banking.citi.com Open in urlscan Pro
35.190.22.40 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://click.info15.citi.com/?qs=73f70529a57eee71abf8a9e77d04e1daa797ea6962e1e3a61031b01e3e1acf3343c6a8586feb0a0af0b206c52bcc...
Effective URL:
https://banking.citi.com/cbol/investment/cpwm/default.htm?BT_TX=1&ProspectID=455F85F6E72647FBA011AEE59AEF2397
Submission: On April 11 via manual (April 11th 2024, 8:05:34 pm UTC) from IN — Scanned from DE

Summary HTTP 124 Redirects Links 10 Behaviour Indicators

Summary

This website contacted 33 IPs in 5 countries across 23 domains to perform 124 HTTP transactions. The main IP is 35.190.22.40, located in Kansas City, United States and belongs to GOOGLE, US. The main domain is banking.citi.com. The Cisco Umbrella rank of the primary domain is 398283.
TLS certificate: Issued by DigiCert EV RSA CA G2 on January 11th 2024. Valid for: a year.

This is the only time banking.citi.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1 1	13.111.71.127 13.111.71.127	14340 (SALESFORCE) (SALESFORCE)
2 23	35.190.22.40 35.190.22.40	15169 (GOOGLE) (GOOGLE)
4	2606:4700::68... 2606:4700::6813:9408	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	2600:9000:20c... 2600:9000:20c3:6000:2:8f43:5780:93a1	16509 (AMAZON-02) (AMAZON-02)
14	3.124.119.57 3.124.119.57	16509 (AMAZON-02) (AMAZON-02)
1 3	63.34.203.75 63.34.203.75	16509 (AMAZON-02) (AMAZON-02)
14	99.84.88.39 99.84.88.39	16509 (AMAZON-02) (AMAZON-02)
1	18.173.154.120 18.173.154.120	16509 (AMAZON-02) (AMAZON-02)
1	99.84.88.53 99.84.88.53	16509 (AMAZON-02) (AMAZON-02)
1	2600:9000:20c... 2600:9000:20c3:2a00:1:76cf:fe80:93a1	16509 (AMAZON-02) (AMAZON-02)
5	2a00:1450:400... 2a00:1450:4001:81d::2008	15169 (GOOGLE) (GOOGLE)
1	2606:4700::68... 2606:4700::6812:180d	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	63.140.62.27 63.140.62.27	15224 (OMNITURE) (OMNITURE)
1 1	99.81.63.100 99.81.63.100	16509 (AMAZON-02) (AMAZON-02)
1	34.249.110.227 34.249.110.227	16509 (AMAZON-02) (AMAZON-02)
1	193.0.160.130 193.0.160.130	54312 (ROCKETFUEL) (ROCKETFUEL)
8	34.107.138.236 34.107.138.236	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
1	66.235.152.156 66.235.152.156	16509 (AMAZON-02) (AMAZON-02)
11	104.17.208.240 104.17.208.240	13335 (CLOUDFLAR...) (CLOUDFLARENET)
11	216.58.206.72 216.58.206.72	15169 (GOOGLE) (GOOGLE)
2	2a00:1288:80:... 2a00:1288:80:807::1	203220 (YAHOO-DEB) (YAHOO-DEB)
1 2	142.250.184.198 142.250.184.198	15169 (GOOGLE) (GOOGLE)
1	35.244.154.8 35.244.154.8	15169 (GOOGLE) (GOOGLE)
1	2600:9000:224... 2600:9000:2247:5400:1d:bf0a:0:93a1	16509 (AMAZON-02) (AMAZON-02)
3	2620:1ec:c11:... 2620:1ec:c11::237	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1	13.32.27.28 13.32.27.28	16509 (AMAZON-02) (AMAZON-02)
1	34.232.212.104 34.232.212.104	14618 (AMAZON-AES) (AMAZON-AES)
2	99.83.205.94 99.83.205.94	16509 (AMAZON-02) (AMAZON-02)
1	18.66.196.37 18.66.196.37	16509 (AMAZON-02) (AMAZON-02)
1	18.173.154.117 18.173.154.117	16509 (AMAZON-02) (AMAZON-02)
1	212.82.100.181 212.82.100.181	34010 (YAHOO-IRD) (YAHOO-IRD)
1	52.87.59.181 52.87.59.181	14618 (AMAZON-AES) (AMAZON-AES)
1	184.30.20.101 184.30.20.101	16625 (AKAMAI-AS) (AKAMAI-AS)
1	3.220.94.22 3.220.94.22	14618 (AMAZON-AES) (AMAZON-AES)
124	33

1 13.111.71.127 (United States) 1 redirects

ASN14340 (SALESFORCE, US)
PTR: click.info15.citi.com

click.info15.citi.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

23 35.190.22.40 (Kansas City, United States) 2 redirects

ASN15169 (GOOGLE, US)
PTR: 40.22.190.35.bc.googleusercontent.com

banking.citi.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
citi.bridgetrack.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2606:4700::6813:9408 (United States)

ASN13335 (CLOUDFLARENET, US)

script.crazyegg.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2600:9000:20c3:6000:2:8f43:5780:93a1 (United States)

ASN16509 (AMAZON-02, US)

nexus.ensighten.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

14 3.124.119.57 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-3-124-119-57.eu-central-1.compute.amazonaws.com

tagmanager1.citi.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
data.privacy.ensighten.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 63.34.203.75 (Dublin, Ireland) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-63-34-203-75.eu-west-1.compute.amazonaws.com

dpm.demdex.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

14 99.84.88.39 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-99-84-88-39.muc50.r.cloudfront.net

nexus.ensighten.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 18.173.154.120 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-18-173-154-120.muc50.r.cloudfront.net

pagestates-tracking.crazyegg.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 99.84.88.53 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-99-84-88-53.muc50.r.cloudfront.net

assets-tracking.crazyegg.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:20c3:2a00:1:76cf:fe80:93a1 (United States)

ASN16509 (AMAZON-02, US)

c1.rfihub.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2a00:1450:4001:81d::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6812:180d (United States)

ASN13335 (CLOUDFLARENET, US)

cdn.gbqofs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 63.140.62.27 (United States)

ASN15224 (OMNITURE, US)
PTR: ip-63-140-62-27.data.adobedc.net

metrics1.citi.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 99.81.63.100 (Dublin, Ireland) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-99-81-63-100.eu-west-1.compute.amazonaws.com

cm.everesttech.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 34.249.110.227 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-34-249-110-227.eu-west-1.compute.amazonaws.com

tracking.crazyegg.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 193.0.160.130 (United States)

ASN54312 (ROCKETFUEL, US)

20766699p.rfihub.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 34.107.138.236 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 236.138.107.34.bc.googleusercontent.com

cdn.digitalmarketing.citibankonline.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 66.235.152.156 (United States)

ASN16509 (AMAZON-02, US)
PTR: ip-66-235-152-156.data.adobedc.net

citicorpcreditservic.tt.omtrdc.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

11 104.17.208.240 (None, )

ASN13335 (CLOUDFLARENET, US)

zn3vi8kkuds0jjrfc-citifeedback.siteintercept.qualtrics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
siteintercept.qualtrics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

11 216.58.206.72 (United States)

ASN15169 (GOOGLE, US)
PTR: lhr35s11-in-f8.1e100.net

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1288:80:807::1 (United Kingdom)

ASN203220 (YAHOO-DEB, GB)

s.yimg.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 142.250.184.198 (United States) 1 redirects

ASN15169 (GOOGLE, US)
PTR: fra24s11-in-f6.1e100.net

6269322.fls.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 35.244.154.8 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 8.154.244.35.bc.googleusercontent.com

sr.rlcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:2247:5400:1d:bf0a:0:93a1 (United States)

ASN16509 (AMAZON-02, US)

c.tvpixel.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2620:1ec:c11::237 (United States)

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

bat.bing.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.32.27.28 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-32-27-28.fra56.r.cloudfront.net

live.rezync.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 34.232.212.104 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-34-232-212-104.compute-1.amazonaws.com

prod.report.nacustomerexperience.citi.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 99.83.205.94 (United States)

ASN16509 (AMAZON-02, US)
PTR: ad37daabd18951e96.awsglobalaccelerator.com

p.tvpixel.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 18.66.196.37 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-18-66-196-37.mxp63.r.cloudfront.net

sb.scorecardresearch.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 18.173.154.117 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-18-173-154-117.muc50.r.cloudfront.net

cdn.boomtrain.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 212.82.100.181 (Dublin, Ireland)

ASN34010 (YAHOO-IRD, GB)
PTR: spdc.pbp.vip.ir2.yahoo.com

sp.analytics.yahoo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.87.59.181 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-52-87-59-181.compute-1.amazonaws.com

people.api.boomtrain.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 184.30.20.101 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a184-30-20-101.deploy.static.akamaitechnologies.com

iad1.qualtrics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 3.220.94.22 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-3-220-94-22.compute-1.amazonaws.com

events.api.boomtrain.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
32	citi.com 2 redirects click.info15.citi.com — Cisco Umbrella Rank: 120896 banking.citi.com — Cisco Umbrella Rank: 398283 tagmanager1.citi.com — Cisco Umbrella Rank: 53053 metrics1.citi.com — Cisco Umbrella Rank: 20036 prod.report.nacustomerexperience.citi.com — Cisco Umbrella Rank: 21070	709 KB
23	ensighten.com nexus.ensighten.com — Cisco Umbrella Rank: 4162 data.privacy.ensighten.com — Cisco Umbrella Rank: 10515	220 KB
16	googletagmanager.com www.googletagmanager.com — Cisco Umbrella Rank: 44	1 MB
12	qualtrics.com zn3vi8kkuds0jjrfc-citifeedback.siteintercept.qualtrics.com — Cisco Umbrella Rank: 35988 siteintercept.qualtrics.com — Cisco Umbrella Rank: 946 iad1.qualtrics.com — Cisco Umbrella Rank: 10569	94 KB
8	citibankonline.com cdn.digitalmarketing.citibankonline.com — Cisco Umbrella Rank: 79380	233 KB
7	crazyegg.com script.crazyegg.com — Cisco Umbrella Rank: 2629 pagestates-tracking.crazyegg.com — Cisco Umbrella Rank: 5425 assets-tracking.crazyegg.com — Cisco Umbrella Rank: 5429 tracking.crazyegg.com — Cisco Umbrella Rank: 4626	37 KB
3	boomtrain.com cdn.boomtrain.com — Cisco Umbrella Rank: 5389 people.api.boomtrain.com — Cisco Umbrella Rank: 5845 events.api.boomtrain.com — Cisco Umbrella Rank: 8169	31 KB
3	bing.com bat.bing.com — Cisco Umbrella Rank: 353	14 KB
3	tvpixel.com c.tvpixel.com — Cisco Umbrella Rank: 9432 p.tvpixel.com — Cisco Umbrella Rank: 2167	32 KB
3	demdex.net 1 redirects dpm.demdex.net — Cisco Umbrella Rank: 237 citi.demdex.net Failed	2 KB
2	doubleclick.net 1 redirects 6269322.fls.doubleclick.net — Cisco Umbrella Rank: 225439	842 B
2	yimg.com s.yimg.com — Cisco Umbrella Rank: 666	7 KB
2	bridgetrack.com 1 redirects citi.bridgetrack.com — Cisco Umbrella Rank: 187158	2 KB
1	yahoo.com sp.analytics.yahoo.com — Cisco Umbrella Rank: 1694	633 B
1	scorecardresearch.com sb.scorecardresearch.com — Cisco Umbrella Rank: 166	301 B
1	rezync.com live.rezync.com — Cisco Umbrella Rank: 1254	2 KB
1	rlcdn.com sr.rlcdn.com — Cisco Umbrella Rank: 32213
1	omtrdc.net citicorpcreditservic.tt.omtrdc.net — Cisco Umbrella Rank: 34607	1 KB
1	rfihub.com 20766699p.rfihub.com — Cisco Umbrella Rank: 146138
1	everesttech.net 1 redirects cm.everesttech.net — Cisco Umbrella Rank: 1363	517 B
1	gbqofs.com cdn.gbqofs.com — Cisco Umbrella Rank: 6789	149 KB
1	rfihub.net c1.rfihub.net — Cisco Umbrella Rank: 5022	6 KB
0	amazon-adsystem.com Failed s.amazon-adsystem.com — Cisco Umbrella Rank: 302 Failed
124	23

	Domain	Requested by
21	banking.citi.com	1 redirects banking.citi.com nexus.ensighten.com
16	www.googletagmanager.com	nexus.ensighten.com
16	nexus.ensighten.com	banking.citi.com nexus.ensighten.com
10	siteintercept.qualtrics.com	nexus.ensighten.com
8	cdn.digitalmarketing.citibankonline.com	banking.citi.com
7	data.privacy.ensighten.com	banking.citi.com
7	tagmanager1.citi.com	nexus.ensighten.com
4	script.crazyegg.com	banking.citi.com script.crazyegg.com nexus.ensighten.com
3	bat.bing.com	nexus.ensighten.com
3	dpm.demdex.net	1 redirects banking.citi.com
2	p.tvpixel.com	nexus.ensighten.com
2	6269322.fls.doubleclick.net	1 redirects nexus.ensighten.com
2	s.yimg.com	nexus.ensighten.com
2	metrics1.citi.com	nexus.ensighten.com
2	citi.bridgetrack.com	1 redirects banking.citi.com
1	events.api.boomtrain.com	nexus.ensighten.com
1	iad1.qualtrics.com
1	people.api.boomtrain.com	nexus.ensighten.com
1	sp.analytics.yahoo.com
1	cdn.boomtrain.com	nexus.ensighten.com
1	sb.scorecardresearch.com
1	prod.report.nacustomerexperience.citi.com	nexus.ensighten.com
1	live.rezync.com	nexus.ensighten.com
1	c.tvpixel.com	nexus.ensighten.com
1	sr.rlcdn.com	nexus.ensighten.com
1	zn3vi8kkuds0jjrfc-citifeedback.siteintercept.qualtrics.com	nexus.ensighten.com
1	citicorpcreditservic.tt.omtrdc.net	nexus.ensighten.com
1	20766699p.rfihub.com	nexus.ensighten.com
1	tracking.crazyegg.com	script.crazyegg.com
1	cm.everesttech.net	1 redirects
1	cdn.gbqofs.com	nexus.ensighten.com
1	c1.rfihub.net	nexus.ensighten.com
1	assets-tracking.crazyegg.com	script.crazyegg.com
1	pagestates-tracking.crazyegg.com	script.crazyegg.com
1	click.info15.citi.com	1 redirects
0	s.amazon-adsystem.com Failed
0	citi.demdex.net Failed	nexus.ensighten.com
124	37

This site contains links to these domains. Also see Links.

Domain
citi.bridgetrack.com

Subject Issuer	Validity	Valid
banking.citi.com DigiCert EV RSA CA G2	`2024-01-11` - `2025-01-28`	a year	crt.sh
script.crazyegg.com E1	`2024-04-05` - `2024-07-04`	3 months	crt.sh
nexus.ensighten.com Amazon RSA 2048 M02	`2023-09-29` - `2024-10-27`	a year	crt.sh
citi.bridgetrack.com Thawte EV RSA CA G2	`2024-04-08` - `2025-05-09`	a year	crt.sh
tagmanager1.citi.com DigiCert EV RSA CA G2	`2023-08-21` - `2024-09-20`	a year	crt.sh
*.privacy.ensighten.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2024-02-02` - `2025-02-19`	a year	crt.sh
crazyegg.com Amazon RSA 2048 M02	`2023-05-28` - `2024-06-26`	a year	crt.sh
*.rfihub.net Amazon RSA 2048 M03	`2023-10-31` - `2024-11-28`	a year	crt.sh
*.google-analytics.com GTS CA 1C3	`2024-03-04` - `2024-05-27`	3 months	crt.sh
gbqofs.com Cloudflare Inc ECC CA-3	`2023-10-12` - `2024-10-11`	a year	crt.sh
metrics1.citi.com DigiCert EV RSA CA G2	`2023-07-10` - `2024-08-09`	a year	crt.sh
*.rfihub.com Sectigo RSA Domain Validation Secure Server CA	`2024-04-08` - `2025-04-27`	a year	crt.sh
cdn.digitalmarketing.citibankonline.com DigiCert EV RSA CA G2	`2023-05-23` - `2024-06-22`	a year	crt.sh
*.tt.omtrdc.net DigiCert TLS RSA SHA256 2020 CA1	`2023-08-22` - `2024-09-21`	a year	crt.sh
*.qualtrics.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2024-03-27` - `2025-02-19`	a year	crt.sh
*.fantasysports.yahoo.com DigiCert SHA2 High Assurance Server CA	`2024-04-02` - `2024-05-22`	2 months	crt.sh
*.doubleclick.net GTS CA 1C3	`2024-03-04` - `2024-05-27`	3 months	crt.sh
*.rlcdn.com Sectigo RSA Domain Validation Secure Server CA	`2024-02-06` - `2025-03-05`	a year	crt.sh
*.tvpixel.com Amazon RSA 2048 M03	`2023-11-15` - `2024-12-13`	a year	crt.sh
www.bing.com Microsoft Azure TLS Issuing CA 02	`2024-04-11` - `2024-06-27`	3 months	crt.sh
*.rezync.com Amazon RSA 2048 M02	`2023-10-25` - `2024-11-21`	a year	crt.sh
prod.report.nacustomerexperience.citi.com DigiCert EV RSA CA G2	`2023-05-19` - `2024-05-22`	a year	crt.sh
p.tvpixel.com Amazon RSA 2048 M02	`2024-02-01` - `2025-03-01`	a year	crt.sh
*.scorecardresearch.com Sectigo RSA Organization Validation Secure Server CA	`2023-12-11` - `2024-12-10`	a year	crt.sh
*.boomtrain.com Amazon RSA 2048 M02	`2024-01-10` - `2025-02-07`	a year	crt.sh
real.sp.analytics.yahoo.com DigiCert SHA2 High Assurance Server CA	`2024-03-19` - `2024-09-11`	6 months	crt.sh
*.api.boomtrain.com Amazon RSA 2048 M03	`2023-09-16` - `2024-10-14`	a year	crt.sh

This page contains 6 frames:

Primary Page: https://banking.citi.com/cbol/investment/cpwm/default.htm?BT_TX=1&ProspectID=455F85F6E72647FBA011AEE59AEF2397
Frame ID: 93B4F30B7293921F1D7F33E57F0F1795
Requests: 114 HTTP requests in this frame

Frame: https://script.crazyegg.com/pages/data-scripts/0090/1567/sampling/banking.citi.com.json?t=475796
Frame ID: B2CFCA5FC1A79A6FFC83E598AFC203CC
Requests: 4 HTTP requests in this frame

Frame: https://citi.demdex.net/dest5.html?d_nsid=0
Frame ID: 93409485318A376464344D7800AD31DA
Requests: 1 HTTP requests in this frame

Frame: https://20766699p.rfihub.com/ca.html?ver=9&ra=934&rb=648&ca=20766699&_o=17169175&_t=investmentcpwm&_rev=1&_pcode=1&_orderid=1&ssv_cuuid=&ssv_package=null&ssv_prodlist=null&ssv_pagename=investmentcpwm&pe=https%3A%2F%2Fbanking.citi.com%2Fcbol%2Finvestment%2Fcpwm%2Fdefault.htm%3FBT_TX%3D1%26ProspectID%3D455F85F6E72647FBA011AEE59AEF2397&pf=&ra=8858525936592563
Frame ID: 66DF6C3040B229EA8EAAACE36F5717AA
Requests: 1 HTTP requests in this frame

Frame: https://6269322.fls.doubleclick.net/activityi;dc_pre=CJq7h-n6uoUDFchZHgId42QFpg;src=6269322;type=bankp00;cat=banka019;ord=1;num=1583168628853;npa=1;auiddc=102249979.1712865927;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B123.0.6312.122%7CNot%253AA-Brand%3B8.0.0.0%7CChromium%3B123.0.6312.122;uamb=0;uam=;uap=Win32;uapv=10.0.0;uaw=0;pscdl=noapi;gtm=45fe44a0v9179876355za200;gcd=13l3l3l2l1;dma_cps=sypham;dma=1;epver=2;~oref=https%3A%2F%2Fbanking.citi.com%2Fcbol%2Finvestment%2Fcpwm%2Fdefault.htm%3FBT_TX%3D1%26ProspectID%3D455F85F6E72647FBA011AEE59AEF2397
Frame ID: 45C3DF6EFFBCCE559FA1D10AD1E61E3B
Requests: 1 HTTP requests in this frame

Frame: https://sr.rlcdn.com/425466.html?es=80676&u=da39a3ee5e6b4b0d3255bfef95601890afd80709
Frame ID: F6FF5811C8D04B01C72F90FA87BC0ECA
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Earn up to $5,000 | Citi.com

Page URL History Show full URLs

https://click.info15.citi.com/?qs=73f70529a57eee71abf8a9e77d04e1daa797ea6962e1e3a61031b01e3e1acf3343c6a858... HTTP 302
https://banking.citi.com/cbol/investment/cpwm/default.htm HTTP 302
https://citi.bridgetrack.com/cbol/investment/cpwm/default.htm?BT_VanityDomain=75D5D21283638384E0D1F0BE7A3... HTTP 302
https://banking.citi.com/cbol/investment/cpwm/default.htm?BT_TX=1&ProspectID=455F85F6E72647FBA011AEE5... Page URL

Detected technologies

Bootstrap (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js

Crazy Egg (Analytics) Expand

Overall confidence: 100%
Detected patterns

script\.crazyegg\.com/pages/scripts/\d+/\d+\.js

Ensighten (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

//nexus\.ensighten\.com/

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/gtag/js

Page Statistics

124
Requests

94 %
HTTPS

24 %
IPv6

23
Domains

37
Subdomains

33
IPs

5
Countries

2782 kB
Transfer

6961 kB
Size

58
Cookies

10 Outgoing links

These are links going to different origins than the main page.

URL: https://citi.bridgetrack.com/track/?TGT=28718

Search URL Search Domain Scan URL

URL: https://citi.bridgetrack.com/track/?TGT=28715
Title: Terms & Conditions

Search URL Search Domain Scan URL

URL: https://citi.bridgetrack.com/track/?TGT=28717
Title: Privacy

Search URL Search Domain Scan URL

URL: https://citi.bridgetrack.com/track/?TGT=151056
Title: Notice at Collection

Search URL Search Domain Scan URL

URL: https://citi.bridgetrack.com/track/?TGT=151057
Title: CA Privacy Hub

Search URL Search Domain Scan URL

URL: https://citi.bridgetrack.com/track/?TGT=28716
Title: Security

Search URL Search Domain Scan URL

URL: https://citi.bridgetrack.com/track/?TGT=143095
Title: Contact Us

Search URL Search Domain Scan URL

URL: https://citi.bridgetrack.com/track/?TGT=143097

Search URL Search Domain Scan URL

URL: https://citi.bridgetrack.com/track/?TGT=143098

Search URL Search Domain Scan URL

URL: https://citi.bridgetrack.com/track/?TGT=143100

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://click.info15.citi.com/?qs=73f70529a57eee71abf8a9e77d04e1daa797ea6962e1e3a61031b01e3e1acf3343c6a8586feb0a0af0b206c52bcc020a22a6935c58adb965 HTTP 302
https://banking.citi.com/cbol/investment/cpwm/default.htm HTTP 302
https://citi.bridgetrack.com/cbol/investment/cpwm/default.htm?BT_VanityDomain=75D5D21283638384E0D1F0BE7A3F8F3FA8FC1D5DDA7E6A8BBA188968495696A7A3F735D5C571B532B253E2E0D1E5F1A08EDB93E72A HTTP 302
https://banking.citi.com/cbol/investment/cpwm/default.htm?BT_TX=1&ProspectID=455F85F6E72647FBA011AEE59AEF2397 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 8

https://dpm.demdex.net/id?d_visid_ver=4.4.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=61834D9B5228A7430A490D45%40AdobeOrg&d_nsid=0&ts=1712865926142 HTTP 302
https://dpm.demdex.net/id/rd?d_visid_ver=4.4.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=61834D9B5228A7430A490D45%40AdobeOrg&d_nsid=0&ts=1712865926142

Request Chain 39

https://cm.everesttech.net/cm/dd?d_uuid=17654313976704716112721178464925810017 HTTP 302
https://dpm.demdex.net/ibs:dpid=411&dpuuid=ZhhChgAAAE_bYAO5

Request Chain 75

https://6269322.fls.doubleclick.net/activityi;src=6269322;type=bankp00;cat=banka019;ord=1;num=1583168628853;npa=1;auiddc=102249979.1712865927;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B123.0.6312.122%7CNot%253AA-Brand%3B8.0.0.0%7CChromium%3B123.0.6312.122;uamb=0;uam=;uap=Win32;uapv=10.0.0;uaw=0;pscdl=noapi;gtm=45fe44a0v9179876355za200;gcd=13l3l3l2l1;dma_cps=sypham;dma=1;epver=2;~oref=https%3A%2F%2Fbanking.citi.com%2Fcbol%2Finvestment%2Fcpwm%2Fdefault.htm%3FBT_TX%3D1%26ProspectID%3D455F85F6E72647FBA011AEE59AEF2397 HTTP 302
https://6269322.fls.doubleclick.net/activityi;dc_pre=CJq7h-n6uoUDFchZHgId42QFpg;src=6269322;type=bankp00;cat=banka019;ord=1;num=1583168628853;npa=1;auiddc=102249979.1712865927;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B123.0.6312.122%7CNot%253AA-Brand%3B8.0.0.0%7CChromium%3B123.0.6312.122;uamb=0;uam=;uap=Win32;uapv=10.0.0;uaw=0;pscdl=noapi;gtm=45fe44a0v9179876355za200;gcd=13l3l3l2l1;dma_cps=sypham;dma=1;epver=2;~oref=https%3A%2F%2Fbanking.citi.com%2Fcbol%2Finvestment%2Fcpwm%2Fdefault.htm%3FBT_TX%3D1%26ProspectID%3D455F85F6E72647FBA011AEE59AEF2397

Request Chain 80

https://s.amazon-adsystem.com/iu3?pid=c3702eea-109e-48b0-9ef4-c856bdd405e2&event=PageView HTTP 302
https://s.amazon-adsystem.com/iu3?pid=c3702eea-109e-48b0-9ef4-c856bdd405e2&event=PageView&dcc=t

124 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

Primary Request default.htm Show response
banking.citi.com/cbol/investment/cpwm/
Redirect Chain

https://click.info15.citi.com/?qs=73f70529a57eee71abf8a9e77d04e1daa797ea6962e1e3a61031b01e3e1acf3343c6a8586feb0a0af0b206c52bcc020a22a6935c58adb965
https://banking.citi.com/cbol/investment/cpwm/default.htm
https://citi.bridgetrack.com/cbol/investment/cpwm/default.htm?BT_VanityDomain=75D5D21283638384E0D1F0BE7A3F8F3FA8FC1D5DDA7E6A8BBA188968495696A7A3F735D5C571B532B253E2E0D1E5F1A08EDB93E72A
https://banking.citi.com/cbol/investment/cpwm/default.htm?BT_TX=1&ProspectID=455F85F6E72647FBA011AEE59AEF2397

5 KB
2 KB

174ms
174ms

Document
text/html

35.190.22.40
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://banking.citi.com/cbol/investment/cpwm/default.htm?BT_TX=1&ProspectID=455F85F6E72647FBA011AEE59AEF2397

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

35.190.22.40 Kansas City, United States, ASN15169 (GOOGLE, US),

Reverse DNS

40.22.190.35.bc.googleusercontent.com

Software

Resource Hash

ebdabf4297fb1adc64f0a9eb3e596fa3e02bc8bfc610c1aaad6e82742293efa2

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.bridgetrack.com; report-uri https://csp-reporter-ui3464xpjq-uc.a.run.app/api/csp-report/?env=prod
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9;q=0.9
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Win32"

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-encoding: gzip
content-length: 2397
content-security-policy: frame-ancestors https://*.citi.com https://*.bridgetrack.com; report-uri https://csp-reporter-ui3464xpjq-uc.a.run.app/api/csp-report/?env=prod
content-type: text/html
date: Thu, 11 Apr 2024 20:05:24 GMT
expires: Wed, 10 Apr 2024 20:05:25 GMT
p3p: CP="NON DSP COR DEVa PSAa IVAo CONo OUR IND UNI PUR NAV DEM LOC", policyref="http://citi.bridgetrack.com/w3c/p3p.xml"
permissions-policy: fullscreen=(self "https://*.citi.com" "https://*.bridgetrack.com" "https://www.youtube.com" "https://cdn.digitalmarketing.citibankonline.com"), geolocation=(self "https://*.citi.com" "https://*.bridgetrack.com"), camera=()
referrer-policy: strict-origin-when-cross-origin
strict-transport-security: max-age=31536000; includeSubDomains
vary: Accept-Encoding
via: 1.1 google
x-content-type-options: nosniff
x-xss-protection: 1; mode=block

Redirect headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-length: 0
content-security-policy: frame-ancestors https://*.citi.com https://*.bridgetrack.com; report-uri https://csp-reporter-ui3464xpjq-uc.a.run.app/api/csp-report/?env=prod
content-type: text/html
date: Thu, 11 Apr 2024 20:05:24 GMT
expires: Wed, 10 Apr 2024 20:05:25 GMT
location: https://banking.citi.com/cbol/investment/cpwm/default.htm?BT_TX=1&ProspectID=455F85F6E72647FBA011AEE59AEF2397
p3p: CP="NON DSP COR DEVa PSAa IVAo CONo OUR IND UNI PUR NAV DEM LOC", policyref="http://citi.bridgetrack.com/w3c/p3p.xml"
permissions-policy: fullscreen=(self "https://*.citi.com" "https://*.bridgetrack.com" "https://www.youtube.com" "https://cdn.digitalmarketing.citibankonline.com"), geolocation=(self "https://*.citi.com" "https://*.bridgetrack.com"), camera=()
referrer-policy: strict-origin-when-cross-origin
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 google
x-content-type-options: nosniff
x-xss-protection: 1; mode=block

