online.citi.com Open in urlscan Pro
104.109.92.187 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://validation.information.dns-cloud.net/citi-onlinebanking/Login.php
Effective URL:
https://online.citi.com/US/login.do?JFP_TOKEN=3RQ3Y559
Submission: On April 30 via api (April 30th 2020, 8:03:12 pm UTC) from CA

Summary HTTP 162 Redirects Links 24 Behaviour Indicators

Summary

This website contacted 41 IPs in 7 countries across 32 domains to perform 162 HTTP transactions. The main IP is 104.109.92.187, located in Netherlands and belongs to AKAMAI-ASN1, EU. The main domain is online.citi.com.
TLS certificate: Issued by DigiCert SHA2 Extended Validation Ser... on March 13th 2020. Valid for: 2 years.

This is the only time online.citi.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1 1	111.90.149.203 111.90.149.203	45839 (SHINJIRU-...) (SHINJIRU-MY-AS-AP Shinjiru Technology Sdn Bhd)
1	2a00:1450:400... 2a00:1450:4001:817::2003	15169 (GOOGLE) (GOOGLE)
2 59	104.109.92.187 104.109.92.187	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
16	18.195.42.228 18.195.42.228	16509 (AMAZON-02) (AMAZON-02)
2	35.241.8.149 35.241.8.149	15169 (GOOGLE) (GOOGLE)
3	151.101.114.133 151.101.114.133	54113 (FASTLY) (FASTLY)
2	3.212.183.163 3.212.183.163	14618 (AMAZON-AES) (AMAZON-AES)
1	23.61.220.204 23.61.220.204	16625 (AKAMAI-AS) (AKAMAI-AS)
1	99.80.97.22 99.80.97.22	16509 (AMAZON-02) (AMAZON-02)
1 4	34.249.189.231 34.249.189.231	16509 (AMAZON-02) (AMAZON-02)
1	52.50.37.223 52.50.37.223	16509 (AMAZON-02) (AMAZON-02)
3	15.188.31.119 15.188.31.119	16509 (AMAZON-02) (AMAZON-02)
1 1	66.117.28.86 66.117.28.86	15224 (OMNITURE) (OMNITURE)
1	2a00:1450:400... 2a00:1450:4001:81c::2008	15169 (GOOGLE) (GOOGLE)
1	23.39.98.15 23.39.98.15	16625 (AKAMAI-AS) (AKAMAI-AS)
1	2a00:1450:400... 2a00:1450:4001:814::200e	15169 (GOOGLE) (GOOGLE)
6 13	2a00:1450:400... 2a00:1450:4001:81f::2004	15169 (GOOGLE) (GOOGLE)
1	23.61.221.89 23.61.221.89	16625 (AKAMAI-AS) (AKAMAI-AS)
2	52.129.74.12 52.129.74.12	395492 (IOVATION3) (IOVATION3)
1	2a00:1450:400... 2a00:1450:4001:81d::200e	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:809::200e	15169 (GOOGLE) (GOOGLE)
5	193.0.160.128 193.0.160.128	54312 (ROCKETFUEL) (ROCKETFUEL)
1 1	185.31.128.129 185.31.128.129	54312 (ROCKETFUEL) (ROCKETFUEL)
1	23.67.129.14 23.67.129.14	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
11	91.235.134.21 91.235.134.21	30286 (THM) (THM)
1	13.224.95.202 13.224.95.202	16509 (AMAZON-02) (AMAZON-02)
3	2620:1ec:c11:... 2620:1ec:c11::200	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1	172.217.16.194 172.217.16.194	15169 (GOOGLE) (GOOGLE)
2	99.86.243.81 99.86.243.81	16509 (AMAZON-02) (AMAZON-02)
1 2	172.217.18.166 172.217.18.166	15169 (GOOGLE) (GOOGLE)
1	151.101.114.109 151.101.114.109	54113 (FASTLY) (FASTLY)
1	2a03:2880:f12... 2a03:2880:f12d:83:face:b00c:0:25de	32934 (FACEBOOK) (FACEBOOK)
1	2600:9000:219... 2600:9000:2190:6000:19:fc2c:a140:93a1	16509 (AMAZON-02) (AMAZON-02)
1	23.45.237.36 23.45.237.36	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
6 10	2a00:1450:400... 2a00:1450:4001:81a::2002	15169 (GOOGLE) (GOOGLE)
10	2a00:1450:400... 2a00:1450:4001:825::2003	15169 (GOOGLE) (GOOGLE)
1	151.101.113.175 151.101.113.175	54113 (FASTLY) (FASTLY)
1	46.51.196.250 46.51.196.250	16509 (AMAZON-02) (AMAZON-02)
1	35.241.45.82 35.241.45.82	15169 (GOOGLE) (GOOGLE)
1	91.235.132.130 91.235.132.130	30286 (THM) (THM)
1	91.235.134.131 91.235.134.131	30286 (THM) (THM)
4	192.193.200.243 192.193.200.243	32287 (SOLANA-CI...) (SOLANA-CITIPLEX)
1 2	2a00:1450:400... 2a00:1450:4001:816::2013	15169 (GOOGLE) (GOOGLE)
1 1	52.29.85.133 52.29.85.133	16509 (AMAZON-02) (AMAZON-02)
162	41

1 111.90.149.203 (Malaysia) 1 redirects

ASN45839 (SHINJIRU-MY-AS-AP Shinjiru Technology Sdn Bhd, MY)

validation.information.dns-cloud.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:817::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.ro	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

59 104.109.92.187 (Netherlands) 2 redirects

ASN20940 (AKAMAI-ASN1, EU)
PTR: a104-109-92-187.deploy.static.akamaitechnologies.com

online.citibank.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
online.citi.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

16 18.195.42.228 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-18-195-42-228.eu-central-1.compute.amazonaws.com

nexus.ensighten.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 35.241.8.149 (Ascension Island)

ASN15169 (GOOGLE, US)
PTR: 149.8.241.35.bc.googleusercontent.com

di.rlcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
sr.rlcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 151.101.114.133 (Frankfurt am Main, Germany)

ASN54113 (FASTLY, US)

resources.digital-cloud-citi.medallia.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 3.212.183.163 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-3-212-183-163.compute-1.amazonaws.com

cyseal.cyveillance.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 23.61.220.204 (Netherlands)

ASN16625 (AKAMAI-AS, US)
PTR: a23-61-220-204.deploy.static.akamaitechnologies.com

cdn.tt.omtrdc.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 99.80.97.22 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-99-80-97-22.eu-west-1.compute.amazonaws.com

citicorpcreditservic.tt.omtrdc.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 34.249.189.231 (Dublin, Ireland) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-34-249-189-231.eu-west-1.compute.amazonaws.com

dpm.demdex.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.50.37.223 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-52-50-37-223.eu-west-1.compute.amazonaws.com

citi.demdex.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 15.188.31.119 (Paris, France)

ASN16509 (AMAZON-02, US)
PTR: ec2-15-188-31-119.eu-west-3.compute.amazonaws.com

metrics1.citi.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 66.117.28.86 (United States) 1 redirects

ASN15224 (OMNITURE, US)

cm.everesttech.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:81c::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 23.39.98.15 (Netherlands)

ASN16625 (AKAMAI-AS, US)
PTR: a23-39-98-15.deploy.static.akamaitechnologies.com

tags.bkrtx.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:814::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

cse.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

13 2a00:1450:4001:81f::2004 (Frankfurt am Main, Germany) 6 redirects

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 23.61.221.89 (Netherlands)

ASN16625 (AKAMAI-AS, US)
PTR: a23-61-221-89.deploy.static.akamaitechnologies.com

c1.rfihub.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 52.129.74.12 (United States)

ASN395492 (IOVATION3, US)
PTR: mpsnare.iesnare.com

mpsnare.iesnare.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:81d::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.youtube.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:809::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

s.ytimg.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 193.0.160.128 (Netherlands)

ASN54312 (ROCKETFUEL, US)

a.rfihub.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
20766699p.rfihub.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
20779813p.rfihub.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 185.31.128.129 (Netherlands) 1 redirects

ASN54312 (ROCKETFUEL, US)

s.rfihub.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 23.67.129.14 (Netherlands)

ASN20940 (AKAMAI-ASN1, EU)
PTR: a23-67-129-14.deploy.static.akamaitechnologies.com

www.citi.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

11 91.235.134.21 (Netherlands)

ASN30286 (THM, US)

content22.online.citi.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.224.95.202 (Seattle, United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-224-95-202.zrh50.r.cloudfront.net

js.adsrvr.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2620:1ec:c11::200 (United States)

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

bat.bing.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 172.217.16.194 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s08-in-f2.1e100.net

www.googleadservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 99.86.243.81 (Seattle, United States)

ASN16509 (AMAZON-02, US)
PTR: server-99-86-243-81.vie50.r.cloudfront.net

cdn.pbbl.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 172.217.18.166 (United States) 1 redirects

ASN15169 (GOOGLE, US)
PTR: fra15s29-in-f6.1e100.net

6260004.fls.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 151.101.114.109 (Frankfurt am Main, Germany)

ASN54113 (FASTLY, US)

pt.ispot.tv	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a03:2880:f12d:83:face:b00c:0:25de (Ireland)

ASN32934 (FACEBOOK, US)

www.facebook.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:2190:6000:19:fc2c:a140:93a1 (United States)

ASN16509 (AMAZON-02, US)

d.agkn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 23.45.237.36 (United States)

ASN20940 (AKAMAI-ASN1, EU)
PTR: a23-45-237-36.deploy.static.akamaitechnologies.com

stags.bluekai.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

10 2a00:1450:4001:81a::2002 (Frankfurt am Main, Germany) 6 redirects

ASN15169 (GOOGLE, US)

googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

10 2a00:1450:4001:825::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 151.101.113.175 (Frankfurt am Main, Germany)

ASN54113 (FASTLY, US)

nebula-cdn.kampyle.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 46.51.196.250 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-46-51-196-250.eu-west-1.compute.amazonaws.com

insight.adsrvr.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 35.241.45.82 (Ascension Island)

ASN15169 (GOOGLE, US)
PTR: 82.45.241.35.bc.googleusercontent.com

udc-neb.kampyle.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 91.235.132.130 (Netherlands)

ASN30286 (THM, US)
PTR: h.online-metrix.net

h.online-metrix.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 91.235.134.131 (Netherlands)

ASN30286 (THM, US)

89oebq5krr5dakmqy7madoyk5t57gvtfx2h3rxwdb6087d1243c030c0am1.e.aa.online-metrix.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 192.193.200.243 (United States)

ASN32287 (SOLANA-CITIPLEX, US)

prod.report.nacustomerexperience.citi.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:816::2013 (Frankfurt am Main, Germany) 1 redirects

ASN15169 (GOOGLE, US)

px0.pbbl.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.29.85.133 (Frankfurt am Main, Germany) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-52-29-85-133.eu-central-1.compute.amazonaws.com

aa.agkn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
77	citi.com 1 redirects online.citi.com metrics1.citi.com www.citi.com content22.online.citi.com prod.report.nacustomerexperience.citi.com	1 MB
16	ensighten.com nexus.ensighten.com	261 KB
14	google.com 6 redirects cse.google.com www.google.com	106 KB
12	doubleclick.net 7 redirects 6260004.fls.doubleclick.net googleads.g.doubleclick.net	10 KB
10	google.de www.google.de	1 KB
6	rfihub.com 1 redirects a.rfihub.com 20766699p.rfihub.com s.rfihub.com 20779813p.rfihub.com	1 KB
5	demdex.net 1 redirects dpm.demdex.net citi.demdex.net	4 KB
4	pbbl.co 1 redirects cdn.pbbl.co px0.pbbl.co	9 KB
3	bing.com bat.bing.com	8 KB
3	medallia.com resources.digital-cloud-citi.medallia.com	60 KB
2	online-metrix.net h.online-metrix.net 89oebq5krr5dakmqy7madoyk5t57gvtfx2h3rxwdb6087d1243c030c0am1.e.aa.online-metrix.net	438 B
2	kampyle.com nebula-cdn.kampyle.com udc-neb.kampyle.com	6 KB
2	agkn.com 1 redirects d.agkn.com aa.agkn.com	983 B
2	adsrvr.org js.adsrvr.org insight.adsrvr.org	2 KB
2	iesnare.com mpsnare.iesnare.com	14 KB
2	omtrdc.net cdn.tt.omtrdc.net citicorpcreditservic.tt.omtrdc.net	16 KB
2	cyveillance.com cyseal.cyveillance.com	1 KB
2	rlcdn.com di.rlcdn.com api.rlcdn.com Failed sr.rlcdn.com	62 B
1	facebook.com www.facebook.com	157 B
1	ispot.tv pt.ispot.tv	315 B
1	googleadservices.com www.googleadservices.com	11 KB
1	ytimg.com s.ytimg.com	25 KB
1	youtube.com www.youtube.com	926 B
1	rfihub.net c1.rfihub.net	7 KB
1	bluekai.com stags.bluekai.com Failed
1	bkrtx.com tags.bkrtx.com	11 KB
1	googletagmanager.com www.googletagmanager.com	30 KB
1	everesttech.net 1 redirects cm.everesttech.net	554 B
1	citibank.com 1 redirects online.citibank.com	154 B
1	google.ro www.google.ro	1 KB
1	dns-cloud.net 1 redirects validation.information.dns-cloud.net	586 B
0	we-stats.com Failed cfr.us.v2.we-stats.com Failed
162	32

	Domain	Requested by
58	online.citi.com	1 redirects www.google.ro online.citi.com
16	nexus.ensighten.com	online.citi.com nexus.ensighten.com
13	www.google.com	6 redirects cse.google.com
11	content22.online.citi.com	online.citi.com content22.online.citi.com
10	www.google.de
10	googleads.g.doubleclick.net	6 redirects www.googleadservices.com
4	prod.report.nacustomerexperience.citi.com	online.citi.com
4	dpm.demdex.net	1 redirects online.citi.com
3	bat.bing.com	nexus.ensighten.com
3	a.rfihub.com	c1.rfihub.net
3	metrics1.citi.com	online.citi.com
3	resources.digital-cloud-citi.medallia.com	online.citi.com resources.digital-cloud-citi.medallia.com
2	px0.pbbl.co	1 redirects
2	6260004.fls.doubleclick.net	1 redirects www.googletagmanager.com
2	cdn.pbbl.co	nexus.ensighten.com cdn.pbbl.co
2	mpsnare.iesnare.com	online.citi.com mpsnare.iesnare.com
2	cyseal.cyveillance.com	online.citi.com cyseal.cyveillance.com
1	aa.agkn.com	1 redirects
1	89oebq5krr5dakmqy7madoyk5t57gvtfx2h3rxwdb6087d1243c030c0am1.e.aa.online-metrix.net
1	h.online-metrix.net	content22.online.citi.com
1	udc-neb.kampyle.com
1	insight.adsrvr.org	js.adsrvr.org
1	nebula-cdn.kampyle.com	resources.digital-cloud-citi.medallia.com
1	d.agkn.com
1	www.facebook.com
1	pt.ispot.tv
1	20779813p.rfihub.com	c1.rfihub.net
1	sr.rlcdn.com	nexus.ensighten.com
1	www.googleadservices.com	www.googletagmanager.com
1	js.adsrvr.org	nexus.ensighten.com
1	www.citi.com	online.citi.com
1	s.rfihub.com	1 redirects
1	20766699p.rfihub.com	c1.rfihub.net
1	s.ytimg.com	www.youtube.com
1	www.youtube.com	online.citi.com
1	c1.rfihub.net	nexus.ensighten.com
1	stags.bluekai.com	online.citi.com tags.bkrtx.com
1	cse.google.com	online.citi.com
1	tags.bkrtx.com	nexus.ensighten.com
1	www.googletagmanager.com	nexus.ensighten.com
1	cm.everesttech.net	1 redirects
1	citi.demdex.net	nexus.ensighten.com
1	citicorpcreditservic.tt.omtrdc.net	nexus.ensighten.com
1	cdn.tt.omtrdc.net	nexus.ensighten.com
1	di.rlcdn.com	online.citi.com
1	online.citibank.com	1 redirects
1	www.google.ro
1	validation.information.dns-cloud.net	1 redirects
0	cfr.us.v2.we-stats.com Failed	online.citi.com
0	api.rlcdn.com Failed	online.citi.com
162	50

This site contains links to these domains. Also see Links.

Domain
www.citi.com
www.citicards.com
banking.citi.com
www.lifeandmoney.citi.com
citi.com
www.facebook.com
www.twitter.com
www.youtube.com
www.citigroup.com
jobs.citi.com
citieasydeals.com
www.citiprivatepass.com
www.privatebank.citibank.com
itunes.apple.com
play.google.com
www.ipbus.citi.com
www.jdpower.com

Subject Issuer	Validity	Valid
*.google.ro GTS CA 1O1	`2020-04-07` - `2020-06-30`	3 months	crt.sh
online.citibank.com DigiCert SHA2 Extended Validation Server CA	`2020-03-13` - `2022-05-14`	2 years	crt.sh
nexus.ensighten.com DigiCert SHA2 Secure Server CA	`2019-10-03` - `2020-10-02`	a year	crt.sh
*.rlcdn.com Sectigo RSA Domain Validation Secure Server CA	`2020-04-14` - `2021-04-23`	a year	crt.sh
*.digital-cloud-citi.medallia.com SSL.com DV CA	`2018-11-13` - `2020-11-12`	2 years	crt.sh
cyseal.cyveillance.com Amazon	`2020-01-05` - `2021-02-05`	a year	crt.sh
*.tt.omtrdc.net DigiCert SHA2 High Assurance Server CA	`2017-10-26` - `2020-11-25`	3 years	crt.sh
*.demdex.net DigiCert SHA2 High Assurance Server CA	`2018-01-09` - `2021-02-12`	3 years	crt.sh
metrics1.citi.com DigiCert SHA2 Extended Validation Server CA	`2018-08-31` - `2020-08-30`	2 years	crt.sh
*.google-analytics.com GTS CA 1O1	`2020-04-07` - `2020-06-30`	3 months	crt.sh
*.bkrtx.com DigiCert SHA2 Secure Server CA	`2020-02-28` - `2021-05-29`	a year	crt.sh
*.google.com GTS CA 1O1	`2020-04-07` - `2020-06-30`	3 months	crt.sh
www.google.com GTS CA 1O1	`2020-04-07` - `2020-06-30`	3 months	crt.sh
*.rfihub.net DigiCert SHA2 Secure Server CA	`2020-04-01` - `2021-07-01`	a year	crt.sh
mpsnare.iesnare.com DigiCert SHA2 High Assurance Server CA	`2019-04-24` - `2020-05-26`	a year	crt.sh
*.rfihub.com DigiCert SHA2 Secure Server CA	`2019-08-27` - `2020-08-31`	a year	crt.sh
www.citi.com DigiCert SHA2 Extended Validation Server CA	`2019-10-17` - `2022-01-01`	2 years	crt.sh
content22.online.citi.com DigiCert SHA2 Extended Validation Server CA	`2018-08-06` - `2020-08-06`	2 years	crt.sh
*.adsrvr.org Trustwave Organization Validation SHA256 CA, Level 1	`2019-03-07` - `2021-04-19`	2 years	crt.sh
www.bing.com Microsoft IT TLS CA 2	`2019-04-30` - `2021-04-30`	2 years	crt.sh
www.googleadservices.com GTS CA 1O1	`2020-04-07` - `2020-06-30`	3 months	crt.sh
*.pbbl.co Amazon	`2020-01-01` - `2021-02-01`	a year	crt.sh
*.doubleclick.net GTS CA 1O1	`2020-04-07` - `2020-06-30`	3 months	crt.sh
f3.shared.global.fastly.net GlobalSign CloudSSL CA - SHA256 - G3	`2020-04-16` - `2021-04-17`	a year	crt.sh
*.facebook.com DigiCert SHA2 High Assurance Server CA	`2020-04-15` - `2020-07-14`	3 months	crt.sh
*.agkn.com RapidSSL RSA CA 2018	`2018-06-21` - `2020-09-16`	2 years	crt.sh
odc-prod-01.oracle.com DigiCert Secure Site ECC CA-1	`2020-04-14` - `2021-04-10`	a year	crt.sh
*.g.doubleclick.net GTS CA 1O1	`2020-04-07` - `2020-06-30`	3 months	crt.sh
www.google.de GTS CA 1O1	`2020-04-07` - `2020-06-30`	3 months	crt.sh
j.ssl.fastly.net GlobalSign Organization Validation CA - SHA256 - G2	`2020-04-23` - `2020-06-11`	2 months	crt.sh
*.kampyle.com RapidSSL RSA CA 2018	`2020-02-11` - `2022-03-06`	2 years	crt.sh
h.online-metrix.net Trustwave Organization Validation SHA256 CA, Level 1	`2020-02-20` - `2021-02-19`	a year	crt.sh
*.e.aa.online-metrix.net Go Daddy Secure Certificate Authority - G2	`2019-09-13` - `2021-09-13`	2 years	crt.sh
prod.report.nacustomerexperience.citi.com DigiCert Global CA G2	`2018-07-05` - `2020-07-04`	2 years	crt.sh
px0.pbbl.co GTS CA 1D2	`2020-04-30` - `2020-07-29`	3 months	crt.sh

This page contains 15 frames:

Primary Page: https://online.citi.com/US/login.do?JFP_TOKEN=3RQ3Y559
Frame ID: F708E9992871DAA43EE1E9837F2E1995
Requests: 140 HTTP requests in this frame

Frame: https://citi.demdex.net/dest5.html?d_nsid=0
Frame ID: DA443EA0A056E1F261F88D72525109DC
Requests: 1 HTTP requests in this frame

Frame: https://20766699p.rfihub.com/ca.html?rfiidc=1871597495045692823&rfiaid=f804af61beca40bf9748474318876071&ver=9&ra=632&rb=648&ca=20766699&_o=17169175&_t=noncookiedusernamepassword&ssv_cuuid=&ssv_pagename=noncookiedusernamepassword&pe=https%3A%2F%2Fonline.citi.com%2FUS%2Flogin.do%3FJFP_TOKEN%3D3RQ3Y559&pf=https%3A%2F%2Fwww.google.ro%2F&ra=9413098787311582
Frame ID: 26F412235E87EE4E31B1E7B503421EE8
Requests: 1 HTTP requests in this frame

Frame: https://sr.rlcdn.com/425466.html?es=80676&u=da39a3ee5e6b4b0d3255bfef95601890afd80709
Frame ID: AB7662AE60E070E0E3735A2C58C4F325
Requests: 1 HTTP requests in this frame

Frame: https://20779813p.rfihub.com/ca.html?rfiidc=1871597495045692823&rfiaid=f804af61beca40bf9748474318876071&ver=9&ra=1852&rb=648&ca=20779813&_o=17169175&_t=20779813&pe=https%3A%2F%2Fonline.citi.com%2FUS%2Flogin.do%3FJFP_TOKEN%3D3RQ3Y559&pf=https%3A%2F%2Fwww.google.ro%2F&ra=9123664344616131
Frame ID: 55E83682DF3FA2AEC19F4C96B4D6857D
Requests: 1 HTTP requests in this frame

Frame: https://6260004.fls.doubleclick.net/activityi;dc_pre=CMPqz-T4kOkCFdanGwod73EIXg;src=6260004;type=citih0;cat=citih00;qty=1;cost=1;ord=7240636854035.425;gtm=2od4f0;auiddc=1404517603.1588276967;~oref=https%3A%2F%2Fonline.citi.com%2FUS%2Flogin.do%3FJFP_TOKEN%3D3RQ3Y559
Frame ID: 4687F4FAB9014EF2EF05FFB4B2284B3D
Requests: 1 HTTP requests in this frame

Frame: https://stags.bluekai.com/site/63068?ret=html&phint=language%3Denglish&phint=product%3D&phint=event&phint=category%3Dpre-login%20Sign%20on%20page&phint=page%3DNon%20Cookied%20Username%20Password%20&phint=section1%3DPublic&phint=section2%3DSignOn&phint=section3%3D&phint=section4%3D&phint=bankappstatus&phint=productID&phint=__bk_t%3DOnline%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&phint=__bk_k%3Dbanking%2C%20citi%2C%20financial%20services%2C%20checking%20account%2C%20savings%20account%2C%20credit%20cards&phint=__bk_pr%3Dhttps%3A%2F%2Fwww.google.ro%2F&phint=__bk_l%3Dhttps%3A%2F%2Fonline.citi.com%2FUS%2Flogin.do%3FJFP_TOKEN%3D3RQ3Y559&phint=__bk_v%3D3.1.4&limit=10&r=45507813
Frame ID: BB1B96217063A86EC1CDC54FA8C6EAC7
Requests: 1 HTTP requests in this frame

Frame: https://insight.adsrvr.org/track/up?adv=1jw5cvl&ref=https%3A%2F%2Fonline.citi.com%2FUS%2Flogin.do%3FJFP_TOKEN%3D3RQ3Y559&upid=t1sl5ty&upv=1.1.0&orderid={orderid}&v={v}&vf={vf}&td1=jUSCBOL_Loginpage_Uncookied&td2=undefined&td3=undefined&td4=Non%20Cookied%20Username%20Password%20&td5=https://online.citi.com/US/login.do?JFP_TOKEN=3RQ3Y559&td6={td6}&td7={td7}&td8={td8}&td9={td9}&td10={td10}
Frame ID: B274D53D20BE1E21B2325CC0796C7396
Requests: 1 HTTP requests in this frame

Frame: https://content22.online.citi.com/fp/check.js;CIS3SID=49B19B296A24D47372FE5748E722A335?org_id=89oebq5k&session_id=870e3f8c1f2b672c1fbc2ee2a3dabc92778d9976d890f49f675074a30b0aca59&nonce=b6087d1243c030c0&pageid=1&jb=3b352626687167773d4e6b6c777a2468736d3f4e6b6e757a266873623f4160706d6f6d253a383536
Frame ID: D79859A50AC94D4DA4D56964D173E1DA
Requests: 9 HTTP requests in this frame

Frame: https://content22.online.citi.com/fp/ls_fp.html;CIS3SID=49B19B296A24D47372FE5748E722A335?org_id=89oebq5k&session_id=870e3f8c1f2b672c1fbc2ee2a3dabc92778d9976d890f49f675074a30b0aca59&nonce=b6087d1243c030c0&pageid=1
Frame ID: 8364F66945A3CF167D3653196109B8E1
Requests: 1 HTTP requests in this frame

Frame: https://h.online-metrix.net/fp/sid_fp.html;CIS3SID=49B19B296A24D47372FE5748E722A335?org_id=89oebq5k&session_id=870e3f8c1f2b672c1fbc2ee2a3dabc92778d9976d890f49f675074a30b0aca59&nonce=b6087d1243c030c0&pageid=1
Frame ID: C91E15AEFCEDD4DB60AE3B21FC872153
Requests: 1 HTTP requests in this frame

Frame: https://content22.online.citi.com/fp/top_fp.html;CIS3SID=49B19B296A24D47372FE5748E722A335?org_id=89oebq5k&session_id=870e3f8c1f2b672c1fbc2ee2a3dabc92778d9976d890f49f675074a30b0aca59&nonce=b6087d1243c030c0&pageid=1
Frame ID: 15A8FF58167DA9327B437759B9C42880
Requests: 1 HTTP requests in this frame

Frame: https://cdn.pbbl.co/i/pp.html
Frame ID: A35BE82540BF0640E0D113A1F2D93448
Requests: 1 HTTP requests in this frame

Frame: https://a.rfihub.com/pstats.html?rb=648&ca=20766699&ri=652cadc13ebfcde66be10c2d4cc45250&rfiidc=1871597495045692823&rfiaid=f804af61beca40bf9748474318876071&stats=%7B%7D&ra=06706145086691384
Frame ID: A44057F2C2D13597839CE36F2DAFCA16
Requests: 1 HTTP requests in this frame

Frame: https://a.rfihub.com/pstats.html?rb=648&ca=20779813&ri=72e163d90704c37091b56f060a44ee97&rfiidc=1871597495045692823&rfiaid=f804af61beca40bf9748474318876071&stats=%7B%7D&ra=2590993627736162
Frame ID: 326C98534EDF030504A79EE9AA9E88EE
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

http://validation.information.dns-cloud.net/citi-onlinebanking/Login.php HTTP 302
https://www.google.ro/url?sa=t&rct=j&q=&esrc=s&source=web&cd=1&cad=rja&uact=8&ved=0CBwQFjAAahUKEwj... Page URL
https://online.citibank.com/ HTTP 301
https://online.citi.com/US/JPS/portal/Index.do HTTP 302
https://online.citi.com/US/login.do?JFP_TOKEN=3RQ3Y559 Page URL

Detected technologies

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

url /\.php(?:$|\?)/i

Google Web Server (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /gws/i

Ensighten (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

script /\/\/nexus\.ensighten\.com\//i

Page Statistics

162
Requests

98 %
HTTPS

27 %
IPv6

32
Domains

50
Subdomains

41
IPs

7
Countries

2059 kB
Transfer

6140 kB
Size

33
Cookies

24 Outgoing links

These are links going to different origins than the main page.

URL: https://www.citi.com/credit-cards/compare-credit-cards/citi.action?ID=view-all-credit-cards
Title: View All Credit Cards

Search URL Search Domain Scan URL

URL: https://www.citi.com/credit-cards/compare-credit-cards/citi.action?ID=low-interest-credit-card
Title: 0% Intro APR Credit Cards

Search URL Search Domain Scan URL

URL: https://www.citi.com/credit-cards/compare-credit-cards/citi.action?ID=balance-transfer-credit-cards
Title: Balance Transfer Credit Cards

Search URL Search Domain Scan URL

URL: https://www.citi.com/credit-cards/compare-credit-cards/citi.action?ID=reward-credit-cards
Title: Rewards Credit Cards

Search URL Search Domain Scan URL

URL: https://www.citicards.com/cards/credit/application/flow.action?isInvitation=N&OC=CC-CITI-3D5
Title: See If You're Pre-Qualified

Search URL Search Domain Scan URL

URL: https://www.citi.com/credit-cards/compare-credit-cards/citi.action?ID=all-small-business-credit-cards&m=f
Title: Small Business Credit Cards

Search URL Search Domain Scan URL

URL: https://www.citi.com/credit-cards/compare-credit-cards/citi.action?ID=view-all-credit-cards&afc=105&intc=1~1~52~6~BANR~1~mpc_Default_citicomREDPE_aug2016
Title:

Search URL Search Domain Scan URL

URL: https://www.citicards.com/cards/credit/application/flow.action?isInvitation=N&OC=CC-CITI-WAN&intc=2~2~51~1~082019~1~PreQualification~Citicards~WN4
Title: Apply for a Citi Credit Card Today

Search URL Search Domain Scan URL

URL: https://www.citi.com/credit-cards/credit-card-details/citi.action?ID=citi-rewards-plus-credit-card&afc=106
Title: The Citi Rewards+SM Card

Search URL Search Domain Scan URL

URL: https://banking.citi.com/cbol/savings/high-yield-savings/default.htm?channel=onsite&promo_ID=4CEWQH4ZENCHPC&intc=1~1~52~6~BANR~2~HYS_SaveOOBTA_Dont~XPX
Title: Don't Miss Out on 1.55% APY

Search URL Search Domain Scan URL

URL: https://www.lifeandmoney.citi.com/money/family/personal-financial-planning-for-families

Search URL Search Domain Scan URL

URL: https://citi.com/citi/covid-19.htm

Search URL Search Domain Scan URL

URL: https://www.facebook.com/citi
Title:

Search URL Search Domain Scan URL

URL: https://www.twitter.com/citi
Title:

Search URL Search Domain Scan URL

URL: https://www.youtube.com/citi
Title:

Search URL Search Domain Scan URL

URL: http://www.citigroup.com/citi/
Title: Our Story

Search URL Search Domain Scan URL

URL: https://jobs.citi.com/
Title: Careers

Search URL Search Domain Scan URL

URL: https://citieasydeals.com/
Title: Citi Easy DealsSM

Search URL Search Domain Scan URL

URL: http://www.citiprivatepass.com/
Title: Citi EntertainmentSM

Search URL Search Domain Scan URL

URL: https://www.privatebank.citibank.com/
Title: Citi Private Bank

Search URL Search Domain Scan URL

URL: https://itunes.apple.com/app/citi-mobile-sm/id301724680?mt=8
Title:

Search URL Search Domain Scan URL

URL: https://play.google.com/store/apps/details?id=com.citi.citimobile
Title:

Search URL Search Domain Scan URL

URL: https://www.ipbus.citi.com/
Title: International Personal Bank U.S.

