online.citi.com Open in urlscan Pro
104.109.92.187 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://thankyou.citi.com/T/v500000174d9f614ad97b26af4bbe5cfc0/3bf2bdb046d54a330000021ef3a0bcc3/3bf2bdb0-46d5-4a33-94ae-df...
Effective URL:
https://online.citi.com/US/JSO/signon/DisplayUsernameSignon.do?userType=tyLogin&locale=en_US&TYNewUser=false&TYForgotUUI...
Submission Tags: phishing malicious Search All
Submission: On September 29 via api (September 29th 2020, 2:21:43 pm UTC) from US

Summary HTTP 124 Redirects Links 10 Behaviour Indicators

Summary

This website contacted 28 IPs in 7 countries across 19 domains to perform 124 HTTP transactions. The main IP is 104.109.92.187, located in Netherlands and belongs to AKAMAI-ASN1, EU. The main domain is online.citi.com.
TLS certificate: Issued by DigiCert SHA2 Extended Validation Ser... on March 13th 2020. Valid for: 2 years.

This is the only time online.citi.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
2 2	159.127.187.155 159.127.187.155	19137 (EPSILON-I...) (EPSILON-INTERACTIVE)
1 1	159.127.208.20 159.127.208.20	19137 (EPSILON-I...) (EPSILON-INTERACTIVE)
31	104.109.92.187 104.109.92.187	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
9	18.195.42.228 18.195.42.228	16509 (AMAZON-02) (AMAZON-02)
1 3	34.249.46.6 34.249.46.6	16509 (AMAZON-02) (AMAZON-02)
28	91.235.133.67 91.235.133.67	30286 (THM) (THM)
4	99.86.243.18 99.86.243.18	16509 (AMAZON-02) (AMAZON-02)
7	178.249.101.23 178.249.101.23	11054 (LIVEPERSON) (LIVEPERSON)
1	54.154.62.31 54.154.62.31	16509 (AMAZON-02) (AMAZON-02)
1 3	15.236.9.100 15.236.9.100	16509 (AMAZON-02) (AMAZON-02)
1 1	66.117.28.86 66.117.28.86	15224 (OMNITURE) (OMNITURE)
1	2a00:1450:400... 2a00:1450:4001:81a::2008	15169 (GOOGLE) (GOOGLE)
1	104.108.63.235 104.108.63.235	16625 (AKAMAI-AS) (AKAMAI-AS)
1	104.103.78.138 104.103.78.138	16625 (AKAMAI-AS) (AKAMAI-AS)
2	193.0.160.128 193.0.160.128	54312 (ROCKETFUEL) (ROCKETFUEL)
2	2a00:1450:400... 2a00:1450:4001:809::2008	15169 (GOOGLE) (GOOGLE)
2	2a03:6400:10:... 2a03:6400:10:0:178:249:97:99	11054 (LIVEPERSON) (LIVEPERSON)
1	13.225.73.20 13.225.73.20	16509 (AMAZON-02) (AMAZON-02)
1	52.141.218.213 52.141.218.213	8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1	35.244.245.222 35.244.245.222	15169 (GOOGLE) (GOOGLE)
3	151.101.194.133 151.101.194.133	54113 (FASTLY) (FASTLY)
2	143.204.94.11 143.204.94.11	16509 (AMAZON-02) (AMAZON-02)
1	184.30.210.81 184.30.210.81	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1	2a03:6400:10:... 2a03:6400:10:0:178:249:97:98	11054 (LIVEPERSON) (LIVEPERSON)
2	91.235.132.130 91.235.132.130	30286 (THM) (THM)
2	91.235.134.131 91.235.134.131	30286 (THM) (THM)
1	151.101.13.175 151.101.13.175	54113 (FASTLY) (FASTLY)
1 2	2a00:1450:400... 2a00:1450:4001:801::2013	15169 (GOOGLE) (GOOGLE)
1 1	52.28.175.104 52.28.175.104	16509 (AMAZON-02) (AMAZON-02)
1	35.241.45.82 35.241.45.82	15169 (GOOGLE) (GOOGLE)
13	208.89.12.87 208.89.12.87	11054 (LIVEPERSON) (LIVEPERSON)
124	28

2 159.127.187.155 (United States) 2 redirects

ASN19137 (EPSILON-INTERACTIVE, US)

thankyou.citi.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 159.127.208.20 (United States) 1 redirects

ASN19137 (EPSILON-INTERACTIVE, US)

www.thankyou.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

31 104.109.92.187 (Netherlands)

ASN20940 (AKAMAI-ASN1, EU)
PTR: a104-109-92-187.deploy.static.akamaitechnologies.com

online.citi.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

9 18.195.42.228 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-18-195-42-228.eu-central-1.compute.amazonaws.com

nexus.ensighten.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 34.249.46.6 (Dublin, Ireland) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-34-249-46-6.eu-west-1.compute.amazonaws.com

dpm.demdex.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

28 91.235.133.67 (Netherlands)

ASN30286 (THM, US)

content22.online.citi.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 99.86.243.18 (Seattle, United States)

ASN16509 (AMAZON-02, US)
PTR: server-99-86-243-18.vie50.r.cloudfront.net

gateway.foresee.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 178.249.101.23 (Netherlands)

ASN11054 (LIVEPERSON, US)

lptag.liveperson.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 54.154.62.31 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-54-154-62-31.eu-west-1.compute.amazonaws.com

citi.demdex.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 15.236.9.100 (Paris, France) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-15-236-9-100.eu-west-3.compute.amazonaws.com

metrics1.citi.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 66.117.28.86 (United States) 1 redirects

ASN15224 (OMNITURE, US)

cm.everesttech.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:81a::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.108.63.235 (Netherlands)

ASN16625 (AKAMAI-AS, US)
PTR: a104-108-63-235.deploy.static.akamaitechnologies.com

tags.bkrtx.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.103.78.138 (Netherlands)

ASN16625 (AKAMAI-AS, US)
PTR: a104-103-78-138.deploy.static.akamaitechnologies.com

c1.rfihub.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 193.0.160.128 (Netherlands)

ASN54312 (ROCKETFUEL, US)

a.rfihub.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
20766699p.rfihub.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:809::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a03:6400:10:0:178:249:97:99 (United Kingdom)

ASN11054 (LIVEPERSON, US)

lp-01.chat.online.citi.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.225.73.20 (Seattle, United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-225-73-20.fra2.r.cloudfront.net

static-assets.fs.liveperson.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.141.218.213 (Des Moines, United States)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

contents3.00110.citi.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 35.244.245.222 (Mountain View, United States)

ASN15169 (GOOGLE, US)
PTR: 222.245.244.35.bc.googleusercontent.com

sr.rlcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 151.101.194.133 (United States)

ASN54113 (FASTLY, US)

resources.digital-cloud-citi.medallia.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 143.204.94.11 (Seattle, United States)

ASN16509 (AMAZON-02, US)
PTR: server-143-204-94-11.fra50.r.cloudfront.net

cdn.pbbl.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 184.30.210.81 (Netherlands)