GET
H2 200 1567.js Show response
script.crazyegg.com/pages/scripts/0090/ 6 KB
2 KB 159ms
62ms Script
text/javascript 2606:4700::6813:9408
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://script.crazyegg.com/pages/scripts/0090/1567.js
Requested by: Host: banking.citi.com
URL: https://banking.citi.com/cbol/investment/cpwm/default.htm?BT_TX=1&ProspectID=455F85F6E72647FBA011AEE59AEF2397
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6813:9408 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: fb2668e04a4954dce87f6d3516774360d71506274332a3c8cbf47bace5e11af1

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://banking.citi.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 11 Apr 2024 20:05:25 GMT
content-encoding: gzip
cf-cache-status: HIT
age: 233097
cf-polished: origSize=6112
ce-version: 11.5.202
cf-bgj: minify
last-modified: Tue, 09 Apr 2024 03:20:28 GMT
server: cloudflare
vary: Accept-Encoding
content-type: text/javascript
access-control-allow-origin: *
access-control-expose-headers: CE-Version
cache-control: public, max-age=300, s-maxage=1209600
timing-allow-origin: *
cf-ray: 872d97627dcc71d0-FRA

GET
H2 200 Bootstrap.js Show response
nexus.ensighten.com/citi/na_prod/ 642 KB
152 KB 142ms
46ms Script
application/javascript 2600:9000:20c3:6000:2:8f43:5780:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Requested by: Host: banking.citi.com
URL: https://banking.citi.com/cbol/investment/cpwm/default.htm?BT_TX=1&ProspectID=455F85F6E72647FBA011AEE59AEF2397
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:20c3:6000:2:8f43:5780:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: CloudFront /
Resource Hash: a7752b6c23225d6511ec65a421cd536a822a68f3157139343d49c104e8e453fe

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://banking.citi.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 26 Mar 2024 18:47:37 GMT
x-amz-version-id: T55p11KHrcvHUi6ZwvUQAAOFuOGZ5wBZ
content-encoding: br
via: 1.1 c4c822c878c22be90d0bb70ab49a395a.cloudfront.net (CloudFront)
x-amz-cf-pop: MUC50-C1
age: 1387069
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: PENDING
alt-svc: h3=":443"; ma=86400
last-modified: Tue, 26 Mar 2024 18:47:16 GMT
server: CloudFront
etag: W/"1896bb46164a29f71136ee683583cd91"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
cache-control: max-age=300
x-amz-cf-id: NbT6xxofK5CBI3gvSXeAxQC-4ZzUrINB0lzncVNrdqs3gaSntSXFMg==

GET
H2 200 /
citi.bridgetrack.com/track/ 43 B
551 B 245ms
156ms Image
image/gif 35.190.22.40
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://citi.bridgetrack.com/track/?id=67181&random=2.92160480559271E+17
Requested by: Host: banking.citi.com
URL: https://banking.citi.com/cbol/investment/cpwm/default.htm?BT_TX=1&ProspectID=455F85F6E72647FBA011AEE59AEF2397
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.190.22.40 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 40.22.190.35.bc.googleusercontent.com
Software: /
Resource Hash: 63b98a0c8568c08fd01a6946a147bca65eff26c8085f1ccb5330aafe0f0dcd15

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://banking.citi.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

pragma: no-cache
date: Thu, 11 Apr 2024 20:05:25 GMT
via: 1.1 google
content-type: image/GIF
p3p: CP="NON DSP COR DEVa PSAa IVAo CONo OUR IND UNI PUR NAV DEM LOC", policyref="http://citi.bridgetrack.com/w3c/p3p.xml"
cache-control: private
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
expires: Wed, 10 Apr 2024 20:05:25 GMT

GET
H3 200 main.74b88a8e74f2195ab579.bundle.js Show response
banking.citi.com/cbol/investment/cpwm/js/ 107 KB
45 KB 162ms
162ms Script
application/javascript 35.190.22.40
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://banking.citi.com/cbol/investment/cpwm/js/main.74b88a8e74f2195ab579.bundle.js

Requested by

Host: banking.citi.com
URL: https://banking.citi.com/cbol/investment/cpwm/default.htm?BT_TX=1&ProspectID=455F85F6E72647FBA011AEE59AEF2397

Protocol

Security

QUIC, , AES_128_GCM

Server

35.190.22.40 Kansas City, United States, ASN15169 (GOOGLE, US),

Reverse DNS

40.22.190.35.bc.googleusercontent.com

Software

Resource Hash

741e9b5e3fe4d03e50d4025abf4ce86250728f885d002d8ccbb3b1e471e15646

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.bridgetrack.com; report-uri https://csp-reporter-ui3464xpjq-uc.a.run.app/api/csp-report/?env=prod
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://banking.citi.com/cbol/investment/cpwm/default.htm?BT_TX=1&ProspectID=455F85F6E72647FBA011AEE59AEF2397
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 11 Apr 2024 20:05:25 GMT
content-encoding: gzip
via: 1.1 google
content-security-policy: frame-ancestors https://*.citi.com https://*.bridgetrack.com; report-uri https://csp-reporter-ui3464xpjq-uc.a.run.app/api/csp-report/?env=prod
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 46523
x-xss-protection: 1; mode=block
referrer-policy: strict-origin-when-cross-origin
last-modified: Fri, 22 Mar 2024 21:04:25 GMT
etag: "80d2f859c7cda1:0"
vary: Accept-Encoding
content-type: application/javascript
permissions-policy: fullscreen=(self "https://*.citi.com" "https://*.bridgetrack.com" "https://www.youtube.com" "https://cdn.digitalmarketing.citibankonline.com"), geolocation=(self "https://*.citi.com" "https://*.bridgetrack.com"), camera=()
accept-ranges: bytes

GET
H2 200 banking.citi.com.json Show response
script.crazyegg.com/pages/data-scripts/0090/1567/site/ 8 KB
2 KB 155ms
70ms XHR
application/json 2606:4700::6813:9408
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://script.crazyegg.com/pages/data-scripts/0090/1567/site/banking.citi.com.json?t=1
Requested by: Host: script.crazyegg.com
URL: https://script.crazyegg.com/pages/scripts/0090/1567.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6813:9408 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: d7526f723abdddfdd587906749e14840864a3168aef6434436e0529e0667fa37

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://banking.citi.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 11 Apr 2024 20:05:25 GMT
content-encoding: gzip
cf-cache-status: HIT
age: 232056
ce-version: 11.5.202
content-length: 2049
last-modified: Tue, 09 Apr 2024 03:37:49 GMT
server: cloudflare
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: *
access-control-expose-headers: CE-Version
cache-control: public, max-age=300, s-maxage=1209600
accept-ranges: bytes
timing-allow-origin: *
cf-ray: 872d97636ced37eb-FRA

GET
H2 200 cc Show response
tagmanager1.citi.com/pc/citi/ 21 B
397 B 249ms
148ms XHR
application/json 3.124.119.57
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tagmanager1.citi.com/pc/citi/cc?ensDisableTracking=user&output=ip
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 3.124.119.57 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-124-119-57.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 1d355a2635cf91a471018aa8dd3f11475641f3830b3d4afa7d103d0881b06581

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://banking.citi.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

pragma: no-cache
date: Thu, 11 Apr 2024 20:05:26 GMT
content-encoding: gzip
server: nginx
vary: Accept-Encoding
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS
content-type: application/json;charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: *
cache-control: no-cache, no-store, must-revalidate
x-ens-event-id: f34b41c6-c5ff-466a-874e-dbc5e63571e1
access-control-allow-headers: *
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2 200 83450500e6cddbe403b69c5b65e8ac92e627e9587d48f611f606b45c4f021867 Show response
tagmanager1.citi.com/one/v1/profiles/ 2 B
216 B 88ms
88ms XHR
application/json 3.124.119.57
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tagmanager1.citi.com/one/v1/profiles/83450500e6cddbe403b69c5b65e8ac92e627e9587d48f611f606b45c4f021867
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 3.124.119.57 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-124-119-57.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://banking.citi.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 11 Apr 2024 20:05:26 GMT
server: nginx
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS
content-type: application/json
access-control-allow-origin: *
access-control-expose-headers: *
access-control-allow-headers: *
content-length: 2
apigw-requestid: WE9U_iUXliAEKCw=

GET
H2 200 83450500e6cddbe403b69c5b65e8ac92e627e9587d48f611f606b45c4f021867 Show response
tagmanager1.citi.com/one/v1/profiles/ 2 B
216 B 62ms
61ms XHR
application/json 3.124.119.57
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tagmanager1.citi.com/one/v1/profiles/83450500e6cddbe403b69c5b65e8ac92e627e9587d48f611f606b45c4f021867
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 3.124.119.57 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-124-119-57.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://banking.citi.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 11 Apr 2024 20:05:26 GMT
server: nginx
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS
content-type: application/json
access-control-allow-origin: *
access-control-expose-headers: *
access-control-allow-headers: *
content-length: 2
apigw-requestid: WE9VAipeFiAEJkg=

GET
H2

200

rd Show response
dpm.demdex.net/id/
Redirect Chain

https://dpm.demdex.net/id?d_visid_ver=4.4.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=61834D9B5228A7430A490D45%40AdobeOrg&d_nsid=0&ts=1712865926142
https://dpm.demdex.net/id/rd?d_visid_ver=4.4.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=61834D9B5228A7430A490D45%40AdobeOrg&d_nsid=0&ts=1712865926142

363 B
909 B

58ms
58ms

XHR
application/json

63.34.203.75
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://dpm.demdex.net/id/rd?d_visid_ver=4.4.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=61834D9B5228A7430A490D45%40AdobeOrg&d_nsid=0&ts=1712865926142

Requested by

Host: banking.citi.com
URL: https://banking.citi.com/cbol/investment/cpwm/default.htm?BT_TX=1&ProspectID=455F85F6E72647FBA011AEE59AEF2397

Protocol

Server

63.34.203.75 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-63-34-203-75.eu-west-1.compute.amazonaws.com

Software

Resource Hash

f0fabaafede0bd57afc5b649c210ef345620e2a871be626a8d232e1eebaf6e98

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9;q=0.9
Referer: https://banking.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36

Response headers

dcs: dcs-prod-irl1-2-v060-0c81fd8de.edge-irl1.demdex.com 2 ms
pragma: no-cache
date: Thu, 11 Apr 2024 20:05:26 GMT
strict-transport-security: max-age=31536000; includeSubDomains
content-encoding: gzip
x-tid: fbMHIA6yQRY=
vary: Origin
content-type: application/json;charset=utf-8
p3p: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
access-control-allow-origin: https://banking.citi.com
cache-control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
access-control-allow-credentials: true
content-length: 306
expires: Thu, 01 Jan 1970 00:00:00 UTC

Redirect headers

dcs: dcs-prod-irl1-2-v060-06084f813.edge-irl1.demdex.com 0 ms
pragma: no-cache
date: Thu, 11 Apr 2024 20:05:26 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-tid: 7+ghfgfgS08=
vary: Origin
p3p: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
location: https://dpm.demdex.net/id/rd?d_visid_ver=4.4.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=61834D9B5228A7430A490D45%40AdobeOrg&d_nsid=0&ts=1712865926142
access-control-allow-origin: https://banking.citi.com
cache-control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
access-control-allow-credentials: true
content-length: 0
expires: Thu, 01 Jan 1970 00:00:00 UTC

GET
H2 200 6735f9594d6bb8a4f1fe56c6b3e21cf5.js Show response
script.crazyegg.com/pages/versioned/common-scripts/ 94 KB
31 KB 53ms
53ms Script
text/javascript 2606:4700::6813:9408
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://script.crazyegg.com/pages/versioned/common-scripts/6735f9594d6bb8a4f1fe56c6b3e21cf5.js
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6813:9408 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: d69e3303757e223cc0fd92ec05e7f0eb6ca17c61c857cf273f19d181ad2afd47

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://banking.citi.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 11 Apr 2024 20:05:26 GMT
content-encoding: gzip
cf-cache-status: HIT
last-modified: Tue, 02 Apr 2024 14:46:52 GMT
server: cloudflare
age: 291905
vary: Accept-Encoding
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000, s-maxage=31536000
accept-ranges: bytes
timing-allow-origin: *
cf-ray: 872d97669a9d71d0-FRA
content-length: 31374

GET
H2 200 serverComponent.php Show response
nexus.ensighten.com/citi/na_prod/ 2 KB
1 KB 69ms
68ms Script
text/javascript 2600:9000:20c3:6000:2:8f43:5780:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://nexus.ensighten.com/citi/na_prod/serverComponent.php?namespace=Bootstrapper&staticJsPath=nexus.ensighten.com/citi/na_prod/code/&publishedOn=Tue%20Mar%2026%2018:47:13%20GMT%202024&ClientID=1129&PageID=https%3A%2F%2Fbanking.citi.com%2Fcbol%2Finvestment%2Fcpwm%2Fdefault.htm%3FBT_TX%3D1%26ProspectID%3D455F85F6E72647FBA011AEE59AEF2397
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:20c3:6000:2:8f43:5780:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: CloudFront /
Resource Hash: 523c29d48b0179cd38f1508a965d3145b200653a18f856696cf7c10c9143ac95

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://banking.citi.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 11 Apr 2024 20:05:26 GMT
content-encoding: gzip
via: 1.1 c4c822c878c22be90d0bb70ab49a395a.cloudfront.net (CloudFront)
server: CloudFront
x-amz-cf-pop: MUC50-C1
vary: Accept-Encoding
x-cache: Miss from cloudfront
content-type: text/javascript
cache-control: no-cache, no-store
alt-svc: h3=":443"; ma=86400
x-amz-cf-id: 3YdoN3SjTaHbNr_5-x2_KZbEJqvf4LzTRyXXQyCOpPrO0iz5zeiRZw==
expires: Thu, 11 Apr 2024 20:05:25 GMT

GET
H3 200 633.3c832a2c9ead4e03be41.bundle.js Show response
banking.citi.com/cbol/investment/cpwm/js/ 16 KB
7 KB 146ms
146ms Script
application/javascript 35.190.22.40
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://banking.citi.com/cbol/investment/cpwm/js/633.3c832a2c9ead4e03be41.bundle.js

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

Security

QUIC, , AES_128_GCM

Server

35.190.22.40 Kansas City, United States, ASN15169 (GOOGLE, US),

Reverse DNS

40.22.190.35.bc.googleusercontent.com

Software

Resource Hash

55d5eb3da583f30d615bb79e23312cba96514a500dc0e3770d941ea6dec74135

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.bridgetrack.com; report-uri https://csp-reporter-ui3464xpjq-uc.a.run.app/api/csp-report/?env=prod
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://banking.citi.com/cbol/investment/cpwm/default.htm?BT_TX=1&ProspectID=455F85F6E72647FBA011AEE59AEF2397
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 11 Apr 2024 20:05:25 GMT
content-encoding: gzip
via: 1.1 google
content-security-policy: frame-ancestors https://*.citi.com https://*.bridgetrack.com; report-uri https://csp-reporter-ui3464xpjq-uc.a.run.app/api/csp-report/?env=prod
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 6777
x-xss-protection: 1; mode=block
referrer-policy: strict-origin-when-cross-origin
last-modified: Thu, 29 Feb 2024 19:09:15 GMT
etag: "80ff4ac9426bda1:0"
vary: Accept-Encoding
content-type: application/javascript
permissions-policy: fullscreen=(self "https://*.citi.com" "https://*.bridgetrack.com" "https://www.youtube.com" "https://cdn.digitalmarketing.citibankonline.com"), geolocation=(self "https://*.citi.com" "https://*.bridgetrack.com"), camera=()
accept-ranges: bytes

GET
H3 200 300.00a0fa644ca1ed0bbbac.bundle.js Show response
banking.citi.com/cbol/investment/cpwm/js/ 24 KB
8 KB 150ms
150ms Script
application/javascript 35.190.22.40
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://banking.citi.com/cbol/investment/cpwm/js/300.00a0fa644ca1ed0bbbac.bundle.js

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

Security

QUIC, , AES_128_GCM

Server

35.190.22.40 Kansas City, United States, ASN15169 (GOOGLE, US),

Reverse DNS

40.22.190.35.bc.googleusercontent.com

Software

Resource Hash

3a7a0cd3684464728510590f32a4ef7c515b42b4989c72d1fd7bc74bb91dc96a

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.bridgetrack.com; report-uri https://csp-reporter-ui3464xpjq-uc.a.run.app/api/csp-report/?env=prod
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://banking.citi.com/cbol/investment/cpwm/default.htm?BT_TX=1&ProspectID=455F85F6E72647FBA011AEE59AEF2397
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 11 Apr 2024 20:05:25 GMT
content-encoding: gzip
via: 1.1 google
content-security-policy: frame-ancestors https://*.citi.com https://*.bridgetrack.com; report-uri https://csp-reporter-ui3464xpjq-uc.a.run.app/api/csp-report/?env=prod
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 8558
x-xss-protection: 1; mode=block
referrer-policy: strict-origin-when-cross-origin
last-modified: Fri, 22 Mar 2024 21:04:25 GMT
etag: "80d2f859c7cda1:0"
vary: Accept-Encoding
content-type: application/javascript
permissions-policy: fullscreen=(self "https://*.citi.com" "https://*.bridgetrack.com" "https://www.youtube.com" "https://cdn.digitalmarketing.citibankonline.com"), geolocation=(self "https://*.citi.com" "https://*.bridgetrack.com"), camera=()
accept-ranges: bytes

GET
H2 204 r.rnc
data.privacy.ensighten.com/privacy/v1/b/ 0
107 B 137ms
45ms Image
text/plain 3.124.119.57
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://data.privacy.ensighten.com/privacy/v1/b/r.rnc?n=0&c=1129&i=5r0cn4&p=na_prod&s=335&d=8HB7InZlcnNpb24iOiIxLjAuMCIsImdhdGV3YXkiOiIyLjMuNjExIiwiY2xpZW50SWQiOjExMjksInB1Ymxpc2hQYXRoIjoibmFfcHJvZCIsImluc3RhbmNlSWQiOiI1cjBjbjQiLCJwYWNrZXQiOjAsIm1vZGUiOiJlbmZvcmNlWgDxMG9va2llcyI6e30sImVudmlyb25tZW50IjoiQ0JPTCBQcml2YWN5IiwicmVxdWVzdHMiOlt7ImRlc3RpbmF0absA8BkiLCJ0eXBlIjoiYmlsbGluZyIsInN0YXJ0IjoxNzEyODY1OTI2MTc4YgDAZCI6LTEsInNvdXJjMgACKwBhdHVzIjoiZgBAYXNvbmUA1F0sImRhdGFQYXR0ZXISALBsaXN0IjpbXSwiaQ0B8AA3MTI4NjU5MjYxNzh9XX0
Requested by: Host: banking.citi.com
URL: https://banking.citi.com/cbol/investment/cpwm/default.htm?BT_TX=1&ProspectID=455F85F6E72647FBA011AEE59AEF2397
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 3.124.119.57 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-124-119-57.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://banking.citi.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 11 Apr 2024 20:05:26 GMT
cache-control: no-cache, no-store
server: nginx
expires: Thu, 11 Apr 2024 20:05:25 GMT

GET
H2 204 r.rnc
data.privacy.ensighten.com/privacy/v1/c/ 0
106 B 137ms
46ms Image
text/plain 3.124.119.57
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://data.privacy.ensighten.com/privacy/v1/c/r.rnc?n=0&c=1129&i=7fiu4y&p=na_prod&s=445&d=9Cd7InZlcnNpb24iOiIxLjAuMCIsImdhdGV3YXkiOiIyLjMuNjExIiwiY2xpZW50SWQiOjExMjkQAPAaTmFtZSI6ImNpdGkiLCJwdWJsaXNoUGF0aCI6Im5hX3Byb2QiLCJtb2QmAJBibGFja2xpc3RPAPAfb29raWVzIjp7IkNJVElfRU5TSUdIVEVOX1BSSVZBQ1lfQkFOTkVSX0xPQURFRJ0A8Q8ifSwiZHQiOjE3MTI4NjU5MjYxODEsInNldHRpbmdLAPEqbW9kYWwiOiJlbnRlcnByaXNlIiwiZW52aXJvbm1lbnQiOiJDQk9MIFByaXZhY3kiLCJkZWZhdWx0PgD0CFBlcmZvcm1hbmNlLUFuYWx5dGljcyBDqgD5CDEsIkVzc2VudGlhbC1GdW5jdGlvbmFsIQDwAkFkdmVydGlzaW5nLVRhcmdlmwAHIgCAfX0sImV2ZW5xACJbewsAAEABAWQAYENoYW5nZTEBD-cAAAUPAcBBREVEIjoiMSJ9XX0
Requested by: Host: banking.citi.com
URL: https://banking.citi.com/cbol/investment/cpwm/default.htm?BT_TX=1&ProspectID=455F85F6E72647FBA011AEE59AEF2397
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 3.124.119.57 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-124-119-57.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://banking.citi.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 11 Apr 2024 20:05:26 GMT
cache-control: no-cache, no-store
server: nginx
expires: Thu, 11 Apr 2024 20:05:25 GMT

OPTIONS
H2 204 83450500e6cddbe403b69c5b65e8ac92e627e9587d48f611f606b45c4f021867
tagmanager1.citi.com/one/v1/profiles/ Frame 0
0 49ms
49ms Preflight
text/plain 3.124.119.57
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tagmanager1.citi.com/one/v1/profiles/83450500e6cddbe403b69c5b65e8ac92e627e9587d48f611f606b45c4f021867?returnValues=ALL_NEW
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 3.124.119.57 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-124-119-57.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Method: PUT
Origin: https://banking.citi.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36

Response headers

access-control-allow-headers: *
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS
access-control-allow-origin: *
access-control-max-age: 1728000
content-length: 0
content-type: text/plain; charset=utf-8
date: Thu, 11 Apr 2024 20:05:26 GMT
server: nginx

PUT
H2 201 83450500e6cddbe403b69c5b65e8ac92e627e9587d48f611f606b45c4f021867 Show response
tagmanager1.citi.com/one/v1/profiles/ 1010 B
1 KB 117ms
117ms XHR
application/json 3.124.119.57
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tagmanager1.citi.com/one/v1/profiles/83450500e6cddbe403b69c5b65e8ac92e627e9587d48f611f606b45c4f021867?returnValues=ALL_NEW
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 3.124.119.57 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-124-119-57.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 5002685df95297e193278218f50268795903f8ca608f6d93cae028ba11dc2ec2

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
sec-ch-ua-platform: "Win32"
Referer: https://banking.citi.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

date: Thu, 11 Apr 2024 20:05:26 GMT
server: nginx
x-ens-one-is-anonymous: true
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS
content-type: application/json
access-control-allow-origin: *
access-control-expose-headers: *
access-control-allow-headers: *
content-length: 1010
x-ens-one-ttl: 1720641926
apigw-requestid: WE9VBjxOFiAEJfQ=

GET
H2 200 banking.citi.com.json Show response
script.crazyegg.com/pages/data-scripts/0090/1567/sampling/ Frame B2CF 154 B
262 B 52ms
52ms XHR
application/json 2606:4700::6813:9408
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://script.crazyegg.com/pages/data-scripts/0090/1567/sampling/banking.citi.com.json?t=475796
Requested by: Host: script.crazyegg.com
URL: https://script.crazyegg.com/pages/versioned/common-scripts/6735f9594d6bb8a4f1fe56c6b3e21cf5.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6813:9408 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 6d2d020c9dd6cd75eab4da4f73978a55ff1ae0b5dfe37fb59f13ec5abd31891a

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 11 Apr 2024 20:05:26 GMT
content-encoding: gzip
cf-cache-status: HIT
age: 62582
ce-version: 11.5.202
content-length: 146
last-modified: Thu, 11 Apr 2024 02:42:24 GMT
server: cloudflare
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: *
access-control-expose-headers: CE-Version
cache-control: public, max-age=300, s-maxage=1209600
accept-ranges: bytes
timing-allow-origin: *
cf-ray: 872d9766f96e37eb-FRA

GET
H3 200 93935a4096516447172d9d3f1d23710d.js Show response
nexus.ensighten.com/citi/na_prod/code/ 1 KB
913 B 43ms
43ms Script
application/javascript 99.84.88.39
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://nexus.ensighten.com/citi/na_prod/code/93935a4096516447172d9d3f1d23710d.js?conditionId0=433072
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 99.84.88.39 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-84-88-39.muc50.r.cloudfront.net
Software: CloudFront /
Resource Hash: f071110e088267097a0946520a2a08bd589f971f3ce4cb989feda1415026ac49

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://banking.citi.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Sun, 17 Dec 2023 01:21:22 GMT
x-amz-version-id: .9Yu1fA6u9LpETfeDT0_cOHllcbsIoL2
content-encoding: br
via: 1.1 37e2872b8b14122ba8fe3a34c3bb506a.cloudfront.net (CloudFront)
age: 10089845
x-amz-cf-pop: MUC50-C1
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
alt-svc: h3=":443"; ma=86400
last-modified: Tue, 20 Jul 2021 20:01:11 GMT
server: CloudFront
etag: W/"22035994ea9f0b167d391afd37705f26"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
cache-control: max-age=315360000
x-amz-cf-id: -ma3p1efotba3BHVz0WBf5UWk8RdNpJwHUXcradGtibnHvMXdNvGmw==

GET
H3 200 7c8ae1f9c206930028672949c6703f6d.js Show response
nexus.ensighten.com/citi/na_prod/code/ 2 KB
2 KB 44ms
44ms Script
application/javascript 99.84.88.39
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://nexus.ensighten.com/citi/na_prod/code/7c8ae1f9c206930028672949c6703f6d.js?conditionId0=4849963
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 99.84.88.39 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-84-88-39.muc50.r.cloudfront.net
Software: CloudFront /
Resource Hash: 9a74546a8f511f31b5252f115d2db7aa69370ca5eeaf6828f60abb197f35a169

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://banking.citi.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Fri, 15 Dec 2023 00:56:42 GMT
x-amz-version-id: fn0OQIG24n9jjHSfN2OozphT08M6eW_x
content-encoding: gzip
via: 1.1 37e2872b8b14122ba8fe3a34c3bb506a.cloudfront.net (CloudFront)
age: 10264125
x-amz-cf-pop: MUC50-C1
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
alt-svc: h3=":443"; ma=86400
last-modified: Tue, 18 Oct 2022 17:52:59 GMT
server: CloudFront
etag: W/"7df0440e45009010a99db868682aafb3"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
cache-control: max-age=315360000
x-amz-cf-id: wRj1QtUpvypkpJuDl0R89H0dBCpeTau3VmktbSiTqaoozqK_fhXmKQ==

GET
H3 200 f0db1cf4496c8b42c5a1b2fa40b4f157.js Show response
nexus.ensighten.com/citi/na_prod/code/ 5 KB
2 KB 44ms
44ms Script
application/javascript 99.84.88.39
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://nexus.ensighten.com/citi/na_prod/code/f0db1cf4496c8b42c5a1b2fa40b4f157.js?conditionId0=4897099
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 99.84.88.39 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-84-88-39.muc50.r.cloudfront.net
Software: CloudFront /
Resource Hash: 13a59cfac1785dd94d0005457ed1e12cf77fee65b975fe6fd91af77b7ac6cd77

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://banking.citi.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Sun, 17 Dec 2023 00:07:45 GMT
x-amz-version-id: _NJEt9Au7TfYHRltPN9x_4PZSTxTzbkJ
content-encoding: br
via: 1.1 37e2872b8b14122ba8fe3a34c3bb506a.cloudfront.net (CloudFront)
age: 10094262
x-amz-cf-pop: MUC50-C1
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
alt-svc: h3=":443"; ma=86400
last-modified: Wed, 02 Aug 2023 16:06:47 GMT
server: CloudFront
etag: W/"f21df27f4d3e67ca5151a737dacd6837"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
cache-control: max-age=315360000
x-amz-cf-id: d5WF0xOHk84gRQFpuROSLV7lkFSQ-dTgghdRswdTFiQ2B3ki4AYicQ==

GET
H3 200 c65a3609e1beed72955b88afac8cd31d.js Show response
nexus.ensighten.com/citi/na_prod/code/ 2 KB
1 KB 42ms
41ms Script
application/javascript 99.84.88.39
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://nexus.ensighten.com/citi/na_prod/code/c65a3609e1beed72955b88afac8cd31d.js?conditionId0=480881
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 99.84.88.39 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-84-88-39.muc50.r.cloudfront.net
Software: CloudFront /
Resource Hash: 686eb5d7c927dd741ef72adda5c719b478d36f1e29520ee16d5121854c174b10

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://banking.citi.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Mon, 22 Jan 2024 12:00:16 GMT
x-amz-version-id: wXRQEmBG4QJsg2TZDdHUFOaVLJIZHKhf
content-encoding: br
via: 1.1 37e2872b8b14122ba8fe3a34c3bb506a.cloudfront.net (CloudFront)
age: 6941110
x-amz-cf-pop: MUC50-C1
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
alt-svc: h3=":443"; ma=86400
last-modified: Thu, 15 Dec 2022 04:55:25 GMT
server: CloudFront
etag: W/"e9bda8e342fda2a02ffa59c9064942d8"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
cache-control: max-age=315360000
x-amz-cf-id: aW1Ob2Da_jpeyhT_vfqqEcaJJXlthygrS0Ef8v-oSy2N988s7BFIjA==

GET
H3 200 8aa4b673eb520bf3b50c186c94a14d69.js Show response
nexus.ensighten.com/citi/na_prod/code/ 428 KB
45 KB 45ms
44ms Script
application/javascript 99.84.88.39
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://nexus.ensighten.com/citi/na_prod/code/8aa4b673eb520bf3b50c186c94a14d69.js?conditionId0=421908
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 99.84.88.39 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-84-88-39.muc50.r.cloudfront.net
Software: CloudFront /
Resource Hash: ef90c0d5f242aee0c3fe7654ac74a9403dcdee295488f9b57d645da9447efd14

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://banking.citi.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 20 Mar 2024 21:07:53 GMT
x-amz-version-id: DHYzBYzYJ.7SlhvXhUh.DO9xoK9mEGfC
content-encoding: br
via: 1.1 37e2872b8b14122ba8fe3a34c3bb506a.cloudfront.net (CloudFront)
age: 1897054
x-amz-cf-pop: MUC50-C1
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: PENDING
alt-svc: h3=":443"; ma=86400
last-modified: Wed, 20 Mar 2024 21:07:45 GMT
server: CloudFront
etag: W/"b2404de25dca8d98b657809b62bf0529"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
cache-control: max-age=315360000
x-amz-cf-id: 79PTBMYz-2YF52nhE0ngPenjhKZchnkyVqN6QcBTwt1-9vMdgEj9Dw==

