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
date: Sat, 15 Apr 2023 20:33:24 GMT
via: 1.1 google

GET
H2 200 / Show response
znbro6yehc0hrkllk-citifeedback.siteintercept.qualtrics.com/SIE/ 8 KB
4 KB 400ms
312ms Script
application/javascript 104.17.208.240
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://znbro6yehc0hrkllk-citifeedback.siteintercept.qualtrics.com/SIE/?Q_ZID=ZN_bro6yEHC0HRkLlk

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.17.208.240 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

9e60dc8bf888a0a4ee8d00c6d8be7d8584b33342c18d9ceecaa171930f40c056

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.49 Safari/537.36

Response headers

date: Sat, 15 Apr 2023 20:33:25 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: br
age: 94655
cf-polished: origSize=9051
edge-control: max-age=604800
referrer-policy: strict-origin-when-cross-origin
cf-bgj: minify
server: cloudflare
etag: W/"235b-NS7T4zpki7a0x6ENiCsi8/FOvmw"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=3600, s-maxage=604800
permissions-policy: camera=(), geolocation=(), microphone=()
cf-ray: 7b86f6a48c94913a-FRA
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept
timing-allow-origin: *

GET
H/1.1

200
OK

iu3
s.amazon-adsystem.com/
Redirect Chain

https://s.amazon-adsystem.com/iu3?pid=c3702eea-109e-48b0-9ef4-c856bdd405e2&event=PageView
https://s.amazon-adsystem.com/iu3?pid=c3702eea-109e-48b0-9ef4-c856bdd405e2&event=PageView&dcc=t

0
0

133ms
133ms

Image
text/html

52.46.151.131
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s.amazon-adsystem.com/iu3?pid=c3702eea-109e-48b0-9ef4-c856bdd405e2&event=PageView&dcc=t
Protocol: HTTP/1.1
Server: 52.46.151.131 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.49 Safari/537.36

Response headers

Redirect headers

Pragma: no-cache
Date: Sat, 15 Apr 2023 20:33:25 GMT
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Server: Server
x-amz-rid: 5ND4A7RJ8QM2EW42MX1Y
Vary: Content-Type,Accept-Encoding,User-Agent
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
Location: https://s.amazon-adsystem.com/iu3?pid=c3702eea-109e-48b0-9ef4-c856bdd405e2&event=PageView&dcc=t
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 0
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H/1.1 200
OK cls_report Show response
prod.report.nacustomerexperience.citi.com/glassbox/reporting/ 39 KB
5 KB 942ms
149ms XHR
application/json 192.193.179.248
CITIGROUP

General

Check archive.org

Show headers Download Go to

Full URL

https://prod.report.nacustomerexperience.citi.com/glassbox/reporting/cls_report?_cls_s=e3c96675-3465-47bd-b85a-8d75871e4128%3A0&_cls_v=fc9c1ab1-6a28-4891-af9a-3a4f4009c47e&pv=2&f_cls_s=true

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

192.193.179.248 , United States, ASN25883 (CITIGROUP, US),

Reverse DNS

Software

GlassBox Cligate /

Resource Hash

657af636f8767c0b56a7db83f43f1588b21579f8b16982ef66229c1f8b885106

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubdomains;
X-Frame-Options	SAMEORIGIN, SAMEORIGIN

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.49 Safari/537.36

Response headers

Date: Sat, 15 Apr 2023 20:33:25 GMT
Strict-Transport-Security: max-age=63072000; includeSubdomains;
content-encoding: gzip
Server: GlassBox Cligate
X-Akamai-CITISITE: SWDC
X-Frame-Options: SAMEORIGIN, SAMEORIGIN
Access-Control-Allow-Methods: POST, GET
Content-Type: application/json
Access-Control-Allow-Origin: https://www.cardbenefits.citi.com
vary: origin
Access-Control-Allow-Credentials: true
Connection: close
Access-Control-Allow-Headers: accept,x-requested-method,origin
content-length: 4490

POST
H2 200 data
col.site24x7rum.com/rum/ 0
0 1830ms
1110ms Ping
application/json 52.35.185.48
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://col.site24x7rum.com/rum/data
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.35.185.48 Boardman, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-35-185-48.us-west-2.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.cardbenefits.citi.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.49 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

GET
H3 200 a
www.googletagmanager.com/ 0
11 B 38ms
38ms Image
text/html 2a00:1450:4001:806::2008
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.googletagmanager.com/a?v=3&t=l&pid=1835041366&rv=34c0&cid=DC-6269322&l=DC-6269322.L3860.S7.E559.TC1.HTC0~gtm.init.S0.E9~gtm.js.S0.E10.TS5rep.TE0~gtm.dom.S0.E5~gtm.load.S0.E4~gtm.init_consent.S0.E10&qi=0

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.49 Safari/537.36

Response headers

date: Sat, 15 Apr 2023 20:33:24 GMT
server: Google Tag Manager
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H2 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/916451471/ 3 KB
2 KB 371ms
50ms Script
text/javascript 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/916451471/?random=1681590804918&cv=11&fst=1681590804918&bg=ffffff&guid=ON&async=1&gtm=45be34c0&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.cardbenefits.citi.com%2F&hn=www.googleadservices.com&frm=0&tiba=Citi%C2%AE%20Card%20Benefits%20-%20Credit%20Card%20Benefits%20for%20Citi%20Customers&auid=609713501.1681590804&uamb=0&uaw=0&data=event%3Dgtag.config&rfmt=3&fmt=4

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

5f9f84dca0dd61ac75a6d72509b4496ef96759bc4f427ddbea3612e0f2ff76e0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.49 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 15 Apr 2023 20:33:25 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1234
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 176 KB
64 KB 330ms
330ms Script
application/javascript 2a00:1450:4001:806::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-960621875&l=dataLayer&cx=c

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

f5e096fc8178cae0cf6bc9e488717aa73dd9015e68d12bba81dbe301b054981b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.49 Safari/537.36

Response headers

date: Sat, 15 Apr 2023 20:33:25 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 65805
x-xss-protection: 0
last-modified: Sat, 15 Apr 2023 18:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Sat, 15 Apr 2023 20:33:25 GMT

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 131 KB
50 KB 341ms
341ms Script
application/javascript 2a00:1450:4001:806::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-644574043&l=dataLayer&cx=c

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

795a990610fd34ad7a58c94c780e81f5cd13388e524145e4d96c1821444c85d4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.49 Safari/537.36

Response headers

date: Sat, 15 Apr 2023 20:33:25 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 51462
x-xss-protection: 0
last-modified: Sat, 15 Apr 2023 18:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Sat, 15 Apr 2023 20:33:25 GMT

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 130 KB
50 KB 305ms
304ms Script
application/javascript 2a00:1450:4001:806::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-975701947&l=dataLayer&cx=c

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

c01e9d98f7206f9911670b8eea7d1e94cec22f5d611614553c2b21be536cab45

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.49 Safari/537.36

Response headers

date: Sat, 15 Apr 2023 20:33:25 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 51360
x-xss-protection: 0
last-modified: Sat, 15 Apr 2023 18:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Sat, 15 Apr 2023 20:33:25 GMT

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 188 KB
67 KB 296ms
296ms Script
application/javascript 2a00:1450:4001:806::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-830907969&l=dataLayer&cx=c

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

2e524320a930af7ed9185809b9385aff48a719012ffe2a2a1d8ab5a732eea1e7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.49 Safari/537.36

Response headers

date: Sat, 15 Apr 2023 20:33:25 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 68998
x-xss-protection: 0
last-modified: Sat, 15 Apr 2023 18:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Sat, 15 Apr 2023 20:33:25 GMT

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 131 KB
50 KB 301ms
301ms Script
application/javascript 2a00:1450:4001:806::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-695231162&l=dataLayer&cx=c

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

4e534c323937c7013e47d49a2180e655222d130d14620a32cff0bce7bedd5764

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.49 Safari/537.36

Response headers

date: Sat, 15 Apr 2023 20:33:25 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 51352
x-xss-protection: 0
last-modified: Sat, 15 Apr 2023 18:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Sat, 15 Apr 2023 20:33:25 GMT

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 178 KB
65 KB 322ms
322ms Script
application/javascript 2a00:1450:4001:806::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-819500023&l=dataLayer&cx=c

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

595829e3a5e2556e6d26b8a62f0bb60c5b653f9899b5f532f2d372c89d1f22f8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.49 Safari/537.36

Response headers

date: Sat, 15 Apr 2023 20:33:25 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 66222
x-xss-protection: 0
last-modified: Sat, 15 Apr 2023 18:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Sat, 15 Apr 2023 20:33:25 GMT

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 131 KB
50 KB 318ms
318ms Script
application/javascript 2a00:1450:4001:806::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-959299794&l=dataLayer&cx=c

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

d42a32002a44905c9bbf13077679d350572217a5a99c7ad6f9e6e035c6a79050

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.49 Safari/537.36

Response headers

date: Sat, 15 Apr 2023 20:33:25 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 51408
x-xss-protection: 0
last-modified: Sat, 15 Apr 2023 18:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Sat, 15 Apr 2023 20:33:25 GMT

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 176 KB
64 KB 315ms
315ms Script
application/javascript 2a00:1450:4001:806::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-10955006959&l=dataLayer&cx=c

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

7b55b329a1e03740c18c46ee5917aba16d707db5558f8cb420a97fc551eb6a47

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.49 Safari/537.36

Response headers

date: Sat, 15 Apr 2023 20:33:25 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 65774
x-xss-protection: 0
last-modified: Sat, 15 Apr 2023 18:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Sat, 15 Apr 2023 20:33:25 GMT

GET
H2 200 10.13da654ebc4ff074d07c.chunk.js Show response
siteintercept.qualtrics.com/dxjsmodule/ 64 KB
20 KB 47ms
46ms Script
application/javascript 104.17.208.240
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://siteintercept.qualtrics.com/dxjsmodule/10.13da654ebc4ff074d07c.chunk.js?Q_CLIENTVERSION=1.89.0&Q_CLIENTTYPE=web&Q_BRANDID=www.cardbenefits.citi.com

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.17.208.240 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

53f1c140ebf7e31e6a8015d357d53b986280a1f847cff8b69e42220c01eb52cf

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.49 Safari/537.36

Response headers

date: Sat, 15 Apr 2023 20:33:25 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: br
age: 357057
cf-polished: origSize=66409
edge-control: max-age=604800
referrer-policy: strict-origin-when-cross-origin
last-modified: Mon, 10 Apr 2023 18:07:31 GMT
cf-bgj: minify
server: cloudflare
etag: W/"10369-1876c5a02b8"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=604800, s-maxage=604800
permissions-policy: camera=(), geolocation=(), microphone=()
cf-ray: 7b86f6a4dd31913a-FRA
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept
timing-allow-origin: *

GET
H2 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/830907969/ 3 KB
1 KB 66ms
66ms Script
text/javascript 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/830907969/?random=1681590805279&cv=11&fst=1681590805279&bg=ffffff&guid=ON&async=1&gtm=45be34c0&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.cardbenefits.citi.com%2F&hn=www.googleadservices.com&frm=0&tiba=Citi%C2%AE%20Card%20Benefits%20-%20Credit%20Card%20Benefits%20for%20Citi%20Customers&auid=609713501.1681590804&uamb=0&uaw=0&data=event%3Dgtag.config&rfmt=3&fmt=4

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ae8ad9f060bd3d65f363d4248fdea6a71d2419e94177efcf9ccc5321777652f2

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.49 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 15 Apr 2023 20:33:25 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1233
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 200 Targeting.php Show response
siteintercept.qualtrics.com/WRSiteInterceptEngine/ 4 KB
2 KB 239ms
238ms XHR
application/json 104.17.208.240
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://siteintercept.qualtrics.com/WRSiteInterceptEngine/Targeting.php?Q_ZoneID=ZN_bro6yEHC0HRkLlk&Q_CLIENTVERSION=1.89.0&Q_CLIENTTYPE=web

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.17.208.240 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

d724a5f7b07527f79290065326cb91078de0c74dac58956b04b995b569e74d8b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.cardbenefits.citi.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.49 Safari/537.36
Content-type: application/x-www-form-urlencoded

Response headers

date: Sat, 15 Apr 2023 20:33:25 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-encoding: br
cf-cache-status: DYNAMIC
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
server: cloudflare
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: https://www.cardbenefits.citi.com
cache-control: no-store, no-cache, must-revalidate, max-age=0
access-control-allow-credentials: true
permissions-policy: camera=(), geolocation=(), microphone=()
trace-id: eb53ddd4ca7dc41e
cf-ray: 7b86f6a53dfd913a-FRA
timing-allow-origin: *

GET
H2 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/695231162/ 3 KB
1 KB 99ms
98ms Script
text/javascript 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/695231162/?random=1681590805310&cv=11&fst=1681590805310&bg=ffffff&guid=ON&async=1&gtm=45be34c0&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.cardbenefits.citi.com%2F&hn=www.googleadservices.com&frm=0&tiba=Citi%C2%AE%20Card%20Benefits%20-%20Credit%20Card%20Benefits%20for%20Citi%20Customers&auid=609713501.1681590804&uamb=0&uaw=0&data=event%3Dgtag.config&rfmt=3&fmt=4

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

3d0a6f9614a0d6ac3b871045e69bc55df29246b2293fdfcd63880c32117499d4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.49 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 15 Apr 2023 20:33:25 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1232
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/975701947/ 3 KB
1 KB 69ms
69ms Script
text/javascript 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/975701947/?random=1681590805322&cv=11&fst=1681590805322&bg=ffffff&guid=ON&async=1&gtm=45be34c0&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.cardbenefits.citi.com%2F&hn=www.googleadservices.com&frm=0&tiba=Citi%C2%AE%20Card%20Benefits%20-%20Credit%20Card%20Benefits%20for%20Citi%20Customers&auid=609713501.1681590804&uamb=0&uaw=0&data=event%3Dgtag.config&rfmt=3&fmt=4

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a2d0950629905c71cf75517f1eb6525627b29a2abcc95be0bf16fab7477bb8db

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.49 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 15 Apr 2023 20:33:25 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1232
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/959299794/ 3 KB
1 KB 99ms
99ms Script
text/javascript 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/959299794/?random=1681590805337&cv=11&fst=1681590805337&bg=ffffff&guid=ON&async=1&gtm=45be34c0&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.cardbenefits.citi.com%2F&hn=www.googleadservices.com&frm=0&tiba=Citi%C2%AE%20Card%20Benefits%20-%20Credit%20Card%20Benefits%20for%20Citi%20Customers&auid=609713501.1681590804&uamb=0&uaw=0&data=event%3Dgtag.config&rfmt=3&fmt=4

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a317f8c54ab2a4a4c87a47536d93ed4d9838e0847f3aeeb02a49fa24bf824171

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.49 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 15 Apr 2023 20:33:25 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1233
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/10955006959/ 3 KB
1 KB 147ms
147ms Script
text/javascript 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/10955006959/?random=1681590805367&cv=11&fst=1681590805367&bg=ffffff&guid=ON&async=1&gtm=45be34c0&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.cardbenefits.citi.com%2F&hn=www.googleadservices.com&frm=0&tiba=Citi%C2%AE%20Card%20Benefits%20-%20Credit%20Card%20Benefits%20for%20Citi%20Customers&auid=609713501.1681590804&uamb=0&uaw=0&data=event%3Dgtag.config&rfmt=3&fmt=4