Search URL Search Domain Scan URL

URL: http://www.jdpower.com/awards
Title: jdpower.com/awards

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://validation.information.dns-cloud.net/citi-onlinebanking/Login.php HTTP 302
https://www.google.ro/url?sa=t&rct=j&q=&esrc=s&source=web&cd=1&cad=rja&uact=8&ved=0CBwQFjAAahUKEwjRzomd1pTIAhVB1RoKHfIwAV0&url=https%3A%2F%2Fonline.citibank.com%2F&usg=AFQjCNH-zqrGKnLkLZ-i-DRUiyct_qlSpw Page URL
https://online.citibank.com/ HTTP 301
https://online.citi.com/US/JPS/portal/Index.do HTTP 302
https://online.citi.com/US/login.do?JFP_TOKEN=3RQ3Y559 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0

http://validation.information.dns-cloud.net/citi-onlinebanking/Login.php HTTP 302
https://www.google.ro/url?sa=t&rct=j&q=&esrc=s&source=web&cd=1&cad=rja&uact=8&ved=0CBwQFjAAahUKEwjRzomd1pTIAhVB1RoKHfIwAV0&url=https%3A%2F%2Fonline.citibank.com%2F&usg=AFQjCNH-zqrGKnLkLZ-i-DRUiyct_qlSpw

Request Chain 32

https://dpm.demdex.net/id?d_visid_ver=3.1.2&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=61834D9B5228A7430A490D45%40AdobeOrg&d_nsid=0&ts=1588276966285 HTTP 302
https://dpm.demdex.net/id/rd?d_visid_ver=3.1.2&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=61834D9B5228A7430A490D45%40AdobeOrg&d_nsid=0&ts=1588276966285

Request Chain 41

https://cm.everesttech.net/cm/dd?d_uuid=83352382745646397341532672648230344974 HTTP 302
https://dpm.demdex.net/ibs:dpid=411&dpuuid=Xqsu5gAAAb1tMi3-

Request Chain 85

https://s.rfihub.com/uidm?_o=17169175&_u=fe255924-87aa-430f-a458-fc324e379fc3&_sm=:R22534S@A4VK2nC24944S@A4VK2nC2232L2@A4VK2nS2233L2@A4VK2nS28259S1@A4VK2nS28266S1@A4VK2nS28267S1@A4VK2nS28227S1@A4VK2nS1045T2@A4VK2nS49119S@A4VK2nC2569L5@A4VK2nS38573S1@A4VK2nS&redirect=32 HTTP 302
https://www.citi.com/credit-cards/rfuidmatch/citi.action?XP_UID=SY-00GflAAW61nZc=583

Request Chain 110

https://6260004.fls.doubleclick.net/activityi;src=6260004;type=citih0;cat=citih00;qty=1;cost=1;ord=7240636854035.425;gtm=2od4f0;auiddc=1404517603.1588276967;~oref=https%3A%2F%2Fonline.citi.com%2FUS%2Flogin.do%3FJFP_TOKEN%3D3RQ3Y559 HTTP 302
https://6260004.fls.doubleclick.net/activityi;dc_pre=CMPqz-T4kOkCFdanGwod73EIXg;src=6260004;type=citih0;cat=citih00;qty=1;cost=1;ord=7240636854035.425;gtm=2od4f0;auiddc=1404517603.1588276967;~oref=https%3A%2F%2Fonline.citi.com%2FUS%2Flogin.do%3FJFP_TOKEN%3D3RQ3Y559

Request Chain 120

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/975701947/?random=1588276969611&cv=9&fst=1588276969611&num=1&fmt=3&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2od4f0&sendb=1&ig=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fonline.citi.com%2FUS%2Flogin.do%3FJFP_TOKEN%3D3RQ3Y559&ref=https%3A%2F%2Fwww.google.ro%2F&tiba=Online%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&hn=www.googleadservices.com&async=1 HTTP 302
https://www.google.com/pagead/1p-user-list/975701947/?random=1588276969611&cv=9&fst=1588276800000&num=1&fmt=3&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2od4f0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fonline.citi.com%2FUS%2Flogin.do%3FJFP_TOKEN%3D3RQ3Y559&ref=https%3A%2F%2Fwww.google.ro%2F&tiba=Online%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&async=1&is_vtc=1&random=1234346003&resp=GooglemKTybQhCsO HTTP 302
https://www.google.de/pagead/1p-user-list/975701947/?random=1588276969611&cv=9&fst=1588276800000&num=1&fmt=3&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2od4f0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fonline.citi.com%2FUS%2Flogin.do%3FJFP_TOKEN%3D3RQ3Y559&ref=https%3A%2F%2Fwww.google.ro%2F&tiba=Online%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&async=1&is_vtc=1&random=1234346003&resp=GooglemKTybQhCsO&ipr=y&ezwbk=AZuM4hAwua1hMoCKcyCla81dgz2cEqvxXg6XipDCM4WoqSKFHZk3vt_tPAhANv7anGqZr5C3cQr9XV25k1pxRiq8LFrw

Request Chain 121

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/819500023/?random=1588276969611&cv=9&fst=1588276969611&num=1&fmt=3&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2od4f0&sendb=1&ig=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fonline.citi.com%2FUS%2Flogin.do%3FJFP_TOKEN%3D3RQ3Y559&ref=https%3A%2F%2Fwww.google.ro%2F&tiba=Online%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&hn=www.googleadservices.com&async=1 HTTP 302
https://www.google.com/pagead/1p-user-list/819500023/?random=1588276969611&cv=9&fst=1588276800000&num=1&fmt=3&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2od4f0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fonline.citi.com%2FUS%2Flogin.do%3FJFP_TOKEN%3D3RQ3Y559&ref=https%3A%2F%2Fwww.google.ro%2F&tiba=Online%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&async=1&is_vtc=1&random=2015971103&resp=GooglemKTybQhCsO HTTP 302
https://www.google.de/pagead/1p-user-list/819500023/?random=1588276969611&cv=9&fst=1588276800000&num=1&fmt=3&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2od4f0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fonline.citi.com%2FUS%2Flogin.do%3FJFP_TOKEN%3D3RQ3Y559&ref=https%3A%2F%2Fwww.google.ro%2F&tiba=Online%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&async=1&is_vtc=1&random=2015971103&resp=GooglemKTybQhCsO&ipr=y&ezwbk=AZuM4hDUj0ro-DnOIK3eKG0NUAn5lbHG1KQMvS-_QPnyACojdy1Zas_PW5uWLNVzw2INH1UQTj1ynPmHxnjJUnZEQJ6k

Request Chain 122

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/959299794/?random=1588276969612&cv=9&fst=1588276969612&num=1&fmt=3&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2od4f0&sendb=1&ig=1&data=event%3Dconversion&frm=0&url=https%3A%2F%2Fonline.citi.com%2FUS%2Flogin.do%3FJFP_TOKEN%3D3RQ3Y559&ref=https%3A%2F%2Fwww.google.ro%2F&tiba=Online%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&hn=www.googleadservices.com&async=1 HTTP 302
https://www.google.com/pagead/1p-user-list/959299794/?random=1588276969612&cv=9&fst=1588276800000&num=1&fmt=3&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2od4f0&sendb=1&data=event%3Dconversion&frm=0&url=https%3A%2F%2Fonline.citi.com%2FUS%2Flogin.do%3FJFP_TOKEN%3D3RQ3Y559&ref=https%3A%2F%2Fwww.google.ro%2F&tiba=Online%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&async=1&is_vtc=1&random=302494715&resp=GooglemKTybQhCsO HTTP 302
https://www.google.de/pagead/1p-user-list/959299794/?random=1588276969612&cv=9&fst=1588276800000&num=1&fmt=3&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2od4f0&sendb=1&data=event%3Dconversion&frm=0&url=https%3A%2F%2Fonline.citi.com%2FUS%2Flogin.do%3FJFP_TOKEN%3D3RQ3Y559&ref=https%3A%2F%2Fwww.google.ro%2F&tiba=Online%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&async=1&is_vtc=1&random=302494715&resp=GooglemKTybQhCsO&ipr=y&ezwbk=AZuM4hABxzntrDvVo5diIdxVqtJDGROsfV4S2dd2PbYF-zYQb34ZDjMM5sqlXcWsiUhfZXoieCg29ReRyjCJhbTxa1Uf

Request Chain 123

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/916451471/?random=1588276969612&cv=9&fst=1588276969612&num=1&fmt=3&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2od4f0&sendb=1&ig=1&data=event%3Dconversion&frm=0&url=https%3A%2F%2Fonline.citi.com%2FUS%2Flogin.do%3FJFP_TOKEN%3D3RQ3Y559&ref=https%3A%2F%2Fwww.google.ro%2F&tiba=Online%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&hn=www.googleadservices.com&async=1 HTTP 302
https://www.google.com/pagead/1p-user-list/916451471/?random=1588276969612&cv=9&fst=1588276800000&num=1&fmt=3&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2od4f0&sendb=1&data=event%3Dconversion&frm=0&url=https%3A%2F%2Fonline.citi.com%2FUS%2Flogin.do%3FJFP_TOKEN%3D3RQ3Y559&ref=https%3A%2F%2Fwww.google.ro%2F&tiba=Online%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&async=1&is_vtc=1&random=3583965345&resp=GooglemKTybQhCsO HTTP 302
https://www.google.de/pagead/1p-user-list/916451471/?random=1588276969612&cv=9&fst=1588276800000&num=1&fmt=3&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2od4f0&sendb=1&data=event%3Dconversion&frm=0&url=https%3A%2F%2Fonline.citi.com%2FUS%2Flogin.do%3FJFP_TOKEN%3D3RQ3Y559&ref=https%3A%2F%2Fwww.google.ro%2F&tiba=Online%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&async=1&is_vtc=1&random=3583965345&resp=GooglemKTybQhCsO&ipr=y&ezwbk=AZuM4hAvPnvKsYTXwH-O-ShRWKuH_QeSt_rXq3Q2aIo95hqbRly5aEvE3AL9QvBjQwxPue4UWiEWxM6tPyCDxEjLIJZo

Request Chain 124

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/975701947/?random=1588276969612&cv=9&fst=1588276969612&num=1&fmt=3&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2od4f0&sendb=1&ig=1&data=event%3Dconversion&frm=0&url=https%3A%2F%2Fonline.citi.com%2FUS%2Flogin.do%3FJFP_TOKEN%3D3RQ3Y559&ref=https%3A%2F%2Fwww.google.ro%2F&tiba=Online%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&hn=www.googleadservices.com&async=1 HTTP 302
https://www.google.com/pagead/1p-user-list/975701947/?random=1588276969612&cv=9&fst=1588276800000&num=1&fmt=3&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2od4f0&sendb=1&data=event%3Dconversion&frm=0&url=https%3A%2F%2Fonline.citi.com%2FUS%2Flogin.do%3FJFP_TOKEN%3D3RQ3Y559&ref=https%3A%2F%2Fwww.google.ro%2F&tiba=Online%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&async=1&is_vtc=1&random=57541276&resp=GooglemKTybQhCsO HTTP 302
https://www.google.de/pagead/1p-user-list/975701947/?random=1588276969612&cv=9&fst=1588276800000&num=1&fmt=3&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2od4f0&sendb=1&data=event%3Dconversion&frm=0&url=https%3A%2F%2Fonline.citi.com%2FUS%2Flogin.do%3FJFP_TOKEN%3D3RQ3Y559&ref=https%3A%2F%2Fwww.google.ro%2F&tiba=Online%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&async=1&is_vtc=1&random=57541276&resp=GooglemKTybQhCsO&ipr=y&ezwbk=AZuM4hCbe8-ZEADs9TidepI4XV5T8XbI2eyR1wZVcZybsNhSWdTP4nuW935x1T-h9OynBWUMcoQLjLc8FKI02HXXn_xZ

Request Chain 125

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/677332377/?random=1588276969613&cv=9&fst=1588276969613&num=1&fmt=3&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2od4f0&sendb=1&ig=1&data=event%3Dconversion&frm=0&url=https%3A%2F%2Fonline.citi.com%2FUS%2Flogin.do%3FJFP_TOKEN%3D3RQ3Y559&ref=https%3A%2F%2Fwww.google.ro%2F&tiba=Online%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&hn=www.googleadservices.com&async=1 HTTP 302
https://www.google.com/pagead/1p-user-list/677332377/?random=1588276969613&cv=9&fst=1588276800000&num=1&fmt=3&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2od4f0&sendb=1&data=event%3Dconversion&frm=0&url=https%3A%2F%2Fonline.citi.com%2FUS%2Flogin.do%3FJFP_TOKEN%3D3RQ3Y559&ref=https%3A%2F%2Fwww.google.ro%2F&tiba=Online%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&async=1&is_vtc=1&random=3960329207&resp=GooglemKTybQhCsO HTTP 302
https://www.google.de/pagead/1p-user-list/677332377/?random=1588276969613&cv=9&fst=1588276800000&num=1&fmt=3&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2od4f0&sendb=1&data=event%3Dconversion&frm=0&url=https%3A%2F%2Fonline.citi.com%2FUS%2Flogin.do%3FJFP_TOKEN%3D3RQ3Y559&ref=https%3A%2F%2Fwww.google.ro%2F&tiba=Online%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&async=1&is_vtc=1&random=3960329207&resp=GooglemKTybQhCsO&ipr=y&ezwbk=AZuM4hBJ75Ms3oyfIYTsLhVzEPtqVyxjUUf7guIGK8dW0VWcNGzzSsGJpa9TVQMYLYmy9_h7yNFF4M7rGEafC14CjiOa

Request Chain 154

https://px0.pbbl.co/ns/__p2.gif?ppid=be9589e0-9427-41e8-8a54-f523ed2eef79&chk=false&brid=1560&brcid=fe255924-87aa-430f-a458-fc324e379fc3&email=&orderId=&orderValue=&productId=&offerCode=&label=&pageUrl=https%3A%2F%2Fonline.citi.com%2FUS%2Flogin.do%3FJFP_TOKEN%3D3RQ3Y559&referrerUrl=https%3A%2F%2Fwww.google.ro%2F&targetUrl=https%3A%2F%2Fonline.citi.com%2FUS%2Flogin.do%3FJFP_TOKEN%3D3RQ3Y559&sessionId=&markerType=seg&rand=rSJHHzsX6hBCvfGQ&iabOptOut=-&jsVer=3.2.1&frVer=1.1&markerId=348192 HTTP 302
https://aa.agkn.com/adscores/g.pixel?sid=9212282598&_ppid=be9589e0-9427-41e8-8a54-f523ed2eef79&_segid=99&iid=1d4543f3-5138-4eec-a4d3-e9f193b5b968 HTTP 302
https://px0.pbbl.co/adadvisor.gif?segment=000&_ppid=be9589e0-9427-41e8-8a54-f523ed2eef79&_segid=99&_zip=&hk=&iid=1d4543f3-5138-4eec-a4d3-e9f193b5b968&mt=&bd=

162 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

url Show response
www.google.ro/
Redirect Chain

http://validation.information.dns-cloud.net/citi-onlinebanking/Login.php
https://www.google.ro/url?sa=t&rct=j&q=&esrc=s&source=web&cd=1&cad=rja&uact=8&ved=0CBwQFjAAahUKEwjRzomd1pTIAhVB1RoKHfIwAV0&url=https%3A%2F%2Fonline.citibank.com%2F&usg=AFQjCNH-zqrGKnLkLZ-i-DRUiyct_...

920 B
1 KB

52ms
32ms

Document
text/html

2a00:1450:4001:817::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.ro/url?sa=t&rct=j&q=&esrc=s&source=web&cd=1&cad=rja&uact=8&ved=0CBwQFjAAahUKEwjRzomd1pTIAhVB1RoKHfIwAV0&url=https%3A%2F%2Fonline.citibank.com%2F&usg=AFQjCNH-zqrGKnLkLZ-i-DRUiyct_qlSpw

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:817::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

gws /

Resource Hash

b6e9d065a465bbb985fd55235fcffb2331504d35da93eda00afef1905521c8a3

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Xss-Protection	0

Request headers

:method: GET
:authority: www.google.ro
:scheme: https
:path: /url?sa=t&rct=j&q=&esrc=s&source=web&cd=1&cad=rja&uact=8&ved=0CBwQFjAAahUKEwjRzomd1pTIAhVB1RoKHfIwAV0&url=https%3A%2F%2Fonline.citibank.com%2F&usg=AFQjCNH-zqrGKnLkLZ-i-DRUiyct_qlSpw
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: none
sec-fetch-mode: navigate
sec-fetch-user: ?1
sec-fetch-dest: document
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

status: 200
date: Thu, 30 Apr 2020 20:02:45 GMT
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
cache-control: no-cache, must-revalidate
content-type: text/html; charset=UTF-8
strict-transport-security: max-age=31536000
p3p: CP="This is not a P3P policy! See g.co/p3phelp for more info."
content-encoding: br
server: gws
content-length: 471
x-xss-protection: 0
set-cookie: NID=203=DVf3xeUUlf3lbWVnoHFFSxiiRb4QOHA8b_8DOTWpjWyi7Ek8kJQHdj_PmsWFzv9pbZ_36b-ZMVoev0XQ3RmXil9-8HeLJiAKAYIu7cqNsbxQUCuCfR0jPd2kPyyz8i7gLa8l-0qCsRK_g7R-G-y_NOsJNSeqOkzHUj1YSQzpbzg; expires=Fri, 30-Oct-2020 20:02:45 GMT; path=/; domain=.google.ro; Secure; HttpOnly; SameSite=none CONSENT=WP.286458; expires=Fri, 01-Jan-2038 00:00:00 GMT; path=/; domain=.google.ro
alt-svc: h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

Redirect headers

Date: Thu, 30 Apr 2020 20:02:44 GMT
Server: Apache
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
Set-Cookie: PHPSESSID=300c222a403ca86533f876df7172e72b; path=/
Location: https://www.google.ro/url?sa=t&rct=j&q=&esrc=s&source=web&cd=1&cad=rja&uact=8&ved=0CBwQFjAAahUKEwjRzomd1pTIAhVB1RoKHfIwAV0&url=https%3A%2F%2Fonline.citibank.com%2F&usg=AFQjCNH-zqrGKnLkLZ-i-DRUiyct_qlSpw
Keep-Alive: timeout=5, max=99
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8

GET
H2

200

Primary Request login.do Show response
online.citi.com/US/
Redirect Chain

https://online.citibank.com/
https://online.citi.com/US/JPS/portal/Index.do
https://online.citi.com/US/login.do?JFP_TOKEN=3RQ3Y559

310 KB
108 KB

566ms
566ms

Document
text/html

104.109.92.187
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://online.citi.com/US/login.do?JFP_TOKEN=3RQ3Y559

Requested by

Host: www.google.ro
URL: https://www.google.ro/url?sa=t&rct=j&q=&esrc=s&source=web&cd=1&cad=rja&uact=8&ved=0CBwQFjAAahUKEwjRzomd1pTIAhVB1RoKHfIwAV0&url=https%3A%2F%2Fonline.citibank.com%2F&usg=AFQjCNH-zqrGKnLkLZ-i-DRUiyct_qlSpw

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.109.92.187 , Netherlands, ASN20940 (AKAMAI-ASN1, EU),

Reverse DNS

a104-109-92-187.deploy.static.akamaitechnologies.com

Software

Resource Hash

2fc2de39e8f7ef461ecbf5894fd989352dc7f387380a50882af2788795f3407c

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

:method: GET
:authority: online.citi.com
:scheme: https
:path: /US/login.do?JFP_TOKEN=3RQ3Y559
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: document
referer: https://www.google.ro/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: JSESSIONID=0000U3hh8fLJ5Pf2hsR-031W8OL:gt02p-srv3; TLTSID=599b119873af5ec508362e219f21ef6f7ba846bcf38d806d9d39e6ee2a86fc70; CUUID=fe255924-87aa-430f-a458-fc324e379fc3; CITI_SITE=gtdc; AKMTLTSID=4C2CDD8C02CD596E71003DD09CC0F73F
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: https://www.google.ro/url?sa=t&rct=j&q=&esrc=s&source=web&cd=1&cad=rja&uact=8&ved=0CBwQFjAAahUKEwjRzomd1pTIAhVB1RoKHfIwAV0&url=https%3A%2F%2Fonline.citibank.com%2F&usg=AFQjCNH-zqrGKnLkLZ-i-DRUiyct_qlSpw

Response headers

status: 200
content-type: text/html; charset=ISO-8859-1
x-ion-hop: Prod
expires: Thu, 01 Jan 1970 00:00:00 GMT
cid: gt02p-srv3
cache-control: no-cache, must-revalidate, proxy-revalidate, no-store
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
pragma: no-cache
x-akamai-citisite: GTDC
x-debug-drain: GOOD-GTDC-NO
strict-transport-security: max-age=300
content-language: en-US
jid: 200430160245602356347143
x-ua-compatible: IE=edge
x-debug-tier2: c49fde-23.198.9.21-1588276965-AUTH1-SHPIP4.16.69.11-TCIP83.97.23.36
x-akamai-transformed: 9 - 0 pmb=mTOE,1
content-encoding: gzip
date: Thu, 30 Apr 2020 20:02:46 GMT
vary: Accept-Encoding
set-cookie: CUUID=fe255924-87aa-430f-a458-fc324e379fc3; Expires=Thu, 01-Dec-94 16:00:00 GMT; Path=/; Secure CUUID=fe255924-87aa-430f-a458-fc324e379fc3; Expires=Fri, 30-Apr-21 20:02:45 GMT; Path=/; Domain=.citi.com; Secure CITI_SITE=gtdc; path=/; domain=.citi.com; secure; HttpOnly CITI_SITE=gtdc; path=/; domain=.citi.com; secure; HttpOnly
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

Redirect headers

status: 302
content-type: text/html; charset=UTF-8
content-length: 0
x-ion-hop: Prod
expires: Thu, 01 Jan 1970 00:00:00 GMT
cache-control: no-cache, must-revalidate, proxy-revalidate, no-store
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
pragma: no-cache
location: https://online.citi.com/US/login.do?JFP_TOKEN=3RQ3Y559
x-akamai-citisite: GTDC
strict-transport-security: max-age=300
content-language: en-US
x-debug-tier2-parent: 475ac381-23.223.202.141-1588276965-AUTH1-SHPIP23.198.9.22-TCIP83.97.23.36
jid: 200430160245602356347143
x-ua-compatible: IE=edge
x-debug-tier2: d9d4b66-23.198.9.22-1588276965-AUTH1-SHPIP4.16.69.12-TCIP83.97.23.36
date: Thu, 30 Apr 2020 20:02:45 GMT
set-cookie: JSESSIONID=0000U3hh8fLJ5Pf2hsR-031W8OL:gt02p-srv3; Path=/; Secure TLTSID=599b119873af5ec508362e219f21ef6f7ba846bcf38d806d9d39e6ee2a86fc70; Path=/; Domain=citi.com; Secure CUUID=fe255924-87aa-430f-a458-fc324e379fc3; Expires=Fri, 30-Apr-21 20:02:45 GMT; Path=/; Domain=.citi.com; Secure AKMTLTSID=7C1A119A669783C93ECE66BD6D8A7D2B; path=/; domain=citi.com; secure CITI_SITE=gtdc; path=/; domain=.citi.com; secure; HttpOnly AKMTLTSID=4C2CDD8C02CD596E71003DD09CC0F73F; path=/; domain=citi.com; secure CITI_SITE=gtdc; path=/; domain=.citi.com; secure; HttpOnly
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 200 tagging.js Show response
online.citi.com/CBOL/taggingTransformation/ 52 KB
11 KB 15ms
14ms Script
application/x-javascript 104.109.92.187
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://online.citi.com/CBOL/taggingTransformation/tagging.js

Requested by

Host: online.citi.com
URL: https://online.citi.com/US/login.do?JFP_TOKEN=3RQ3Y559

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.109.92.187 , Netherlands, ASN20940 (AKAMAI-ASN1, EU),

Reverse DNS

a104-109-92-187.deploy.static.akamaitechnologies.com

Software

Resource Hash

f6a65a0f46fc8a47e868fb882f19c5f6ac278db63a7cddbb74f67cc5fbb9ab21

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

Referer: https://online.citi.com/US/login.do?JFP_TOKEN=3RQ3Y559
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security: max-age=300
content-encoding: gzip
last-modified: Wed, 08 Apr 2020 17:36:46 GMT
x-akamai-citisite: GTDC
date: Thu, 30 Apr 2020 20:02:46 GMT
vary: Accept-Encoding
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
status: 200
expires: Fri, 01 May 2020 02:02:46 GMT
cache-control: max-age=21600
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
content-length: 10552
content-type: application/x-javascript
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 200 main.css
online.citi.com/GFC/branding/responsivebranding/css/ 45 KB
7 KB 27ms
27ms Stylesheet
text/css 104.109.92.187
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://online.citi.com/GFC/branding/responsivebranding/css/main.css

Requested by

Host: online.citi.com
URL: https://online.citi.com/US/login.do?JFP_TOKEN=3RQ3Y559

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.109.92.187 , Netherlands, ASN20940 (AKAMAI-ASN1, EU),

Reverse DNS

a104-109-92-187.deploy.static.akamaitechnologies.com

Software

Resource Hash

429d8af3190c76d5fcb9b1cad2aa6eb555684921323da905d62017fbdbf557c6

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

Referer: https://online.citi.com/US/login.do?JFP_TOKEN=3RQ3Y559
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security: max-age=300
content-encoding: gzip
last-modified: Wed, 26 Jun 2019 07:44:47 GMT
x-akamai-citisite: GTDC
date: Thu, 30 Apr 2020 20:02:46 GMT
vary: Accept-Encoding
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
status: 200
expires: Fri, 01 May 2020 02:02:46 GMT
cache-control: max-age=21600
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
content-length: 7108
content-type: text/css
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 200 tagging_transformation.json Show response
online.citi.com/gcgapi/prod/public/v1/staticcms/USGCB/en_US/appid/ 516 KB
76 KB 18ms
18ms XHR
application/json 104.109.92.187
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://online.citi.com/gcgapi/prod/public/v1/staticcms/USGCB/en_US/appid/tagging_transformation.json

Requested by

Host: online.citi.com
URL: https://online.citi.com/US/login.do?JFP_TOKEN=3RQ3Y559

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.109.92.187 , Netherlands, ASN20940 (AKAMAI-ASN1, EU),

Reverse DNS

a104-109-92-187.deploy.static.akamaitechnologies.com

Software

Resource Hash

26f9d98fbd36f3b8f4d845fcade394e9b92ada9d1aee314c7e5009820abbe206

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

appVersion: CBOLV1.0.0
Referer: https://online.citi.com/US/login.do?JFP_TOKEN=3RQ3Y559
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
client_id: 4a51fb19-a1a7-4247-bc7e-18aa56dd1c40

Response headers

date: Thu, 30 Apr 2020 20:02:46 GMT
content-encoding: gzip
x-route-target: DIGITAL-DEFAULT:DEFAULT
citiuuid: a7c2f105-542b-4357-818e-4bb4f938aa6e7800078
access-control-allow-origin
status: 200
access-control-max-age: 2147483647
x-global-transaction-id: 38f9b44b5eab25e21d2ad47f
dclocation: GT1
content-length: 76221
uuid: 677316ad-9e1d-4f7b-a17d-3302c48fdf24
x-akamai-citisite: GTDC
vary: Accept-Encoding
access-control-allow-methods: GET,PUT,POST,DELETE,HEAD
content-type: application/json
x-backside-transport: OK OK,OK OK,OK OK
x-vcap-request-id: c5bcaf12-34e7-4c6b-5422-a4922dae9f70,c0525d55-4a65-4b3b-7ff3-bca92682117d,dc4c757a-5371-4455-7e2a-ef76f429d543
access-control-expose-headers: APIm-Debug-Trans-Id, X-RateLimit-Limit, X-RateLimit-Remaining, X-RateLimit-Reset, X-Global-Transaction-ID,action,challengeType,bizToken,eventid,Eventid,Eventidexpirytime,eventidexpirytime,accesstoken,Authorization,sid,SessionId,CCPToken,CFIToken
cache-control: public, max-age=60
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
access-control-allow-headers: action,challengeType,accesstoken,appVersion,,Content-Type,sid,CCPToken,CFIToken,countryCode,businessCode,channelId,uuid,client_id,environmentId
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 200 ddl.min.css
online.citi.com/CBOL/common/ui/ddl/theme/latest/styles/ 624 KB
69 KB 17ms
15ms Stylesheet
text/css 104.109.92.187
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://online.citi.com/CBOL/common/ui/ddl/theme/latest/styles/ddl.min.css

Requested by

Host: online.citi.com
URL: https://online.citi.com/US/login.do?JFP_TOKEN=3RQ3Y559

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.109.92.187 , Netherlands, ASN20940 (AKAMAI-ASN1, EU),

Reverse DNS

a104-109-92-187.deploy.static.akamaitechnologies.com

Software

Resource Hash

6177c6163dc1ad67fb596a94ef3d18a277bfd437dbb3c1a928cd6caacefeff2e

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

Referer: https://online.citi.com/US/login.do?JFP_TOKEN=3RQ3Y559
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security: max-age=300
content-encoding: gzip
last-modified: Tue, 12 Sep 2017 17:20:58 GMT
x-akamai-citisite: GTDC
date: Thu, 30 Apr 2020 20:02:46 GMT
vary: Accept-Encoding
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
status: 200
expires: Fri, 01 May 2020 02:02:46 GMT
cache-control: max-age=21600
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
content-length: 69738
content-type: text/css
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 200 jfpm.autocomplete.off.js Show response
online.citi.com/JFP/js/modules/ 1 KB
834 B 68ms
66ms Script
application/x-javascript 104.109.92.187
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://online.citi.com/JFP/js/modules/jfpm.autocomplete.off.js

Requested by

Host: online.citi.com
URL: https://online.citi.com/US/login.do?JFP_TOKEN=3RQ3Y559

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.109.92.187 , Netherlands, ASN20940 (AKAMAI-ASN1, EU),

Reverse DNS

a104-109-92-187.deploy.static.akamaitechnologies.com

Software

Resource Hash

9dad502247a8488c21ef5beb32aed1a78b17b748711bec817c472911f76b4ead

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

Referer: https://online.citi.com/US/login.do?JFP_TOKEN=3RQ3Y559
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security: max-age=300
content-encoding: gzip
last-modified: Tue, 12 Sep 2017 17:20:58 GMT
x-akamai-citisite: GTDC
date: Thu, 30 Apr 2020 20:02:46 GMT
vary: Accept-Encoding
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
status: 200
expires: Fri, 01 May 2020 02:02:46 GMT
cache-control: max-age=21600
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
content-length: 344
content-type: application/x-javascript
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 200 main_branding.css
online.citi.com/GFC/branding/responsivebranding/css/ 272 KB
43 KB 26ms
24ms Stylesheet
text/css 104.109.92.187
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://online.citi.com/GFC/branding/responsivebranding/css/main_branding.css

Requested by

Host: online.citi.com
URL: https://online.citi.com/US/login.do?JFP_TOKEN=3RQ3Y559

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.109.92.187 , Netherlands, ASN20940 (AKAMAI-ASN1, EU),

Reverse DNS

a104-109-92-187.deploy.static.akamaitechnologies.com

Software

Resource Hash

44d3d4e66e1e7636e57911765054e696958d07ea55189620e27a1e163ba33957

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

Referer: https://online.citi.com/US/login.do?JFP_TOKEN=3RQ3Y559
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security: max-age=300
content-encoding: gzip
last-modified: Wed, 05 Feb 2020 04:55:56 GMT
x-akamai-citisite: GTDC
date: Thu, 30 Apr 2020 20:02:46 GMT
vary: Accept-Encoding
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
status: 200
expires: Fri, 01 May 2020 02:02:46 GMT
cache-control: max-age=21600
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
content-length: 43631
content-type: text/css
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 200 vendor.js Show response
online.citi.com/CBOL/common/ui/ddl/theme/latest/scripts/ 204 KB
64 KB 45ms
44ms Script
application/x-javascript 104.109.92.187
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://online.citi.com/CBOL/common/ui/ddl/theme/latest/scripts/vendor.js

Requested by

Host: online.citi.com
URL: https://online.citi.com/US/login.do?JFP_TOKEN=3RQ3Y559

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.109.92.187 , Netherlands, ASN20940 (AKAMAI-ASN1, EU),

Reverse DNS

a104-109-92-187.deploy.static.akamaitechnologies.com

Software

Resource Hash

03c736ca1c90e26743865ed80c9766f84ca237b0dc572fab630737aaef70d171

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

Referer: https://online.citi.com/US/login.do?JFP_TOKEN=3RQ3Y559
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security: max-age=300
content-encoding: gzip
last-modified: Tue, 12 Sep 2017 17:24:53 GMT
x-akamai-citisite: GTDC
date: Thu, 30 Apr 2020 20:02:46 GMT
vary: Accept-Encoding
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
status: 200
expires: Fri, 01 May 2020 02:02:46 GMT
cache-control: max-age=21600
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
content-length: 64910
content-type: application/x-javascript
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 200 Bootstrap.js Show response
nexus.ensighten.com/citi/na_prod/ 328 KB
105 KB 37ms
17ms Script
application/javascript 18.195.42.228
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Requested by: Host: online.citi.com
URL: https://online.citi.com/US/login.do?JFP_TOKEN=3RQ3Y559
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 18.195.42.228 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-195-42-228.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 3a5a45b443726dcc8f0c2ddfffc0f9bc00e1f8a09dbfdd2c748638be5f52f93e

Request headers

Referer: https://online.citi.com/US/login.do?JFP_TOKEN=3RQ3Y559
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 30 Apr 2020 20:02:46 GMT
content-encoding: gzip
last-modified: Thu, 30 Apr 2020 13:42:50 GMT
server: nginx
etag: W/"5eaad5da-5202d"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
status: 200
cache-control: max-age=300

GET
H2 200 homePage.min.css
online.citi.com/loginpage/styles/ 24 KB
5 KB 34ms
33ms Stylesheet
text/css 104.109.92.187
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://online.citi.com/loginpage/styles/homePage.min.css

Requested by

Host: online.citi.com
URL: https://online.citi.com/US/login.do?JFP_TOKEN=3RQ3Y559

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.109.92.187 , Netherlands, ASN20940 (AKAMAI-ASN1, EU),

Reverse DNS

a104-109-92-187.deploy.static.akamaitechnologies.com

Software

Resource Hash

ed48ae9c1a324d49404d9fb4c508b880ca97a65f8fd21d352e241d1e4dfc50e2

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

Referer: https://online.citi.com/US/login.do?JFP_TOKEN=3RQ3Y559
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security: max-age=300
content-encoding: gzip
last-modified: Tue, 12 Jun 2018 05:31:28 GMT
x-akamai-citisite: GTDC
date: Thu, 30 Apr 2020 20:02:46 GMT
vary: Accept-Encoding
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
status: 200
expires: Fri, 01 May 2020 02:02:46 GMT
cache-control: max-age=21600
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
content-length: 5032
content-type: text/css
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 200 jquery.tmpl.js Show response
online.citi.com/JFP/js/jquery/plugins/ 6 KB
3 KB 58ms
57ms Script
application/x-javascript 104.109.92.187
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://online.citi.com/JFP/js/jquery/plugins/jquery.tmpl.js

Requested by

Host: online.citi.com
URL: https://online.citi.com/US/login.do?JFP_TOKEN=3RQ3Y559

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.109.92.187 , Netherlands, ASN20940 (AKAMAI-ASN1, EU),

Reverse DNS

a104-109-92-187.deploy.static.akamaitechnologies.com

Software

Resource Hash

629b48196dcc270143a42ce57535b251c655617f8d510277d4a05306c426fd38

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

Referer: https://online.citi.com/US/login.do?JFP_TOKEN=3RQ3Y559
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security: max-age=300
content-encoding: gzip
last-modified: Tue, 12 Sep 2017 17:16:57 GMT
x-akamai-citisite: GTDC
date: Thu, 30 Apr 2020 20:02:46 GMT
vary: Accept-Encoding
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
status: 200
expires: Fri, 01 May 2020 02:02:46 GMT
cache-control: max-age=21600
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
content-length: 2905
content-type: application/x-javascript
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 200 fp.min.js Show response
online.citi.com/JSO/js/ 15 KB
5 KB 74ms
74ms Script
application/x-javascript 104.109.92.187
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://online.citi.com/JSO/js/fp.min.js

Requested by

Host: online.citi.com
URL: https://online.citi.com/US/login.do?JFP_TOKEN=3RQ3Y559

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.109.92.187 , Netherlands, ASN20940 (AKAMAI-ASN1, EU),

Reverse DNS

a104-109-92-187.deploy.static.akamaitechnologies.com

Software

Resource Hash

c3c994c3fe9bd4e055f6d0eb42067ecd6bdd3247e136bc22835b9882cfe77c61

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

Referer: https://online.citi.com/US/login.do?JFP_TOKEN=3RQ3Y559
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security: max-age=300
content-encoding: gzip
last-modified: Tue, 12 Sep 2017 17:22:45 GMT
x-akamai-citisite: GTDC
date: Thu, 30 Apr 2020 20:02:46 GMT
vary: Accept-Encoding
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
status: 200
expires: Fri, 01 May 2020 02:02:46 GMT
cache-control: max-age=21600
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
content-length: 4322
content-type: application/x-javascript
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 204 463166.gif
di.rlcdn.com/ 0
62 B 149ms
117ms Image
text/plain 35.241.8.149
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://di.rlcdn.com/463166.gif?partner_uid=fe255924-87aa-430f-a458-fc324e379fc3
Requested by: Host: online.citi.com
URL: https://online.citi.com/US/login.do?JFP_TOKEN=3RQ3Y559
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.241.8.149 , Ascension Island, ASN15169 (GOOGLE, US),
Reverse DNS: 149.8.241.35.bc.googleusercontent.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://online.citi.com/US/login.do?JFP_TOKEN=3RQ3Y559
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

status: 204
date: Thu, 30 Apr 2020 20:02:46 GMT
via: 1.1 google
alt-svc: clear

GET
H2 200 bcsid.js Show response
online.citi.com/passivebio/ 947 B
917 B 35ms
35ms Script
application/x-javascript 104.109.92.187
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://online.citi.com/passivebio/bcsid.js

Requested by

Host: online.citi.com
URL: https://online.citi.com/US/login.do?JFP_TOKEN=3RQ3Y559

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.109.92.187 , Netherlands, ASN20940 (AKAMAI-ASN1, EU),

Reverse DNS

a104-109-92-187.deploy.static.akamaitechnologies.com

Software

Resource Hash

7d481eb36581746fd3662c7c452856b695df90cdce24664c48f565aa119c8b16

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

Referer: https://online.citi.com/US/login.do?JFP_TOKEN=3RQ3Y559
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security: max-age=300
content-encoding: gzip
last-modified: Tue, 30 Oct 2018 06:18:02 GMT
x-akamai-citisite: GTDC
date: Thu, 30 Apr 2020 20:02:46 GMT
vary: Accept-Encoding
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
status: 200
expires: Fri, 01 May 2020 02:02:46 GMT
cache-control: max-age=21600
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
content-length: 427
content-type: application/x-javascript
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 200 BiocatchATO.js Show response
online.citi.com/passivebio/ 338 KB
88 KB 15ms
13ms Script
application/x-javascript 104.109.92.187
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://online.citi.com/passivebio/BiocatchATO.js

Requested by

Host: online.citi.com
URL: https://online.citi.com/US/login.do?JFP_TOKEN=3RQ3Y559

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.109.92.187 , Netherlands, ASN20940 (AKAMAI-ASN1, EU),

Reverse DNS

a104-109-92-187.deploy.static.akamaitechnologies.com

Software

Resource Hash

fb932909daac7eff47f2a458fb47760bfd0924191bcd477f2366dd31e3ee73a4

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

Referer: https://online.citi.com/US/login.do?JFP_TOKEN=3RQ3Y559
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security: max-age=300
content-encoding: gzip
last-modified: Tue, 30 Oct 2018 06:18:02 GMT
x-akamai-citisite: GTDC
date: Thu, 30 Apr 2020 20:02:46 GMT
vary: Accept-Encoding
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
status: 200
expires: Fri, 01 May 2020 02:02:46 GMT
cache-control: max-age=21600
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
content-length: 89195
content-type: application/x-javascript
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 200 cbol-smartSearch.css
online.citi.com/NCCS/smartSearch/css/ 8 KB
1 KB 17ms
17ms Stylesheet
text/css 104.109.92.187
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://online.citi.com/NCCS/smartSearch/css/cbol-smartSearch.css

Requested by

Host: online.citi.com
URL: https://online.citi.com/US/login.do?JFP_TOKEN=3RQ3Y559

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.109.92.187 , Netherlands, ASN20940 (AKAMAI-ASN1, EU),

Reverse DNS

a104-109-92-187.deploy.static.akamaitechnologies.com

Software

Resource Hash

6d3001c9deac8cb1f88ea5254105f8d678de5532f1998a24eab1b59906eaf86b

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

Referer: https://online.citi.com/US/login.do?JFP_TOKEN=3RQ3Y559
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security: max-age=300
content-encoding: gzip
last-modified: Tue, 13 Feb 2018 16:10:30 GMT
x-akamai-citisite: GTDC
date: Thu, 30 Apr 2020 20:02:46 GMT
vary: Accept-Encoding
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
status: 200
expires: Fri, 01 May 2020 02:02:46 GMT
cache-control: max-age=21600
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
content-length: 899
content-type: text/css
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 200 search-white.png
online.citi.com/GFC/branding/img/ 429 B
859 B 169ms
169ms Image
image/png 104.109.92.187
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://online.citi.com/GFC/branding/img/search-white.png

Requested by

Host: online.citi.com
URL: https://online.citi.com/US/login.do?JFP_TOKEN=3RQ3Y559

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.109.92.187 , Netherlands, ASN20940 (AKAMAI-ASN1, EU),

Reverse DNS

a104-109-92-187.deploy.static.akamaitechnologies.com

Software

Resource Hash

e2812b1e3529e5f39e3b0586e82c7ad0dfc3fc61cfa0107edfac16483d0547d7

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

Referer: https://online.citi.com/US/login.do?JFP_TOKEN=3RQ3Y559
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security: max-age=300
last-modified: Wed, 14 Jun 2017 18:29:07 GMT
x-akamai-citisite: GTDC
date: Thu, 30 Apr 2020 20:02:46 GMT
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
status: 200
content-length: 429
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
accept-ranges: bytes
content-type: image/png
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 200 citiHomePage.min.js Show response
online.citi.com/loginpage/scripts/ 15 KB
5 KB 24ms
21ms Script
application/x-javascript 104.109.92.187
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://online.citi.com/loginpage/scripts/citiHomePage.min.js

Requested by

Host: online.citi.com
URL: https://online.citi.com/US/login.do?JFP_TOKEN=3RQ3Y559

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.109.92.187 , Netherlands, ASN20940 (AKAMAI-ASN1, EU),