GET
H3 200 a9607bbeb2e6e06c07801d4745900799.js Show response
nexus.ensighten.com/citi/na_prod/code/ 23 KB
5 KB 47ms
45ms Script
application/javascript 99.84.88.39
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://nexus.ensighten.com/citi/na_prod/code/a9607bbeb2e6e06c07801d4745900799.js?conditionId0=486757
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 99.84.88.39 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-84-88-39.muc50.r.cloudfront.net
Software: CloudFront /
Resource Hash: 3556b4fa28a41290454dc84939dae439fcf5bda8a1eac70efdf2647bf041d43d

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://banking.citi.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Fri, 15 Dec 2023 01:09:37 GMT
x-amz-version-id: TUtp2N9e.3Mq3kFsEinWRYvNz9Zemh3C
content-encoding: gzip
via: 1.1 37e2872b8b14122ba8fe3a34c3bb506a.cloudfront.net (CloudFront)
age: 10263350
x-amz-cf-pop: MUC50-C1
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
alt-svc: h3=":443"; ma=86400
last-modified: Tue, 19 Sep 2023 17:48:03 GMT
server: CloudFront
etag: W/"e4e9e801aca9bba5a66c95552720097c"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
cache-control: max-age=315360000
x-amz-cf-id: vOvQVKeZS-oTg35gw48-lDrEGs2bsl-0Ddpb-K4DZAQRy_eQdX60Jg==

GET
H3 200 42f4b87285e54fd11d3f42fa901b9761.js Show response
nexus.ensighten.com/citi/na_prod/code/ 4 KB
2 KB 47ms
45ms Script
application/javascript 99.84.88.39
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://nexus.ensighten.com/citi/na_prod/code/42f4b87285e54fd11d3f42fa901b9761.js?conditionId0=4926730
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 99.84.88.39 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-84-88-39.muc50.r.cloudfront.net
Software: CloudFront /
Resource Hash: aa0b89a8518a91a7a991882b55591cec24fc87ba73c35016c8c6605f905a5b99

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://banking.citi.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 16 Jan 2024 07:33:13 GMT
x-amz-version-id: bSeFiH6XtE0w1jeAuamyG2xZTZq6eme6
content-encoding: br
via: 1.1 37e2872b8b14122ba8fe3a34c3bb506a.cloudfront.net (CloudFront)
age: 7475534
x-amz-cf-pop: MUC50-C1
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
alt-svc: h3=":443"; ma=86400
last-modified: Tue, 05 Dec 2023 21:30:23 GMT
server: CloudFront
etag: W/"38cd7f3eb8a165db14f77aa0044b3209"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
cache-control: max-age=315360000
x-amz-cf-id: Ye8kMt9PfDTMtkg3dvCWssyEc44re2bpqqZHSlrVE6cl681Fx2SrWw==

GET
H3 200 f120449dcdb84c3b6d0f58c8b98ad8a3.js Show response
nexus.ensighten.com/citi/na_prod/code/ 24 KB
6 KB 48ms
45ms Script
application/javascript 99.84.88.39
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://nexus.ensighten.com/citi/na_prod/code/f120449dcdb84c3b6d0f58c8b98ad8a3.js?conditionId0=467299
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 99.84.88.39 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-84-88-39.muc50.r.cloudfront.net
Software: CloudFront /
Resource Hash: bf39c7a23da56a09d7fba494ab7a46604dc02a19fabfaf8d4c3ab6629aad0692

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://banking.citi.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Sun, 17 Dec 2023 00:07:45 GMT
x-amz-version-id: nWKpv6NjQeNKdUj5cLa_yhYRraA7P2n3
content-encoding: br
via: 1.1 37e2872b8b14122ba8fe3a34c3bb506a.cloudfront.net (CloudFront)
age: 10094262
x-amz-cf-pop: MUC50-C1
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
alt-svc: h3=":443"; ma=86400
last-modified: Tue, 19 Sep 2023 17:48:03 GMT
server: CloudFront
etag: W/"79a1f615128893a73faf5e48cfd01107"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
cache-control: max-age=315360000
x-amz-cf-id: yRWi5MExt84JgGyjqLa78bDBybruFixVFpu-uMttW93GJs7yKOGEWQ==

GET
H3 200 501175129083d695b433d40e43dcf4dd.js Show response
nexus.ensighten.com/citi/na_prod/code/ 1 KB
972 B 50ms
47ms Script
application/javascript 99.84.88.39
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://nexus.ensighten.com/citi/na_prod/code/501175129083d695b433d40e43dcf4dd.js?conditionId0=4951300
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 99.84.88.39 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-84-88-39.muc50.r.cloudfront.net
Software: CloudFront /
Resource Hash: 7337d0aa06e2a7d2555a60936c9243f8f93c24dcd64e064d0181e6790294607b

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://banking.citi.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Mon, 22 Jan 2024 12:00:16 GMT
x-amz-version-id: LXNmF0WWctVwrG36aJ.jkMTI8bp3KIhL
content-encoding: br
via: 1.1 37e2872b8b14122ba8fe3a34c3bb506a.cloudfront.net (CloudFront)
age: 6941110
x-amz-cf-pop: MUC50-C1
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
alt-svc: h3=":443"; ma=86400
last-modified: Tue, 25 Jul 2023 19:27:55 GMT
server: CloudFront
etag: W/"4355ffb7776a87cb3f6308e895da7ddd"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
cache-control: max-age=315360000
x-amz-cf-id: AKLNCzFok9Wrjt0ir_fiIIcAnyHXbbrl0LhtvCOYKDTpm4LM5f8WAA==

GET
H3 200 e6b9fe1f920efcc9ea8e7e604b897c8c.js Show response
nexus.ensighten.com/citi/na_prod/code/ 321 B
737 B 49ms
47ms Script
application/javascript 99.84.88.39
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://nexus.ensighten.com/citi/na_prod/code/e6b9fe1f920efcc9ea8e7e604b897c8c.js?conditionId0=3013337
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 99.84.88.39 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-84-88-39.muc50.r.cloudfront.net
Software: CloudFront /
Resource Hash: 1c34a537ea8a62cb24c782a11aaf49c1cbd671e5d264d81c6732e2338e05d2af

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://banking.citi.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Sat, 30 Mar 2024 23:32:44 GMT
x-amz-version-id: vaBGtucfcpfHvM_CMxnO.fJKgerOHEtE
via: 1.1 37e2872b8b14122ba8fe3a34c3bb506a.cloudfront.net (CloudFront)
age: 1024363
x-amz-cf-pop: MUC50-C1
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
alt-svc: h3=":443"; ma=86400
content-length: 321
last-modified: Thu, 03 Aug 2023 21:05:53 GMT
server: CloudFront
etag: "31ca559990bbe8a9a1b2319b45c0f49b"
content-type: application/javascript; charset=utf-8
cache-control: max-age=315360000
accept-ranges: bytes
x-amz-cf-id: 8YYgDkQ-HywAK6udm-j_arOOEq56pW2xwn5uBcNjbNBXgEiQ2GVN3A==

GET
H3 200 7349fcb852dc064a78ef55e132b72441.js Show response
nexus.ensighten.com/citi/na_prod/code/ 340 B
756 B 50ms
48ms Script
application/javascript 99.84.88.39
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://nexus.ensighten.com/citi/na_prod/code/7349fcb852dc064a78ef55e132b72441.js?conditionId0=4906371
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 99.84.88.39 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-84-88-39.muc50.r.cloudfront.net
Software: CloudFront /
Resource Hash: ea9362709bbb4d2ac09a1b684fa0276e535b8b2a2809e27ad46c3def2dae1850

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://banking.citi.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Mon, 01 Apr 2024 09:27:56 GMT
x-amz-version-id: Su8ds1Rr4g_xlQQNcgVgERL8egfTi_hX
via: 1.1 37e2872b8b14122ba8fe3a34c3bb506a.cloudfront.net (CloudFront)
age: 902251
x-amz-cf-pop: MUC50-C1
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
alt-svc: h3=":443"; ma=86400
content-length: 340
last-modified: Wed, 08 Mar 2023 15:45:15 GMT
server: CloudFront
etag: "8990a8a1b012a959f263cdd1fac2ede3"
content-type: application/javascript; charset=utf-8
cache-control: max-age=315360000
accept-ranges: bytes
x-amz-cf-id: 5Zc5fiFjCzXXNfo-9VOfIs8aKzJxt7zmAox_KD-SyZlYbMp_ZSbjzw==

GET
H2 200 healthcheck Show response
pagestates-tracking.crazyegg.com/ Frame B2CF 19 B
462 B 137ms
39ms XHR
application/json 18.173.154.120
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://pagestates-tracking.crazyegg.com/healthcheck
Requested by: Host: script.crazyegg.com
URL: https://script.crazyegg.com/pages/versioned/common-scripts/6735f9594d6bb8a4f1fe56c6b3e21cf5.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.173.154.120 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-173-154-120.muc50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 830e67bda2532cd5880ee86e3b33e69721082f8458bb0df0cd4edbb1577fd375

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 20 Sep 2023 01:43:28 GMT
via: 1.1 3721bbb571fa1179150d81f8194461ae.cloudfront.net (CloudFront)
x-amz-cf-pop: MUC50-P3
age: 17691719
x-cache: Hit from cloudfront
content-length: 19
last-modified: Fri, 08 Jul 2022 22:25:51 GMT
server: AmazonS3
etag: "d06f04fccf68d0b228a5923187ce1afd"
access-control-max-age: 31536000
access-control-allow-methods: GET, HEAD
content-type: application/json
access-control-allow-origin: *
access-control-expose-headers: Access-Control-Allow-Origin
accept-ranges: bytes
x-amz-cf-id: myQPeHe_7s5UMYJgQz0rcBdfvd36KvMt34-YpKCfpOC6iqZbQvwcfg==

GET
H2 200 healthcheck Show response
assets-tracking.crazyegg.com/ Frame B2CF 19 B
461 B 139ms
39ms XHR
application/json 99.84.88.53
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://assets-tracking.crazyegg.com/healthcheck
Requested by: Host: script.crazyegg.com
URL: https://script.crazyegg.com/pages/versioned/common-scripts/6735f9594d6bb8a4f1fe56c6b3e21cf5.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 99.84.88.53 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-84-88-53.muc50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 830e67bda2532cd5880ee86e3b33e69721082f8458bb0df0cd4edbb1577fd375

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 20 Dec 2023 01:23:29 GMT
via: 1.1 04033844f25f5e47de102de77d8b5f4c.cloudfront.net (CloudFront)
x-amz-cf-pop: MUC50-C1
age: 9830518
x-cache: Hit from cloudfront
content-length: 19
last-modified: Fri, 08 Jul 2022 22:25:51 GMT
server: AmazonS3
etag: "d06f04fccf68d0b228a5923187ce1afd"
access-control-max-age: 31536000
access-control-allow-methods: GET, HEAD
content-type: application/json
access-control-allow-origin: *
access-control-expose-headers: Access-Control-Allow-Origin
accept-ranges: bytes
x-amz-cf-id: LNObbETaJJpowGRwMgYBuceEpco1VNSbygI0yVgbTEhV9jydR9LddA==

GET
BLOB 200
OK 27e413f9-a6b0-4c94-9a95-2182879d5645
https://banking.citi.com/ 45 B
0 Other
text/javascript

General

Check archive.org

Show headers Download Go to

Full URL: blob:https://banking.citi.com/27e413f9-a6b0-4c94-9a95-2182879d5645
Requested by: Host: banking.citi.com
URL: https://banking.citi.com/cbol/investment/cpwm/default.htm?BT_TX=1&ProspectID=455F85F6E72647FBA011AEE59AEF2397
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 86551808dbfbf8bc9b23ab3d0725794c2e1f2b4265c96715f2945638160edc2b

Request headers

Accept-Language: de-DE,de;q=0.9;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36

Response headers

Content-Length: 45
Content-Type: text/javascript

GET
H2 200 tc.min.js Show response
c1.rfihub.net/js/ 19 KB
6 KB 159ms
42ms Script
application/x-javascript 2600:9000:20c3:2a00:1:76cf:fe80:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c1.rfihub.net/js/tc.min.js
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:20c3:2a00:1:76cf:fe80:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: Jetty(9.4.51.v20230217) /
Resource Hash: 7ef97b12890fc6fee67f869c6e1f74b6719de7d66ac0d649c8d7386a80b4c30f

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://banking.citi.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 11 Apr 2024 19:35:22 GMT
content-encoding: gzip
via: 1.1 f4d15e906467f56692c7fc70be861e04.cloudfront.net (CloudFront)
last-modified: Thu, 11 Apr 2024 19:35:12 GMT
server: Jetty(9.4.51.v20230217)
x-amz-cf-pop: MUC50-C1
age: 1804
x-cache: Hit from cloudfront
content-type: application/x-javascript
p3p: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
cache-control: public, max-age=3600
content-length: 6162
x-amz-cf-id: ZQzXdcdwqfelw5J1KaV65mc5QXIhgza450SerRgt_L0UX7aCx8RH6A==
expires: Thu, 11 Apr 2024 20:35:22 GMT

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 204 KB
74 KB 154ms
61ms Script
application/javascript 2a00:1450:4001:81d::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=DC-6260004

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81d::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

b1b7bd1a5781769bb0518d0d8de10f146605ea94a1c1af8f0353492ae74f3e52

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://banking.citi.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 11 Apr 2024 20:05:26 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 75223
x-xss-protection: 0
last-modified: Thu, 11 Apr 2024 19:10:04 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Thu, 11 Apr 2024 20:05:26 GMT

GET
H2 200 detector-dom.min.js Show response
cdn.gbqofs.com/citi-na-prod/p/ 494 KB
149 KB 152ms
59ms Script
application/javascript 2606:4700::6812:180d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.gbqofs.com/citi-na-prod/p/detector-dom.min.js
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:180d , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 34dcba6a6c195a0ffbfd6027fe8420fc70943c5d3fb15b7c626f2c60f1a98911

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://banking.citi.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 11 Apr 2024 20:05:26 GMT
x-amz-version-id: cUDUo_WNS0HkQEZe3fNf7kVk2yNbsaQl
content-encoding: gzip
cf-cache-status: HIT
via: 1.1 13140684c599ca32163cf7ec1871cebc.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-C2
age: 6441
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
last-modified: Wed, 10 Apr 2024 16:41:56 GMT
server: cloudflare
etag: W/"4d5963a317083f27f0981852e9ef7a99"
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=14400
cf-ray: 872d97680fa73a8b-FRA
x-amz-cf-id: kFFygqLCmMBJEeqsgU1X33m2ax6y5jyqbAGAs72pt5apWaHH2Cfkhw==
expires: Fri, 12 Apr 2024 00:05:26 GMT

GET
H3 200 900.7b852447e1b156d36d28.bundle.js Show response
banking.citi.com/cbol/investment/cpwm/js/ 54 KB
18 KB 157ms
157ms Script
application/javascript 35.190.22.40
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://banking.citi.com/cbol/investment/cpwm/js/900.7b852447e1b156d36d28.bundle.js

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

Security

QUIC, , AES_128_GCM

Server

35.190.22.40 Kansas City, United States, ASN15169 (GOOGLE, US),

Reverse DNS

40.22.190.35.bc.googleusercontent.com

Software

Resource Hash

0d58dcf003d82f0e9e70a31a85524da3da4effbfd765576e5ef7d2b46776ad38

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.bridgetrack.com; report-uri https://csp-reporter-ui3464xpjq-uc.a.run.app/api/csp-report/?env=prod
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://banking.citi.com/cbol/investment/cpwm/default.htm?BT_TX=1&ProspectID=455F85F6E72647FBA011AEE59AEF2397
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 11 Apr 2024 20:05:25 GMT
content-encoding: gzip
via: 1.1 google
content-security-policy: frame-ancestors https://*.citi.com https://*.bridgetrack.com; report-uri https://csp-reporter-ui3464xpjq-uc.a.run.app/api/csp-report/?env=prod
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 18459
x-xss-protection: 1; mode=block
referrer-policy: strict-origin-when-cross-origin
last-modified: Thu, 29 Feb 2024 19:09:15 GMT
etag: "80ff4ac9426bda1:0"
vary: Accept-Encoding
content-type: application/javascript
permissions-policy: fullscreen=(self "https://*.citi.com" "https://*.bridgetrack.com" "https://www.youtube.com" "https://cdn.digitalmarketing.citibankonline.com"), geolocation=(self "https://*.citi.com" "https://*.bridgetrack.com"), camera=()
accept-ranges: bytes

GET
H3 200 253.247d8833ece7deee27a2.bundle.js Show response
banking.citi.com/cbol/investment/cpwm/js/ 115 KB
22 KB 165ms
165ms Script
application/javascript 35.190.22.40
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://banking.citi.com/cbol/investment/cpwm/js/253.247d8833ece7deee27a2.bundle.js

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

Security

QUIC, , AES_128_GCM

Server

35.190.22.40 Kansas City, United States, ASN15169 (GOOGLE, US),

Reverse DNS

40.22.190.35.bc.googleusercontent.com

Software

Resource Hash

49c5a65c0b9afc6e5de3edc3f0c3d07c4d2746e680c276a95ea567a79a81eed2

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.bridgetrack.com; report-uri https://csp-reporter-ui3464xpjq-uc.a.run.app/api/csp-report/?env=prod
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://banking.citi.com/cbol/investment/cpwm/default.htm?BT_TX=1&ProspectID=455F85F6E72647FBA011AEE59AEF2397
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 11 Apr 2024 20:05:25 GMT
content-encoding: gzip
via: 1.1 google
content-security-policy: frame-ancestors https://*.citi.com https://*.bridgetrack.com; report-uri https://csp-reporter-ui3464xpjq-uc.a.run.app/api/csp-report/?env=prod
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 22304
x-xss-protection: 1; mode=block
referrer-policy: strict-origin-when-cross-origin
last-modified: Thu, 29 Feb 2024 19:09:15 GMT
etag: "80ff4ac9426bda1:0"
vary: Accept-Encoding
content-type: application/javascript
permissions-policy: fullscreen=(self "https://*.citi.com" "https://*.bridgetrack.com" "https://www.youtube.com" "https://cdn.digitalmarketing.citibankonline.com"), geolocation=(self "https://*.citi.com" "https://*.bridgetrack.com"), camera=()
accept-ranges: bytes

GET dest5.html
citi.demdex.net/ Frame 9340 0
0

GET
H2 200 id Show response
metrics1.citi.com/ 48 B
461 B 188ms
54ms XHR
application/x-javascript 63.140.62.27
OMNITURE

General

Check archive.org

Show headers Download Go to

Full URL

https://metrics1.citi.com/id?d_visid_ver=4.4.0&d_fieldgroup=A&mcorgid=61834D9B5228A7430A490D45%40AdobeOrg&mid=12349810510954818803197568228951999682&ts=1712865926381

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

63.140.62.27 , United States, ASN15224 (OMNITURE, US),

Reverse DNS

ip-63-140-62-27.data.adobedc.net

Software

jag /

Resource Hash

dc1c1b20a82744db60084b47906b4aa1f414d0e99794fdb6777a85629fd038b4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
sec-ch-ua-platform: "Win32"
Referer: https://banking.citi.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

date: Thu, 11 Apr 2024 20:05:26 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
server: jag
vary: Origin
content-type: application/x-javascript;charset=utf-8
access-control-allow-origin: https://banking.citi.com
p3p: CP="This is not a P3P policy"
cache-control: no-cache, no-store, max-age=0, no-transform, private
access-control-allow-credentials: true
content-length: 48
x-xss-protection: 1; mode=block

GET
H2

200

ibs:dpid=411&dpuuid=ZhhChgAAAE_bYAO5
dpm.demdex.net/
Redirect Chain

https://cm.everesttech.net/cm/dd?d_uuid=17654313976704716112721178464925810017
https://dpm.demdex.net/ibs:dpid=411&dpuuid=ZhhChgAAAE_bYAO5

42 B
715 B

64ms
60ms

Image
image/gif

63.34.203.75
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dpm.demdex.net/ibs:dpid=411&dpuuid=ZhhChgAAAE_bYAO5

Requested by

Host: banking.citi.com
URL: https://banking.citi.com/cbol/investment/cpwm/default.htm?BT_TX=1&ProspectID=455F85F6E72647FBA011AEE59AEF2397

Protocol

Server

63.34.203.75 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-63-34-203-75.eu-west-1.compute.amazonaws.com

Software

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9;q=0.9
Referer: https://banking.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36

Response headers

dcs: dcs-prod-irl1-2-v060-0c57507fa.edge-irl1.demdex.com 2 ms
pragma: no-cache
date: Thu, 11 Apr 2024 20:05:26 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
content-encoding: gzip
x-tid: B1IZ2MXaR7E=
content-type: image/gif
p3p: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
cache-control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
content-length: 59
expires: Thu, 01 Jan 1970 00:00:00 UTC

Redirect headers

Location: https://dpm.demdex.net/ibs:dpid=411&dpuuid=ZhhChgAAAE_bYAO5
Date: Thu, 11 Apr 2024 20:05:26 GMT
Cache-Control: no-cache
Server: AMO-cookiemap/1.1
Connection: keep-alive
Content-Length: 0
P3P: CP="NOI NID DEVa PSAa PSDa OUR IND PUR COM NAV INT DEM"

GET
H2 200 clock Show response
tracking.crazyegg.com/ Frame B2CF 38 B
145 B 223ms
81ms XHR
text/plain 34.249.110.227
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tracking.crazyegg.com/clock?t=1712865926428&tk=3353697c62395c48c0b0030a6d85efcd&s=340498&p=%2Fcbol%2Finvestment%2Fcpwm%2Fdefault.htm&u=901567&v=6e7c0f79dfab29c70a415d19f01b2feb283a3378&f=banking.citi.com%2Fcbol%2Finvestment%2Fcpwm%2Fdefault.htm&ul=https%3A%2F%2Fbanking.citi.com%2Fcbol%2Finvestment%2Fcpwm%2Fdefault.htm%3FBT_TX%3D1%26ProspectID%3D455F85F6E72647FBA011AEE59AEF2397
Requested by: Host: script.crazyegg.com
URL: https://script.crazyegg.com/pages/versioned/common-scripts/6735f9594d6bb8a4f1fe56c6b3e21cf5.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.249.110.227 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-34-249-110-227.eu-west-1.compute.amazonaws.com
Software: awselb/2.0 /
Resource Hash: d9d779ad16edc985e253102848bca69a3d661f9678af58c3da469fc13ff52b3c

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

access-control-allow-origin: *
date: Thu, 11 Apr 2024 20:05:26 GMT
cache-control: no-store
server: awselb/2.0
content-length: 38
content-type: text/plain

GET
H2 200 83450500e6cddbe403b69c5b65e8ac92e627e9587d48f611f606b45c4f021867 Show response
tagmanager1.citi.com/one/v1/profiles/ 1010 B
784 B 93ms
93ms XHR
application/json 3.124.119.57
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tagmanager1.citi.com/one/v1/profiles/83450500e6cddbe403b69c5b65e8ac92e627e9587d48f611f606b45c4f021867
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 3.124.119.57 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-124-119-57.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 5002685df95297e193278218f50268795903f8ca608f6d93cae028ba11dc2ec2

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://banking.citi.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 11 Apr 2024 20:05:26 GMT
content-encoding: gzip
server: nginx
x-ens-one-is-anonymous: true
vary: Accept-Encoding
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS
content-type: application/json
access-control-allow-origin: *
access-control-expose-headers: *
access-control-allow-headers: *
x-ens-one-ttl: 1720641926
apigw-requestid: WE9VDilwliAEJ4w=

GET
H/1.1 200
OK ca.html
20766699p.rfihub.com/ Frame 66DF 0
0 222ms
49ms Document
text/html 193.0.160.130
ROCKETFUEL

General

Check archive.org

Show headers Download Go to

Full URL: https://20766699p.rfihub.com/ca.html?ver=9&ra=934&rb=648&ca=20766699&_o=17169175&_t=investmentcpwm&_rev=1&_pcode=1&_orderid=1&ssv_cuuid=&ssv_package=null&ssv_prodlist=null&ssv_pagename=investmentcpwm&pe=https%3A%2F%2Fbanking.citi.com%2Fcbol%2Finvestment%2Fcpwm%2Fdefault.htm%3FBT_TX%3D1%26ProspectID%3D455F85F6E72647FBA011AEE59AEF2397&pf=&ra=8858525936592563
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 193.0.160.130 , United States, ASN54312 (ROCKETFUEL, US),
Reverse DNS
Software: Jetty(9.4.51.v20230217) /
Resource Hash

Request headers

Accept-Language: de-DE,de;q=0.9;q=0.9
Referer: https://banking.citi.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Win32"

Response headers

Cache-Control: no-cache
Content-Length: 3027
Content-Type: text/html;charset=utf-8
Date: Thu, 11 Apr 2024 20:05:26 GMT
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Server: Jetty(9.4.51.v20230217)

GET
H3 200 hero-dsk.5f0d38595c4935a20982.png
banking.citi.com/cbol/investment/cpwm/images/ 249 KB
249 KB 197ms
173ms Image
image/png 35.190.22.40
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://banking.citi.com/cbol/investment/cpwm/images/hero-dsk.5f0d38595c4935a20982.png

Requested by

Host: banking.citi.com
URL: https://banking.citi.com/cbol/investment/cpwm/default.htm?BT_TX=1&ProspectID=455F85F6E72647FBA011AEE59AEF2397

Protocol

Security

QUIC, , AES_128_GCM

Server

35.190.22.40 Kansas City, United States, ASN15169 (GOOGLE, US),

Reverse DNS

40.22.190.35.bc.googleusercontent.com

Software

Resource Hash

eaa67e46f9e5da602af79451d714a9ef2db9c94812f48e643a7c57a12ac915a4

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.bridgetrack.com; report-uri https://csp-reporter-ui3464xpjq-uc.a.run.app/api/csp-report/?env=prod
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://banking.citi.com/cbol/investment/cpwm/default.htm?BT_TX=1&ProspectID=455F85F6E72647FBA011AEE59AEF2397
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 11 Apr 2024 20:05:26 GMT
via: 1.1 google
referrer-policy: strict-origin-when-cross-origin
content-security-policy: frame-ancestors https://*.citi.com https://*.bridgetrack.com; report-uri https://csp-reporter-ui3464xpjq-uc.a.run.app/api/csp-report/?env=prod
last-modified: Tue, 19 Dec 2023 06:03:16 GMT
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains
etag: "0aa98e4132da1:0"
content-type: image/png
permissions-policy: fullscreen=(self "https://*.citi.com" "https://*.bridgetrack.com" "https://www.youtube.com" "https://cdn.digitalmarketing.citibankonline.com"), geolocation=(self "https://*.citi.com" "https://*.bridgetrack.com"), camera=()
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 255035
x-xss-protection: 1; mode=block

GET
H3 200 title-dots-white.e700c57a62ca2f7817dd.svg
banking.citi.com/cbol/investment/cpwm/images/ 283 B
306 B 171ms
146ms Image
image/svg+xml 35.190.22.40
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://banking.citi.com/cbol/investment/cpwm/images/title-dots-white.e700c57a62ca2f7817dd.svg

Requested by

Host: banking.citi.com
URL: https://banking.citi.com/cbol/investment/cpwm/default.htm?BT_TX=1&ProspectID=455F85F6E72647FBA011AEE59AEF2397

Protocol

Security

QUIC, , AES_128_GCM

Server

35.190.22.40 Kansas City, United States, ASN15169 (GOOGLE, US),

Reverse DNS

40.22.190.35.bc.googleusercontent.com

Software

Resource Hash

fee3b9c632711d281142c495d3f6c405e63148580a68f4213184178c23f5598e

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.bridgetrack.com; report-uri https://csp-reporter-ui3464xpjq-uc.a.run.app/api/csp-report/?env=prod
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://banking.citi.com/cbol/investment/cpwm/default.htm?BT_TX=1&ProspectID=455F85F6E72647FBA011AEE59AEF2397
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 11 Apr 2024 20:05:26 GMT
via: 1.1 google
referrer-policy: strict-origin-when-cross-origin
content-security-policy: frame-ancestors https://*.citi.com https://*.bridgetrack.com; report-uri https://csp-reporter-ui3464xpjq-uc.a.run.app/api/csp-report/?env=prod
last-modified: Tue, 19 Dec 2023 06:03:16 GMT
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains
etag: "0aa98e4132da1:0"
content-type: image/svg+xml
access-control-allow-origin: *
permissions-policy: fullscreen=(self "https://*.citi.com" "https://*.bridgetrack.com" "https://www.youtube.com" "https://cdn.digitalmarketing.citibankonline.com"), geolocation=(self "https://*.citi.com" "https://*.bridgetrack.com"), camera=()
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 283
x-xss-protection: 1; mode=block

GET
H3 200 rtbs-dsk.6d1df87e73ca566ea7fa.png
banking.citi.com/cbol/investment/cpwm/images/ 210 KB
210 KB 171ms
147ms Image
image/png 35.190.22.40
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://banking.citi.com/cbol/investment/cpwm/images/rtbs-dsk.6d1df87e73ca566ea7fa.png

Requested by

Host: banking.citi.com
URL: https://banking.citi.com/cbol/investment/cpwm/default.htm?BT_TX=1&ProspectID=455F85F6E72647FBA011AEE59AEF2397

Protocol

Security

QUIC, , AES_128_GCM

Server

35.190.22.40 Kansas City, United States, ASN15169 (GOOGLE, US),

Reverse DNS

40.22.190.35.bc.googleusercontent.com

Software

Resource Hash

a374d49d2f2a50e86ac0262262e5daa1e4affe7e4749398bf5eb0b30d9c08f1a

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.bridgetrack.com; report-uri https://csp-reporter-ui3464xpjq-uc.a.run.app/api/csp-report/?env=prod
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://banking.citi.com/cbol/investment/cpwm/default.htm?BT_TX=1&ProspectID=455F85F6E72647FBA011AEE59AEF2397
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 11 Apr 2024 20:05:26 GMT
via: 1.1 google
referrer-policy: strict-origin-when-cross-origin
content-security-policy: frame-ancestors https://*.citi.com https://*.bridgetrack.com; report-uri https://csp-reporter-ui3464xpjq-uc.a.run.app/api/csp-report/?env=prod
last-modified: Tue, 19 Dec 2023 06:03:16 GMT
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains
etag: "0aa98e4132da1:0"
content-type: image/png
permissions-policy: fullscreen=(self "https://*.citi.com" "https://*.bridgetrack.com" "https://www.youtube.com" "https://cdn.digitalmarketing.citibankonline.com"), geolocation=(self "https://*.citi.com" "https://*.bridgetrack.com"), camera=()
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 215284
x-xss-protection: 1; mode=block

