urlscan.io logo urlscan.io
SecurityTrails logo

fm.info4.citi.com Open in urlscan Pro
63.148.46.101  Public Scan

Go To Rescan Add Verdict Report
Submitted URL: http://l.info4.citi.com/rts/go2.aspx?t=3437661&tp=i-H55-Q3d-RRI-2rKyTI-24-75EZt-1c-4pkD2-2pYxwg-Ezbvz&x=i-H55-Q3d-RRI-2r...
Effective URL: https://fm.info4.citi.com/ats/url.aspx?cr=100169&wu=10&tp=i-H55-Q3d-RRI-2rKyTI-24-75EZt-1c-4pkD2-2pYxwg-Ezbvz
Submission Tags: falconsandbox
Submission: On December 23 via api from US — Scanned from DE
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 2 IPs in 2 countries across 2 domains to perform 3 HTTP transactions. The main IP is 63.148.46.101, located in Reidsville, United States and belongs to ASN-CHEETA-MAIL, US. The main domain is fm.info4.citi.com.
TLS certificate: Issued by DigiCert EV RSA CA G2 on May 13th 2022. Valid for: a year.
This is the only time fm.info4.citi.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
2 4 63.148.46.101 53316 (ASN-CHEET...)
1 104.64.117.41 16625 (AKAMAI-AS)
3 2
Apex Domain
Subdomains		 Transfer
4 citi.com
l.info4.citi.com — Cisco Umbrella Rank: 658549
fm.info4.citi.com
9 KB
1 eccmp.com
snamwpm.eccmp.com — Cisco Umbrella Rank: 38042
501 B
3 2
Domain Requested by
3 l.info4.citi.com 2 redirects fm.info4.citi.com
1 snamwpm.eccmp.com fm.info4.citi.com
1 fm.info4.citi.com
3 3

This site contains links to these domains. Also see Links.

Domain
l.info4.citi.com
Subject Issuer Validity Valid
info4.citi.com
DigiCert EV RSA CA G2		 2022-05-13 -
2023-06-13		 a year crt.sh
wpm.ccmp.eu
R3		 2022-12-21 -
2023-03-21		 3 months crt.sh

This page contains 1 frames:

Primary Page: https://fm.info4.citi.com/ats/url.aspx?cr=100169&wu=10&tp=i-H55-Q3d-RRI-2rKyTI-24-75EZt-1c-4pkD2-2pYxwg-Ezbvz
Frame ID: 7077BF721A4C9FFEC942272C645FF4DF
Requests: 3 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Citi - English Preference Page

Page URL History Show full URLs

  1. http://l.info4.citi.com/rts/go2.aspx?t=3437661&tp=i-H55-Q3d-RRI-2rKyTI-24-75EZt-1c-4pkD2-2pYxwg-Ezbv... HTTP 302
    https://l.info4.citi.com/rts/go2.aspx?t=3437661&tp=i-H55-Q3d-RRI-2rKyTI-24-75EZt-1c-4pkD2-2pYxwg-Ezbv... HTTP 302
    https://fm.info4.citi.com/ats/url.aspx?cr=100169&wu=10&tp=i-H55-Q3d-RRI-2rKyTI-24-75EZt-1c-4pkD2-2pYxw... Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • \.aspx?(?:$|\?)

Page Statistics

3
Requests

100 %
HTTPS

0 %
IPv6

2
Domains

3
Subdomains

2
IPs

2
Countries

8 kB
Transfer

8 kB
Size

3
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. http://l.info4.citi.com/rts/go2.aspx?t=3437661&tp=i-H55-Q3d-RRI-2rKyTI-24-75EZt-1c-4pkD2-2pYxwg-Ezbvz&x=i-H55-Q3d-RRI-2rKyTI-24-75EZt-1c-4pkD2-2pYxwg-Ezbvz HTTP 302
    https://l.info4.citi.com/rts/go2.aspx?t=3437661&tp=i-H55-Q3d-RRI-2rKyTI-24-75EZt-1c-4pkD2-2pYxwg-Ezbvz&x=i-H55-Q3d-RRI-2rKyTI-24-75EZt-1c-4pkD2-2pYxwg-Ezbvz HTTP 302
    https://fm.info4.citi.com/ats/url.aspx?cr=100169&wu=10&tp=i-H55-Q3d-RRI-2rKyTI-24-75EZt-1c-4pkD2-2pYxwg-Ezbvz Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