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

0896e8db9df1f5be7584c8d25fc4da59e68efa77a90fd3c10881cb13963a4e28

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.49 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 15 Apr 2023 20:33:25 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1236
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/644574043/ 3 KB
1 KB 69ms
69ms Script
text/javascript 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/644574043/?random=1681590805383&cv=11&fst=1681590805383&bg=ffffff&guid=ON&async=1&gtm=45be34c0&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.cardbenefits.citi.com%2F&hn=www.googleadservices.com&frm=0&tiba=Citi%C2%AE%20Card%20Benefits%20-%20Credit%20Card%20Benefits%20for%20Citi%20Customers&auid=609713501.1681590804&uamb=0&uaw=0&data=event%3Dgtag.config&rfmt=3&fmt=4

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b17b04dc0d2c35d2e62410a2618740d07a2ca2432465d3354855d0b2a7e7ec79

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.49 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 15 Apr 2023 20:33:25 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1232
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/819500023/ 3 KB
1 KB 183ms
183ms Script
text/javascript 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/819500023/?random=1681590805400&cv=11&fst=1681590805400&bg=ffffff&guid=ON&async=1&gtm=45be34c0&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.cardbenefits.citi.com%2F&hn=www.googleadservices.com&frm=0&tiba=Citi%C2%AE%20Card%20Benefits%20-%20Credit%20Card%20Benefits%20for%20Citi%20Customers&auid=609713501.1681590804&uamb=0&uaw=0&data=event%3Dgtag.config&rfmt=3&fmt=4

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

0ece6d0e46b14c10b60d7e72769a0387822dbf39bfc2dadadc00d99a45c2a185

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.49 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 15 Apr 2023 20:33:25 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1229
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/960621875/ 3 KB
1 KB 104ms
104ms Script
text/javascript 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/960621875/?random=1681590805420&cv=11&fst=1681590805420&bg=ffffff&guid=ON&async=1&gtm=45be34c0&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.cardbenefits.citi.com%2F&hn=www.googleadservices.com&frm=0&tiba=Citi%C2%AE%20Card%20Benefits%20-%20Credit%20Card%20Benefits%20for%20Citi%20Customers&auid=609713501.1681590804&uamb=0&uaw=0&data=event%3Dgtag.config&rfmt=3&fmt=4

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

f41237b29b03ede2a8e721d29eee497db759913d4bb785a960090b9b2fb70b69

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.49 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 15 Apr 2023 20:33:25 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1233
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 prelogin.css
online.citi.com/federatedBranding/v1/css/ 119 KB
15 KB 87ms
38ms Stylesheet
text/css 104.102.43.113
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://online.citi.com/federatedBranding/v1/css/prelogin.css

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.102.43.113 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-102-43-113.deploy.static.akamaitechnologies.com

Software

Resource Hash

5aeaab80bccdfa303f264de43e389206456610bf1a95ccf33cb3e716d410e9b1

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.49 Safari/537.36

Response headers

expires: Sun, 16 Apr 2023 02:33:25 GMT
strict-transport-security: max-age=300
content-encoding: gzip
date: Sat, 15 Apr 2023 20:33:25 GMT
last-modified: Thu, 26 Aug 2021 14:56:09 GMT
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-akamai-citisite: GTDC
vary: Accept-Encoding
content-type: text/css
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
cache-control: max-age=21600
content-length: 15236
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 200 branding_main_citi.css
online.citi.com/federatedBranding/v1/css/ 38 KB
7 KB 93ms
45ms Stylesheet
text/css 104.102.43.113
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://online.citi.com/federatedBranding/v1/css/branding_main_citi.css

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.102.43.113 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-102-43-113.deploy.static.akamaitechnologies.com

Software

Resource Hash

fe6831c996a420f55c8107aec373f542b26aea94847d37e7128d5dab94245fee

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.49 Safari/537.36

Response headers

expires: Sun, 16 Apr 2023 02:33:25 GMT
strict-transport-security: max-age=300
content-encoding: gzip
date: Sat, 15 Apr 2023 20:33:25 GMT
last-modified: Tue, 09 Mar 2021 05:43:06 GMT
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-akamai-citisite: SWDC
vary: Accept-Encoding
content-type: text/css
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
cache-control: max-age=21600
content-length: 6696
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 200 preLoginFooter.css
online.citi.com/federatedBranding/v1/css/ 15 KB
4 KB 91ms
43ms Stylesheet
text/css 104.102.43.113
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://online.citi.com/federatedBranding/v1/css/preLoginFooter.css

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.102.43.113 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-102-43-113.deploy.static.akamaitechnologies.com

Software

Resource Hash

ab70a5f2e7870238214cc4b0ff62fe3db05dc6cb0a9647ed5b2d1ec12f591e87

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.49 Safari/537.36

Response headers

expires: Sun, 16 Apr 2023 02:33:25 GMT
strict-transport-security: max-age=300
content-encoding: gzip
date: Sat, 15 Apr 2023 20:33:25 GMT
last-modified: Tue, 10 Jan 2023 18:17:10 GMT
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-akamai-citisite: SWDC
vary: Accept-Encoding
content-type: text/css
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
cache-control: max-age=21600
content-length: 3721
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 200 oo_engine.min.js Show response
online.citi.com/federatedBranding/v1/headJs/ 42 KB
12 KB 169ms
121ms Script
application/x-javascript 104.102.43.113
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://online.citi.com/federatedBranding/v1/headJs/oo_engine.min.js

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.102.43.113 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-102-43-113.deploy.static.akamaitechnologies.com

Software

Resource Hash

1f2a0e7aa3dabf73dae3cc7c1e53a70ec51145b39b027bdc1ecae9223c0c80d2

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.49 Safari/537.36

Response headers

expires: Sun, 16 Apr 2023 02:33:25 GMT
strict-transport-security: max-age=300
content-encoding: gzip
date: Sat, 15 Apr 2023 20:33:25 GMT
last-modified: Tue, 09 Mar 2021 05:12:15 GMT
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-akamai-citisite: GTDC
vary: Accept-Encoding
content-type: application/x-javascript
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
cache-control: max-age=21600
content-length: 11704
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 200 jquery-combined.min.js Show response
online.citi.com/federatedBranding/v1/headJs/ 318 KB
90 KB 159ms
112ms Script
application/x-javascript 104.102.43.113
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://online.citi.com/federatedBranding/v1/headJs/jquery-combined.min.js

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.102.43.113 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-102-43-113.deploy.static.akamaitechnologies.com

Software

Resource Hash

a23a111c352e400db7b00a1ddfd5f44d8f158969cb0ac6d3eb5abb2ca13738d9

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.49 Safari/537.36

Response headers

expires: Sun, 16 Apr 2023 02:33:25 GMT
strict-transport-security: max-age=300
content-encoding: gzip
date: Sat, 15 Apr 2023 20:33:25 GMT
last-modified: Tue, 09 Mar 2021 05:12:15 GMT
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-akamai-citisite: SWDC
vary: Accept-Encoding
content-type: application/x-javascript
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
cache-control: max-age=21600
content-length: 91637
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 200 jfp.combined.min.js Show response
online.citi.com/federatedBranding/v1/headJs/ 855 KB
146 KB 148ms
101ms Script
application/x-javascript 104.102.43.113
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://online.citi.com/federatedBranding/v1/headJs/jfp.combined.min.js

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.102.43.113 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-102-43-113.deploy.static.akamaitechnologies.com

Software

Resource Hash

292e1f72edc83fb43a4bb43e4accf046baa69ed667a1802c9e5f5522de344b2b

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.49 Safari/537.36

Response headers

expires: Sun, 16 Apr 2023 02:33:25 GMT
strict-transport-security: max-age=300
content-encoding: gzip
date: Sat, 15 Apr 2023 20:33:25 GMT
last-modified: Tue, 09 Mar 2021 05:12:16 GMT
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-akamai-citisite: GTDC
vary: Accept-Encoding
content-type: application/x-javascript
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
cache-control: max-age=21600
content-length: 148431
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 200 preLoginFooter.js Show response
online.citi.com/federatedBranding/v1/headJs/ 560 B
879 B 157ms
110ms Script
application/x-javascript 104.102.43.113
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://online.citi.com/federatedBranding/v1/headJs/preLoginFooter.js

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.102.43.113 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-102-43-113.deploy.static.akamaitechnologies.com

Software

Resource Hash

b72a903861501df1de39dd2c3dac10d0b2511b0608161bb4faff39cebad6a154

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.49 Safari/537.36

Response headers

expires: Sun, 16 Apr 2023 02:33:25 GMT
strict-transport-security: max-age=300
content-encoding: gzip
date: Sat, 15 Apr 2023 20:33:25 GMT
last-modified: Thu, 23 Sep 2021 12:38:02 GMT
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-akamai-citisite: SWDC
vary: Accept-Encoding
content-type: application/x-javascript
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
cache-control: max-age=21600
content-length: 329
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 404 testrlm.js
online.citi.com/federatedBranding/v1/bodyTagJs/ 0
0 728ms
683ms Script
text/html 104.102.43.113
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://online.citi.com/federatedBranding/v1/bodyTagJs/testrlm.js
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 104.102.43.113 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-102-43-113.deploy.static.akamaitechnologies.com
Software: /
Resource Hash

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.49 Safari/537.36

Response headers

GET
H2 200 jquery.autocomplete.js Show response
online.citi.com/federatedBranding/v1/bodyTagJs/ 17 KB
6 KB 143ms
98ms Script
application/x-javascript 104.102.43.113
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://online.citi.com/federatedBranding/v1/bodyTagJs/jquery.autocomplete.js

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.102.43.113 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-102-43-113.deploy.static.akamaitechnologies.com

Software

Resource Hash

e96d366aa97a36d5d438994d17ecc1104e6a8fb8d60ffcbac8c4c8d0147dbf6b

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.49 Safari/537.36

Response headers

expires: Sun, 16 Apr 2023 02:33:25 GMT
strict-transport-security: max-age=300
content-encoding: gzip
date: Sat, 15 Apr 2023 20:33:25 GMT
last-modified: Tue, 09 Mar 2021 05:10:09 GMT
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-akamai-citisite: GTDC
vary: Accept-Encoding
content-type: application/x-javascript
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
cache-control: max-age=21600
content-length: 5196
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 200 navBar.js Show response
online.citi.com/federatedBranding/v1/bodyTagJs/ 225 KB
26 KB 119ms
75ms Script
application/x-javascript 104.102.43.113
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://online.citi.com/federatedBranding/v1/bodyTagJs/navBar.js

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.102.43.113 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-102-43-113.deploy.static.akamaitechnologies.com

Software

Resource Hash

52f8d8ef7330a65f050d9da9f531a09eb512293ca754c8564312ffcea67d0ea2

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.49 Safari/537.36

Response headers

expires: Sun, 16 Apr 2023 02:33:25 GMT
strict-transport-security: max-age=300
content-encoding: gzip
date: Sat, 15 Apr 2023 20:33:25 GMT
last-modified: Fri, 10 Feb 2023 12:12:56 GMT
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-akamai-citisite: SWDC
vary: Accept-Encoding
content-type: application/x-javascript
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
cache-control: max-age=21600
content-length: 26242
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 200 jquery-ui-1.8.9.js Show response
online.citi.com/federatedBranding/v1/bodyTagJs/ 267 KB
60 KB 128ms
84ms Script
application/x-javascript 104.102.43.113
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://online.citi.com/federatedBranding/v1/bodyTagJs/jquery-ui-1.8.9.js

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.102.43.113 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-102-43-113.deploy.static.akamaitechnologies.com

Software

Resource Hash

fe0ffa60df0db77aa9456ccc34f5a4fb49baa909cf641c77315b111bcd7486a5

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.49 Safari/537.36

Response headers

expires: Sun, 16 Apr 2023 02:33:25 GMT
strict-transport-security: max-age=300
content-encoding: gzip
date: Sat, 15 Apr 2023 20:33:25 GMT
last-modified: Tue, 09 Mar 2021 05:10:09 GMT
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-akamai-citisite: GTDC
vary: Accept-Encoding
content-type: application/x-javascript
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
cache-control: max-age=21600
content-length: 60336
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 200 citilive-search.js Show response
online.citi.com/federatedBranding/v1/bodyTagJs/ 2 KB
2 KB 180ms
136ms Script
application/x-javascript 104.102.43.113
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://online.citi.com/federatedBranding/v1/bodyTagJs/citilive-search.js

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.102.43.113 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-102-43-113.deploy.static.akamaitechnologies.com

Software

Resource Hash

1869cd3bacae3e5bc15aaf1aed2775812bd38e29a9eb324c3b9724c94baf645e

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.49 Safari/537.36

Response headers

expires: Sun, 16 Apr 2023 02:33:25 GMT
strict-transport-security: max-age=300
content-encoding: gzip
date: Sat, 15 Apr 2023 20:33:25 GMT
last-modified: Tue, 09 Mar 2021 05:10:08 GMT
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-akamai-citisite: GTDC
vary: Accept-Encoding
content-type: application/x-javascript
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
cache-control: max-age=21600
content-length: 1076
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 200 citi_search.js Show response
online.citi.com/federatedBranding/v1/bodyTagJs/ 6 KB
2 KB 154ms
111ms Script
application/x-javascript 104.102.43.113
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://online.citi.com/federatedBranding/v1/bodyTagJs/citi_search.js

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.102.43.113 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-102-43-113.deploy.static.akamaitechnologies.com

Software

Resource Hash

8e28e708e26399cc3ae5c4ba9581faa284271a50b33731fada501650d01c6ffd

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.49 Safari/537.36

Response headers

expires: Sun, 16 Apr 2023 02:33:25 GMT
strict-transport-security: max-age=300
content-encoding: gzip
date: Sat, 15 Apr 2023 20:33:25 GMT
last-modified: Tue, 09 Mar 2021 05:10:08 GMT
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-akamai-citisite: GTDC
vary: Accept-Encoding
content-type: application/x-javascript
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
cache-control: max-age=21600
content-length: 1433
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 200 inheritance-2.7.js Show response
online.citi.com/federatedBranding/v1/bodyTagJs/ 1 KB
1 KB 164ms
120ms Script
application/x-javascript 104.102.43.113
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://online.citi.com/federatedBranding/v1/bodyTagJs/inheritance-2.7.js

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.102.43.113 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-102-43-113.deploy.static.akamaitechnologies.com

Software

Resource Hash

5ceb00b7cc0b9fcc76171202553e6608f29c09309d5efb2dfc254b177e4862e3

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.49 Safari/537.36

Response headers

expires: Sun, 16 Apr 2023 02:33:25 GMT
strict-transport-security: max-age=300
content-encoding: gzip
date: Sat, 15 Apr 2023 20:33:25 GMT
last-modified: Tue, 09 Mar 2021 05:10:08 GMT
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-akamai-citisite: SWDC
vary: Accept-Encoding
content-type: application/x-javascript
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
cache-control: max-age=21600
content-length: 600
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 200 branding_federated.js Show response
online.citi.com/federatedBranding/v1/bodyTagJs/ 2 KB
1 KB 153ms
110ms Script
application/x-javascript 104.102.43.113
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://online.citi.com/federatedBranding/v1/bodyTagJs/branding_federated.js