Reverse DNS

a104-109-92-187.deploy.static.akamaitechnologies.com

Software

Resource Hash

dc5ba306fece552e3a002c8e18fa392c85acfa61091e1b98496b745f8ace6876

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

Referer: https://online.citi.com/US/login.do?JFP_TOKEN=3RQ3Y559
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security: max-age=300
content-encoding: gzip
last-modified: Mon, 13 Apr 2020 20:36:24 GMT
x-akamai-citisite: GTDC
date: Thu, 30 Apr 2020 20:02:46 GMT
vary: Accept-Encoding
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
status: 200
expires: Fri, 01 May 2020 02:02:46 GMT
cache-control: max-age=21600
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
content-length: 4255
content-type: application/x-javascript
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 200 rsa.js Show response
online.citi.com/CBOL/sec/debcaract/js/ 36 KB
11 KB 45ms
42ms Script
application/x-javascript 104.109.92.187
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://online.citi.com/CBOL/sec/debcaract/js/rsa.js

Requested by

Host: online.citi.com
URL: https://online.citi.com/US/login.do?JFP_TOKEN=3RQ3Y559

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.109.92.187 , Netherlands, ASN20940 (AKAMAI-ASN1, EU),

Reverse DNS

a104-109-92-187.deploy.static.akamaitechnologies.com

Software

Resource Hash

793c2f3d02d0bc3ad8a2cdc901b2134159b66245e951ac258fee1ac8b2709f44

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

Referer: https://online.citi.com/US/login.do?JFP_TOKEN=3RQ3Y559
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security: max-age=300
content-encoding: gzip
last-modified: Tue, 12 Sep 2017 17:24:53 GMT
x-akamai-citisite: GTDC
date: Thu, 30 Apr 2020 20:02:46 GMT
vary: Accept-Encoding
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
status: 200
expires: Fri, 01 May 2020 02:02:46 GMT
cache-control: max-age=21600
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
content-length: 10616
content-type: application/x-javascript
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 200 peworkflow.min.js Show response
online.citi.com/personalization/ 5 KB
2 KB 56ms
53ms Script
application/x-javascript 104.109.92.187
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://online.citi.com/personalization/peworkflow.min.js

Requested by

Host: online.citi.com
URL: https://online.citi.com/US/login.do?JFP_TOKEN=3RQ3Y559

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.109.92.187 , Netherlands, ASN20940 (AKAMAI-ASN1, EU),

Reverse DNS

a104-109-92-187.deploy.static.akamaitechnologies.com

Software

Resource Hash

f6293fa8c399fd492fb1d40068afee4415acd29c573e7b8661d9c49b1aecea95

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

Referer: https://online.citi.com/US/login.do?JFP_TOKEN=3RQ3Y559
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security: max-age=300
content-encoding: gzip
last-modified: Tue, 30 Oct 2018 06:18:02 GMT
x-akamai-citisite: GTDC
date: Thu, 30 Apr 2020 20:02:46 GMT
vary: Accept-Encoding
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
status: 200
expires: Fri, 01 May 2020 02:02:46 GMT
cache-control: max-age=21600
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
content-length: 1803
content-type: application/x-javascript
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 200 embed.js Show response
resources.digital-cloud-citi.medallia.com/wdcusciti/50/onsite/ 2 KB
1 KB 47ms
7ms Script
application/javascript 151.101.114.133
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://resources.digital-cloud-citi.medallia.com/wdcusciti/50/onsite/embed.js
Requested by: Host: online.citi.com
URL: https://online.citi.com/US/login.do?JFP_TOKEN=3RQ3Y559
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.114.133 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: a7ec647250f3b02114793bd7f7081352a87ccb205660ce3b6fed6c5640d0ca12

Request headers

Referer: https://online.citi.com/US/login.do?JFP_TOKEN=3RQ3Y559
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-amz-version-id: JlktQKtNr3Bp1Cj.AtWSb9pldYa5q67p
content-encoding: gzip
etag: "2e00ed1d07db3ccf708b7b7d7855a117"
age: 106
via: 1.1 varnish
x-cache: HIT
status: 200
content-length: 675
x-amz-id-2: xRdCYvUzjbNIx02ub8D2n6NDo+TGqj/quo837QKJqABMMzm27lKGX6q9pkjSLAHXrp9xzZes32I=
x-served-by: cache-hhn4042-HHN
last-modified: Thu, 30 Apr 2020 17:12:41 GMT
server: AmazonS3
x-timer: S1588276966.448761,VS0,VE1
date: Thu, 30 Apr 2020 20:02:46 GMT
vary: Accept-Encoding
x-amz-request-id: 72B254D5D153609A
access-control-allow-origin: *
cache-control: max-age=0,must-revalidate
accept-ranges: bytes
content-type: application/javascript
x-cache-hits: 1

GET
H2 200 2019CertifiedMobileApp.png
online.citi.com/JRS/images/ 28 KB
29 KB 86ms
85ms Image
image/png 104.109.92.187
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://online.citi.com/JRS/images/2019CertifiedMobileApp.png

Requested by

Host: online.citi.com
URL: https://online.citi.com/US/login.do?JFP_TOKEN=3RQ3Y559

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.109.92.187 , Netherlands, ASN20940 (AKAMAI-ASN1, EU),

Reverse DNS

a104-109-92-187.deploy.static.akamaitechnologies.com

Software

Resource Hash

771c92ecc9167287111bc793f6392bfb0dc8a51a830b497f7591e6d3493fc1fc

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

Referer: https://online.citi.com/US/login.do?JFP_TOKEN=3RQ3Y559
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security: max-age=300
last-modified: Tue, 05 Mar 2019 18:17:00 GMT
x-akamai-citisite: GTDC
date: Thu, 30 Apr 2020 20:02:46 GMT
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
status: 200
content-length: 29171
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
accept-ranges: bytes
content-type: image/png
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 200 oo_engine.min.js Show response
online.citi.com/GFC/branding/olab/js/ 42 KB
12 KB 67ms
64ms Script
application/x-javascript 104.109.92.187
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://online.citi.com/GFC/branding/olab/js/oo_engine.min.js

Requested by

Host: online.citi.com
URL: https://online.citi.com/US/login.do?JFP_TOKEN=3RQ3Y559

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.109.92.187 , Netherlands, ASN20940 (AKAMAI-ASN1, EU),

Reverse DNS

a104-109-92-187.deploy.static.akamaitechnologies.com

Software

Resource Hash

1f2a0e7aa3dabf73dae3cc7c1e53a70ec51145b39b027bdc1ecae9223c0c80d2

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

Referer: https://online.citi.com/US/login.do?JFP_TOKEN=3RQ3Y559
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security: max-age=300
content-encoding: gzip
last-modified: Tue, 12 Sep 2017 16:59:12 GMT
x-akamai-citisite: GTDC
date: Thu, 30 Apr 2020 20:02:46 GMT
vary: Accept-Encoding
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
status: 200
expires: Fri, 01 May 2020 02:02:46 GMT
cache-control: max-age=21600
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
content-length: 11704
content-type: application/x-javascript
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 200 ddl.min.js Show response
online.citi.com/CBOL/common/ui/ddl/theme/latest/scripts/ 64 KB
18 KB 78ms
78ms Script
application/x-javascript 104.109.92.187
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://online.citi.com/CBOL/common/ui/ddl/theme/latest/scripts/ddl.min.js

Requested by

Host: online.citi.com
URL: https://online.citi.com/US/login.do?JFP_TOKEN=3RQ3Y559

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.109.92.187 , Netherlands, ASN20940 (AKAMAI-ASN1, EU),

Reverse DNS

a104-109-92-187.deploy.static.akamaitechnologies.com

Software

Resource Hash

f1821b3865a1008ba0c088f7dc5c7eeb6b81e414461885c40b8d0f48fcbc9341

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

Referer: https://online.citi.com/US/login.do?JFP_TOKEN=3RQ3Y559
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security: max-age=300
content-encoding: gzip
last-modified: Tue, 12 Sep 2017 17:24:53 GMT
x-akamai-citisite: GTDC
date: Thu, 30 Apr 2020 20:02:46 GMT
vary: Accept-Encoding
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
status: 200
expires: Fri, 01 May 2020 02:02:46 GMT
cache-control: max-age=21600
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
content-length: 17670
content-type: application/x-javascript
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 200 main.js Show response
online.citi.com/GFC/branding/responsivebranding/js/ 33 KB
8 KB 90ms
89ms Script
application/x-javascript 104.109.92.187
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://online.citi.com/GFC/branding/responsivebranding/js/main.js

Requested by

Host: online.citi.com
URL: https://online.citi.com/US/login.do?JFP_TOKEN=3RQ3Y559

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.109.92.187 , Netherlands, ASN20940 (AKAMAI-ASN1, EU),

Reverse DNS

a104-109-92-187.deploy.static.akamaitechnologies.com

Software

Resource Hash

2c65cdc8fed4d04ccebbd8a065b8a6e16a6503060507c5140cb60350b0c2f480

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

Referer: https://online.citi.com/US/login.do?JFP_TOKEN=3RQ3Y559
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security: max-age=300
content-encoding: gzip
last-modified: Thu, 16 Jan 2020 14:46:15 GMT
x-akamai-citisite: GTDC
date: Thu, 30 Apr 2020 20:02:46 GMT
vary: Accept-Encoding
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
status: 200
expires: Fri, 01 May 2020 02:02:46 GMT
cache-control: max-age=21600
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
content-length: 7957
content-type: application/x-javascript
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 200 citilive-search.js Show response
online.citi.com/JEA/CitiSearch/nexus-platform/js/ 2 KB
2 KB 93ms
93ms Script
application/x-javascript 104.109.92.187
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://online.citi.com/JEA/CitiSearch/nexus-platform/js/citilive-search.js

Requested by

Host: online.citi.com
URL: https://online.citi.com/US/login.do?JFP_TOKEN=3RQ3Y559

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.109.92.187 , Netherlands, ASN20940 (AKAMAI-ASN1, EU),

Reverse DNS

a104-109-92-187.deploy.static.akamaitechnologies.com

Software

Resource Hash

f2adfd83f8e9c7f3b092921eb5a59d4463041b2be8386a17ec7ac29d8d588470

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

Referer: https://online.citi.com/US/login.do?JFP_TOKEN=3RQ3Y559
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security: max-age=300
content-encoding: gzip
last-modified: Tue, 13 Feb 2018 16:10:30 GMT
x-akamai-citisite: GTDC
date: Thu, 30 Apr 2020 20:02:46 GMT
vary: Accept-Encoding
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
status: 200
expires: Fri, 01 May 2020 02:02:46 GMT
cache-control: max-age=21600
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
content-length: 1073
content-type: application/x-javascript
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 200 cbol-smartSearch-inject.js Show response
online.citi.com/NCCS/smartSearch/js/ 13 KB
3 KB 84ms
83ms Script
application/x-javascript 104.109.92.187
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://online.citi.com/NCCS/smartSearch/js/cbol-smartSearch-inject.js

Requested by

Host: online.citi.com
URL: https://online.citi.com/US/login.do?JFP_TOKEN=3RQ3Y559

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.109.92.187 , Netherlands, ASN20940 (AKAMAI-ASN1, EU),

Reverse DNS

a104-109-92-187.deploy.static.akamaitechnologies.com

Software

Resource Hash

318acbdda26774e066af0f143edeb3d0b752dc1b2ebfb406e68e7fa34ce5553c

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

Referer: https://online.citi.com/US/login.do?JFP_TOKEN=3RQ3Y559
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security: max-age=300
content-encoding: gzip
last-modified: Mon, 13 Apr 2020 20:36:24 GMT
x-akamai-citisite: GTDC
date: Thu, 30 Apr 2020 20:02:46 GMT
vary: Accept-Encoding
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
status: 200
expires: Fri, 01 May 2020 02:02:46 GMT
cache-control: max-age=21600
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
content-length: 3021
content-type: application/x-javascript
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 200 TMXProfiling.js Show response
online.citi.com/TMX/ 1 KB
1 KB 124ms
124ms Script
application/x-javascript 104.109.92.187
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://online.citi.com/TMX/TMXProfiling.js

Requested by

Host: online.citi.com
URL: https://online.citi.com/US/login.do?JFP_TOKEN=3RQ3Y559

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.109.92.187 , Netherlands, ASN20940 (AKAMAI-ASN1, EU),

Reverse DNS

a104-109-92-187.deploy.static.akamaitechnologies.com

Software

Resource Hash

157430093a6d2ee63082eae5dabf826926d3b6259d33482aa6713c48728e82fa

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

Referer: https://online.citi.com/US/login.do?JFP_TOKEN=3RQ3Y559
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security: max-age=300
content-encoding: gzip
last-modified: Fri, 10 Aug 2018 07:26:42 GMT
x-akamai-citisite: GTDC
date: Thu, 30 Apr 2020 20:02:46 GMT
vary: Accept-Encoding
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
status: 200
expires: Fri, 01 May 2020 02:02:46 GMT
cache-control: max-age=21600
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
content-length: 546
content-type: application/x-javascript
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H/1.1 200
OK siteseal2p.async.js Show response
cyseal.cyveillance.com/SiteSeal/ 685 B
1004 B 401ms
99ms Script
application/javascript 3.212.183.163
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://cyseal.cyveillance.com/SiteSeal/siteseal2p.async.js
Requested by: Host: online.citi.com
URL: https://online.citi.com/US/login.do?JFP_TOKEN=3RQ3Y559
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.212.183.163 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-212-183-163.compute-1.amazonaws.com
Software: Apache/2.4.6 (Red Hat Enterprise Linux) OpenSSL/1.0.1e-fips mod_jk/1.2.40 /
Resource Hash: 8cad2492e705a54e5c4a634509b1d6c836dfb5bd179c2e58063653cc8635d6df

Request headers

Referer: https://online.citi.com/US/login.do?JFP_TOKEN=3RQ3Y559
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Thu, 30 Apr 2020 20:02:46 GMT
Last-Modified: Fri, 30 Jun 2017 16:15:48 GMT
Server: Apache/2.4.6 (Red Hat Enterprise Linux) OpenSSL/1.0.1e-fips mod_jk/1.2.40
ETag: W/"685-1498839348000"
Content-Type: application/javascript
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 685

GET
H2 200 cobrowse_overlay.css
online.citi.com/GPS/portal/css/ 7 KB
2 KB 59ms
58ms Stylesheet
text/css 104.109.92.187
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://online.citi.com/GPS/portal/css/cobrowse_overlay.css

Requested by

Host: online.citi.com
URL: https://online.citi.com/US/login.do?JFP_TOKEN=3RQ3Y559

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.109.92.187 , Netherlands, ASN20940 (AKAMAI-ASN1, EU),

Reverse DNS

a104-109-92-187.deploy.static.akamaitechnologies.com

Software

Resource Hash

a9623118fb6ec3944d1312cd0d492c3f32455e89bc1e01eafa67628a309d9c60

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

Referer: https://online.citi.com/US/login.do?JFP_TOKEN=3RQ3Y559
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security: max-age=300
content-encoding: gzip
last-modified: Tue, 13 Aug 2019 07:17:14 GMT
x-akamai-citisite: GTDC
date: Thu, 30 Apr 2020 20:02:46 GMT
vary: Accept-Encoding
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
status: 200
expires: Fri, 01 May 2020 02:02:46 GMT
cache-control: max-age=21600
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
content-length: 1597
content-type: text/css
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H/1.1 200
OK target.js Show response
cdn.tt.omtrdc.net/cdn/ 43 KB
14 KB 109ms
38ms Script
text/javascript 23.61.220.204
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.tt.omtrdc.net/cdn/target.js
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.61.220.204 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-61-220-204.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: 7ecf3bf86151cd72036fb67feb8fcbd8c80359e0ca871e1aeb955428ed43c26d

Request headers

Referer: https://online.citi.com/US/login.do?JFP_TOKEN=3RQ3Y559
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

Date: Thu, 30 Apr 2020 20:02:46 GMT
Content-Encoding: gzip
Last-Modified: Tue, 01 Oct 2019 05:02:27 GMT
Server: Apache
ETag: "1fcc3-aa3e-593d2423b31d3"
Vary: Accept-Encoding
Content-Type: text/javascript; charset=utf-8
Cache-Control: must-revalidate, max-age=3600
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 14200

GET
H2 200 ajax Show response
citicorpcreditservic.tt.omtrdc.net/m2/citicorpcreditservic/mbox/ 811 B
1 KB 105ms
33ms Script
text/javascript 99.80.97.22
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://citicorpcreditservic.tt.omtrdc.net/m2/citicorpcreditservic/mbox/ajax?mboxHost=online.citi.com&mboxPage=2d9122308456434f9c52e409fb4c44d4&screenHeight=1200&screenWidth=1600&browserWidth=1600&browserHeight=1200&browserTimeOffset=120&colorDepth=24&mboxSession=2d9122308456434f9c52e409fb4c44d4&mboxXDomain=enabled&mboxCount=1&mboxTime=1588284166281&mbox=target-global-mbox&mboxId=0&mboxURL=https%3A%2F%2Fonline.citi.com%2FUS%2Flogin.do%3FJFP_TOKEN%3D3RQ3Y559&mboxReferrer=https%3A%2F%2Fwww.google.ro%2F&mboxVersion=63
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 99.80.97.22 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-99-80-97-22.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: 23d6bbd61eb9603a71d3930d3e0bdbc480e10e22f1123b3dbf87faf3e17bd64a

Request headers

Referer: https://online.citi.com/US/login.do?JFP_TOKEN=3RQ3Y559
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

pragma: no-cache
date: Thu, 30 Apr 2020 20:02:46 GMT
content-type: text/javascript;charset=utf-8
p3p: CP="NOI DSP CURa OUR STP COM"
status: 200
cache-control: no-cache
timing-allow-origin: *
content-length: 811
x-request-id: a87226cdc32e58f32f1b115cf35dc04d

GET
H/1.1

200
OK

rd Show response
dpm.demdex.net/id/
Redirect Chain

https://dpm.demdex.net/id?d_visid_ver=3.1.2&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=61834D9B5228A7430A490D45%40AdobeOrg&d_nsid=0&ts=1588276966285
https://dpm.demdex.net/id/rd?d_visid_ver=3.1.2&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=61834D9B5228A7430A490D45%40AdobeOrg&d_nsid=0&ts=1588276966285

363 B
1 KB

36ms
36ms

XHR
application/json

34.249.189.231
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://dpm.demdex.net/id/rd?d_visid_ver=3.1.2&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=61834D9B5228A7430A490D45%40AdobeOrg&d_nsid=0&ts=1588276966285

Requested by

Host: online.citi.com
URL: https://online.citi.com/US/login.do?JFP_TOKEN=3RQ3Y559

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

34.249.189.231 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-34-249-189-231.eu-west-1.compute.amazonaws.com

Software

Resource Hash

82dfd7c72529e9bfb0bdc36b5fa7c709dfbfa1fc631a9e7a97103e61f3954326

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://online.citi.com/US/login.do?JFP_TOKEN=3RQ3Y559
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

DCS: dcs-prod-irl1-v067-045e0e442.edge-irl1.demdex.com 5.68.0.20200428121513 3ms (+0ms)
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Encoding: gzip
X-TID: RQaU1XsDR+w=
Vary: Origin, Accept-Encoding, User-Agent
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Access-Control-Allow-Origin: https://online.citi.com
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/json;charset=utf-8
Content-Length: 300
Expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
Access-Control-Allow-Origin: https://online.citi.com
X-TID: ZsSYOzE3QYU=
Vary: Origin
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Location: https://dpm.demdex.net/id/rd?d_visid_ver=3.1.2&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=61834D9B5228A7430A490D45%40AdobeOrg&d_nsid=0&ts=1588276966285
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 0
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2 200 serverComponent.php Show response
nexus.ensighten.com/citi/na_prod/ 2 KB
925 B 27ms
25ms Script
text/javascript 18.195.42.228
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://nexus.ensighten.com/citi/na_prod/serverComponent.php?r=5.530497584651338&ClientID=1129&PageID=https%3A%2F%2Fonline.citi.com%2FUS%2Flogin.do%3FJFP_TOKEN%3D3RQ3Y559
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 18.195.42.228 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-195-42-228.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: e1cbb72f9a23129e0e8bc8c81a0a8fc80172ccd9ea86bef84617c20c83fb3af1

Request headers

Referer: https://online.citi.com/US/login.do?JFP_TOKEN=3RQ3Y559
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 30 Apr 2020 20:02:46 GMT
content-encoding: gzip
server: nginx
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: no-cache, no-store
expires: Thu, 30 Apr 2020 20:02:45 GMT

GET identity
api.rlcdn.com/api/ 0
0

GET
BLOB 200
OK 6655670a-472a-4589-94cf-e5738e7c6968
https://online.citi.com/ 138 KB
0 Other
application/javascript

General

Check archive.org

Show headers Download Go to

Full URL: blob:https://online.citi.com/6655670a-472a-4589-94cf-e5738e7c6968
Requested by: Host: online.citi.com
URL: https://online.citi.com/passivebio/BiocatchATO.js
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: e5168b3d0c8f929a1b8c4c1b4e4ebac60ee0e1ecfd759aeb4be4c2b15e3fc097

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Length: 140879
Content-Type: application/javascript

GET
H2 200 Citi-Enterprise-White.png
online.citi.com/GFC/branding/img/ 1 KB
1 KB 103ms
102ms Image
image/png 104.109.92.187
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://online.citi.com/GFC/branding/img/Citi-Enterprise-White.png

Requested by

Host: online.citi.com
URL: https://online.citi.com/US/login.do?JFP_TOKEN=3RQ3Y559

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.109.92.187 , Netherlands, ASN20940 (AKAMAI-ASN1, EU),

Reverse DNS

a104-109-92-187.deploy.static.akamaitechnologies.com

Software

Resource Hash

7cb24e06c00e47bb6bc6c38b935d6bc62817f656703387e4fb7591add96c7454

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

Referer: https://online.citi.com/GFC/branding/responsivebranding/css/main_branding.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security: max-age=300
last-modified: Wed, 14 Jun 2017 18:29:05 GMT
x-akamai-citisite: GTDC
date: Thu, 30 Apr 2020 20:02:46 GMT
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
status: 200
content-length: 1040
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
accept-ranges: bytes
content-type: image/png
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 200 Interstate-Light.woff
online.citi.com/CBOL/common/ui/ddl/theme/latest/styles/fonts/interstate/ 74 KB
74 KB 122ms
121ms Font
application/octet-stream 104.109.92.187
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://online.citi.com/CBOL/common/ui/ddl/theme/latest/styles/fonts/interstate/Interstate-Light.woff

Requested by

Host: online.citi.com
URL: https://online.citi.com/US/login.do?JFP_TOKEN=3RQ3Y559

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.109.92.187 , Netherlands, ASN20940 (AKAMAI-ASN1, EU),

Reverse DNS

a104-109-92-187.deploy.static.akamaitechnologies.com

Software

Resource Hash

f327a0ba3e41b1e8154e1c18fc114baff0bd057151e3afe7fa6f33cc0cb18296

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: https://online.citi.com/CBOL/common/ui/ddl/theme/latest/styles/ddl.min.css
Origin: https://online.citi.com

Response headers

strict-transport-security: max-age=300
content-encoding: gzip
last-modified: Tue, 12 Sep 2017 17:20:58 GMT
x-akamai-citisite: GTDC
date: Thu, 30 Apr 2020 20:02:46 GMT
vary: Accept-Encoding
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
status: 200
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
content-length: 75483
content-type: text/plain
access-control-allow-origin: *
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 200 Interstate-Bold.woff
online.citi.com/CBOL/common/ui/ddl/theme/latest/styles/fonts/interstate/ 70 KB
71 KB 143ms
142ms Font
application/octet-stream 104.109.92.187
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://online.citi.com/CBOL/common/ui/ddl/theme/latest/styles/fonts/interstate/Interstate-Bold.woff

Requested by

Host: online.citi.com
URL: https://online.citi.com/US/login.do?JFP_TOKEN=3RQ3Y559

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.109.92.187 , Netherlands, ASN20940 (AKAMAI-ASN1, EU),

Reverse DNS

a104-109-92-187.deploy.static.akamaitechnologies.com

Software

Resource Hash

e9e9a67395a0d83b584208a19b95af203df8e8e6c6952fe76c690d60ea9381c7

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: https://online.citi.com/CBOL/common/ui/ddl/theme/latest/styles/ddl.min.css
Origin: https://online.citi.com

Response headers

strict-transport-security: max-age=300
content-encoding: gzip
last-modified: Tue, 12 Sep 2017 17:22:45 GMT
x-akamai-citisite: GTDC
date: Thu, 30 Apr 2020 20:02:46 GMT
vary: Accept-Encoding
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
status: 200
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
content-length: 71859
content-type: text/plain
access-control-allow-origin: *
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H/1.1 200
OK Cookie set dest5.html
citi.demdex.net/ Frame DA44 0
0 122ms
31ms Document
text/html 52.50.37.223
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://citi.demdex.net/dest5.html?d_nsid=0

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.50.37.223 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-52-50-37-223.eu-west-1.compute.amazonaws.com

Software

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Host: citi.demdex.net
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Referer: https://online.citi.com/US/login.do?JFP_TOKEN=3RQ3Y559
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Cookie: demdex=83352382745646397341532672648230344974
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: https://online.citi.com/US/login.do?JFP_TOKEN=3RQ3Y559

Response headers

Accept-Ranges: bytes
Cache-Control: max-age=21600
Content-Encoding: gzip
Content-Type: text/html
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Last-Modified: Wed, 29 Apr 2020 07:26:34 GMT
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Pragma: no-cache
Set-Cookie: demdex=83352382745646397341532672648230344974;Path=/;Domain=.demdex.net;Expires=Tue, 27-Oct-2020 20:02:46 GMT;Max-Age=15552000;Secure;SameSite=None
Strict-Transport-Security: max-age=31536000; includeSubDomains
Vary: Accept-Encoding, User-Agent
X-TID: L4efjzW2SPo=
Content-Length: 2785
Connection: keep-alive

GET
H2 200 id Show response
metrics1.citi.com/ 89 B
625 B 258ms
15ms XHR
application/x-javascript 15.188.31.119
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://metrics1.citi.com/id?d_visid_ver=3.1.2&d_fieldgroup=A&mcorgid=61834D9B5228A7430A490D45%40AdobeOrg&mid=87952983065949927252082562565465972909&ts=1588276966508

Requested by

Host: online.citi.com
URL: https://online.citi.com/US/login.do?JFP_TOKEN=3RQ3Y559

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

15.188.31.119 Paris, France, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-15-188-31-119.eu-west-3.compute.amazonaws.com

Software

jag /

Resource Hash

188edc45a0bce3ecb592ac0f871ca13c9e8f686f0a30a20ccc37f8514c5bbe5f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://online.citi.com/US/login.do?JFP_TOKEN=3RQ3Y559
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

status: 200
date: Thu, 30 Apr 2020 20:02:46 GMT
x-content-type-options: nosniff
server: jag
xserver: anedge-65fb49f79-8947p
vary: Origin
x-c: master-1221.I0e927e.M0-376
p3p: CP="This is not a P3P policy"
access-control-allow-origin: https://online.citi.com
cache-control: no-cache, no-store, max-age=0, no-transform, private
access-control-allow-credentials: true
content-type: application/x-javascript;charset=utf-8
content-length: 89
x-xss-protection: 1; mode=block

GET
H/1.1

200
OK

ibs:dpid=411&dpuuid=Xqsu5gAAAb1tMi3-
dpm.demdex.net/
Redirect Chain

https://cm.everesttech.net/cm/dd?d_uuid=83352382745646397341532672648230344974
https://dpm.demdex.net/ibs:dpid=411&dpuuid=Xqsu5gAAAb1tMi3-

42 B
915 B

111ms
108ms

Image
image/gif

34.249.189.231
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dpm.demdex.net/ibs:dpid=411&dpuuid=Xqsu5gAAAb1tMi3-

Requested by

Host: online.citi.com
URL: https://online.citi.com/US/login.do?JFP_TOKEN=3RQ3Y559

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

34.249.189.231 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-34-249-189-231.eu-west-1.compute.amazonaws.com

Software

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Referer: https://online.citi.com/US/login.do?JFP_TOKEN=3RQ3Y559
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

DCS: dcs-prod-irl1-v067-05b592a33.edge-irl1.demdex.com 5.68.0.20200428121513 1ms (+0ms)
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-Content-Type-Options: nosniff
X-TID: atrtgxfGQGk=
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection: keep-alive
Content-Type: image/gif
Content-Length: 42
Expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

Date: Thu, 30 Apr 2020 20:02:46 GMT
Server: AMO-cookiemap/1.1
P3P: CP="NOI NID DEVa PSAa PSDa OUR IND PUR COM NAV INT DEM"
Location: https://dpm.demdex.net/ibs:dpid=411&dpuuid=Xqsu5gAAAb1tMi3-
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=15,max=100
Content-Length: 0

GET
H2 200 bkintg.min.js Show response
online.citi.com/personalization/ 2 KB
1 KB 133ms
133ms XHR
application/x-javascript 104.109.92.187
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://online.citi.com/personalization/bkintg.min.js

Requested by

Host: online.citi.com
URL: https://online.citi.com/US/login.do?JFP_TOKEN=3RQ3Y559

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.109.92.187 , Netherlands, ASN20940 (AKAMAI-ASN1, EU),

Reverse DNS

a104-109-92-187.deploy.static.akamaitechnologies.com

Software

Resource Hash

5407ad372944d2599b86775c628e963429af523c48f5c80b70ea587a8ed12fa8

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

Accept: text/javascript, application/javascript, application/ecmascript, application/x-ecmascript, */*; q=0.01
Referer: https://online.citi.com/US/login.do?JFP_TOKEN=3RQ3Y559
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security: max-age=300
content-encoding: gzip
last-modified: Tue, 12 Jun 2018 05:31:28 GMT
x-akamai-citisite: GTDC
date: Thu, 30 Apr 2020 20:02:46 GMT
vary: Accept-Encoding
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
status: 200
expires: Fri, 01 May 2020 02:02:46 GMT
cache-control: max-age=21600
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
content-length: 892
content-type: application/x-javascript
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 200 aosRFServerIntg.min.js Show response
online.citi.com/personalization/ 15 KB
5 KB 144ms
144ms XHR
application/x-javascript 104.109.92.187
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://online.citi.com/personalization/aosRFServerIntg.min.js

Requested by

Host: online.citi.com
URL: https://online.citi.com/US/login.do?JFP_TOKEN=3RQ3Y559

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.109.92.187 , Netherlands, ASN20940 (AKAMAI-ASN1, EU),

Reverse DNS

a104-109-92-187.deploy.static.akamaitechnologies.com

Software

Resource Hash

9ca747861c2e2787351bc177db2b022c378d21b1f1057643764562ac5f4c23e9

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

Accept: text/javascript, application/javascript, application/ecmascript, application/x-ecmascript, */*; q=0.01
Referer: https://online.citi.com/US/login.do?JFP_TOKEN=3RQ3Y559
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security: max-age=300
content-encoding: gzip
last-modified: Tue, 12 Nov 2019 16:41:08 GMT
x-akamai-citisite: GTDC
date: Thu, 30 Apr 2020 20:02:46 GMT
vary: Accept-Encoding
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
status: 200
expires: Fri, 01 May 2020 02:02:46 GMT
cache-control: max-age=21600
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
content-length: 4622
content-type: application/x-javascript
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 200 cmstmplintg.min.js Show response
online.citi.com/personalization/ 22 KB
7 KB 164ms
164ms XHR
application/x-javascript 104.109.92.187
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://online.citi.com/personalization/cmstmplintg.min.js

Requested by

Host: online.citi.com
URL: https://online.citi.com/US/login.do?JFP_TOKEN=3RQ3Y559

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.109.92.187 , Netherlands, ASN20940 (AKAMAI-ASN1, EU),

Reverse DNS

a104-109-92-187.deploy.static.akamaitechnologies.com

Software

Resource Hash

55f4299515608ef8997bdefa45ab5d70816ba780d5d14ea820cd1373d0e734dd

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

Accept: text/javascript, application/javascript, application/ecmascript, application/x-ecmascript, */*; q=0.01
Referer: https://online.citi.com/US/login.do?JFP_TOKEN=3RQ3Y559
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security: max-age=300
content-encoding: gzip
last-modified: Mon, 13 Apr 2020 20:36:24 GMT
x-akamai-citisite: GTDC
date: Thu, 30 Apr 2020 20:02:46 GMT
vary: Accept-Encoding
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
status: 200
expires: Fri, 01 May 2020 02:02:46 GMT
cache-control: max-age=21600
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
content-length: 6184
content-type: application/x-javascript
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 200 f1c71c10d3e2f87f440821ca1f9e2e65.js Show response
nexus.ensighten.com/citi/na_prod/code/ 2 KB
863 B 8ms
7ms Script
application/javascript 18.195.42.228
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://nexus.ensighten.com/citi/na_prod/code/f1c71c10d3e2f87f440821ca1f9e2e65.js?conditionId0=480881
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 18.195.42.228 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-195-42-228.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: e226935ba96b671378a7552d0669729f2b4733fab20624ed8018e86bad35401e

Request headers

Referer: https://online.citi.com/US/login.do?JFP_TOKEN=3RQ3Y559
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 30 Apr 2020 20:02:46 GMT
content-encoding: gzip
last-modified: Tue, 04 Feb 2020 18:16:27 GMT
server: nginx
etag: W/"5e39b4fb-631"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
status: 200
cache-control: max-age=315360000

GET
H2 200 779cbb199d4a967f322364c6b836d2e4.js Show response
nexus.ensighten.com/citi/na_prod/code/ 98 KB
22 KB 13ms
12ms Script
application/javascript 18.195.42.228
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://nexus.ensighten.com/citi/na_prod/code/779cbb199d4a967f322364c6b836d2e4.js?conditionId0=421908
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 18.195.42.228 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-195-42-228.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 700b17285634a71e669d5fcc56209b7ccd47d60b27160fdf1aa8431d54fc8fc8

Request headers

Referer: https://online.citi.com/US/login.do?JFP_TOKEN=3RQ3Y559
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 30 Apr 2020 20:02:46 GMT
content-encoding: gzip
last-modified: Sat, 25 Apr 2020 03:51:49 GMT
server: nginx
etag: W/"5ea3b3d5-1867e"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
status: 200
cache-control: max-age=315360000

GET
H2 200 cb092b2ff994a5f9a27eda3b2258f538.js Show response
nexus.ensighten.com/citi/na_prod/code/ 3 KB
1 KB 13ms
13ms Script
application/javascript 18.195.42.228
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://nexus.ensighten.com/citi/na_prod/code/cb092b2ff994a5f9a27eda3b2258f538.js?conditionId0=4854834
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 18.195.42.228 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-195-42-228.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: a7e642d5a6f9e651391c666872b8be295929ca063d178a647a5adeebd8afb805

Request headers

Referer: https://online.citi.com/US/login.do?JFP_TOKEN=3RQ3Y559
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 30 Apr 2020 20:02:46 GMT
content-encoding: gzip
last-modified: Sat, 25 Apr 2020 03:51:49 GMT
server: nginx
etag: W/"5ea3b3d5-cc8"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
status: 200
cache-control: max-age=315360000

GET
H2 200 fdf45a7c15c1cee06bb71e10dac4e26e.js Show response
nexus.ensighten.com/citi/na_prod/code/ 989 B
1 KB 8ms
6ms Script
application/javascript 18.195.42.228
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://nexus.ensighten.com/citi/na_prod/code/fdf45a7c15c1cee06bb71e10dac4e26e.js?conditionId0=4849963
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 18.195.42.228 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-195-42-228.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 7df13706eaab8ce9a3dcd2a501f60bc66987c83834d07dfaf07ae56ef814c110

Request headers

Referer: https://online.citi.com/US/login.do?JFP_TOKEN=3RQ3Y559
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 30 Apr 2020 20:02:46 GMT
last-modified: Tue, 14 May 2019 17:01:42 GMT
server: nginx
etag: "5cdaf476-3dd"
content-type: application/javascript; charset=utf-8
status: 200
cache-control: max-age=315360000
accept-ranges: bytes
content-length: 989

GET
H2 200 6a702e427e66cf489bdca18dfff8fdd4.js Show response
nexus.ensighten.com/citi/na_prod/code/ 1 KB
663 B 10ms
8ms Script
application/javascript 18.195.42.228
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://nexus.ensighten.com/citi/na_prod/code/6a702e427e66cf489bdca18dfff8fdd4.js?conditionId0=4860234
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 18.195.42.228 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-195-42-228.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: ab9cf8bad2c540d5d217334d9e16bf332cf72967c04ff4c330749cf1dba8d597

Request headers

Referer: https://online.citi.com/US/login.do?JFP_TOKEN=3RQ3Y559
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 30 Apr 2020 20:02:46 GMT
content-encoding: gzip
last-modified: Sat, 25 Apr 2020 03:51:49 GMT
server: nginx
etag: W/"5ea3b3d5-43c"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
status: 200
cache-control: max-age=315360000

GET
H2 200 652b3a2578a1a28ebfdaf8d08fce596c.js Show response
nexus.ensighten.com/citi/na_prod/code/ 126 KB
34 KB 16ms
14ms Script
application/javascript 18.195.42.228
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://nexus.ensighten.com/citi/na_prod/code/652b3a2578a1a28ebfdaf8d08fce596c.js?conditionId0=486757
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 18.195.42.228 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-195-42-228.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: b5c6b8a54243fcab13be120e9ef678397569e146a57be2e7a4ca55f182361f79

Request headers

Referer: https://online.citi.com/US/login.do?JFP_TOKEN=3RQ3Y559
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 30 Apr 2020 20:02:46 GMT
content-encoding: gzip
last-modified: Sun, 19 Apr 2020 10:08:21 GMT
server: nginx
etag: W/"5e9c2315-1f7e2"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
status: 200
cache-control: max-age=315360000