GET
H3 200 title-dots.2cc0f81637e2d92cc3ea.svg
banking.citi.com/cbol/investment/cpwm/images/ 444 B
467 B 184ms
160ms Image
image/svg+xml 35.190.22.40
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://banking.citi.com/cbol/investment/cpwm/images/title-dots.2cc0f81637e2d92cc3ea.svg

Requested by

Host: banking.citi.com
URL: https://banking.citi.com/cbol/investment/cpwm/default.htm?BT_TX=1&ProspectID=455F85F6E72647FBA011AEE59AEF2397

Protocol

Security

QUIC, , AES_128_GCM

Server

35.190.22.40 Kansas City, United States, ASN15169 (GOOGLE, US),

Reverse DNS

40.22.190.35.bc.googleusercontent.com

Software

Resource Hash

22f9eb0056c978dc7e93f99f2042fe9580e713f9ef88e87a3bbc5a8af5b7354d

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.bridgetrack.com; report-uri https://csp-reporter-ui3464xpjq-uc.a.run.app/api/csp-report/?env=prod
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://banking.citi.com/cbol/investment/cpwm/default.htm?BT_TX=1&ProspectID=455F85F6E72647FBA011AEE59AEF2397
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 11 Apr 2024 20:05:26 GMT
via: 1.1 google
referrer-policy: strict-origin-when-cross-origin
content-security-policy: frame-ancestors https://*.citi.com https://*.bridgetrack.com; report-uri https://csp-reporter-ui3464xpjq-uc.a.run.app/api/csp-report/?env=prod
last-modified: Tue, 19 Dec 2023 06:03:16 GMT
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains
etag: "0aa98e4132da1:0"
content-type: image/svg+xml
access-control-allow-origin: *
permissions-policy: fullscreen=(self "https://*.citi.com" "https://*.bridgetrack.com" "https://www.youtube.com" "https://cdn.digitalmarketing.citibankonline.com"), geolocation=(self "https://*.citi.com" "https://*.bridgetrack.com"), camera=()
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 444
x-xss-protection: 1; mode=block

GET
H3 200 closing-dsk.a372e1afff16f3a7635b.jpg
banking.citi.com/cbol/investment/cpwm/images/ 88 KB
88 KB 184ms
161ms Image
image/jpeg 35.190.22.40
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://banking.citi.com/cbol/investment/cpwm/images/closing-dsk.a372e1afff16f3a7635b.jpg

Requested by

Host: banking.citi.com
URL: https://banking.citi.com/cbol/investment/cpwm/default.htm?BT_TX=1&ProspectID=455F85F6E72647FBA011AEE59AEF2397

Protocol

Security

QUIC, , AES_128_GCM

Server

35.190.22.40 Kansas City, United States, ASN15169 (GOOGLE, US),

Reverse DNS

40.22.190.35.bc.googleusercontent.com

Software

Resource Hash

3ceaf77d9be69d9e29f14a1b4c2dea61484ad99ef8b0a0419965464931753bdd

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.bridgetrack.com; report-uri https://csp-reporter-ui3464xpjq-uc.a.run.app/api/csp-report/?env=prod
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://banking.citi.com/cbol/investment/cpwm/default.htm?BT_TX=1&ProspectID=455F85F6E72647FBA011AEE59AEF2397
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 11 Apr 2024 20:05:26 GMT
via: 1.1 google
referrer-policy: strict-origin-when-cross-origin
content-security-policy: frame-ancestors https://*.citi.com https://*.bridgetrack.com; report-uri https://csp-reporter-ui3464xpjq-uc.a.run.app/api/csp-report/?env=prod
last-modified: Tue, 19 Dec 2023 06:03:16 GMT
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains
etag: "0aa98e4132da1:0"
content-type: image/jpeg
permissions-policy: fullscreen=(self "https://*.citi.com" "https://*.bridgetrack.com" "https://www.youtube.com" "https://cdn.digitalmarketing.citibankonline.com"), geolocation=(self "https://*.citi.com" "https://*.bridgetrack.com"), camera=()
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 89878
x-xss-protection: 1; mode=block

GET
H2 200 Citi-Sans-Text-Bold.woff2
cdn.digitalmarketing.citibankonline.com/fonts/ 36 KB
37 KB 158ms
47ms Font
application/font-woff2 34.107.138.236
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.digitalmarketing.citibankonline.com/fonts/Citi-Sans-Text-Bold.woff2

Requested by

Host: banking.citi.com
URL: https://banking.citi.com/cbol/investment/cpwm/default.htm?BT_TX=1&ProspectID=455F85F6E72647FBA011AEE59AEF2397

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

34.107.138.236 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

236.138.107.34.bc.googleusercontent.com

Software

Resource Hash

08dc2092e48755ada1438b1d701943b7e05e076adae5f5a1adedd2ad62ebaa56

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://banking.citi.com/
Origin: https://banking.citi.com
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 11 Apr 2024 09:39:00 GMT
via: 1.1 google
x-content-type-options: nosniff
last-modified: Wed, 01 Feb 2023 20:40:10 GMT
cross-origin-opener-policy: same-origin
age: 37586
content-type: application/font-woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 37076
x-xss-protection: 0

GET
H2 200 interstate-regular.woff
cdn.digitalmarketing.citibankonline.com/fonts/ 17 KB
17 KB 283ms
172ms Font
application/x-woff 34.107.138.236
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.digitalmarketing.citibankonline.com/fonts/interstate-regular.woff

Requested by

Host: banking.citi.com
URL: https://banking.citi.com/cbol/investment/cpwm/default.htm?BT_TX=1&ProspectID=455F85F6E72647FBA011AEE59AEF2397

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

34.107.138.236 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

236.138.107.34.bc.googleusercontent.com

Software

Resource Hash

6896c70fd430a1ffe69dc778926e1866ca52a12bd341170522ad6278aafd7bcf

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://banking.citi.com/
Origin: https://banking.citi.com
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Sun, 31 Mar 2024 10:32:59 GMT
via: 1.1 google
x-content-type-options: nosniff
last-modified: Mon, 10 Feb 2020 17:54:07 GMT
cross-origin-opener-policy: same-origin
age: 984747
content-type: application/x-woff
access-control-allow-origin: *
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 17592
x-xss-protection: 0

GET
H2 200 Citi-Sans-Text-Regular.woff2
cdn.digitalmarketing.citibankonline.com/fonts/ 35 KB
35 KB 224ms
113ms Font
application/font-woff2 34.107.138.236
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.digitalmarketing.citibankonline.com/fonts/Citi-Sans-Text-Regular.woff2

Requested by

Host: banking.citi.com
URL: https://banking.citi.com/cbol/investment/cpwm/default.htm?BT_TX=1&ProspectID=455F85F6E72647FBA011AEE59AEF2397

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

34.107.138.236 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

236.138.107.34.bc.googleusercontent.com

Software

Resource Hash

80062e184f15fd918b5e002539264821f55d5a4b44246d7426a3b7e5f9f6b98e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://banking.citi.com/
Origin: https://banking.citi.com
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 11 Apr 2024 09:38:59 GMT
via: 1.1 google
x-content-type-options: nosniff
last-modified: Wed, 01 Feb 2023 20:40:10 GMT
cross-origin-opener-policy: same-origin
age: 37587
content-type: application/font-woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 36076
x-xss-protection: 0

GET
H2 200 interstate-light.woff
cdn.digitalmarketing.citibankonline.com/fonts/ 17 KB
17 KB 258ms
149ms Font
application/x-woff 34.107.138.236
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.digitalmarketing.citibankonline.com/fonts/interstate-light.woff

Requested by

Host: banking.citi.com
URL: https://banking.citi.com/cbol/investment/cpwm/default.htm?BT_TX=1&ProspectID=455F85F6E72647FBA011AEE59AEF2397

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

34.107.138.236 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

236.138.107.34.bc.googleusercontent.com

Software

Resource Hash

0a747978746092df6f18fe90ef23b9896959f6a9bb0b58cbab2cbc851793e023

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://banking.citi.com/
Origin: https://banking.citi.com
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 14 Mar 2024 14:30:37 GMT
via: 1.1 google
x-content-type-options: nosniff
last-modified: Mon, 10 Feb 2020 17:54:41 GMT
cross-origin-opener-policy: same-origin
age: 2439289
content-type: application/x-woff
access-control-allow-origin: *
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 17596
x-xss-protection: 0

GET
H2 200 interstate-bold.woff
cdn.digitalmarketing.citibankonline.com/fonts/ 17 KB
17 KB 286ms
177ms Font
application/x-woff 34.107.138.236
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.digitalmarketing.citibankonline.com/fonts/interstate-bold.woff

Requested by

Host: banking.citi.com
URL: https://banking.citi.com/cbol/investment/cpwm/default.htm?BT_TX=1&ProspectID=455F85F6E72647FBA011AEE59AEF2397

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

34.107.138.236 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

236.138.107.34.bc.googleusercontent.com

Software

Resource Hash

28ced8a7cb30e6f747ad8116dcd11d3dbf5848c2d49a9babbd7d8c94e0a29cf7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://banking.citi.com/
Origin: https://banking.citi.com
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Sun, 07 Apr 2024 05:34:22 GMT
via: 1.1 google
x-content-type-options: nosniff
last-modified: Mon, 10 Feb 2020 17:54:07 GMT
cross-origin-opener-policy: same-origin
age: 397864
content-type: application/x-woff
access-control-allow-origin: *
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 17500
x-xss-protection: 0

GET
H2 200 Citi-Sans-Display-Regular.woff2
cdn.digitalmarketing.citibankonline.com/fonts/ 35 KB
36 KB 244ms
135ms Font
application/font-woff2 34.107.138.236
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.digitalmarketing.citibankonline.com/fonts/Citi-Sans-Display-Regular.woff2

Requested by

Host: banking.citi.com
URL: https://banking.citi.com/cbol/investment/cpwm/default.htm?BT_TX=1&ProspectID=455F85F6E72647FBA011AEE59AEF2397

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

34.107.138.236 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

236.138.107.34.bc.googleusercontent.com

Software

Resource Hash

c82a05d8c84a1b47c2a38408219f40e88a20b2fd06c5b3c07357e6e5b0161317

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://banking.citi.com/
Origin: https://banking.citi.com
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 11 Apr 2024 09:38:59 GMT
via: 1.1 google
x-content-type-options: nosniff
last-modified: Wed, 01 Feb 2023 20:40:10 GMT
cross-origin-opener-policy: same-origin
age: 37587
content-type: application/font-woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 36320
x-xss-protection: 0

GET
H2 200 Citi-Sans-Display-Bold.woff2
cdn.digitalmarketing.citibankonline.com/fonts/ 36 KB
37 KB 197ms
88ms Font
application/font-woff2 34.107.138.236
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.digitalmarketing.citibankonline.com/fonts/Citi-Sans-Display-Bold.woff2

Requested by

Host: banking.citi.com
URL: https://banking.citi.com/cbol/investment/cpwm/default.htm?BT_TX=1&ProspectID=455F85F6E72647FBA011AEE59AEF2397

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

34.107.138.236 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

236.138.107.34.bc.googleusercontent.com

Software

Resource Hash

dd1a7d1816db5f8e64d47c7b76acc1fdf9c0bfc645733f8442b01763e422429e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://banking.citi.com/
Origin: https://banking.citi.com
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 11 Apr 2024 16:24:10 GMT
via: 1.1 google
x-content-type-options: nosniff
last-modified: Wed, 01 Feb 2023 20:40:10 GMT
cross-origin-opener-policy: same-origin
age: 13276
content-type: application/font-woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 37372
x-xss-protection: 0

GET
H2 200 Citi-Sans-Text-Regular-Italic.woff2
cdn.digitalmarketing.citibankonline.com/fonts/ 37 KB
37 KB 265ms
156ms Font
application/font-woff2 34.107.138.236
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.digitalmarketing.citibankonline.com/fonts/Citi-Sans-Text-Regular-Italic.woff2

Requested by

Host: banking.citi.com
URL: https://banking.citi.com/cbol/investment/cpwm/default.htm?BT_TX=1&ProspectID=455F85F6E72647FBA011AEE59AEF2397

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

34.107.138.236 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

236.138.107.34.bc.googleusercontent.com

Software

Resource Hash

d1356aee6b232d734bac0a04793623cf30ecdadb6107b857acc368a704d529b7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://banking.citi.com/
Origin: https://banking.citi.com
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 11 Apr 2024 16:23:07 GMT
via: 1.1 google
x-content-type-options: nosniff
last-modified: Wed, 01 Feb 2023 20:40:10 GMT
cross-origin-opener-policy: same-origin
age: 13339
content-type: application/font-woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 37832
x-xss-protection: 0

GET
H3 200 header-citi-logo-dsk.6d648431cd080eb515e4.png
banking.citi.com/cbol/investment/cpwm/images/ 2 KB
2 KB 206ms
200ms Image
image/png 35.190.22.40
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://banking.citi.com/cbol/investment/cpwm/images/header-citi-logo-dsk.6d648431cd080eb515e4.png

Requested by

Host: banking.citi.com
URL: https://banking.citi.com/cbol/investment/cpwm/default.htm?BT_TX=1&ProspectID=455F85F6E72647FBA011AEE59AEF2397

Protocol

Security

QUIC, , AES_128_GCM

Server

35.190.22.40 Kansas City, United States, ASN15169 (GOOGLE, US),

Reverse DNS

40.22.190.35.bc.googleusercontent.com

Software

Resource Hash

9a7b3f11a504db5bb479923952c4f4ad7441abac479b59701b2369e490ea0920

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.bridgetrack.com; report-uri https://csp-reporter-ui3464xpjq-uc.a.run.app/api/csp-report/?env=prod
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://banking.citi.com/cbol/investment/cpwm/default.htm?BT_TX=1&ProspectID=455F85F6E72647FBA011AEE59AEF2397
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 11 Apr 2024 20:05:26 GMT
via: 1.1 google
referrer-policy: strict-origin-when-cross-origin
content-security-policy: frame-ancestors https://*.citi.com https://*.bridgetrack.com; report-uri https://csp-reporter-ui3464xpjq-uc.a.run.app/api/csp-report/?env=prod
last-modified: Tue, 19 Dec 2023 15:42:07 GMT
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains
etag: "80b1e2eb9132da1:0"
content-type: image/png
permissions-policy: fullscreen=(self "https://*.citi.com" "https://*.bridgetrack.com" "https://www.youtube.com" "https://cdn.digitalmarketing.citibankonline.com"), geolocation=(self "https://*.citi.com" "https://*.bridgetrack.com"), camera=()
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1549
x-xss-protection: 1; mode=block

GET
H3 200 phoneIcon.61c53286d75b7766f1b9.svg
banking.citi.com/cbol/investment/cpwm/images/ 3 KB
3 KB 184ms
177ms Image
image/svg+xml 35.190.22.40
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://banking.citi.com/cbol/investment/cpwm/images/phoneIcon.61c53286d75b7766f1b9.svg

Requested by

Host: banking.citi.com
URL: https://banking.citi.com/cbol/investment/cpwm/default.htm?BT_TX=1&ProspectID=455F85F6E72647FBA011AEE59AEF2397

Protocol

Security

QUIC, , AES_128_GCM

Server

35.190.22.40 Kansas City, United States, ASN15169 (GOOGLE, US),

Reverse DNS

40.22.190.35.bc.googleusercontent.com

Software

Resource Hash

4f3d8ad7bd78e79e9a9b313433ec6b182c4250de209b00b2e8dc4114b3a43079

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.bridgetrack.com; report-uri https://csp-reporter-ui3464xpjq-uc.a.run.app/api/csp-report/?env=prod
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://banking.citi.com/cbol/investment/cpwm/default.htm?BT_TX=1&ProspectID=455F85F6E72647FBA011AEE59AEF2397
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 11 Apr 2024 20:05:26 GMT
via: 1.1 google
referrer-policy: strict-origin-when-cross-origin
content-security-policy: frame-ancestors https://*.citi.com https://*.bridgetrack.com; report-uri https://csp-reporter-ui3464xpjq-uc.a.run.app/api/csp-report/?env=prod
last-modified: Tue, 19 Dec 2023 06:03:16 GMT
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains
etag: "0aa98e4132da1:0"
content-type: image/svg+xml
access-control-allow-origin: *
permissions-policy: fullscreen=(self "https://*.citi.com" "https://*.bridgetrack.com" "https://www.youtube.com" "https://cdn.digitalmarketing.citibankonline.com"), geolocation=(self "https://*.citi.com" "https://*.bridgetrack.com"), camera=()
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 3020
x-xss-protection: 1; mode=block

GET
H3 200 advisor.2197fbbe32454265d7e5.svg
banking.citi.com/cbol/investment/cpwm/images/ 4 KB
4 KB 182ms
176ms Image
image/svg+xml 35.190.22.40
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://banking.citi.com/cbol/investment/cpwm/images/advisor.2197fbbe32454265d7e5.svg

Requested by

Host: banking.citi.com
URL: https://banking.citi.com/cbol/investment/cpwm/default.htm?BT_TX=1&ProspectID=455F85F6E72647FBA011AEE59AEF2397

Protocol

Security

QUIC, , AES_128_GCM

Server

35.190.22.40 Kansas City, United States, ASN15169 (GOOGLE, US),

Reverse DNS

40.22.190.35.bc.googleusercontent.com

Software

Resource Hash

94b3b5dc4faaa590be767cfc781c53e0b22887fbee06abcc6d8d4d9d8690d282

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.bridgetrack.com; report-uri https://csp-reporter-ui3464xpjq-uc.a.run.app/api/csp-report/?env=prod
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://banking.citi.com/cbol/investment/cpwm/default.htm?BT_TX=1&ProspectID=455F85F6E72647FBA011AEE59AEF2397
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 11 Apr 2024 20:05:26 GMT
via: 1.1 google
referrer-policy: strict-origin-when-cross-origin
content-security-policy: frame-ancestors https://*.citi.com https://*.bridgetrack.com; report-uri https://csp-reporter-ui3464xpjq-uc.a.run.app/api/csp-report/?env=prod
last-modified: Wed, 03 Jan 2024 14:36:08 GMT
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains
etag: "07c5530523eda1:0"
content-type: image/svg+xml
access-control-allow-origin: *
permissions-policy: fullscreen=(self "https://*.citi.com" "https://*.bridgetrack.com" "https://www.youtube.com" "https://cdn.digitalmarketing.citibankonline.com"), geolocation=(self "https://*.citi.com" "https://*.bridgetrack.com"), camera=()
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 3993
x-xss-protection: 1; mode=block

GET
H3 200 capabilities.6993c97497c51fc57326.svg
banking.citi.com/cbol/investment/cpwm/images/ 6 KB
6 KB 185ms
178ms Image
image/svg+xml 35.190.22.40
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://banking.citi.com/cbol/investment/cpwm/images/capabilities.6993c97497c51fc57326.svg

Requested by

Host: banking.citi.com
URL: https://banking.citi.com/cbol/investment/cpwm/default.htm?BT_TX=1&ProspectID=455F85F6E72647FBA011AEE59AEF2397

Protocol

Security

QUIC, , AES_128_GCM

Server

35.190.22.40 Kansas City, United States, ASN15169 (GOOGLE, US),

Reverse DNS

40.22.190.35.bc.googleusercontent.com

Software

Resource Hash

1abef9ed7dc7e7f148b3e64da91176e0d1fcbf812a46db9c7420bd267ee11735

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.bridgetrack.com; report-uri https://csp-reporter-ui3464xpjq-uc.a.run.app/api/csp-report/?env=prod
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://banking.citi.com/cbol/investment/cpwm/default.htm?BT_TX=1&ProspectID=455F85F6E72647FBA011AEE59AEF2397
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 11 Apr 2024 20:05:26 GMT
via: 1.1 google
referrer-policy: strict-origin-when-cross-origin
content-security-policy: frame-ancestors https://*.citi.com https://*.bridgetrack.com; report-uri https://csp-reporter-ui3464xpjq-uc.a.run.app/api/csp-report/?env=prod
last-modified: Wed, 03 Jan 2024 14:36:08 GMT
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains
etag: "07c5530523eda1:0"
content-type: image/svg+xml
access-control-allow-origin: *
permissions-policy: fullscreen=(self "https://*.citi.com" "https://*.bridgetrack.com" "https://www.youtube.com" "https://cdn.digitalmarketing.citibankonline.com"), geolocation=(self "https://*.citi.com" "https://*.bridgetrack.com"), camera=()
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 6312
x-xss-protection: 1; mode=block

GET
H3 200 marketGraph.33266fd47f3ee7d17730.svg
banking.citi.com/cbol/investment/cpwm/images/ 2 KB
2 KB 217ms
211ms Image
image/svg+xml 35.190.22.40
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://banking.citi.com/cbol/investment/cpwm/images/marketGraph.33266fd47f3ee7d17730.svg

Requested by

Host: banking.citi.com
URL: https://banking.citi.com/cbol/investment/cpwm/default.htm?BT_TX=1&ProspectID=455F85F6E72647FBA011AEE59AEF2397

Protocol

Security

QUIC, , AES_128_GCM

Server

35.190.22.40 Kansas City, United States, ASN15169 (GOOGLE, US),

Reverse DNS

40.22.190.35.bc.googleusercontent.com

Software

Resource Hash

3a5194cde0bc6408df78ffcd888809dc4e028b5df6a9fb96be756806152f5f59

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.bridgetrack.com; report-uri https://csp-reporter-ui3464xpjq-uc.a.run.app/api/csp-report/?env=prod
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://banking.citi.com/cbol/investment/cpwm/default.htm?BT_TX=1&ProspectID=455F85F6E72647FBA011AEE59AEF2397
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 11 Apr 2024 20:05:26 GMT
via: 1.1 google
referrer-policy: strict-origin-when-cross-origin
content-security-policy: frame-ancestors https://*.citi.com https://*.bridgetrack.com; report-uri https://csp-reporter-ui3464xpjq-uc.a.run.app/api/csp-report/?env=prod
last-modified: Wed, 03 Jan 2024 14:36:08 GMT
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains
etag: "07c5530523eda1:0"
content-type: image/svg+xml
access-control-allow-origin: *
permissions-policy: fullscreen=(self "https://*.citi.com" "https://*.bridgetrack.com" "https://www.youtube.com" "https://cdn.digitalmarketing.citibankonline.com"), geolocation=(self "https://*.citi.com" "https://*.bridgetrack.com"), camera=()
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2502
x-xss-protection: 1; mode=block

GET
H3 200 pricing.a8a802dfb164cafb7167.svg
banking.citi.com/cbol/investment/cpwm/images/ 8 KB
8 KB 206ms
200ms Image
image/svg+xml 35.190.22.40
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://banking.citi.com/cbol/investment/cpwm/images/pricing.a8a802dfb164cafb7167.svg

Requested by

Host: banking.citi.com
URL: https://banking.citi.com/cbol/investment/cpwm/default.htm?BT_TX=1&ProspectID=455F85F6E72647FBA011AEE59AEF2397

Protocol

Security

QUIC, , AES_128_GCM

Server

35.190.22.40 Kansas City, United States, ASN15169 (GOOGLE, US),

Reverse DNS

40.22.190.35.bc.googleusercontent.com

Software

Resource Hash

279d30a83ec9df0b98f9a8ca372f7d94e83c605e9299ea22a5e5d461a0a12495

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.bridgetrack.com; report-uri https://csp-reporter-ui3464xpjq-uc.a.run.app/api/csp-report/?env=prod
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://banking.citi.com/cbol/investment/cpwm/default.htm?BT_TX=1&ProspectID=455F85F6E72647FBA011AEE59AEF2397
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 11 Apr 2024 20:05:26 GMT
via: 1.1 google
referrer-policy: strict-origin-when-cross-origin
content-security-policy: frame-ancestors https://*.citi.com https://*.bridgetrack.com; report-uri https://csp-reporter-ui3464xpjq-uc.a.run.app/api/csp-report/?env=prod
last-modified: Wed, 03 Jan 2024 14:36:08 GMT
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains
etag: "07c5530523eda1:0"
content-type: image/svg+xml
access-control-allow-origin: *
permissions-policy: fullscreen=(self "https://*.citi.com" "https://*.bridgetrack.com" "https://www.youtube.com" "https://cdn.digitalmarketing.citibankonline.com"), geolocation=(self "https://*.citi.com" "https://*.bridgetrack.com"), camera=()
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 7965
x-xss-protection: 1; mode=block

GET
H3 200 rankedIcon.5b789652164b173724d3.jpg
banking.citi.com/cbol/investment/cpwm/images/ 18 KB
18 KB 195ms
189ms Image
image/jpeg 35.190.22.40
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://banking.citi.com/cbol/investment/cpwm/images/rankedIcon.5b789652164b173724d3.jpg

Requested by

Host: banking.citi.com
URL: https://banking.citi.com/cbol/investment/cpwm/default.htm?BT_TX=1&ProspectID=455F85F6E72647FBA011AEE59AEF2397

Protocol

Security

QUIC, , AES_128_GCM

Server

35.190.22.40 Kansas City, United States, ASN15169 (GOOGLE, US),

Reverse DNS

40.22.190.35.bc.googleusercontent.com

Software

Resource Hash

a03e6c7363c6912c0dae3e34d4b4b0e4961f14c9e5e8a7f638140f59e93eaedf

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.bridgetrack.com; report-uri https://csp-reporter-ui3464xpjq-uc.a.run.app/api/csp-report/?env=prod
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://banking.citi.com/cbol/investment/cpwm/default.htm?BT_TX=1&ProspectID=455F85F6E72647FBA011AEE59AEF2397
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 11 Apr 2024 20:05:26 GMT
via: 1.1 google
referrer-policy: strict-origin-when-cross-origin
content-security-policy: frame-ancestors https://*.citi.com https://*.bridgetrack.com; report-uri https://csp-reporter-ui3464xpjq-uc.a.run.app/api/csp-report/?env=prod
last-modified: Thu, 29 Feb 2024 19:09:18 GMT
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains
etag: "0c314cb426bda1:0"
content-type: image/jpeg
permissions-policy: fullscreen=(self "https://*.citi.com" "https://*.bridgetrack.com" "https://www.youtube.com" "https://cdn.digitalmarketing.citibankonline.com"), geolocation=(self "https://*.citi.com" "https://*.bridgetrack.com"), camera=()
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 18751
x-xss-protection: 1; mode=block

GET
H3 200 phoneIcon.c86939d5bb7841204553.svg
banking.citi.com/cbol/investment/cpwm/images/ 3 KB
3 KB 180ms
174ms Image
image/svg+xml 35.190.22.40
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://banking.citi.com/cbol/investment/cpwm/images/phoneIcon.c86939d5bb7841204553.svg

Requested by

Host: banking.citi.com
URL: https://banking.citi.com/cbol/investment/cpwm/default.htm?BT_TX=1&ProspectID=455F85F6E72647FBA011AEE59AEF2397

Protocol

Security

QUIC, , AES_128_GCM

Server

35.190.22.40 Kansas City, United States, ASN15169 (GOOGLE, US),

Reverse DNS

40.22.190.35.bc.googleusercontent.com

Software

Resource Hash

a4f02d764058d001c0de3d11ab9652db7275fed7900113b892b7800db39d2663

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.bridgetrack.com; report-uri https://csp-reporter-ui3464xpjq-uc.a.run.app/api/csp-report/?env=prod
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://banking.citi.com/cbol/investment/cpwm/default.htm?BT_TX=1&ProspectID=455F85F6E72647FBA011AEE59AEF2397
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 11 Apr 2024 20:05:26 GMT
via: 1.1 google
referrer-policy: strict-origin-when-cross-origin
content-security-policy: frame-ancestors https://*.citi.com https://*.bridgetrack.com; report-uri https://csp-reporter-ui3464xpjq-uc.a.run.app/api/csp-report/?env=prod
last-modified: Tue, 19 Dec 2023 06:03:16 GMT
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains
etag: "0aa98e4132da1:0"
content-type: image/svg+xml
access-control-allow-origin: *
permissions-policy: fullscreen=(self "https://*.citi.com" "https://*.bridgetrack.com" "https://www.youtube.com" "https://cdn.digitalmarketing.citibankonline.com"), geolocation=(self "https://*.citi.com" "https://*.bridgetrack.com"), camera=()
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 3021
x-xss-protection: 1; mode=block

PUT
H2 200 83450500e6cddbe403b69c5b65e8ac92e627e9587d48f611f606b45c4f021867 Show response
tagmanager1.citi.com/one/v1/profiles/ 1010 B
786 B 89ms
81ms XHR
application/json 3.124.119.57
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tagmanager1.citi.com/one/v1/profiles/83450500e6cddbe403b69c5b65e8ac92e627e9587d48f611f606b45c4f021867?returnValues=ALL_NEW
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 3.124.119.57 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-124-119-57.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 6160e82977edf783d073558110bc0036bed5c4a62a1f49f3eb91458a872dc7c3

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
sec-ch-ua-platform: "Win32"
Referer: https://banking.citi.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

date: Thu, 11 Apr 2024 20:05:26 GMT
content-encoding: gzip
server: nginx
x-ens-one-is-anonymous: true
vary: Accept-Encoding
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS
content-type: application/json
access-control-allow-origin: *
access-control-expose-headers: *
access-control-allow-headers: *
x-ens-one-ttl: 1720641926
apigw-requestid: WE9VEio9liAEJIA=

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 204 KB
74 KB 57ms
52ms Script
application/javascript 2a00:1450:4001:81d::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=DC-6269322&l=dataLayer&cx=c

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81d::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

930b9163349172607e509b2e72a3ac3a3152a7f5b28a61a4f562c720f18e6d92

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://banking.citi.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 11 Apr 2024 20:05:26 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 75258
x-xss-protection: 0
last-modified: Thu, 11 Apr 2024 19:10:04 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Thu, 11 Apr 2024 20:05:26 GMT