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.102.43.113 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-102-43-113.deploy.static.akamaitechnologies.com

Software

Resource Hash

2468545a0699ce571b4f9c3cd167551eb05bdf0531e56b6db09ef4d613214fda

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.49 Safari/537.36

Response headers

expires: Sun, 16 Apr 2023 02:33:25 GMT
strict-transport-security: max-age=300
content-encoding: gzip
date: Sat, 15 Apr 2023 20:33:25 GMT
last-modified: Tue, 09 Mar 2021 05:10:08 GMT
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-akamai-citisite: GTDC
vary: Accept-Encoding
content-type: application/x-javascript
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
cache-control: max-age=21600
content-length: 787
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 200 cbol-smartSearch-inject-BB.js Show response
online.citi.com/federatedBranding/v1/bodyTagJs/ 11 KB
3 KB 154ms
111ms Script
application/x-javascript 104.102.43.113
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://online.citi.com/federatedBranding/v1/bodyTagJs/cbol-smartSearch-inject-BB.js

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.102.43.113 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-102-43-113.deploy.static.akamaitechnologies.com

Software

Resource Hash

6deff94a740c455fd1bd5d099a27a628c6cf6269f272d40a2149fadb9cb43a1b

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.49 Safari/537.36

Response headers

expires: Sun, 16 Apr 2023 02:33:25 GMT
strict-transport-security: max-age=300
content-encoding: gzip
date: Sat, 15 Apr 2023 20:33:25 GMT
last-modified: Tue, 09 Mar 2021 05:10:08 GMT
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-akamai-citisite: GTDC
vary: Accept-Encoding
content-type: application/x-javascript
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
cache-control: max-age=21600
content-length: 2825
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 200 branding_universal.js Show response
online.citi.com/federatedBranding/v1/bodyTagJs/ 36 KB
11 KB 167ms
125ms Script
application/x-javascript 104.102.43.113
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://online.citi.com/federatedBranding/v1/bodyTagJs/branding_universal.js

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.102.43.113 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-102-43-113.deploy.static.akamaitechnologies.com

Software

Resource Hash

42e8f5c6b1aa453a1b0bdddd68fc49e719b4440906b1b1b9882c257c292f0deb

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.49 Safari/537.36

Response headers

expires: Sun, 16 Apr 2023 02:33:25 GMT
strict-transport-security: max-age=300
content-encoding: gzip
date: Sat, 15 Apr 2023 20:33:25 GMT
last-modified: Mon, 04 Oct 2021 06:24:47 GMT
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-akamai-citisite: GTDC
vary: Accept-Encoding
content-type: application/x-javascript
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
cache-control: max-age=21600
content-length: 10750
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 200 citilogoredesign.png
online.citi.com/GFC/branding/img/redesigned/ 2 KB
2 KB 103ms
61ms Image
image/png 104.102.43.113
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://online.citi.com/GFC/branding/img/redesigned/citilogoredesign.png

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.102.43.113 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-102-43-113.deploy.static.akamaitechnologies.com

Software

Resource Hash

102503acef6077fcf8e42a856fb4904fcd74224a32d5d8efcd13236ac6309fed

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.49 Safari/537.36

Response headers

strict-transport-security: max-age=300
date: Sat, 15 Apr 2023 20:33:25 GMT
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
last-modified: Thu, 02 Jul 2020 07:18:33 GMT
x-akamai-citisite: SWDC
content-type: image/png
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
accept-ranges: bytes
content-length: 1799
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 200 atmbranchloc.svg
online.citi.com/GFC/branding/img/redesigned/ 2 KB
1 KB 86ms
44ms Image
image/svg+xml 104.102.43.113
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://online.citi.com/GFC/branding/img/redesigned/atmbranchloc.svg

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.102.43.113 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-102-43-113.deploy.static.akamaitechnologies.com

Software

Resource Hash

6336ae7b60dff18e0a37721a3a19fd5e18568577a64faa662969d35966dbf72b

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.49 Safari/537.36

Response headers

strict-transport-security: max-age=300
content-encoding: gzip
date: Sat, 15 Apr 2023 20:33:25 GMT
last-modified: Wed, 29 Jul 2020 05:29:17 GMT
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-akamai-citisite: SWDC
vary: Accept-Encoding
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
content-type: image/svg+xml
accept-ranges: bytes
content-length: 758
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 200 /
www.google.com/pagead/1p-user-list/916451471/ 42 B
108 B 86ms
37ms Image
image/gif 2a00:1450:4001:806::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/916451471/?random=1681590804918&cv=11&fst=1681588800000&bg=ffffff&guid=ON&async=1&gtm=45be34c0&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.cardbenefits.citi.com%2F&frm=0&tiba=Citi%C2%AE%20Card%20Benefits%20-%20Credit%20Card%20Benefits%20for%20Citi%20Customers&data=event%3Dgtag.config&fmt=3&is_vtc=1&random=3485402975&rmt_tld=0&ipr=y

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:806::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.49 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 15 Apr 2023 20:33:25 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.de/pagead/1p-user-list/916451471/ 42 B
455 B 88ms
33ms Image
image/gif 2a00:1450:4001:810::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/916451471/?random=1681590804918&cv=11&fst=1681588800000&bg=ffffff&guid=ON&async=1&gtm=45be34c0&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.cardbenefits.citi.com%2F&frm=0&tiba=Citi%C2%AE%20Card%20Benefits%20-%20Credit%20Card%20Benefits%20for%20Citi%20Customers&data=event%3Dgtag.config&fmt=3&is_vtc=1&random=3485402975&rmt_tld=1&ipr=y

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.49 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 15 Apr 2023 20:33:25 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.com/pagead/1p-user-list/830907969/ 42 B
455 B 77ms
34ms Image
image/gif 2a00:1450:4001:806::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/830907969/?random=1681590805279&cv=11&fst=1681588800000&bg=ffffff&guid=ON&async=1&gtm=45be34c0&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.cardbenefits.citi.com%2F&frm=0&tiba=Citi%C2%AE%20Card%20Benefits%20-%20Credit%20Card%20Benefits%20for%20Citi%20Customers&data=event%3Dgtag.config&fmt=3&is_vtc=1&random=1209604637&rmt_tld=0&ipr=y

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:806::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.49 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 15 Apr 2023 20:33:25 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.de/pagead/1p-user-list/830907969/ 42 B
108 B 83ms
33ms Image
image/gif 2a00:1450:4001:810::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/830907969/?random=1681590805279&cv=11&fst=1681588800000&bg=ffffff&guid=ON&async=1&gtm=45be34c0&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.cardbenefits.citi.com%2F&frm=0&tiba=Citi%C2%AE%20Card%20Benefits%20-%20Credit%20Card%20Benefits%20for%20Citi%20Customers&data=event%3Dgtag.config&fmt=3&is_vtc=1&random=1209604637&rmt_tld=1&ipr=y

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.49 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 15 Apr 2023 20:33:25 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.com/pagead/1p-user-list/975701947/ 42 B
108 B 81ms
38ms Image
image/gif 2a00:1450:4001:806::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/975701947/?random=1681590805322&cv=11&fst=1681588800000&bg=ffffff&guid=ON&async=1&gtm=45be34c0&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.cardbenefits.citi.com%2F&frm=0&tiba=Citi%C2%AE%20Card%20Benefits%20-%20Credit%20Card%20Benefits%20for%20Citi%20Customers&data=event%3Dgtag.config&fmt=3&is_vtc=1&random=2127923060&rmt_tld=0&ipr=y

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:806::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.49 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 15 Apr 2023 20:33:25 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.de/pagead/1p-user-list/975701947/ 42 B
108 B 85ms
35ms Image
image/gif 2a00:1450:4001:810::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/975701947/?random=1681590805322&cv=11&fst=1681588800000&bg=ffffff&guid=ON&async=1&gtm=45be34c0&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.cardbenefits.citi.com%2F&frm=0&tiba=Citi%C2%AE%20Card%20Benefits%20-%20Credit%20Card%20Benefits%20for%20Citi%20Customers&data=event%3Dgtag.config&fmt=3&is_vtc=1&random=2127923060&rmt_tld=1&ipr=y

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.49 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 15 Apr 2023 20:33:25 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.com/pagead/1p-user-list/695231162/ 42 B
108 B 77ms
35ms Image
image/gif 2a00:1450:4001:806::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/695231162/?random=1681590805310&cv=11&fst=1681588800000&bg=ffffff&guid=ON&async=1&gtm=45be34c0&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.cardbenefits.citi.com%2F&frm=0&tiba=Citi%C2%AE%20Card%20Benefits%20-%20Credit%20Card%20Benefits%20for%20Citi%20Customers&data=event%3Dgtag.config&fmt=3&is_vtc=1&random=487863195&rmt_tld=0&ipr=y

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:806::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.49 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 15 Apr 2023 20:33:25 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.de/pagead/1p-user-list/695231162/ 42 B
108 B 83ms
34ms Image
image/gif 2a00:1450:4001:810::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/695231162/?random=1681590805310&cv=11&fst=1681588800000&bg=ffffff&guid=ON&async=1&gtm=45be34c0&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.cardbenefits.citi.com%2F&frm=0&tiba=Citi%C2%AE%20Card%20Benefits%20-%20Credit%20Card%20Benefits%20for%20Citi%20Customers&data=event%3Dgtag.config&fmt=3&is_vtc=1&random=487863195&rmt_tld=1&ipr=y

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.49 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 15 Apr 2023 20:33:25 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.com/pagead/1p-user-list/959299794/ 42 B
108 B 33ms
32ms Image
image/gif 2a00:1450:4001:806::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/959299794/?random=1681590805337&cv=11&fst=1681588800000&bg=ffffff&guid=ON&async=1&gtm=45be34c0&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.cardbenefits.citi.com%2F&frm=0&tiba=Citi%C2%AE%20Card%20Benefits%20-%20Credit%20Card%20Benefits%20for%20Citi%20Customers&data=event%3Dgtag.config&fmt=3&is_vtc=1&random=1253743329&rmt_tld=0&ipr=y

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:806::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.49 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 15 Apr 2023 20:33:25 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.de/pagead/1p-user-list/959299794/ 42 B
108 B 32ms
31ms Image
image/gif 2a00:1450:4001:810::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/959299794/?random=1681590805337&cv=11&fst=1681588800000&bg=ffffff&guid=ON&async=1&gtm=45be34c0&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.cardbenefits.citi.com%2F&frm=0&tiba=Citi%C2%AE%20Card%20Benefits%20-%20Credit%20Card%20Benefits%20for%20Citi%20Customers&data=event%3Dgtag.config&fmt=3&is_vtc=1&random=1253743329&rmt_tld=1&ipr=y

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.49 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 15 Apr 2023 20:33:25 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.com/pagead/1p-user-list/644574043/ 42 B
108 B 33ms
32ms Image
image/gif 2a00:1450:4001:806::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/644574043/?random=1681590805383&cv=11&fst=1681588800000&bg=ffffff&guid=ON&async=1&gtm=45be34c0&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.cardbenefits.citi.com%2F&frm=0&tiba=Citi%C2%AE%20Card%20Benefits%20-%20Credit%20Card%20Benefits%20for%20Citi%20Customers&data=event%3Dgtag.config&fmt=3&is_vtc=1&random=4007275881&rmt_tld=0&ipr=y

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:806::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.49 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 15 Apr 2023 20:33:25 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.de/pagead/1p-user-list/644574043/ 42 B
108 B 32ms
32ms Image
image/gif 2a00:1450:4001:810::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/644574043/?random=1681590805383&cv=11&fst=1681588800000&bg=ffffff&guid=ON&async=1&gtm=45be34c0&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.cardbenefits.citi.com%2F&frm=0&tiba=Citi%C2%AE%20Card%20Benefits%20-%20Credit%20Card%20Benefits%20for%20Citi%20Customers&data=event%3Dgtag.config&fmt=3&is_vtc=1&random=4007275881&rmt_tld=1&ipr=y

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.49 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 15 Apr 2023 20:33:25 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.com/pagead/1p-user-list/10955006959/ 42 B
108 B 33ms
33ms Image
image/gif 2a00:1450:4001:806::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/10955006959/?random=1681590805367&cv=11&fst=1681588800000&bg=ffffff&guid=ON&async=1&gtm=45be34c0&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.cardbenefits.citi.com%2F&frm=0&tiba=Citi%C2%AE%20Card%20Benefits%20-%20Credit%20Card%20Benefits%20for%20Citi%20Customers&data=event%3Dgtag.config&fmt=3&is_vtc=1&random=4156975217&rmt_tld=0&ipr=y

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:806::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.49 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 15 Apr 2023 20:33:25 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.de/pagead/1p-user-list/10955006959/ 42 B
108 B 33ms
32ms Image
image/gif 2a00:1450:4001:810::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/10955006959/?random=1681590805367&cv=11&fst=1681588800000&bg=ffffff&guid=ON&async=1&gtm=45be34c0&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.cardbenefits.citi.com%2F&frm=0&tiba=Citi%C2%AE%20Card%20Benefits%20-%20Credit%20Card%20Benefits%20for%20Citi%20Customers&data=event%3Dgtag.config&fmt=3&is_vtc=1&random=4156975217&rmt_tld=1&ipr=y

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.49 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 15 Apr 2023 20:33:25 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 CoreModule.js Show response
siteintercept.qualtrics.com/dxjsmodule/ 102 KB
32 KB 51ms
51ms Script
application/javascript 104.17.208.240
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://siteintercept.qualtrics.com/dxjsmodule/CoreModule.js?Q_CLIENTVERSION=1.89.0&Q_CLIENTTYPE=web&Q_BRANDID=citifeedback

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.17.208.240 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

80612033ea475d4cebf196357cc1f0b9eec98c0cfcaff55531acacd5bf3a459a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.49 Safari/537.36

Response headers

date: Sat, 15 Apr 2023 20:33:25 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: br
age: 356992
cf-polished: origSize=104979
edge-control: max-age=604800
referrer-policy: strict-origin-when-cross-origin
last-modified: Mon, 10 Apr 2023 18:07:31 GMT
cf-bgj: minify
server: cloudflare
etag: W/"19a13-1876c5a02b8"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=604800, s-maxage=604800
permissions-policy: camera=(), geolocation=(), microphone=()
cf-ray: 7b86f6a6f97d913a-FRA
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept
timing-allow-origin: *

GET
H2 200 branding_main.css
online.citi.com/federatedBranding/v1/css/ 115 KB
18 KB 49ms
49ms Stylesheet
text/css 104.102.43.113
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://online.citi.com/federatedBranding/v1/css/branding_main.css

Requested by

Host: online.citi.com
URL: https://online.citi.com/federatedBranding/v1/css/branding_main_citi.css

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.102.43.113 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-102-43-113.deploy.static.akamaitechnologies.com

Software

Resource Hash

b96d4da6072b9304962e4b50160af130afb555e377285167785a76128ee3e03b

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://online.citi.com/federatedBranding/v1/css/branding_main_citi.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.49 Safari/537.36