ASN20940 (AKAMAI-ASN1, EU)
PTR: a184-30-210-81.deploy.static.akamaitechnologies.com

stags.bluekai.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a03:6400:10:0:178:249:97:98 (United Kingdom)

ASN11054 (LIVEPERSON, US)

lpcdn.chat.online.citi.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 91.235.132.130 (Netherlands)

ASN30286 (THM, US)
PTR: h.online-metrix.net

h.online-metrix.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 91.235.134.131 (Netherlands)

ASN30286 (THM, US)

89oebq5kxcr3y72iozsn5deq4lvf2s6natzr77jyb40b017a1adcd64dam1.e.aa.online-metrix.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
89oebq5kozitf5zyuxbugh4stmsdoa5wlb4pa4ap22322e055d970a9bam1.e.aa.online-metrix.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 151.101.13.175 (Frankfurt am Main, Germany)

ASN54113 (FASTLY, US)

nebula-cdn.kampyle.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:801::2013 (Frankfurt am Main, Germany) 1 redirects

ASN15169 (GOOGLE, US)

px0.pbbl.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.28.175.104 (Frankfurt am Main, Germany) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-52-28-175-104.eu-central-1.compute.amazonaws.com

aa.agkn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 35.241.45.82 (Ascension Island)

ASN15169 (GOOGLE, US)
PTR: 82.45.241.35.bc.googleusercontent.com

udc-neb.kampyle.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

13 208.89.12.87 (United States)

ASN11054 (LIVEPERSON, US)
PTR: va.v.liveperson.net

lp-03.chat.online.citi.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
81	citi.com 3 redirects thankyou.citi.com online.citi.com content22.online.citi.com metrics1.citi.com lp-01.chat.online.citi.com contents3.00110.citi.com lpcdn.chat.online.citi.com lp-03.chat.online.citi.com	2 MB
9	ensighten.com nexus.ensighten.com	154 KB
7	liveperson.net lptag.liveperson.net	127 KB
4	online-metrix.net h.online-metrix.net 89oebq5kxcr3y72iozsn5deq4lvf2s6natzr77jyb40b017a1adcd64dam1.e.aa.online-metrix.net 89oebq5kozitf5zyuxbugh4stmsdoa5wlb4pa4ap22322e055d970a9bam1.e.aa.online-metrix.net	876 B
4	pbbl.co 1 redirects cdn.pbbl.co px0.pbbl.co	10 KB
4	foresee.com gateway.foresee.com	75 KB
4	demdex.net 1 redirects dpm.demdex.net citi.demdex.net	3 KB
3	medallia.com resources.digital-cloud-citi.medallia.com	66 KB
3	googletagmanager.com www.googletagmanager.com	107 KB
2	kampyle.com nebula-cdn.kampyle.com udc-neb.kampyle.com	6 KB
2	rfihub.com a.rfihub.com 20766699p.rfihub.com	678 B
1	agkn.com 1 redirects aa.agkn.com	398 B
1	bluekai.com stags.bluekai.com
1	rlcdn.com sr.rlcdn.com
1	liveperson.com static-assets.fs.liveperson.com	3 KB
1	rfihub.net c1.rfihub.net	7 KB
1	bkrtx.com tags.bkrtx.com	11 KB
1	everesttech.net 1 redirects cm.everesttech.net	554 B
1	thankyou.com 1 redirects www.thankyou.com	791 B
124	19

	Domain	Requested by
31	online.citi.com	online.citi.com
28	content22.online.citi.com	online.citi.com content22.online.citi.com
13	lp-03.chat.online.citi.com	lptag.liveperson.net
9	nexus.ensighten.com	online.citi.com nexus.ensighten.com
7	lptag.liveperson.net	online.citi.com
4	gateway.foresee.com	online.citi.com gateway.foresee.com
3	resources.digital-cloud-citi.medallia.com	nexus.ensighten.com resources.digital-cloud-citi.medallia.com
3	www.googletagmanager.com	nexus.ensighten.com www.googletagmanager.com
3	metrics1.citi.com	1 redirects online.citi.com
3	dpm.demdex.net	1 redirects online.citi.com
2	px0.pbbl.co	1 redirects
2	h.online-metrix.net	content22.online.citi.com
2	cdn.pbbl.co	nexus.ensighten.com cdn.pbbl.co
2	lp-01.chat.online.citi.com	lptag.liveperson.net
2	thankyou.citi.com	2 redirects
1	udc-neb.kampyle.com
1	89oebq5kozitf5zyuxbugh4stmsdoa5wlb4pa4ap22322e055d970a9bam1.e.aa.online-metrix.net
1	aa.agkn.com	1 redirects
1	nebula-cdn.kampyle.com	resources.digital-cloud-citi.medallia.com
1	89oebq5kxcr3y72iozsn5deq4lvf2s6natzr77jyb40b017a1adcd64dam1.e.aa.online-metrix.net
1	lpcdn.chat.online.citi.com	lptag.liveperson.net
1	stags.bluekai.com	tags.bkrtx.com
1	sr.rlcdn.com	nexus.ensighten.com
1	contents3.00110.citi.com	online.citi.com
1	20766699p.rfihub.com	c1.rfihub.net
1	static-assets.fs.liveperson.com	lptag.liveperson.net
1	a.rfihub.com	c1.rfihub.net
1	c1.rfihub.net	nexus.ensighten.com
1	tags.bkrtx.com	nexus.ensighten.com
1	cm.everesttech.net	1 redirects
1	citi.demdex.net	nexus.ensighten.com
1	www.thankyou.com	1 redirects
124	32

This site contains links to these domains. Also see Links.

Domain
www.thankyou.com
citiretailservices.citibankonline.com
www.facebook.com
www.twitter.com
www.youtube.com