GET
H2 200 7a9abd5b52a3e438cec898587d77cfa0.js Show response
nexus.ensighten.com/citi/na_prod/code/ 257 KB
81 KB 17ms
15ms Script
application/javascript 18.195.42.228
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://nexus.ensighten.com/citi/na_prod/code/7a9abd5b52a3e438cec898587d77cfa0.js?conditionId0=3013337
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 18.195.42.228 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-195-42-228.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 11e06438055585dd6a73f8ce31c35e0dd9d959501ce512f10563b6a437c71e14

Request headers

Referer: https://online.citi.com/US/login.do?JFP_TOKEN=3RQ3Y559
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 30 Apr 2020 20:02:46 GMT
content-encoding: gzip
last-modified: Sun, 19 Apr 2020 10:08:21 GMT
server: nginx
etag: W/"5e9c2315-4036c"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
status: 200
cache-control: max-age=315360000

GET
H2 200 c6d1bd53e0de1c0d07e1c021797a97bf.js Show response
nexus.ensighten.com/citi/na_prod/code/ 29 KB
7 KB 19ms
17ms Script
application/javascript 18.195.42.228
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://nexus.ensighten.com/citi/na_prod/code/c6d1bd53e0de1c0d07e1c021797a97bf.js?conditionId0=467299
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 18.195.42.228 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-195-42-228.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 20b2f2a2ffaf00f3f81f129521d32f2847e02decdf56b04bc7a219eed156bf00

Request headers

Referer: https://online.citi.com/US/login.do?JFP_TOKEN=3RQ3Y559
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 30 Apr 2020 20:02:46 GMT
content-encoding: gzip
last-modified: Sun, 19 Apr 2020 10:08:21 GMT
server: nginx
etag: W/"5e9c2315-75be"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
status: 200
cache-control: max-age=315360000

GET
H2 200 8637af7c210f4e79436bc39f71b49bfa.js Show response
nexus.ensighten.com/citi/na_prod/code/ 1 KB
737 B 23ms
21ms Script
application/javascript 18.195.42.228
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://nexus.ensighten.com/citi/na_prod/code/8637af7c210f4e79436bc39f71b49bfa.js?conditionId0=4827153
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 18.195.42.228 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-195-42-228.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 06dfb367edf9bbff810def9f75f8695b3ccfbcb2813306609fc6e18fcacfc17e

Request headers

Referer: https://online.citi.com/US/login.do?JFP_TOKEN=3RQ3Y559
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 30 Apr 2020 20:02:46 GMT
content-encoding: gzip
last-modified: Wed, 10 Jul 2019 12:57:13 GMT
server: nginx
etag: W/"5d25e0a9-412"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
status: 200
cache-control: max-age=315360000

GET
H2 200 2906f06ed928da15ec22eab16f8f3588.js Show response
nexus.ensighten.com/citi/na_prod/code/ 448 B
630 B 9ms
7ms Script
application/javascript 18.195.42.228
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://nexus.ensighten.com/citi/na_prod/code/2906f06ed928da15ec22eab16f8f3588.js?conditionId0=454466
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 18.195.42.228 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-195-42-228.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 3cb1f89cca21255888919872c51263c08dfc181d2600d2375bdbd8fda57788ce

Request headers

Referer: https://online.citi.com/US/login.do?JFP_TOKEN=3RQ3Y559
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 30 Apr 2020 20:02:46 GMT
last-modified: Tue, 07 May 2019 17:03:33 GMT
server: nginx
etag: "5cd1ba65-1c0"
content-type: application/javascript; charset=utf-8
status: 200
cache-control: max-age=315360000
accept-ranges: bytes
content-length: 448

GET
H2 200 1f8ee64d1e3bb14059a00bc105167007.js Show response
nexus.ensighten.com/citi/na_prod/code/ 10 KB
3 KB 23ms
22ms Script
application/javascript 18.195.42.228
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://nexus.ensighten.com/citi/na_prod/code/1f8ee64d1e3bb14059a00bc105167007.js?conditionId0=462132
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 18.195.42.228 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-195-42-228.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 943a3cd6bb1759cc34b6247d5f38417c857376d1c0a5ddaf640939c40b5bc43e

Request headers

Referer: https://online.citi.com/US/login.do?JFP_TOKEN=3RQ3Y559
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 30 Apr 2020 20:02:46 GMT
content-encoding: gzip
last-modified: Sat, 25 Apr 2020 03:51:49 GMT
server: nginx
etag: W/"5ea3b3d5-2735"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
status: 200
cache-control: max-age=315360000

GET
H2 200 43866ec4d554f2d2e304bf011494be09.js Show response
nexus.ensighten.com/citi/na_prod/code/ 2 KB
910 B 23ms
22ms Script
application/javascript 18.195.42.228
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://nexus.ensighten.com/citi/na_prod/code/43866ec4d554f2d2e304bf011494be09.js?conditionId0=405518
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 18.195.42.228 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-195-42-228.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: edbb17630264914aede51f6ed648a12818459ce44a5dafa91048d6467356a790

Request headers

Referer: https://online.citi.com/US/login.do?JFP_TOKEN=3RQ3Y559
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 30 Apr 2020 20:02:46 GMT
content-encoding: gzip
last-modified: Sat, 25 Apr 2020 03:51:49 GMT
server: nginx
etag: W/"5ea3b3d5-757"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
status: 200
cache-control: max-age=315360000

GET
H2 200 ee55763bbebca7805817a98103ec6f50.js Show response
nexus.ensighten.com/citi/na_prod/code/ 1 KB
678 B 12ms
10ms Script
application/javascript 18.195.42.228
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://nexus.ensighten.com/citi/na_prod/code/ee55763bbebca7805817a98103ec6f50.js?conditionId0=4850690
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 18.195.42.228 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-195-42-228.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: a612a8f640434c7aaee47569897c1fee79df6f146ec26115e2a8c9be645592b7

Request headers

Referer: https://online.citi.com/US/login.do?JFP_TOKEN=3RQ3Y559
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 30 Apr 2020 20:02:46 GMT
content-encoding: gzip
last-modified: Tue, 29 Oct 2019 17:20:39 GMT
server: nginx
etag: W/"5db874e7-425"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
status: 200
cache-control: max-age=315360000

GET
H2 200 557566dc60916e3de69e006bef252459.js Show response
nexus.ensighten.com/citi/na_prod/code/ 2 KB
961 B 12ms
11ms Script
application/javascript 18.195.42.228
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://nexus.ensighten.com/citi/na_prod/code/557566dc60916e3de69e006bef252459.js?conditionId0=4837456
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 18.195.42.228 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-195-42-228.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 31b00ff4929696dfca06885da68e58c3e09f6ecb4ae0fe1ae287e99a3fd1f716

Request headers

Referer: https://online.citi.com/US/login.do?JFP_TOKEN=3RQ3Y559
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 30 Apr 2020 20:02:46 GMT
content-encoding: gzip
last-modified: Tue, 27 Aug 2019 16:59:12 GMT
server: nginx
etag: W/"5d656160-887"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
status: 200
cache-control: max-age=315360000

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 80 KB
30 KB 18ms
18ms Script
application/javascript 2a00:1450:4001:81c::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=DC-6260004

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81c::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

dcb0a09b7d4cfc85ec88668b3ed4995815095d5d167438e5d0dd3087ecd68b2a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Referer: https://online.citi.com/US/login.do?JFP_TOKEN=3RQ3Y559
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 30 Apr 2020 20:02:46 GMT
content-encoding: br
vary: Accept-Encoding
status: 200
alt-svc: h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 30159
x-xss-protection: 0
last-modified: Thu, 30 Apr 2020 18:00:00 GMT
server: Google Tag Manager
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Thu, 30 Apr 2020 20:02:46 GMT

GET
H/1.1 200
OK bk-coretag.js Show response
tags.bkrtx.com/js/ 30 KB
11 KB 130ms
44ms Script
text/javascript 23.39.98.15
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.bkrtx.com/js/bk-coretag.js
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/code/779cbb199d4a967f322364c6b836d2e4.js?conditionId0=421908
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.39.98.15 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-39-98-15.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: 7b8cd61f9d36175fe1b2fc50dfd1585716b9e55a87a82e8ec3c5d9739d6fb939

Request headers

Referer: https://online.citi.com/US/login.do?JFP_TOKEN=3RQ3Y559
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Thu, 30 Apr 2020 20:02:46 GMT
Content-Encoding: gzip
Last-Modified: Wed, 04 Mar 2020 16:24:16 GMT
Server: Apache
ETag: "31600f9-7850-5a009da075833"
Vary: Accept-Encoding
Content-Type: text/javascript
Cache-Control: max-age=604800
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 10546
Expires: Thu, 07 May 2020 20:02:46 GMT

GET
H2 200 cse.js Show response
cse.google.com/cse/ 11 KB
4 KB 63ms
39ms Script
text/javascript 2a00:1450:4001:814::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://cse.google.com/cse/cse.js?cx=009695499870347544712:e3dyicpbrwu

Requested by

Host: online.citi.com
URL: https://online.citi.com/GFC/branding/responsivebranding/js/main.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:814::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

gws /

Resource Hash

5be05d4a5c2d06e04ba83fe6b2467ccaa51e0f8cde93e80db0f802a2093801ee

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://online.citi.com/US/login.do?JFP_TOKEN=3RQ3Y559
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 30 Apr 2020 20:02:46 GMT
content-encoding: br
server: gws
x-frame-options: SAMEORIGIN
p3p: CP="This is not a P3P policy! See g.co/p3phelp for more info."
status: 200
cache-control: private
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 3476
x-xss-protection: 0
expires: Thu, 30 Apr 2020 20:02:46 GMT

GET 19469
stags.bluekai.com/site/ 0
0

GET
H2 200 cse_element__de.js Show response
www.google.com/cse/static/element/4023085f14f5a9c9/ 260 KB
86 KB 7ms
6ms Script
text/javascript 2a00:1450:4001:81f::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/cse/static/element/4023085f14f5a9c9/cse_element__de.js?usqp=CAI%3D

Requested by

Host: cse.google.com
URL: https://cse.google.com/cse/cse.js?cx=009695499870347544712:e3dyicpbrwu

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81f::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5c852d77b2b93c6bf9c1d0ed52019dd893fa65577b80ac1ca9df5d767eeb1be6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://online.citi.com/US/login.do?JFP_TOKEN=3RQ3Y559
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Wed, 29 Apr 2020 09:32:40 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Thu, 02 Apr 2020 17:08:58 GMT
server: sffe
age: 124206
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: public, max-age=31536000
accept-ranges: bytes
alt-svc: h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 88279
x-xss-protection: 0
expires: Thu, 29 Apr 2021 09:32:40 GMT

GET
H2 200 default+de.css
www.google.com/cse/static/element/4023085f14f5a9c9/ 40 KB
9 KB 8ms
7ms Stylesheet
text/css 2a00:1450:4001:81f::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/cse/static/element/4023085f14f5a9c9/default+de.css

Requested by

Host: cse.google.com
URL: https://cse.google.com/cse/cse.js?cx=009695499870347544712:e3dyicpbrwu

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81f::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

0a95d057d3fe90ee1644edbddfa370cfec43701106d45ae2efa91e8b8afffcec

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://online.citi.com/US/login.do?JFP_TOKEN=3RQ3Y559
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Wed, 29 Apr 2020 09:34:21 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Thu, 02 Apr 2020 17:08:58 GMT
server: sffe
age: 124105
vary: Accept-Encoding
content-type: text/css
status: 200
cache-control: public, max-age=31536000
accept-ranges: bytes
alt-svc: h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 8776
x-xss-protection: 0
expires: Thu, 29 Apr 2021 09:34:21 GMT

GET
H2 200 default.css
www.google.com/cse/static/style/look/v3/ 11 KB
3 KB 7ms
7ms Stylesheet
text/css 2a00:1450:4001:81f::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/cse/static/style/look/v3/default.css

Requested by

Host: cse.google.com
URL: https://cse.google.com/cse/cse.js?cx=009695499870347544712:e3dyicpbrwu

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81f::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

9ceaa25ec7654a66294c16e28989fbf1ecb9cebc9debe96ec597529465c7cd50

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://online.citi.com/US/login.do?JFP_TOKEN=3RQ3Y559
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 30 Apr 2020 19:57:01 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Thu, 21 Nov 2019 23:30:00 GMT
server: sffe
age: 345
vary: Accept-Encoding
content-type: text/css
status: 200
cache-control: public, max-age=3000
accept-ranges: bytes
alt-svc: h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2719
x-xss-protection: 0
expires: Thu, 30 Apr 2020 20:47:01 GMT

GET
H/1.1 200
OK tc.min.js Show response
c1.rfihub.net/js/ 20 KB
7 KB 105ms
34ms Script
application/x-javascript 23.61.221.89
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://c1.rfihub.net/js/tc.min.js
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/code/c6d1bd53e0de1c0d07e1c021797a97bf.js?conditionId0=467299
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.61.221.89 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-61-221-89.deploy.static.akamaitechnologies.com
Software: Jetty(9.0.6.v20130930) /
Resource Hash: cb2bb21705b9cce9781d02c9223f3344a65bd5314027d11c5a8518ad4bd84e84

Request headers

Referer: https://online.citi.com/US/login.do?JFP_TOKEN=3RQ3Y559
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Thu, 30 Apr 2020 20:02:46 GMT
Content-Encoding: gzip
Last-Modified: Sat, 18 Apr 2020 21:59:46 GMT
Server: Jetty(9.0.6.v20130930)
Vary: Accept-Encoding
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Cache-Control: public, max-age=3600
Connection: keep-alive
Content-Type: application/x-javascript
Content-Length: 6375
Expires: Thu, 30 Apr 2020 21:02:46 GMT

GET
H/1.1 200
OK snare.js Show response
mpsnare.iesnare.com/ 38 KB
13 KB 59ms
26ms Script
text/javascript 52.129.74.12
IOVATION3

General

Check archive.org

Show headers Download Go to

Full URL

https://mpsnare.iesnare.com/snare.js?_=1588276966253

Requested by

Host: online.citi.com
URL: https://online.citi.com/CBOL/common/ui/ddl/theme/latest/scripts/vendor.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.129.74.12 , United States, ASN395492 (IOVATION3, US),

Reverse DNS

mpsnare.iesnare.com

Software

nginx /

Resource Hash

1e682f9b00359018d35c1d1c53cedfbe133b65e4a2ae55988a3583ff971f64e1

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains

Request headers

Referer: https://online.citi.com/US/login.do?JFP_TOKEN=3RQ3Y559
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 30 Apr 2020 20:02:46 GMT
Content-Encoding: gzip
Server: nginx
Strict-Transport-Security: max-age=15552000; includeSubDomains
p3p: CP="NON DSP COR CURa"
Cache-Control: no-cache, private
Transfer-Encoding: chunked
Connection: keep-alive
Content-Type: text/javascript; charset=utf-8
Expires: 0

GET
H2 200 close.svg
online.citi.com/CBOL/common/ui/ddl/theme/latest/images/icons/svgs/ 1 KB
1 KB 164ms
163ms Image
image/svg+xml 104.109.92.187
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://online.citi.com/CBOL/common/ui/ddl/theme/latest/images/icons/svgs/close.svg

Requested by

Host: online.citi.com
URL: https://online.citi.com/CBOL/common/ui/ddl/theme/latest/scripts/vendor.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.109.92.187 , Netherlands, ASN20940 (AKAMAI-ASN1, EU),

Reverse DNS

a104-109-92-187.deploy.static.akamaitechnologies.com

Software

Resource Hash

55e066703c69d4d89a1f4d66794d474aa93d710624d8f807096bac17a7867b17

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

Referer: https://online.citi.com/CBOL/common/ui/ddl/theme/latest/styles/ddl.min.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security: max-age=300
content-encoding: gzip
last-modified: Tue, 12 Sep 2017 17:24:53 GMT
x-akamai-citisite: GTDC
date: Thu, 30 Apr 2020 20:02:46 GMT
vary: Accept-Encoding
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
status: 200
content-length: 641
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
accept-ranges: bytes
content-type: image/svg+xml
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 200 iframe_api Show response
www.youtube.com/ 859 B
926 B 21ms
20ms Script
application/javascript 2a00:1450:4001:81d::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.youtube.com/iframe_api

Requested by

Host: online.citi.com
URL: https://online.citi.com/CBOL/common/ui/ddl/theme/latest/scripts/ddl.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81d::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

YouTube Frontend Proxy /

Resource Hash

d24feef8a5dd86e7d2eb674dc936d2c3a5bbd1395c0c49e5fa4200d43373a6b4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://online.citi.com/US/login.do?JFP_TOKEN=3RQ3Y559
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 30 Apr 2020 20:02:46 GMT
x-content-type-options: nosniff
server: YouTube Frontend Proxy
content-type: application/javascript
status: 200
cache-control: no-cache
alt-svc: h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 859
x-xss-protection: 0
expires: Tue, 27 Apr 1971 19:44:06 GMT

GET
H2 200 citilive-search-responsive.css
online.citi.com/JEA/CitiSearch/nexus-platform/css/ 57 KB
13 KB 28ms
26ms Stylesheet
text/css 104.109.92.187
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://online.citi.com/JEA/CitiSearch/nexus-platform/css/citilive-search-responsive.css

Requested by

Host: online.citi.com
URL: https://online.citi.com/JEA/CitiSearch/nexus-platform/js/citilive-search.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.109.92.187 , Netherlands, ASN20940 (AKAMAI-ASN1, EU),

Reverse DNS

a104-109-92-187.deploy.static.akamaitechnologies.com

Software

Resource Hash

607adc86c1049b6dfd0802a182bc8ce30c37c32c664c5ad21878e24f25ce60ef

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

Referer: https://online.citi.com/US/login.do?JFP_TOKEN=3RQ3Y559
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security: max-age=300
content-encoding: gzip
last-modified: Mon, 13 Apr 2020 20:36:24 GMT
x-akamai-citisite: GTDC
date: Thu, 30 Apr 2020 20:02:46 GMT
vary: Accept-Encoding
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
status: 200
expires: Fri, 01 May 2020 02:02:46 GMT
cache-control: max-age=21600
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
content-length: 12587
content-type: text/css
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 200 citilive-search-library.js Show response
online.citi.com/JEA/CitiSearch/nexus-platform/js/ 179 KB
61 KB 37ms
36ms Script
application/x-javascript 104.109.92.187
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://online.citi.com/JEA/CitiSearch/nexus-platform/js/citilive-search-library.js

Requested by

Host: online.citi.com
URL: https://online.citi.com/JEA/CitiSearch/nexus-platform/js/citilive-search.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.109.92.187 , Netherlands, ASN20940 (AKAMAI-ASN1, EU),

Reverse DNS

a104-109-92-187.deploy.static.akamaitechnologies.com

Software

Resource Hash

d57c8034f9c12aa3ce626c9ed1d61a4bb0941c3ef320bb59346f20496fb0096a

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

Referer: https://online.citi.com/US/login.do?JFP_TOKEN=3RQ3Y559
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security: max-age=300
content-encoding: gzip
last-modified: Tue, 12 Sep 2017 17:16:57 GMT
x-akamai-citisite: GTDC
date: Thu, 30 Apr 2020 20:02:46 GMT
vary: Accept-Encoding
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
status: 200
expires: Fri, 01 May 2020 02:02:46 GMT
cache-control: max-age=21600
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
content-length: 61658
content-type: application/x-javascript
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 200 citilive-search-service.js Show response
online.citi.com/JEA/CitiSearch/nexus-platform/js/ 9 KB
3 KB 56ms
55ms Script
application/x-javascript 104.109.92.187
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://online.citi.com/JEA/CitiSearch/nexus-platform/js/citilive-search-service.js

Requested by

Host: online.citi.com
URL: https://online.citi.com/JEA/CitiSearch/nexus-platform/js/citilive-search.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.109.92.187 , Netherlands, ASN20940 (AKAMAI-ASN1, EU),

Reverse DNS

a104-109-92-187.deploy.static.akamaitechnologies.com

Software

Resource Hash

eec5cc477e7cb4f1eee1f26dce3eb411a63716d89a9b659c7d5559571c837ccb

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

Referer: https://online.citi.com/US/login.do?JFP_TOKEN=3RQ3Y559
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security: max-age=300
content-encoding: gzip
last-modified: Tue, 11 Sep 2018 07:31:14 GMT
x-akamai-citisite: GTDC
date: Thu, 30 Apr 2020 20:02:46 GMT
vary: Accept-Encoding
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
status: 200
expires: Fri, 01 May 2020 02:02:46 GMT
cache-control: max-age=21600
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
content-length: 2415
content-type: application/x-javascript
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 200 citi-search-tmpl.js Show response
online.citi.com/JEA/CitiSearch/nexus-platform/js/ 18 KB
6 KB 68ms
67ms Script
application/x-javascript 104.109.92.187
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://online.citi.com/JEA/CitiSearch/nexus-platform/js/citi-search-tmpl.js

Requested by

Host: online.citi.com
URL: https://online.citi.com/JEA/CitiSearch/nexus-platform/js/citilive-search.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.109.92.187 , Netherlands, ASN20940 (AKAMAI-ASN1, EU),

Reverse DNS

a104-109-92-187.deploy.static.akamaitechnologies.com

Software

Resource Hash

250218e57c75f9528eb52a89678ae7174412e11d6757654d2b569def502afa0e

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

Referer: https://online.citi.com/US/login.do?JFP_TOKEN=3RQ3Y559
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security: max-age=300
content-encoding: gzip
last-modified: Mon, 13 Apr 2020 20:36:24 GMT
x-akamai-citisite: GTDC
date: Thu, 30 Apr 2020 20:02:46 GMT
vary: Accept-Encoding
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
status: 200
expires: Fri, 01 May 2020 02:02:46 GMT
cache-control: max-age=21600
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
content-length: 5160
content-type: application/x-javascript
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 200 citilive-search-controller.js Show response
online.citi.com/JEA/CitiSearch/nexus-platform/js/ 112 KB
23 KB 80ms
80ms Script
application/x-javascript 104.109.92.187
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://online.citi.com/JEA/CitiSearch/nexus-platform/js/citilive-search-controller.js

Requested by

Host: online.citi.com
URL: https://online.citi.com/JEA/CitiSearch/nexus-platform/js/citilive-search.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.109.92.187 , Netherlands, ASN20940 (AKAMAI-ASN1, EU),

Reverse DNS

a104-109-92-187.deploy.static.akamaitechnologies.com

Software

Resource Hash

4327a467473f73d384db9201c403606c513d9730b04543bdc083c2b2099524f5

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

Referer: https://online.citi.com/US/login.do?JFP_TOKEN=3RQ3Y559
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security: max-age=300
content-encoding: gzip
last-modified: Mon, 13 Apr 2020 20:36:24 GMT
x-akamai-citisite: GTDC
date: Thu, 30 Apr 2020 20:02:46 GMT
vary: Accept-Encoding
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
status: 200
expires: Fri, 01 May 2020 02:02:46 GMT
cache-control: max-age=21600
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
content-length: 22661
content-type: application/x-javascript
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H/1.1 200
OK id Show response
dpm.demdex.net/ 363 B
1 KB 35ms
34ms XHR
application/json 34.249.189.231
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://dpm.demdex.net/id?d_visid_ver=3.1.2&d_fieldgroup=AAM&d_rtbd=json&d_ver=2&d_orgid=61834D9B5228A7430A490D45%40AdobeOrg&d_nsid=0&d_mid=87952983065949927252082562565465972909&d_blob=RKhpRz8krg2tLO6pguXWp5olkAcUniQYPHaMWWgdJ3xzPWQmdj0y&d_cid_ic=AVID%012F5597730515D332-40000864E2F62AB0&ts=1588276966790

Requested by

Host: online.citi.com
URL: https://online.citi.com/US/login.do?JFP_TOKEN=3RQ3Y559

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

34.249.189.231 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-34-249-189-231.eu-west-1.compute.amazonaws.com

Software

Resource Hash

e5e2516fbcd5efa489f44adca3809519fb9a94a420040577ad802d62c6cc09ed

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://online.citi.com/US/login.do?JFP_TOKEN=3RQ3Y559
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

DCS: dcs-prod-irl1-v067-023dc8812.edge-irl1.demdex.com 5.68.0.20200428121513 3ms (+0ms)
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Encoding: gzip
X-TID: FMYZeX9FQ34=
Vary: Origin, Accept-Encoding, User-Agent
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Access-Control-Allow-Origin: https://online.citi.com
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/json;charset=utf-8
Content-Length: 299
Expires: Thu, 01 Jan 1970 00:00:00 GMT

POST
H2 200 BKDmpUpdate.action Show response
online.citi.com/US/DMP/ 3 KB
2 KB 206ms
205ms XHR
text/html 104.109.92.187
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://online.citi.com/US/DMP/BKDmpUpdate.action?JFP_TOKEN=3RQ3Y559

Requested by

Host: online.citi.com
URL: https://online.citi.com/US/login.do?JFP_TOKEN=3RQ3Y559

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.109.92.187 , Netherlands, ASN20940 (AKAMAI-ASN1, EU),

Reverse DNS

a104-109-92-187.deploy.static.akamaitechnologies.com

Software

Resource Hash

e17da319eba14bc5a5677abdac48f8ef973597cca0c9733f8d3dd68bbc6faf81

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

Accept: */*
Referer: https://online.citi.com/US/login.do?JFP_TOKEN=3RQ3Y559
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security: max-age=300
content-encoding: gzip
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
status: 200
cid: gt02p-srv3, gt02p-srv3
x-ua-compatible: IE=edge, IE=edge
pragma: no-cache
x-akamai-citisite: GTDC
jid: 200430160247602356347148, 200430160247602356347148
date: Thu, 30 Apr 2020 20:02:47 GMT
vary: Accept-Encoding
content-language: en-US
expires: Thu, 01 Jan 1970 00:00:00 GMT
cache-control: no-cache, must-revalidate, proxy-revalidate, no-store
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
content-length: 1127
content-type: text/html;charset=ISO-8859-1
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

POST
H2 200 banner Show response
online.citi.com/gcgapi/prod/api/v1/marketing/offers/ 12 KB
5 KB 835ms
834ms XHR
application/json 104.109.92.187
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://online.citi.com/gcgapi/prod/api/v1/marketing/offers/banner

Requested by

Host: online.citi.com
URL: https://online.citi.com/US/login.do?JFP_TOKEN=3RQ3Y559

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.109.92.187 , Netherlands, ASN20940 (AKAMAI-ASN1, EU),

Reverse DNS

a104-109-92-187.deploy.static.akamaitechnologies.com

Software

Resource Hash

d9aa05050741d9e970f4010ac655cbe27c8901f5ebde1d19530280b70da93c9a

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

Accept-Language: en-US
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: application/json
scope: VISITOR
Accept: application/json, text/javascript, */*; q=0.01
Referer: https://online.citi.com/US/login.do?JFP_TOKEN=3RQ3Y559
countryCode: US
X-Requested-With: XMLHttpRequest
client_id: e83e6374-92f0-472c-8a6b-2ded64acc51c

Response headers

sid: 9b8cfc91-744a-4f24-bcf9-6d746af7fc67
content-encoding: gzip
nonce: 9450360528654858
access-control-allow-origin: https://online.citi.com
status: 200
access-control-max-age: 2147483647
x-global-transaction-id: 38f9b44b5eab2ee747c2cf0d
uuid: 1807aaf5-ebe6-4ffe-bda2-f21fa8aba990
content-length: 3839
pragma: no-cache
expires: -1
x-akamai-citisite: GTDC
date: Thu, 30 Apr 2020 20:02:47 GMT
x-route-target: DIGITAL-DEFAULT:DEFAULT
vary: Accept-Encoding
access-control-allow-methods: GET,PUT,POST,DELETE,HEAD
content-type: application/json
x-backside-transport: OK OK,OK OK
x-vcap-request-id: 56f013d4-b845-4696-697f-295b08e5556d,edb8be79-c878-4b0a-587b-deab72055df4,e675efe8-2a67-4307-509e-7bd308aa77a6
access-control-expose-headers: action,challengeType,bizToken,eventid,Eventid,Eventidexpirytime,eventidexpirytime,accesstoken,Authorization,sid,SessionId,CCPToken,CFIToken
cache-control: no-cache, no-store
access-control-allow-credentials: true
scope: VISITOR
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
access-control-allow-headers: action,challengeType,accesstoken,appVersion,,Content-Type,sid,CCPToken,CFIToken,countryCode,businessCode,channelId,uuid,client_id,environmentId
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
dclocation: SW1
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 200 www-widgetapi.js Show response
s.ytimg.com/yts/jsbin/www-widgetapi-vflrtdDSb/ 68 KB
25 KB 6ms
5ms Script
text/javascript 2a00:1450:4001:809::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://s.ytimg.com/yts/jsbin/www-widgetapi-vflrtdDSb/www-widgetapi.js

Requested by

Host: www.youtube.com
URL: https://www.youtube.com/iframe_api

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:809::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

8c5ebc81567bb11fea53ee4cf729e44ea2bfa2115442a1c72ea9b53fc654fbb9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://online.citi.com/US/login.do?JFP_TOKEN=3RQ3Y559
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Tue, 28 Apr 2020 19:51:29 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 173478
status: 200
alt-svc: h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 25733
x-xss-protection: 0
last-modified: Tue, 28 Apr 2020 18:21:09 GMT
server: sffe
vary: Accept-Encoding, Origin
content-type: text/javascript
cache-control: public, max-age=691200
accept-ranges: bytes
timing-allow-origin: https://www.youtube.com
expires: Wed, 06 May 2020 19:51:29 GMT

GET
H/1.1 202
Accepted cyss.js Show response
cyseal.cyveillance.com/SiteSeal/ 0
226 B 97ms
96ms Script
application/javascript 3.212.183.163
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://cyseal.cyveillance.com/SiteSeal/cyss.js?ref=online.citi.com
Requested by: Host: cyseal.cyveillance.com
URL: https://cyseal.cyveillance.com/SiteSeal/siteseal2p.async.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.212.183.163 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-212-183-163.compute-1.amazonaws.com
Software: Apache/2.4.6 (Red Hat Enterprise Linux) OpenSSL/1.0.1e-fips mod_jk/1.2.40 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://online.citi.com/US/login.do?JFP_TOKEN=3RQ3Y559
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Thu, 30 Apr 2020 20:02:47 GMT
Server: Apache/2.4.6 (Red Hat Enterprise Linux) OpenSSL/1.0.1e-fips mod_jk/1.2.40
Connection: keep-alive
Content-Length: 0
Content-Type: application/javascript

GET
H/1.1 200
OK logo.js Show response
mpsnare.iesnare.com/script/ 96 B
514 B 17ms
17ms Script
text/javascript 52.129.74.12
IOVATION3

General

Check archive.org

Show headers Download Go to

Full URL

https://mpsnare.iesnare.com/script/logo.js

Requested by

Host: mpsnare.iesnare.com
URL: https://mpsnare.iesnare.com/snare.js?_=1588276966253

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.129.74.12 , United States, ASN395492 (IOVATION3, US),

Reverse DNS

mpsnare.iesnare.com

Software

nginx /

Resource Hash

2bc5133f1e02f3ebc4bfa9aebbc020234dab6b1b424ebb005062cdc06fcf0d1c

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains

Request headers

Referer: https://online.citi.com/US/login.do?JFP_TOKEN=3RQ3Y559
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Thu, 30 Apr 2020 20:02:47 GMT
Content-Encoding: gzip
Last-Modified: Tue, 06 May 2014 00:01:40 GMT
Server: nginx
Strict-Transport-Security: max-age=15552000; includeSubDomains
p3p: CP="NON DSP COR CURa"
Cache-Control: private
Transfer-Encoding: chunked
Connection: keep-alive
Content-Type: text/javascript; charset=utf-8
Expires: Fri, 30 Apr 2021 20:02:47 GMT

GET
H/1.1 200
OK idr.js Show response
a.rfihub.com/ 83 B
686 B 67ms
18ms Script
application/javascript 193.0.160.128
ROCKETFUEL

General

Check archive.org

Show headers Download Go to

Full URL: https://a.rfihub.com/idr.js?_callback=window.RocketfuelBCP.jsonpCallbacks.request_cmZpSWRJbkNhY2hl
Requested by: Host: c1.rfihub.net
URL: https://c1.rfihub.net/js/tc.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_256_CBC
Server: 193.0.160.128 , Netherlands, ASN54312 (ROCKETFUEL, US),
Reverse DNS
Software: Jetty(9.0.6.v20130930) /
Resource Hash: 0ae963446c472d283aa4f73633015771af3afe1c084fd784539971ab9a618b55

Request headers

Referer: https://online.citi.com/US/login.do?JFP_TOKEN=3RQ3Y559
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Cache-Control: public, max-age=33696000
Content-Type: application/javascript
Server: Jetty(9.0.6.v20130930)
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Content-Length: 83
Expires: Tue, 25 May 2021 20:02:47 GMT

GET cr.png
cfr.us.v2.we-stats.com/api/v1/ 0
0

GET
H/1.1 200
OK Cookie set ca.html
20766699p.rfihub.com/ Frame 26F4 0
0 64ms
18ms Document
text/html 193.0.160.128
ROCKETFUEL

General

Check archive.org

Show headers Download Go to

Full URL: https://20766699p.rfihub.com/ca.html?rfiidc=1871597495045692823&rfiaid=f804af61beca40bf9748474318876071&ver=9&ra=632&rb=648&ca=20766699&_o=17169175&_t=noncookiedusernamepassword&ssv_cuuid=&ssv_pagename=noncookiedusernamepassword&pe=https%3A%2F%2Fonline.citi.com%2FUS%2Flogin.do%3FJFP_TOKEN%3D3RQ3Y559&pf=https%3A%2F%2Fwww.google.ro%2F&ra=9413098787311582
Requested by: Host: c1.rfihub.net
URL: https://c1.rfihub.net/js/tc.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_256_CBC
Server: 193.0.160.128 , Netherlands, ASN54312 (ROCKETFUEL, US),
Reverse DNS
Software: Jetty(9.0.6.v20130930) /
Resource Hash

Request headers

Host: 20766699p.rfihub.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Referer: https://online.citi.com/US/login.do?JFP_TOKEN=3RQ3Y559
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Cookie: rud=H4sIAAAAAAAAAOMSNrQwNzS1NDexNDUwMTWzNLIwMhbiM9R1KcpJjIwqdQpxD4mU4jU0tbAwMjezNDM3NDYDAG6Phy00AAAA; ruds=H4sIAAAAAAAAAOMSNrQwNzS1NDexNDUwMTWzNLIwMhbiM9R1KcpJjIwqdQpxD4kEAF1H0gclAAAA
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: https://online.citi.com/US/login.do?JFP_TOKEN=3RQ3Y559

Response headers

P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Set-Cookie: rud=H4sIAAAAAAAAAOMSNrQwNzS1NDexNDUwMTWzNLIwMhbiM9R1KcpJjIwqdQpxD4mU4jU0tbAwMjezNDM3NDYDAG6Phy00AAAA; Path=/; Domain=.rfihub.com; Expires=Tue, 25 May 2021 20:02:48 GMT; Secure; SameSite=None ruds=H4sIAAAAAAAAAOMSNrQwNzS1NDexNDUwMTWzNLIwMhbiM9R1KcpJjIwqdQpxD4kEAF1H0gclAAAA; Path=/; Domain=.rfihub.com; Secure; SameSite=None
Cache-Control: no-cache
Content-Type: text/html
Content-Encoding: gzip
Vary: Accept-Encoding, User-Agent
Transfer-Encoding: chunked
Server: Jetty(9.0.6.v20130930)

POST
H2 200 offers.jws Show response
online.citi.com/US/REST/personalization/uncookied/ 6 KB
2 KB 237ms
237ms XHR
text/plain 104.109.92.187
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://online.citi.com/US/REST/personalization/uncookied/offers.jws

Requested by

Host: online.citi.com
URL: https://online.citi.com/US/login.do?JFP_TOKEN=3RQ3Y559

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.109.92.187 , Netherlands, ASN20940 (AKAMAI-ASN1, EU),

Reverse DNS

a104-109-92-187.deploy.static.akamaitechnologies.com

Software

Resource Hash

e4049a88307528336fa92f75c639b693b0b910299dfe04b939a45f568ec55025

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

Accept: application/json, text/javascript, */*; q=0.01
Referer: https://online.citi.com/US/login.do?JFP_TOKEN=3RQ3Y559
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: application/json;charset=UTF-8

Response headers

strict-transport-security: max-age=300
content-encoding: gzip
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
status: 200
cid: gt02p-srv3
x-ua-compatible: IE=edge
pragma: no-cache
x-akamai-citisite: GTDC
jid: 200430160247602356347148
date: Thu, 30 Apr 2020 20:02:48 GMT
vary: Accept-Encoding
content-language: en-US
expires: Thu, 01 Jan 1970 00:00:00 GMT
cache-control: no-cache, must-revalidate, proxy-revalidate, no-store
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
content-length: 1896
content-type: text/plain;charset=UTF-8
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H/1.1

200
OK

citi.action
www.citi.com/credit-cards/rfuidmatch/
Redirect Chain

https://s.rfihub.com/uidm?_o=17169175&_u=fe255924-87aa-430f-a458-fc324e379fc3&_sm=:R22534S@A4VK2nC24944S@A4VK2nC2232L2@A4VK2nS2233L2@A4VK2nS28259S1@A4VK2nS28266S1@A4VK2nS28267S1@A4VK2nS28227S1@A4VK...
https://www.citi.com/credit-cards/rfuidmatch/citi.action?XP_UID=SY-00GflAAW61nZc=583