Response headers

expires: Sun, 16 Apr 2023 02:33:25 GMT
strict-transport-security: max-age=300
content-encoding: gzip
date: Sat, 15 Apr 2023 20:33:25 GMT
last-modified: Tue, 03 Jan 2023 23:11:58 GMT
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-akamai-citisite: SWDC
vary: Accept-Encoding
content-type: text/css
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
cache-control: max-age=21600
content-length: 17486
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 200 /
www.google.com/pagead/1p-user-list/960621875/ 42 B
108 B 35ms
34ms Image
image/gif 2a00:1450:4001:806::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/960621875/?random=1681590805420&cv=11&fst=1681588800000&bg=ffffff&guid=ON&async=1&gtm=45be34c0&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.cardbenefits.citi.com%2F&frm=0&tiba=Citi%C2%AE%20Card%20Benefits%20-%20Credit%20Card%20Benefits%20for%20Citi%20Customers&data=event%3Dgtag.config&fmt=3&is_vtc=1&random=2148729049&rmt_tld=0&ipr=y

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:806::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.49 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 15 Apr 2023 20:33:25 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.de/pagead/1p-user-list/960621875/ 42 B
108 B 36ms
35ms Image
image/gif 2a00:1450:4001:810::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/960621875/?random=1681590805420&cv=11&fst=1681588800000&bg=ffffff&guid=ON&async=1&gtm=45be34c0&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.cardbenefits.citi.com%2F&frm=0&tiba=Citi%C2%AE%20Card%20Benefits%20-%20Credit%20Card%20Benefits%20for%20Citi%20Customers&data=event%3Dgtag.config&fmt=3&is_vtc=1&random=2148729049&rmt_tld=1&ipr=y

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.49 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 15 Apr 2023 20:33:25 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.com/pagead/1p-user-list/819500023/ 42 B
108 B 34ms
32ms Image
image/gif 2a00:1450:4001:806::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/819500023/?random=1681590805400&cv=11&fst=1681588800000&bg=ffffff&guid=ON&async=1&gtm=45be34c0&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.cardbenefits.citi.com%2F&frm=0&tiba=Citi%C2%AE%20Card%20Benefits%20-%20Credit%20Card%20Benefits%20for%20Citi%20Customers&data=event%3Dgtag.config&fmt=3&is_vtc=1&random=1894783268&rmt_tld=0&ipr=y

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:806::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.49 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 15 Apr 2023 20:33:25 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.de/pagead/1p-user-list/819500023/ 42 B
108 B 34ms
33ms Image
image/gif 2a00:1450:4001:810::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/819500023/?random=1681590805400&cv=11&fst=1681588800000&bg=ffffff&guid=ON&async=1&gtm=45be34c0&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.cardbenefits.citi.com%2F&frm=0&tiba=Citi%C2%AE%20Card%20Benefits%20-%20Credit%20Card%20Benefits%20for%20Citi%20Customers&data=event%3Dgtag.config&fmt=3&is_vtc=1&random=1894783268&rmt_tld=1&ipr=y

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:810::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.49 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 15 Apr 2023 20:33:25 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 bg-branding-banner.jpg
online.citi.com/GFC/branding/img/ 5 KB
5 KB 57ms
56ms Image
image/jpeg 104.102.43.113
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://online.citi.com/GFC/branding/img/bg-branding-banner.jpg

Requested by

Host: online.citi.com
URL: https://online.citi.com/federatedBranding/v1/css/branding_main.css

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.102.43.113 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-102-43-113.deploy.static.akamaitechnologies.com

Software

Resource Hash

b47060147f820f4721134724e1a38cab5fcc6960091389f6b4587769c4d2c313

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://online.citi.com/federatedBranding/v1/css/branding_main.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.49 Safari/537.36

Response headers

strict-transport-security: max-age=300
date: Sat, 15 Apr 2023 20:33:25 GMT
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
last-modified: Tue, 12 Sep 2017 16:59:12 GMT
x-akamai-citisite: SWDC
content-type: image/jpeg
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
accept-ranges: bytes
content-length: 4857
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 200 Interstate-Light.woff
online.citi.com/GFC/branding/fonts/ 74 KB
74 KB 32ms
32ms Font
application/octet-stream 104.102.43.113
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://online.citi.com/GFC/branding/fonts/Interstate-Light.woff

Requested by

Host: online.citi.com
URL: https://online.citi.com/federatedBranding/v1/css/branding_main_citi.css

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.102.43.113 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-102-43-113.deploy.static.akamaitechnologies.com

Software

Resource Hash

f327a0ba3e41b1e8154e1c18fc114baff0bd057151e3afe7fa6f33cc0cb18296

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

Referer: https://online.citi.com/federatedBranding/v1/css/branding_main_citi.css
Origin: https://www.cardbenefits.citi.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.49 Safari/537.36

Response headers

strict-transport-security: max-age=300
content-encoding: gzip
date: Sat, 15 Apr 2023 20:33:25 GMT
last-modified: Tue, 12 Sep 2017 17:22:45 GMT
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-akamai-citisite: GTDC
vary: Accept-Encoding
content-type: text/plain
access-control-allow-origin: *
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
content-length: 75483
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 200 5.07a6a69905ef056ba9ee.chunk.js Show response
siteintercept.qualtrics.com/dxjsmodule/ 2 KB
895 B 54ms
53ms Script
application/javascript 104.17.208.240
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://siteintercept.qualtrics.com/dxjsmodule/5.07a6a69905ef056ba9ee.chunk.js?Q_CLIENTVERSION=1.89.0&Q_CLIENTTYPE=web&Q_BRANDID=citifeedback

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.17.208.240 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f1b46a29347f98c4452c9e512233641444def5ebf724cf4cc6a8b18709323204

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.49 Safari/537.36

Response headers

date: Sat, 15 Apr 2023 20:33:25 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: br
age: 356991
cf-polished: origSize=2522
edge-control: max-age=604800
referrer-policy: strict-origin-when-cross-origin
last-modified: Mon, 10 Apr 2023 18:07:31 GMT
cf-bgj: minify
server: cloudflare
etag: W/"9da-1876c5a02b8"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=604800, s-maxage=604800
permissions-policy: camera=(), geolocation=(), microphone=()
cf-ray: 7b86f6a78aa4913a-FRA
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept
timing-allow-origin: *

GET
H2 200 1.92310019cd9a5ffe1656.chunk.js Show response
siteintercept.qualtrics.com/dxjsmodule/ 28 KB
7 KB 44ms
44ms Script
application/javascript 104.17.208.240
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://siteintercept.qualtrics.com/dxjsmodule/1.92310019cd9a5ffe1656.chunk.js?Q_CLIENTVERSION=1.89.0&Q_CLIENTTYPE=web&Q_BRANDID=citifeedback

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.17.208.240 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

ee84f35cccd4482139bcd41e7e0b932961363f9a702082b36ecb0b48921c2fc0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.49 Safari/537.36

Response headers

date: Sat, 15 Apr 2023 20:33:25 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: br
age: 356991
cf-polished: origSize=29372
edge-control: max-age=604800
referrer-policy: strict-origin-when-cross-origin
last-modified: Mon, 10 Apr 2023 18:07:31 GMT
cf-bgj: minify
server: cloudflare
etag: W/"72bc-1876c5a02b8"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=604800, s-maxage=604800
permissions-policy: camera=(), geolocation=(), microphone=()
cf-ray: 7b86f6a78aa8913a-FRA
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept
timing-allow-origin: *

GET
H2 200 FeedbackButtonModule.js Show response
siteintercept.qualtrics.com/dxjsmodule/ 63 KB
23 KB 48ms
48ms Script
application/javascript 104.17.208.240
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://siteintercept.qualtrics.com/dxjsmodule/FeedbackButtonModule.js?Q_CLIENTVERSION=1.89.0&Q_CLIENTTYPE=web&Q_BRANDID=citifeedback

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.17.208.240 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

b24c5b325810b01a60487c8a42151b8f6ac44d1173722ec526c54fe7c4b7c762

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.49 Safari/537.36

Response headers

date: Sat, 15 Apr 2023 20:33:25 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: br
age: 356986
cf-polished: origSize=65177
edge-control: max-age=604800
referrer-policy: strict-origin-when-cross-origin
last-modified: Mon, 10 Apr 2023 18:07:31 GMT
cf-bgj: minify
server: cloudflare
etag: W/"fe99-1876c5a02b8"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=604800, s-maxage=604800
permissions-policy: camera=(), geolocation=(), microphone=()
cf-ray: 7b86f6a78aad913a-FRA
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept
timing-allow-origin: *

GET
H2 200 Asset.php Show response
siteintercept.qualtrics.com/WRSiteInterceptEngine/ 5 KB
2 KB 94ms
46ms XHR
application/json 104.17.208.240
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://siteintercept.qualtrics.com/WRSiteInterceptEngine/Asset.php?Module=SI_8B5oMIbRX4YInUG&Version=12&Q_ORIGIN=https://www.cardbenefits.citi.com&Q_CLIENTVERSION=1.89.0&Q_CLIENTTYPE=web

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.17.208.240 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f7718f62c157d811823428b72f258a9398b5f1124576cf33d9f361ea73d9571c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.49 Safari/537.36

Response headers

expires: Sat, 09 Apr 2033 03:17:03 GMT
date: Sat, 15 Apr 2023 20:33:25 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: br
age: 321381
p3p: CP="CAO DSP COR CURa ADMa DEVa OUR IND PHY ONL UNI COM NAV INT DEM PRE"
edge-control: max-age=604800
referrer-policy: strict-origin-when-cross-origin
last-modified: Wed, 12 Apr 2023 03:17:04 GMT
server: cloudflare
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: *
cache-control: public, max-age=604800, s-maxage=604800, max-age=315360000
access-control-allow-credentials: false
permissions-policy: camera=(), geolocation=(), microphone=()
cf-ray: 7b86f6a7dcae2bac-FRA
servershortname

GET
H2 200 Asset.php Show response
siteintercept.qualtrics.com/WRSiteInterceptEngine/ 2 KB
765 B 95ms
46ms XHR
application/json 104.17.208.240
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://siteintercept.qualtrics.com/WRSiteInterceptEngine/Asset.php?Module=CR_6ijNH7d3IMqHIvY&Version=1&Q_InterceptID=SI_8B5oMIbRX4YInUG&Q_ORIGIN=https://www.cardbenefits.citi.com&Q_CLIENTVERSION=1.89.0&Q_CLIENTTYPE=web

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.17.208.240 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

3a0c7beb20db9ed78b764c5384eff2a97f5aa347d6c1aad914e08edd91e25fb4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.49 Safari/537.36

Response headers

expires: Mon, 11 Apr 2033 12:14:33 GMT
date: Sat, 15 Apr 2023 20:33:25 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: br
age: 116332
p3p: CP="CAO DSP COR CURa ADMa DEVa OUR IND PHY ONL UNI COM NAV INT DEM PRE"
edge-control: max-age=604800
referrer-policy: strict-origin-when-cross-origin
last-modified: Fri, 14 Apr 2023 12:14:33 GMT
server: cloudflare
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: *
cache-control: public, max-age=604800, s-maxage=604800, max-age=315360000
access-control-allow-credentials: false
permissions-policy: camera=(), geolocation=(), microphone=()
cf-ray: 7b86f6a7dcb02bac-FRA
servershortname

GET
H2 200 Graphic.php
iad1.qualtrics.com/WRQualtricsSiteIntercept/ 2 KB
3 KB 131ms
47ms Image
image/png 2.18.232.194
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://iad1.qualtrics.com/WRQualtricsSiteIntercept/Graphic.php?IM=IM_2ghDuHHjeSOirNc

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2.18.232.194 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a2-18-232-194.deploy.static.akamaitechnologies.com

Software

Resource Hash

25f4eeb23f67fe1d74534ed37230ecd54ab4f57524276970dcbeaaf3b0fc64f9

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.49 Safari/537.36

Response headers

date: Sat, 15 Apr 2023 20:33:25 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
content-security-policy-report-only: report-uri https://sjc1.qualtrics.com/csp-report
content-disposition: inline; filename=feedback.png
content-length: 2196
x-request-id: 83d91ccc-3dc6-421a-84cc-3f1f4c09faf8
referrer-policy: strict-origin-when-cross-origin
etag: "e6ed675f115fb1568bb1aabc00aa3f30"
content-type: image/png
access-control-allow-origin: *
x-transaction-id: 1d2c72e1-dbdb-4a1e-98cd-a657b40d25a5
cache-control: public, max-age=12
permissions-policy: camera=(), geolocation=(), microphone=()
x-robots-tag: noindex
expires: Sat, 15 Apr 2023 20:33:37 GMT

POST
H2 200 / Show response
siteintercept.qualtrics.com/WRSiteInterceptEngine/ 45 B
236 B 186ms
186ms XHR
text/plain 104.17.208.240
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://siteintercept.qualtrics.com/WRSiteInterceptEngine/?Q_Impress=1&Q_CID=CR_6ijNH7d3IMqHIvY&Q_SIID=SI_8B5oMIbRX4YInUG&Q_ASID=AS_cBEAA91wJ93h69E&Q_CLIENTVERSION=1.89.0&Q_CLIENTTYPE=web&r=1681590805912

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.17.208.240 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f47f21063dfdcbdeffed3d97689b45efae7a52401cd7fc5b8d07c42d2f232ab9

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.cardbenefits.citi.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.49 Safari/537.36
Content-type: application/x-www-form-urlencoded

Response headers

date: Sat, 15 Apr 2023 20:33:26 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
referrer-policy: strict-origin-when-cross-origin
cf-cache-status: DYNAMIC
content-encoding: br
x-content-type-options: nosniff
server: cloudflare
vary: Accept-Encoding
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://www.cardbenefits.citi.com
cache-control: no-store, no-cache, must-revalidate, max-age=0
access-control-allow-credentials: true
permissions-policy: camera=(), geolocation=(), microphone=()
trace-id: 1aeae4f08b8067bc
cf-ray: 7b86f6a94ee12bac-FRA

GET
H2 200 wr-dialog-close-btn-white.png
siteintercept.qualtrics.com/WRQualtricsShared/Graphics/siteintercept/ 254 B
523 B 98ms
97ms Image
image/png 104.17.208.240
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://siteintercept.qualtrics.com/WRQualtricsShared/Graphics/siteintercept/wr-dialog-close-btn-white.png

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.17.208.240 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

cd5496f75a7c1029bc681f639794b83f034d5ecd884e8514ae12b13eee9eec70

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.49 Safari/537.36

Response headers

expires: Thu, 17 Mar 2033 11:41:25 GMT
date: Sat, 15 Apr 2023 20:33:25 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
age: 2278320
cf-polished: origSize=759
p3p: CP="CAO DSP COR CURa ADMa DEVa OUR IND PHY ONL UNI COM NAV INT DEM PRE"
content-length: 254
referrer-policy: strict-origin-when-cross-origin
last-modified: Tue, 28 Feb 2023 19:32:28 GMT
cf-bgj: imgq:85,h2pri
server: cloudflare
vary: Accept-Encoding
content-type: image/png
cache-control: max-age=315360000, public
permissions-policy: camera=(), geolocation=(), microphone=()
accept-ranges: bytes
cf-ray: 7b86f6a94e22913a-FRA
trace-id: 75d12b1d8566c104
servershortname