Subject Issuer	Validity	Valid
online.citibank.com DigiCert SHA2 Extended Validation Server CA	`2020-03-13` - `2022-05-14`	2 years	crt.sh
nexus.ensighten.com DigiCert SHA2 Secure Server CA	`2020-09-09` - `2021-10-11`	a year	crt.sh
*.demdex.net DigiCert SHA2 High Assurance Server CA	`2018-01-09` - `2021-02-12`	3 years	crt.sh
content22.online.citi.com DigiCert SHA2 Extended Validation Server CA	`2020-07-14` - `2022-08-06`	2 years	crt.sh
foresee.com Amazon	`2020-07-25` - `2021-08-25`	a year	crt.sh
*.liveperson.net COMODO RSA Organization Validation Secure Server CA	`2017-12-17` - `2020-12-16`	3 years	crt.sh
metrics1.citi.com DigiCert SHA2 Extended Validation Server CA	`2020-07-02` - `2022-08-30`	2 years	crt.sh
*.google-analytics.com GTS CA 1O1	`2020-09-03` - `2020-11-26`	3 months	crt.sh
*.bkrtx.com DigiCert SHA2 Secure Server CA	`2020-02-28` - `2021-05-29`	a year	crt.sh
*.rfihub.net DigiCert SHA2 Secure Server CA	`2020-04-01` - `2021-07-01`	a year	crt.sh
*.rfihub.com Sectigo RSA Domain Validation Secure Server CA	`2020-06-18` - `2022-06-18`	2 years	crt.sh
chat.online.citi.com DigiCert SHA2 Extended Validation Server CA	`2019-11-01` - `2022-01-25`	2 years	crt.sh
fs.liveperson.com Amazon	`2020-08-23` - `2021-09-23`	a year	crt.sh
contents1.00110.citi.com DigiCert SHA2 Extended Validation Server CA	`2020-08-10` - `2022-08-10`	2 years	crt.sh
*.rlcdn.com Sectigo RSA Domain Validation Secure Server CA	`2020-04-14` - `2021-04-23`	a year	crt.sh
*.digital-cloud-citi.medallia.com SSL.com DV CA	`2018-11-13` - `2020-11-12`	2 years	crt.sh
*.pbbl.co Amazon	`2020-01-01` - `2021-02-01`	a year	crt.sh
odc-prod-01.oracle.com DigiCert Secure Site ECC CA-1	`2020-04-14` - `2021-04-10`	a year	crt.sh
h.online-metrix.net Trustwave Organization Validation SHA256 CA, Level 1	`2020-02-20` - `2021-02-19`	a year	crt.sh
*.e.aa.online-metrix.net Go Daddy Secure Certificate Authority - G2	`2019-09-13` - `2021-09-13`	2 years	crt.sh
j.ssl.fastly.net GlobalSign Organization Validation CA - SHA256 - G2	`2020-08-24` - `2022-08-21`	2 years	crt.sh
px0.pbbl.co GTS CA 1D2	`2020-08-29` - `2020-11-27`	3 months	crt.sh
*.kampyle.com RapidSSL RSA CA 2018	`2020-02-11` - `2022-03-06`	2 years	crt.sh

This page contains 15 frames:

Primary Page: https://online.citi.com/US/JSO/signon/DisplayUsernameSignon.do?userType=tyLogin&locale=en_US&TYNewUser=false&TYForgotUUID=false&TYMigration=&SAMLPostURL=https://www.thankyou.com//gateway2.htm&ErrorCode=&TYPostURL=https://www.thankyou.com//tyLoginGateway.htm&cmp=EMC-CRG0780012.01
Frame ID: CCF4527070453CCBAF42E53E92E219B8
Requests: 89 HTTP requests in this frame

Frame: https://citi.demdex.net/dest5.html?d_nsid=0
Frame ID: 136BC26479AA606826492E5CD688FC65
Requests: 1 HTTP requests in this frame

Frame: https://20766699p.rfihub.com/ca.html?rfiidc=1871878971826550442&rfiaid=5344eddb4ef74dd8a4ef7411f4845e08&ver=9&ra=1467&rb=648&ca=20766699&_o=17169175&_t=thankyousignonpage&ssv_cuuid=&ssv_package=null&ssv_prodlist=null&ssv_pagename=thankyousignonpage&pe=https%3A%2F%2Fonline.citi.com%2FUS%2FJSO%2Fsignon%2FDisplayUsernameSignon.do%3FuserType%3DtyLogin%26locale%3Den_US%26TYNewUser%3Dfalse%26TYForgotUUID%3Dfalse%26TYMigration%3D%26SAMLPostURL%3Dhttps%3A%2F%2Fwww.thankyou.com%2F%2Fgateway2.htm%26ErrorCode%3D%26TYPostURL%3Dhttps%3A%2F%2Fwww.thankyou.com%2F%2FtyLoginGateway.htm%26cmp%3DEMC-CRG0780012.01&pf=&ra=8469396024789038
Frame ID: E06E5293429B3B424462618A671CF257
Requests: 1 HTTP requests in this frame

Frame: https://sr.rlcdn.com/425466.html?es=80676&u=da39a3ee5e6b4b0d3255bfef95601890afd80709
Frame ID: 8EDD0AD9005B5C80550628779C37B63A
Requests: 1 HTTP requests in this frame

Frame: https://content22.online.citi.com/fp/check.js;CIS3SID=67976A93C8D450F65E37A1CD641DB509?org_id=89oebq5k&session_id=cf40e4849e45711ff9ddabe667b837a5426267c7c86bb19a726ed881cc7102e3&nonce=b40b017a1adcd64d&pageid=1&jb=313526266a736775354c696e7778266871673d4c696c757a2468716a3f4168726f6f672730323a31
Frame ID: 0976095DFEA3BAD892ABCDFCFD271D85
Requests: 11 HTTP requests in this frame

Frame: https://stags.bluekai.com/site/63068?ret=html&phint=language%3DEnglish&phint=product%3D&phint=event&phint=category%3Dprelogin%20sign%20on%20page&phint=page%3Dthankyou%20signon%20page&phint=section1%3Dother&phint=section2%3Dpublic&phint=section3%3Dthankyou&phint=section4%3Dsignon&phint=bankappstatus&phint=productID&phint=__bk_t%3DCiti%20ThankYou%C2%AE%20Rewards%20%3F%20Sign%20On&phint=__bk_k%3D&phint=__bk_l%3Dhttps%3A%2F%2Fonline.citi.com%2FUS%2FJSO%2Fsignon%2FDisplayUsernameSignon.do%3FuserType%3DtyLogin%26locale%3Den_US%26TYNewUser%3Dfalse%26TYForgotUUID%3Dfalse%26TYMigration%3D%26SAMLPostURL%3Dhttps%3A%2F%2Fwww.thankyou.com%2F%2Fgateway2.htm%26ErrorCode%3D%26TYPostURL%3Dhttps%3A%2F%2Fwww.thankyou.com%2F%2FtyLoginGateway.htm%26cmp%3DEMC-CRG0780012.01&phint=__bk_v%3D3.1.6&limit=10&r=33734178
Frame ID: 66E995CC1828A7E66DD1957CB21C66EC
Requests: 1 HTTP requests in this frame

Frame: https://lpcdn.chat.online.citi.com/le_secure_storage/3.10.0.1-release_5033/storage.secure.min.html?loc=https%3A%2F%2Fonline.citi.com&site=50929468&env=prod
Frame ID: AF4B0BD11B9D9A2EE3A05D671B9B70D1
Requests: 1 HTTP requests in this frame

Frame: https://content22.online.citi.com/fp/check.js;CIS3SID=40DB560ABF04134584AF178535767951?org_id=89oebq5k&session_id=7959029db1a8d9b4b554fe6564f43bf1d57a69340cdd92a73beb688ce71dded6&nonce=22322e055d970a9b&pageid=1&jb=313f262e6a7167753f4c69667570246a716f3d4c6b6e7778246a71623f416a726f6d672530383a33
Frame ID: CDA9358ADBB2C0B598A09D54F21D07BE
Requests: 11 HTTP requests in this frame