0
904 B

576ms
535ms

Image
text/html

23.67.129.14
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.citi.com/credit-cards/rfuidmatch/citi.action?XP_UID=SY-00GflAAW61nZc=583
Requested by: Host: online.citi.com
URL: https://online.citi.com/US/login.do?JFP_TOKEN=3RQ3Y559
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.67.129.14 , Netherlands, ASN20940 (AKAMAI-ASN1, EU),
Reverse DNS: a23-67-129-14.deploy.static.akamaitechnologies.com
Software: / Servlet/3.0
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://online.citi.com/US/login.do?JFP_TOKEN=3RQ3Y559
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Thu, 30 Apr 2020 20:02:49 GMT
X-Akamai-CITISITE: GTDC
X-Powered-By: Servlet/3.0
Content-Language: en-US
P3P: policyref="/w3c/p3p.xml"\,CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
Access-Control-Allow-Origin: https://citimobile.citibankonline.com
Cache-Control: no-cache="set-cookie, set-cookie2"
Access-Control-Allow-Credentials: true
X-UA-Compatible: IE=edge, IE=edge
Connection: keep-alive
Content-Type: text/html
Content-Length: 0
Expires: Thu, 01 Dec 1994 16:00:00 GMT

Redirect headers

Location: https://www.citi.com/credit-cards/rfuidmatch/citi.action?XP_UID=SY-00GflAAW61nZc=583
Cache-Control: no-cache
Server: Jetty(9.0.6.v20130930)
Content-Length: 0
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

GET
H2 200 HERO_2737.jpg
online.citi.com/JRS/banners/hero_background/ 53 KB
54 KB 40ms
40ms Image
image/jpeg 104.109.92.187
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://online.citi.com/JRS/banners/hero_background/HERO_2737.jpg

Requested by

Host: online.citi.com
URL: https://online.citi.com/CBOL/common/ui/ddl/theme/latest/scripts/vendor.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.109.92.187 , Netherlands, ASN20940 (AKAMAI-ASN1, EU),

Reverse DNS

a104-109-92-187.deploy.static.akamaitechnologies.com

Software

Resource Hash

359a00b9518a4295a70361f526a7d69cf7dc40099a5ff361a5fbf8c0ee034e0c

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

Referer: https://online.citi.com/US/login.do?JFP_TOKEN=3RQ3Y559
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security: max-age=300
last-modified: Mon, 17 Sep 2018 18:30:21 GMT
x-akamai-citisite: GTDC
date: Thu, 30 Apr 2020 20:02:48 GMT
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
status: 200
content-length: 54363
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
accept-ranges: bytes
content-type: image/jpeg
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 200 HP_Hero_LazyLoad.jpg
online.citi.com/JRS/banners/modules/ 10 KB
10 KB 37ms
36ms Image
image/jpeg 104.109.92.187
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://online.citi.com/JRS/banners/modules/HP_Hero_LazyLoad.jpg

Requested by

Host: online.citi.com
URL: https://online.citi.com/CBOL/common/ui/ddl/theme/latest/scripts/vendor.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.109.92.187 , Netherlands, ASN20940 (AKAMAI-ASN1, EU),

Reverse DNS

a104-109-92-187.deploy.static.akamaitechnologies.com

Software

Resource Hash

b5b99c97960d130c44fad1acc54bba0644286e0fd6d3899e3027392ab7de9cc8

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

Referer: https://online.citi.com/US/login.do?JFP_TOKEN=3RQ3Y559
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security: max-age=300
last-modified: Tue, 12 Sep 2017 17:22:45 GMT
x-akamai-citisite: GTDC
date: Thu, 30 Apr 2020 20:02:48 GMT
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
status: 200
content-length: 9859
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
accept-ranges: bytes
content-type: image/jpeg
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 200 arrow-btn-next-blue-sm-bold.svg
online.citi.com/CBOL/common/ui/ddl/theme/latest/images/icons/svgs/arrows/ 918 B
1000 B 214ms
213ms Image
image/svg+xml 104.109.92.187
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://online.citi.com/CBOL/common/ui/ddl/theme/latest/images/icons/svgs/arrows/arrow-btn-next-blue-sm-bold.svg

Requested by

Host: online.citi.com
URL: https://online.citi.com/CBOL/common/ui/ddl/theme/latest/scripts/vendor.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.109.92.187 , Netherlands, ASN20940 (AKAMAI-ASN1, EU),

Reverse DNS

a104-109-92-187.deploy.static.akamaitechnologies.com

Software

Resource Hash

e90fb0eba512ed6473f6fb8acf4cd09b38732f150f43c396246c12bb2aacbb67

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

Referer: https://online.citi.com/GFC/branding/responsivebranding/css/main.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security: max-age=300
content-encoding: gzip
last-modified: Tue, 12 Sep 2017 17:24:53 GMT
x-akamai-citisite: GTDC
date: Thu, 30 Apr 2020 20:02:49 GMT
vary: Accept-Encoding
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
status: 200
content-length: 499
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
accept-ranges: bytes
content-type: image/svg+xml
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 200 Citi-Branding-Sprite.png
online.citi.com/GFC/branding/img/ 5 KB
5 KB 56ms
55ms Image
image/png 104.109.92.187
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://online.citi.com/GFC/branding/img/Citi-Branding-Sprite.png

Requested by

Host: online.citi.com
URL: https://online.citi.com/CBOL/common/ui/ddl/theme/latest/scripts/vendor.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.109.92.187 , Netherlands, ASN20940 (AKAMAI-ASN1, EU),

Reverse DNS

a104-109-92-187.deploy.static.akamaitechnologies.com

Software

Resource Hash

3fca3de24621f0f10186594054444d608016297c2e853e548710b3521e42a609

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

Referer: https://online.citi.com/GFC/branding/responsivebranding/css/main_branding.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security: max-age=300
last-modified: Wed, 14 Jun 2017 18:29:01 GMT
x-akamai-citisite: GTDC
date: Thu, 30 Apr 2020 20:02:48 GMT
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
status: 200
content-length: 4952
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
accept-ranges: bytes
content-type: image/png
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 200 appStore_1px.png
online.citi.com/GFC/branding/responsivebranding/img/ 3 KB
4 KB 66ms
66ms Image
image/png 104.109.92.187
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://online.citi.com/GFC/branding/responsivebranding/img/appStore_1px.png

Requested by

Host: online.citi.com
URL: https://online.citi.com/CBOL/common/ui/ddl/theme/latest/scripts/vendor.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.109.92.187 , Netherlands, ASN20940 (AKAMAI-ASN1, EU),

Reverse DNS

a104-109-92-187.deploy.static.akamaitechnologies.com

Software

Resource Hash

f44e4692a52b6a382cb481e23f8bcb9a6d4c24eec8aa60143c7e2ca3a85758b2

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

Referer: https://online.citi.com/GFC/branding/responsivebranding/css/main_branding.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security: max-age=300
last-modified: Thu, 27 Sep 2018 21:19:09 GMT
x-akamai-citisite: GTDC
date: Thu, 30 Apr 2020 20:02:48 GMT
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
status: 200
content-length: 3513
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
accept-ranges: bytes
content-type: image/png
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 200 googlePlay_1px.png
online.citi.com/GFC/branding/responsivebranding/img/ 4 KB
4 KB 79ms
79ms Image
image/png 104.109.92.187
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://online.citi.com/GFC/branding/responsivebranding/img/googlePlay_1px.png

Requested by

Host: online.citi.com
URL: https://online.citi.com/CBOL/common/ui/ddl/theme/latest/scripts/vendor.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.109.92.187 , Netherlands, ASN20940 (AKAMAI-ASN1, EU),

Reverse DNS

a104-109-92-187.deploy.static.akamaitechnologies.com

Software

Resource Hash

1cc4ec61057f30cea6d47126e0444f119b2606720b1fe8d7e0deff1f5742a82b

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

Referer: https://online.citi.com/GFC/branding/responsivebranding/css/main_branding.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security: max-age=300
last-modified: Thu, 27 Sep 2018 21:21:52 GMT
x-akamai-citisite: GTDC
date: Thu, 30 Apr 2020 20:02:48 GMT
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
status: 200
content-length: 3900
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
accept-ranges: bytes
content-type: image/png
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 200 arrow-btn-next-white-sm-bold.svg
online.citi.com/CBOL/common/ui/ddl/theme/latest/images/icons/svgs/arrows/ 918 B
997 B 174ms
173ms Image
image/svg+xml 104.109.92.187
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://online.citi.com/CBOL/common/ui/ddl/theme/latest/images/icons/svgs/arrows/arrow-btn-next-white-sm-bold.svg

Requested by

Host: online.citi.com
URL: https://online.citi.com/CBOL/common/ui/ddl/theme/latest/scripts/vendor.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.109.92.187 , Netherlands, ASN20940 (AKAMAI-ASN1, EU),

Reverse DNS

a104-109-92-187.deploy.static.akamaitechnologies.com

Software

Resource Hash

4f918cd256712c03a1b88007176cabf623cc63740e919d35a217c18dc7ebe607

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

Referer: https://online.citi.com/loginpage/styles/homePage.min.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security: max-age=300
content-encoding: gzip
last-modified: Tue, 12 Sep 2017 17:24:53 GMT
x-akamai-citisite: GTDC
date: Thu, 30 Apr 2020 20:02:49 GMT
vary: Accept-Encoding
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
status: 200
content-length: 496
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
accept-ranges: bytes
content-type: image/svg+xml
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 200 oo_icon_retina.gif
online.citi.com/GFC/branding/olab/images/ 2 KB
3 KB 53ms
53ms Image
image/gif 104.109.92.187
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://online.citi.com/GFC/branding/olab/images/oo_icon_retina.gif

Requested by

Host: online.citi.com
URL: https://online.citi.com/CBOL/common/ui/ddl/theme/latest/scripts/vendor.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.109.92.187 , Netherlands, ASN20940 (AKAMAI-ASN1, EU),

Reverse DNS

a104-109-92-187.deploy.static.akamaitechnologies.com

Software

Resource Hash

701d2f9f02741b8429f4fb892b2b48c34a8a0f9189cb09013b2799031f22e484

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

Referer: https://online.citi.com/GFC/branding/responsivebranding/css/main_branding.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security: max-age=300
last-modified: Tue, 12 Sep 2017 17:22:45 GMT
x-akamai-citisite: GTDC
date: Thu, 30 Apr 2020 20:02:49 GMT
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
status: 200
content-length: 2204
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
accept-ranges: bytes
content-type: image/gif
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

POST
H2 200 metrics Show response
online.citi.com/gcgapi/prod/public/v1/digital/reporting/ 0
2 KB 351ms
350ms XHR
text/plain 104.109.92.187
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://online.citi.com/gcgapi/prod/public/v1/digital/reporting/metrics

Requested by

Host: online.citi.com
URL: https://online.citi.com/US/login.do?JFP_TOKEN=3RQ3Y559

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.109.92.187 , Netherlands, ASN20940 (AKAMAI-ASN1, EU),

Reverse DNS

a104-109-92-187.deploy.static.akamaitechnologies.com

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

Accept-Language: en-US
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: application/json
scope: VISITOR
Accept: application/json, text/javascript, */*; q=0.01
Referer: https://online.citi.com/US/login.do?JFP_TOKEN=3RQ3Y559
countryCode: US
X-Requested-With: XMLHttpRequest
client_id: 4a51fb19-a1a7-4247-bc7e-18aa56dd1c40

Response headers

date: Thu, 30 Apr 2020 20:02:49 GMT
content-encoding: gzip
x-route-target: DIGITAL-DEFAULT:DEFAULT
citiuuid: eeec1af6-47ef-4258-ad88-4bb4f9381c287800078
access-control-allow-origin: https://online.citi.com
biztoken: ENupijENFNwQkSImnl2mMwRCmP/6lXBV6rbVa39ckImB/bnTdOg7Pq5vL9hO14/e2fNRYvo3df4Li8Nn+1PBuzwDzYMgIh9/3BA3P4/JeIs=
status: 200
access-control-max-age: 2147483647
x-global-transaction-id: 38f9b44b5eab2ee91f1d56ff
uuid: 9cc31341-d5a9-4931-9c95-09ed03a21be1
content-length: 0
pragma: no-cache
expires: -1
x-akamai-citisite: GTDC
dclocation: GT1
vary: Accept-Encoding
access-control-allow-methods: GET,PUT,POST,DELETE,HEAD,GET,POST,PUT,DELETE
content-type: text/plain
x-backside-transport: OK OK,OK OK,OK OK
x-vcap-request-id: 21d522cf-e6bc-4ad4-6806-6bfed835b39f,f8239178-cef4-41d7-5877-a7e08c1bc0e6,56e306de-e994-4da2-4c9a-434d1d3c2508
access-control-expose-headers: action,challengeType,bizToken,eventid,Eventid,Eventidexpirytime,eventidexpirytime,accesstoken,Authorization,sid,SessionId,CCPToken,CFIToken,Accept,Accept-Language,Authorization,businessCode,client_id,content-type,countryCode,uuid,x-ibm-client-id,eventid,sessionID,bizToken,citiuuid,applicationId,channelId,Scope,blackBox,devicePrint,deviceTokenCookie,AMWResponse,action,challengeType,TMXSessionId,tenantName,TMXDigitalApplicationType,accessToken,familyIndicator,Otpid,deviceId,subscriberId,CitiProfOnly,digitalApplicationType,environmentId,BioCatchSessionId,X-Migration-Target,x-soz9htcz-a,x-soz9htcz-b,x-soz9htcz-c,x-soz9htcz-d,x-soz9htcz-e,x-soz9htcz-f,x-soz9htcz-z,x-soz9htcz-uniquestatekey,tenantId,appid,X-Akamai-CITISITE,Dclocation,Uuid,appVersion,devicemodelname
cache-control: no-cache, no-store
access-control-allow-credentials: true
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
access-control-allow-headers: action,challengeType,accesstoken,appVersion,,Content-Type,sid,CCPToken,CFIToken,countryCode,businessCode,channelId,uuid,client_id,environmentId,Accept,Accept-Language,Authorization,businessCode,client_id,content-type,countryCode,uuid,x-ibm-client-id,eventid,sessionID,bizToken,citiuuid,applicationId,channelId,Scope,blackBox,devicePrint,deviceTokenCookie,AMWResponse,action,challengeType,TMXSessionId,tenantName,TMXDigitalApplicationType,accessToken,familyIndicator,Otpid,deviceId,subscriberId,CitiProfOnly,digitalApplicationType,environmentId,BioCatchSessionId,X-Migration-Target,x-soz9htcz-a,x-soz9htcz-b,x-soz9htcz-c,x-soz9htcz-d,x-soz9htcz-e,x-soz9htcz-f,x-soz9htcz-z,x-soz9htcz-uniquestatekey,tenantId,appid,X-Akamai-CITISITE,Dclocation,Uuid,appVersion,devicemodelname
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 200 450x285-citi-cluster.png
online.citi.com/JRS/banners/card_art/ 59 KB
59 KB 68ms
67ms Image
image/png 104.109.92.187
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://online.citi.com/JRS/banners/card_art/450x285-citi-cluster.png

Requested by

Host: online.citi.com
URL: https://online.citi.com/US/login.do?JFP_TOKEN=3RQ3Y559

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.109.92.187 , Netherlands, ASN20940 (AKAMAI-ASN1, EU),

Reverse DNS

a104-109-92-187.deploy.static.akamaitechnologies.com

Software

Resource Hash

d71b39784664cbc1e6905bd0c99918d0452ddf5ebf78f19e1721f4ba125e0d57

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

Referer: https://online.citi.com/US/login.do?JFP_TOKEN=3RQ3Y559
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security: max-age=300
last-modified: Thu, 21 Nov 2019 18:57:58 GMT
x-akamai-citisite: GTDC
date: Thu, 30 Apr 2020 20:02:49 GMT
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
status: 200
content-length: 60075
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
accept-ranges: bytes
content-type: image/png
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 200 HP_Hero_LazyLoad_1120x630.jpg
online.citi.com/JRS/banners/modules/ 12 KB
13 KB 56ms
55ms Image
image/jpeg 104.109.92.187
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://online.citi.com/JRS/banners/modules/HP_Hero_LazyLoad_1120x630.jpg

Requested by

Host: online.citi.com
URL: https://online.citi.com/US/login.do?JFP_TOKEN=3RQ3Y559

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.109.92.187 , Netherlands, ASN20940 (AKAMAI-ASN1, EU),

Reverse DNS

a104-109-92-187.deploy.static.akamaitechnologies.com

Software

Resource Hash

e18c28c95bea1af6b2187c6a35eb651dccabfb2212e529b6edd4a2e2f4c39ea8

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

Referer: https://online.citi.com/US/login.do?JFP_TOKEN=3RQ3Y559
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security: max-age=300
last-modified: Tue, 12 Sep 2017 17:16:58 GMT
x-akamai-citisite: GTDC
date: Thu, 30 Apr 2020 20:02:49 GMT
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
status: 200
content-length: 12405
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
accept-ranges: bytes
content-type: image/jpeg
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 200 HP5820_M.jpg
online.citi.com/JRS/banners/modules/ 95 KB
95 KB 27ms
27ms Image
image/jpeg 104.109.92.187
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://online.citi.com/JRS/banners/modules/HP5820_M.jpg

Requested by

Host: online.citi.com
URL: https://online.citi.com/US/login.do?JFP_TOKEN=3RQ3Y559

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.109.92.187 , Netherlands, ASN20940 (AKAMAI-ASN1, EU),

Reverse DNS

a104-109-92-187.deploy.static.akamaitechnologies.com

Software

Resource Hash

01d6b632b0c808c52a298af8c62df853f1d736632600c78f539c5bc061df3315

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

Referer: https://online.citi.com/US/login.do?JFP_TOKEN=3RQ3Y559
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security: max-age=300
last-modified: Mon, 25 Nov 2019 18:21:05 GMT
x-akamai-citisite: GTDC
date: Thu, 30 Apr 2020 20:02:49 GMT
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
status: 200
content-length: 97118
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
accept-ranges: bytes
content-type: image/jpeg
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 200 M1-M7_Rewards.jpg
online.citi.com/JRS/banners/modules/ 99 KB
100 KB 57ms
55ms Image
image/jpeg 104.109.92.187
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://online.citi.com/JRS/banners/modules/M1-M7_Rewards.jpg

Requested by

Host: online.citi.com
URL: https://online.citi.com/US/login.do?JFP_TOKEN=3RQ3Y559

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.109.92.187 , Netherlands, ASN20940 (AKAMAI-ASN1, EU),

Reverse DNS

a104-109-92-187.deploy.static.akamaitechnologies.com

Software

Resource Hash

b7264725078e153ab3a4af37c52374b3a5d46b8fb5fc7b5f8af2e773364eef93

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

Referer: https://online.citi.com/US/login.do?JFP_TOKEN=3RQ3Y559
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security: max-age=300
last-modified: Thu, 21 Nov 2019 18:59:04 GMT
x-akamai-citisite: GTDC
date: Thu, 30 Apr 2020 20:02:49 GMT
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
status: 200
content-length: 101509
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
accept-ranges: bytes
content-type: image/jpeg
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 200 HYSA_M1M7_3Up.jpg
online.citi.com/JRS/banners/modules/ 93 KB
93 KB 61ms
60ms Image
image/jpeg 104.109.92.187
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://online.citi.com/JRS/banners/modules/HYSA_M1M7_3Up.jpg

Requested by

Host: online.citi.com
URL: https://online.citi.com/US/login.do?JFP_TOKEN=3RQ3Y559

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.109.92.187 , Netherlands, ASN20940 (AKAMAI-ASN1, EU),

Reverse DNS

a104-109-92-187.deploy.static.akamaitechnologies.com

Software

Resource Hash

6c754df7391b8b22f329bdf75eaee815a2032412e26941cbe3838b074cb4d9cd

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

Referer: https://online.citi.com/US/login.do?JFP_TOKEN=3RQ3Y559
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security: max-age=300
last-modified: Wed, 15 Apr 2020 13:47:44 GMT
x-akamai-citisite: GTDC
date: Thu, 30 Apr 2020 20:02:49 GMT
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
status: 200
content-length: 94786
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
accept-ranges: bytes
content-type: image/jpeg
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 200 HP5904_M.jpg
online.citi.com/JRS/banners/modules/ 98 KB
99 KB 61ms
60ms Image
image/jpeg 104.109.92.187
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://online.citi.com/JRS/banners/modules/HP5904_M.jpg

Requested by

Host: online.citi.com
URL: https://online.citi.com/US/login.do?JFP_TOKEN=3RQ3Y559

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.109.92.187 , Netherlands, ASN20940 (AKAMAI-ASN1, EU),

Reverse DNS

a104-109-92-187.deploy.static.akamaitechnologies.com

Software

Resource Hash

4999a8bcfc1f9fd95a0c4e42cfbac1abdf5a6c9e26734abbe4bc157b8c2b49ab

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

Referer: https://online.citi.com/US/login.do?JFP_TOKEN=3RQ3Y559
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security: max-age=300
last-modified: Fri, 11 Oct 2019 18:40:20 GMT
x-akamai-citisite: GTDC
date: Thu, 30 Apr 2020 20:02:49 GMT
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
status: 200
content-length: 100665
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
accept-ranges: bytes
content-type: image/jpeg
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

POST
H2 200 TMXProfile.jws Show response
online.citi.com/US/REST/ManageTMXProfile/ 264 B
845 B 180ms
180ms XHR
application/json 104.109.92.187
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://online.citi.com/US/REST/ManageTMXProfile/TMXProfile.jws

Requested by

Host: online.citi.com
URL: https://online.citi.com/US/login.do?JFP_TOKEN=3RQ3Y559

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.109.92.187 , Netherlands, ASN20940 (AKAMAI-ASN1, EU),

Reverse DNS

a104-109-92-187.deploy.static.akamaitechnologies.com

Software

Resource Hash

00d2ef3349482205ef97b84af5c5dd9abda693a458649a12159a096e9e899705

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

Accept: */*
Referer: https://online.citi.com/US/login.do?JFP_TOKEN=3RQ3Y559
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security: max-age=300
content-encoding: gzip
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
status: 200
cid: gt02p-srv3
x-ua-compatible: IE=edge
pragma: no-cache
x-akamai-citisite: GTDC
jid: 200430160247602356347148
date: Thu, 30 Apr 2020 20:02:49 GMT
vary: Accept-Encoding
content-language: en-US
expires: Thu, 01 Jan 1970 00:00:00 GMT
cache-control: no-cache, must-revalidate, proxy-revalidate, no-store
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
content-length: 233
content-type: application/json
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H/1.1 200
OK tags.js Show response
content22.online.citi.com/fp/ 49 KB
11 KB 116ms
22ms Script
text/javascript 91.235.134.21
THM

General

Check archive.org

Show headers Download Go to

Full URL

https://content22.online.citi.com/fp/tags.js?org_id=89oebq5k&session_id=870e3f8c1f2b672c1fbc2ee2a3dabc92778d9976d890f49f675074a30b0aca59&allow_reprofile=1

Requested by

Host: online.citi.com
URL: https://online.citi.com/TMX/TMXProfiling.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

91.235.134.21 , Netherlands, ASN30286 (THM, US),

Reverse DNS

Software

Apache /

Resource Hash

acd6c4f286c0e142ce45f592e4c53bc8d608d469a03ed61b98b19272373be930

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://online.citi.com/US/login.do?JFP_TOKEN=3RQ3Y559
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 30 Apr 2020 20:02:49 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Server: Apache
Strict-Transport-Security: max-age=31536000
P3P: CP=IVAa PSAa
Cache-Control: no-cache, no-store, must-revalidate
Transfer-Encoding: chunked
Connection: Keep-Alive, Keep-Alive
Content-Type: text/javascript;charset=UTF-8
Vary: Accept-Encoding
X-XSS-Protection: 1; mode=block
Keep-Alive: timeout=2, max=100
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H/1.1 200
OK up_loader.1.1.0.js Show response
js.adsrvr.org/ 4 KB
2 KB 39ms
13ms Script
application/x-javascript 13.224.95.202
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://js.adsrvr.org/up_loader.1.1.0.js
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 13.224.95.202 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-224-95-202.zrh50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 0615974c40d602afdbf9759533e352bc17b0458c85aad6694b1a1ad20659625b

Request headers

Referer: https://online.citi.com/US/login.do?JFP_TOKEN=3RQ3Y559
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Thu, 30 Apr 2020 04:40:41 GMT
Content-Encoding: gzip
Last-Modified: Mon, 13 Jan 2020 19:16:48 GMT
Server: AmazonS3
Age: 55329
Vary: Accept-Encoding
X-Cache: Hit from cloudfront
Content-Type: application/x-javascript
Via: 1.1 048a65288aba3f3565a971a2e44151be.cloudfront.net (CloudFront)
Connection: keep-alive
Transfer-Encoding: chunked
X-Amz-Cf-Pop: ZRH50-C1
X-Amz-Cf-Id: Y2tkKkM8nIweIZOeH3S6IULWL7T495lDVKXkSOwIurFEJDm40tY0LA==

GET
H2 200 bat.js Show response
bat.bing.com/ 25 KB
8 KB 31ms
30ms Script
application/javascript 2620:1ec:c11::200
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://bat.bing.com/bat.js
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: 079e218ad07f42523479d475b4973a6e386ba95209ee964c04c1a6eb6186bda3

Request headers

Referer: https://online.citi.com/US/login.do?JFP_TOKEN=3RQ3Y559
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 30 Apr 2020 20:02:49 GMT
content-encoding: gzip
last-modified: Mon, 13 Apr 2020 22:01:50 GMT
x-msedge-ref: Ref A: 32A9F8D1A4A9499CB9E5E1DE65B0BBB7 Ref B: FRAEDGE0709 Ref C: 2020-04-30T20:02:49Z
status: 200
etag: "0db222df11d61:0"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: private,max-age=1800
accept-ranges: bytes
content-length: 7610

GET
H2 200 conversion_async.js Show response
www.googleadservices.com/pagead/ 28 KB
11 KB 19ms
18ms Script
text/javascript 172.217.16.194
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googleadservices.com/pagead/conversion_async.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=DC-6260004

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.16.194 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s08-in-f2.1e100.net

Software

cafe /

Resource Hash

28f07389552cf9e3557433f06cf63d9cf59e406f6aace98f63ba8220bb6095a5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://online.citi.com/US/login.do?JFP_TOKEN=3RQ3Y559
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 30 Apr 2020 20:02:49 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
content-disposition: attachment; filename="f.txt"
alt-svc: h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 10743
x-xss-protection: 0
server: cafe
etag: 10886962978695911934
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600
timing-allow-origin: *
expires: Thu, 30 Apr 2020 20:02:49 GMT

POST
H2 200 s2148128111647 Show response
metrics1.citi.com/b/ss/citiuscombprod/1/JS-2.9.0/ 43 B
439 B 68ms
24ms XHR
image/gif 15.188.31.119
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://metrics1.citi.com/b/ss/citiuscombprod/1/JS-2.9.0/s2148128111647

Requested by

Host: online.citi.com
URL: https://online.citi.com/US/login.do?JFP_TOKEN=3RQ3Y559

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

15.188.31.119 Paris, France, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-15-188-31-119.eu-west-3.compute.amazonaws.com

Software

jag /

Resource Hash

55c9d2f019f9d7ddfd69b2ad0351c5617338a222362aebb02b3b98a4dbc18486

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://online.citi.com/US/login.do?JFP_TOKEN=3RQ3Y559
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

date: Thu, 30 Apr 2020 20:02:49 GMT
x-content-type-options: nosniff
x-c: master-1221.I0e927e.M0-376
p3p: CP="This is not a P3P policy"
status: 200
content-length: 43
x-xss-protection: 1; mode=block
pragma: no-cache
last-modified: Fri, 01 May 2020 20:02:49 GMT
server: jag
xserver: anedge-65fb49f79-9g5h7
etag: 3410798819507798016-4616796778396395420
vary: *
content-type: image/gif;charset=utf-8
access-control-allow-origin: https://online.citi.com
cache-control: no-cache, no-store, max-age=0, no-transform, private
access-control-allow-credentials: true
expires: Wed, 29 Apr 2020 20:02:49 GMT

GET
H2 204 425466.html
sr.rlcdn.com/ Frame AB76 0
0 130ms
117ms Document
text/plain 35.241.8.149
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://sr.rlcdn.com/425466.html?es=80676&u=da39a3ee5e6b4b0d3255bfef95601890afd80709
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/code/c6d1bd53e0de1c0d07e1c021797a97bf.js?conditionId0=467299
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.241.8.149 , Ascension Island, ASN15169 (GOOGLE, US),
Reverse DNS: 149.8.241.35.bc.googleusercontent.com
Software: /
Resource Hash

Request headers

:method: GET
:authority: sr.rlcdn.com
:scheme: https
:path: /425466.html?es=80676&u=da39a3ee5e6b4b0d3255bfef95601890afd80709
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://online.citi.com/US/login.do?JFP_TOKEN=3RQ3Y559
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: https://online.citi.com/US/login.do?JFP_TOKEN=3RQ3Y559

Response headers

status: 204
date: Thu, 30 Apr 2020 20:02:49 GMT
via: 1.1 google
alt-svc: clear

GET
H2 200 1560.js Show response
cdn.pbbl.co/r/ 33 KB
9 KB 206ms
127ms Script
application/javascript 99.86.243.81
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.pbbl.co/r/1560.js

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/code/8637af7c210f4e79436bc39f71b49bfa.js?conditionId0=4827153

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

99.86.243.81 Seattle, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-99-86-243-81.vie50.r.cloudfront.net

Software

nginx/1.10.3 (Ubuntu) /

Resource Hash

8e60e8edaca8a3167fe48e62f9b53ba1989a5b6a23283555f09ab12175fed96e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Xss-Protection	1

Request headers

Referer: https://online.citi.com/US/login.do?JFP_TOKEN=3RQ3Y559
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 30 Apr 2020 20:02:49 GMT
content-encoding: gzip
last-modified: Tue, 03 Mar 2020 17:36:15 GMT
server: nginx/1.10.3 (Ubuntu)
x-amz-cf-pop: VIE50-C1
status: 200
vary: Accept-Encoding
x-cache: Miss from cloudfront
content-type: application/javascript
via: 1.1 2ada7fef339aac482bc92d45b7dff5f8.cloudfront.net (CloudFront)
cache-control: max-age=1800, public
strict-transport-security: max-age=31536000
x-amz-cf-id: 9f2KLzwtPezW8KiLTCfXZK51jTA9vuyr15uWH2krdDNQlMfqF7AfHQ==
x-xss-protection: 1
expires: Thu, 30 Apr 2020 20:32:49 GMT

GET
H/1.1 200
OK Cookie set ca.html
20779813p.rfihub.com/ Frame 55E8 0
0 111ms
31ms Document
text/html 193.0.160.128
ROCKETFUEL

General

Check archive.org

Show headers Download Go to

Full URL: https://20779813p.rfihub.com/ca.html?rfiidc=1871597495045692823&rfiaid=f804af61beca40bf9748474318876071&ver=9&ra=1852&rb=648&ca=20779813&_o=17169175&_t=20779813&pe=https%3A%2F%2Fonline.citi.com%2FUS%2Flogin.do%3FJFP_TOKEN%3D3RQ3Y559&pf=https%3A%2F%2Fwww.google.ro%2F&ra=9123664344616131
Requested by: Host: c1.rfihub.net
URL: https://c1.rfihub.net/js/tc.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_256_CBC
Server: 193.0.160.128 , Netherlands, ASN54312 (ROCKETFUEL, US),
Reverse DNS
Software: Jetty(9.0.6.v20130930) /
Resource Hash

Request headers

Host: 20779813p.rfihub.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Referer: https://online.citi.com/US/login.do?JFP_TOKEN=3RQ3Y559
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Cookie: rud=H4sIAAAAAAAAAOMSNrQwNzS1NDexNDUwMTWzNLIwMhbiM9R1KcpJjIwqdQpxD4mU4jU0tbAwMjezNDM3NDYDAG6Phy00AAAA; ruds=H4sIAAAAAAAAAOMSNrQwNzS1NDexNDUwMTWzNLIwMhbiM9R1KcpJjIwqdQpxD4kEAF1H0gclAAAA
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: https://online.citi.com/US/login.do?JFP_TOKEN=3RQ3Y559

Response headers

P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Set-Cookie: rud=H4sIAAAAAAAAAOMSNrQwNzS1NDexNDUwMTWzNLIwMhbiM9R1KcpJjIwqdQpxD4mU4jU0tbAwMjezNDM3NDYDAG6Phy00AAAA; Path=/; Domain=.rfihub.com; Expires=Tue, 25 May 2021 20:02:49 GMT; Secure; SameSite=None ruds=H4sIAAAAAAAAAOMSNrQwNzS1NDexNDUwMTWzNLIwMhbiM9R1KcpJjIwqdQpxD4kEAF1H0gclAAAA; Path=/; Domain=.rfihub.com; Secure; SameSite=None
Cache-Control: no-cache
Content-Type: text/html
Content-Encoding: gzip
Vary: Accept-Encoding, User-Agent
Transfer-Encoding: chunked
Server: Jetty(9.0.6.v20130930)

GET
H2

200

activityi;dc_pre=CMPqz-T4kOkCFdanGwod73EIXg;src=6260004;type=citih0;cat=citih00;qty=1;cost=1;ord=7240636854035.425;gtm=2od4f0;auiddc=1404517603.1588276967;~oref=https%3A%2F%2Fonline.citi.com%2FUS%2...
6260004.fls.doubleclick.net/ Frame 4687
Redirect Chain

https://6260004.fls.doubleclick.net/activityi;src=6260004;type=citih0;cat=citih00;qty=1;cost=1;ord=7240636854035.425;gtm=2od4f0;auiddc=1404517603.1588276967;~oref=https%3A%2F%2Fonline.citi.com%2FUS...
https://6260004.fls.doubleclick.net/activityi;dc_pre=CMPqz-T4kOkCFdanGwod73EIXg;src=6260004;type=citih0;cat=citih00;qty=1;cost=1;ord=7240636854035.425;gtm=2od4f0;auiddc=1404517603.1588276967;~oref=...

0
0

23ms
23ms

Document
text/html

172.217.18.166
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://6260004.fls.doubleclick.net/activityi;dc_pre=CMPqz-T4kOkCFdanGwod73EIXg;src=6260004;type=citih0;cat=citih00;qty=1;cost=1;ord=7240636854035.425;gtm=2od4f0;auiddc=1404517603.1588276967;~oref=https%3A%2F%2Fonline.citi.com%2FUS%2Flogin.do%3FJFP_TOKEN%3D3RQ3Y559?