GET
H2 204 r.rnc
data.privacy.ensighten.com/privacy/v1/b/ 0
106 B 37ms
36ms Image
text/plain 3.124.119.57
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://data.privacy.ensighten.com/privacy/v1/b/r.rnc?n=1&c=1129&i=57y38a&p=na_prod&s=15660&d=8HB7InZlcnNpb24iOiIxLjAuMCIsImdhdGV3YXkiOiIyLjMuNjExIiwiY2xpZW50SWQiOjExMjksInB1Ymxpc2hQYXRoIjoibmFfcHJvZCIsImluc3RhbmNlSWQiOiI1N3kzOGEiLCJwYWNrZXQiOjEsIm1vZGUiOiJlbmZvcmNlWgDwCG9va2llcyI6eyJCQU5ORVJfTE9BREVEkQDyJyJ9LCJlbnZpcm9ubWVudCI6IkNCT0wgUHJpdmFjeSIsInJlcXVlc3RzIjpbeyJkZXN0aW5hdM4A8TxodHRwczovL3d3dy5jYXJkYmVuZWZpdHMuY2l0aS5jb20vZGlzdC9qcy92ZW5kb3JzL3NjcmlwdHMubWluLmpzIiwidHlwZSI6InMYAHAiLCJzdGFyxgDANjgxNTkwODAzOTk0oQAAFgEEFADxAzQwMDIsInNvdXJjZSI6Im11dJEAok9ic2VydmVyQ0xIAKF0dXMiOiJsb2FkxgBAYXNvbsUA1F0sImRhdGFQYXR0ZXISALJsaXN0IjpbXSwiaWoAzzA3NDU1MTQ1NzF9LPcABWZvbmxpbmXtAHBnY2dhcGkvpwERL70B8BZjL3YxL3ByZWxvZ2luL2RpZ2l0YWwvY3VzdG9tZXJFbnRpdGxldgGDL2Jyb3dzZXIoAaIvYnJhbmRpbmc_OAFCSWQ9QlsB9QVCdWlsZGVyJnVzZXJUeXBlPUJCIkUBMnhocvoACUIBTjQwMTZCAQAUAAVCAbJYSFJfTUFOQUdFUkEAAjsBb2FsbG93ZT4BIa8zMjg0OTE2MDU1PgGwHzc-AQAXN4ACDz4BRx82PgEHD3MDB_ApYnVuZGxlcy9qcz92PW1wSTVna05jQkYydjhtUFp2ek1yT2R4UndEdjY5ZE00TmFvUEkwU0FITmODBA-OAw0_NDAxDgEAJzI1DgEPjgNBvzc5NzQ1MDAxMzU4EgEH8QBuZXh1cy5lbnNpZ2h0ZW5_BACIBCIvbjoFEy8eBPAWb21wb25lbnQucGhwP25hbWVzcGFjZT1Cb290c3RyYXBwZXImc1IEMGNKc3wFHz1ZAA5hY29kZS8m8gPyIHNoZWRPbj1XZWQlMjBBcHIlMjAwNSUyMDEzOjU1OjIyJTIwR01UJTIwMjAyMyZD8gUgRD3xBYEmUGFnZUlEPVUFnyUzQSUyRiUyRugBBjYlMkb6AwJXBQK8Awn9A04zOTg1vwIYND8Fwmluc2VydEJlZm9yZUIAAv4DDzkFJK8yMzUxMDMwMjcwqwH_IA-oBQAJqwEPXANBFTixAQ_qBgiGbWV0cmljczHsBvZwaWQ_ZF92aXNpZF92ZXI9NC40LjAmZF9maWVsZGdyb3VwPUEmbWNvcmdpZD02MTgzNEQ5QjUyMjhBNzQzMEE0OTBENDUlNDBBZG9iZU9yZyZtaWQ9NzA1NzA2MTY1MDEwNDg3NTUwMjE1MzI1NDAxOTI4OTQyNDk2MDQmdHM9MQsIJjQ5BwMPAQcFLzQ5BAMAFzm1BA_DBT6fMTQ5Mzc5MTg0AQcID1UB_0MPrQUT8BozNGZlZGE5MjkwYzFlNGFlNWE0NmQxMTE4NzRlOTcxMS5qcz9jb25kaekKtUlkMD00NjIxMzIiawkPcQUGPzQwM8YDABg2MAgPcQU9jzc2NTQ1ODk4awIIDxYBby40MYMDCRYBD9wEQwMcAR85jQYpAd8H_hFhZjNiMjEwNzBkZDAxYWIyMmE0ZjMzMTA1NjMyNDM3NDICVzg5NzA5nQQPMwIJHzgdAQAIoAQPMwI9nzgwMzQxNTM0MqQHKA8XAU8PNAICCBcBDzQCQwQdAQ9QAy7wBzlkOWE3NjY3ZWRhMTY0MjFiNzU5ZDNwBG4zNGQyNWY0Aj82NzIzAhQuNDAzAh83ZgRIrzA3NDI3OTU3MTkzAi0PFgFKD2YEAAkWAQ8yAkIEHAEfMmYELv8QMzNmOGYzMGY3YzcwNzRlZWM4NGRjNDJlNDI4NDBiMJgGAF8yMTkwOJgGEw8FCQAnOTYFCQ9lBDu_Nzk2NDA1NjA4MDQyAi0PFgFJD2QEAQkWAQ8yAkEGHAEP4g8ID7QHE_4RZTVjZjMzOTk2OTg1YjE3MWI5MzcyZTI1YTkwOGYwODlkBF8zMjc5NDICEg9kBAA_MTA4MgJGvzgyNTMxMTg0ODQzMgItDxYBSg5kBAoWAQ8yAkEGHAEPTgMIDywQBhQvFBLBbm9tb25pdG9yaW5nIBL_HHpGZmliaGZuai1sZTNzRXBiM2Fvb1RUNVhfdVNJQzFGbE0tLTNzVEFjb2sgEhMAuRYiZW5EFQLCFT80MTC0B0-PNjI2ODExMDXEDggPUAMT_hFjNjVhMzYwOWUxYmVlZDcyOTU1Yjg4YWZhYzhjZDMxZFADTzgwODgcARMeM4IFRjExMyzKFg-CBTuPODAzMzU4MDiGFQoPFgFvD4IFAAoWAQ9QA0IFHAEfN2wELf8RNTFhYmE5ZjYyNzg3ZWZiYWExM2U1M2E4ZDFhZTM4OTIyAgBfMjcxNTODBSYPMwJJnzE2NDAwMTcyMRcBjA-EBQAJFwEPNAJCBR0BD4YWKQE3Df0RZjE1MzAyYjA3NzJiYmQ0NWZkM2JiNzI0NGU5Mzg2YmE0An8zMDEzMzM3NAITDx0BAACVEAXvGQ9nBDyfMTk2MTk3NTk2MQ0uDxcBSx0yMg0ZMRcBDzQCQwQdAQ_qCQgPuAcHgExvZ2dpbmcvGxhGVmlldwACD-sUBC8xNeYAAAAUAAX9AQ_rFD-PMDI0MjI2NzJ8BwgP4gDp8BJ-L21lZGlhL0NQUC9JbWFnZXMvTW9iaWxlJTIwSGVhZGUlGgMZAACwGvY0LWxvZ28uYXNoeD9oPTM1JmxhPWVuJmhhc2g9QkJBRTYyQkIxRDlENEZFQjc4NDhGMzkzOEI4QzIyM0NFMTZFQjZCNScCMmltZ9QZDBYaDscbNzE2MIsIDw0DQo8wODc2NzQzOMcbCf8AZHBtLmRlbWRleC5uZXQvaBgQ8gBBTSZkX3J0YmQ9anNvbiaRGE8yJmRffhgXcGRfbnNpZD3CGB9tiRgX82RkX2Jsb2I9UktocFJ6OGtyZzJ0TE82cGd1WFdwNW9sa0FjVW5pUVlQSGFNV1dnZEozeHpQV1FtZGoweSZkX2NpZF9pYz1BVklEJTAxMzIxRDg1MEEyNDJBQzVGOS02MDAwMDJCMTlFMzM2REE5JnRzPTE2FiEwNDE3RiIDrx0PDAQFHjckEhAxFAAPDARHnzM0NjI3NDQ5MwsGCA_hAf_PAO0F8QFnb29nbGV0YWdtYW5hZ2Vyjh9AZ3RhZ5cggGlkPURDLTYy4wIPihATAMQTC1YOHzJWDk-fMDEwOTUzNzU2kBAIALIFoGNvcnBjcmVkaXRjIMFpYy50dC5vbXRyZGPDBEByZXN0CSShZGVsaXZlcnk_Y_cfHz07AAFAJnNlcysm8xVJZD1hMjhkMmYzMWQwNjA0OTU0YTJjYzYwZmM2MTM5ZGUwNSZWJkI9Mi4xVSYPDwQLLjIz9AUBFAAPDwRHnzEwMzIwNzU5NUEB_0oCrCLBLnNpdGUyNHg3cnVtbQN3YmVhY29uLxcAEi11J_YZP2FwcEtleT03NWZlODQ0ZmQ2MGJiNjlmZWNlOGNmZWY0OTBlZGI3Y0UID7oaBwGpDwyZAwBuHwVUAgBQI2BuZENoaWxIJgCsAA-WJylAMzIyN28MD10iCQBkAC9pYxABZQ6tKBkyEAEPWAlCBRcBD4MLIg-hCgBDSGVyb6YKEC8MAFRfTU9CMpQKmDEwMCZ3PTMyMJsK9xhDOTdCODcyQzdEQkJCRTExMDFGOERDQjRGREQzRDBCMENFMEIxNURDHw-bCgYODR0oMjeoGA9DAUKfMjYwNzQwODcy-RAID9kGFoA1NjcxMCZsPWgqn0xheWVyJmN4PVEDEhAyYBcMUQMAwyUFUQMPvQ89jzE5NDQ5MTU3oA4MD9EHEg_4ACkOHBUZMvgAD_YBQhQx_gAP9gEIAKcHCJIMAAMtdDUuaHRtbD83DB8jtCcUBlMFU2lmcmFtbycJmw0_NDA0QwQAGDgAAw9TBTufMjY2OTE4Mjg2WRgIDwMBXR81AwENDw0CQgQKAR83CgEJgTEucmZpaHVi2glfanMvdGPMLhc_NDE1gwkAGDl3Dw_eAzyfMjAwOTU4MTUx0wBID7kDAAnTAA-sAUME2QAPtwQwbzQxNTgxMq8FJA_-AAEIIx0P_gBCnzA2MzE5OTEyNY0hCA-tBhZPNjkzMv4AJQ6rBxAzwQYPrQZFnzI4ODIxMzU2NF8QCA_4AFIO9gEK-AAP9gFCBf4AD_QCDA-KMwMefocUANoJAt8JdERTSzJCLTHiCSAyN-IJOTEyMOMJ9xg1MDQ5MTdEMEUxQ0E1OTZEQzAzMzY1Q0U3M0JBRUI4NUE5RTEyNTIMHQ_jCQYOBwUoMzi9JA9AAUOPMTgyNzcxMDMNBQgAPgIPQAGQD3gDAA9AAVgPfgMMD0ABFoFDYXRlZ29yeYQCli9zaG9wcGluZ2gMeTI1Jnc9NjaFAv8YNDcxMEU5QTYxRjlFMDNERDBGNTUwREI1MDU2NzU2OUNGNUY3RDgzhQIQAKUGC2oLKDUyaAkPhQJCjzM0Mzk5ODI0YR0JD4UCGg9FAWwObxoPRQFZDwAHDA-KAh_ASWNvbnMvRGluaW5nDAAFEgVoMSZ3PTE58g74FzQ5MjIxRUE0ODEwREY2QTQ3QkNDNjE5RDJGOTM5RkRGQzk3NkIxayUPDwUFHjmxHRA1LCIFRwcPigJCjzE0MDk3MzAzRQgND0UBlR0z3x0PRQFYHzZ6ETUKzwMCVhYPEgUL9xk1OThDRTY5MzFBNTgyOTUwQzU2RDE3QjU2QUZDN0VCQjczNjEzNUM1fQ4PFRwED4gCAR81EgVPwDM1MjUzNDI2OX1dfQ
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 3.124.119.57 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-124-119-57.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.49 Safari/537.36

Response headers

date: Sat, 15 Apr 2023 20:33:26 GMT
cache-control: no-cache, no-store
server: nginx
expires: Sat, 15 Apr 2023 20:33:25 GMT