3 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request url.aspx
fm.info4.citi.com/ats/
Redirect Chain
  • http://l.info4.citi.com/rts/go2.aspx?t=3437661&tp=i-H55-Q3d-RRI-2rKyTI-24-75EZt-1c-4pkD2-2pYxwg-Ezbvz&x=i-H55-Q3d-RRI-2rKyTI-24-75EZt-1c-4pkD2-2pYxwg-Ezbvz
  • https://l.info4.citi.com/rts/go2.aspx?t=3437661&tp=i-H55-Q3d-RRI-2rKyTI-24-75EZt-1c-4pkD2-2pYxwg-Ezbvz&x=i-H55-Q3d-RRI-2rKyTI-24-75EZt-1c-4pkD2-2pYxwg-Ezbvz
  • https://fm.info4.citi.com/ats/url.aspx?cr=100169&wu=10&tp=i-H55-Q3d-RRI-2rKyTI-24-75EZt-1c-4pkD2-2pYxwg-Ezbvz
7 KB
8 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://fm.info4.citi.com/ats/url.aspx?cr=100169&wu=10&tp=i-H55-Q3d-RRI-2rKyTI-24-75EZt-1c-4pkD2-2pYxwg-Ezbvz
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
63.148.46.101 Reidsville, United States, ASN53316 (ASN-CHEETA-MAIL, US),
Reverse DNS
Software
/
Resource Hash
23f96020c39a90b42b34cacbe8abc10d5928b30af45cab3b3bc9f6b333fd409a

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

Access-Control-Allow-Headers
Origin, X-Requested-With, Content-Type, Accept
Access-Control-Allow-Methods
POST, GET, OPTIONS, PUT, DELETE
Cache-Control
no-cache, no-store, must-revalidate
Content-Length
7456
Content-Type
text/html; charset=utf-8
Date
Fri, 23 Dec 2022 05:18:28 GMT
Expires
0
Pragma
no-cache
SERVER
X-Powered-By

Redirect headers

Cache-Control
private
Content-Type
text/html; charset=utf-8
Date
Fri, 23 Dec 2022 05:18:26 GMT
Location
https://fm.info4.citi.com/ats/url.aspx?cr=100169&wu=10&tp=i-H55-Q3d-RRI-2rKyTI-24-75EZt-1c-4pkD2-2pYxwg-Ezbvz
Server
Transfer-Encoding
chunked
X-Powered-By
open.aspx
l.info4.citi.com/rts/ 		43 B
255 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://l.info4.citi.com/rts/open.aspx?tp=i-pFH-Q3d-4D-2rKyTI-24-75EZt-1c-4pkD2-G-2pYxwg-RRI-1fINIY
Requested by
Host: fm.info4.citi.com
URL: https://fm.info4.citi.com/ats/url.aspx?cr=100169&wu=10&tp=i-H55-Q3d-RRI-2rKyTI-24-75EZt-1c-4pkD2-2pYxwg-Ezbvz
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
63.148.46.101 Reidsville, United States, ASN53316 (ASN-CHEETA-MAIL, US),
Reverse DNS
Software
/
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://fm.info4.citi.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

Pragma
no-cache
Date
Fri, 23 Dec 2022 05:18:29 GMT
Server
X-Powered-By
Transfer-Encoding
chunked
Content-Type
image/gif
Cache-Control
no-cache, max-age=0
Expires
0
red_arrow.gif
snamwpm.eccmp.com/wpm/503/ContentUploads/Forms/ 		223 B
501 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://snamwpm.eccmp.com/wpm/503/ContentUploads/Forms/red_arrow.gif
Requested by
Host: fm.info4.citi.com
URL: https://fm.info4.citi.com/ats/url.aspx?cr=100169&wu=10&tp=i-H55-Q3d-RRI-2rKyTI-24-75EZt-1c-4pkD2-2pYxwg-Ezbvz
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
104.64.117.41 Prague, Czech Republic, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-64-117-41.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
18689a9e360d7e0e5a1fb4f03437829279b931200c6fe6fb010aa7ffc56f20fb

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://fm.info4.citi.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

Date
Fri, 23 Dec 2022 05:18:30 GMT
Last-Modified
Mon, 18 Aug 2014 16:26:38 GMT
Server
ETag
"5620962f1bbcf1:0"
X-Powered-By
Content-Type
image/gif
Access-Control-Allow-Origin
*
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
223

Verdicts & Comments Add Verdict or Comment

4 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| oncontentvisibilityautostatechange function| validate string| ct object| mper

3 Cookies

Domain/Path Name / Value
l.info4.citi.com/ Name: ASP.NET_SessionId
Value: th1000vtpwrg31mvmvowqdym
l.info4.citi.com/ Name: BIGipServercnv_ats_ssl_pool
Value: 1044846602.47873.0000
fm.info4.citi.com/ Name: BIGipServercnv_ats_ssl_pool
Value: 1044846602.47873.0000

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

fm.info4.citi.com
l.info4.citi.com
snamwpm.eccmp.com
104.64.117.41
63.148.46.101
18689a9e360d7e0e5a1fb4f03437829279b931200c6fe6fb010aa7ffc56f20fb
23f96020c39a90b42b34cacbe8abc10d5928b30af45cab3b3bc9f6b333fd409a
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b