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 196 KB
71 KB 71ms
66ms Script
application/javascript 2a00:1450:4001:81d::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=DC-6256710&l=dataLayer&cx=c

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81d::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

96589f45397c06969f95b1acd12fffcf53653ae37659d8eb0cf6b142a80ba3f1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://banking.citi.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 11 Apr 2024 20:05:26 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 73006
x-xss-protection: 0
last-modified: Thu, 11 Apr 2024 19:10:04 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Thu, 11 Apr 2024 20:05:26 GMT

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 196 KB
71 KB 84ms
79ms Script
application/javascript 2a00:1450:4001:81d::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=DC-6415812&l=dataLayer&cx=c

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81d::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

e20c077b8692a41850659276824f26d91c169ea46fd27f14f87de875a3b41fc8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://banking.citi.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 11 Apr 2024 20:05:26 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 73033
x-xss-protection: 0
last-modified: Thu, 11 Apr 2024 19:10:04 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Thu, 11 Apr 2024 20:05:26 GMT

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 196 KB
71 KB 118ms
114ms Script
application/javascript 2a00:1450:4001:81d::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=DC-6268858&l=dataLayer&cx=c

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81d::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

093a4766afe0242a41c22de19122885eee9d4e2600a8d0c2d0b27bef4bdfff7c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://banking.citi.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 11 Apr 2024 20:05:26 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 73013
x-xss-protection: 0
last-modified: Thu, 11 Apr 2024 19:10:04 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Thu, 11 Apr 2024 20:05:26 GMT

POST
H2 200 delivery Show response
citicorpcreditservic.tt.omtrdc.net/rest/v1/ 363 B
1 KB 219ms
72ms XHR
application/json 66.235.152.156
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://citicorpcreditservic.tt.omtrdc.net/rest/v1/delivery?client=citicorpcreditservic&sessionId=68af5caefc6945c1b097b19849eb31b2&version=2.10.2

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

66.235.152.156 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ip-66-235-152-156.data.adobedc.net

Software

jag /

Resource Hash

329e2aa5ac1633899d882b0ec5ddf4972aef44b72010dd963a195c3e90387adf

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
sec-ch-ua-platform: "Win32"
Referer: https://banking.citi.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
Content-Type: text/plain

Response headers

date: Thu, 11 Apr 2024 20:05:26 GMT
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains
p3p: CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
x-xss-protection: 1; mode=block
x-request-id: b75a29e1-216c-4935-9214-06964633915a
referrer-policy: strict-origin-when-cross-origin
accept-ch: Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version-List
server: jag
vary: origin,access-control-request-method,access-control-request-headers,accept-encoding
content-type: application/json;charset=UTF-8
access-control-allow-origin: https://banking.citi.com
cache-control: no-cache, no-store, max-age=0, no-transform, private
access-control-allow-credentials: true
timing-allow-origin: *

GET
BLOB 200
OK 6d7107f8-cad1-430b-927e-58726c76e640
https://banking.citi.com/ 241 B
0 Other
text/javascript

General

Check archive.org

Show headers Download Go to

Full URL: blob:https://banking.citi.com/6d7107f8-cad1-430b-927e-58726c76e640
Requested by: Host: banking.citi.com
URL: https://banking.citi.com/cbol/investment/cpwm/default.htm?BT_TX=1&ProspectID=455F85F6E72647FBA011AEE59AEF2397
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 7d02633239369d04c8812eff65b6c3fad7d08525efd85d2451de2a4bac9f0cfb

Request headers

Accept-Language: de-DE,de;q=0.9;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36

Response headers

Content-Length: 241
Content-Type: text/javascript

GET
H2 200 / Show response
zn3vi8kkuds0jjrfc-citifeedback.siteintercept.qualtrics.com/SIE/ 10 KB
5 KB 255ms
73ms Script
application/javascript 104.17.208.240
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://zn3vi8kkuds0jjrfc-citifeedback.siteintercept.qualtrics.com/SIE/?Q_ZID=ZN_3VI8kkudS0JJRFc

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.17.208.240 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

d451431443e3d3142f524e7743c84d9ec20c5ed361c4086cdf59eb267567e13c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://banking.citi.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 11 Apr 2024 20:05:27 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: br
age: 12749
content-security-policy-report-only: frame-ancestors 'self' *.qualtrics.com *.my.salesforce.com *.visualforce.com *.visual.force.com *.lightning.force.com; report-uri https://sjc1.qualtrics.com/csp-report
edge-control: max-age=604800
referrer-policy: strict-origin-when-cross-origin
server: cloudflare
etag: W/"26bb-48b78iXDAu8GTSOJskPicy9VV2g"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=3600, s-maxage=604800
permissions-policy: camera=(), geolocation=(), microphone=()
cf-ray: 872d976c3a953546-WAW
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept
timing-allow-origin: *

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 251 KB
87 KB 57ms
57ms Script
application/javascript 216.58.206.72
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-916451471

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

Security

QUIC, , AES_128_GCM

Server

216.58.206.72 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lhr35s11-in-f8.1e100.net

Software

Google Tag Manager /

Resource Hash

1f92443e7d2ea7191712d2145ce8725a7fcd1e5bc5423c0d81462dbd6da54b62

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://banking.citi.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 11 Apr 2024 20:05:26 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 88728
x-xss-protection: 0
last-modified: Thu, 11 Apr 2024 19:10:04 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Thu, 11 Apr 2024 20:05:26 GMT

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 217 KB
78 KB 59ms
59ms Script
application/javascript 216.58.206.72
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-11360697733

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

Security

QUIC, , AES_128_GCM

Server

216.58.206.72 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lhr35s11-in-f8.1e100.net

Software

Google Tag Manager /

Resource Hash

78720184c8dc77ae80b9efadf89e7a413d1533d357cb5785a4525d95291083e2

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://banking.citi.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 11 Apr 2024 20:05:26 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 79995
x-xss-protection: 0
last-modified: Thu, 11 Apr 2024 19:10:04 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Thu, 11 Apr 2024 20:05:26 GMT

GET
H2 200 ytc.js Show response
s.yimg.com/wi/ 18 KB
7 KB 217ms
44ms Script
application/javascript 2a00:1288:80:807::1
YAHOO-DEB

General

Check archive.org

Show headers Download Go to

Full URL

https://s.yimg.com/wi/ytc.js

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1288:80:807::1 , United Kingdom, ASN203220 (YAHOO-DEB, GB),

Reverse DNS

Software

ATS /

Resource Hash

480b06b23e574b4bf386fde1a91145a4171f97aeb5ee800e4be1850f29b1ad91

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://banking.citi.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

ats-carp-promotion: 1, 1
date: Thu, 11 Apr 2024 19:23:15 GMT
x-amz-version-id: xC6OTTJGIjCqkMTkbrZpmtbXHK5oaZhW
content-encoding: gzip
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
x-amz-request-id: NHRVZN2FYJAM0K48
age: 2533
x-amz-server-side-encryption: AES256
content-length: 6262
x-amz-id-2: G6NPS3aTnI5ON15qGN15z1uKl14NvGJjQDCddFPUVq2JchbNb6ImDgDGOvudz9Va/YGqyhmaklI=
x-xss-protection: 1; mode=block
referrer-policy: no-referrer-when-downgrade
x-amz-expiration: expiry-date="Wed, 31 Jul 2024 00:00:00 GMT", rule-id="oath-standard-lifecycle"
last-modified: Mon, 26 Jun 2023 09:26:35 GMT
server: ATS
etag: "5c6ed25dce803fd84288922b8928409e-df"
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
vary: Origin, Accept-Encoding
content-type: application/javascript
cache-control: public,max-age=3600
accept-ranges: bytes

GET
H2

200

activityi;dc_pre=CJq7h-n6uoUDFchZHgId42QFpg;src=6269322;type=bankp00;cat=banka019;ord=1;num=1583168628853;npa=1;auiddc=102249979.1712865927;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B123.0.6312.122%7...
6269322.fls.doubleclick.net/ Frame 45C3
Redirect Chain

https://6269322.fls.doubleclick.net/activityi;src=6269322;type=bankp00;cat=banka019;ord=1;num=1583168628853;npa=1;auiddc=102249979.1712865927;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B123.0.6312.122...
https://6269322.fls.doubleclick.net/activityi;dc_pre=CJq7h-n6uoUDFchZHgId42QFpg;src=6269322;type=bankp00;cat=banka019;ord=1;num=1583168628853;npa=1;auiddc=102249979.1712865927;uaa=x86;uab=64;uafvl=...

0
0

90ms
84ms

Document
text/html

142.250.184.198
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://6269322.fls.doubleclick.net/activityi;dc_pre=CJq7h-n6uoUDFchZHgId42QFpg;src=6269322;type=bankp00;cat=banka019;ord=1;num=1583168628853;npa=1;auiddc=102249979.1712865927;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B123.0.6312.122%7CNot%253AA-Brand%3B8.0.0.0%7CChromium%3B123.0.6312.122;uamb=0;uam=;uap=Win32;uapv=10.0.0;uaw=0;pscdl=noapi;gtm=45fe44a0v9179876355za200;gcd=13l3l3l2l1;dma_cps=sypham;dma=1;epver=2;~oref=https%3A%2F%2Fbanking.citi.com%2Fcbol%2Finvestment%2Fcpwm%2Fdefault.htm%3FBT_TX%3D1%26ProspectID%3D455F85F6E72647FBA011AEE59AEF2397?

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.184.198 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s11-in-f6.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=21600
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9;q=0.9
Referer: https://banking.citi.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Win32"

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=0
content-encoding: br
content-length: 450
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Thu, 11 Apr 2024 20:05:27 GMT
expires: Thu, 11 Apr 2024 20:05:27 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
strict-transport-security: max-age=21600
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

Redirect headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, must-revalidate
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Thu, 11 Apr 2024 20:05:27 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
follow-only-when-prerender-shown: 1
location: https://6269322.fls.doubleclick.net/activityi;dc_pre=CJq7h-n6uoUDFchZHgId42QFpg;src=6269322;type=bankp00;cat=banka019;ord=1;num=1583168628853;npa=1;auiddc=102249979.1712865927;uaa=x86;uab=64;uafvl=Google%2520Chrome%3B123.0.6312.122%7CNot%253AA-Brand%3B8.0.0.0%7CChromium%3B123.0.6312.122;uamb=0;uam=;uap=Win32;uapv=10.0.0;uaw=0;pscdl=noapi;gtm=45fe44a0v9179876355za200;gcd=13l3l3l2l1;dma_cps=sypham;dma=1;epver=2;~oref=https%3A%2F%2Fbanking.citi.com%2Fcbol%2Finvestment%2Fcpwm%2Fdefault.htm%3FBT_TX%3D1%26ProspectID%3D455F85F6E72647FBA011AEE59AEF2397?
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
pragma: no-cache
server: cafe
strict-transport-security: max-age=21600
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 451 425466.html
sr.rlcdn.com/ Frame F6FF 0
0 333ms
165ms Document
text/plain 35.244.154.8
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://sr.rlcdn.com/425466.html?es=80676&u=da39a3ee5e6b4b0d3255bfef95601890afd80709
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.154.8 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 8.154.244.35.bc.googleusercontent.com
Software: /
Resource Hash

Request headers

Accept-Language: de-DE,de;q=0.9;q=0.9
Referer: https://banking.citi.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Win32"

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
date: Thu, 11 Apr 2024 20:05:27 GMT
via: 1.1 google

GET
H2 200 dpm_pixel_min.js Show response
c.tvpixel.com/js/current/ 103 KB
32 KB 231ms
59ms Script
application/javascript 2600:9000:2247:5400:1d:bf0a:0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c.tvpixel.com/js/current/dpm_pixel_min.js?aid=citi-d4f85824-1351-4554-91ff-fdb56f962c5c&comscore=true
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2247:5400:1d:bf0a:0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 61d8137d275f12306e177bc726c2b3e072f9efa4743a0ace6ecbcf7a0932fd07

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://banking.citi.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 11 Apr 2024 00:57:46 GMT
x-amz-version-id: oMk5SFqHXboEDRm2.vDWImtx_4ARYxEl
content-encoding: gzip
last-modified: Thu, 16 Sep 2021 18:14:59 GMT
server: AmazonS3
via: 1.1 13b67581ff611543a4bbfc12dfe7dae0.cloudfront.net (CloudFront)
x-amz-cf-pop: MXP63-P2
etag: W/"08e770c8a17bf087d50cec01af0892c2"
age: 68862
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
x-amz-cf-id: DFiCYsIZJRxEHue_15hBaGKw4Oo5vCWdrDxGYdZYdESX3R0I0NWAJA==

GET
H2 200 bat.js Show response
bat.bing.com/ 45 KB
13 KB 238ms
67ms Script
application/javascript 2620:1ec:c11::237
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://bat.bing.com/bat.js

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2620:1ec:c11::237 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

823804a7807864b44093a3843788f4cd076e89cf4a6fdeb8d153ae5c2c2df721

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://banking.citi.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
content-encoding: gzip
date: Thu, 11 Apr 2024 20:05:26 GMT
last-modified: Thu, 29 Feb 2024 19:58:06 GMT
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 52D680DFF5AC40698C13353A5317A1EA Ref B: FRA31EDGE0805 Ref C: 2024-04-11T20:05:27Z
etag: "01b4e9c496bda1:0"
vary: Accept-Encoding
x-cache: CONFIG_NOCACHE
content-type: application/javascript
cache-control: private,max-age=1800
accept-ranges: bytes
content-length: 13261

GET
H2 200 sync Show response
live.rezync.com/ 1 KB
2 KB 350ms
188ms Script
text/javascript 13.32.27.28
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://live.rezync.com/sync?c=16b6410431b6374e780104abb0443ca8&p=7e32322de398f7a80f6da0ee1cec9a9b&k=citibank-pixel-6667&custom1=null&custom2=undefined&custom3=null&custom4=undefined&custom5=undefined&custom6=undefined&zmpID=citibank&cache_buster=1712865926892&PageUrl=https://banking.citi.com/cbol/investment/cpwm/default.htm?BT_TX=1&ProspectID=455F85F6E72647FBA011AEE59AEF2397&page_referrer=
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.32.27.28 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-32-27-28.fra56.r.cloudfront.net
Software: lighttpd/1.4.69 /
Resource Hash: 72a507c884f2708c32bb63ec9f7a71b720695f050fbdc1967eeec54a1f66dd52

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://banking.citi.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 11 Apr 2024 20:05:27 GMT
via: 1.1 99399b4523bd3370d7a592870d630ec8.cloudfront.net (CloudFront)
server: lighttpd/1.4.69
x-amz-cf-pop: FRA56-C2
vary: Cookie
x-cache: Miss from cloudfront
content-type: text/javascript
accept-ranges: bytes
content-length: 1349
x-amz-cf-id: VO6Uku8tAiXRxiUMwvEqCM1lrKwGvnNa2tGlT73mfFJVf3OzCr-k4g==

GET

iu3
s.amazon-adsystem.com/
Redirect Chain

https://s.amazon-adsystem.com/iu3?pid=c3702eea-109e-48b0-9ef4-c856bdd405e2&event=PageView
https://s.amazon-adsystem.com/iu3?pid=c3702eea-109e-48b0-9ef4-c856bdd405e2&event=PageView&dcc=t

0
0

GET
H3 204 e.gif
nexus.ensighten.com/error/ 0
218 B 43ms
42ms Image
text/plain 99.84.88.39
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://nexus.ensighten.com/error/e.gif?msg=Cannot%20read%20properties%20of%20undefined%20(reading%20%27join%27)&lnn=-1&fn=&cid=1129&client=citi&publishPath=na_prod&rid=2836703&did=578343&errorName=TypeError
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 99.84.88.39 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-84-88-39.muc50.r.cloudfront.net
Software: CloudFront /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://banking.citi.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 11 Apr 2024 02:47:16 GMT
via: 1.1 37e2872b8b14122ba8fe3a34c3bb506a.cloudfront.net (CloudFront)
server: CloudFront
age: 62290
x-amz-cf-pop: MUC50-C1
x-cache: Hit from cloudfront
cache-control: no-cache, no-store
alt-svc: h3=":443"; ma=86400
x-amz-cf-id: 3wq06FjcE8DP0rcDG23jdOvlMLvO-qP1Bt2BPkmdXopQFPEy0xzmjA==

GET
H3 204 e.gif
nexus.ensighten.com/error/ 0
217 B 42ms
42ms Image
text/plain 99.84.88.39
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://nexus.ensighten.com/error/e.gif?msg=%24%20is%20not%20defined&lnn=-1&fn=&cid=1129&client=citi&publishPath=na_prod&rid=2836703&did=578343&errorName=ReferenceError
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 99.84.88.39 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-84-88-39.muc50.r.cloudfront.net
Software: CloudFront /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://banking.citi.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 11 Apr 2024 02:47:16 GMT
via: 1.1 37e2872b8b14122ba8fe3a34c3bb506a.cloudfront.net (CloudFront)
server: CloudFront
age: 62290
x-amz-cf-pop: MUC50-C1
x-cache: Hit from cloudfront
cache-control: no-cache, no-store
alt-svc: h3=":443"; ma=86400
x-amz-cf-id: KYWIsTJ0OeVDARiwdO0Dg5Nm2JsppIbdy48wdlPd7ap2VxFTNesQvg==

GET
H3 204 e.gif
nexus.ensighten.com/error/ 0
218 B 43ms
43ms Image
text/plain 99.84.88.39
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://nexus.ensighten.com/error/e.gif?msg=%24%20is%20not%20defined&lnn=-1&fn=&cid=1129&client=citi&publishPath=na_prod&rid=2680754&did=572750&errorName=ReferenceError
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 99.84.88.39 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-84-88-39.muc50.r.cloudfront.net
Software: CloudFront /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://banking.citi.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 11 Apr 2024 02:47:16 GMT
via: 1.1 37e2872b8b14122ba8fe3a34c3bb506a.cloudfront.net (CloudFront)
server: CloudFront
age: 62290
x-amz-cf-pop: MUC50-C1
x-cache: Hit from cloudfront
cache-control: no-cache, no-store
alt-svc: h3=":443"; ma=86400
x-amz-cf-id: pzxdmaBEVI-Vp5x8yCH9zl_cKB0XBb2FDsGz68Qe1gSg2KMXPaicCA==

GET
H/1.1 200
OK cls_report Show response
prod.report.nacustomerexperience.citi.com/glassbox/reporting/798b2f12-9162-4a94-91ee-805d883ca266/ 12 KB
3 KB 1223ms
120ms XHR
application/json 34.232.212.104
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://prod.report.nacustomerexperience.citi.com/glassbox/reporting/798b2f12-9162-4a94-91ee-805d883ca266/cls_report?_cls_s=d436117f-99ee-4c8f-90cf-84373b8f2ff7%3A0&_cls_v=97b61d6c-610f-4480-8a74-efcc3ce99500&pv=2

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

34.232.212.104 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-34-232-212-104.compute-1.amazonaws.com

Software

Glassbox Cligate /

Resource Hash

73f050ae7efaaf6933c9f791011b6ec7dae72c7afc80b36b7d9a83b853701c43

Security Headers

Name	Value
Content-Security-Policy	default-src 'self';
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://banking.citi.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Date: Thu, 11 Apr 2024 20:05:28 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains
content-encoding: gzip
Content-Security-Policy: default-src 'self';
X-Content-Type-Options: nosniff
Connection: keep-alive
Content-Length: 2229
X-XSS-Protection: 1; mode=block
Referrer-Policy: strict-origin-when-cross-origin
Server: Glassbox Cligate
X-Frame-Options: SAMEORIGIN
vary: origin
Content-Type: application/json
access-control-allow-origin: https://banking.citi.com
access-control-allow-credentials: true
GB-Server: g5075
X-Robots-Tag: noindex

GET
H2 200 s87737052291748
metrics1.citi.com/b/ss/citiuscombprod,citicitiuscombprodtest/1/JS-2.25.0/ 43 B
463 B 58ms
58ms Image
image/gif 63.140.62.27
OMNITURE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://metrics1.citi.com/b/ss/citiuscombprod,citicitiuscombprodtest/1/JS-2.25.0/s87737052291748?AQB=1&ndh=1&pf=1&t=11%2F3%2F2024%2022%3A5%3A26%204%20-120&sdid=67AC8C84DF47EBE6-28941B66716B4982&mid=12349810510954818803197568228951999682&aamlh=6&ce=UTF-8&g=https%3A%2F%2Fbanking.citi.com%2Fcbol%2Finvestment%2Fcpwm%2Fdefault.htm%3FBT_TX%3D1%26ProspectID%3D455F85F6E72647FBA011AEE59AEF2397&c.&action_type=page%20view&evarpagename=us%7Cweb%7Cpublic%7Cmicrosite%7Cwealth%7Cciti%20personal%20wealth%20management&app_hierarchy=public%7Cmicrosite%7Cwealth%7Cciti%20personal%20wealth%20management&evarPageName_0=us&evarPageName_1=web&evarPageName_2=public&evarPageName_3=microsite&evarPageName_4=wealth&evarPageName_5=landing&site_hierarchy_0=us&site_hierarchy_1=web&site_hierarchy_2=public&site_hierarchy_3=microsite&site_hierarchy_4=wealth&form_type=razorfish%3A154055%3A2024%20CBNA%20Global%20Wealth%20CPWM%20Page%3A2024Q1&lead_type=wealth%7Cciti%20personal%20wealth%20management&test_id=198_46%20a%20Wealth%20-%20Citi%20Personal%20Wealth%20Management&site_name=US&login_status=unknown&domain=banking.citi.com&prospect_id=455F85F6E72647FBA011AEE59AEF2397&url=https%3A%2F%2Fbanking.citi.com%2Fcbol%2Finvestment%2Fcpwm%2Fdefault.htm%3FBT_TX%3D1%26ProspectID%3D455F85F6E72647FBA011AEE59AEF2397&guid=4ff1704c-d80e-46c1-a90e-b0a148665656&plat=browser&.c&cc=USD&aamb=RKhpRz8krg2tLO6pguXWp5olkAcUniQYPHaMWWgdJ3xzPWQmdj0y&c7=4%3A05%20PM%7CThursday&v7=4%3A05%20PM%7CThursday&v11=New&c65=investment_cpwm&v85=4ff1704c-d80e-46c1-a90e-b0a148665656&s=1600x1200&c=24&j=1.6&v=N&k=Y&bw=1600&bh=1200&mcorgid=61834D9B5228A7430A490D45%40AdobeOrg&AQE=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

63.140.62.27 , United States, ASN15224 (OMNITURE, US),

Reverse DNS

ip-63-140-62-27.data.adobedc.net

Software

jag /

Resource Hash

a1ecbaed793a1f564c49c671f2dd0ce36f858534ef6d26b55783a06b884cc506

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://banking.citi.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

pragma: no-cache
date: Thu, 11 Apr 2024 20:05:27 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
last-modified: Fri, 12 Apr 2024 20:05:27 GMT
server: jag
etag: 3678351571333840896-4618435684175625271
vary: *
p3p: CP="This is not a P3P policy"
access-control-allow-origin: *
content-type: image/gif;charset=utf-8
cache-control: no-cache, no-store, max-age=0, no-transform, private
content-length: 43
x-xss-protection: 1; mode=block
expires: Wed, 10 Apr 2024 20:05:27 GMT

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 214 KB
78 KB 71ms
71ms Script
application/javascript 216.58.206.72
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-960621875&l=dataLayer&cx=c

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

Security

QUIC, , AES_128_GCM

Server

216.58.206.72 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lhr35s11-in-f8.1e100.net

Software

Google Tag Manager /

Resource Hash

81c0d3368ab09a4346305126269d432a59f1f679a03ab5a9f04368ba33213735

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://banking.citi.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 11 Apr 2024 20:05:27 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 79528
x-xss-protection: 0
last-modified: Thu, 11 Apr 2024 19:10:04 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Thu, 11 Apr 2024 20:05:27 GMT

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 209 KB
76 KB 59ms
58ms Script
application/javascript 216.58.206.72
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-644574043&l=dataLayer&cx=c

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

Security

QUIC, , AES_128_GCM

Server

216.58.206.72 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lhr35s11-in-f8.1e100.net

Software

Google Tag Manager /

Resource Hash

f645ffb0d67a42a3244124653935ff9a7ee4a84fee30a2c83d9bf4a2a17cc2ef

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://banking.citi.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 11 Apr 2024 20:05:27 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 77954
x-xss-protection: 0
last-modified: Thu, 11 Apr 2024 19:10:04 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Thu, 11 Apr 2024 20:05:27 GMT

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 221 KB
79 KB 51ms
51ms Script
application/javascript 216.58.206.72
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-975701947&l=dataLayer&cx=c

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

Security

QUIC, , AES_128_GCM

Server

216.58.206.72 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lhr35s11-in-f8.1e100.net

Software

Google Tag Manager /

Resource Hash

c00cb90f8b23d8e6fc9e95239911cc8ac7a475a8b2badd31ebe3eb38e27bffab

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://banking.citi.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 11 Apr 2024 20:05:27 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 80912
x-xss-protection: 0
last-modified: Thu, 11 Apr 2024 19:10:04 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Thu, 11 Apr 2024 20:05:27 GMT

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 227 KB
81 KB 64ms
64ms Script
application/javascript 216.58.206.72
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-830907969&l=dataLayer&cx=c

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

Security

QUIC, , AES_128_GCM

Server

216.58.206.72 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lhr35s11-in-f8.1e100.net

Software

Google Tag Manager /

Resource Hash

6763619496179f71fb260cdd36e51b58c5f36c46fec660fe4d18299b027daea8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://banking.citi.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 11 Apr 2024 20:05:27 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 83035
x-xss-protection: 0
last-modified: Thu, 11 Apr 2024 19:10:04 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Thu, 11 Apr 2024 20:05:27 GMT

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 209 KB
76 KB 101ms
101ms Script
application/javascript 216.58.206.72
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-695231162&l=dataLayer&cx=c

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

Security

QUIC, , AES_128_GCM

Server

216.58.206.72 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lhr35s11-in-f8.1e100.net

Software

Google Tag Manager /

Resource Hash

03021c1ca1bd0347e57e25382cb189535b4a9780b3c6cd1edfba459496f9f7d2

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://banking.citi.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 11 Apr 2024 20:05:27 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 77993
x-xss-protection: 0
last-modified: Thu, 11 Apr 2024 19:10:04 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Thu, 11 Apr 2024 20:05:27 GMT

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 217 KB
78 KB 73ms
73ms Script
application/javascript 216.58.206.72
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-819500023&l=dataLayer&cx=c

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

Security

QUIC, , AES_128_GCM

Server

216.58.206.72 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lhr35s11-in-f8.1e100.net

Software

Google Tag Manager /

Resource Hash

ca1fb4a2a8c322e5cd2cda753d2d45e3f7e4ac1d007a3c4cfa2efa18784fdcae

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://banking.citi.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 11 Apr 2024 20:05:27 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 80127
x-xss-protection: 0
last-modified: Thu, 11 Apr 2024 19:10:04 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Thu, 11 Apr 2024 20:05:27 GMT

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 254 KB
87 KB 104ms
104ms Script
application/javascript 216.58.206.72
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-959299794&l=dataLayer&cx=c

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

Security

QUIC, , AES_128_GCM

Server

216.58.206.72 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lhr35s11-in-f8.1e100.net

Software

Google Tag Manager /

Resource Hash

d76a9bdd77714c038618f13c0a1a9a579565cd9e011703dbe08c826547c051dc

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://banking.citi.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 11 Apr 2024 20:05:27 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 89110
x-xss-protection: 0
last-modified: Thu, 11 Apr 2024 19:10:04 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Thu, 11 Apr 2024 20:05:27 GMT

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 214 KB
78 KB 75ms
74ms Script
application/javascript 216.58.206.72
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-10955006959&l=dataLayer&cx=c

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

Security

QUIC, , AES_128_GCM

Server

216.58.206.72 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lhr35s11-in-f8.1e100.net

Software

Google Tag Manager /

Resource Hash

ccd46b7e4b8c9c6f9ac43bbc0713ec461d9d9f8360ee594cc9f080a78e347a9a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://banking.citi.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 11 Apr 2024 20:05:27 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 79464
x-xss-protection: 0
last-modified: Thu, 11 Apr 2024 19:10:04 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Thu, 11 Apr 2024 20:05:27 GMT

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 248 KB
86 KB 178ms
178ms Script
application/javascript 216.58.206.72
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-11172302925&l=dataLayer&cx=c

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

Security

QUIC, , AES_128_GCM

Server

216.58.206.72 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

lhr35s11-in-f8.1e100.net

Software

Google Tag Manager /

Resource Hash

d1315919f890960ea8830814c630d5f16c70baefe183033ac4a53fedd4aa0bab

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://banking.citi.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 11 Apr 2024 20:05:27 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 87618
x-xss-protection: 0
last-modified: Thu, 11 Apr 2024 19:10:04 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Thu, 11 Apr 2024 20:05:27 GMT

GET
H2 200 10200346.json Show response
s.yimg.com/wi/config/ 2 B
514 B 239ms
145ms XHR
application/json 2a00:1288:80:807::1
YAHOO-DEB

General

Check archive.org

Show headers Download Go to

Full URL

https://s.yimg.com/wi/config/10200346.json

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1288:80:807::1 , United Kingdom, ASN203220 (YAHOO-DEB, GB),

Reverse DNS

Software

ATS /

Resource Hash

44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://banking.citi.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 11 Apr 2024 20:05:26 GMT
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=31536000
x-amz-request-id: VVR0ZKXXDDKDK0SN
age: 1
content-length: 22
x-amz-id-2: 2aFD11xgrbtTQALOuz8mXLYlGSRmPnoWzZdjY3s+PzhbgTU/YUeqMwx3YfhXkXBy/0jwb8KM5x+OIIX4vOAfKYd2ZsrXtD/X65/w5MX8O8k=
x-xss-protection: 1; mode=block
referrer-policy: no-referrer-when-downgrade
server: ATS
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
vary: Origin, Access-Control-Request-Headers, Access-Control-Request-Method, Accept-Encoding
access-control-allow-methods: GET
content-type: application/json
access-control-allow-origin: *
cache-control: public,max-age=3600