GET
H2 204 r.rnc
data.privacy.ensighten.com/privacy/v1/b/ 0
106 B 36ms
36ms Image
text/plain 3.124.119.57
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://data.privacy.ensighten.com/privacy/v1/b/r.rnc?n=2&c=1129&i=57y38a&p=na_prod&s=15273&d=8HB7InZlcnNpb24iOiIxLjAuMCIsImdhdGV3YXkiOiIyLjMuNjExIiwiY2xpZW50SWQiOjExMjksInB1Ymxpc2hQYXRoIjoibmFfcHJvZCIsImluc3RhbmNlSWQiOiI1N3kzOGEiLCJwYWNrZXQiOjEsIm1vZGUiOiJlbmZvcmNlWgDwCG9va2llcyI6eyJCQU5ORVJfTE9BREVEkQDyJyJ9LCJlbnZpcm9ubWVudCI6IkNCT0wgUHJpdmFjeSIsInJlcXVlc3RzIjpbeyJkZXN0aW5hdM4A8JRodHRwczovL3d3dy5jYXJkYmVuZWZpdHMuY2l0aS5jb20vfi9tZWRpYS9DUFAvSW1hZ2VzL0NhdGVnb3J5L0hlcm8vY3JlZGl0Mi5hc2h4P2g9MTI1Jnc9NjYwJmxhPWVuJmhhc2g9NTk4Q0U2OTMxQTU4Mjk1MEM1NkQxN0I1NkFGQzdFQkI3MzYxMzVDNSIsInR5cGUiOiJpbWciLCJzdGFyEgHANjgxNTkwODAzOTky7QAAYgEEFACwNDU1Niwic291cmM5ADFtdXTdALFPYnNlcnZlckNMIkgAoXR1cyI6ImxvYWQSAUBhc29uEQHUXSwiZGF0YVBhdHRlchIAsmxpc3QiOltdLCJpagDPMzM1MjUzNDI3MH0sQwEF8QEyMDc2NjY5OXAucmZpaHViPgH0EGNhLmh0bWw_dmVyPTkmcmE9NjA2JnJiPTY0OCZjYT00APQBJl9vPTE3MTY5MTc1Jl90PYcB8ANob21lJl9yZXY9MSZfcGNvZGUJAPEFb3JkZXJpZD0xJnNzdl9jdXVpZD0LAMJwYWNrYWdlPW51bGwRADByb2TNAAcSAHphZ2VuYW1lYwAxcGU9CgKfJTNBJTJGJTJGEAIGcCUyRiZwZj3LAPcCMzczNjA5MTc2MTU2MDkyMjS-AVJmcmFtZXkBGHLBAU00Mjg5wQE3NjI3wQGzaW5zZXJ0QmVmb3JCAA-7ASqvMjcxNzAxMTk4NrsB_y8vOTC7AQwPfANCBcEBHzfBAQcPrwIG8AcvZGlzdC9pbWdzL3BsdXMtYm94LnBuWwQfdGgEDB4x7AAnNTCnAg_sAEKvMDY1Nzk0MzM2NewAWg5UBR827ABYD5kDCA_YAQcPlwYJ8wBJY29ucy9TaG9wcGluZ0LTBgEWABQupgZoOCZ3PTE0pAb3GTdEMzdCREZEQzE4NUJCRDdDOEZBMTEyRTA1RUJENTVBRUNFNTNCMTnmBBBtSQIPpAYADygDAC83NTwCTo83NTEzOTAwOaQGCA9QAaQPoAIAD1ABWB8yjAMhD6ACDyBDcjgJcGFuZEFjY3SdAgScAi0yMJwC_xk2RUNFMTRFREVDRUQ2QUVBNjZBNkQ2REE1NEM2OTA4QUI1QjlCREZDnAIQD9gEABg4fwcP2ARCnzI2NDQxOTYwM0wBuw-YAgAPTAFYHzOYAkNoVHJhdmVsNgUEmQIQMTUFKDIzNQX_GDY0NDczNzc0RDAwMjM1NDIwRUY4NDA4REVBQTZDNkMzNEE4OTAzQpkCEQ41BT83OTE1BU2fMjExNDU2Mjk4mQJED00BZQ7mAw9NAVkPmgI-EEhpDhF0mQIPaQ4L_xlEOTkyMkFCMUJBQkJCRUY3RTlFMzdERjdGMTg2MjVERjgxMTZGMUMzKQUQD5ACAR84kAJNjzE3ODYzNDUzaQ4JD8UHIw9DAWEPhgIBD0MBVx8xIAU9AUMBcTI1MTIwMV8LEfUBVXBkYXRlX0NfNjYweDEyNSkFDwQRAf8ZNzQzQjdFQzQ1QkU5NTZFRjA2MEEyMTU1NjE4MkZENDA4Nzc3RjRCRpsCEA5YAS84McQHUH8zMTA1ODA0KwU-D1gBdh0z9A0PWAFZHzSwAiEG4A7_AmJhY2tfdG9fdG9wX2Fycm936Q4UD_UAAB8y6Q5OnzIyOTg3MTM5Of0NNfQATG9nb3Mvc2l0ZS1sb2dvigMjNDCuCEJ3PTY3jBT_GUNEODEyRDYxRUY4MUZBRUEzNTZFN0E4NkVENzAzOEQxNDNFQzlGQzKIAxAPOwEAHzM7AU-fNjk4NjA4ODg4MAIhD5gMAA87AWIeNGsDDzsBWB85OwEHAKMX9g0ucmVwb3J0Lm5hY3VzdG9tZXJleHBlcmllbmNlGheSZ2xhc3Nib3gvLgCCaW5nL2Nsc18OACA_XwwA8RxzPWUzYzk2Njc1LTM0NjUtNDdiZC1iODVhLThkNzU4NzFlNDEyOCUzQTAmMADxHnY9ZmM5YzFhYjEtNmEyOC00ODkxLWFmOWEtM2E0ZjQwMDljNDdlJnB2PTImZjIAUHM9dHJ1KBUD0BI_eGhydxUBPjg0OHEBABQABTgXslhIUl9NQU5BR0VSQQACdhVvYWxsb3dlNBchnzI2NTY1ODc0OYgHCA9tAf9bJGMxmhj2AW5ldC9qcy90Yy5taW4uanPrBGJzY3JpcHQBAgq5Fy84M-4EABg11hIPuRc9fzAwOTU4MjHQEgkP0wAsHjTBDxk40wAPDRFDBNkAD4YECEBjb2wuzQZxMjR4N3J1bUwaQHJ1bS-sGgeuAZ9lbmRCZWFjb26yAQIeNsMMKDg2Uw-vU0VOREJFQUNPTvsDPX84MjM4OTEyKwoM8QFnb29nbGV0YWdtYW5hZ2Vy5wDwB2d0YWcvanM_aWQ9QVctOTE2NDUxNDdfHQPjBA-kAgkdN-YEKDkzcgwPpAI8nzM2MDAyMTY4MIwHDA_pAD4PugIACukAD7oCQgTvAB8x4Q8I4GNkbi5wYmJsLmNvL3IvGxwPYQQWDb0BODUyMtsdD70BBUBlcnJv9gYvcmXWHRtAMDIyM8EcHzeFCggPzwAnDqMBC88AD6MBCw_VAC0fOHcHCPADem5icm82eWVoYzBocmtsbGst7x9AZmVlZEUMAXkE8QRpbnRlcmNlcHQucXVhbHRyaWNzngPhU0lFLz9RX1pJRD1aTl9HAKdFSEMwSFJrTGxrmgQPSAYHHTS-Dkc1MjQ0WRGgYXBwZW5kQ2hpbHcIMnN0YYoID7sfJJ8xMzEzNDM0MTMXGQgPEAFrDYUGCxABDygCCw8XAS0PJwIIAGkSD7oEEMA4MzA5MDc5NjkmbD2gBq9MYXllciZjeD1jEAIRPDkzNrQFIDUyah4FmgoP9wMFD_oAI683OTUzNjQwMDg5UB4MD_oAUA2UCwv6AA_6AUEGAAEPfwgIAHsIDwIEBXRXUlNpdGVJIATwBUVuZ2luZS9UYXJnZXRpbmcucGhwIQQ_b25lJAQC9QgmUV9DTElFTlRWRVJTSU9OPTEuODkuMBcAhlRZUEU9d2ViPAIP0wwDPjUzMDkDARQABTkCD9MMPp8zNjI4NDkxMTnYCAgPOwH_Rf8dZHhqc21vZHVsZS8xMC4xM2RhNjU0ZWJjNGZmMDc0ZDA3Yy5jaHVuay5qcz9iAhSwJlFfQlJBTkRJRD3qBA__JgIGhgIPdgoGAq4FImVuKiYCqCZHNTMwM9IGD8gDQa84MzQ3NDA4NjkwwgUvnzY5NTIzMTE2MsIFNhkzkBYPwgU7rzgyMzA1MzgyNDnCBAgA0gEPwgUQD_oALQ7CBQr6AA_6AUIDAAEfNfoBMJ85NzU3MDE5NDf6ATcJxxMP-gE8nzM3MzM5MDU0NoEMCA_6ARQP-gAtD_oBAAn6AA_6AUIFAAEPICYMD_oCEJ85NTkyOTk3OTT6ASQOrQ0vMzStDREPtgkjrzgxNTExMTUwNzcmGQwP-gBQD_oBAAn6AA_6AUIFAAEP-gEvrzEwOTU1MDA2OTWyCyUPAgEAHzeAHE6fMTg0MzIxMDc38AYwjzQ0NTc0MDQz_AIkHTWyDBAzmC4FeQoP9gQ8nzE0ODUzMTgwMfwCLx82-gAsD_oBAAn6AA_8AkMEAAEPsg0wQDE5NTCsJA_6ASQO9gQoNDHqCQ_6AT2PMDc5MDQ5NTL6AG8O-gEK-gAP-gFDBAABD2AVMI82MDYyMTg3NfoBJA2xHD81NDJaFkifMDY5NDgyNDgy-gBvD_oBAAn6AA_6AUIEAAEPMioJV29ubGlukR2QR0ZDL2JyYW5kix3wAGltZy9yZWRlc2lnbmVkL-EUABkgBBMADx0hET01NDRCGQIUAAfqBWluZXJIVE1lNA80HSavNzk4MDQ4OTg2NOQGCA_2ABkwYXRtEQGWY2hsb2Muc3Znzw4PYDUDLzU0nhUAARQAD_IARDA4MDA_FC8zMIEpCQ_yABkP6AEkDpQWD_YASQboAQ9JEggP9gAZD-gBswK8C_ADYWRzLmcuZG91YmxlY2xpY2surx7zBnBhZ2VhZC92aWV3dGhyb3VnaGNvbpY5FS8lHCAvP_8DRW9tPTEeONs5MTgmY3Y9MTEmZnN0GABBYmc9ZgEAICZnRDfwEE9OJmFzeW5jPTEmZ3RtPTQ1YmUzNGMwJnVfdz0xNjAJAEBoPTEyCQAvcmwxNxkhaG5iEgXgAGFlcnZpY2VRGfQRJmZybT0wJnRpYmE9Q2l0aSVDMiVBRSUyMENhcmQlMjCILUAlMjAtFgABNTAACQANHwAwZm9yGAAARAAzMjBDuCIwcyZh2gCmNjA5NzEzNTAxLhkB4CZ1YW1iPTAmdWF3PTAmuReQPWV2ZW50JTNEgx3wAC5jb25maWcmcmZtdD0zJgYAB-E3Dw4TBi40OSggKTU0IA0P4Bk64Dc5NTA3ODYyOTQzfV19
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 3.124.119.57 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-124-119-57.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.49 Safari/537.36

Response headers

date: Sat, 15 Apr 2023 20:33:26 GMT
cache-control: no-cache, no-store
server: nginx
expires: Sat, 15 Apr 2023 20:33:25 GMT

GET
H2 204 r.rnc
data.privacy.ensighten.com/privacy/v1/b/ 0
106 B 50ms
50ms Image
text/plain 3.124.119.57
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://data.privacy.ensighten.com/privacy/v1/b/r.rnc?n=3&c=1129&i=57y38a&p=na_prod&s=16145&d=8HB7InZlcnNpb24iOiIxLjAuMCIsImdhdGV3YXkiOiIyLjMuNjExIiwiY2xpZW50SWQiOjExMjksInB1Ymxpc2hQYXRoIjoibmFfcHJvZCIsImluc3RhbmNlSWQiOiI1N3kzOGEiLCJwYWNrZXQiOjEsIm1vZGUiOiJlbmZvcmNlWgDwCG9va2llcyI6eyJCQU5ORVJfTE9BREVEkQDyJyJ9LCJlbnZpcm9ubWVudCI6IkNCT0wgUHJpdmFjeSIsInJlcXVlc3RzIjpbeyJkZXN0aW5hdM4A8ypodHRwczovL2dvb2dsZWFkcy5nLmRvdWJsZWNsaWNrLm5ldC9wYWdlYWQvdmlld3Rocm91Z2hjb24RAfsbLzkxNjQ1MTQ3MS8_cmFuZG9tPTE2ODE1OTA4MDQ5MTgmY3Y9MTEmZnN0GABBYmc9ZgEA8BYmZ3VpZD1PTiZhc3luYz0xJmd0bT00NWJlMzRjMCZ1X3c9MTYwCQBAaD0xMgkAMXJsPbYA8BolM0ElMkYlMkZ3d3cuY2FyZGJlbmVmaXRzLmNpdGkuY29tJTJGJmhuPSAABeAAcGVydmljZXMfAPMSJmZybT0wJnRpYmE9Q2l0aSVDMiVBRSUyMENhcmQlMjBCUABAJTIwLRYAUHJlZGl0CQANHwAwZm9yGAAARADQMjBDdXN0b21lcnMmYdoApjYwOTcxMzUwMS4ZAfAfJnVhbWI9MCZ1YXc9MCZkYXRhPWV2ZW50JTNEZ3RhZy5jb25maWcmcmZtdD0zJgYA8Ak0IiwidHlwZSI6InNjcmlwdCIsInN0YXIvAgZwASAzOAoCAH8CBBQAsDU0NDYsInNvdXJjPAAxbXV0-gGiT2JzZXJ2ZXJDTEgAoXR1cyI6ImxvYWQvAkBhc29uLgIwXSwinQBkUGF0dGVyEgCxbGlzdCI6W10sImlqAN83OTUwNzg2Mjk0OH0sYAIFgHAucmZpaHVieAH_JS9jYS5odG1sP3Zlcj05JnJhPTExOTgmcmI9NjQ4JmNhPSZfbz0xNzE2OTE3NSZfdD0mcGXzARkxcGY9VQDWNjcxMjU1NzczOTQ0M0ABYmlmcmFtZfgACkABPzgzNUABABc4QAGzaW5zZXJ0QmVmb3JCAA86ASm_ODA5MjczNjExNzE6Aa0vNDI6AQwPegJBBkABD3oCCAX6Aw_aBB2eODMwOTA3OTY52gRPNTI3OdoEAQEYAA_aBP9BTjUyODlgAic1MpoDoGFwcGVuZENoaWzDBD9zdGGZAyqvMzA0MjkwODg3MpkDBw9ZAv-0LzkwWQIMD7kEQgVgAh8zYAJAnzk3NTcwMTk0N7kEAD8zMjK5BAIAGAAPuQT_Qi8zM2ACYq8yODEzNDA2NTA1YAJAnzY5NTIzMTE2MmACAS8xMGACAz8xMCZgAv9DLzE2wAQAHzMZB0avMTQ1NjQ4ODc3N1kC_88fN1kCDA8ZB0IFYAIP0gtBnzk1OTI5OTc5NLkEAS8zN7kEAy8zN7kE_0QfNGwPAB81uQRHrzIyMzY5MTYyMDa5BEAPWQL_fA8SBw0PuQRCBWACDxkHQo80NDU3NDA0M7kEAS84M7kEAy84M7kE_0QfOesSACc2NHIJD2ACQp8xNzExNjYzMzUyDkGvMTA5NTUwMDY5Ne0SAS8zNhsHBB82Gwf_RR43wgQoNTKHFg_tEjuvMDM5MDA5MzM1ORsHQA9bAv9-DtYLClsCD70EQgRiAi82MGICB2VvbmxpbmW8G2AvR0ZDL2JTHPAHaW5nL2ltZy9yZWRlc2lnbmVkL2F0bRsAl2NobG9jLnN2Z90ZEG0NAAwaGy81NG4KAB81GhtOMDgwMEUYPzMwOHUKQo82MDYyMTg3NRUIAC80MocRAwAYAA-HEf9CEDSfBSFlbhAdA_4eIDU1tBgPeh1KUDgzMjU2FwgfOacYCA9YAxkAOR9EbG9nb2sDMC5wbk8DA3keH2lcAxgvOTERCUyvNzk4MDQ4OTg2NFwDCAz8AKRmZWRlcmF0ZWRCWQT2B3YxL2JvZHlUYWdKcy9uYXZCYXIuanNQBA9tHwYvNTTzHAA3NTk19wAPpgc8jzk3MDg4NjE18ABmDrEPCvAADzsGQwT3AA-dCAgP5wEc_wRqcXVlcnkuYXV0b2NvbXBsZXRl9AEqD5oJR68yODgxNzIzOTM0OAcXD-QCDA_9ACkPAQIBCP0ADwECQgUEAQ9ZDwiBc3IucmxjZG5eImI0MjU0NjZiIvYkZXM9ODA2NzYmdT1kYTM5YTNlZTVlNmI0YjBkMzI1NWJmZWY5NTYwMTg5MGFmZDgwNzA5_AMPKSIJDmkjKDYwaSMP_AM7nzEzMDYxNTk4MugFCA8EAV4PAAUACgQBDw8CQgULAQ8HBQgPmh8nfzE5NTAwMDJoEQEvNDBTCQQfMNoa_0QuNDFoET82MDdgB0afMTQwNjc5NTg5WQL_0B0z2hoKWQIPuQRDBGACD8gGCA_JCBwABA9VZGluZ1_0Bw_ICBYfNAMBAAjLBw_ABjsgMDOMID83NzEAEBgF1AAPrAsDD_wAKA7HCCg2MPwAD_8BQgUDAQ_rKQgP_wES_wVoZWFkSnMvcHJlTG9naW5Gb290ZbQMFh4zRycK_AAP-AE7MDM1MQcuLzUwuAgID_UATx807QIND_EBQgX8AA_wAzcAnw9_X3NlYXJjaOkDFg_sBAEI7QIP8QE8jzYwMjIxNDYwphgID_EBEgaVDw_1ACEP4gNiFDP8AA90JQgP_AAdoWJvbC1zbWFydFP2Aa8taW5qZWN0LUJCAAIWD_wCAR85RQlGnzMyODM3MTExNeYELQcAAg8EAS8PDwIBCAQBDwAEQwQLAQ_8BC0GCwFhaW5oZXJpOjRPLTIuNwQCFg8EBAEIAAEPBAQ7nzAyNzg5MjkzNwgDNw_5ACUP-QFiBQABD_kFLQPqB2Bvb19lbmccGT9taW70ARUP6QcBHzI9DUefMjc4Mjc1OTgxPQ0ID_wEEg_0ACkP6AcBCfQAD-gDQgT7AB8y8wQ3AqQTny11aS0xLjguOfQBFR806AMAHzP0AUcwMzE2WTUfMOwHOA_5ACUP6AMACfkAD_kBQgUAAQ_oBDcF1QwwdW5pYTkvYWz8ARYP6AcACQMBD-QFO58yNTk0NDExMDP1AjcP_AAoD_8BYgUDAQ_gBzcA6wpfbGl2ZS3kCy8ADAQFfBwP_AE7nzE2MTk0ODk5NvwBNw_5ACUP-QEACfkAD_gDQgUAAQ_kDC0D7AYwamZwuBhvYmluZWQu4wcsHzTbDUfQMjI5MzYyMDI4NH1dfQ
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 3.124.119.57 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-124-119-57.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.49 Safari/537.36