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=DC-6260004

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.18.166 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra15s29-in-f6.1e100.net

Software

cafe /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=21600
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: 6260004.fls.doubleclick.net
:scheme: https
:path: /activityi;dc_pre=CMPqz-T4kOkCFdanGwod73EIXg;src=6260004;type=citih0;cat=citih00;qty=1;cost=1;ord=7240636854035.425;gtm=2od4f0;auiddc=1404517603.1588276967;~oref=https%3A%2F%2Fonline.citi.com%2FUS%2Flogin.do%3FJFP_TOKEN%3D3RQ3Y559?
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://online.citi.com/US/login.do?JFP_TOKEN=3RQ3Y559
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: about:blank

Response headers

status: 200
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
date: Thu, 30 Apr 2020 20:02:49 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
cache-control: no-cache, must-revalidate
strict-transport-security: max-age=21600
content-type: text/html; charset=UTF-8
pragma: no-cache
x-content-type-options: nosniff
content-encoding: gzip
server: cafe
content-length: 422
x-xss-protection: 0
set-cookie: test_cookie=CheckForPermission; expires=Thu, 30-Apr-2020 20:17:49 GMT; path=/; domain=.doubleclick.net; Secure; SameSite=none
alt-svc: h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

Redirect headers

status: 302
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin: *
date: Thu, 30 Apr 2020 20:02:49 GMT
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
cache-control: no-cache, must-revalidate
follow-only-when-prerender-shown: 1
strict-transport-security: max-age=21600
location: https://6260004.fls.doubleclick.net/activityi;dc_pre=CMPqz-T4kOkCFdanGwod73EIXg;src=6260004;type=citih0;cat=citih00;qty=1;cost=1;ord=7240636854035.425;gtm=2od4f0;auiddc=1404517603.1588276967;~oref=https%3A%2F%2Fonline.citi.com%2FUS%2Flogin.do%3FJFP_TOKEN%3D3RQ3Y559?
content-type: text/html; charset=UTF-8
x-content-type-options: nosniff
server: cafe
content-length: 0
x-xss-protection: 0
alt-svc: h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 TC-3498-2.gif
pt.ispot.tv/v2/ 43 B
315 B 32ms
9ms Image
image/gif 151.101.114.109
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pt.ispot.tv/v2/TC-3498-2.gif?app=web&type=citi
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.114.109 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: 0227e0e4dea130eb6f3163aa3ab03720dce83a0e219c282189b03bc5b8a727e3

Request headers

Referer: https://online.citi.com/US/login.do?JFP_TOKEN=3RQ3Y559
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 30 Apr 2020 20:02:49 GMT
content-type: image/gif
status: 200
cache-control: no-cache, no-store, must-revalidate
accept-ranges: bytes
content-length: 43
expires: 0

GET
H2 200 tr
www.facebook.com/ 44 B
157 B 8ms
6ms Image
image/gif 2a03:2880:f12d:83:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr?id=313693532491635&ev=PageView&cd[order_id]=[CS]v1|2F5597730515D332-40000864E2F62AB0[CE]

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f12d:83:face:b00c:0:25de , Ireland, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://online.citi.com/US/login.do?JFP_TOKEN=3RQ3Y559
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 30 Apr 2020 20:02:49 GMT, Thu, 30 Apr 2020 20:02:49 GMT
last-modified: Fri, 21 Dec 2012 00:00:01 GMT
server: proxygen-bolt
strict-transport-security: max-age=31536000; includeSubDomains
content-type: image/gif
status: 200
cache-control: no-cache, must-revalidate, max-age=0
alt-svc: h3-27=":443"; ma=3600
content-length: 44
expires: Thu, 30 Apr 2020 20:02:49 GMT

GET
H2 200 /
d.agkn.com/pixel/9340/ 43 B
587 B 54ms
24ms Image
image/gif 2600:9000:2190:6000:19:fc2c:a140:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://d.agkn.com/pixel/9340/?che=1503502891.5451164&abid=[CS]v1|2F5597730515D332-40000864E2F62AB0[CE]
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:9000:2190:6000:19:fc2c:a140:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: Apache-Coyote/1.1 /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer: https://online.citi.com/US/login.do?JFP_TOKEN=3RQ3Y559
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 30 Apr 2020 20:02:49 GMT
via: 1.1 376bac901e689131d2a41914df1245d9.cloudfront.net (CloudFront)
server: Apache-Coyote/1.1
x-amz-cf-pop: ZRH50-C1
x-cache: Miss from cloudfront
p3p: CP="NOI DSP COR CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
status: 200
cache-control: no-cache, must-revalidate
content-type: image/gif
content-length: 43
x-amz-cf-id: j32NQ_PrEXpeHUlYr_BuiGjEPZIglyL3vFKFpSCmck9LRf51c6-aLg==
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 generic1588266760035.js Show response
resources.digital-cloud-citi.medallia.com/wdcusciti/50/onsite/ 299 KB
56 KB 10ms
9ms Script
application/javascript 151.101.114.133
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://resources.digital-cloud-citi.medallia.com/wdcusciti/50/onsite/generic1588266760035.js
Requested by: Host: resources.digital-cloud-citi.medallia.com
URL: https://resources.digital-cloud-citi.medallia.com/wdcusciti/50/onsite/embed.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.114.133 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 9300787330c7945c4ad1c6b2beecc1b22ee5d35f2ad71b6abdf3dc723ed41f82

Request headers

Referer: https://online.citi.com/US/login.do?JFP_TOKEN=3RQ3Y559
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-amz-version-id: nd2nf6XV7QgOAaJ2JeSq9Yei216Rn8dJ
content-encoding: gzip
etag: "5d4536679a0426f77c32548bfcc31947"
age: 13
via: 1.1 varnish
x-cache: HIT
status: 200
content-length: 57497
x-amz-id-2: TOCdJHlMENTqnw12zN4OMRd2KisqUhTt0upj/xTJI655lB1T8wBgY118Ulkpa8X0TyAROnCj3lY=
x-served-by: cache-hhn4042-HHN
last-modified: Thu, 30 Apr 2020 17:12:41 GMT
server: AmazonS3
x-timer: S1588276970.590090,VS0,VE1
date: Thu, 30 Apr 2020 20:02:49 GMT
vary: Accept-Encoding
x-amz-request-id: B0391766934A9677
access-control-allow-origin: *
cache-control: max-age=0,must-revalidate
accept-ranges: bytes
content-type: application/javascript
x-cache-hits: 1

GET
H/1.1 200
OK 63068
stags.bluekai.com/site/ Frame BB1B 0
0 159ms
158ms Document
text/html 23.45.237.36
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://stags.bluekai.com/site/63068?ret=html&phint=language%3Denglish&phint=product%3D&phint=event&phint=category%3Dpre-login%20Sign%20on%20page&phint=page%3DNon%20Cookied%20Username%20Password%20&phint=section1%3DPublic&phint=section2%3DSignOn&phint=section3%3D&phint=section4%3D&phint=bankappstatus&phint=productID&phint=__bk_t%3DOnline%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&phint=__bk_k%3Dbanking%2C%20citi%2C%20financial%20services%2C%20checking%20account%2C%20savings%20account%2C%20credit%20cards&phint=__bk_pr%3Dhttps%3A%2F%2Fwww.google.ro%2F&phint=__bk_l%3Dhttps%3A%2F%2Fonline.citi.com%2FUS%2Flogin.do%3FJFP_TOKEN%3D3RQ3Y559&phint=__bk_v%3D3.1.4&limit=10&r=45507813
Requested by: Host: tags.bkrtx.com
URL: https://tags.bkrtx.com/js/bk-coretag.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 23.45.237.36 , United States, ASN20940 (AKAMAI-ASN1, EU),
Reverse DNS: a23-45-237-36.deploy.static.akamaitechnologies.com
Software: /
Resource Hash

Request headers

Host: stags.bluekai.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Referer: https://online.citi.com/US/login.do?JFP_TOKEN=3RQ3Y559
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: https://online.citi.com/US/login.do?JFP_TOKEN=3RQ3Y559

Response headers

Content-Type: text/html
Content-Length: 71
P3P: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV", policyref="http://tags.bluekai.com/w3c/p3p.xml"
BK-Server: 446a
Date: Thu, 30 Apr 2020 20:02:49 GMT
Connection: keep-alive
X-N: S

GET
H2 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/959299794/ 2 KB
1 KB 19ms
18ms Script
text/javascript 2a00:1450:4001:81a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/959299794/?random=1588276969608&cv=9&fst=1588276969608&num=1&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2od4f0&sendb=1&ig=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fonline.citi.com%2FUS%2Flogin.do%3FJFP_TOKEN%3D3RQ3Y559&ref=https%3A%2F%2Fwww.google.ro%2F&tiba=Online%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4

Requested by

Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/conversion_async.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d0fe233255a67c17c1898de0f5cd5062ab0bf847c2f8a8ce3121bcdf8da23e5b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://online.citi.com/US/login.do?JFP_TOKEN=3RQ3Y559
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 30 Apr 2020 20:02:49 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status: 200
cache-control: no-cache, must-revalidate
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 1094
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/916451471/ 2 KB
1 KB 18ms
17ms Script
text/javascript 2a00:1450:4001:81a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/916451471/?random=1588276969611&cv=9&fst=1588276969611&num=1&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2od4f0&sendb=1&ig=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fonline.citi.com%2FUS%2Flogin.do%3FJFP_TOKEN%3D3RQ3Y559&ref=https%3A%2F%2Fwww.google.ro%2F&tiba=Online%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4

Requested by

Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/conversion_async.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

bb7e425b980d4abf83a191fcb2014b457c29966ce44ec047512a243a39db5961

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://online.citi.com/US/login.do?JFP_TOKEN=3RQ3Y559
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 30 Apr 2020 20:02:49 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status: 200
cache-control: no-cache, must-revalidate
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 1093
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/677332377/ 2 KB
1 KB 17ms
16ms Script
text/javascript 2a00:1450:4001:81a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/677332377/?random=1588276969612&cv=9&fst=1588276969612&num=1&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2od4f0&sendb=1&ig=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fonline.citi.com%2FUS%2Flogin.do%3FJFP_TOKEN%3D3RQ3Y559&ref=https%3A%2F%2Fwww.google.ro%2F&tiba=Online%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4

Requested by

Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/conversion_async.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

0074c83def322940a2623cd1cf2dc07ffb37fd2c8c618ca03743f49d12bba614

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://online.citi.com/US/login.do?JFP_TOKEN=3RQ3Y559
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 30 Apr 2020 20:02:49 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status: 200
cache-control: no-cache, must-revalidate
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 1093
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/819500023/ 2 KB
1 KB 18ms
17ms Script
text/javascript 2a00:1450:4001:81a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/819500023/?random=1588276969613&cv=9&fst=1588276969613&num=1&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2od4f0&sendb=1&ig=1&data=event%3Dconversion&frm=0&url=https%3A%2F%2Fonline.citi.com%2FUS%2Flogin.do%3FJFP_TOKEN%3D3RQ3Y559&ref=https%3A%2F%2Fwww.google.ro%2F&tiba=Online%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4

Requested by

Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/conversion_async.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

6dc82b09be03ccf4678564bfb41b5d035572a59c96a09fc6b62b12ae445b666f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://online.citi.com/US/login.do?JFP_TOKEN=3RQ3Y559
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 30 Apr 2020 20:02:49 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
status: 200
cache-control: no-cache, must-revalidate
content-disposition: attachment; filename="f.txt"
content-type: text/javascript; charset=UTF-8
alt-svc: h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q049="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050="googleads.g.doubleclick.net:443"; ma=2592000,h3-T050=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length: 1093
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

/
www.google.de/pagead/1p-user-list/975701947/
Redirect Chain

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/975701947/?random=1588276969611&cv=9&fst=1588276969611&num=1&fmt=3&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=12...
https://www.google.com/pagead/1p-user-list/975701947/?random=1588276969611&cv=9&fst=1588276800000&num=1&fmt=3&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java...
https://www.google.de/pagead/1p-user-list/975701947/?random=1588276969611&cv=9&fst=1588276800000&num=1&fmt=3&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=...

42 B
110 B

26ms
20ms

Image
image/gif

2a00:1450:4001:825::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/975701947/?random=1588276969611&cv=9&fst=1588276800000&num=1&fmt=3&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2od4f0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fonline.citi.com%2FUS%2Flogin.do%3FJFP_TOKEN%3D3RQ3Y559&ref=https%3A%2F%2Fwww.google.ro%2F&tiba=Online%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&async=1&is_vtc=1&random=1234346003&resp=GooglemKTybQhCsO&ipr=y&ezwbk=AZuM4hAwua1hMoCKcyCla81dgz2cEqvxXg6XipDCM4WoqSKFHZk3vt_tPAhANv7anGqZr5C3cQr9XV25k1pxRiq8LFrw

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:825::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://online.citi.com/US/login.do?JFP_TOKEN=3RQ3Y559
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 30 Apr 2020 20:02:49 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, no-store, must-revalidate
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Thu, 30 Apr 2020 20:02:49 GMT
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 302
content-type: image/gif
location: https://www.google.de/pagead/1p-user-list/975701947/?random=1588276969611&cv=9&fst=1588276800000&num=1&fmt=3&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2od4f0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fonline.citi.com%2FUS%2Flogin.do%3FJFP_TOKEN%3D3RQ3Y559&ref=https%3A%2F%2Fwww.google.ro%2F&tiba=Online%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&async=1&is_vtc=1&random=1234346003&resp=GooglemKTybQhCsO&ipr=y&ezwbk=AZuM4hAwua1hMoCKcyCla81dgz2cEqvxXg6XipDCM4WoqSKFHZk3vt_tPAhANv7anGqZr5C3cQr9XV25k1pxRiq8LFrw
cache-control: no-cache, no-store, must-revalidate
content-security-policy: script-src 'none'; object-src 'none'
timing-allow-origin: *
alt-svc: h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

/
www.google.de/pagead/1p-user-list/819500023/
Redirect Chain

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/819500023/?random=1588276969611&cv=9&fst=1588276969611&num=1&fmt=3&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=12...
https://www.google.com/pagead/1p-user-list/819500023/?random=1588276969611&cv=9&fst=1588276800000&num=1&fmt=3&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java...
https://www.google.de/pagead/1p-user-list/819500023/?random=1588276969611&cv=9&fst=1588276800000&num=1&fmt=3&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=...

42 B
110 B

31ms
22ms

Image
image/gif

2a00:1450:4001:825::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/819500023/?random=1588276969611&cv=9&fst=1588276800000&num=1&fmt=3&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2od4f0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fonline.citi.com%2FUS%2Flogin.do%3FJFP_TOKEN%3D3RQ3Y559&ref=https%3A%2F%2Fwww.google.ro%2F&tiba=Online%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&async=1&is_vtc=1&random=2015971103&resp=GooglemKTybQhCsO&ipr=y&ezwbk=AZuM4hDUj0ro-DnOIK3eKG0NUAn5lbHG1KQMvS-_QPnyACojdy1Zas_PW5uWLNVzw2INH1UQTj1ynPmHxnjJUnZEQJ6k

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:825::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://online.citi.com/US/login.do?JFP_TOKEN=3RQ3Y559
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 30 Apr 2020 20:02:49 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, no-store, must-revalidate
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Thu, 30 Apr 2020 20:02:49 GMT
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 302
content-type: image/gif
location: https://www.google.de/pagead/1p-user-list/819500023/?random=1588276969611&cv=9&fst=1588276800000&num=1&fmt=3&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2od4f0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fonline.citi.com%2FUS%2Flogin.do%3FJFP_TOKEN%3D3RQ3Y559&ref=https%3A%2F%2Fwww.google.ro%2F&tiba=Online%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&async=1&is_vtc=1&random=2015971103&resp=GooglemKTybQhCsO&ipr=y&ezwbk=AZuM4hDUj0ro-DnOIK3eKG0NUAn5lbHG1KQMvS-_QPnyACojdy1Zas_PW5uWLNVzw2INH1UQTj1ynPmHxnjJUnZEQJ6k
cache-control: no-cache, no-store, must-revalidate
content-security-policy: script-src 'none'; object-src 'none'
timing-allow-origin: *
alt-svc: h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

/
www.google.de/pagead/1p-user-list/959299794/
Redirect Chain

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/959299794/?random=1588276969612&cv=9&fst=1588276969612&num=1&fmt=3&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=12...
https://www.google.com/pagead/1p-user-list/959299794/?random=1588276969612&cv=9&fst=1588276800000&num=1&fmt=3&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java...
https://www.google.de/pagead/1p-user-list/959299794/?random=1588276969612&cv=9&fst=1588276800000&num=1&fmt=3&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=...

42 B
110 B

26ms
20ms

Image
image/gif

2a00:1450:4001:825::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/959299794/?random=1588276969612&cv=9&fst=1588276800000&num=1&fmt=3&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2od4f0&sendb=1&data=event%3Dconversion&frm=0&url=https%3A%2F%2Fonline.citi.com%2FUS%2Flogin.do%3FJFP_TOKEN%3D3RQ3Y559&ref=https%3A%2F%2Fwww.google.ro%2F&tiba=Online%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&async=1&is_vtc=1&random=302494715&resp=GooglemKTybQhCsO&ipr=y&ezwbk=AZuM4hABxzntrDvVo5diIdxVqtJDGROsfV4S2dd2PbYF-zYQb34ZDjMM5sqlXcWsiUhfZXoieCg29ReRyjCJhbTxa1Uf

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:825::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://online.citi.com/US/login.do?JFP_TOKEN=3RQ3Y559
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 30 Apr 2020 20:02:49 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, no-store, must-revalidate
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Thu, 30 Apr 2020 20:02:49 GMT
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 302
content-type: image/gif
location: https://www.google.de/pagead/1p-user-list/959299794/?random=1588276969612&cv=9&fst=1588276800000&num=1&fmt=3&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2od4f0&sendb=1&data=event%3Dconversion&frm=0&url=https%3A%2F%2Fonline.citi.com%2FUS%2Flogin.do%3FJFP_TOKEN%3D3RQ3Y559&ref=https%3A%2F%2Fwww.google.ro%2F&tiba=Online%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&async=1&is_vtc=1&random=302494715&resp=GooglemKTybQhCsO&ipr=y&ezwbk=AZuM4hABxzntrDvVo5diIdxVqtJDGROsfV4S2dd2PbYF-zYQb34ZDjMM5sqlXcWsiUhfZXoieCg29ReRyjCJhbTxa1Uf
cache-control: no-cache, no-store, must-revalidate
content-security-policy: script-src 'none'; object-src 'none'
timing-allow-origin: *
alt-svc: h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

/
www.google.de/pagead/1p-user-list/916451471/
Redirect Chain

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/916451471/?random=1588276969612&cv=9&fst=1588276969612&num=1&fmt=3&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=12...
https://www.google.com/pagead/1p-user-list/916451471/?random=1588276969612&cv=9&fst=1588276800000&num=1&fmt=3&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java...
https://www.google.de/pagead/1p-user-list/916451471/?random=1588276969612&cv=9&fst=1588276800000&num=1&fmt=3&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=...

42 B
110 B

28ms
22ms

Image
image/gif

2a00:1450:4001:825::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/916451471/?random=1588276969612&cv=9&fst=1588276800000&num=1&fmt=3&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2od4f0&sendb=1&data=event%3Dconversion&frm=0&url=https%3A%2F%2Fonline.citi.com%2FUS%2Flogin.do%3FJFP_TOKEN%3D3RQ3Y559&ref=https%3A%2F%2Fwww.google.ro%2F&tiba=Online%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&async=1&is_vtc=1&random=3583965345&resp=GooglemKTybQhCsO&ipr=y&ezwbk=AZuM4hAvPnvKsYTXwH-O-ShRWKuH_QeSt_rXq3Q2aIo95hqbRly5aEvE3AL9QvBjQwxPue4UWiEWxM6tPyCDxEjLIJZo

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:825::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://online.citi.com/US/login.do?JFP_TOKEN=3RQ3Y559
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 30 Apr 2020 20:02:49 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, no-store, must-revalidate
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Thu, 30 Apr 2020 20:02:49 GMT
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 302
content-type: image/gif
location: https://www.google.de/pagead/1p-user-list/916451471/?random=1588276969612&cv=9&fst=1588276800000&num=1&fmt=3&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2od4f0&sendb=1&data=event%3Dconversion&frm=0&url=https%3A%2F%2Fonline.citi.com%2FUS%2Flogin.do%3FJFP_TOKEN%3D3RQ3Y559&ref=https%3A%2F%2Fwww.google.ro%2F&tiba=Online%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&async=1&is_vtc=1&random=3583965345&resp=GooglemKTybQhCsO&ipr=y&ezwbk=AZuM4hAvPnvKsYTXwH-O-ShRWKuH_QeSt_rXq3Q2aIo95hqbRly5aEvE3AL9QvBjQwxPue4UWiEWxM6tPyCDxEjLIJZo
cache-control: no-cache, no-store, must-revalidate
content-security-policy: script-src 'none'; object-src 'none'
timing-allow-origin: *
alt-svc: h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

/
www.google.de/pagead/1p-user-list/975701947/
Redirect Chain

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/975701947/?random=1588276969612&cv=9&fst=1588276969612&num=1&fmt=3&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=12...
https://www.google.com/pagead/1p-user-list/975701947/?random=1588276969612&cv=9&fst=1588276800000&num=1&fmt=3&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java...
https://www.google.de/pagead/1p-user-list/975701947/?random=1588276969612&cv=9&fst=1588276800000&num=1&fmt=3&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=...

42 B
110 B

19ms
19ms

Image
image/gif

2a00:1450:4001:825::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/975701947/?random=1588276969612&cv=9&fst=1588276800000&num=1&fmt=3&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2od4f0&sendb=1&data=event%3Dconversion&frm=0&url=https%3A%2F%2Fonline.citi.com%2FUS%2Flogin.do%3FJFP_TOKEN%3D3RQ3Y559&ref=https%3A%2F%2Fwww.google.ro%2F&tiba=Online%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&async=1&is_vtc=1&random=57541276&resp=GooglemKTybQhCsO&ipr=y&ezwbk=AZuM4hCbe8-ZEADs9TidepI4XV5T8XbI2eyR1wZVcZybsNhSWdTP4nuW935x1T-h9OynBWUMcoQLjLc8FKI02HXXn_xZ

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:825::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://online.citi.com/US/login.do?JFP_TOKEN=3RQ3Y559
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 30 Apr 2020 20:02:50 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, no-store, must-revalidate
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Thu, 30 Apr 2020 20:02:49 GMT
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 302
content-type: image/gif
location: https://www.google.de/pagead/1p-user-list/975701947/?random=1588276969612&cv=9&fst=1588276800000&num=1&fmt=3&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2od4f0&sendb=1&data=event%3Dconversion&frm=0&url=https%3A%2F%2Fonline.citi.com%2FUS%2Flogin.do%3FJFP_TOKEN%3D3RQ3Y559&ref=https%3A%2F%2Fwww.google.ro%2F&tiba=Online%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&async=1&is_vtc=1&random=57541276&resp=GooglemKTybQhCsO&ipr=y&ezwbk=AZuM4hCbe8-ZEADs9TidepI4XV5T8XbI2eyR1wZVcZybsNhSWdTP4nuW935x1T-h9OynBWUMcoQLjLc8FKI02HXXn_xZ
cache-control: no-cache, no-store, must-revalidate
content-security-policy: script-src 'none'; object-src 'none'
timing-allow-origin: *
alt-svc: h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

/
www.google.de/pagead/1p-user-list/677332377/
Redirect Chain

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/677332377/?random=1588276969613&cv=9&fst=1588276969613&num=1&fmt=3&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=12...
https://www.google.com/pagead/1p-user-list/677332377/?random=1588276969613&cv=9&fst=1588276800000&num=1&fmt=3&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java...
https://www.google.de/pagead/1p-user-list/677332377/?random=1588276969613&cv=9&fst=1588276800000&num=1&fmt=3&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=...

42 B
110 B

28ms
22ms

Image
image/gif

2a00:1450:4001:825::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/677332377/?random=1588276969613&cv=9&fst=1588276800000&num=1&fmt=3&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2od4f0&sendb=1&data=event%3Dconversion&frm=0&url=https%3A%2F%2Fonline.citi.com%2FUS%2Flogin.do%3FJFP_TOKEN%3D3RQ3Y559&ref=https%3A%2F%2Fwww.google.ro%2F&tiba=Online%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&async=1&is_vtc=1&random=3960329207&resp=GooglemKTybQhCsO&ipr=y&ezwbk=AZuM4hBJ75Ms3oyfIYTsLhVzEPtqVyxjUUf7guIGK8dW0VWcNGzzSsGJpa9TVQMYLYmy9_h7yNFF4M7rGEafC14CjiOa

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:825::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://online.citi.com/US/login.do?JFP_TOKEN=3RQ3Y559
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 30 Apr 2020 20:02:49 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, no-store, must-revalidate
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Thu, 30 Apr 2020 20:02:49 GMT
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 302
content-type: image/gif
location: https://www.google.de/pagead/1p-user-list/677332377/?random=1588276969613&cv=9&fst=1588276800000&num=1&fmt=3&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2od4f0&sendb=1&data=event%3Dconversion&frm=0&url=https%3A%2F%2Fonline.citi.com%2FUS%2Flogin.do%3FJFP_TOKEN%3D3RQ3Y559&ref=https%3A%2F%2Fwww.google.ro%2F&tiba=Online%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&async=1&is_vtc=1&random=3960329207&resp=GooglemKTybQhCsO&ipr=y&ezwbk=AZuM4hBJ75Ms3oyfIYTsLhVzEPtqVyxjUUf7guIGK8dW0VWcNGzzSsGJpa9TVQMYLYmy9_h7yNFF4M7rGEafC14CjiOa
cache-control: no-cache, no-store, must-revalidate
content-security-policy: script-src 'none'; object-src 'none'
timing-allow-origin: *
alt-svc: h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 204 0
bat.bing.com/action/ 0
93 B 31ms
30ms Image
text/plain 2620:1ec:c11::200
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://bat.bing.com/action/0?ti=16003743&Ver=2&mid=3669195f-005f-3095-d1ae-3e892f215fcb&sid=82b937f0-6744-4072-c2d1-c1f1318870fe&pi=0&lg=en-US&sw=1600&sh=1200&sc=24&tl=Online%20Banking,%20Mortgages,%20Personal%20Loans,%20Investing%20%7C%20Citi.com&kw=banking,%20citi,%20financial%20services,%20checking%20account,%20savings%20account,%20credit%20cards&p=https%3A%2F%2Fonline.citi.com%2FUS%2Flogin.do%3FJFP_TOKEN%3D3RQ3Y559&r=https%3A%2F%2Fwww.google.ro%2F&lt=4435&evt=pageLoad&msclkid=N&sv=1&rn=646283
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://online.citi.com/US/login.do?JFP_TOKEN=3RQ3Y559
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

status: 204
pragma: no-cache
date: Thu, 30 Apr 2020 20:02:49 GMT
cache-control: no-cache, must-revalidate
x-msedge-ref: Ref A: F7DEB14780F5480FADCA26A6BFD56FA0 Ref B: FRAEDGE0709 Ref C: 2020-04-30T20:02:49Z
access-control-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 204 0
bat.bing.com/action/ 0
93 B 31ms
30ms Image
text/plain 2620:1ec:c11::200
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://bat.bing.com/action/0?ti=16003743&Ver=2&mid=3669195f-005f-3095-d1ae-3e892f215fcb&sid=82b937f0-6744-4072-c2d1-c1f1318870fe&ec=Non%20Cookied%20Username%20Password%20&ec2=Non%20Cookied%20Username%20Password%20&evt=custom&msclkid=N&rn=935458
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://online.citi.com/US/login.do?JFP_TOKEN=3RQ3Y559
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

status: 204
pragma: no-cache
date: Thu, 30 Apr 2020 20:02:49 GMT
cache-control: no-cache, must-revalidate
x-msedge-ref: Ref A: D86121CA07CA4D46BC326D66534F4330 Ref B: FRAEDGE0709 Ref C: 2020-04-30T20:02:49Z
access-control-allow-origin: *
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 cool-2.1.15.min.js Show response
nebula-cdn.kampyle.com/resources/onsite/js/ 14 KB
5 KB 32ms
8ms Script
application/javascript 151.101.113.175
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://nebula-cdn.kampyle.com/resources/onsite/js/cool-2.1.15.min.js
Requested by: Host: resources.digital-cloud-citi.medallia.com
URL: https://resources.digital-cloud-citi.medallia.com/wdcusciti/50/onsite/generic1588266760035.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.113.175 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 3e72de5de67d6d80b65a114af684eaf880c53c250155a663cb17d677ff064bc1

Request headers

Referer: https://online.citi.com/US/login.do?JFP_TOKEN=3RQ3Y559
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 30 Apr 2020 20:02:49 GMT
content-encoding: gzip
age: 0
accept-ranges: bytes
x-cache: MISS, HIT
status: 200
x-amz-request-id: 9951A5F978E3F1C8
x-amz-id-2: XqVaKHOURU7MwBcpCCMUctvOEFoT/DWescBxrAjf4sZMYSxmxYYg9yZGPXef3JTIqggebmjHsaM=
x-served-by: cache-iad2139-IAD, cache-hhn4026-HHN
access-control-allow-origin: *
last-modified: Tue, 17 Mar 2020 11:10:17 GMT
server: AmazonS3
x-timer: S1588276970.685709,VS0,VE0
etag: "80dd5e3be5152c5c72d552c6a26ef6ff"
vary: Accept-Encoding
content-type: application/javascript
via: 1.1 varnish, 1.1 varnish
cache-control: max-age=31536000
content-length: 5197
x-cache-hits: 0, 252802

GET
H2 200 copy_copy_1551286869362_Feedback.png
resources.digital-cloud-citi.medallia.com/wdcusciti/50/resources/image/ 2 KB
2 KB 10ms
9ms Image
image/png 151.101.114.133
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://resources.digital-cloud-citi.medallia.com/wdcusciti/50/resources/image/copy_copy_1551286869362_Feedback.png
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.114.133 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 506575b752d10714465811aec4dd67a7bfb471fcbc2e9619c1faad68c110759e

Request headers

Referer: https://online.citi.com/US/login.do?JFP_TOKEN=3RQ3Y559
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-amz-version-id: c4QPIOt7jeoG0ZVKM.gnL_o4mPR3HO8Y
content-encoding: gzip
etag: "8515c838c29a9151befa4f4350e41381"
age: 78
via: 1.1 varnish
x-cache: HIT
status: 200
content-length: 2016
x-amz-id-2: xATAmP40qP4MuW1TgTOuB6Vb3TPMs/E3E250eLL8b6qfA6GUOZEQEMTofE254yZ5RvECv7M6Euo=
x-served-by: cache-hhn4042-HHN
last-modified: Thu, 14 Nov 2019 20:30:23 GMT
server: AmazonS3
x-timer: S1588276970.677557,VS0,VE1
date: Thu, 30 Apr 2020 20:02:49 GMT
vary: Accept-Encoding
x-amz-request-id: AFE96E1FC05801D7
access-control-allow-origin: *
cache-control: max-age=0,must-revalidate
accept-ranges: bytes
content-type: image/png
x-cache-hits: 1

GET
H2 200 up
insight.adsrvr.org/track/ Frame B274 0
0 101ms
35ms Document
text/html 46.51.196.250
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://insight.adsrvr.org/track/up?adv=1jw5cvl&ref=https%3A%2F%2Fonline.citi.com%2FUS%2Flogin.do%3FJFP_TOKEN%3D3RQ3Y559&upid=t1sl5ty&upv=1.1.0&orderid={orderid}&v={v}&vf={vf}&td1=jUSCBOL_Loginpage_Uncookied&td2=undefined&td3=undefined&td4=Non%20Cookied%20Username%20Password%20&td5=https://online.citi.com/US/login.do?JFP_TOKEN=3RQ3Y559&td6={td6}&td7={td7}&td8={td8}&td9={td9}&td10={td10}
Requested by: Host: js.adsrvr.org
URL: https://js.adsrvr.org/up_loader.1.1.0.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 46.51.196.250 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-46-51-196-250.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash

Request headers

:method: GET
:authority: insight.adsrvr.org
:scheme: https
:path: /track/up?adv=1jw5cvl&ref=https%3A%2F%2Fonline.citi.com%2FUS%2Flogin.do%3FJFP_TOKEN%3D3RQ3Y559&upid=t1sl5ty&upv=1.1.0&orderid={orderid}&v={v}&vf={vf}&td1=jUSCBOL_Loginpage_Uncookied&td2=undefined&td3=undefined&td4=Non%20Cookied%20Username%20Password%20&td5=https://online.citi.com/US/login.do?JFP_TOKEN=3RQ3Y559&td6={td6}&td7={td7}&td8={td8}&td9={td9}&td10={td10}
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://online.citi.com/US/login.do?JFP_TOKEN=3RQ3Y559
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: https://online.citi.com/US/login.do?JFP_TOKEN=3RQ3Y559

Response headers

status: 200
date: Thu, 30 Apr 2020 20:02:49 GMT
content-type: text/html
cache-control: private,no-cache, must-revalidate
pragma: no-cache
x-aspnet-version: 4.0.30319
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"

GET
H/1.1 200
OK check.js;CIS3SID=49B19B296A24D47372FE5748E722A335 Show response
content22.online.citi.com/fp/ Frame D798 172 KB
44 KB 37ms
36ms Script
text/javascript 91.235.134.21
THM

General

Check archive.org

Show headers Download Go to

Full URL

https://content22.online.citi.com/fp/check.js;CIS3SID=49B19B296A24D47372FE5748E722A335?org_id=89oebq5k&session_id=870e3f8c1f2b672c1fbc2ee2a3dabc92778d9976d890f49f675074a30b0aca59&nonce=b6087d1243c030c0&pageid=1&jb=3b352626687167773d4e6b6c777a2468736d3f4e6b6e757a266873623f4160706d6f6d253a383536

Requested by

Host: content22.online.citi.com
URL: https://content22.online.citi.com/fp/tags.js?org_id=89oebq5k&session_id=870e3f8c1f2b672c1fbc2ee2a3dabc92778d9976d890f49f675074a30b0aca59&allow_reprofile=1

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

91.235.134.21 , Netherlands, ASN30286 (THM, US),

Reverse DNS

Software

Apache /

Resource Hash

5f69a6ff3d506bf20768ccc7d7343b38fe81f09a6c730b2c6d2fe9f93f4b829d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://online.citi.com/US/login.do?JFP_TOKEN=3RQ3Y559
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 30 Apr 2020 20:02:49 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Server: Apache
Strict-Transport-Security: max-age=31536000
Content-Type: text/javascript;charset=UTF-8
Cache-Control: no-cache, no-store, must-revalidate
Transfer-Encoding: chunked
tmx-nonce: b6087d1243c030c0
Connection: Keep-Alive, Keep-Alive
Vary: Accept-Encoding
X-XSS-Protection: 1; mode=block
Keep-Alive: timeout=2, max=99
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H/1.1 200
OK clear.png
content22.online.citi.com/fp/ Frame D798 81 B
475 B 62ms
19ms Image
image/png 91.235.134.21
THM

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://content22.online.citi.com/fp/clear.png?org_id=89oebq5k&session_id=870e3f8c1f2b672c1fbc2ee2a3dabc92778d9976d890f49f675074a30b0aca59&nonce=b6087d1243c030c0&pageid=1&w=5e39621e1a7b254e&ck=0&m=1

Requested by

Host: content22.online.citi.com
URL: https://content22.online.citi.com/fp/tags.js?org_id=89oebq5k&session_id=870e3f8c1f2b672c1fbc2ee2a3dabc92778d9976d890f49f675074a30b0aca59&allow_reprofile=1

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

91.235.134.21 , Netherlands, ASN30286 (THM, US),

Reverse DNS

Software

Apache /

Resource Hash

95518cbec0d55a574a9c8ef72a2a7d62ac0d40a4de5dfe67a76a7d214dc8b743

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://online.citi.com/US/login.do?JFP_TOKEN=3RQ3Y559
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 30 Apr 2020 20:02:49 GMT
X-Content-Type-Options: nosniff
Server: Apache
Strict-Transport-Security: max-age=31536000
Content-Type: image/png
Cache-Control: no-cache, no-store, must-revalidate
Connection: Keep-Alive
Keep-Alive: timeout=2, max=100
Content-Length: 81
X-XSS-Protection: 1; mode=block
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H/1.1 200
OK clear.png
content22.online.citi.com/fp/ Frame D798 81 B
475 B 63ms
24ms Image
image/png 91.235.134.21
THM

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://content22.online.citi.com/fp/clear.png?org_id=89oebq5k&session_id=870e3f8c1f2b672c1fbc2ee2a3dabc92778d9976d890f49f675074a30b0aca59&nonce=b6087d1243c030c0&pageid=1&ck=0&m=2