GET
BLOB 200
OK 354a874f-8527-4f59-acf6-67afa4698cef
https://banking.citi.com/ 75 B
0 Other
application/javascript

General

Check archive.org

Show headers Download Go to

Full URL: blob:https://banking.citi.com/354a874f-8527-4f59-acf6-67afa4698cef
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 4caed94f9975debb1a1ee2ff2e68395802a18a4cf3f3be7ae057f1b97b2c87ff

Request headers

Accept-Language: de-DE,de;q=0.9;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36

Response headers

Content-Length: 75
Content-Type: application/javascript

GET
H2 204 331000549.js Show response
bat.bing.com/p/action/ 0
118 B 74ms
71ms Script
text/plain 2620:1ec:c11::237
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://bat.bing.com/p/action/331000549.js

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2620:1ec:c11::237 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://banking.citi.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: private,max-age=1800
date: Thu, 11 Apr 2024 20:05:26 GMT
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: E4BF14A5AED2484396FD8A463397A2FE Ref B: FRA31EDGE0805 Ref C: 2024-04-11T20:05:27Z
x-cache: CONFIG_NOCACHE

GET
H2 204 0
bat.bing.com/action/ 0
285 B 156ms
151ms Image
text/plain 2620:1ec:c11::237
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://bat.bing.com/action/0?ti=331000549&Ver=2&mid=c66e689b-3f80-4b3e-82b3-246e6819270a&sid=d6d9feb0f83e11eeac28db7827a1f9a6&vid=d6da33e0f83e11ee8155cff736682224&vids=1&msclkid=N&pi=918639831&lg=de-DE&sw=1600&sh=1200&sc=24&tl=Earn%20up%20to%20%245,000%20%7C%20Citi.com&p=https%3A%2F%2Fbanking.citi.com%2Fcbol%2Finvestment%2Fcpwm%2Fdefault.htm%3FBT_TX%3D1%26ProspectID%3D455F85F6E72647FBA011AEE59AEF2397&r=&lt=3034&evt=pageLoad&sv=1&rn=330397

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2620:1ec:c11::237 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://banking.citi.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

pragma: no-cache
strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Thu, 11 Apr 2024 20:05:26 GMT
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: AC5B48000822462B88289E62C10CE088 Ref B: FRA31EDGE0805 Ref C: 2024-04-11T20:05:27Z
x-cache: CONFIG_NOCACHE
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 200 tp2 Show response
p.tvpixel.com/com.snowplowanalytics.snowplow/ 2 B
288 B 359ms
129ms XHR
text/plain 99.83.205.94
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://p.tvpixel.com/com.snowplowanalytics.snowplow/tp2

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

99.83.205.94 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ad37daabd18951e96.awsglobalaccelerator.com

Software

nginx /

Resource Hash

2689367b205c16ce32ed4200942b8b8b1e262dfc70d9bc9fbc77c49699a4f1df

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
sec-ch-ua-platform: "Win32"
Referer: https://banking.citi.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
Content-Type: application/json; charset=UTF-8

Response headers

access-control-allow-origin: https://banking.citi.com
date: Thu, 11 Apr 2024 20:05:27 GMT
strict-transport-security: max-age=31536000; includeSubDomains
access-control-allow-credentials: true
server: nginx
content-length: 2

GET
H2 200 p
sb.scorecardresearch.com/ 43 B
301 B 187ms
62ms Image
image/gif 18.66.196.37
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sb.scorecardresearch.com/p?c1=2&c2=34402982&ns_type=hidden&ns_event=page_view&c6=citi-d4f85824-1351-4554-91ff-fdb56f962c5c&c7=https%3A%2F%2Fbanking.citi.com%2Fcbol%2Finvestment%2Fcpwm%2Fdefault.htm%3FBT_TX%3D1%26ProspectID%3D455F85F6E72647FBA011AEE59AEF2397&c8=Earn%20up%20to%20%245%2C000%20%7C%20Citi.com&c9=&rn=1712865927138
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.66.196.37 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-66-196-37.mxp63.r.cloudfront.net
Software: /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://banking.citi.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 11 Apr 2024 20:05:27 GMT
via: 1.1 3889464930fc240ec6e67dcf9392dcc2.cloudfront.net (CloudFront)
accept-ch: UA, Platform, Arch, Model, Mobile
x-amz-cf-pop: MXP63-P1
x-cache: Miss from cloudfront
content-type: image/gif
content-length: 43
x-amz-cf-id: n7o34-QL-u1yScik5IW67VNPQWgxk8ZxNP8CyYGTYy7qRNlIM4V7CQ==

OPTIONS
H2 200 tp2
p.tvpixel.com/com.snowplowanalytics.snowplow/ Frame 0
0 377ms
132ms Preflight 99.83.205.94
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://p.tvpixel.com/com.snowplowanalytics.snowplow/tp2

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

99.83.205.94 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ad37daabd18951e96.awsglobalaccelerator.com

Software

nginx /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://banking.citi.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Content-Type, SP-Anonymous
access-control-allow-origin: https://banking.citi.com
access-control-max-age: 600
content-length: 0
date: Thu, 11 Apr 2024 20:05:27 GMT
server: nginx
strict-transport-security: max-age=31536000; includeSubDomains

GET
H2 200 12.00593e070a6f1562a8b4.chunk.js Show response
siteintercept.qualtrics.com/dxjsmodule/ 73 KB
21 KB 75ms
65ms Script
application/javascript 104.17.208.240
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://siteintercept.qualtrics.com/dxjsmodule/12.00593e070a6f1562a8b4.chunk.js?Q_CLIENTVERSION=2.4.0&Q_CLIENTTYPE=web&Q_BRANDID=banking.citi.com

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.17.208.240 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

773476fc4041f913eb57d338efa749e0c2b63828f086c83da65c3d3aeb51fa73

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://banking.citi.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 11 Apr 2024 20:05:27 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: br
age: 243486
content-security-policy-report-only: frame-ancestors 'self' *.qualtrics.com *.my.salesforce.com *.visualforce.com *.visual.force.com *.lightning.force.com; report-uri https://sjc1.qualtrics.com/csp-report
edge-control: max-age=604800
referrer-policy: strict-origin-when-cross-origin
last-modified: Mon, 01 Apr 2024 18:13:43 GMT
server: cloudflare
etag: W/"125c9-18e9addfbd8"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=604800, s-maxage=604800
permissions-policy: camera=(), geolocation=(), microphone=()
timing-allow-origin: *
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept
cf-ray: 872d976cfba33546-WAW

POST
H2 200 Targeting.php Show response
siteintercept.qualtrics.com/WRSiteInterceptEngine/ 9 KB
2 KB 104ms
100ms XHR
application/json 104.17.208.240
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://siteintercept.qualtrics.com/WRSiteInterceptEngine/Targeting.php?Q_ZoneID=ZN_3VI8kkudS0JJRFc&Q_CLIENTVERSION=2.4.0&Q_CLIENTTYPE=web

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.17.208.240 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

2e69ca332cb31dddff8d9918d641d2e7076314f3e0bb4a957260595921e312f0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
sec-ch-ua-platform: "Win32"
Referer: https://banking.citi.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
Content-type: application/x-www-form-urlencoded

Response headers

date: Thu, 11 Apr 2024 20:05:27 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
content-encoding: br
content-security-policy-report-only: frame-ancestors 'self' *.qualtrics.com *.my.salesforce.com *.visualforce.com *.visual.force.com *.lightning.force.com; report-uri https://sjc1.qualtrics.com/csp-report
referrer-policy: strict-origin-when-cross-origin
server: cloudflare
content-type: application/json
access-control-allow-origin: https://banking.citi.com
cache-control: no-store, no-cache, must-revalidate, max-age=0
access-control-allow-credentials: true
permissions-policy: camera=(), geolocation=(), microphone=()
trace-id: cd985c885b6c7b5c
timing-allow-origin: *
cf-ray: 872d976d7ca73546-WAW

GET
H/1.1 200
OK p13n.min.js Show response
cdn.boomtrain.com/p13n/citibank/ 93 KB
30 KB 203ms
94ms Script
application/javascript 18.173.154.117
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.boomtrain.com/p13n/citibank/p13n.min.js
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 18.173.154.117 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-173-154-117.muc50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 78570cd5a9bcc8cdbd843bfaada3505723a95220767990aa3fd9d59670232bb7

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://banking.citi.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-amz-version-id: KmnMxkUg.4ppsnu03K6LrWsdMwDcyAKL
Content-Encoding: gzip
Via: 1.1 fe6d656eba9969a63bb94889f81e9bf8.cloudfront.net (CloudFront)
Date: Thu, 11 Apr 2024 19:47:18 GMT
X-Amz-Cf-Pop: MUC50-P3
Age: 1154
x-amz-server-side-encryption: AES256
Transfer-Encoding: chunked
X-Cache: Hit from cloudfront
Connection: keep-alive
Last-Modified: Wed, 10 Apr 2024 02:39:57 GMT
Server: AmazonS3
ETag: W/"633c740caea8028711aa84db564e5131"
Vary: Accept-Encoding
Content-Type: application/javascript
Cache-Control: public, max-age=3600
X-Amz-Cf-Id: tGtIw6YNymYcQ9uGS14x9pW6YNVh3I_bjOgRPvHMNyUrHjF8-qnOPQ==

GET
H2 200 sp.pl
sp.analytics.yahoo.com/ 43 B
633 B 249ms
61ms Image
image/gif 212.82.100.181
YAHOO-IRD

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://sp.analytics.yahoo.com/sp.pl?a=10000&d=Thu%2C%2011%20Apr%202024%2020%3A05%3A27%20GMT&n=-2d&b=Earn%20up%20to%20%245%2C000%20%7C%20Citi.com&.yp=10200346&f=https%3A%2F%2Fbanking.citi.com%2Fcbol%2Finvestment%2Fcpwm%2Fdefault.htm%3FBT_TX%3D1%26ProspectID%3D455F85F6E72647FBA011AEE59AEF2397&enc=UTF-8&yv=1.15.1&tagmgr=gtm%2Censighten

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

212.82.100.181 Dublin, Ireland, ASN34010 (YAHOO-IRD, GB),

Reverse DNS

spdc.pbp.vip.ir2.yahoo.com

Software

ATS /

Resource Hash

0e4b1e428a2198ef747010c094101c257b568a97cdcc0f31ed5e9868cc835b39

Security Headers

Name	Value
Content-Security-Policy	sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://banking.citi.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

pragma: no-cache
date: Thu, 11 Apr 2024 20:05:27 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
server: ATS
content-security-policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-frame-options: DENY
content-type: image/gif
cache-control: no-cache, private, must-revalidate
accept-ranges: bytes
content-length: 43
expires: Thu, 11 Apr 2024 20:05:27 GMT

GET
H2 200 CoreModule.js Show response
siteintercept.qualtrics.com/dxjsmodule/ 102 KB
30 KB 73ms
73ms Script
application/javascript 104.17.208.240
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://siteintercept.qualtrics.com/dxjsmodule/CoreModule.js?Q_CLIENTVERSION=2.4.0&Q_CLIENTTYPE=web&Q_BRANDID=citifeedback

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.17.208.240 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

984227c0d097ac96cff8b8ae797de2a34f79a84438685db3c72a1c226fd5a23b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://banking.citi.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 11 Apr 2024 20:05:27 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: br
age: 243486
content-security-policy-report-only: frame-ancestors 'self' *.qualtrics.com *.my.salesforce.com *.visualforce.com *.visual.force.com *.lightning.force.com; report-uri https://sjc1.qualtrics.com/csp-report
edge-control: max-age=604800
referrer-policy: strict-origin-when-cross-origin
last-modified: Mon, 01 Apr 2024 18:13:43 GMT
server: cloudflare
etag: W/"19639-18e9addfbd8"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=604800, s-maxage=604800
permissions-policy: camera=(), geolocation=(), microphone=()
timing-allow-origin: *
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept
cf-ray: 872d976e9eec3546-WAW

GET
H/1.1 200
OK resolve Show response
people.api.boomtrain.com/identify/ 142 B
457 B 529ms
157ms XHR
application/json 52.87.59.181
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://people.api.boomtrain.com/identify/resolve?data=eyJjb29raWUiOnsiYnNpbiI6IiJ9LCJxdWVyeXN0cmluZyI6e30sImV4dGVybmFsX2lkcyI6eyJ6eW5jIjoiOGNlNGI4ODAtZjgxOC00ZWFlLWFhMGEtODYxZGQzN2NmMzhmOjE3MTI4NjU5MjcuMTUwMTkyNSJ9fQ%3D%3D&site_id=citibank
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.87.59.181 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-87-59-181.compute-1.amazonaws.com
Software: nginx /
Resource Hash: 32c07d9f90e2cde824d029e7651077624c39443117d2b61664d4b7210b509339

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://banking.citi.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Date: Thu, 11 Apr 2024 20:05:27 GMT
Server: nginx
Access-Control-Allow-Methods: GET,PUT,POST,DELETE
Content-Type: application/json
Access-Control-Allow-Origin: *
Connection: keep-alive
Access-Control-Allow-Headers: X-Requested-With,Content-Type,Authorization,x-app-id
Content-Length: 142

GET
H2 200 7.7f92166a279ec8ccbb92.chunk.js Show response
siteintercept.qualtrics.com/dxjsmodule/ 3 KB
1 KB 66ms
66ms Script
application/javascript 104.17.208.240
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://siteintercept.qualtrics.com/dxjsmodule/7.7f92166a279ec8ccbb92.chunk.js?Q_CLIENTVERSION=2.4.0&Q_CLIENTTYPE=web&Q_BRANDID=citifeedback

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.17.208.240 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e2b8e58c49dfe86a02acbced8d3ddf91c303df4af7009ab38ad9e6b89fde24ad

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://banking.citi.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 11 Apr 2024 20:05:27 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: br
age: 243486
content-security-policy-report-only: frame-ancestors 'self' *.qualtrics.com *.my.salesforce.com *.visualforce.com *.visual.force.com *.lightning.force.com; report-uri https://sjc1.qualtrics.com/csp-report
edge-control: max-age=604800
referrer-policy: strict-origin-when-cross-origin
last-modified: Mon, 01 Apr 2024 18:13:43 GMT
server: cloudflare
etag: W/"b52-18e9addfbd8"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=604800, s-maxage=604800
permissions-policy: camera=(), geolocation=(), microphone=()
timing-allow-origin: *
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept
cf-ray: 872d976f18113546-WAW

GET
H2 200 1.2211346a24b96c334744.chunk.js Show response
siteintercept.qualtrics.com/dxjsmodule/ 29 KB
7 KB 69ms
68ms Script
application/javascript 104.17.208.240
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://siteintercept.qualtrics.com/dxjsmodule/1.2211346a24b96c334744.chunk.js?Q_CLIENTVERSION=2.4.0&Q_CLIENTTYPE=web&Q_BRANDID=citifeedback

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.17.208.240 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

442c5f94f41f419cb2d62746624f7ed4e7d5c6481b2d741d632d4b920fc1dc8d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://banking.citi.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 11 Apr 2024 20:05:27 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: br
age: 243485
content-security-policy-report-only: frame-ancestors 'self' *.qualtrics.com *.my.salesforce.com *.visualforce.com *.visual.force.com *.lightning.force.com; report-uri https://sjc1.qualtrics.com/csp-report
edge-control: max-age=604800
referrer-policy: strict-origin-when-cross-origin
last-modified: Mon, 01 Apr 2024 18:13:43 GMT
server: cloudflare
etag: W/"73f8-18e9addfbd8"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=604800, s-maxage=604800
permissions-policy: camera=(), geolocation=(), microphone=()
timing-allow-origin: *
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept
cf-ray: 872d976f18133546-WAW

GET
H2 200 FeedbackButtonModule.js Show response
siteintercept.qualtrics.com/dxjsmodule/ 64 KB
23 KB 73ms
72ms Script
application/javascript 104.17.208.240
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://siteintercept.qualtrics.com/dxjsmodule/FeedbackButtonModule.js?Q_CLIENTVERSION=2.4.0&Q_CLIENTTYPE=web&Q_BRANDID=citifeedback

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.17.208.240 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

de6c5b4c59e1122b4e9665ef6d348d8d87657a516e806ab8e16aea5dc597cd8d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://banking.citi.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 11 Apr 2024 20:05:27 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: br
age: 243485
content-security-policy-report-only: frame-ancestors 'self' *.qualtrics.com *.my.salesforce.com *.visualforce.com *.visual.force.com *.lightning.force.com; report-uri https://sjc1.qualtrics.com/csp-report
edge-control: max-age=604800
referrer-policy: strict-origin-when-cross-origin
last-modified: Mon, 01 Apr 2024 18:13:43 GMT
server: cloudflare
etag: W/"fefc-18e9addfbd8"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=604800, s-maxage=604800
permissions-policy: camera=(), geolocation=(), microphone=()
timing-allow-origin: *
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept
cf-ray: 872d976f18153546-WAW

GET
H2 200 Asset.php Show response
siteintercept.qualtrics.com/WRSiteInterceptEngine/ 10 KB
2 KB 172ms
70ms XHR
application/json 104.17.208.240
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://siteintercept.qualtrics.com/WRSiteInterceptEngine/Asset.php?Module=SI_0AioryRkl8bxHM2&Version=25&Q_ORIGIN=https://banking.citi.com&Q_CLIENTVERSION=2.4.0&Q_CLIENTTYPE=web&Q_BRANDTIER=lIjhYuMl2g&Q_ARCACHEVERSION=21

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.17.208.240 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

4b99a4e92de3333bf62e8c2766dc1a880f1c19308c1591d2516974f6369b721a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://banking.citi.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

servershortname
date: Thu, 11 Apr 2024 20:05:27 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: br
age: 223250
content-security-policy-report-only: frame-ancestors 'self' *.qualtrics.com *.my.salesforce.com *.visualforce.com *.visual.force.com *.lightning.force.com; report-uri https://sjc1.qualtrics.com/csp-report
p3p: CP="CAO DSP COR CURa ADMa DEVa OUR IND PHY ONL UNI COM NAV INT DEM PRE"
edge-control: max-age=604800
referrer-policy: strict-origin-when-cross-origin
last-modified: Tue, 09 Apr 2024 06:04:37 GMT
server: cloudflare
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: *
cache-control: public, max-age=604800, s-maxage=604800, max-age=315360000
access-control-allow-credentials: false
permissions-policy: camera=(), geolocation=(), microphone=()
cf-ray: 872d976fc9d170bd-WAW
expires: Fri, 07 Apr 2034 06:04:33 GMT

GET
H2 200 Asset.php Show response
siteintercept.qualtrics.com/WRSiteInterceptEngine/ 2 KB
766 B 172ms
71ms XHR
application/json 104.17.208.240
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://siteintercept.qualtrics.com/WRSiteInterceptEngine/Asset.php?Module=CR_6sPqDX4wKQujPO6&Version=9&Q_InterceptID=SI_0AioryRkl8bxHM2&Q_ORIGIN=https://banking.citi.com&Q_CLIENTVERSION=2.4.0&Q_CLIENTTYPE=web&Q_BRANDTIER=lIjhYuMl2g&Q_ARCACHEVERSION=21

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.17.208.240 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

566095a5f65029a8730735e82ff6cf43336a92723d96484db740011b88467aa1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://banking.citi.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

servershortname
date: Thu, 11 Apr 2024 20:05:27 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: br
age: 542974
content-security-policy-report-only: frame-ancestors 'self' *.qualtrics.com *.my.salesforce.com *.visualforce.com *.visual.force.com *.lightning.force.com; report-uri https://sjc1.qualtrics.com/csp-report
p3p: CP="CAO DSP COR CURa ADMa DEVa OUR IND PHY ONL UNI COM NAV INT DEM PRE"
edge-control: max-age=604800
referrer-policy: strict-origin-when-cross-origin
last-modified: Fri, 05 Apr 2024 13:15:53 GMT
server: cloudflare
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: *
cache-control: public, max-age=604800, s-maxage=604800, max-age=315360000
access-control-allow-credentials: false
permissions-policy: camera=(), geolocation=(), microphone=()
cf-ray: 872d976fc9d470bd-WAW
expires: Mon, 03 Apr 2034 13:15:53 GMT

GET
H3 200 favicon.ico
banking.citi.com/ 2 KB
3 KB 147ms
147ms Other
image/x-icon 35.190.22.40
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://banking.citi.com/favicon.ico
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 35.190.22.40 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 40.22.190.35.bc.googleusercontent.com
Software: /
Resource Hash: 3ceb6abdaf923b247b264301b13f3c177e976add13d557a07c6edd4d680cbf6e

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://banking.citi.com/cbol/investment/cpwm/default.htm?BT_TX=1&ProspectID=455F85F6E72647FBA011AEE59AEF2397
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 11 Apr 2024 20:05:27 GMT
via: 1.1 google
last-modified: Tue, 21 Sep 2004 14:41:39 GMT
etag: "1c80ad1ae99fc41:0"
content-type: image/x-icon
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2550

GET
H2 200 Graphic.php
iad1.qualtrics.com/WRQualtricsSiteIntercept/ 2 KB
3 KB 214ms
70ms Image
image/png 184.30.20.101
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://iad1.qualtrics.com/WRQualtricsSiteIntercept/Graphic.php?IM=IM_2ghDuHHjeSOirNc

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

184.30.20.101 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a184-30-20-101.deploy.static.akamaitechnologies.com

Software

Resource Hash

25f4eeb23f67fe1d74534ed37230ecd54ab4f57524276970dcbeaaf3b0fc64f9

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://banking.citi.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 11 Apr 2024 20:05:27 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
content-security-policy-report-only: frame-ancestors 'self' *.qualtrics.com *.my.salesforce.com *.visualforce.com *.visual.force.com *.lightning.force.com; report-uri https://sjc1.qualtrics.com/csp-report
content-disposition: inline; filename=feedback.png
content-length: 2196
x-request-id: 7919c960-534b-47e7-96b9-cecf65061421
referrer-policy: strict-origin-when-cross-origin
etag: "e6ed675f115fb1568bb1aabc00aa3f30"
content-type: image/png
access-control-allow-origin: *
x-transaction-id: c30061e9-5e68-49a1-874c-43578fa39639
cache-control: public, max-age=52
permissions-policy: camera=(), geolocation=(), microphone=()
x-robots-tag: noindex
expires: Thu, 11 Apr 2024 20:06:19 GMT

POST
H2 200 / Show response
siteintercept.qualtrics.com/WRSiteInterceptEngine/ 45 B
217 B 99ms
96ms XHR
text/plain 104.17.208.240
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://siteintercept.qualtrics.com/WRSiteInterceptEngine/?Q_Impress=1&Q_CID=CR_6sPqDX4wKQujPO6&Q_SIID=SI_0AioryRkl8bxHM2&Q_ASID=AS_07210024&Q_CLIENTVERSION=2.4.0&Q_CLIENTTYPE=web&r=1712865927913

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.17.208.240 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f47f21063dfdcbdeffed3d97689b45efae7a52401cd7fc5b8d07c42d2f232ab9

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
sec-ch-ua-platform: "Win32"
Referer: https://banking.citi.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
Content-type: application/x-www-form-urlencoded

Response headers

date: Thu, 11 Apr 2024 20:05:27 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-encoding: br
cf-cache-status: DYNAMIC
x-content-type-options: nosniff
content-security-policy-report-only: frame-ancestors 'self' *.qualtrics.com *.my.salesforce.com *.visualforce.com *.visual.force.com *.lightning.force.com; report-uri https://sjc1.qualtrics.com/csp-report
referrer-policy: strict-origin-when-cross-origin
server: cloudflare
vary: Accept-Encoding
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://banking.citi.com
cache-control: no-store, no-cache, must-revalidate, max-age=0
access-control-allow-credentials: true
permissions-policy: camera=(), geolocation=(), microphone=()
trace-id: 614f9e4d59a00038
cf-ray: 872d97719cd170bd-WAW

GET
H2 200 wr-dialog-close-btn-white.png
siteintercept.qualtrics.com/WRQualtricsShared/Graphics/siteintercept/ 254 B
538 B 92ms
90ms Image
image/png 104.17.208.240
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://siteintercept.qualtrics.com/WRQualtricsShared/Graphics/siteintercept/wr-dialog-close-btn-white.png

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.17.208.240 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

cd5496f75a7c1029bc681f639794b83f034d5ecd884e8514ae12b13eee9eec70

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://banking.citi.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

expires: Fri, 25 Nov 2033 03:51:07 GMT
date: Thu, 11 Apr 2024 20:05:27 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
age: 11722460
cf-polished: origSize=759
content-security-policy-report-only: frame-ancestors 'self' *.qualtrics.com *.my.salesforce.com *.visualforce.com *.visual.force.com *.lightning.force.com; report-uri https://sjc1.qualtrics.com/csp-report
p3p: CP="CAO DSP COR CURa ADMa DEVa OUR IND PHY ONL UNI COM NAV INT DEM PRE"
content-length: 254
referrer-policy: strict-origin-when-cross-origin
last-modified: Mon, 06 Nov 2023 19:06:31 GMT
cf-bgj: imgq:85,h2pri
server: cloudflare
vary: Accept-Encoding
content-type: image/png
cache-control: max-age=315360000, public
permissions-policy: camera=(), geolocation=(), microphone=()
accept-ranges: bytes
cf-ray: 872d97719d393546-WAW
trace-id: 6e2a2a13d45ebf88
servershortname

POST
H2 200 track Show response
events.api.boomtrain.com/event/ 2 B
209 B 394ms
129ms XHR
text/plain 3.220.94.22
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://events.api.boomtrain.com/event/track
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.220.94.22 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-220-94-22.compute-1.amazonaws.com
Software: nginx /
Resource Hash: 565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
sec-ch-ua-platform: "Win32"
Referer: https://banking.citi.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: *
date: Thu, 11 Apr 2024 20:05:28 GMT
server: nginx
access-control-allow-headers: X-Requested-With, Content-Type, Authorization, x-app-id
content-length: 2
access-control-allow-methods: GET, PUT, POST, DELETE
content-type: text/plain