Response headers

date: Sat, 15 Apr 2023 20:33:26 GMT
cache-control: no-cache, no-store
server: nginx
expires: Sat, 15 Apr 2023 20:33:25 GMT

GET
H2 204 r.rnc
data.privacy.ensighten.com/privacy/v1/b/ 0
106 B 30ms
29ms Image
text/plain 3.124.119.57
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://data.privacy.ensighten.com/privacy/v1/b/r.rnc?n=4&c=1129&i=57y38a&p=na_prod&s=5730&d=8HB7InZlcnNpb24iOiIxLjAuMCIsImdhdGV3YXkiOiIyLjMuNjExIiwiY2xpZW50SWQiOjExMjksInB1Ymxpc2hQYXRoIjoibmFfcHJvZCIsImluc3RhbmNlSWQiOiI1N3kzOGEiLCJwYWNrZXQiOjEsIm1vZGUiOiJlbmZvcmNlWgDwCG9va2llcyI6eyJCQU5ORVJfTE9BREVEkQDyJyJ9LCJlbnZpcm9ubWVudCI6IkNCT0wgUHJpdmFjeSIsInJlcXVlc3RzIjpbeyJkZXN0aW5hdM4A8ChodHRwczovL29ubGluZS5jaXRpLmNvbS9mZWRlcmF0ZWRCcmFuZGluZy92MS9oZWFkSnMvamZwJADwFGJpbmVkLm1pbi5qcyIsInR5cGUiOiJzY3JpcHQiLCJzdGFyzQDANjgxNTkwODA1NDQ0qAAAHQEFFACgNjQ4LCJzb3VyYzwAMW11dJgAok9ic2VydmVyQ0xIAKF0dXMiOiJsb2FkzQBAYXNvbswA1F0sImRhdGFQYXR0ZXISALJsaXN0IjpbXSwiaWoAzzIyOTM2MjAyODl9LP4AMp9xdWVyeS1jb20BAR4uMzkBASc2MgEBoGFwcGVuZENoaWzqAD9zdGH6ACm_Nzk3MzQzMDk2NTP6AG4P-wEBCfoAD_sBQQYBAR84AQEH8AhzaXRlaW50ZXJjZXB0LnF1YWx0cmljc-EC8QIvZHhqc21vZHVsZS9Db3JlTQsA9AwuanM_UV9DTElFTlRWRVJTSU9OPTEuODkuMCYXAPAEVFlQRT13ZWImUV9CUkFORElEPVkDj2ZlZWRiYWNrLQMRPjU4MywCJzcxLAIPMgFBrzgyODY0OTY3ODUtAwgPMgEJdFdSU2l0ZUlQAfICRW5naW5lL0Fzc2V0LnBocD9DAfIGPVNJXzhCNW9NSWJSWDRZSW5VRyZWYQXUPTEyJlFfT1JJR0lOPZ0E9QF3d3cuY2FyZGJlbmVmaXRzpwQFcgEPiQEMBnIBMnhoclQECpwEPzY3NW8BABc1bwGyWEhSX01BTkFHRVJBAAKbA2BhbGxvd2WuAy9yZZgEGr83OTcxNjAzMjkyMp0CIw9rAf-A9gNDUl82aWpOSDdkM0lNcUhJdlnWAjUmUV8WAy9JRAEDAQ_2AtKvODEzNjcwMDQ3OPYCSw-LAf9SBx4H_w0xLjkyMzEwMDE5Y2Q5YTVmZmUxNjU2LmNodW5rMAdTLjY3XQovNzJcCUavODAyNjgxODg3M1wJCA8pBwkPPQF8Dv4GCj0BD20IQgVEAR80AgcjB0QB_wc1LjA3YTZhNjk5MDVlZjA1NmJhOWVlgQJvFzlCCA_dCzqvODM1MTEzNDk3MoECLw89AXEPgQIBCD0BD4ECQgVEAQ-BAi8TRtwLYkJ1dHRvbucKD_oEaBgzuwoPeQI7rzE2Njg5Mzc2MDa2Ay4PNQFpD3ECAAk1AQ9xAkIFPAEfNzwBIw_0CwPAP1FfSW1wcmVzcz0xEg0_SUQ9AAkAT1FfU0l6CgXwCEFTSUQ9QVNfY0JFQUE5MXdKOTNoNjlFTQAP6A4SNXI9MdMRPzkxMm8NDj05MTJvDQEUAAULEg9vDT2_ODAxMTgyMTY2NzF7Af-hFFGXEfkBU2hhcmVkL0dyYXBoaWNzL2MJ9g8vd3ItZGlhbG9nLWNsb3NlLWJ0bi13aGl0ZS5wbmeVAiBpbQ0ADaAUAYECImVuNhQCtBQgNjCpAgWVAg9JBTrgNzk0ODA5MDQxODJ9XX0
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 3.124.119.57 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-124-119-57.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.49 Safari/537.36

Response headers

date: Sat, 15 Apr 2023 20:33:28 GMT
cache-control: no-cache, no-store
server: nginx
expires: Sat, 15 Apr 2023 20:33:27 GMT

GET
H2 204 r.rnc
data.privacy.ensighten.com/privacy/v1/b/ 0
106 B 28ms
27ms Image
text/plain 3.124.119.57
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://data.privacy.ensighten.com/privacy/v1/b/r.rnc?n=5&c=1129&i=57y38a&p=na_prod&s=980&d=8HB7InZlcnNpb24iOiIxLjAuMCIsImdhdGV3YXkiOiIyLjMuNjExIiwiY2xpZW50SWQiOjExMjksInB1Ymxpc2hQYXRoIjoibmFfcHJvZCIsImluc3RhbmNlSWQiOiI1N3kzOGEiLCJwYWNrZXQiOjQsIm1vZGUiOiJlbmZvcmNlWgDwCG9va2llcyI6eyJCQU5ORVJfTE9BREVEkQDyJyJ9LCJlbnZpcm9ubWVudCI6IkNCT0wgUHJpdmFjeSIsInJlcXVlc3RzIjpbeyJkZXN0aW5hdM4A9BhodHRwczovL3NpdGVpbnRlcmNlcHQucXVhbHRyaWNzLmNvbS9XUlEQAPoAU2hhcmVkL0dyYXBoaWNzNwDwGy93ci1kaWFsb2ctY2xvc2UtYnRuLXdoaXRlLnBuZyIsInR5cGUiOiJpbQ0A8AVzdGFydCI6MTY4MTU5MDgwNTkxM8gAAD0BBBQAsDYwMTIsInNvdXJjOQAxbXV0uADxC09ic2VydmVyQ0wiLCJzdGF0dXMiOiJsb2Fk7QBAYXNvbuwA1F0sImRhdGFQYXR0ZXISALFsaXN0IjpbXSwiaWoA3zc5NDgwOTA0MTgzfSweAQWxb25saW5lLmNpdGkSAfYaZmVkZXJhdGVkQnJhbmRpbmcvdjEvYm9keVRhZ0pzL3Rlc3RybG0uanP1AGJzY3JpcHSwAAr4AD00NDL4ACgxN_gAoGFwcGVuZENoaWzhAAXxAF9lcnJvcvIAH784MDcwOTIzMzMwMfIAZh818gAMD-oBCw_5ACbANzA5MjMzMzA0fV19
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 3.124.119.57 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-124-119-57.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.cardbenefits.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.49 Safari/537.36

Response headers

date: Sat, 15 Apr 2023 20:33:28 GMT
cache-control: no-cache, no-store
server: nginx
expires: Sat, 15 Apr 2023 20:33:27 GMT

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: www.cardbenefits.citi.com
URL: https://www.cardbenefits.citi.com/dist/css/jquery-ui.css

Verdicts & Comments Add Verdict or Comment

392 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

41 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
prod.report.nacustomerexperience.citi.com/glassbox/reporting	1969-12-31 23:59:59	Name: _cls_v Value: fc9c1ab1-6a28-4891-af9a-3a4f4009c47e
prod.report.nacustomerexperience.citi.com/glassbox/reporting	1969-12-31 23:59:59	Name: _cls_cfgver Value: f5047c47
prod.report.nacustomerexperience.citi.com/glassbox/reporting	1969-12-31 23:59:59	Name: _cls_s Value: e3c96675-3465-47bd-b85a-8d75871e4128:0
www.cardbenefits.citi.com/	1969-12-31 23:59:59	Name: sc_expview Value: 0
www.cardbenefits.citi.com/	1969-12-31 23:59:59	Name: CBProd2_SessionId Value: pu4rs0s0d04nlfrfnyvq13pt
www.cardbenefits.citi.com/	1970-01-20 11:06:31	Name: NSC_CC-DC-QSPE2 Value: 28d4a3da1addffdad28d04db6cfea677737af7f2fd137755855b8d6052ab03c57bf88fe7
.cardbenefits.citi.com/	1969-12-31 23:59:59	Name: XCADC Value: OFQwO2O13pqTdUqqmwTFj1Mczz40002
.citi.com/	1970-01-20 11:06:38	Name: ensighten_conentSync_timestamp Value: 1
.demdex.net/	1970-01-20 15:25:42	Name: demdex Value: 75154193643650581252082693921030427431
.citi.com/	1970-01-20 19:52:06	Name: CITI_ENSIGHTEN_PRIVACY_BANNER_LOADED Value: 1
.citi.com/	1969-12-31 23:59:59	Name: CITI_ENSIGHTEN_CC_SYNC Value: 0
.citi.com/	1969-12-31 23:59:59	Name: at_check Value: true
.citi.com/	1969-12-31 23:59:59	Name: AMCVS_61834D9B5228A7430A490D45%40AdobeOrg Value: 1
www.cardbenefits.citi.com/	1970-01-20 11:06:32	Name: 7830 Value: error
www.cardbenefits.citi.com/	1970-01-20 11:06:32	Name: 7018 Value:
www.cardbenefits.citi.com/	1970-01-20 13:16:06	Name: 64072 Value:
.citi.com/	1970-01-20 20:42:30	Name: _cls_v Value: fc9c1ab1-6a28-4891-af9a-3a4f4009c47e
.citi.com/	1969-12-31 23:59:59	Name: _cls_s Value: e3c96675-3465-47bd-b85a-8d75871e4128:0
.citi.com/	1970-01-20 20:42:30	Name: s_vi Value: [CS]v1\|321D850A242AC5F9-600002B19E336DA9[CE]
.citi.com/	1970-01-20 20:42:30	Name: s_ecid Value: MCMID%7C70570616501048755021532540192894249604
.citi.com/	1970-01-20 13:16:06	Name: _gcl_au Value: 1.1.609713501.1681590804
.everesttech.net/	1970-01-20 19:52:06	Name: everest_g_v2 Value: g_surferid~ZDsKFAAAAN7_QwNe
.dpm.demdex.net/	1970-01-20 15:25:42	Name: dpm Value: 75154193643650581252082693921030427431
.citi.com/	1970-01-20 20:42:30	Name: AMCV_61834D9B5228A7430A490D45%40AdobeOrg Value: 1585540135%7CMCIDTS%7C19463%7CMCMID%7C70570616501048755021532540192894249604%7CMCAAMLH-1682195604%7C6%7CMCAAMB-1682195604%7CRKhpRz8krg2tLO6pguXWp5olkAcUniQYPHaMWWgdJ3xzPWQmdj0y%7CMCOPTOUT-1681598004s%7CNONE%7CMCAID%7C321D850A242AC5F9-600002B19E336DA9%7CMCSYNCSOP%7C411-19470%7CvVersion%7C4.4.0
.citi.com/	1970-01-20 20:42:30	Name: s_fid Value: 0AAE963D3F2B3F4B-0340C2638A1BFDE4
.citi.com/	1970-01-20 20:42:30	Name: s_pers Value: %20s_nr%3D1681590804413-New%7C1839270804413%3B%20s_vnum%3D1682899200414%2526vn%253D1%7C1682899200414%3B%20s_invisit%3Dtrue%7C1681592604414%3B%20s_lastvisit%3D1681590804416%7C1776198804416%3B%20gpv_pn%3DBenefitBuilder%253Adefault%7C1681592604419%3B
.citicorpcreditservic.tt.omtrdc.net/	1970-01-20 11:06:32	Name: citicorpcreditservic!mboxSession Value: a28d2f31d0604954a2cc60fc6139de05
.citicorpcreditservic.tt.omtrdc.net/	1970-01-20 20:42:30	Name: citicorpcreditservic!mboxPC Value: a28d2f31d0604954a2cc60fc6139de05.37_0
.citi.com/	1969-12-31 23:59:59	Name: s_cc Value: true
.citi.com/	1970-01-20 20:42:30	Name: mbox Value: session#a28d2f31d0604954a2cc60fc6139de05#1681592665\|PC#a28d2f31d0604954a2cc60fc6139de05.37_0#1744835605
.citi.com/	1970-01-20 11:06:32	Name: mboxEdgeCluster Value: 37
.rfihub.com/	1970-01-20 20:28:06	Name: rud Value: H4sIAAAAAAAA_-MSNjU0MDcxNrYwMjc2tzQ0NbawNBXiM9QN9zAuNcgu8S4PdQ8AAGAo-1ElAAAA
.rfihub.com/	1969-12-31 23:59:59	Name: ruds Value: H4sIAAAAAAAA_-MSNjU0MDcxNrYwMjc2tzQ0NbawNBXiM9QN9zAuNcgu8S4PdQ8AAGAo-1ElAAAA
.citi.com/	1969-12-31 23:59:59	Name: s_sess Value: %20s_ppv%3D-%252C60%252C60%252C1200%3B
www.cardbenefits.citi.com/	1970-01-20 20:42:30	Name: site24x7rumID Value: 104080691550129.1681590800216.1681590800216
.doubleclick.net/	1970-01-20 20:28:06	Name: IDE Value: AHWqTUktuTZuPRCXywj0_OaaUtEH3h2sVFA7RNW7uRMJhd7WPD6RpQLevVlKt-Oc
.amazon-adsystem.com/	1970-01-20 17:22:21	Name: ad-id Value: A6L2Zp3Ii0qGpmeLWXtzwOA
.amazon-adsystem.com/	1970-01-20 20:42:30	Name: ad-privacy Value: 0
prod.report.nacustomerexperience.citi.com/	1969-12-31 23:59:59	Name: ROUTEID Value: .cligate1_swcrd15
.citi.com/	1969-12-31 23:59:59	Name: AKMTLTSID Value: 0EED2DF9A8353A47D293ED98FD707222
col.site24x7rum.com/	1969-12-31 23:59:59	Name: s247cname Value: adff11af-811d-4549-9abe-f63bc1cc4dc5