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

91.235.134.21 , Netherlands, ASN30286 (THM, US),

Reverse DNS

Software

Apache /

Resource Hash

95518cbec0d55a574a9c8ef72a2a7d62ac0d40a4de5dfe67a76a7d214dc8b743

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://online.citi.com/US/login.do?JFP_TOKEN=3RQ3Y559
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 30 Apr 2020 20:02:49 GMT
X-Content-Type-Options: nosniff
Server: Apache
Strict-Transport-Security: max-age=31536000
Content-Type: image/png
Cache-Control: no-cache, no-store, must-revalidate
Connection: Keep-Alive
Keep-Alive: timeout=2, max=100
Content-Length: 81
X-XSS-Protection: 1; mode=block
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2 200 /
www.google.com/pagead/1p-user-list/677332377/ 42 B
282 B 30ms
30ms Image
image/gif 2a00:1450:4001:81f::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/677332377/?random=1588276969612&cv=9&fst=1588276800000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2od4f0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fonline.citi.com%2FUS%2Flogin.do%3FJFP_TOKEN%3D3RQ3Y559&ref=https%3A%2F%2Fwww.google.ro%2F&tiba=Online%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&async=1&fmt=3&is_vtc=1&random=1184315556&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81f::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://online.citi.com/US/login.do?JFP_TOKEN=3RQ3Y559
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 30 Apr 2020 20:02:49 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, no-store, must-revalidate
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.de/pagead/1p-user-list/677332377/ 42 B
110 B 25ms
19ms Image
image/gif 2a00:1450:4001:825::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/677332377/?random=1588276969612&cv=9&fst=1588276800000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2od4f0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fonline.citi.com%2FUS%2Flogin.do%3FJFP_TOKEN%3D3RQ3Y559&ref=https%3A%2F%2Fwww.google.ro%2F&tiba=Online%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&async=1&fmt=3&is_vtc=1&random=1184315556&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:825::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://online.citi.com/US/login.do?JFP_TOKEN=3RQ3Y559
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 30 Apr 2020 20:02:49 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, no-store, must-revalidate
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.com/pagead/1p-user-list/916451471/ 42 B
110 B 35ms
33ms Image
image/gif 2a00:1450:4001:81f::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/916451471/?random=1588276969611&cv=9&fst=1588276800000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2od4f0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fonline.citi.com%2FUS%2Flogin.do%3FJFP_TOKEN%3D3RQ3Y559&ref=https%3A%2F%2Fwww.google.ro%2F&tiba=Online%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&async=1&fmt=3&is_vtc=1&random=1625810501&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81f::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://online.citi.com/US/login.do?JFP_TOKEN=3RQ3Y559
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 30 Apr 2020 20:02:49 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, no-store, must-revalidate
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.de/pagead/1p-user-list/916451471/ 42 B
110 B 20ms
19ms Image
image/gif 2a00:1450:4001:825::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/916451471/?random=1588276969611&cv=9&fst=1588276800000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2od4f0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fonline.citi.com%2FUS%2Flogin.do%3FJFP_TOKEN%3D3RQ3Y559&ref=https%3A%2F%2Fwww.google.ro%2F&tiba=Online%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&async=1&fmt=3&is_vtc=1&random=1625810501&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:825::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://online.citi.com/US/login.do?JFP_TOKEN=3RQ3Y559
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 30 Apr 2020 20:02:49 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, no-store, must-revalidate
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.com/pagead/1p-user-list/959299794/ 42 B
110 B 35ms
35ms Image
image/gif 2a00:1450:4001:81f::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/959299794/?random=1588276969608&cv=9&fst=1588276800000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2od4f0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fonline.citi.com%2FUS%2Flogin.do%3FJFP_TOKEN%3D3RQ3Y559&ref=https%3A%2F%2Fwww.google.ro%2F&tiba=Online%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&async=1&fmt=3&is_vtc=1&random=468687767&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81f::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://online.citi.com/US/login.do?JFP_TOKEN=3RQ3Y559
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 30 Apr 2020 20:02:49 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, no-store, must-revalidate
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.de/pagead/1p-user-list/959299794/ 42 B
110 B 20ms
18ms Image
image/gif 2a00:1450:4001:825::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/959299794/?random=1588276969608&cv=9&fst=1588276800000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2od4f0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fonline.citi.com%2FUS%2Flogin.do%3FJFP_TOKEN%3D3RQ3Y559&ref=https%3A%2F%2Fwww.google.ro%2F&tiba=Online%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&async=1&fmt=3&is_vtc=1&random=468687767&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:825::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://online.citi.com/US/login.do?JFP_TOKEN=3RQ3Y559
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 30 Apr 2020 20:02:49 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, no-store, must-revalidate
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.com/pagead/1p-user-list/819500023/ 42 B
110 B 32ms
30ms Image
image/gif 2a00:1450:4001:81f::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/819500023/?random=1588276969613&cv=9&fst=1588276800000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2od4f0&sendb=1&data=event%3Dconversion&frm=0&url=https%3A%2F%2Fonline.citi.com%2FUS%2Flogin.do%3FJFP_TOKEN%3D3RQ3Y559&ref=https%3A%2F%2Fwww.google.ro%2F&tiba=Online%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&async=1&fmt=3&is_vtc=1&random=4166659234&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81f::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://online.citi.com/US/login.do?JFP_TOKEN=3RQ3Y559
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 30 Apr 2020 20:02:49 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, no-store, must-revalidate
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.de/pagead/1p-user-list/819500023/ 42 B
110 B 21ms
19ms Image
image/gif 2a00:1450:4001:825::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/819500023/?random=1588276969613&cv=9&fst=1588276800000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&gtm=2od4f0&sendb=1&data=event%3Dconversion&frm=0&url=https%3A%2F%2Fonline.citi.com%2FUS%2Flogin.do%3FJFP_TOKEN%3D3RQ3Y559&ref=https%3A%2F%2Fwww.google.ro%2F&tiba=Online%20Banking%2C%20Mortgages%2C%20Personal%20Loans%2C%20Investing%20%7C%20Citi.com&async=1&fmt=3&is_vtc=1&random=4166659234&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:825::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://online.citi.com/US/login.do?JFP_TOKEN=3RQ3Y559
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 30 Apr 2020 20:02:49 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
status: 200
cache-control: no-cache, no-store, must-revalidate
content-security-policy: script-src 'none'; object-src 'none'
content-type: image/gif
alt-svc: h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,h3-T050=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 __cool.gif
udc-neb.kampyle.com/egw/5/qceuv8449dzg58ptt1bhda9g8ue19c7s/track/ 0
321 B 121ms
99ms Image
image/gif 35.241.45.82
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://udc-neb.kampyle.com/egw/5/qceuv8449dzg58ptt1bhda9g8ue19c7s/track/__cool.gif?data=eyJldmVudHMiOiBbCiAgICB7InNlc3Npb25fc2NyZWVuX3NpemUiOiAiMTYwMHgxMjAwIiwic2Vzc2lvbl9kdWEiOiAiTW96aWxsYS81LjAgKE1hY2ludG9zaDsgSW50ZWwgTWFjIE9TIFggMTBfMTRfNSkgQXBwbGVXZWJLaXQvNTM3LjM2IChLSFRNTCwgbGlrZSBHZWNrbykgQ2hyb21lLzc0LjAuMzcyOS4xNjkgU2FmYXJpLzUzNy4zNiIsInNlc3Npb25fcGxhdGZvcm0iOiAiTGludXggeDg2XzY0IiwicmVmZXJyaW5nX3VybCI6ICJodHRwczovL3d3dy5nb29nbGUucm8vIiwicmVmZXJyaW5nX2RvbWFpbiI6ICJ3d3cuZ29vZ2xlLnJvIiwidHJhY2tlcl90eXBlIjogImphdmFzY3JpcHQiLCJ0cmFja2VyX3ZlcnNpb24iOiAiMi4xLjE1IiwiZXZlbnRfbmFtZSI6ICJuZWJ1bGFfcGFnZV92aWV3IiwiZXZlbnRfdGltZXN0YW1wX2Vwb2NoIjogIjE1ODgyNzY5Njk3NTciLCJldmVudF90aW1lem9uZV9vZmZzZXQiOiAyLCJ1c2VyX2lkIjogIjE3MWNjYWY0MTFhMjU0LTA1ODBkZjM5M2Y0NTZjLTM3NjQ3ZTAzLTFkNGMwMC0xNzFjY2FmNDExYjk5OSIsImVudmlyb21lbnQiOiAiZGlnaXRhbC1jbG91ZC11cy1jaXRpIiwiYWNjb3VudElkIjogNDksInVybCI6ICJodHRwczovL29ubGluZS5jaXRpLmNvbS9VUy9sb2dpbi5kbz9KRlBfVE9LRU49M1JRM1k1NTkiLCJ3ZWJzaXRlSWQiOiA1MCwiZmVlZGJhY2tfdXVpZCI6IG51bGwsImZvcm1JZCI6IG51bGwsImZvcm1UcmlnZ2VyVHlwZSI6IG51bGwsImthbXB5bGVfZGF0YSI6IHsiTEFTVF9JTlZJVEFUSU9OX1ZJRVciOiAiIiwiREVDTElORURfREFURSI6ICIiLCJrYW1weWxlSW52aXRlUHJlc2VudGVkIjogIiIsImthbXB5bGVfdXNlcmlkIjogIjlmNGUtYWQ3YS0zZWEzLTY5ZGUtNTFhOC1iMWUwLWNlNjQtNWY5MyIsImthbXB5bGVVc2VyU2Vzc2lvbiI6ICIxNTg4Mjc2OTY5NjU4Iiwia2FtcHlsZVVzZXJQZXJjZW50aWxlIjogIiIsIlNVQk1JVFRFRF9EQVRFIjogIiJ9LCJjb29raWVfc2l6ZSI6IDMxNDIsImthbXB5bGVfdmVyc2lvbiI6ICIwLjAuMC4wIiwiaGlzdG9yeV9sZW5ndGgiOiAyLCJldmVudF9sb2NhbF90aW1lc3RhbXAiOiAxNTg4Mjc2OTY5NjYyLCJwb3NpdGlvbiI6IG51bGwsImlzVXNlcklkZW50aWZpZWQiOiBmYWxzZX0KXX0=
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.241.45.82 , Ascension Island, ASN15169 (GOOGLE, US),
Reverse DNS: 82.45.241.35.bc.googleusercontent.com
Software: Jetty(9.2.11.v20150529) /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://online.citi.com/US/login.do?JFP_TOKEN=3RQ3Y559
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-me: prod-instance-gatewayservice-green-3kj7
date: Thu, 30 Apr 2020 20:02:49 GMT
via: 1.1 google
server: Jetty(9.2.11.v20150529)
access-control-allow-headers: X-Requested-With, Origin, Content-Type, Accept
status: 200
access-control-max-age: 1800
access-control-allow-methods: GET, POST, PUT, DELETE
content-type: image/gif; charset=UTF-8
access-control-allow-origin: *
access-control-allow-credentials: true
alt-svc: clear
content-length: 0
x-application-context: application:9090

GET
H/1.1 200
OK clear.png Show response
content22.online.citi.com/fp/ Frame D798 81 B
531 B 53ms
16ms XHR
image/png 91.235.134.21
THM

General

Check archive.org

Show headers Download Go to

Full URL

https://content22.online.citi.com/fp/clear.png

Requested by

Host: content22.online.citi.com
URL: https://content22.online.citi.com/fp/check.js;CIS3SID=49B19B296A24D47372FE5748E722A335?org_id=89oebq5k&session_id=870e3f8c1f2b672c1fbc2ee2a3dabc92778d9976d890f49f675074a30b0aca59&nonce=b6087d1243c030c0&pageid=1&jb=3b352626687167773d4e6b6c777a2468736d3f4e6b6e757a266873623f4160706d6f6d253a383536

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

91.235.134.21 , Netherlands, ASN30286 (THM, US),

Reverse DNS

Software

Apache /

Resource Hash

95518cbec0d55a574a9c8ef72a2a7d62ac0d40a4de5dfe67a76a7d214dc8b743

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Accept: */*, 89oebq5k/b6087d1243c030c0870e3f8c1f2b672c1fbc2ee2a3dabc92778d9976d890f49f675074a30b0aca59
Referer: https://online.citi.com/US/login.do?JFP_TOKEN=3RQ3Y559
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Thu, 30 Apr 2020 20:02:49 GMT
Last-Modified: Thu, 30 Apr 2020 20:02:49 GMT
Server: Apache
Etag: 06024832f6c94714a0b1cba187936e57
Strict-Transport-Security: max-age=31536000
Content-Type: image/png
Access-Control-Allow-Origin: https://online.citi.com
Cache-Control: private, must-revalidate, max-age=0
Connection: Keep-Alive
Keep-Alive: timeout=2, max=100
Content-Length: 81
Expires: Tue, 29 Apr 2025 20:02:49 GMT

GET
H/1.1 200
OK ls_fp.html;CIS3SID=49B19B296A24D47372FE5748E722A335 Show response
content22.online.citi.com/fp/ Frame 8364 46 KB
12 KB 65ms
64ms Document
text/html 91.235.134.21
THM

General

Check archive.org

Show headers Download Go to

Full URL

https://content22.online.citi.com/fp/ls_fp.html;CIS3SID=49B19B296A24D47372FE5748E722A335?org_id=89oebq5k&session_id=870e3f8c1f2b672c1fbc2ee2a3dabc92778d9976d890f49f675074a30b0aca59&nonce=b6087d1243c030c0&pageid=1

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

91.235.134.21 , Netherlands, ASN30286 (THM, US),

Reverse DNS

Software

Apache /

Resource Hash

ef27c333057941304d9ed95281e6e2271ee97eb104b2a1b62c22c62a5e2c175f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Host: content22.online.citi.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: same-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Referer: https://online.citi.com/US/login.do?JFP_TOKEN=3RQ3Y559
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Cookie: TLTSID=599b119873af5ec508362e219f21ef6f7ba846bcf38d806d9d39e6ee2a86fc70; CUUID=fe255924-87aa-430f-a458-fc324e379fc3; CITI_SITE=gtdc; AKMTLTSID=4C2CDD8C02CD596E71003DD09CC0F73F; mbox=check#true#1588277027|session#2d9122308456434f9c52e409fb4c44d4#1588278827|PC#2d9122308456434f9c52e409fb4c44d4.37_0#1589486567; bcsid=1125020B34030B0ABBAFB4DD065E794; bmuid=1588276966447-D269394D-D0C9-4320-BD2F-278D60D5ACC8; cdContextId=2; AMCVS_61834D9B5228A7430A490D45%40AdobeOrg=1; experience=Uncookied; _cls_v=0018432a-747b-4d2c-a6e7-8497f3095ef3; _cls_s=8843ce37-2d96-4c75-92c5-9b48b27d5e75:0; _gcl_au=1.1.1404517603.1588276967; s_vi=[CS]v1|2F5597730515D332-40000864E2F62AB0[CE]; s_ecid=MCMID%7C87952983065949927252082562565465972909; AMCV_61834D9B5228A7430A490D45%40AdobeOrg=-330454231%7CMCIDTS%7C18383%7CMCMID%7C87952983065949927252082562565465972909%7CMCAAMLH-1588881766%7C6%7CMCAAMB-1588881766%7CRKhpRz8krg2tLO6pguXWp5olkAcUniQYPHaMWWgdJ3xzPWQmdj0y%7CMCOPTOUT-1588284166s%7CNONE%7CMCSYNCSOP%7C411-18390%7CMCAID%7C2F5597730515D332-40000864E2F62AB0%7CvVersion%7C3.1.2; BKDMP=; popSplit=0; cdSNum=1588276966901-sjn0000602-c673f01e-64a3-418f-90c2-1e0a6649fbad; AOSDMPRF=aos_offers=OMPC--142--X-c-248-X----|OMPC--202--X-c-366-X----|OMPC--408--X-c-299-X----|OMPC--520--X-c-442-X----|Bank--A201---c--B----|Bank--A301---c--B----|OMPC--AAF--X-c-650-X----|Bank--B100---c--B----|Bank--C101---c--B----|Bank--C129---c--B----|Bank--C133---c--B----|Bank--C201---c--B----|Bank--C301---c--B----|Bank--C501---c--B----|Bank--C601---c--B----|Bank--D184---c--B----|Bank--H147---c--B----|Bank--H148---c--B----|Bank--I250---c--B----|Bank--I500---c--B----|Bank--L018---c--B----|Bank--M185---c--B----|OMPC--MPC--X-c-353-X----|Bank--NKH---c--B----|Bank--PAL---c--B----|OMPC--PRQ--X-c-301-X----|Bank--QLE---c--B----|Bank--S101---c--B----|Bank--S201---c--B----|Bank--S301---c--B----|Bank--S700---c--B----|Bank--S723---c--B----|Bank--V100---c--B----|Bank--V150---c--B----|Bank--V200---c--B----|Bank--V350---c--B----&aos_tx=e07d1eba61f7475190420f5a1c1098eb&aos_axid=e07d1eba61f7475190420f5a1c1098eb prod 2020-04-30-15 8588&aos_ex=Uncookied&aos_cat=C202_00&aos_ep=PRD&aos_c_cbcat=B178_01&aos_cbcat=B178_01&aos_mem=OBTA&aos_responseCode=I000&aos_httpStatus=200; RFXPUID=SY-00GflAAW61nZc=583; tmx_sessionid=870e3f8c1f2b672c1fbc2ee2a3dabc92778d9976d890f49f675074a30b0aca59; tmx_digitalApptype=PC_BROWSER; s_nr=1588276969533-New; gpv_pn=public%7Cmarketing%7Chome%7Cciti; s_cc=true; thx_guid=52858c93bc884116968607286a169826; _uetsid=_uet82b937f0-6744-4072-c2d1-c1f1318870fe; cd_user_id=171ccaf411a254-0580df393f456c-37647e03-1d4c00-171ccaf411b999
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: https://online.citi.com/US/login.do?JFP_TOKEN=3RQ3Y559

Response headers

Date: Thu, 30 Apr 2020 20:02:49 GMT
Server: Apache
Strict-Transport-Security: max-age=31536000
Cache-Control: no-cache, no-store, must-revalidate
Pragma: no-cache
Connection: Keep-Alive, Keep-Alive
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Content-Type: text/html;charset=UTF-8
Vary: Accept-Encoding
Content-Encoding: gzip
Keep-Alive: timeout=2, max=99
Transfer-Encoding: chunked

GET
H/1.1 200
OK sid_fp.html;CIS3SID=49B19B296A24D47372FE5748E722A335
h.online-metrix.net/fp/ Frame C91E 0
0 62ms
21ms Document
text/html 91.235.132.130
THM

General

Check archive.org

Show headers Download Go to

Full URL

https://h.online-metrix.net/fp/sid_fp.html;CIS3SID=49B19B296A24D47372FE5748E722A335?org_id=89oebq5k&session_id=870e3f8c1f2b672c1fbc2ee2a3dabc92778d9976d890f49f675074a30b0aca59&nonce=b6087d1243c030c0&pageid=1

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

91.235.132.130 , Netherlands, ASN30286 (THM, US),

Reverse DNS

h.online-metrix.net

Software

Apache /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Host: h.online-metrix.net
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Referer: https://online.citi.com/US/login.do?JFP_TOKEN=3RQ3Y559
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: https://online.citi.com/US/login.do?JFP_TOKEN=3RQ3Y559

Response headers

Date: Thu, 30 Apr 2020 20:02:49 GMT
Server: Apache
Strict-Transport-Security: max-age=31536000
Cache-Control: no-cache, no-store, must-revalidate
Pragma: no-cache
Connection: Keep-Alive, Keep-Alive
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Content-Type: text/html;charset=UTF-8
Vary: Accept-Encoding
Content-Encoding: gzip
Keep-Alive: timeout=2, max=100
Transfer-Encoding: chunked

GET
H/1.1 204
No Content clear.png Show response
content22.online.citi.com/fp/ Frame D798 0
388 B 50ms
15ms Script
text/javascript 91.235.134.21
THM

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

91.235.134.21 , Netherlands, ASN30286 (THM, US),

Reverse DNS

Software

Apache /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://online.citi.com/US/login.do?JFP_TOKEN=3RQ3Y559
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 30 Apr 2020 20:02:50 GMT
X-Content-Type-Options: nosniff
Server: Apache
Strict-Transport-Security: max-age=31536000
Content-Type: text/javascript
Cache-Control: no-cache, no-store, must-revalidate
Connection: Keep-Alive
Keep-Alive: timeout=2, max=100
X-XSS-Protection: 1; mode=block
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H/1.1 200
OK top_fp.html;CIS3SID=49B19B296A24D47372FE5748E722A335 Show response
content22.online.citi.com/fp/ Frame 15A8 46 KB
12 KB 36ms
30ms Document
text/html 91.235.134.21
THM

General

Check archive.org

Show headers Download Go to

Full URL

https://content22.online.citi.com/fp/top_fp.html;CIS3SID=49B19B296A24D47372FE5748E722A335?org_id=89oebq5k&session_id=870e3f8c1f2b672c1fbc2ee2a3dabc92778d9976d890f49f675074a30b0aca59&nonce=b6087d1243c030c0&pageid=1

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

91.235.134.21 , Netherlands, ASN30286 (THM, US),

Reverse DNS

Software

Apache /

Resource Hash

fca01f10bacd4f564701cc6d9e119cc0e9846a654ed74fea2495c22ee54b5779

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Host: content22.online.citi.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: same-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Referer: https://online.citi.com/US/login.do?JFP_TOKEN=3RQ3Y559
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Cookie: TLTSID=599b119873af5ec508362e219f21ef6f7ba846bcf38d806d9d39e6ee2a86fc70; CUUID=fe255924-87aa-430f-a458-fc324e379fc3; CITI_SITE=gtdc; AKMTLTSID=4C2CDD8C02CD596E71003DD09CC0F73F; mbox=check#true#1588277027|session#2d9122308456434f9c52e409fb4c44d4#1588278827|PC#2d9122308456434f9c52e409fb4c44d4.37_0#1589486567; bcsid=1125020B34030B0ABBAFB4DD065E794; bmuid=1588276966447-D269394D-D0C9-4320-BD2F-278D60D5ACC8; cdContextId=2; AMCVS_61834D9B5228A7430A490D45%40AdobeOrg=1; experience=Uncookied; _cls_v=0018432a-747b-4d2c-a6e7-8497f3095ef3; _cls_s=8843ce37-2d96-4c75-92c5-9b48b27d5e75:0; _gcl_au=1.1.1404517603.1588276967; s_vi=[CS]v1|2F5597730515D332-40000864E2F62AB0[CE]; s_ecid=MCMID%7C87952983065949927252082562565465972909; AMCV_61834D9B5228A7430A490D45%40AdobeOrg=-330454231%7CMCIDTS%7C18383%7CMCMID%7C87952983065949927252082562565465972909%7CMCAAMLH-1588881766%7C6%7CMCAAMB-1588881766%7CRKhpRz8krg2tLO6pguXWp5olkAcUniQYPHaMWWgdJ3xzPWQmdj0y%7CMCOPTOUT-1588284166s%7CNONE%7CMCSYNCSOP%7C411-18390%7CMCAID%7C2F5597730515D332-40000864E2F62AB0%7CvVersion%7C3.1.2; BKDMP=; popSplit=0; cdSNum=1588276966901-sjn0000602-c673f01e-64a3-418f-90c2-1e0a6649fbad; AOSDMPRF=aos_offers=OMPC--142--X-c-248-X----|OMPC--202--X-c-366-X----|OMPC--408--X-c-299-X----|OMPC--520--X-c-442-X----|Bank--A201---c--B----|Bank--A301---c--B----|OMPC--AAF--X-c-650-X----|Bank--B100---c--B----|Bank--C101---c--B----|Bank--C129---c--B----|Bank--C133---c--B----|Bank--C201---c--B----|Bank--C301---c--B----|Bank--C501---c--B----|Bank--C601---c--B----|Bank--D184---c--B----|Bank--H147---c--B----|Bank--H148---c--B----|Bank--I250---c--B----|Bank--I500---c--B----|Bank--L018---c--B----|Bank--M185---c--B----|OMPC--MPC--X-c-353-X----|Bank--NKH---c--B----|Bank--PAL---c--B----|OMPC--PRQ--X-c-301-X----|Bank--QLE---c--B----|Bank--S101---c--B----|Bank--S201---c--B----|Bank--S301---c--B----|Bank--S700---c--B----|Bank--S723---c--B----|Bank--V100---c--B----|Bank--V150---c--B----|Bank--V200---c--B----|Bank--V350---c--B----&aos_tx=e07d1eba61f7475190420f5a1c1098eb&aos_axid=e07d1eba61f7475190420f5a1c1098eb prod 2020-04-30-15 8588&aos_ex=Uncookied&aos_cat=C202_00&aos_ep=PRD&aos_c_cbcat=B178_01&aos_cbcat=B178_01&aos_mem=OBTA&aos_responseCode=I000&aos_httpStatus=200; RFXPUID=SY-00GflAAW61nZc=583; tmx_sessionid=870e3f8c1f2b672c1fbc2ee2a3dabc92778d9976d890f49f675074a30b0aca59; tmx_digitalApptype=PC_BROWSER; gpv_pn=public%7Cmarketing%7Chome%7Cciti; s_cc=true; thx_guid=52858c93bc884116968607286a169826; _uetsid=_uet82b937f0-6744-4072-c2d1-c1f1318870fe; cd_user_id=171ccaf411a254-0580df393f456c-37647e03-1d4c00-171ccaf411b999; s_fid=5DAC1B209FFB2AD9-14A179C6E81C247D; s_pers=%20gpv_p7%3DNon%2520Cookied%2520Username%2520Password%7C1588278770178%3B%20s_visit%3D1%7C1588278770179%3B%20s_vnum%3D1588284000180%2526vn%253D1%7C1588284000180%3B%20s_invisit%3Dtrue%7C1588278770180%3B%20s_nr%3D1588276970182-New%7C1745956970182%3B; s_sess=%20SC_LINKS%3D%3B%20s_vstart%3D1588276970185%3B
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: https://online.citi.com/US/login.do?JFP_TOKEN=3RQ3Y559

Response headers

Date: Thu, 30 Apr 2020 20:02:50 GMT
Server: Apache
Strict-Transport-Security: max-age=31536000
Cache-Control: no-cache, no-store, must-revalidate
Pragma: no-cache
Connection: Keep-Alive, Keep-Alive
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Content-Type: text/html;charset=UTF-8
Vary: Accept-Encoding
Content-Encoding: gzip
Keep-Alive: timeout=2, max=98
Transfer-Encoding: chunked

GET
H/1.1 204
204 clear.png Show response
content22.online.citi.com/fp/ Frame D798 0
218 B 62ms
21ms Script
text/javascript 91.235.134.21
THM

General

Check archive.org

Show headers Download Go to

Full URL

https://content22.online.citi.com/fp/clear.png?org_id=89oebq5k&session_id=870e3f8c1f2b672c1fbc2ee2a3dabc92778d9976d890f49f675074a30b0aca59&nonce=b6087d1243c030c0&pageid=1&ja=3e3433262475353765313b34303367336135603037346524633f36302478353432246e3d393e323278393a3032266c72703f312c33363032783332303226616e35333630327a3930303224717a7b3f327832247161643d3034246c683f6a7c7672712d33492d3044253a4e6f6c6c616c672c636976692e616f6f25324455532d3a446c6f656b662c646d2731444844525f564d49474e253144315251315b3d373b246c7235607676707b2d3343253a442730467775772e656f6d676c672e72672d304626723f786e75656b6c5d646e63736a5c64636c736721726c75656b665d756b6664677f715d6d6d6c69635f786e637b65725c66616e736721706e756761665d61646d606d5d6161706d6063765c66636e716721706e7565696e5d737d6b61697c69656d5c6461647b6523706477656b6e5f71686f616b756176675e666964716521726e7d65696c5d7067636e726c637b67705e66636c716521726e7d656b6c5776646b5d726c697165705e6e636e716521726c7565696c5f64677661647e705e66636e7b6721726e77656b6c5d7374655d7469657565705e66636e7b67237264756f616c5d6a697e615c66696e716726686a3d6131353435363561393f6e373537346638606460353b353b31353867663633382668736d3d4c6b6c7d7a24687b62354b6a706f656d2530303f362468736f773d4c6b6e7778266c6863353930266e666f353a267678663f4777706f72672730464267726e696e246f69766a70353438383166316b3a62676338306734636337363032383061643335353c383366643637303a3136336634676363323666613b3461646266373231333b333b3469266d70313f63303c6636376c35343b636231376131346132306732643139646637313a3c326363353237633661266161663f323032303230&jb=393430266e73354f6f786b6e6e63273046372c322732302a4d6363696c7667716a273b422d3a324b6e7c6d6c2732384f63612532324f532732325825303031385733345f372b2d30304372726e67556762496b762732463733352e3334273a322a49405445442730432d3a306e6963672730304767636b6d29273230416872676567253244353c2c302c3135303b2c33363b2730325361646170692530443d31352c3b36

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

91.235.134.21 , Netherlands, ASN30286 (THM, US),

Reverse DNS

Software

Apache /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://online.citi.com/US/login.do?JFP_TOKEN=3RQ3Y559
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Thu, 30 Apr 2020 20:02:50 GMT
Server: Apache
Connection: Keep-Alive
Keep-Alive: timeout=2, max=99
Strict-Transport-Security: max-age=31536000
Content-Type: text/javascript;charset=UTF-8

GET
H/1.1 200
OK clear.png
89oebq5krr5dakmqy7madoyk5t57gvtfx2h3rxwdb6087d1243c030c0am1.e.aa.online-metrix.net/fp/ Frame D798 81 B
438 B 61ms
14ms Image
image/png 91.235.134.131
THM

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://89oebq5krr5dakmqy7madoyk5t57gvtfx2h3rxwdb6087d1243c030c0am1.e.aa.online-metrix.net/fp/clear.png?org_id=89oebq5k&session_id=870e3f8c1f2b672c1fbc2ee2a3dabc92778d9976d890f49f675074a30b0aca59&nonce=b6087d1243c030c0&pageid=1&di=yes

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

91.235.134.131 , Netherlands, ASN30286 (THM, US),

Reverse DNS

Software

Apache /

Resource Hash

95518cbec0d55a574a9c8ef72a2a7d62ac0d40a4de5dfe67a76a7d214dc8b743

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://online.citi.com/US/login.do?JFP_TOKEN=3RQ3Y559
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 30 Apr 2020 20:02:50 GMT
X-Content-Type-Options: nosniff
Server: Apache
Strict-Transport-Security: max-age=31536000
Content-Type: image/png
Cache-Control: no-cache, no-store, must-revalidate
Connection: close
Content-Length: 81
X-XSS-Protection: 1; mode=block
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2 200 s26721256578135
metrics1.citi.com/b/ss/citinaprod/1/JS-2.0.0/ 43 B
351 B 16ms
15ms Image
image/gif 15.188.31.119
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://metrics1.citi.com/b/ss/citinaprod/1/JS-2.0.0/s26721256578135?AQB=1&ndh=1&pf=1&t=30%2F3%2F2020%2022%3A2%3A50%204%20-120&fid=5DAC1B209FFB2AD9-14A179C6E81C247D&ce=UTF-8&pageName=Non%20Cookied%20Username%20Password&g=https%3A%2F%2Fonline.citi.com%2FUS%2Flogin.do%3FJFP_TOKEN%3D3RQ3Y559&r=https%3A%2F%2Fwww.google.ro%2F&c.&visitStart=1&.c&cc=USD&ch=CBOL&c1=Public&h1=CBOL%2FPublic%2FSignOn%2F%2F&c2=SignOn&l3=1%3Ampc_citicom_may2016%7C5%3ASave_Hub2%7C6%3ACITIGOLD_FamilyFinancialPlan%7C7%3ACOVID19BAN%7C2%3A3up%3APrequal_WAN_19%7C3%3A3up%3ACITI_RewardsPlus_18%7C4%3A3up%3AHYS_SaveOOBTA_Dont%7C&c8=pre-login%20Sign%20on%20page&c9=US&v9=e07d1eba61f7475190420f5a1c1098eb%7CPRD%7CB178_01%7CI000&c11=english&v12=2d9122308456434f9c52e409fb4c44d4.37_0&c25=%5BCS%5Dv1%7C2F5597730515D332-40000864E2F62AB0%5BCE%5D&c26=success%7C66809201&c27=e07d1eba61f7475190420f5a1c1098eb%7CPRD%7CB178_01%7CI000&c37=na_prod&v38=Non%20Cookied%20Username%20Password&v42=en_US_USPTL&v52=mpc_citicom_may2016%7C1%7Chero-one%2CPrequal_WAN_19%7C2%7Cmod-two%2CCITI_RewardsPlus_18%7C3%7Cmod-two%2CHYS_SaveOOBTA_Dont%7C4%7Cmod-two%2CSave_Hub2%7C5%7Cmod-seven%2CCITIGOLD_FamilyFinancialPlan%7C6%7Cmod-one%2CCOVID19BAN%7C7%7Cmod-three%7EN&c59=jUSCBOL_Loginpage_Uncookied&c61=41&v62=fe255924-87aa-430f-a458-fc324e379fc3&c63=https%3A%2F%2Fonline.citi.com%2FUS%2Flogin.do%3FJFP_TOKEN%3D3RQ3Y559&c64=4%3A02PM&v64=4%3A02PM&c65=Thursday&v65=Thursday&c66=Thursday%7C4%3A02PM&v67=New&v68=1&c69=not%20logged%20in&c73=624610%2C358910%2C552021%2C354602%2C578278%2C373773%2C490004%2C622672%2C582775%2C593700%2C495376%2C495377%2C584566%2C495374%2C495375%2C573017%2C593103%2C522574%2C588511%2C639140%2C542251%2C632449%2C522572%2C490141%2C580663%2C626438%2C515853%2C522576%2C562734%2C551962%2C507276%2C600937%2C555592%2C494437%2C551970%2C571630%2C385436%2C572752%2C583873%2C569456%2C639206%2C617299%2C637871%2C492646%2C606935%2C512346%2C521100%2C578262%2C613371%2C578343%2C609397%2C609396%2C388219%2C531459%2C565689%2C534325%2C508299%2C620980%2C623461%2C536797%2C560576%2C560579%2C359218%2C528144%2C423185%2C488122%2C572750%2C359214%2C486892%2C510670%2C369351&v73=medium%7C1600&v78=Yes&v79=a2d12eab-8008-49ef-a5eb-9630fb0e5c57&v87=online.citi.com&v96=sv%7Cbos%3A1%7Cdsa%3A1%7Cax%3A1%7Cdsr%3A1%7Crf%3A1%7Ccms%3A1&s=1600x1200&c=24&j=1.6&v=N&k=Y&bw=1600&bh=1200&AQE=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

15.188.31.119 Paris, France, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-15-188-31-119.eu-west-3.compute.amazonaws.com

Software

jag /

Resource Hash

a1ecbaed793a1f564c49c671f2dd0ce36f858534ef6d26b55783a06b884cc506

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://online.citi.com/US/login.do?JFP_TOKEN=3RQ3Y559
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Thu, 30 Apr 2020 20:02:49 GMT
x-content-type-options: nosniff
x-c: master-1221.I0e927e.M0-376
p3p: CP="This is not a P3P policy"
status: 200
content-length: 43
x-xss-protection: 1; mode=block
pragma: no-cache
last-modified: Fri, 01 May 2020 20:02:50 GMT
server: jag
xserver: anedge-65fb49f79-nmz5c
etag: 3410798821655281664-4617256797644796058
vary: *
content-type: image/gif;charset=utf-8
access-control-allow-origin: *
cache-control: no-cache, no-store, max-age=0, no-transform, private
expires: Wed, 29 Apr 2020 20:02:50 GMT

GET
H2 200 pp.html
cdn.pbbl.co/i/ Frame A35B 0
0 148ms
147ms Document
text/html 99.86.243.81
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.pbbl.co/i/pp.html
Requested by: Host: cdn.pbbl.co
URL: https://cdn.pbbl.co/r/1560.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 99.86.243.81 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-243-81.vie50.r.cloudfront.net
Software: nginx/1.10.3 (Ubuntu) /
Resource Hash

Request headers

:method: GET
:authority: cdn.pbbl.co
:scheme: https
:path: /i/pp.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://online.citi.com/US/login.do?JFP_TOKEN=3RQ3Y559
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: https://online.citi.com/US/login.do?JFP_TOKEN=3RQ3Y559

Response headers

status: 200
content-type: text/html
server: nginx/1.10.3 (Ubuntu)
date: Thu, 30 Apr 2020 20:02:50 GMT
last-modified: Thu, 30 Jan 2020 18:07:58 GMT
content-encoding: gzip
vary: Accept-Encoding
x-cache: Miss from cloudfront
via: 1.1 2ada7fef339aac482bc92d45b7dff5f8.cloudfront.net (CloudFront)
x-amz-cf-pop: VIE50-C1
x-amz-cf-id: dRSUxA672OYaPiydY6iBSNQqu-5uuVAgw5wRAo3uM9ndCky0uH6NOw==

GET
H/1.1 200
OK cls_report Show response
prod.report.nacustomerexperience.citi.com/glassbox/reporting/ 0
660 B 1570ms
122ms XHR
text/plain 192.193.200.243
SOLANA-CITIPLEX

General

Check archive.org

Show headers Download Go to

Full URL

https://prod.report.nacustomerexperience.citi.com/glassbox/reporting/cls_report?_cls_s=8843ce37-2d96-4c75-92c5-9b48b27d5e75%3A0&_cls_v=0018432a-747b-4d2c-a6e7-8497f3095ef3

Requested by

Host: online.citi.com
URL: https://online.citi.com/US/login.do?JFP_TOKEN=3RQ3Y559

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

192.193.200.243 , United States, ASN32287 (SOLANA-CITIPLEX, US),

Reverse DNS

Software

GlassBox Cligate /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubdomains;
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://online.citi.com/US/login.do?JFP_TOKEN=3RQ3Y559
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Thu, 30 Apr 2020 20:02:51 GMT
Strict-Transport-Security: max-age=63072000; includeSubdomains;
vary: origin
Server: GlassBox Cligate
X-Akamai-CITISITE: SWDC
X-Frame-Options: SAMEORIGIN
Content-Type: text/plain; charset=utf-8
access-control-allow-origin: https://online.citi.com
access-control-allow-credentials: true
Connection: close
Content-Length: 0

GET
H/1.1 204
204 clear1.png;CIS3SID=49B19B296A24D47372FE5748E722A335
content22.online.citi.com/fp/ Frame D798 0
386 B 18ms
17ms Image
image/png 91.235.134.21
THM

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://content22.online.citi.com/fp/clear1.png;CIS3SID=49B19B296A24D47372FE5748E722A335?org_id=89oebq5k&session_id=870e3f8c1f2b672c1fbc2ee2a3dabc92778d9976d890f49f675074a30b0aca59&nonce=b6087d1243c030c0&pageid=1&jf=3c333626716b6c5d726c663f7666705d546a76494832487a5033574e317a493724716164576c6376653539353a383a35343b3730247369665f767970673d776d6a38656366716924736b665d69677b3f3332373b313031313034303730633034363a6b653b6c32303039383632383a633a34343861653366303130313237303b3c30303032363132383230646766603066303332336262326636393166303e3b643238376b386366643e3c3964626d323167303666383530666665373631626d3061643636316963373a64363036316466333434603939333034396561373a3b3b613c37383a6733333b693132613e60313236383434353a323562636030333e3f30656237662e7169665d716b653f313036373230323132303a30396664313166366d62306e346136386b6231633930646763376763613032376430343537396c30373136353f6039343336306167603867373a36613033323232323237316335346b303a3e3634663b696430326d316432343533306337636333623b36613e3a3a646236673b3133326764353530316660353134393635333b393437247b6b64703530

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

91.235.134.21 , Netherlands, ASN30286 (THM, US),

Reverse DNS

Software

Apache /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://online.citi.com/US/login.do?JFP_TOKEN=3RQ3Y559
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 30 Apr 2020 20:02:50 GMT
X-Content-Type-Options: nosniff
Server: Apache
Strict-Transport-Security: max-age=31536000
Content-Type: image/png
Cache-Control: no-cache, no-store, must-revalidate
Connection: Keep-Alive, Keep-Alive
Keep-Alive: timeout=2, max=97
X-XSS-Protection: 1; mode=block
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2

200

adadvisor.gif
px0.pbbl.co/
Redirect Chain

https://px0.pbbl.co/ns/__p2.gif?ppid=be9589e0-9427-41e8-8a54-f523ed2eef79&chk=false&brid=1560&brcid=fe255924-87aa-430f-a458-fc324e379fc3&email=&orderId=&orderValue=&productId=&offerCode=&label=&pag...
https://aa.agkn.com/adscores/g.pixel?sid=9212282598&_ppid=be9589e0-9427-41e8-8a54-f523ed2eef79&_segid=99&iid=1d4543f3-5138-4eec-a4d3-e9f193b5b968
https://px0.pbbl.co/adadvisor.gif?segment=000&_ppid=be9589e0-9427-41e8-8a54-f523ed2eef79&_segid=99&_zip=&hk=&iid=1d4543f3-5138-4eec-a4d3-e9f193b5b968&mt=&bd=

42 B
135 B

146ms
146ms

Image
image/gif

2a00:1450:4001:816::2013
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://px0.pbbl.co/adadvisor.gif?segment=000&_ppid=be9589e0-9427-41e8-8a54-f523ed2eef79&_segid=99&_zip=&hk=&iid=1d4543f3-5138-4eec-a4d3-e9f193b5b968&mt=&bd=

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:816::2013 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Frontend /