Frame: https://cdn.pbbl.co/i/pp.html
Frame ID: F7E75899E2C305AD63454209392DAFDC
Requests: 1 HTTP requests in this frame

Frame: https://content22.online.citi.com/fp/ls_fp.html;CIS3SID=67976A93C8D450F65E37A1CD641DB509?org_id=89oebq5k&session_id=cf40e4849e45711ff9ddabe667b837a5426267c7c86bb19a726ed881cc7102e3&nonce=b40b017a1adcd64d&pageid=1
Frame ID: 3B4DBC0F14EFC6C1329ADEFBCF343E60
Requests: 2 HTTP requests in this frame

Frame: https://h.online-metrix.net/fp/sid_fp.html;CIS3SID=67976A93C8D450F65E37A1CD641DB509?org_id=89oebq5k&session_id=cf40e4849e45711ff9ddabe667b837a5426267c7c86bb19a726ed881cc7102e3&nonce=b40b017a1adcd64d&pageid=1
Frame ID: 7322BFAA3AA2F04CD0158DC8F7263114
Requests: 1 HTTP requests in this frame

Frame: https://content22.online.citi.com/fp/top_fp.html;CIS3SID=67976A93C8D450F65E37A1CD641DB509?org_id=89oebq5k&session_id=cf40e4849e45711ff9ddabe667b837a5426267c7c86bb19a726ed881cc7102e3&nonce=b40b017a1adcd64d&pageid=1
Frame ID: C68CCE15A043B5396E460593068391AC
Requests: 1 HTTP requests in this frame

Frame: https://content22.online.citi.com/fp/ls_fp.html;CIS3SID=40DB560ABF04134584AF178535767951?org_id=89oebq5k&session_id=7959029db1a8d9b4b554fe6564f43bf1d57a69340cdd92a73beb688ce71dded6&nonce=22322e055d970a9b&pageid=1
Frame ID: 7BFB61762CECBD809DEB4B8EB39FAC58
Requests: 2 HTTP requests in this frame

Frame: https://h.online-metrix.net/fp/sid_fp.html;CIS3SID=40DB560ABF04134584AF178535767951?org_id=89oebq5k&session_id=7959029db1a8d9b4b554fe6564f43bf1d57a69340cdd92a73beb688ce71dded6&nonce=22322e055d970a9b&pageid=1
Frame ID: 1C11D443723A0322232DB96CF59AB37F
Requests: 1 HTTP requests in this frame

Frame: https://content22.online.citi.com/fp/top_fp.html;CIS3SID=40DB560ABF04134584AF178535767951?org_id=89oebq5k&session_id=7959029db1a8d9b4b554fe6564f43bf1d57a69340cdd92a73beb688ce71dded6&nonce=22322e055d970a9b&pageid=1
Frame ID: E26C4F771A6B7B78B1966761BCA687E8
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

http://thankyou.citi.com/T/v500000174d9f614ad97b26af4bbe5cfc0/3bf2bdb046d54a330000021ef3a0bcc3/3bf2bd... HTTP 302
https://thankyou.citi.com/T/v500000174d9f614ad97b26af4bbe5cfc0/3bf2bdb046d54a330000021ef3a0bcc3/3bf2bd... HTTP 302
https://www.thankyou.com/pointsSummary.htm?cmp=EMC-CRG0780012.01&LID=cardart&OID=email&MID=header_CBS... HTTP 302
https://online.citi.com/US/JSO/signon/DisplayUsernameSignon.do?userType=tyLogin&locale=en_US&TYNewUs... Page URL

Page Statistics

124
Requests

99 %
HTTPS

16 %
IPv6

19
Domains

32
Subdomains

28
IPs

7
Countries

2240 kB
Transfer

6508 kB
Size

22
Cookies

10 Outgoing links

These are links going to different origins than the main page.

URL: https://www.thankyou.com/cms/thankyou?cmp=nav&lid=header%7Clogo

Search URL Search Domain Scan URL

URL: https://www.thankyou.com/forgotPasswordLanding.htm
Title: Forgot User ID or Password?

Search URL Search Domain Scan URL

URL: https://citiretailservices.citibankonline.com/RSnextgen/svc/registration/index.action?siteId=SEARS&langId=en_US#verify
Title: Register SearsCard.com account

Search URL Search Domain Scan URL

URL: https://www.thankyou.com/registrationLanding.htm
Title: Register your ThankYou.com account

Search URL Search Domain Scan URL

URL: https://www.thankyou.com/tc.jspx?cmp=nav&lid=footer%7Cterms-and-conditions
Title: ThankYou Rewards Terms and Conditions

Search URL Search Domain Scan URL

URL: https://www.thankyou.com/privacyStmt.jspx?cmp=NAV&LID=footer%7Cprivacy
Title: Privacy

Search URL Search Domain Scan URL

URL: https://www.thankyou.com/security.jspx?cmp=NAV&LID=footer%7Csecurity
Title: Security

Search URL Search Domain Scan URL

URL: https://www.facebook.com/citi
Title:

Search URL Search Domain Scan URL

URL: https://www.twitter.com/citi
Title:

Search URL Search Domain Scan URL

URL: https://www.youtube.com/citi
Title:

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://thankyou.citi.com/T/v500000174d9f614ad97b26af4bbe5cfc0/3bf2bdb046d54a330000021ef3a0bcc3/3bf2bdb0-46d5-4a33-94ae-df8336ca9242?__dU__=v0G4RBKTXg2Gs5BnssqDWhgDWVXpKy0GrsB2gabaYTn6rYFBs0LdIJkA==&__F__=v0fUYvjHMDjRPMSh3tviDHXIoXcPxvDgUUCCPvXMWoX_0JoZLAZABQF5BnkC6ALMKVVKovhFqYdDDXSc0qSmoB9Wcsw7WSb2bfKXzLETwZlPHrHhBEm4Wo8bMSnVudVYD2VU3Gqe91T1x_GgSgzZcNuiGdauK_lAHEReFwOra78tjbFzxSnq-wJjumGLy1t-sJHnMDE0CCpcuvKsBzlg-NIsy94g439cFYh6nZxYe6dZLVfh6eS8qCFR6kEjHPVDPbtIRZ6NwqrqTn1EkBxTQL_8OkPY-QoQo3xnXlZR-yo9WnwgKoNtlXxl2Ho0vOXZuzGIKfn1No5ofGLfypOjV7SiQJwen0QfOYB_KsWuWJj90nd9E3wmd4-H2cqZqgg9LhGqBrYeOI9WjEkHuBNNmatlR-iKNF6DLrPMIQqTzq1PNB9Ppeoivq1LLhC89eEjY5YcyeJxsQka_Iz6CB6VbTSDejkSlWl9D8H3P-d5mF3kc= HTTP 302
https://thankyou.citi.com/T/v500000174d9f614ad97b26af4bbe5cfc0/3bf2bdb046d54a330000021ef3a0bcc3/3bf2bdb0-46d5-4a33-94ae-df8336ca9242?__dU__=v0G4RBKTXg2Gs5BnssqDWhgDWVXpKy0GrsB2gabaYTn6rYFBs0LdIJkA==&__F__=v0fUYvjHMDjRPMSh3tviDHXIoXcPxvDgUUCCPvXMWoX_0JoZLAZABQF5BnkC6ALMKVVKovhFqYdDDXSc0qSmoB9Wcsw7WSb2bfKXzLETwZlPHrHhBEm4Wo8bMSnVudVYD2VU3Gqe91T1x_GgSgzZcNuiGdauK_lAHEReFwOra78tjbFzxSnq-wJjumGLy1t-sJHnMDE0CCpcuvKsBzlg-NIsy94g439cFYh6nZxYe6dZLVfh6eS8qCFR6kEjHPVDPbtIRZ6NwqrqTn1EkBxTQL_8OkPY-QoQo3xnXlZR-yo9WnwgKoNtlXxl2Ho0vOXZuzGIKfn1No5ofGLfypOjV7SiQJwen0QfOYB_KsWuWJj90nd9E3wmd4-H2cqZqgg9LhGqBrYeOI9WjEkHuBNNmatlR-iKNF6DLrPMIQqTzq1PNB9Ppeoivq1LLhC89eEjY5YcyeJxsQka_Iz6CB6VbTSDejkSlWl9D8H3P-d5mF3kc= HTTP 302
https://www.thankyou.com/pointsSummary.htm?cmp=EMC-CRG0780012.01&LID=cardart&OID=email&MID=header_CBSD-00142&emaillinkid=card_art&ZID=bottomright&mcell=1010 HTTP 302
https://online.citi.com/US/JSO/signon/DisplayUsernameSignon.do?userType=tyLogin&locale=en_US&TYNewUser=false&TYForgotUUID=false&TYMigration=&SAMLPostURL=https://www.thankyou.com//gateway2.htm&ErrorCode=&TYPostURL=https://www.thankyou.com//tyLoginGateway.htm&cmp=EMC-CRG0780012.01 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 25

https://dpm.demdex.net/id?d_visid_ver=3.1.2&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=61834D9B5228A7430A490D45%40AdobeOrg&d_nsid=0&ts=1601389284642 HTTP 302
https://dpm.demdex.net/id/rd?d_visid_ver=3.1.2&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=61834D9B5228A7430A490D45%40AdobeOrg&d_nsid=0&ts=1601389284642

Request Chain 45

https://cm.everesttech.net/cm/dd?d_uuid=44614461522505419113347224304972832399 HTTP 302
https://dpm.demdex.net/ibs:dpid=411&dpuuid=X3NC5AAAB0ir_BTJ

Request Chain 85

https://metrics1.citi.com/b/ss/citinaprod/1/JS-2.0.0/s63555186440240?AQB=1&ndh=1&pf=1&t=29%2F8%2F2020%2016%3A21%3A27%202%20-120&fid=63F902CF85FB5BD0-15F73831CC713931&ce=UTF-8&pageName=thankyou%20signon%20page&g=https%3A%2F%2Fonline.citi.com%2FUS%2FJSO%2Fsignon%2FDisplayUsernameSignon.do%3FuserType%3DtyLogin%26locale%3Den_US%26TYNewUser%3Dfalse%26TYForgotUUID%3Dfalse%26TYMigration%3D%26SAMLPostURL%3Dhttps%3A%2F%2Fwww.thankyou.com%2F%2Fgateway2.htm%26ErrorCode%3D%26TYPostURL%3Dhttps%3A%2F%2Fwww.thankyou.com%2F%2FtyLoginGateway.h&c.&visitStart=1&.c&cc=USD&ch=us&v0=EMC-CRG0780012.01&c1=other&h1=us%2Fother%2Fpublic%2Fthankyou%2Fsignon&c2=public&c3=thankyou&c4=signon&c8=prelogin%20sign%20on%20page&c9=us&v9=no%20call%2C%20no%20cache&c11=English&c22=thankyou%20signon%20page&c26=no%20value&c37=na_prod&v38=thankyou%20signon%20page&v42=en_US_USTYN&v52=no%20value&c59=jUSCBOL_CustomizedThankYou&c61=21&c63=https%3A%2F%2Fonline.citi.com%2FUS%2FJSO%2Fsignon%2FDisplayUsernameSignon.do%3FuserType%3DtyLogin%26locale%3Den_US%26TYNewUser%3Dfalse%26TYForgotUUID%3Dfalse%26TYMigration%3D%26SAMLPostURL%3Dhttps%3A%2F%2Fwww.thankyou.com%2F%2Fgateway2.htm%26ErrorCode%3D%26TYPostURL%3Dhttps%3A%2F%2Fwww.thankyou.com%2F%2FtyLoginGateway.htm%26cmp%3DEMC-CRG0780012.01&c64=10%3A21AM&v64=10%3A21AM&c65=Tuesday&v65=Tuesday&c66=Tuesday%7C10%3A21AM&v67=New&v68=1&c69=not%20logged%20in&c73=354602%2C578278%2C358910%2C552021%2C373773%2C490004%2C622672%2C624610%2C531459%2C507276%2C600937%2C593700%2C495376%2C495377%2C593103%2C584566%2C495374%2C495375%2C573017%2C522574%2C652314%2C588511%2C639140%2C542251%2C632449%2C522572%2C490141%2C580663%2C626438%2C654259%2C515853%2C522576%2C562734%2C551962%2C582775%2C494437%2C551970%2C571630%2C385436%2C572752%2C609397%2C609396%2C388219%2C569456%2C565689%2C606935%2C512346%2C578262%2C521100%2C578343%2C359218%2C528144%2C488122%2C572750%2C359214%2C486892%2C510670%2C369351&v73=medium%7C1600&v79=3afd3d39-ebdc-416a-825a-65ff4374b3ba&v87=online.citi.com&v96=cl%7Cbos%3Ana%7Cdsa%3Ana%7Cax%3Ano%20call%7Cdsr%3Ana%7Crf%3A-%7Ccms%3A-&v114=%23&s=1600x1200&c=24&j=1.6&v=N&k=Y&bw=1600&bh=1200&-g=tm%26cmp%3DEMC-CRG0780012.01&AQE=1 HTTP 302
https://metrics1.citi.com/b/ss/citinaprod/1/JS-2.0.0/s63555186440240?AQB=1&pccr=true&vidn=2FB9A1740515E5AE-600008C8A338E10E&ndh=1&pf=1&t=29%2F8%2F2020%2016%3A21%3A27%202%20-120&fid=63F902CF85FB5BD0-15F73831CC713931&ce=UTF-8&pageName=thankyou%20signon%20page&g=https%3A%2F%2Fonline.citi.com%2FUS%2FJSO%2Fsignon%2FDisplayUsernameSignon.do%3FuserType%3DtyLogin%26locale%3Den_US%26TYNewUser%3Dfalse%26TYForgotUUID%3Dfalse%26TYMigration%3D%26SAMLPostURL%3Dhttps%3A%2F%2Fwww.thankyou.com%2F%2Fgateway2.htm%26ErrorCode%3D%26TYPostURL%3Dhttps%3A%2F%2Fwww.thankyou.com%2F%2FtyLoginGateway.h&c.&visitStart=1&.c&cc=USD&ch=us&v0=EMC-CRG0780012.01&c1=other&h1=us%2Fother%2Fpublic%2Fthankyou%2Fsignon&c2=public&c3=thankyou&c4=signon&c8=prelogin%20sign%20on%20page&c9=us&v9=no%20call%2C%20no%20cache&c11=English&c22=thankyou%20signon%20page&c26=no%20value&c37=na_prod&v38=thankyou%20signon%20page&v42=en_US_USTYN&v52=no%20value&c59=jUSCBOL_CustomizedThankYou&c61=21&c63=https%3A%2F%2Fonline.citi.com%2FUS%2FJSO%2Fsignon%2FDisplayUsernameSignon.do%3FuserType%3DtyLogin%26locale%3Den_US%26TYNewUser%3Dfalse%26TYForgotUUID%3Dfalse%26TYMigration%3D%26SAMLPostURL%3Dhttps%3A%2F%2Fwww.thankyou.com%2F%2Fgateway2.htm%26ErrorCode%3D%26TYPostURL%3Dhttps%3A%2F%2Fwww.thankyou.com%2F%2FtyLoginGateway.htm%26cmp%3DEMC-CRG0780012.01&c64=10%3A21AM&v64=10%3A21AM&c65=Tuesday&v65=Tuesday&c66=Tuesday%7C10%3A21AM&v67=New&v68=1&c69=not%20logged%20in&c73=354602%2C578278%2C358910%2C552021%2C373773%2C490004%2C622672%2C624610%2C531459%2C507276%2C600937%2C593700%2C495376%2C495377%2C593103%2C584566%2C495374%2C495375%2C573017%2C522574%2C652314%2C588511%2C639140%2C542251%2C632449%2C522572%2C490141%2C580663%2C626438%2C654259%2C515853%2C522576%2C562734%2C551962%2C582775%2C494437%2C551970%2C571630%2C385436%2C572752%2C609397%2C609396%2C388219%2C569456%2C565689%2C606935%2C512346%2C578262%2C521100%2C578343%2C359218%2C528144%2C488122%2C572750%2C359214%2C486892%2C510670%2C369351&v73=medium%7C1600&v79=3afd3d39-ebdc-416a-825a-65ff4374b3ba&v87=online.citi.com&v96=cl%7Cbos%3Ana%7Cdsa%3Ana%7Cax%3Ano%20call%7Cdsr%3Ana%7Crf%3A-%7Ccms%3A-&v114=%23&s=1600x1200&c=24&j=1.6&v=N&k=Y&bw=1600&bh=1200&-g=tm%26cmp%3DEMC-CRG0780012.01&AQE=1