4 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
security	error	URL: https://www.cardbenefits.citi.com/ Message: Refused to apply style from 'https://www.cardbenefits.citi.com/dist/css/jquery-ui.css' because its MIME type ('text/html') is not a supported stylesheet MIME type, and strict MIME checking is enabled.
network	error	URL: https://cdn.pbbl.co/r/1560.js Message: Failed to load resource: the server responded with a status of 403 ()
network	error	URL: https://sr.rlcdn.com/425466.html?es=80676&u=da39a3ee5e6b4b0d3255bfef95601890afd80709 Message: Failed to load resource: the server responded with a status of 451 ()
network	error	URL: https://online.citi.com/federatedBranding/v1/bodyTagJs/testrlm.js Message: Failed to load resource: the server responded with a status of 404 ()

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=157680000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

20766699p.rfihub.com
c1.rfihub.net
cdn.pbbl.co
citi.demdex.net
citicorpcreditservic.tt.omtrdc.net
click.info15.citi.com
cm.everesttech.net
col.site24x7rum.com
data.privacy.ensighten.com
dpm.demdex.net
googleads.g.doubleclick.net
iad1.qualtrics.com
metrics1.citi.com
nexus.ensighten.com
online.citi.com
p.rfihub.com
prod.report.nacustomerexperience.citi.com
s.amazon-adsystem.com
siteintercept.qualtrics.com
sr.rlcdn.com
static.site24x7rum.com
tagmanager1.citi.com
www.cardbenefits.citi.com
www.google.com
www.google.de
www.googletagmanager.com
znbro6yehc0hrkllk-citifeedback.siteintercept.qualtrics.com
www.cardbenefits.citi.com
104.102.43.113
104.17.208.240
13.111.71.127
15.236.125.10
18.154.63.96
18.173.233.43
18.66.248.114
192.193.179.248
193.0.160.130
198.160.105.71
2.18.232.194
2600:9000:224a:b200:1:76cf:fe80:93a1
2a00:1450:4001:806::2004
2a00:1450:4001:806::2008
2a00:1450:4001:810::2003
2a00:1450:4001:82a::2002
3.124.119.57
35.190.60.146
52.18.34.243
52.212.210.65
52.215.88.8
52.35.185.48
52.46.151.131
63.33.154.254
01f511247bc8f93f4fb4117396a63b2659a0f3d75dee6473f75dc748749899b0
045cd226594cb32ddf9d4db8ee45611f4d0788675ae50180b68da975e66fe1fe
055395b01212455e2e3cf174208947ef347110b0a0d8710f097237698d8eee2b
0896e8db9df1f5be7584c8d25fc4da59e68efa77a90fd3c10881cb13963a4e28
09e83612e0e15e2be2a4e1ab29a718f014595bec63c3d8a961c5c71894888c0c
0ece6d0e46b14c10b60d7e72769a0387822dbf39bfc2dadadc00d99a45c2a185
0ffab593a942ff4d16420a89a9a3bba85f5dd24016a0a860cc876f574c699a88
102503acef6077fcf8e42a856fb4904fcd74224a32d5d8efcd13236ac6309fed
14875cf677222a019e070a208c8e6d4abe1842c4442c38d76308199a21a9bf57
1869cd3bacae3e5bc15aaf1aed2775812bd38e29a9eb324c3b9724c94baf645e
1c8b26febbe628f7d600bf1c0e1f2f5a22bfa052068f0dd1b14aa11d69c1bfcf
1e0e6122c92a80dbf98084bdcd33e8c41cc58a26945ce8fac8318f63427663d2
1f2a0e7aa3dabf73dae3cc7c1e53a70ec51145b39b027bdc1ecae9223c0c80d2
2468545a0699ce571b4f9c3cd167551eb05bdf0531e56b6db09ef4d613214fda
25f4eeb23f67fe1d74534ed37230ecd54ab4f57524276970dcbeaaf3b0fc64f9
26a10d37ec90a75c776be14d420d658a5dfa21e8a02cb5089c0cc7736fd18e72
292e1f72edc83fb43a4bb43e4accf046baa69ed667a1802c9e5f5522de344b2b
2e524320a930af7ed9185809b9385aff48a719012ffe2a2a1d8ab5a732eea1e7
2ed294ef47169b6130caa2bff97d546695d6fe42d9539ce6d87980141d2dd411
2f4c746d966ec923f094efcffe16b9e6319cfb49348b3c9b7fde387784494419
319d89af33fd866acddc109d87bb5415e8dc8ba84bea381c8f945127b9031525
3a0c7beb20db9ed78b764c5384eff2a97f5aa347d6c1aad914e08edd91e25fb4
3aad0543d3b63be29a3b353b23efd0c94359a1d20f207defc88a112ae55119ea
3d0a6f9614a0d6ac3b871045e69bc55df29246b2293fdfcd63880c32117499d4
3dca846f585486c23de116f5d0c0b335876f8b297ec59f2bc71b0fdbbf4af734
42807acf8a1f94395ba975771af6eb599e8e016605a8d52560caaf32d6622088
42e8f5c6b1aa453a1b0bdddd68fc49e719b4440906b1b1b9882c257c292f0deb
46457c35c25b4611c5c93a9ce12446e4deb3d574d4238149e7666f274cdbfee1
4ad163bc0b11d1be18088e84afc86ab7e863f2c88015c54700b5ce0327a2b2ea
4e534c323937c7013e47d49a2180e655222d130d14620a32cff0bce7bedd5764
52f8d8ef7330a65f050d9da9f531a09eb512293ca754c8564312ffcea67d0ea2
53f1c140ebf7e31e6a8015d357d53b986280a1f847cff8b69e42220c01eb52cf
59374b2d6bced61bc1e03384f26d88c7ac21a8028d8c19a65074571606d1a9d7
595829e3a5e2556e6d26b8a62f0bb60c5b653f9899b5f532f2d372c89d1f22f8
5aeaab80bccdfa303f264de43e389206456610bf1a95ccf33cb3e716d410e9b1
5ceb00b7cc0b9fcc76171202553e6608f29c09309d5efb2dfc254b177e4862e3
5f9f84dca0dd61ac75a6d72509b4496ef96759bc4f427ddbea3612e0f2ff76e0
6336ae7b60dff18e0a37721a3a19fd5e18568577a64faa662969d35966dbf72b
657af636f8767c0b56a7db83f43f1588b21579f8b16982ef66229c1f8b885106
65ce6d53148f1b3471942b6789c7126bbce7c257be2cf5a474dd68768513a86e
686eb5d7c927dd741ef72adda5c719b478d36f1e29520ee16d5121854c174b10
696482c2e2d088086d19d0fc4406632415e35b741ecc23151a75a39b8766a5d5
6b0061d304f90f867c7d89b7a06d8203d35c7d9e72eda2e15a30174f594b27b8
6c5466a549e41202c96f43d2af9187ef17e76c8903939eef5e23132878fe02c3
6deff94a740c455fd1bd5d099a27a628c6cf6269f272d40a2149fadb9cb43a1b
795a990610fd34ad7a58c94c780e81f5cd13388e524145e4d96c1821444c85d4
798c1f09661daf19fcaedf28a599db2c692dee36abbbe437eda587ea523bc1ab
7b55b329a1e03740c18c46ee5917aba16d707db5558f8cb420a97fc551eb6a47
7bea17a80a61ed0f54248b4ffc4c718f7c8ff2619742577a73591d62ce074da8
7ef97b12890fc6fee67f869c6e1f74b6719de7d66ac0d649c8d7386a80b4c30f
80612033ea475d4cebf196357cc1f0b9eec98c0cfcaff55531acacd5bf3a459a
839317a8bb731ea99e1a77bf48525baddcf5d65cb2fbd4f8d188934c336f4530
896100123281db500d93da27fdc5638ccb1317311fe3010ea27be6283e33a7c0
8a3898d8de6fee76cf386e4da3df1db7533f921a700ee0dcf00075add1f1334e
8e28e708e26399cc3ae5c4ba9581faa284271a50b33731fada501650d01c6ffd
8ef89f069ba574abd891892cf4a8d628a02c4959108604bf06d5965e1aba262e
9431927bcc4452d078e9d47384ae572530c340dae3b5b385e40b9df3b67e283b
9a93b0d48f5d73e23d7eff3e2c5f855b84398c37939253ce5eb3c2873a99a8bc
9e60dc8bf888a0a4ee8d00c6d8be7d8584b33342c18d9ceecaa171930f40c056
a1ecbaed793a1f564c49c671f2dd0ce36f858534ef6d26b55783a06b884cc506
a23a111c352e400db7b00a1ddfd5f44d8f158969cb0ac6d3eb5abb2ca13738d9
a2d0950629905c71cf75517f1eb6525627b29a2abcc95be0bf16fab7477bb8db
a317f8c54ab2a4a4c87a47536d93ed4d9838e0847f3aeeb02a49fa24bf824171
a625452ec4e298366c604ba857a4468a51496024a96d6b55a126881e40c2ab79
ab70a5f2e7870238214cc4b0ff62fe3db05dc6cb0a9647ed5b2d1ec12f591e87
ad484c2e3d0b602969f1217b2e2485bfb17d53e319a77ade0d513c15ceed6d75
ae8ad9f060bd3d65f363d4248fdea6a71d2419e94177efcf9ccc5321777652f2
b058a1f558d6c191a9d483bb7f9e151b80bb365c3230ffb0ff0d3efc1b8e0dbb
b17b04dc0d2c35d2e62410a2618740d07a2ca2432465d3354855d0b2a7e7ec79
b24c5b325810b01a60487c8a42151b8f6ac44d1173722ec526c54fe7c4b7c762
b47060147f820f4721134724e1a38cab5fcc6960091389f6b4587769c4d2c313
b72a903861501df1de39dd2c3dac10d0b2511b0608161bb4faff39cebad6a154
b96d4da6072b9304962e4b50160af130afb555e377285167785a76128ee3e03b
bf8892a953595eb96b9ca68c5756849d404115dcf2ee9bf87e8b4e7b3cf8e650
c01e9d98f7206f9911670b8eea7d1e94cec22f5d611614553c2b21be536cab45
c3e16766123a0f9a90724242f8ea37b32e9138b60d8b3fed3b45e7f06b6f8b9e
c437eb764a99e6cd5172d63c3fae564bbc51eda4981058d5edebd2bf0700eb76
cd5496f75a7c1029bc681f639794b83f034d5ecd884e8514ae12b13eee9eec70
d0f6beeab8cabab3951c4c34364a5e48f56aa4464bfe2422791b225f46f42c0f
d2751a84e6a70913798dd8b2aede47ab49b7a701618cd151d89755638f71aa02
d31442e80150b0898d0d5598d6b0d828cf70f8b0fdf347969478139b9e956adb
d3bbc6374810ab19b58d5c46134a0957d4c24d78a6f459b941697bb9f5006416
d42a32002a44905c9bbf13077679d350572217a5a99c7ad6f9e6e035c6a79050
d724a5f7b07527f79290065326cb91078de0c74dac58956b04b995b569e74d8b
d8aa932749cab7020563ca74e6720637e6c12b11d517f02aef6a18ca1973b422
d93e11694f5d600c28cb6aca785fc6fb0a199bb1185a4a18eef5794ed9c64fc4
dc6ffe00ea357a0f8ce9d0104243cd52ed4a09e4c4594d27dbe5b44c3af92c4d
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e96d366aa97a36d5d438994d17ecc1104e6a8fb8d60ffcbac8c4c8d0147dbf6b
e9e9a67395a0d83b584208a19b95af203df8e8e6c6952fe76c690d60ea9381c7
ee84f35cccd4482139bcd41e7e0b932961363f9a702082b36ecb0b48921c2fc0
ee9935ca1b9f86df52ab78c4c4a5e2aa7975ebe85da1d8792023ee89ff76e976
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f049bfffec4b94ee7d0948f98b2a0d131a89baffdf21fd61cafb82b3155bd9c2
f1b46a29347f98c4452c9e512233641444def5ebf724cf4cc6a8b18709323204
f327a0ba3e41b1e8154e1c18fc114baff0bd057151e3afe7fa6f33cc0cb18296
f41237b29b03ede2a8e721d29eee497db759913d4bb785a960090b9b2fb70b69
f47f21063dfdcbdeffed3d97689b45efae7a52401cd7fc5b8d07c42d2f232ab9
f5e096fc8178cae0cf6bc9e488717aa73dd9015e68d12bba81dbe301b054981b
f7718f62c157d811823428b72f258a9398b5f1124576cf33d9f361ea73d9571c
f943107aff6f4e820528f733ff3e1e4ad76618ac28927217cc258d9c78de2e1e
fbc8f05345ac48ed8255d901fcf2c119ff9fe774762ec9a04aba3f3a4697aa90
fe0ffa60df0db77aa9456ccc34f5a4fb49baa909cf641c77315b111bcd7486a5
fe6831c996a420f55c8107aec373f542b26aea94847d37e7128d5dab94245fee

www.cardbenefits.citi.com Open in urlscan Pro 198.160.105.71 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

141 Requests

97 %HTTPS

21 %IPv6

16 Domains

27 Subdomains

23 IPs

6 Countries

2449 kBTransfer

7633 kBSize

41 Cookies

16 Outgoing links

Page URL History

Redirected requests

141 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

www.cardbenefits.citi.com Open in urlscan Pro
198.160.105.71 Public Scan

Screenshot
Live screenshot

Full Image

141
Requests

97 %
HTTPS

21 %
IPv6

16
Domains

27
Subdomains

23
IPs

6
Countries

2449 kB
Transfer

7633 kB
Size

41
Cookies

141 HTTP transactions
0 data transactions