GET
H2 204 r.rnc
data.privacy.ensighten.com/privacy/v1/b/ 0
106 B 44ms
43ms Image
text/plain 3.124.119.57
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://data.privacy.ensighten.com/privacy/v1/b/r.rnc?n=1&c=1129&i=5r0cn4&p=na_prod&s=15736&d=8HB7InZlcnNpb24iOiIxLjAuMCIsImdhdGV3YXkiOiIyLjMuNjExIiwiY2xpZW50SWQiOjExMjksInB1Ymxpc2hQYXRoIjoibmFfcHJvZCIsImluc3RhbmNlSWQiOiI1cjBjbjQiLCJwYWNrZXQiOjEsIm1vZGUiOiJlbmZvcmNlWgDxMG9va2llcyI6e30sImVudmlyb25tZW50IjoiQ0JPTCBQcml2YWN5IiwicmVxdWVzdHMiOlt7ImRlc3RpbmF0absA8TpodHRwczovL2RwbS5kZW1kZXgubmV0L2lkP2RfdmlzaWRfdmVyPTQuNC4wJmRfZmllbGRncm91cD1NQyZkX3J0YmQ9anNvbiZkKAASMggA8FBpZnk9MSZkX29yZ2lkPTYxODM0RDlCNTIyOEE3NDMwQTQ5MEQ0NSU0MEFkb2JlT3JnJmRfbnNpZD0wJnRzPTE3MTI4NjU5MjYxNDIiLCJ0eXBlIjoieGhyIiwic3RhchABCCQAAP4AAGABBxQAgDMsInNvdXJjOQDBWEhSX01BTkFHRVIiQQDRdHVzIjoiYWxsb3dlZB8BQGFzb24eAdRdLCJkYXRhUGF0dGVyEgCybGlzdCI6W10sImlmAM8zMzc0MzE2NTIzfSxQAcAfM1ABZh80UAEH8QZjaXRpLmJyaWRnZXRyYWNrLmNvbS8KACAvP2QC9hE3MTgxJnJhbmRvbT0yLjkyMTYwNDgwNTU5MjcxRSsxN0gCMmltZwcCGnJIAh82-AAAJzY0SAIxbXV0NgOiT2JzZXJ2ZXJDTEgAAk8CP2xvYUwCIa8yMDA2MzA5OTIw_AAHgWJhbmtpbmcuBAEA-ACwY2JvbC9pbnZlc3TxA_YdL2Nwd20vanMvbWFpbi43NGI4OGE4ZTc0ZjIxOTVhYjU3OS5idW5kbGUuanMIAWJzY3JpcHTDAA8LARAvNzgLAU2vMTE5MTk2MTcyNQsBB7Z0YWdtYW5hZ2VyMQ8B9lZvbmUvdjEvcHJvZmlsZXMvODM0NTA1MDBlNmNkZGJlNDAzYjY5YzViNjVlOGFjOTJlNjI3ZTk1ODdkNDhmNjExZjYwNmI0NWM0ZjAyMTg2Nz9yZXR1cm5WYWx1ZXM9QUxMX05FVzkBD4kEBR85QQIAABQAD4kESI84MTYzMDgzMDkDCA8yAf8gAhkDkS5jcmF6eWVnZ2oEY3BhZ2VzL_IHomVkL2NvbW1vbi0rAP8Tcy82NzM1Zjk1OTRkNmJiOGE0ZjFmZTU2YzZiM2UyMWNmNXkDFS01MHwFPzIxMXkDTp80MTAxNjk3MTF5AwfxAG5leHVzLmVuc2lnaHRlbhUBAJAEIi9uwggTLxQF8BZvbXBvbmVudC5waHA_bmFtZXNwYWNlPUJvb3RzdHJhcHBlciZzSAUwY0pzBAkfPVkADmNjb2RlLyY3CfAVZWRPbj1UdWUlMjBNYXIlMjAyNiUyMDE4OjQ3OjEzJTIwR01UFgBSMDI0JkN6CSBEPXkJgSZQYWdlSUQ98AicJTNBJTJGJTJGWgUwJTJGXAU2JTJGXgUAFAD2PnB3bSUyRmRlZmF1bHQuaHRtJTNGQlRfVFglM0QxJTI2UHJvc3BlY3RJRCUzRDQ1NUY4NUY2RTcyNjQ3RkJBMDExQUVFNTlBRUYyMzk3SgQCPwIPgwUDHjIKAhgzjgbCaW5zZXJ0QmVmb3JlQgAPiAYqrzMyMTk4MTgyMjkEAv95DlEGGTIEAg-SCEIECgIfM5IICA-1AxPwBGM2NWEzNjA5ZTFiZWVkNzI5NTWbCPADZmFjOGNkMzFkLmpzP2NvbmRpjAyQSWQwPTQ4MDg4NQ0SdPMLDyADBy8yMxwBACc5MioFDyADPJ8xNjEwOTMwMjQgAykBywQPFgFKHjQ2BAkWAQ8yAkIEHAEfNTICLv8QN2M4YWUxZjljMjA2OTMwMDI4NjcyOTQ5YzY3MDNmNjICAV80OTk2M1MFEQ8zAl6fMjg5NTg2MDY1Jw4ID0kDEw8XAUsPNAJiBR0BD7sKCA8dARP_EDkzOTM1YTQwOTY1MTY0NDcxNzJkOWQzZjFkMjM3MTA0AgBfMzMwNzIzAoKvMTYxODc1MDY4NoYHKAFmBA8WAUoPMgJiBRwBHzccAS3_EWYwZGIxY2Y0NDk2YzhiNDJjNWExYjJmYTQwYjRmMTU3mAYAXzk3MDk5MwKCnzA3OTgxMjkyMxcBjA80AmIFHQEfODQCLf4RNDJmNGI4NzI4NWU1NGZkMTFkM2Y0MmZhOTAxYjk3NjE0AlA5MjY3MxYWD80IEA8dAWKfMTQzMzk2NDAxHQEu_xA1MDExNzUxMjkwODNkNjk1YjQzM2Q0MGU0M2RjZjRkgwUAXzk1MTMwHQEoCOAVD9QIRH83NDQyNTI2FA8pAYoF_hFhOTYwN2JiZWIyZTZlMDZjMDc4MDFkNDc0NTkwMDc5OToCRzg2NzWxFA8GCx0IHAEPBgs8nzQwMDA0NDg2NaMTCA-2BxMPFgFKD08DAQgWAQ8yAkIFHAEPvAcuUGU2YjlmBwuAMjBlZmNjOWXOFb1lNjA0Yjg5N2M4YzICbzMwMTMzMzMCFA8dAQEIWRAPHQFCnzE3OTA5MzQ4NWwELv0RZjEyMDQ0OWRjZGI4NGMzYjZkMGY1OGM4Yjk4YWQ4YTMdARA0QwwPvAcUDxwBYlAzODk0MD0UDwsLLv8QNzM0OWZjYjg1MmRjMDY0YTc4ZWY1NWUxMzJiNzI0NKUGAU8wNjM3cg8UDx0BYp80MjI5ODcwMTFWAy7_EDhhYTRiNjczZWI1MjBiZjNiNTBjMTg2Yzk0YTE0ZDaIBQBfMjE5MDj1CSUoMzIxGQ-IBT2PMTA2OTUyOTMzAi4PFgFKDjICChYBD2sEQhQ0HAEPpAYIDPgVEC_2FQ9SGwGwNjMzLjNjODMyYTKIBZ9kNGUwM2JlNDFRGxwAPRsiZW4-HgPcHjczMzeuEg8KAUKfMjMwMTg0ODA2mBEIDwoBFv8JMzAwLjAwYTBmYTY0NGNhMWVkMGJiYmFjCgEwLzQwCgFNnzM2MzI4ODIyOIsRCHdtZXRyaWNzWBwPBSEPT0EmbWPlIBfwDm1pZD0xMjM0OTgxMDUxMDk1NDgxODgwMzE5NzU2ngCaOTUxOTk5NjgyByEYMxQVD34cBD0zODH7EwEUAA9-HEefMjczODQ2NjI3hQQID1UB_0MP0x1SBvgGD3ICBBA0ixgL1QQBFAAPcgJHnzE2NDgzMDc1N-wQCA8dAf8LkWMxLnJmaWh1YuUln2pzL3RjLm1pbp8eFBAySxgM8gEvNTa9BU5_Mjg0NzAzNnsZCQ_HBhZQOTAwLjciC_8ANDQ3ZTFiMTU2ZDM2ZDI4xwYbEDOzBgsKAS81MKkfTlA0MjUwNBILDwADCA8KARb_CTI1My4yNDdkODgzM2VjZTdkZWVlMjdhMgoBMADHIAUGBA_bCEKfMTE4NDEwNTY0fAYIDwoEUh8_LCQiLjU1vxwBFAAFNgEPtSg_AiwkLzY2MgH_O6Z3d3cuZ29vZ2xlbgIBHCNwZ3RhZy9qc5woYERDLTYyNjoTBlQHD9QTCAAzJgxbBB82LAxOEDHMCU81OTc34B4IoWNkbi5nYnFvZnPjAAD_I0AtbmEtwSz_AC9wL2RldGVjdG9yLWRvbVUGGg4mDi82MK4TTp8yNjY1MDI1NzDgFQgA4QCgY29ycGNyZWRpdOEkwWljLnR0Lm9tdHJkY0MHQHJlc3R8KJJkZWxpdmVyeT_vLR89OwABQCZzZXMxLvMVSWQ9NjhhZjVjYWVmYzY5NDVjMWIwOTdiMTk4NDllYjMxYjImaiZnPTIuMTAurBwPjAkEPTYwOf4LARQAD1AER58xMzM1NDA5MTZnDwgPBgEBD0EBhB4xeicQNhQAD0EBUA_aEgiUMjA3NjY2OTlwtwkB_isQYYImIGw_mS_0BDkmcmE9OTM0JnJiPTY0OCZjYT00ADAmX29LL5Y2OTE3NSZfdD3SJgAvLKAmX3Jldj0xJl9wpRgACQBQb3JkZXKiDrEmc3N2X2N1dWlkPQsAwnBhY2thZ2U9bnVsbBEAMHJvZBUvBxIAMGFnZe0nDGUAL3BlcSdxQCZwZj0oAZA4ODU4NTI1OTNdMBg1NiJTaWZyYW1HJwoMLT40NTVaAyc4NfQKD9sTPI8zMjU2MTE1NlgDCQTjAQ8XAv9qHzYXAgwP9wpCBR0CDzQECA-TCBdwOTMyMiZsPfIyr0xheWVyJmN4PWOkCBEvNTb-AAAfORUDSJ80MTU3MjU4MDDAEwgP-ABSHjf2AQn4AA_2AUIF_gAPuwsID_4AFl81NjcxMPYBNhk3qgkPCwU8fzI0Njk2MTPmGAoP-ABSDvYBCvgAD_YBQgX-AA9hCQgP_gAVXzQxNTgx7AM3KDcx9REP9gE8jzE5MDcxMTM28hsJD_gAUg_2AQAJ-AAP9gFCBf4AD-MRCA_-ABUgMjbyCA_sAyQP_gAAHzKGDk-POTc1ODcwODL-AAgP4RITIWltsjPwCHBob25lSWNvbi5jODY5MzlkNWJiNzg0RCBgNTUzLnN2DDgDoSUPGTgEPTU0OPUFEDcAFAUbDA8JAkKfNDEwNDEyMTQ5CwF6DmcODwsBUcAxMDQxMjE0OTh9XX0
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 3.124.119.57 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-124-119-57.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://banking.citi.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 11 Apr 2024 20:05:28 GMT
cache-control: no-cache, no-store
server: nginx
expires: Thu, 11 Apr 2024 20:05:27 GMT

GET
H2 204 r.rnc
data.privacy.ensighten.com/privacy/v1/b/ 0
106 B 45ms
44ms Image
text/plain 3.124.119.57
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://data.privacy.ensighten.com/privacy/v1/b/r.rnc?n=2&c=1129&i=5r0cn4&p=na_prod&s=14783&d=8HB7InZlcnNpb24iOiIxLjAuMCIsImdhdGV3YXkiOiIyLjMuNjExIiwiY2xpZW50SWQiOjExMjksInB1Ymxpc2hQYXRoIjoibmFfcHJvZCIsImluc3RhbmNlSWQiOiI1cjBjbjQiLCJwYWNrZXQiOjEsIm1vZGUiOiJlbmZvcmNlWgDxMG9va2llcyI6e30sImVudmlyb25tZW50IjoiQ0JPTCBQcml2YWN5IiwicmVxdWVzdHMiOlt7ImRlc3RpbmF0absA8BVodHRwczovL2JhbmtpbmcuY2l0aS5jb20vY2JvbC9pbnZlc3RVAPAqL2Nwd20vaW1hZ2VzL2Fkdmlzb3IuMjE5N2ZiYmUzMjQ1NDI2NWQ3ZTUuc3ZnIiwidHlwZSI6ImltDQBAc3RhcsUAwDcxMjg2NTkyNjU0OLMAABUBBRQAoDc0MSwic291cmM5ADFtdXSjAPELT2JzZXJ2ZXJDTCIsInN0YXR1cyI6ImxvYWTYAEBhc29u1wDUXSwiZGF0YVBhdHRlchIAs2xpc3QiOltdLCJpagC_MjMyNDAyMDY2fSwJATL_D3Bob25lSWNvbi42MWM1MzI4NmQ3NWI3NzY2ZjFiOQsBip84MTQ5ODQ3OTULATT_EmNhcGFiaWxpdGllcy42OTkzYzk3NDk3YzUxZmM1NzMyNg4BKB8yGQJNnzM2OTY4NDE2Nw4BNWFyYW5rZWQaAvAINWI3ODk2NTIxNjRiMTczNzI0ZDMuanAYAw8lAyAvNTgMAU2vMjkzMDkyNjQ3MxoCNHBoZWFkZXItWgT_Ei1sb2dvLW1vYi5hOGU2NjNlY2Q1MDdiNDQzYjQ3Ny5wbhYBJB82OwROrzE4MzQwNzQ3OTcWATT_EW1hcmtldEdyYXBoLjMzMjY2ZmQ0N2YzZWU3ZDE3NzMwLwMnLzc0IwJNrzQzMTA0Njg1ODENATRAcHJpY34G_wVhOGE4MDJkZmIxNjRjYWZiNzE2NwkBJi84MAkBTq8xODAzMzUzMDI4CQEHAOAH9g0ucmVwb3J0Lm5hY3VzdG9tZXJleHBlcmllbmNlcweSZ2xhc3Nib3gvLgDyHmluZy83OThiMmYxMi05MTYyLTRhOTQtOTFlZS04MDVkODgzY2EyNjYvY2xzXzMAID9fDADxHHM9ZDQzNjExN2YtOTllZS00YzhmLTkwY2YtODQzNzNiOGYyZmY3JTNBMCYwAPYcdj05N2I2MWQ2Yy02MTBmLTQ0ODAtOGE3NC1lZmNjM2NlOTk1MDAmcHY9MtoHMnhocpIHCtoHPTkwM9oHARQABdoHslhIUl9NQU5BR0VSQQAC0wdvYWxsb3dl1gchnzM3MTE2OTY1M4UB_47xBXd3dy5nb29nbGV0YWdtYW5hZ2VybAr2Cmd0YWcvanM_aWQ9QVctMTEzNjA2OTc3MzNvAmJzY3JpcHQxAgpyAhA48AQjZW7iCQFgCkc3MDU3BAXCaW5zZXJ0QmVmb3JlQgACcwIPRgoljzk4OTUyNTkwLQgID-sARCw5Nl0DC-sADzcLQwPxAB8y_AYID_EAFIA5MTY0NTE0NxoNA_4ID9oBHC84NtoBR580ODc1MzM4ODTaAS8P6QAbD9gBAQnpAA_YAUIE7wAfNtgBCGFzLnlpbWemA_YId2kvY29uZmlnLzEwMjAwMzQ2Lmpzb26kAw8TBgNONzA5N7YCABQADxMGRzA0MjB1Cz80NjmYBwcP2gDVZnl0Yy5qc6YBD3ADHAmpAQ9KBTyvMzYyMTYzMzYzMKcBFQ_NABgPVAMBCc0AD1QDQgTTAC81MtMAB1BiYXQuYu8KAGgRIGFjihHwJS8wP3RpPTMzMTAwMDU0OSZWZXI9MiZtaWQ9YzY2ZTY4OWItM2Y4MC00YjNlLTgyYjMtMjQYAPIeMTkyNzBhJnNpZD1kNmQ5ZmViMGY4M2UxMWVlYWMyOGRiNzgyN2ExZjlhNiZ2JQBFYTMzZSUA8AE4MTU1Y2ZmNzM2NjgyMjI0JQDwInM9MSZtc2Nsa2lkPU4mcGk9OTE4NjM5ODMxJmxnPWRlLURFJnN3PTE2MDAmc2g9MTIIAPASYz0yNCZ0bD1FYXJuJTIwdXAlMjB0byUyMCUyNDUsMDAwCwBjN0MlMjBDYhIxJnA9fRKrJTNBJTJGJTJGYoMSMCUyRoUSNiUyRocSABQA8Chwd20lMkZkZWZhdWx0Lmh0bSUzRkJUX1RYJTNEMSUyNlByb3NwZWN0SUQlM0Q0NTVGODVGNkU30w72KkZCQTAxMUFFRTU5QUVGMjM5NyZyPSZsdD0zMDM0JmV2dD1wYWdlTG9hZCZzdj0xJnJuPTMzMDM5Nz8DD9ISA003MTM15QQBFAAF5QRQSFRNTElAE9hfU0VUQVRUUklCVVRFkAgPAwsnnzQ4ODcxNzIzNwMLCAl2AgANAA8VBBQdONELPzcxM4UHSI8yNzEyNTY5OYUHCQC_AAVCAwANAA_MABQPFAQACswADxQEQgTSAB81ngEIkXAudHZwaXhlbGsH9QZjb20uc25vd3Bsb3dhbmFseXRpY3MSAD8vdHCJDQ4gNzEDCwsXCwEUAAWRAg-JDT6fMDk1NDE2Mjc46ADwGWPQAfEAanMvY3VycmVudC9kcG1f6QGQX21pbi5qcz9h5QXwBml0aS1kNGY4NTgyNC0xMzUxLTQ1NewP8A1mZi1mZGI1NmY5NjJjNWMmY29tc2NvcmU9dHJ1zQwPRQsPD8ADAS81OUULSI8xOTExOTU2MUAUCA8eAXcPEgQBCR4BDxIEQhM0JAEfMokYCPECem4zdmk4a2t1ZHMwampyZmNCFfAOZmVlZGJhY2suc2l0ZWludGVyY2VwdC5xdWFsdHIlBABUCPECU0lFLz9RX1pJRD1aTl8zVklHAHZTMEpKUkZjywYPCgoJD_UFACc2MzUCoGFwcGVuZENoaWyzEQ-ZGS1gMTcyMjk39xQPNgkHDxABag8nAgEJEAEPJwJCBBcBHzVLAwgA_gYFCwcjcC9PCgVKCg_7CxMRN5scCy4GKDIwRREP8QE7nzM3MzM2NTcyMUIWCgcnCw_aACcPmQkACtoAD7sBQgXhAA9cDwgPNBEVsDc1NzAxOTQ3Jmw95RyfTGF5ZXImY3g9ywMRTTcwODSZCigyMssDD9UNPI81MDA5MDI3NtsBCQ_6AFQOLhMK-gAP-gFCBQABD7UDCIFzci5ybGNkbu0JYDQyNTQ2NskM9iZsP2VzPTgwNjc2JnU9ZGEzOWEzZWU1ZTZiNGIwZDMyNTViZmVmOTU2MDE4OTBhZmQ4MDcwOdAFUGlmcmFtFQgNcB8-ODgyBQIYMzUbD98DO48yNTgxMjgxOGkfCQ8EAV4PxAUAGTIEAQ8PAkIECwEfOOQQCQ_MBwh0V1JTaXRlSeoH0EVuZ2luZS9UYXJnZXREEDBwaHDrBwCIIA_uBwH1ByZRX0NMSUVOVFZFUlNJT049Mi40LjAWAIZUWVBFPXdlYkUCD8UTBC8yNE0DAAAUABRzsiEPTww-jzI1NTczMTQyaBcJDwYJCQ86Af8o8BlkeGpzbW9kdWxlLzEyLjAwNTkzZTA3MGE2ZjE1NjJhOGI0LmNodW5rvwwPYAITvCZRX0JSQU5ESUQ95xEGewIPkAoGIDcxbAkMnwgJfgIPvANCjzEyMTY4MTAyywwJsWxpdmUucmV6eW5jzgXwPnN5bmM_Yz0xNmI2NDEwNDMxYjYzNzRlNzgwMTA0YWJiMDQ0M2NhOCZwPTdlMzIzMjJkZTM5OGY3YTgwZjZkYTBlZTFjZWM5YTliJms9NCEAMAERLTIOYi02NjY3JkIeYzE9bnVsbA0AszI9dW5kZWZpbmVkEgAYMx8AHTQfAB01EgAXNhIAZHptcElEPXwA9QAmY2FjaGVfYnVzdGVyPTGwJbI4OTImUGFnZVVybMkTD0YmFge7ExE_uRM2PTEmtRMfPbMTDgCkE69fcmVmZXJyZXI9QAIQPzY4OQAHAACEJgW-BA8ABzufMzM0NjI5MjU34A0IDzkC_5UP9wYBD4QlTgRAAg81CAkPRAsUnzY0NDU3NDA0Mz4MNxg3OQoPPgw8nzI3NjA0NDAxNj4LCA_6AFQP-gEACfoAD3MGQgUAAQ-DHi-fODMwOTA3OTY5-gEkDtEYGTKUHg_6ATyfMDgxMTUyMzA0NAUID_oBFA_6AC0P-gEACfoAD_oBQgUAAQ8yEDCPNjA2MjE4NzX6ASQO_RMZMjodD_oBPCAxOe8ZAPIjD_4TBw_6ARQfOfoALA_6AQAJ-gAP-gFCBAABD-4FMCA4MasnLzAy7gUlDvQDLzMx7BtJQDM1NDHlKQ_uBDAP-gAsDvoBCvoAD_oBQhQyAAEP9AQICeEVA98VDy4g_8IoMzFvFwxvAhhBKSBAZXJyb34rL3JlADMbDycgEQ9pBRSfNjk1MjMxMTYyYwYkD2kEACc0NWAaD2MGPJ8zNTgwNTA0NjSbHggP-gBUD2kEAAn6AAz6AQ_6NDIFAAEPEScIDwABFJ85NTkyOTk3OTT6ASQPAAEAGDePHg8AAUKfMjc4NjI3MjkyVwwvrzEwOTU1MDA2OTVZCyUPAgEAHzkCAU6fMzExODMzMjkxAgIvIDExbCQQMOEQDwQCNi80MuU1TtA0OTk0MDE3NTczfV19
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 3.124.119.57 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-124-119-57.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://banking.citi.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 11 Apr 2024 20:05:28 GMT
cache-control: no-cache, no-store
server: nginx
expires: Thu, 11 Apr 2024 20:05:27 GMT

GET
H2 204 r.rnc
data.privacy.ensighten.com/privacy/v1/b/ 0
106 B 44ms
43ms Image
text/plain 3.124.119.57
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://data.privacy.ensighten.com/privacy/v1/b/r.rnc?n=3&c=1129&i=5r0cn4&p=na_prod&s=8423&d=8HB7InZlcnNpb24iOiIxLjAuMCIsImdhdGV3YXkiOiIyLjMuNjExIiwiY2xpZW50SWQiOjExMjksInB1Ymxpc2hQYXRoIjoibmFfcHJvZCIsImluc3RhbmNlSWQiOiI1cjBjbjQiLCJwYWNrZXQiOjEsIm1vZGUiOiJlbmZvcmNlWgDxMG9va2llcyI6e30sImVudmlyb25tZW50IjoiQ0JPTCBQcml2YWN5IiwicmVxdWVzdHMiOlt7ImRlc3RpbmF0absA8yNodHRwczovLzYyNjkzMjIuZmxzLmRvdWJsZWNsaWNrLm5ldC9hY3Rpdml0eWk7c3JjPSoA8QI7dHlwZT1iYW5rcDAwO2NhdAwA8YZhMDE5O29yZD0xO251bT0xNTgzMTY4NjI4ODUzO25wYT0xO2F1aWRkYz0xMDIyNDk5NzkuMTcxMjg2NTkyNzt1YWE9eDg2O3VhYj02NDt1YWZ2bD1Hb29nbGUlMjUyMENocm9tZSUzQjEyMy4wLjYzMTIuMTIyJTdDTm90JTI1M0FBLUJyYW5kJTNCOC4wLjAuMCU3QzYAPWl1bTgAcDt1YW1iPTAHALA9O3VhcD1XaW4zMgoAMXY9MT4A8Cg7dWF3PTA7cHNjZGw9bm9hcGk7Z3RtPTQ1ZmU0NGEwdjkxNzk4NzYzNTV6YTIwMDtnY2Q9MTNsAgDwAzJsMTtkbWFfY3BzPXN5cGhhbQ8A8QI9MTtlcHZlcj0yO35vcmVmPYEBkCUzQSUyRiUyRlAB8A1pbmcuY2l0aS5jb20lMkZjYm9sJTJGaW52ZXN04AEAFAAgcHcbAPA8ZGVmYXVsdC5odG0lM0ZCVF9UWCUzRDElMjZQcm9zcGVjdElEJTNENDU1Rjg1RjZFNzI2NDdGQkEwMTFBRUU1OUFFRjIzOTc_IiwizgHwASI6ImlmcmFtZSIsInN0YXJ4AgScAUA2ODc4ZgIAyAIEFADANzQzNiwic291cmNlPACjbnNlcnRCZWZvckIAoXR1cyI6ImxvYWSFAkBhc29uhALUXSwiZGF0YVBhdHRlchIAsmxpc3QiOltdLCJpZADPNDYxMzg2NTAxNn0stgL__ykvOTa2AgwxbXV0DAWiT2JzZXJ2ZXJDTP4CD7wCMi8zNLwCB_AFcGVvcGxlLmFwaS5ib29tdHJhaW7zA_ADL2lkZW50aWZ5L3Jlc29sdmU_LQPwlj1leUpqYjI5cmFXVWlPbnNpWW5OcGJpSTZJaUo5TENKeGRXVnllWE4wY21sdVp5STZlMzBzSW1WNGRHVnlibUZzWDJsa2N5STZleUo2ZVc1aklqb2lPR05sTkdJNE9EQXRaamd4T0MwMFpXRmxMV0ZoTUdFdE9EWXhaR1F6TjJObU16aG1PakUzTVRJNE5qVTVNamN1TVRVd01Ua3lOU0o5ZlElM20EkCZzaXRlX2lkPcMEAM8EFSJdBDJ4aHJcAQlaBE43NDU5pAEAFAAFWgSyWEhSX01BTkFHRVJBAAKdAW9hbGxvd2VcBCKPMjEzMzE0NzVcBAgPoAH3LjYwoAEAFAAPoAFQHzdAAwc7Y2RuOQNUcDEzbi93AhAvDgB2Lm1pbi5qc4MCYnNjcmlwdEUCCoYCPzI0N-YADB9p4AY8jzIwMjY3NDg2hAIID-QAPg_EBwAJygEPDgVDBOoAD84BCAA2BPEEaW50ZXJjZXB0LnF1YWx0cmljcxEF8QFkeGpzbW9kdWxlL0NvcmVNCwD0Cy5qcz9RX0NMSUVOVFZFUlNJT049Mi40LjAmFgDxA1RZUEU9d2ViJlFfQlJBTkRJRJQEj2ZlZWRiYWNrFQIRPTQzNRUCNzUxNfUIDzEBQq8xODUwMjQxNDM5_wIHDzEBCXRXUlNpdGVJTwHyAkVuZ2luZS9Bc3NldC5waHA_QgHyBj1TSV8wQWlvcnlSa2w4YnhITTImVtQMwj0yNSZRX09SSUdJTqIKMDovL80FCJwKBWkBD38BE_UKVElFUj1sSWpoWXVNbDJnJlFfQVJDQUNIRT8AAC8NA4gKDysGBC41McECARQAD4sER58zMDU0Nzg2NjHLBwgPjAHkDrcHNzUxORwDD7cHPgWMAR81GANK9QNDUl82c1BxRFg0d0tRdWpQTzYYA0U5JlFfWAMvSURDAwEPOAODD6wBX482MTU0MTM0NTgDSw-sAf9zB6EH_w03LjdmOTIxNjZhMjc5ZWM4Y2NiYjkyLmNodW5rswdSAQ8GImVuRBADWBI3NjEwlwSgYXBwZW5kQ2hpbDsMMnN0YU4MD6cQJK8yMDIxNDI3ODg4lAQjDzwBew4nBAo8AQ_vCEIFQwEP7wgkB0MB_wcxLjIyMTEzNDZhMjRiOTZjMzM0NzQ0fwJuHzF_AkePNDI0MDIzOTR_Ai8PPAFwD38CAQg8AQ9_AkMEQwEPfwIvE0ZcDGJCdXR0b25nCw_2BGgfNHcCRp8xODExNjU5ODl3Ai8PNAFoD28CAQg0AQ9vAkIFOwEPbwIJgHAuYW5hbHl0Aw9ReWFob28JD_EZc3AucGw_YT0xMDAwMCZkPVRodSUyQyUyMDExJTIwQXByJTIwMjAyNAcA8CUlM0EwNSUzQTI3JTIwR01UJm49LTJkJmI9RWFybiUyMHVwJTIwdG8lMjAlMjQ1JTJDMDAwDQAQN1EAE0OAGEAmLnlwqxlvMDAzNDYmrhhy9hwmZW5jPVVURi04Jnl2PTEuMTUuMSZ0YWdtZ3I9Z3RtJTJDZW5zaWdodGVu4w8_aW1n9REBLjQy4A8oNjfVGA8DAkKvMjY1OTk1ODAxMjQIIw_gDwPAP1FfSW1wcmVzcz0xnA8_SUQ9HgsAT1FfU0m5DAXwAUFTSUQ9QVNfMDcyMTAwMjRGAA9hEREmcj3EGzY5MTN3AQ_HDwQ9OTEzVxEBFAAPxw9HnzQ0MjYwNDMxMbEEJA9zAf9Fb2V2ZW50cwUZAAEZADkvdHKpEw9PAgUuOTFPAgAUAA9PAkePMjc5NTMzNjGdHAkBwwAP3AAvHzLcAAAXMtkHD2YRPtAyNzk1MzM2MTE3fV19
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 3.124.119.57 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-124-119-57.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://banking.citi.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 11 Apr 2024 20:05:28 GMT
cache-control: no-cache, no-store
server: nginx
expires: Thu, 11 Apr 2024 20:05:27 GMT

GET
H2 204 r.rnc
data.privacy.ensighten.com/privacy/v1/b/ 0
106 B 42ms
41ms Image
text/plain 3.124.119.57
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://data.privacy.ensighten.com/privacy/v1/b/r.rnc?n=4&c=1129&i=5r0cn4&p=na_prod&s=749&d=8HB7InZlcnNpb24iOiIxLjAuMCIsImdhdGV3YXkiOiIyLjMuNjExIiwiY2xpZW50SWQiOjExMjksInB1Ymxpc2hQYXRoIjoibmFfcHJvZCIsImluc3RhbmNlSWQiOiI1cjBjbjQiLCJwYWNrZXQiOjQsIm1vZGUiOiJlbmZvcmNlWgDxMG9va2llcyI6e30sImVudmlyb25tZW50IjoiQ0JPTCBQcml2YWN5IiwicmVxdWVzdHMiOlt7ImRlc3RpbmF0absA9BhodHRwczovL3NpdGVpbnRlcmNlcHQucXVhbHRyaWNzLmNvbS9XUlEQAPoAU2hhcmVkL0dyYXBoaWNzNwDwGy93ci1kaWFsb2ctY2xvc2UtYnRuLXdoaXRlLnBuZyIsInR5cGUiOiJpbQ0A8AVzdGFydCI6MTcxMjg2NTkyNzkxM8gAACoBBBQAsDgwMDgsInNvdXJjOQDwC2FwcGVuZENoaWxkIiwic3RhdHVzIjoibG9hEABgcmVhc29u5QDUXSwiZGF0YVBhdHRlchIAsmxpc3QiOltdLCJpYwDPMDc1NjAyNjE4M30sFwGKHzQXAQwxbXV0zwGvT2JzZXJ2ZXJDTB4BMcA3NTYwMjYxODR9XX0
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 3.124.119.57 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-124-119-57.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://banking.citi.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 11 Apr 2024 20:05:31 GMT
cache-control: no-cache, no-store
server: nginx
expires: Thu, 11 Apr 2024 20:05:30 GMT

GET
H2 204 r.rnc
data.privacy.ensighten.com/privacy/v1/b/ 0
106 B 43ms
43ms Image
text/plain 3.124.119.57
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://data.privacy.ensighten.com/privacy/v1/b/r.rnc?n=5&c=1129&i=5r0cn4&p=na_prod&s=2811&d=8HB7InZlcnNpb24iOiIxLjAuMCIsImdhdGV3YXkiOiIyLjMuNjExIiwiY2xpZW50SWQiOjExMjksInB1Ymxpc2hQYXRoIjoibmFfcHJvZCIsImluc3RhbmNlSWQiOiI1cjBjbjQiLCJwYWNrZXQiOjUsIm1vZGUiOiJlbmZvcmNlWgDxMG9va2llcyI6e30sImVudmlyb25tZW50IjoiQ0JPTCBQcml2YWN5IiwicmVxdWVzdHMiOlt7ImRlc3RpbmF0absA8BVodHRwczovL2JhbmtpbmcuY2l0aS5jb20vY2JvbC9pbnZlc3RVAPZIL2Nwd20vanMvNjMzLjNjODMyYTJjOWVhZDRlMDNiZTQxLmJ1bmRsZS5qcyIsInR5cGUiOiJzY3JpcHQiLCJzdGFydCI6MTcxMjg2NTkyNjMzNywiZW5kFADAMzEzODcsInNvdXJjPACycmVtb3ZlQ2hpbGRBAMB0dXMiOiJ0aW1lb3VUAGByZWFzb27UANRdLCJkYXRhUGF0dGVyEgCwbGlzdCI6W10sIml8Ae83MTIzMDE4NDgyMTl9LAYBLv8JMzAwLjAwYTBmYTY0NGNhMWVkMGJiYmFjBgEcIDQwugEDoAAAGgEPBgFOrzM2MzI4ODI0NDUGAQcBBAKwZGVtZGV4Lm5ldC8yAvEBNS5odG1sP2RfbnNpZD0wIzgCnCUzQSUyRiUyRj4CBgMCYmlmcmFtZcIBCwMCLzc5_QAMb2FwcGVuZAMCOK80ODk5MDQ5OTEw_QBuLzg1_QAMMW11dKQDok9ic2VydmVyQ0xFAQ8HAy0FBAEfNgQBBwzPAQ8NBAb_CTkwMC43Yjg1MjQ0N2UxYjE1NmQzNmQyOAcDGz01MDENAT82MzYNBEmvNDI1MDQ0MjQ1OAYBBw8HA1MuNTIKAg_9AE0ABwNPNTAwNQMCLuBpbWFnZXMvaGVhZGVyLTEB9hMtbG9nby1kc2suNmQ2NDg0MzFjZDA4MGViNTE1ZTQucG5nHAQD7AUPHwYAPzU0OBICDA8fA0WvMTAzNzEzNjQ3NxkCBw8fAxb_CTI1My4yNDdkODgzM2VjZTdkZWVlMjdhMh8DHB41JgYPIgJMrzExODQxMDU4NTQGAQfhaWFkMS5xdWFsdHJpY3M0CDRXUlEQAPYgU2l0ZUludGVyY2VwdC9HcmFwaGljLnBocD9JTT1JTV8yZ2hEdUhIamVTT2lyTmMVAiBpbSICG3MxCD03OTEkBDgzMTMxCA8uBj-PNjU5ODI4NjkFAXgcMhcDCwUBDxcDRdA0NjU5ODI4Njk1fV19
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 3.124.119.57 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-124-119-57.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

sec-ch-ua: "Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer: https://banking.citi.com/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Thu, 11 Apr 2024 20:05:33 GMT
cache-control: no-cache, no-store
server: nginx
expires: Thu, 11 Apr 2024 20:05:32 GMT