Request Chain 92

https://px0.pbbl.co/ns/__p2.gif?ppid=667e9e17-f3e5-4a2b-bd90-6c1a5ef55003&chk=false&brid=1560&brcid=&email=&orderId=&orderValue=&productId=&offerCode=&label=&pageUrl=https%3A%2F%2Fonline.citi.com%2FUS%2FJSO%2Fsignon%2FDisplayUsernameSignon.do%3FuserType%3DtyLogin%26locale%3Den_US%26TYNewUser%3Dfalse%26TYForgotUUID%3Dfalse%26TYMigration%3D%26SAMLPostURL%3Dhttps%3A%2F%2Fwww.thankyou.com%2F%2Fgateway2.htm%26ErrorCode%3D%26TYPostURL%3Dhttps%3A%2F%2Fwww.thankyou.com%2F%2FtyLoginGateway.htm%26cmp%3DEMC-CRG0780012.01&referrerUrl=&targetUrl=https%3A%2F%2Fonline.citi.com%2FUS%2FJSO%2Fsignon%2FDisplayUsernameSignon.do%3FuserType%3DtyLogin%26locale%3Den_US%26TYNewUser%3Dfalse%26TYForgotUUID%3Dfalse%26TYMigration%3D%26SAMLPostURL%3Dhttps%3A%2F%2Fwww.thankyou.com%2F%2Fgateway2.htm%26ErrorCode%3D%26TYPostURL%3Dhttps%3A%2F%2Fwww.thankyou.com%2F%2FtyLoginGateway.htm%26cmp%3DEMC-CRG0780012.01&sessionId=&markerType=seg&rand=eiTgqyIMx1T8mSkI&iabOptOut=-&jsVer=3.2.1&frVer=1.1&markerId=348192 HTTP 302
https://aa.agkn.com/adscores/g.pixel?sid=9212282598&_ppid=667e9e17-f3e5-4a2b-bd90-6c1a5ef55003&_segid=99&iid=64d96b3d-fa9e-4836-bb74-bb3c120f6d08 HTTP 302
https://px0.pbbl.co/adadvisor.gif?segment=000&_ppid=667e9e17-f3e5-4a2b-bd90-6c1a5ef55003&_segid=99&_zip=&hk=&iid=64d96b3d-fa9e-4836-bb74-bb3c120f6d08&mt=&bd=

124 HTTP transactions
1 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

Primary Request DisplayUsernameSignon.do Show response
online.citi.com/US/JSO/signon/
Redirect Chain

http://thankyou.citi.com/T/v500000174d9f614ad97b26af4bbe5cfc0/3bf2bdb046d54a330000021ef3a0bcc3/3bf2bdb0-46d5-4a33-94ae-df8336ca9242?__dU__=v0G4RBKTXg2Gs5BnssqDWhgDWVXpKy0GrsB2gabaYTn6rYFBs0LdIJkA==...
https://thankyou.citi.com/T/v500000174d9f614ad97b26af4bbe5cfc0/3bf2bdb046d54a330000021ef3a0bcc3/3bf2bdb0-46d5-4a33-94ae-df8336ca9242?__dU__=v0G4RBKTXg2Gs5BnssqDWhgDWVXpKy0GrsB2gabaYTn6rYFBs0LdIJkA=...
https://www.thankyou.com/pointsSummary.htm?cmp=EMC-CRG0780012.01&LID=cardart&OID=email&MID=header_CBSD-00142&emaillinkid=card_art&ZID=bottomright&mcell=1010
https://online.citi.com/US/JSO/signon/DisplayUsernameSignon.do?userType=tyLogin&locale=en_US&TYNewUser=false&TYForgotUUID=false&TYMigration=&SAMLPostURL=https://www.thankyou.com//gateway2.htm&Error...