Resource Hash

99c2917ee5b2a01459a923bdd1c676f15ee73b62b87f696e6735312d26f51e12

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1

Request headers

Referer: https://online.citi.com/US/login.do?JFP_TOKEN=3RQ3Y559
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 30 Apr 2020 20:02:50 GMT
x-content-type-options: nosniff
server: Google Frontend
content-type: image/gif
status: 200
x-cloud-trace-context: a9f6e944969eaf027ad33fae12578c5b
cache-control: must-revalidate, no-cache, no-store
content-length: 42
x-xss-protection: 1
expires: 0

Redirect headers

pragma: no-cache
date: Thu, 30 Apr 2020 20:02:50 GMT
server: AAWebServer
status: 302
p3p: policyref="https://www.agkn.com/p3p/p3p.xml",CP="NOI NID"
location: https://px0.pbbl.co/adadvisor.gif?segment=000&_ppid=be9589e0-9427-41e8-8a54-f523ed2eef79&_segid=99&_zip=&hk=&iid=1d4543f3-5138-4eec-a4d3-e9f193b5b968&mt=&bd=
cache-control: no-cache, no-store, must-revalidate
content-length: 0
expires: 0

GET
H/1.1 204
No Content clear.png Show response
content22.online.citi.com/fp/ Frame D798 0
387 B 17ms
16ms Script
text/javascript 91.235.134.21
THM

General

Check archive.org

Show headers Download Go to

Full URL

https://content22.online.citi.com/fp/clear.png?org_id=89oebq5k&session_id=870e3f8c1f2b672c1fbc2ee2a3dabc92778d9976d890f49f675074a30b0aca59&nonce=b6087d1243c030c0&pageid=1&jac=1&je=3a36372624756d607276615d6b6c7667726c636e5d69703f3066616567673d312f6138623e253634313025613262312f6460396135363333663b30652c6c6f6b696e2c613030383b3830612f376364322d366064602d626462672d6266606c3a67373b656d6c3b2c6c676b616e267f67607074635d65787665706e616e5f6978353a332e3b352630332c31342460637673763f79206c6574656e223a332c38322e207b74697c777122322a636a617a656b6c67227f266177646a3d646662653b6b61363531306930656431673735376432646737666231353731306167353d37333269373838646361393f65356339313031353230343732663666

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

91.235.134.21 , Netherlands, ASN30286 (THM, US),

Reverse DNS

Software

Apache /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://online.citi.com/US/login.do?JFP_TOKEN=3RQ3Y559
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Pragma: no-cache
Date: Thu, 30 Apr 2020 20:02:50 GMT
X-Content-Type-Options: nosniff
Server: Apache
Strict-Transport-Security: max-age=31536000
Content-Type: text/javascript
Cache-Control: no-cache, no-store, must-revalidate
Connection: Keep-Alive
Keep-Alive: timeout=2, max=96
X-XSS-Protection: 1; mode=block
Expires: Thu, 01 Jan 1970 00:00:00 GMT

POST
H/1.1 200
OK cls_report Show response
prod.report.nacustomerexperience.citi.com/glassbox/reporting/ 9 KB
2 KB 730ms
351ms XHR
application/json 192.193.200.243
SOLANA-CITIPLEX

General

Check archive.org

Show headers Download Go to

Full URL

https://prod.report.nacustomerexperience.citi.com/glassbox/reporting/cls_report?clsjsv=6.2.86B2&_cls_s=8843ce37-2d96-4c75-92c5-9b48b27d5e75:0&_cls_v=0018432a-747b-4d2c-a6e7-8497f3095ef3&pid=f29dc6e6-8ff3-4001-a419-1c9e32e4ad67&sn=1

Requested by

Host: online.citi.com
URL: https://online.citi.com/US/login.do?JFP_TOKEN=3RQ3Y559

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

192.193.200.243 , United States, ASN32287 (SOLANA-CITIPLEX, US),

Reverse DNS

Software

GlassBox Cligate /

Resource Hash

a6e128fa848f63926e5d22a4cf44684cbf98c42fe758696390902bb7b2f41190

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubdomains;
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://online.citi.com/US/login.do?JFP_TOKEN=3RQ3Y559
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

Date: Thu, 30 Apr 2020 20:02:52 GMT
content-encoding: gzip
vary: origin
Server: GlassBox Cligate
X-Akamai-CITISITE: SWDC
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=63072000; includeSubdomains;
Content-Type: application/json
access-control-allow-origin: https://online.citi.com
access-control-allow-credentials: true
Connection: close
content-length: 1832

POST
H/1.1 200
OK cls_report Show response
prod.report.nacustomerexperience.citi.com/glassbox/reporting/ 9 KB
2 KB 564ms
318ms XHR
application/json 192.193.200.243
SOLANA-CITIPLEX

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Host: online.citi.com
URL: https://online.citi.com/US/login.do?JFP_TOKEN=3RQ3Y559

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

192.193.200.243 , United States, ASN32287 (SOLANA-CITIPLEX, US),

Reverse DNS

Software

GlassBox Cligate /

Resource Hash

a6e128fa848f63926e5d22a4cf44684cbf98c42fe758696390902bb7b2f41190

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubdomains;
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://online.citi.com/US/login.do?JFP_TOKEN=3RQ3Y559
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

Date: Thu, 30 Apr 2020 20:03:00 GMT
content-encoding: gzip
vary: origin
Server: GlassBox Cligate
X-Akamai-CITISITE: SWDC
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=63072000; includeSubdomains;
Content-Type: application/json
access-control-allow-origin: https://online.citi.com
access-control-allow-credentials: true
Connection: close
content-length: 1832

POST
H/1.1 200
OK cls_report Show response
prod.report.nacustomerexperience.citi.com/glassbox/reporting/ 9 KB
2 KB 503ms
132ms XHR
application/json 192.193.200.243
SOLANA-CITIPLEX

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Host: online.citi.com
URL: https://online.citi.com/US/login.do?JFP_TOKEN=3RQ3Y559

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

192.193.200.243 , United States, ASN32287 (SOLANA-CITIPLEX, US),

Reverse DNS

Software

GlassBox Cligate /

Resource Hash

a6e128fa848f63926e5d22a4cf44684cbf98c42fe758696390902bb7b2f41190

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubdomains;
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://online.citi.com/US/login.do?JFP_TOKEN=3RQ3Y559
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

Date: Thu, 30 Apr 2020 20:03:00 GMT
content-encoding: gzip
vary: origin
Server: GlassBox Cligate
X-Akamai-CITISITE: SWDC
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=63072000; includeSubdomains;
Content-Type: application/json
access-control-allow-origin: https://online.citi.com
access-control-allow-credentials: true
Connection: close
content-length: 1832

GET
H/1.1 200
OK Cookie set pstats.html
a.rfihub.com/ Frame A440 0
0 67ms
18ms Document
text/html 193.0.160.128
ROCKETFUEL

General

Check archive.org

Show headers Download Go to

Full URL: https://a.rfihub.com/pstats.html?rb=648&ca=20766699&ri=652cadc13ebfcde66be10c2d4cc45250&rfiidc=1871597495045692823&rfiaid=f804af61beca40bf9748474318876071&stats=%7B%7D&ra=06706145086691384
Requested by: Host: c1.rfihub.net
URL: https://c1.rfihub.net/js/tc.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_256_CBC
Server: 193.0.160.128 , Netherlands, ASN54312 (ROCKETFUEL, US),
Reverse DNS
Software: Jetty(9.0.6.v20130930) /
Resource Hash

Request headers

Host: a.rfihub.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Referer: https://online.citi.com/US/login.do?JFP_TOKEN=3RQ3Y559
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: https://online.citi.com/US/login.do?JFP_TOKEN=3RQ3Y559

Response headers

P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Set-Cookie: rud=H4sIAAAAAAAAAOMSNrQwNzS1NDexNDUwMTWzNLIwMhbiM9R1KcpJjIwqdQpxD4mU4jU0tbAwMjeztDC2MDQFAO-uO7k0AAAA; Path=/; Domain=.rfihub.com; Expires=Tue, 25 May 2021 20:03:03 GMT; Secure; SameSite=None ruds=H4sIAAAAAAAAAOMSNrQwNzS1NDexNDUwMTWzNLIwMhbiM9R1KcpJjIwqdQpxD4kEAF1H0gclAAAA; Path=/; Domain=.rfihub.com; Secure; SameSite=None
Content-Type: text/html; charset=ISO-8859-1
Content-Encoding: gzip
Vary: Accept-Encoding, User-Agent
Transfer-Encoding: chunked
Server: Jetty(9.0.6.v20130930)

GET
H/1.1 200
OK Cookie set pstats.html
a.rfihub.com/ Frame 326C 0
0 17ms
16ms Document
text/html 193.0.160.128
ROCKETFUEL

General

Check archive.org

Show headers Download Go to

Full URL: https://a.rfihub.com/pstats.html?rb=648&ca=20779813&ri=72e163d90704c37091b56f060a44ee97&rfiidc=1871597495045692823&rfiaid=f804af61beca40bf9748474318876071&stats=%7B%7D&ra=2590993627736162
Requested by: Host: c1.rfihub.net
URL: https://c1.rfihub.net/js/tc.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_256_CBC
Server: 193.0.160.128 , Netherlands, ASN54312 (ROCKETFUEL, US),
Reverse DNS
Software: Jetty(9.0.6.v20130930) /
Resource Hash

Request headers

Host: a.rfihub.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Referer: https://online.citi.com/US/login.do?JFP_TOKEN=3RQ3Y559
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: https://online.citi.com/US/login.do?JFP_TOKEN=3RQ3Y559

Response headers

P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Set-Cookie: rud=H4sIAAAAAAAAAOMSNrQwNzS1NDexNDUwMTWzNLIwMhbiM9R1KcpJjIwqdQpxD4mU4jU0tbAwMjeztDAxs7AAAKh8AYE0AAAA; Path=/; Domain=.rfihub.com; Expires=Tue, 25 May 2021 20:03:04 GMT; Secure; SameSite=None ruds=H4sIAAAAAAAAAOMSNrQwNzS1NDexNDUwMTWzNLIwMhbiM9R1KcpJjIwqdQpxD4kEAF1H0gclAAAA; Path=/; Domain=.rfihub.com; Secure; SameSite=None
Content-Type: text/html; charset=ISO-8859-1
Content-Encoding: gzip
Vary: Accept-Encoding, User-Agent
Transfer-Encoding: chunked
Server: Jetty(9.0.6.v20130930)

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: api.rlcdn.com
URL: https://api.rlcdn.com/api/identity?pid=1&rt=idl

Domain: stags.bluekai.com
URL: https://stags.bluekai.com/site/19469?ret=json

Domain: cfr.us.v2.we-stats.com
URL: https://cfr.us.v2.we-stats.com/api/v1/cr.png?cid=cedric&snum=1588276966901-sjn0000602-c673f01e-64a3-418f-90c2-1e0a6649fbad&muid=1588276966447-D269394D-D0C9-4320-BD2F-278D60D5ACC8

Verdicts & Comments Add Verdict or Comment

596 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

33 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.rfihub.com/	1969-12-31 23:59:59	Name: ruds Value: H4sIAAAAAAAAAOMSNrQwNzS1NDexNDUwMTWzNLIwMhbiM9R1KcpJjIwqdQpxD4kEAF1H0gclAAAA
.rfihub.com/	1970-01-19 18:32:52	Name: rud Value: H4sIAAAAAAAAAOMSNrQwNzS1NDexNDUwMTWzNLIwMhbiM9R1KcpJjIwqdQpxD4mU4jU0tbAwMjezNDM3NDYDAG6Phy00AAAA
.demdex.net/	1970-01-19 13:30:28	Name: demdex Value: 83352382745646397341532672648230344974
.citi.com/	1969-12-31 23:59:59	Name: s_cc Value: true
.citi.com/	1970-01-19 09:11:18	Name: gpv_pn Value: public%7Cmarketing%7Chome%7Cciti
.citi.com/	1970-01-19 09:54:28	Name: s_nr Value: 1588276969533-New
.citi.com/	1969-12-31 23:59:59	Name: tmx_sessionid Value: 870e3f8c1f2b672c1fbc2ee2a3dabc92778d9976d890f49f675074a30b0aca59
.citi.com/	1970-01-19 09:55:04	Name: RFXPUID Value: SY-00GflAAW61nZc=583
.citi.com/	1969-12-31 23:59:59	Name: AMCVS_61834D9B5228A7430A490D45%40AdobeOrg Value: 1
.citi.com/	1969-12-31 23:59:59	Name: _cls_s Value: 8843ce37-2d96-4c75-92c5-9b48b27d5e75:0
.online.citi.com/	1970-01-19 13:30:28	Name: popSplit Value: 0
.citi.com/	1970-01-20 02:42:28	Name: AMCV_61834D9B5228A7430A490D45%40AdobeOrg Value: -330454231%7CMCIDTS%7C18383%7CMCMID%7C87952983065949927252082562565465972909%7CMCAAMLH-1588881766%7C6%7CMCAAMB-1588881766%7CRKhpRz8krg2tLO6pguXWp5olkAcUniQYPHaMWWgdJ3xzPWQmdj0y%7CMCOPTOUT-1588284166s%7CNONE%7CMCSYNCSOP%7C411-18390%7CMCAID%7C2F5597730515D332-40000864E2F62AB0%7CvVersion%7C3.1.2
.citi.com/	1970-01-20 02:42:28	Name: s_ecid Value: MCMID%7C87952983065949927252082562565465972909
.citi.com/	1970-01-19 11:20:52	Name: _gcl_au Value: 1.1.1404517603.1588276967
.citi.com/	1970-01-19 17:56:52	Name: bmuid Value: 1588276966447-D269394D-D0C9-4320-BD2F-278D60D5ACC8
online.citi.com/	1970-01-19 09:11:18	Name: 7018 Value: fe255924-87aa-430f-a458-fc324e379fc3
.citi.com/	1970-01-19 09:11:38	Name: cdSNum Value: 1588276966901-sjn0000602-c673f01e-64a3-418f-90c2-1e0a6649fbad
.citi.com/	1970-01-19 09:31:26	Name: mbox Value: check#true#1588277027\|session#2d9122308456434f9c52e409fb4c44d4#1588278827\|PC#2d9122308456434f9c52e409fb4c44d4.37_0#1589486567
.online.citi.com/	1969-12-31 23:59:59	Name: experience Value: Uncookied
.online.citi.com/	1969-12-31 23:59:59	Name: AOSDMPRF Value: aos_offers=OMPC--142--X-c-248-X----\|OMPC--202--X-c-366-X----\|OMPC--408--X-c-299-X----\|OMPC--520--X-c-442-X----\|Bank--A201---c--B----\|Bank--A301---c--B----\|OMPC--AAF--X-c-650-X----\|Bank--B100---c--B----\|Bank--C101---c--B----\|Bank--C129---c--B----\|Bank--C133---c--B----\|Bank--C201---c--B----\|Bank--C301---c--B----\|Bank--C501---c--B----\|Bank--C601---c--B----\|Bank--D184---c--B----\|Bank--H147---c--B----\|Bank--H148---c--B----\|Bank--I250---c--B----\|Bank--I500---c--B----\|Bank--L018---c--B----\|Bank--M185---c--B----\|OMPC--MPC--X-c-353-X----\|Bank--NKH---c--B----\|Bank--PAL---c--B----\|OMPC--PRQ--X-c-301-X----\|Bank--QLE---c--B----\|Bank--S101---c--B----\|Bank--S201---c--B----\|Bank--S301---c--B----\|Bank--S700---c--B----\|Bank--S723---c--B----\|Bank--V100---c--B----\|Bank--V150---c--B----\|Bank--V200---c--B----\|Bank--V350---c--B----&aos_tx=e07d1eba61f7475190420f5a1c1098eb&aos_axid=e07d1eba61f7475190420f5a1c1098eb prod 2020-04-30-15 8588&aos_ex=Uncookied&aos_cat=C202_00&aos_ep=PRD&aos_c_cbcat=B178_01&aos_cbcat=B178_01&aos_mem=OBTA&aos_responseCode=I000&aos_httpStatus=200
.citi.com/	1970-01-20 02:42:28	Name: s_vi Value: [CS]v1\|2F5597730515D332-40000864E2F62AB0[CE]
.citi.com/	1969-12-31 23:59:59	Name: cdContextId Value: 2
online.citi.com/	1970-01-19 17:56:52	Name: count Value: 1
.citi.com/	1970-01-19 17:56:52	Name: CUUID Value: fe255924-87aa-430f-a458-fc324e379fc3
.citi.com/	1969-12-31 23:59:59	Name: CITI_SITE Value: gtdc
.citi.com/	1969-12-31 23:59:59	Name: BKDMP Value:
.citi.com/	1969-12-31 23:59:59	Name: AKMTLTSID Value: 4C2CDD8C02CD596E71003DD09CC0F73F
.citi.com/	1969-12-31 23:59:59	Name: tmx_digitalApptype Value: PC_BROWSER
online.citi.com/	1969-12-31 23:59:59	Name: JSESSIONID Value: 0000c0GC0m_6B4ULHesUxOUhKyM:gt02p-srv3
.citi.com/	1970-01-21 04:59:16	Name: _cls_v Value: 0018432a-747b-4d2c-a6e7-8497f3095ef3
.citi.com/	1969-12-31 23:59:59	Name: bcsid Value: 1125020B34030B0ABBAFB4DD065E794
.citi.com/	1969-12-31 23:59:59	Name: TLTSID Value: 599b119873af5ec508362e219f21ef6f7ba846bcf38d806d9d39e6ee2a86fc70
online.citi.com/	1970-01-19 09:11:18	Name: 7830 Value: error

28 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
console-api	log	URL: https://online.citi.com/CBOL/taggingTransformation/tagging.js(Line 300) Message: Started tagging.js core
console-api	log	URL: https://online.citi.com/CBOL/taggingTransformation/tagging.js(Line 1328) Message: key external campaign tracking code is not available
console-api	log	URL: https://online.citi.com/CBOL/taggingTransformation/tagging.js(Line 1343) Message: key internal campaign tracking code is not available
console-api	log	URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js(Line 136) Message: addMbox_tnt_cards value is false
console-api	log	URL: https://online.citi.com/passivebio/bcsid.js(Line 5) Message: Setting new bcsid Cookie
console-api	log	URL: https://online.citi.com/US/login.do?JFP_TOKEN=3RQ3Y559(Line 1578) Message: tmx flag value in javascriptfalse
console-api	log	URL: https://online.citi.com/US/login.do?JFP_TOKEN=3RQ3Y559(Line 1582) Message: rsa flagtrue
console-api	log	URL: https://online.citi.com/US/login.do?JFP_TOKEN=3RQ3Y559(Line 1602) Message: isDCAFallback flag value is : false
console-api	log	URL: https://nexus.ensighten.com/citi/na_prod/code/7a9abd5b52a3e438cec898587d77cfa0.js?conditionId0=3013337(Line 368) Message: [object HTMLDivElement]
console-api	log	URL: https://online.citi.com/TMX/TMXProfiling.js(Line 4) Message: start tmxProfiling.js
console-api	log	URL: https://online.citi.com/JEA/CitiSearch/nexus-platform/js/citilive-search.js(Line 1) Message: >>>>>>>>>>>>>Smart Search init>>>>>>>>>>>>>>>>>>>>>> pageId: jUSCBOL_Loginpage_Uncookied userRole: VISITOR isLoggedIn: false language: en
console-api	log	URL: https://online.citi.com/CBOL/taggingTransformation/tagging.js(Line 764) Message: Load data...[object Object]
console-api	log	URL: https://online.citi.com/CBOL/taggingTransformation/tagging.js(Line 767) Message: [object Object]
console-api	log	URL: https://online.citi.com/TMX/TMXProfiling.js(Line 6) Message: tmxProfiling js execute
console-api	log	URL: https://online.citi.com/TMX/TMXProfiling.js(Line 12) Message: successfalsePC_BROWSER870e3f8c1f2b672c1fbc2ee2a3dabc92778d9976d890f49f675074a30b0aca5989oebq5khttps://content22.online.citi.com/fp/tags.js
console-api	log	URL: https://online.citi.com/TMX/TMXProfiling.js(Line 14) Message: tmxfallback
console-api	log	URL: https://online.citi.com/TMX/TMXProfiling.js(Line 16) Message: get everyparams89oebq5kPC_BROWSER870e3f8c1f2b672c1fbc2ee2a3dabc92778d9976d890f49f675074a30b0aca59
console-api	log	URL: https://nexus.ensighten.com/citi/na_prod/code/779cbb199d4a967f322364c6b836d2e4.js?conditionId0=421908(Line 153) Message: site_events detected
console-api	log	URL: https://nexus.ensighten.com/citi/na_prod/code/779cbb199d4a967f322364c6b836d2e4.js?conditionId0=421908(Line 153) Message: product data detected
console-api	log	URL: https://nexus.ensighten.com/citi/na_prod/code/779cbb199d4a967f322364c6b836d2e4.js?conditionId0=421908(Line 204) Message: Tagging Event Listener fired - _dl value changed
console-api	log	(Line 11) Message: test 12
console-api	log	URL: https://nexus.ensighten.com/citi/na_prod/code/1f8ee64d1e3bb14059a00bc105167007.js?conditionId0=462132(Line 12) Message: 1:mpc_citicom_may2016-viewed:yes\|
console-api	log	URL: https://nexus.ensighten.com/citi/na_prod/code/1f8ee64d1e3bb14059a00bc105167007.js?conditionId0=462132(Line 12) Message: 5:Save_Hub2-viewed:no\|
console-api	log	URL: https://nexus.ensighten.com/citi/na_prod/code/1f8ee64d1e3bb14059a00bc105167007.js?conditionId0=462132(Line 12) Message: 6:CITIGOLD_FamilyFinancialPlan-viewed:no\|
console-api	log	URL: https://nexus.ensighten.com/citi/na_prod/code/1f8ee64d1e3bb14059a00bc105167007.js?conditionId0=462132(Line 12) Message: 7:COVID19BAN-viewed:no\|
console-api	log	URL: https://nexus.ensighten.com/citi/na_prod/code/1f8ee64d1e3bb14059a00bc105167007.js?conditionId0=462132(Line 12) Message: 2:3up:Prequal_WAN_19-viewed:yes\|
console-api	log	URL: https://nexus.ensighten.com/citi/na_prod/code/1f8ee64d1e3bb14059a00bc105167007.js?conditionId0=462132(Line 12) Message: 3:3up:CITI_RewardsPlus_18-viewed:yes\|
console-api	log	URL: https://nexus.ensighten.com/citi/na_prod/code/1f8ee64d1e3bb14059a00bc105167007.js?conditionId0=462132(Line 12) Message: 4:3up:HYS_SaveOOBTA_Dont-viewed:yes\|

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=31536000
X-Xss-Protection	0

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

20766699p.rfihub.com
20779813p.rfihub.com
6260004.fls.doubleclick.net
89oebq5krr5dakmqy7madoyk5t57gvtfx2h3rxwdb6087d1243c030c0am1.e.aa.online-metrix.net
a.rfihub.com
aa.agkn.com
api.rlcdn.com
bat.bing.com
c1.rfihub.net
cdn.pbbl.co
cdn.tt.omtrdc.net
cfr.us.v2.we-stats.com
citi.demdex.net
citicorpcreditservic.tt.omtrdc.net
cm.everesttech.net
content22.online.citi.com
cse.google.com
cyseal.cyveillance.com
d.agkn.com
di.rlcdn.com
dpm.demdex.net
googleads.g.doubleclick.net
h.online-metrix.net
insight.adsrvr.org
js.adsrvr.org
metrics1.citi.com
mpsnare.iesnare.com
nebula-cdn.kampyle.com
nexus.ensighten.com
online.citi.com
online.citibank.com
prod.report.nacustomerexperience.citi.com
pt.ispot.tv
px0.pbbl.co
resources.digital-cloud-citi.medallia.com
s.rfihub.com
s.ytimg.com
sr.rlcdn.com
stags.bluekai.com
tags.bkrtx.com
udc-neb.kampyle.com
validation.information.dns-cloud.net
www.citi.com
www.facebook.com
www.google.com
www.google.de
www.google.ro
www.googleadservices.com
www.googletagmanager.com
www.youtube.com
api.rlcdn.com
cfr.us.v2.we-stats.com
stags.bluekai.com
104.109.92.187
111.90.149.203
13.224.95.202
15.188.31.119
151.101.113.175
151.101.114.109
151.101.114.133
172.217.16.194
172.217.18.166
18.195.42.228
185.31.128.129
192.193.200.243
193.0.160.128
23.39.98.15
23.45.237.36
23.61.220.204
23.61.221.89
23.67.129.14
2600:9000:2190:6000:19:fc2c:a140:93a1
2620:1ec:c11::200
2a00:1450:4001:809::200e
2a00:1450:4001:814::200e
2a00:1450:4001:816::2013
2a00:1450:4001:817::2003
2a00:1450:4001:81a::2002
2a00:1450:4001:81c::2008
2a00:1450:4001:81d::200e
2a00:1450:4001:81f::2004
2a00:1450:4001:825::2003
2a03:2880:f12d:83:face:b00c:0:25de
3.212.183.163
34.249.189.231
35.241.45.82
35.241.8.149
46.51.196.250
52.129.74.12
52.29.85.133
52.50.37.223
66.117.28.86
91.235.132.130
91.235.134.131
91.235.134.21
99.80.97.22
99.86.243.81
0074c83def322940a2623cd1cf2dc07ffb37fd2c8c618ca03743f49d12bba614
00d2ef3349482205ef97b84af5c5dd9abda693a458649a12159a096e9e899705
01d6b632b0c808c52a298af8c62df853f1d736632600c78f539c5bc061df3315
0227e0e4dea130eb6f3163aa3ab03720dce83a0e219c282189b03bc5b8a727e3
03c736ca1c90e26743865ed80c9766f84ca237b0dc572fab630737aaef70d171
0615974c40d602afdbf9759533e352bc17b0458c85aad6694b1a1ad20659625b
06dfb367edf9bbff810def9f75f8695b3ccfbcb2813306609fc6e18fcacfc17e
079e218ad07f42523479d475b4973a6e386ba95209ee964c04c1a6eb6186bda3
0a95d057d3fe90ee1644edbddfa370cfec43701106d45ae2efa91e8b8afffcec
0ae963446c472d283aa4f73633015771af3afe1c084fd784539971ab9a618b55
10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa
11e06438055585dd6a73f8ce31c35e0dd9d959501ce512f10563b6a437c71e14
157430093a6d2ee63082eae5dabf826926d3b6259d33482aa6713c48728e82fa
188edc45a0bce3ecb592ac0f871ca13c9e8f686f0a30a20ccc37f8514c5bbe5f
1cc4ec61057f30cea6d47126e0444f119b2606720b1fe8d7e0deff1f5742a82b
1e682f9b00359018d35c1d1c53cedfbe133b65e4a2ae55988a3583ff971f64e1
1f2a0e7aa3dabf73dae3cc7c1e53a70ec51145b39b027bdc1ecae9223c0c80d2
20b2f2a2ffaf00f3f81f129521d32f2847e02decdf56b04bc7a219eed156bf00
23d6bbd61eb9603a71d3930d3e0bdbc480e10e22f1123b3dbf87faf3e17bd64a
250218e57c75f9528eb52a89678ae7174412e11d6757654d2b569def502afa0e
26f9d98fbd36f3b8f4d845fcade394e9b92ada9d1aee314c7e5009820abbe206
28f07389552cf9e3557433f06cf63d9cf59e406f6aace98f63ba8220bb6095a5
2bc5133f1e02f3ebc4bfa9aebbc020234dab6b1b424ebb005062cdc06fcf0d1c
2c65cdc8fed4d04ccebbd8a065b8a6e16a6503060507c5140cb60350b0c2f480
2fc2de39e8f7ef461ecbf5894fd989352dc7f387380a50882af2788795f3407c
318acbdda26774e066af0f143edeb3d0b752dc1b2ebfb406e68e7fa34ce5553c
31b00ff4929696dfca06885da68e58c3e09f6ecb4ae0fe1ae287e99a3fd1f716
359a00b9518a4295a70361f526a7d69cf7dc40099a5ff361a5fbf8c0ee034e0c
3a5a45b443726dcc8f0c2ddfffc0f9bc00e1f8a09dbfdd2c748638be5f52f93e
3cb1f89cca21255888919872c51263c08dfc181d2600d2375bdbd8fda57788ce
3e72de5de67d6d80b65a114af684eaf880c53c250155a663cb17d677ff064bc1
3fca3de24621f0f10186594054444d608016297c2e853e548710b3521e42a609
429d8af3190c76d5fcb9b1cad2aa6eb555684921323da905d62017fbdbf557c6
4327a467473f73d384db9201c403606c513d9730b04543bdc083c2b2099524f5
44d3d4e66e1e7636e57911765054e696958d07ea55189620e27a1e163ba33957
4999a8bcfc1f9fd95a0c4e42cfbac1abdf5a6c9e26734abbe4bc157b8c2b49ab
4f918cd256712c03a1b88007176cabf623cc63740e919d35a217c18dc7ebe607
506575b752d10714465811aec4dd67a7bfb471fcbc2e9619c1faad68c110759e
5407ad372944d2599b86775c628e963429af523c48f5c80b70ea587a8ed12fa8
55c9d2f019f9d7ddfd69b2ad0351c5617338a222362aebb02b3b98a4dbc18486
55e066703c69d4d89a1f4d66794d474aa93d710624d8f807096bac17a7867b17
55f4299515608ef8997bdefa45ab5d70816ba780d5d14ea820cd1373d0e734dd
5be05d4a5c2d06e04ba83fe6b2467ccaa51e0f8cde93e80db0f802a2093801ee
5c852d77b2b93c6bf9c1d0ed52019dd893fa65577b80ac1ca9df5d767eeb1be6
5f69a6ff3d506bf20768ccc7d7343b38fe81f09a6c730b2c6d2fe9f93f4b829d
607adc86c1049b6dfd0802a182bc8ce30c37c32c664c5ad21878e24f25ce60ef
6177c6163dc1ad67fb596a94ef3d18a277bfd437dbb3c1a928cd6caacefeff2e
629b48196dcc270143a42ce57535b251c655617f8d510277d4a05306c426fd38
6c754df7391b8b22f329bdf75eaee815a2032412e26941cbe3838b074cb4d9cd
6d3001c9deac8cb1f88ea5254105f8d678de5532f1998a24eab1b59906eaf86b
6dc82b09be03ccf4678564bfb41b5d035572a59c96a09fc6b62b12ae445b666f
700b17285634a71e669d5fcc56209b7ccd47d60b27160fdf1aa8431d54fc8fc8
701d2f9f02741b8429f4fb892b2b48c34a8a0f9189cb09013b2799031f22e484
771c92ecc9167287111bc793f6392bfb0dc8a51a830b497f7591e6d3493fc1fc
793c2f3d02d0bc3ad8a2cdc901b2134159b66245e951ac258fee1ac8b2709f44
7b8cd61f9d36175fe1b2fc50dfd1585716b9e55a87a82e8ec3c5d9739d6fb939
7cb24e06c00e47bb6bc6c38b935d6bc62817f656703387e4fb7591add96c7454
7d481eb36581746fd3662c7c452856b695df90cdce24664c48f565aa119c8b16
7df13706eaab8ce9a3dcd2a501f60bc66987c83834d07dfaf07ae56ef814c110
7ecf3bf86151cd72036fb67feb8fcbd8c80359e0ca871e1aeb955428ed43c26d
82dfd7c72529e9bfb0bdc36b5fa7c709dfbfa1fc631a9e7a97103e61f3954326
8c5ebc81567bb11fea53ee4cf729e44ea2bfa2115442a1c72ea9b53fc654fbb9
8cad2492e705a54e5c4a634509b1d6c836dfb5bd179c2e58063653cc8635d6df
8e60e8edaca8a3167fe48e62f9b53ba1989a5b6a23283555f09ab12175fed96e
9300787330c7945c4ad1c6b2beecc1b22ee5d35f2ad71b6abdf3dc723ed41f82
943a3cd6bb1759cc34b6247d5f38417c857376d1c0a5ddaf640939c40b5bc43e
95518cbec0d55a574a9c8ef72a2a7d62ac0d40a4de5dfe67a76a7d214dc8b743
99c2917ee5b2a01459a923bdd1c676f15ee73b62b87f696e6735312d26f51e12
9ca747861c2e2787351bc177db2b022c378d21b1f1057643764562ac5f4c23e9
9ceaa25ec7654a66294c16e28989fbf1ecb9cebc9debe96ec597529465c7cd50
9dad502247a8488c21ef5beb32aed1a78b17b748711bec817c472911f76b4ead
a1ecbaed793a1f564c49c671f2dd0ce36f858534ef6d26b55783a06b884cc506
a612a8f640434c7aaee47569897c1fee79df6f146ec26115e2a8c9be645592b7
a6e128fa848f63926e5d22a4cf44684cbf98c42fe758696390902bb7b2f41190
a7e642d5a6f9e651391c666872b8be295929ca063d178a647a5adeebd8afb805
a7ec647250f3b02114793bd7f7081352a87ccb205660ce3b6fed6c5640d0ca12
a9623118fb6ec3944d1312cd0d492c3f32455e89bc1e01eafa67628a309d9c60
ab9cf8bad2c540d5d217334d9e16bf332cf72967c04ff4c330749cf1dba8d597
acd6c4f286c0e142ce45f592e4c53bc8d608d469a03ed61b98b19272373be930
b5b99c97960d130c44fad1acc54bba0644286e0fd6d3899e3027392ab7de9cc8
b5c6b8a54243fcab13be120e9ef678397569e146a57be2e7a4ca55f182361f79
b6e9d065a465bbb985fd55235fcffb2331504d35da93eda00afef1905521c8a3
b7264725078e153ab3a4af37c52374b3a5d46b8fb5fc7b5f8af2e773364eef93
bb7e425b980d4abf83a191fcb2014b457c29966ce44ec047512a243a39db5961
c3c994c3fe9bd4e055f6d0eb42067ecd6bdd3247e136bc22835b9882cfe77c61
cb2bb21705b9cce9781d02c9223f3344a65bd5314027d11c5a8518ad4bd84e84
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda
d0fe233255a67c17c1898de0f5cd5062ab0bf847c2f8a8ce3121bcdf8da23e5b
d24feef8a5dd86e7d2eb674dc936d2c3a5bbd1395c0c49e5fa4200d43373a6b4
d57c8034f9c12aa3ce626c9ed1d61a4bb0941c3ef320bb59346f20496fb0096a
d71b39784664cbc1e6905bd0c99918d0452ddf5ebf78f19e1721f4ba125e0d57
d9aa05050741d9e970f4010ac655cbe27c8901f5ebde1d19530280b70da93c9a
dc5ba306fece552e3a002c8e18fa392c85acfa61091e1b98496b745f8ace6876
dcb0a09b7d4cfc85ec88668b3ed4995815095d5d167438e5d0dd3087ecd68b2a
e17da319eba14bc5a5677abdac48f8ef973597cca0c9733f8d3dd68bbc6faf81
e18c28c95bea1af6b2187c6a35eb651dccabfb2212e529b6edd4a2e2f4c39ea8
e1cbb72f9a23129e0e8bc8c81a0a8fc80172ccd9ea86bef84617c20c83fb3af1
e226935ba96b671378a7552d0669729f2b4733fab20624ed8018e86bad35401e
e2812b1e3529e5f39e3b0586e82c7ad0dfc3fc61cfa0107edfac16483d0547d7
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e4049a88307528336fa92f75c639b693b0b910299dfe04b939a45f568ec55025
e5168b3d0c8f929a1b8c4c1b4e4ebac60ee0e1ecfd759aeb4be4c2b15e3fc097
e5e2516fbcd5efa489f44adca3809519fb9a94a420040577ad802d62c6cc09ed
e90fb0eba512ed6473f6fb8acf4cd09b38732f150f43c396246c12bb2aacbb67
e9e9a67395a0d83b584208a19b95af203df8e8e6c6952fe76c690d60ea9381c7
ed48ae9c1a324d49404d9fb4c508b880ca97a65f8fd21d352e241d1e4dfc50e2
edbb17630264914aede51f6ed648a12818459ce44a5dafa91048d6467356a790
eec5cc477e7cb4f1eee1f26dce3eb411a63716d89a9b659c7d5559571c837ccb
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
ef27c333057941304d9ed95281e6e2271ee97eb104b2a1b62c22c62a5e2c175f
f1821b3865a1008ba0c088f7dc5c7eeb6b81e414461885c40b8d0f48fcbc9341
f2adfd83f8e9c7f3b092921eb5a59d4463041b2be8386a17ec7ac29d8d588470
f327a0ba3e41b1e8154e1c18fc114baff0bd057151e3afe7fa6f33cc0cb18296
f44e4692a52b6a382cb481e23f8bcb9a6d4c24eec8aa60143c7e2ca3a85758b2
f6293fa8c399fd492fb1d40068afee4415acd29c573e7b8661d9c49b1aecea95
f6a65a0f46fc8a47e868fb882f19c5f6ac278db63a7cddbb74f67cc5fbb9ab21
fb932909daac7eff47f2a458fb47760bfd0924191bcd477f2366dd31e3ee73a4
fca01f10bacd4f564701cc6d9e119cc0e9846a654ed74fea2495c22ee54b5779

online.citi.com Open in urlscan Pro 104.109.92.187 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

162 Requests

98 %HTTPS

27 %IPv6

32 Domains

50 Subdomains

41 IPs

7 Countries

2059 kBTransfer

6140 kBSize

33 Cookies

24 Outgoing links

Page URL History

Redirected requests

162 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

online.citi.com Open in urlscan Pro
104.109.92.187 Public Scan

Screenshot
Live screenshot

Full Image

162
Requests

98 %
HTTPS

27 %
IPv6

32
Domains

50
Subdomains

41
IPs

7
Countries

2059 kB
Transfer

6140 kB
Size

33
Cookies

162 HTTP transactions
0 data transactions