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: citi.demdex.net
URL: https://citi.demdex.net/dest5.html?d_nsid=0

Domain: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/iu3?pid=c3702eea-109e-48b0-9ef4-c856bdd405e2&event=PageView&dcc=t

Verdicts & Comments Add Verdict or Comment

94 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

58 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
prod.report.nacustomerexperience.citi.com/glassbox/reporting/798b2f12-9162-4a94-91ee-805d883ca266	1969-12-31 23:59:59	Name: _cls_cfgver Value: 8da7f8d0
prod.report.nacustomerexperience.citi.com/glassbox/reporting/798b2f12-9162-4a94-91ee-805d883ca266	1969-12-31 23:59:59	Name: _cls_s Value: d436117f-99ee-4c8f-90cf-84373b8f2ff7:0
prod.report.nacustomerexperience.citi.com/glassbox/reporting/798b2f12-9162-4a94-91ee-805d883ca266	1969-12-31 23:59:59	Name: _cls_v Value: 97b61d6c-610f-4480-8a74-efcc3ce99500
banking.citi.com/	1969-12-31 23:59:59	Name: CitiBTSES Value: SID=FF89E8B2CD0C4FEF998A73A7BB85E4DD
.citi.bridgetrack.com/	1970-01-21 04:26:09	Name: ATC1 Value: 35755\|aseK1.B.iABgf.B.B2z.SDJF.KML.lnH.0.EB.C.E
.citi.bridgetrack.com/	1970-01-21 04:25:12	Name: CitiBT Value: GUID=39D418FB8FEB407993720402913011C5
.citi.bridgetrack.com/	1969-12-31 23:59:59	Name: CitiBTSES Value: SID=D3122B6B87C04B6AA10338D0EE38BBEE
.citi.bridgetrack.com/	1970-01-21 04:25:12	Name: CitiBT%5F1 Value: GUID=39D418FB8FEB407993720402913011C5&SID=455F85F6E72647FBA011AEE59AEF2397
.citi.com/	1969-12-31 23:59:59	Name: CITI_privacy_cc_SYNC Value: 0%7C83450500e6cddbe403b69c5b65e8ac92e627e9587d48f611f606b45c4f021867
.citi.com/	1969-12-31 23:59:59	Name: at_check Value: true
.citi.com/	1969-12-31 23:59:59	Name: CITI_ENSIGHTEN_PRIVACY_BANNER_LOADED Value: 1
.citi.com/	1969-12-31 23:59:59	Name: _ce.irv Value: new
.citi.com/	1969-12-31 23:59:59	Name: cebs Value: 1
.demdex.net/	1970-01-21 00:06:57	Name: demdex Value: 17654313976704716112721178464925810017
banking.citi.com/	1970-01-20 19:47:47	Name: 7018 Value:
banking.citi.com/	1970-01-20 19:47:47	Name: 7830 Value: error
banking.citi.com/	1970-01-20 21:57:21	Name: 64072 Value:
.citi.com/	1969-12-31 23:59:59	Name: AMCVS_61834D9B5228A7430A490D45%40AdobeOrg Value: 1
.citi.com/	1970-01-20 19:49:12	Name: _ce.clock_event Value: 1
.citi.com/	1970-01-20 21:57:21	Name: _gcl_au Value: 1.1.102249979.1712865927
.citi.com/	1970-01-21 05:23:45	Name: s_ecid Value: MCMID%7C12349810510954818803197568228951999682
.citi.com/	1970-01-21 05:23:45	Name: _cls_v Value: 97b61d6c-610f-4480-8a74-efcc3ce99500
.citi.com/	1969-12-31 23:59:59	Name: _cls_s Value: d436117f-99ee-4c8f-90cf-84373b8f2ff7:0
.everesttech.net/	1970-01-21 04:33:21	Name: everest_g_v2 Value: g_surferid~ZhhChgAAAE_bYAO5
.citi.com/	1970-01-20 19:49:12	Name: _ce.clock_data Value: 32%2C80.255.7.107%2C1%2C5e705226acd7a97aa6ee95ab188632d6
.citi.com/	1969-12-31 23:59:59	Name: cebsp_ Value: 1
.citi.com/	1970-01-21 04:33:21	Name: _ce.s Value: v~6e7c0f79dfab29c70a415d19f01b2feb283a3378~lcw~1712865926658~lva~1712865926282~vpv~0~v11.fhb~1712865926656~v11.lhb~1712865926656~v11.cs~340498~v11.s~d6916e20-f83e-11ee-9441-b7c544e3a3b1~lcw~1712865926661
.rfihub.com/	1970-01-21 05:09:21	Name: rud Value: H4sIAAAAAAAA_-MSNjU0MTCwMLE0NjC3NDUzNDQ1MhXiM9Q19nMsznTKLjNyz6kEAPFPmqAlAAAA
.rfihub.com/	1969-12-31 23:59:59	Name: ruds Value: H4sIAAAAAAAA_-MSNjU0MTCwMLE0NjC3NDUzNDQ1MhXiM9Q19nMsznTKLjNyz6kEAPFPmqAlAAAA
.dpm.demdex.net/	1970-01-21 00:06:57	Name: dpm Value: 17654313976704716112721178464925810017
.citi.com/	1970-01-21 05:23:45	Name: AMCV_61834D9B5228A7430A490D45%40AdobeOrg Value: 1585540135%7CMCIDTS%7C19825%7CMCMID%7C12349810510954818803197568228951999682%7CMCAAMLH-1713470726%7C6%7CMCAAMB-1713470726%7CRKhpRz8krg2tLO6pguXWp5olkAcUniQYPHaMWWgdJ3xzPWQmdj0y%7CMCOPTOUT-1712873126s%7CNONE%7CMCAID%7CNONE%7CMCSYNCSOP%7C411-19832%7CvVersion%7C4.4.0
.citicorpcreditservic.tt.omtrdc.net/	1970-01-20 19:47:47	Name: citicorpcreditservic!mboxSession Value: 68af5caefc6945c1b097b19849eb31b2
.citicorpcreditservic.tt.omtrdc.net/	1970-01-21 05:23:45	Name: citicorpcreditservic!mboxPC Value: 68af5caefc6945c1b097b19849eb31b2.37_0
.citi.com/	1970-01-21 05:23:45	Name: mbox Value: session#68af5caefc6945c1b097b19849eb31b2#1712867787\|PC#68af5caefc6945c1b097b19849eb31b2.37_0#1776110727
.citi.com/	1970-01-20 19:47:47	Name: mboxEdgeCluster Value: 37
.citi.com/	1970-01-20 20:30:57	Name: s_nr Value: 1712865926990-New
.citi.com/	1970-01-20 19:47:47	Name: gpv_pn Value: public%7Cmicrosite%7Cwealth%7Cciti%20personal%20wealth%20management
.citi.com/	1969-12-31 23:59:59	Name: s_cc Value: true
.citi.com/	1970-01-20 19:49:12	Name: _uetsid Value: d6d9feb0f83e11eeac28db7827a1f9a6
.citi.com/	1970-01-21 05:09:21	Name: _uetvid Value: d6da33e0f83e11ee8155cff736682224
.citi.com/	1970-01-20 19:47:47	Name: _dpm_ses.d03c Value: *
.citi.com/	1970-01-21 04:33:21	Name: _dpm_id.d03c Value: f9c101fa-0a4c-4384-8a96-0fa571a1d242.1712865927.1.1712865927.1712865927.69cccc75-9e2b-4f35-9ae6-89fc35d55840
.doubleclick.net/	1970-01-20 19:47:46	Name: test_cookie Value: CheckForPermission
.doubleclick.net/	1970-01-21 00:06:57	Name: receive-cookie-deprecation Value: 1
.rezync.com/	1970-01-21 00:06:57	Name: zync-uuid Value: 8ce4b880-f818-4eae-aa0a-861dd37cf38f:1712865927.1501925
live.rezync.com/	1970-01-21 00:06:57	Name: sd-session-id Value: eyJfcGVybWFuZW50Ijp0cnVlLCJzZXNzaW9uX2lkIjoiOGNlNGI4ODAtZjgxOC00ZWFlLWFhMGEtODYxZGQzN2NmMzhmOjE3MTI4NjU5MjcuMTUwMTkyNSJ9.ZhhChw.S-Y1e9E2yP3VQVpGpAjiz10ytYQ
.bing.com/	1970-01-21 05:09:21	Name: MUID Value: 10A8D4930475622C0A18C0CD05D9633C
.amazon-adsystem.com/	1970-01-21 02:09:21	Name: ad-id Value: A_V0OKmOREsvrijoLQUq_f8
.amazon-adsystem.com/	1970-01-21 05:23:45	Name: ad-privacy Value: 0
.citi.com/	1970-01-21 04:33:21	Name: btIdentify Value: d6f21098-0ac8-439d-8fb3-a522f29ea9ae
.citi.com/	1970-01-20 19:47:49	Name: _bts Value: c91c0d7a-0b0b-4f89-a637-092c5cd8dd4e
.yahoo.com/	1970-01-21 04:33:43	Name: A3 Value: d=AQABBIdCGGYCEGm6Y6a0JCyR2eiKZn955V4FEgEBAQGUGWYiZuAOyiMA_eMAAA&S=AQAAAhIsSJOJCTawQE604VFUCag
.tvpixel.com/	1970-01-21 04:33:21	Name: sp Value: 1278a188-eabb-42b5-aa67-e3d596f6d000
.citi.com/	1970-01-21 04:33:21	Name: _bti Value: %7B%22app_id%22%3A%22citibank%22%2C%22bsin%22%3A%22NmQ8EpAz2kyCCXAJ93bJgxKDZJxk7N%2FRdwdI9PTHNBbGfe50DMIV7nX6shWAU8H%2BfT33L7zw4txKRlAky6PyPQ%3D%3D%22%2C%22is_identified%22%3Afalse%7D
prod.report.nacustomerexperience.citi.com/	1970-01-20 19:57:50	Name: AWSALB Value: +KqdU6xtWPh15og2+RV6Cuwgxgq8NhyCW8oaOWzEtyfD3RURaD9v0AQM4lzaU/THtZkMy4VleINX6ssqs8iJakfhkAkOqy0/1JNz4/TFIZ2lkybV9Hd8rkNc7cV0
prod.report.nacustomerexperience.citi.com/	1970-01-20 19:57:50	Name: AWSALBCORS Value: +KqdU6xtWPh15og2+RV6Cuwgxgq8NhyCW8oaOWzEtyfD3RURaD9v0AQM4lzaU/THtZkMy4VleINX6ssqs8iJakfhkAkOqy0/1JNz4/TFIZ2lkybV9Hd8rkNc7cV0
prod.report.nacustomerexperience.citi.com/	1969-12-31 23:59:59	Name: ROUTEID Value: .cligate1
.citi.com/	1969-12-31 23:59:59	Name: cls_e Value: d436117f-99ee-4c8f-90cf-84373b8f2ff7:16112980393899

30 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
other	warning	URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js(Line 205) Message: The AudioContext was not allowed to start. It must be resumed (or created) after a user gesture on the page. https://goo.gl/7K7WLu
other	warning	URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js(Line 206) Message: The AudioContext was not allowed to start. It must be resumed (or created) after a user gesture on the page. https://goo.gl/7K7WLu
other	warning	URL: https://banking.citi.com/cbol/investment/cpwm/default.htm?BT_TX=1&ProspectID=455F85F6E72647FBA011AEE59AEF2397 Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://banking.citi.com/cbol/investment/cpwm/default.htm?BT_TX=1&ProspectID=455F85F6E72647FBA011AEE59AEF2397 Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://banking.citi.com/cbol/investment/cpwm/default.htm?BT_TX=1&ProspectID=455F85F6E72647FBA011AEE59AEF2397 Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://banking.citi.com/cbol/investment/cpwm/default.htm?BT_TX=1&ProspectID=455F85F6E72647FBA011AEE59AEF2397 Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://banking.citi.com/cbol/investment/cpwm/default.htm?BT_TX=1&ProspectID=455F85F6E72647FBA011AEE59AEF2397 Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://banking.citi.com/cbol/investment/cpwm/default.htm?BT_TX=1&ProspectID=455F85F6E72647FBA011AEE59AEF2397 Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://banking.citi.com/cbol/investment/cpwm/default.htm?BT_TX=1&ProspectID=455F85F6E72647FBA011AEE59AEF2397 Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://banking.citi.com/cbol/investment/cpwm/default.htm?BT_TX=1&ProspectID=455F85F6E72647FBA011AEE59AEF2397 Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://banking.citi.com/cbol/investment/cpwm/default.htm?BT_TX=1&ProspectID=455F85F6E72647FBA011AEE59AEF2397 Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://banking.citi.com/cbol/investment/cpwm/default.htm?BT_TX=1&ProspectID=455F85F6E72647FBA011AEE59AEF2397 Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://banking.citi.com/cbol/investment/cpwm/default.htm?BT_TX=1&ProspectID=455F85F6E72647FBA011AEE59AEF2397 Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://banking.citi.com/cbol/investment/cpwm/default.htm?BT_TX=1&ProspectID=455F85F6E72647FBA011AEE59AEF2397 Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://banking.citi.com/cbol/investment/cpwm/default.htm?BT_TX=1&ProspectID=455F85F6E72647FBA011AEE59AEF2397 Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://banking.citi.com/cbol/investment/cpwm/default.htm?BT_TX=1&ProspectID=455F85F6E72647FBA011AEE59AEF2397 Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://banking.citi.com/cbol/investment/cpwm/default.htm?BT_TX=1&ProspectID=455F85F6E72647FBA011AEE59AEF2397 Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://banking.citi.com/cbol/investment/cpwm/default.htm?BT_TX=1&ProspectID=455F85F6E72647FBA011AEE59AEF2397 Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://banking.citi.com/cbol/investment/cpwm/default.htm?BT_TX=1&ProspectID=455F85F6E72647FBA011AEE59AEF2397 Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://banking.citi.com/cbol/investment/cpwm/default.htm?BT_TX=1&ProspectID=455F85F6E72647FBA011AEE59AEF2397 Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://banking.citi.com/cbol/investment/cpwm/default.htm?BT_TX=1&ProspectID=455F85F6E72647FBA011AEE59AEF2397 Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://banking.citi.com/cbol/investment/cpwm/default.htm?BT_TX=1&ProspectID=455F85F6E72647FBA011AEE59AEF2397 Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://banking.citi.com/cbol/investment/cpwm/default.htm?BT_TX=1&ProspectID=455F85F6E72647FBA011AEE59AEF2397 Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://banking.citi.com/cbol/investment/cpwm/default.htm?BT_TX=1&ProspectID=455F85F6E72647FBA011AEE59AEF2397 Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://banking.citi.com/cbol/investment/cpwm/default.htm?BT_TX=1&ProspectID=455F85F6E72647FBA011AEE59AEF2397 Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://banking.citi.com/cbol/investment/cpwm/default.htm?BT_TX=1&ProspectID=455F85F6E72647FBA011AEE59AEF2397 Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://banking.citi.com/cbol/investment/cpwm/default.htm?BT_TX=1&ProspectID=455F85F6E72647FBA011AEE59AEF2397 Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://banking.citi.com/cbol/investment/cpwm/default.htm?BT_TX=1&ProspectID=455F85F6E72647FBA011AEE59AEF2397 Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://banking.citi.com/cbol/investment/cpwm/default.htm?BT_TX=1&ProspectID=455F85F6E72647FBA011AEE59AEF2397 Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://banking.citi.com/cbol/investment/cpwm/default.htm?BT_TX=1&ProspectID=455F85F6E72647FBA011AEE59AEF2397 Message: Third-party cookie will be blocked. Learn more in the Issues tab.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.bridgetrack.com; report-uri https://csp-reporter-ui3464xpjq-uc.a.run.app/api/csp-report/?env=prod
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

20766699p.rfihub.com
6269322.fls.doubleclick.net
assets-tracking.crazyegg.com
banking.citi.com
bat.bing.com
c.tvpixel.com
c1.rfihub.net
cdn.boomtrain.com
cdn.digitalmarketing.citibankonline.com
cdn.gbqofs.com
citi.bridgetrack.com
citi.demdex.net
citicorpcreditservic.tt.omtrdc.net
click.info15.citi.com
cm.everesttech.net
data.privacy.ensighten.com
dpm.demdex.net
events.api.boomtrain.com
iad1.qualtrics.com
live.rezync.com
metrics1.citi.com
nexus.ensighten.com
p.tvpixel.com
pagestates-tracking.crazyegg.com
people.api.boomtrain.com
prod.report.nacustomerexperience.citi.com
s.amazon-adsystem.com
s.yimg.com
sb.scorecardresearch.com
script.crazyegg.com
siteintercept.qualtrics.com
sp.analytics.yahoo.com
sr.rlcdn.com
tagmanager1.citi.com
tracking.crazyegg.com
www.googletagmanager.com
zn3vi8kkuds0jjrfc-citifeedback.siteintercept.qualtrics.com
citi.demdex.net
s.amazon-adsystem.com
104.17.208.240
13.111.71.127
13.32.27.28
142.250.184.198
18.173.154.117
18.173.154.120
18.66.196.37
184.30.20.101
193.0.160.130
212.82.100.181
216.58.206.72
2600:9000:20c3:2a00:1:76cf:fe80:93a1
2600:9000:20c3:6000:2:8f43:5780:93a1
2600:9000:2247:5400:1d:bf0a:0:93a1
2606:4700::6812:180d
2606:4700::6813:9408
2620:1ec:c11::237
2a00:1288:80:807::1
2a00:1450:4001:81d::2008
3.124.119.57
3.220.94.22
34.107.138.236
34.232.212.104
34.249.110.227
35.190.22.40
35.244.154.8
52.87.59.181
63.140.62.27
63.34.203.75
66.235.152.156
99.81.63.100
99.83.205.94
99.84.88.39
99.84.88.53
03021c1ca1bd0347e57e25382cb189535b4a9780b3c6cd1edfba459496f9f7d2
08dc2092e48755ada1438b1d701943b7e05e076adae5f5a1adedd2ad62ebaa56
093a4766afe0242a41c22de19122885eee9d4e2600a8d0c2d0b27bef4bdfff7c
0a747978746092df6f18fe90ef23b9896959f6a9bb0b58cbab2cbc851793e023
0d58dcf003d82f0e9e70a31a85524da3da4effbfd765576e5ef7d2b46776ad38
0e4b1e428a2198ef747010c094101c257b568a97cdcc0f31ed5e9868cc835b39
13a59cfac1785dd94d0005457ed1e12cf77fee65b975fe6fd91af77b7ac6cd77
1abef9ed7dc7e7f148b3e64da91176e0d1fcbf812a46db9c7420bd267ee11735
1c34a537ea8a62cb24c782a11aaf49c1cbd671e5d264d81c6732e2338e05d2af
1d355a2635cf91a471018aa8dd3f11475641f3830b3d4afa7d103d0881b06581
1f92443e7d2ea7191712d2145ce8725a7fcd1e5bc5423c0d81462dbd6da54b62
22f9eb0056c978dc7e93f99f2042fe9580e713f9ef88e87a3bbc5a8af5b7354d
25f4eeb23f67fe1d74534ed37230ecd54ab4f57524276970dcbeaaf3b0fc64f9
2689367b205c16ce32ed4200942b8b8b1e262dfc70d9bc9fbc77c49699a4f1df
279d30a83ec9df0b98f9a8ca372f7d94e83c605e9299ea22a5e5d461a0a12495
28ced8a7cb30e6f747ad8116dcd11d3dbf5848c2d49a9babbd7d8c94e0a29cf7
2e69ca332cb31dddff8d9918d641d2e7076314f3e0bb4a957260595921e312f0
329e2aa5ac1633899d882b0ec5ddf4972aef44b72010dd963a195c3e90387adf
32c07d9f90e2cde824d029e7651077624c39443117d2b61664d4b7210b509339
34dcba6a6c195a0ffbfd6027fe8420fc70943c5d3fb15b7c626f2c60f1a98911
3556b4fa28a41290454dc84939dae439fcf5bda8a1eac70efdf2647bf041d43d
3a5194cde0bc6408df78ffcd888809dc4e028b5df6a9fb96be756806152f5f59
3a7a0cd3684464728510590f32a4ef7c515b42b4989c72d1fd7bc74bb91dc96a
3ceaf77d9be69d9e29f14a1b4c2dea61484ad99ef8b0a0419965464931753bdd
3ceb6abdaf923b247b264301b13f3c177e976add13d557a07c6edd4d680cbf6e
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
442c5f94f41f419cb2d62746624f7ed4e7d5c6481b2d741d632d4b920fc1dc8d
480b06b23e574b4bf386fde1a91145a4171f97aeb5ee800e4be1850f29b1ad91
49c5a65c0b9afc6e5de3edc3f0c3d07c4d2746e680c276a95ea567a79a81eed2
4b99a4e92de3333bf62e8c2766dc1a880f1c19308c1591d2516974f6369b721a
4caed94f9975debb1a1ee2ff2e68395802a18a4cf3f3be7ae057f1b97b2c87ff
4f3d8ad7bd78e79e9a9b313433ec6b182c4250de209b00b2e8dc4114b3a43079
5002685df95297e193278218f50268795903f8ca608f6d93cae028ba11dc2ec2
523c29d48b0179cd38f1508a965d3145b200653a18f856696cf7c10c9143ac95
55d5eb3da583f30d615bb79e23312cba96514a500dc0e3770d941ea6dec74135
565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3
566095a5f65029a8730735e82ff6cf43336a92723d96484db740011b88467aa1
6160e82977edf783d073558110bc0036bed5c4a62a1f49f3eb91458a872dc7c3
61d8137d275f12306e177bc726c2b3e072f9efa4743a0ace6ecbcf7a0932fd07
63b98a0c8568c08fd01a6946a147bca65eff26c8085f1ccb5330aafe0f0dcd15
6763619496179f71fb260cdd36e51b58c5f36c46fec660fe4d18299b027daea8
686eb5d7c927dd741ef72adda5c719b478d36f1e29520ee16d5121854c174b10
6896c70fd430a1ffe69dc778926e1866ca52a12bd341170522ad6278aafd7bcf
6d2d020c9dd6cd75eab4da4f73978a55ff1ae0b5dfe37fb59f13ec5abd31891a
72a507c884f2708c32bb63ec9f7a71b720695f050fbdc1967eeec54a1f66dd52
7337d0aa06e2a7d2555a60936c9243f8f93c24dcd64e064d0181e6790294607b
73f050ae7efaaf6933c9f791011b6ec7dae72c7afc80b36b7d9a83b853701c43
741e9b5e3fe4d03e50d4025abf4ce86250728f885d002d8ccbb3b1e471e15646
773476fc4041f913eb57d338efa749e0c2b63828f086c83da65c3d3aeb51fa73
78570cd5a9bcc8cdbd843bfaada3505723a95220767990aa3fd9d59670232bb7
78720184c8dc77ae80b9efadf89e7a413d1533d357cb5785a4525d95291083e2
7d02633239369d04c8812eff65b6c3fad7d08525efd85d2451de2a4bac9f0cfb
7ef97b12890fc6fee67f869c6e1f74b6719de7d66ac0d649c8d7386a80b4c30f
80062e184f15fd918b5e002539264821f55d5a4b44246d7426a3b7e5f9f6b98e
81c0d3368ab09a4346305126269d432a59f1f679a03ab5a9f04368ba33213735
823804a7807864b44093a3843788f4cd076e89cf4a6fdeb8d153ae5c2c2df721
830e67bda2532cd5880ee86e3b33e69721082f8458bb0df0cd4edbb1577fd375
86551808dbfbf8bc9b23ab3d0725794c2e1f2b4265c96715f2945638160edc2b
930b9163349172607e509b2e72a3ac3a3152a7f5b28a61a4f562c720f18e6d92
94b3b5dc4faaa590be767cfc781c53e0b22887fbee06abcc6d8d4d9d8690d282
96589f45397c06969f95b1acd12fffcf53653ae37659d8eb0cf6b142a80ba3f1
984227c0d097ac96cff8b8ae797de2a34f79a84438685db3c72a1c226fd5a23b
9a74546a8f511f31b5252f115d2db7aa69370ca5eeaf6828f60abb197f35a169
9a7b3f11a504db5bb479923952c4f4ad7441abac479b59701b2369e490ea0920
a03e6c7363c6912c0dae3e34d4b4b0e4961f14c9e5e8a7f638140f59e93eaedf
a1ecbaed793a1f564c49c671f2dd0ce36f858534ef6d26b55783a06b884cc506
a374d49d2f2a50e86ac0262262e5daa1e4affe7e4749398bf5eb0b30d9c08f1a
a4f02d764058d001c0de3d11ab9652db7275fed7900113b892b7800db39d2663
a7752b6c23225d6511ec65a421cd536a822a68f3157139343d49c104e8e453fe
aa0b89a8518a91a7a991882b55591cec24fc87ba73c35016c8c6605f905a5b99
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
b1b7bd1a5781769bb0518d0d8de10f146605ea94a1c1af8f0353492ae74f3e52
bf39c7a23da56a09d7fba494ab7a46604dc02a19fabfaf8d4c3ab6629aad0692
c00cb90f8b23d8e6fc9e95239911cc8ac7a475a8b2badd31ebe3eb38e27bffab
c82a05d8c84a1b47c2a38408219f40e88a20b2fd06c5b3c07357e6e5b0161317
ca1fb4a2a8c322e5cd2cda753d2d45e3f7e4ac1d007a3c4cfa2efa18784fdcae
ccd46b7e4b8c9c6f9ac43bbc0713ec461d9d9f8360ee594cc9f080a78e347a9a
cd5496f75a7c1029bc681f639794b83f034d5ecd884e8514ae12b13eee9eec70
d1315919f890960ea8830814c630d5f16c70baefe183033ac4a53fedd4aa0bab
d1356aee6b232d734bac0a04793623cf30ecdadb6107b857acc368a704d529b7
d451431443e3d3142f524e7743c84d9ec20c5ed361c4086cdf59eb267567e13c
d69e3303757e223cc0fd92ec05e7f0eb6ca17c61c857cf273f19d181ad2afd47
d7526f723abdddfdd587906749e14840864a3168aef6434436e0529e0667fa37
d76a9bdd77714c038618f13c0a1a9a579565cd9e011703dbe08c826547c051dc
d9d779ad16edc985e253102848bca69a3d661f9678af58c3da469fc13ff52b3c
dc1c1b20a82744db60084b47906b4aa1f414d0e99794fdb6777a85629fd038b4
dd1a7d1816db5f8e64d47c7b76acc1fdf9c0bfc645733f8442b01763e422429e
de6c5b4c59e1122b4e9665ef6d348d8d87657a516e806ab8e16aea5dc597cd8d
e20c077b8692a41850659276824f26d91c169ea46fd27f14f87de875a3b41fc8
e2b8e58c49dfe86a02acbced8d3ddf91c303df4af7009ab38ad9e6b89fde24ad
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
ea9362709bbb4d2ac09a1b684fa0276e535b8b2a2809e27ad46c3def2dae1850
eaa67e46f9e5da602af79451d714a9ef2db9c94812f48e643a7c57a12ac915a4
ebdabf4297fb1adc64f0a9eb3e596fa3e02bc8bfc610c1aaad6e82742293efa2
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
ef90c0d5f242aee0c3fe7654ac74a9403dcdee295488f9b57d645da9447efd14
f071110e088267097a0946520a2a08bd589f971f3ce4cb989feda1415026ac49
f0fabaafede0bd57afc5b649c210ef345620e2a871be626a8d232e1eebaf6e98
f47f21063dfdcbdeffed3d97689b45efae7a52401cd7fc5b8d07c42d2f232ab9
f645ffb0d67a42a3244124653935ff9a7ee4a84fee30a2c83d9bf4a2a17cc2ef
fb2668e04a4954dce87f6d3516774360d71506274332a3c8cbf47bace5e11af1
fee3b9c632711d281142c495d3f6c405e63148580a68f4213184178c23f5598e

banking.citi.com Open in urlscan Pro 35.190.22.40 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

124 Requests

94 %HTTPS

24 %IPv6

23 Domains

37 Subdomains

33 IPs

5 Countries

2782 kBTransfer

6961 kBSize

58 Cookies

10 Outgoing links

Page URL History

Redirected requests

124 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

banking.citi.com Open in urlscan Pro
35.190.22.40 Public Scan

Screenshot
Live screenshot

Full Image

124
Requests

94 %
HTTPS

24 %
IPv6

23
Domains

37
Subdomains

33
IPs

5
Countries

2782 kB
Transfer

6961 kB
Size

58
Cookies

124 HTTP transactions
0 data transactions