256 KB
129 KB

450ms
400ms

Document
text/html

104.109.92.187
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://online.citi.com/US/JSO/signon/DisplayUsernameSignon.do?userType=tyLogin&locale=en_US&TYNewUser=false&TYForgotUUID=false&TYMigration=&SAMLPostURL=https://www.thankyou.com//gateway2.htm&ErrorCode=&TYPostURL=https://www.thankyou.com//tyLoginGateway.htm&cmp=EMC-CRG0780012.01

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.109.92.187 , Netherlands, ASN20940 (AKAMAI-ASN1, EU),

Reverse DNS

a104-109-92-187.deploy.static.akamaitechnologies.com

Software

Resource Hash

a2d6045bdb7627674cfbca5eabfba0b1ce71fee823c99bf19ca492693aecf936

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

:method: GET
:authority: online.citi.com
:scheme: https
:path: /US/JSO/signon/DisplayUsernameSignon.do?userType=tyLogin&locale=en_US&TYNewUser=false&TYForgotUUID=false&TYMigration=&SAMLPostURL=https://www.thankyou.com//gateway2.htm&ErrorCode=&TYPostURL=https://www.thankyou.com//tyLoginGateway.htm&cmp=EMC-CRG0780012.01
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: none
sec-fetch-mode: navigate
sec-fetch-user: ?1
sec-fetch-dest: document
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

status: 200
content-type: text/html; charset=ISO-8859-1
x-ion-hop: Prod
expires: 0
cache-control: no-cache, no-store, must-revalidate
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
pragma: no-cache
x-akamai-citisite: GTDC
strict-transport-security: max-age=300
content-language: en-US
x-debug-tier2-parent: 21c8590f-96.7.75.87-1601389284-AUTH1-SHPIP23.198.10.127-TCIP185.212.171.67
jid: 200929102124650134007059 200929102124650134007059
x-ua-compatible: IE=edge IE=edge
x-debug-tier2: 46620709-23.198.10.127-1601389284-AUTH1-SHPIP64.124.125.235-TCIP185.212.171.67
vary: Accept-Encoding
content-encoding: gzip
date: Tue, 29 Sep 2020 14:21:24 GMT
content-length: 130551
set-cookie: JSESSIONID=0000j99BRthUiDN58S2XECbKJ7Q:gt67p-srv1; Path=/; Secure; HttpOnly TLTSID=07a058985e5de6f7e7e2f46178defd9d7a95a59c4e92c4ad61e498762ef873f9; Path=/; Domain=citi.com; Secure AKMTLTSID=06509A6CDAF32B2D29F7FB301A0AA06C; path=/; domain=citi.com; secure CITI_SITE=gtdc; path=/; domain=.citi.com; secure; HttpOnly AKMTLTSID=AB4143A921A01B10C84B23141734329F; path=/; domain=citi.com; secure CITI_SITE=gtdc; path=/; domain=.citi.com; secure; HttpOnly
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

Redirect headers

Cache-Control: no-cache, no-store, must-revalidate
Connection: close
Date: Tue, 29 Sep 2020 14:21:23 GMT
Pragma: no-cache
Location: https://online.citi.com/US/JSO/signon/DisplayUsernameSignon.do?userType=tyLogin&locale=en_US&TYNewUser=false&TYForgotUUID=false&TYMigration=&SAMLPostURL=https://www.thankyou.com//gateway2.htm&ErrorCode=&TYPostURL=https://www.thankyou.com//tyLoginGateway.htm&cmp=EMC-CRG0780012.01
Content-Length: 819
Content-Type: text/html
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Content-Language: us-ENG
Access-Control-Allow-Headers: x-tygr-token
Set-Cookie: CSESSIONID=22ecf6ecdc134ebd9e286cdfa09504ae4c739727c061cc2df3e9!-1726528001; path=/; secure; HttpOnly
Access-Control-Allow-Credentials: true
X-FRAME-OPTIONS: SAMEORIGIN

GET
H2 200 vendor.js Show response
online.citi.com/CBOL/common/ui/ddl/theme/latest/scripts/ 204 KB
64 KB 122ms
117ms Script
application/x-javascript 104.109.92.187
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://online.citi.com/CBOL/common/ui/ddl/theme/latest/scripts/vendor.js

Requested by

Host: online.citi.com
URL: https://online.citi.com/US/JSO/signon/DisplayUsernameSignon.do?userType=tyLogin&locale=en_US&TYNewUser=false&TYForgotUUID=false&TYMigration=&SAMLPostURL=https://www.thankyou.com//gateway2.htm&ErrorCode=&TYPostURL=https://www.thankyou.com//tyLoginGateway.htm&cmp=EMC-CRG0780012.01

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.109.92.187 , Netherlands, ASN20940 (AKAMAI-ASN1, EU),

Reverse DNS

a104-109-92-187.deploy.static.akamaitechnologies.com

Software

Resource Hash

03c736ca1c90e26743865ed80c9766f84ca237b0dc572fab630737aaef70d171

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

Referer: https://online.citi.com/US/JSO/signon/DisplayUsernameSignon.do?userType=tyLogin&locale=en_US&TYNewUser=false&TYForgotUUID=false&TYMigration=&SAMLPostURL=https://www.thankyou.com//gateway2.htm&ErrorCode=&TYPostURL=https://www.thankyou.com//tyLoginGateway.htm&cmp=EMC-CRG0780012.01
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=300
content-encoding: gzip
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
status: 200
content-length: 64910
pragma: no-cache
last-modified: Tue, 12 Sep 2017 17:20:58 GMT
x-akamai-citisite: GTDC
date: Tue, 29 Sep 2020 14:21:24 GMT
vary: Accept-Encoding
content-type: application/x-javascript
cache-control: no-cache, no-store, must-revalidate
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
expires: Tue, 29 Sep 2020 14:21:24 GMT

GET
H2 200 tagging.js Show response
online.citi.com/CBOL/taggingTransformation/ 58 KB
12 KB 121ms
117ms Script
application/x-javascript 104.109.92.187
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://online.citi.com/CBOL/taggingTransformation/tagging.js

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.109.92.187 , Netherlands, ASN20940 (AKAMAI-ASN1, EU),

Reverse DNS

a104-109-92-187.deploy.static.akamaitechnologies.com

Software

Resource Hash

ec5a129cf3f2a541423927ce779d4a85dbf647615eeb3c694bc2940fae70fae4

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

Referer: https://online.citi.com/US/JSO/signon/DisplayUsernameSignon.do?userType=tyLogin&locale=en_US&TYNewUser=false&TYForgotUUID=false&TYMigration=&SAMLPostURL=https://www.thankyou.com//gateway2.htm&ErrorCode=&TYPostURL=https://www.thankyou.com//tyLoginGateway.htm&cmp=EMC-CRG0780012.01
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=300
content-encoding: gzip
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
status: 200
content-length: 11937
pragma: no-cache
last-modified: Mon, 31 Aug 2020 21:03:42 GMT
x-akamai-citisite: GTDC
date: Tue, 29 Sep 2020 14:21:24 GMT
vary: Accept-Encoding
content-type: application/x-javascript
cache-control: no-cache, no-store, must-revalidate
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
expires: Tue, 29 Sep 2020 14:21:24 GMT

GET
H2 200 ddl.min.css
online.citi.com/CBOL/common/ui/ddl/theme/latest/styles/ 624 KB
69 KB 57ms
53ms Stylesheet
text/css 104.109.92.187
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://online.citi.com/CBOL/common/ui/ddl/theme/latest/styles/ddl.min.css

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.109.92.187 , Netherlands, ASN20940 (AKAMAI-ASN1, EU),

Reverse DNS

a104-109-92-187.deploy.static.akamaitechnologies.com

Software

Resource Hash

fdaf50ba7dfdf74a600dbb9a28a4ebfc536486d8f1e23296d7dfb33d843e1c3b

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

Referer: https://online.citi.com/US/JSO/signon/DisplayUsernameSignon.do?userType=tyLogin&locale=en_US&TYNewUser=false&TYForgotUUID=false&TYMigration=&SAMLPostURL=https://www.thankyou.com//gateway2.htm&ErrorCode=&TYPostURL=https://www.thankyou.com//tyLoginGateway.htm&cmp=EMC-CRG0780012.01
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=300
content-encoding: gzip
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
status: 200
content-length: 69731
pragma: no-cache
last-modified: Wed, 15 Jul 2020 06:51:10 GMT
x-akamai-citisite: GTDC
date: Tue, 29 Sep 2020 14:21:24 GMT
vary: Accept-Encoding
content-type: text/css
cache-control: no-cache, no-store, must-revalidate
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
expires: Tue, 29 Sep 2020 14:21:24 GMT

GET
H2 200 jfpm.autocomplete.off.js Show response
online.citi.com/JFP/js/modules/ 1 KB
864 B 158ms
156ms Script
application/x-javascript 104.109.92.187
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://online.citi.com/JFP/js/modules/jfpm.autocomplete.off.js

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.109.92.187 , Netherlands, ASN20940 (AKAMAI-ASN1, EU),

Reverse DNS

a104-109-92-187.deploy.static.akamaitechnologies.com

Software

Resource Hash

9dad502247a8488c21ef5beb32aed1a78b17b748711bec817c472911f76b4ead

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

Referer: https://online.citi.com/US/JSO/signon/DisplayUsernameSignon.do?userType=tyLogin&locale=en_US&TYNewUser=false&TYForgotUUID=false&TYMigration=&SAMLPostURL=https://www.thankyou.com//gateway2.htm&ErrorCode=&TYPostURL=https://www.thankyou.com//tyLoginGateway.htm&cmp=EMC-CRG0780012.01
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=300
content-encoding: gzip
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
status: 200
content-length: 344
pragma: no-cache
last-modified: Tue, 12 Sep 2017 16:59:12 GMT
x-akamai-citisite: GTDC
date: Tue, 29 Sep 2020 14:21:24 GMT
vary: Accept-Encoding
content-type: application/x-javascript
cache-control: no-cache, no-store, must-revalidate
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
expires: Tue, 29 Sep 2020 14:21:24 GMT

GET
H2 200 main_branding.css
online.citi.com/GFC/branding/responsivebranding/css/ 273 KB
43 KB 49ms
46ms Stylesheet
text/css 104.109.92.187
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://online.citi.com/GFC/branding/responsivebranding/css/main_branding.css

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.109.92.187 , Netherlands, ASN20940 (AKAMAI-ASN1, EU),

Reverse DNS

a104-109-92-187.deploy.static.akamaitechnologies.com

Software

Resource Hash

242cb1fe2274ec738de60067a2c54568126e01792e55d2db82f8cfb48cbb4f24

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

Referer: https://online.citi.com/US/JSO/signon/DisplayUsernameSignon.do?userType=tyLogin&locale=en_US&TYNewUser=false&TYForgotUUID=false&TYMigration=&SAMLPostURL=https://www.thankyou.com//gateway2.htm&ErrorCode=&TYPostURL=https://www.thankyou.com//tyLoginGateway.htm&cmp=EMC-CRG0780012.01
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=300
content-encoding: gzip
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
status: 200
content-length: 43751
pragma: no-cache
last-modified: Tue, 05 May 2020 09:06:51 GMT
x-akamai-citisite: GTDC
date: Tue, 29 Sep 2020 14:21:24 GMT
vary: Accept-Encoding
content-type: text/css
cache-control: no-cache, no-store, must-revalidate
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
expires: Tue, 29 Sep 2020 14:21:24 GMT

GET
H2 200 footer.css
online.citi.com/GFC/branding/ThankYou/css/ 3 KB
1 KB 64ms
61ms Stylesheet
text/css 104.109.92.187
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://online.citi.com/GFC/branding/ThankYou/css/footer.css

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.109.92.187 , Netherlands, ASN20940 (AKAMAI-ASN1, EU),

Reverse DNS

a104-109-92-187.deploy.static.akamaitechnologies.com

Software

Resource Hash

c6c40bd3fc6c2adebe8d892bcbed92c03ee4dbe582f6304f9eee4ae365bdcdfb

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

Referer: https://online.citi.com/US/JSO/signon/DisplayUsernameSignon.do?userType=tyLogin&locale=en_US&TYNewUser=false&TYForgotUUID=false&TYMigration=&SAMLPostURL=https://www.thankyou.com//gateway2.htm&ErrorCode=&TYPostURL=https://www.thankyou.com//tyLoginGateway.htm&cmp=EMC-CRG0780012.01
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=300
content-encoding: gzip
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
status: 200
content-length: 667
pragma: no-cache
last-modified: Tue, 12 Sep 2017 17:22:45 GMT
x-akamai-citisite: GTDC
date: Tue, 29 Sep 2020 14:21:24 GMT
vary: Accept-Encoding
content-type: text/css
cache-control: no-cache, no-store, must-revalidate
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
expires: Tue, 29 Sep 2020 14:21:24 GMT

GET
H2 200 Bootstrap.js Show response
nexus.ensighten.com/citi/na_prod/ 278 KB
91 KB 95ms
44ms Script
application/javascript 18.195.42.228
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Requested by: Host: online.citi.com
URL: https://online.citi.com/US/JSO/signon/DisplayUsernameSignon.do?userType=tyLogin&locale=en_US&TYNewUser=false&TYForgotUUID=false&TYMigration=&SAMLPostURL=https://www.thankyou.com//gateway2.htm&ErrorCode=&TYPostURL=https://www.thankyou.com//tyLoginGateway.htm&cmp=EMC-CRG0780012.01
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 18.195.42.228 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-195-42-228.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 526ecbfda04e308f90edb0153c851212c52048dc779fd0b2ad7c07f30757864f

Request headers

Referer: https://online.citi.com/US/JSO/signon/DisplayUsernameSignon.do?userType=tyLogin&locale=en_US&TYNewUser=false&TYForgotUUID=false&TYMigration=&SAMLPostURL=https://www.thankyou.com//gateway2.htm&ErrorCode=&TYPostURL=https://www.thankyou.com//tyLoginGateway.htm&cmp=EMC-CRG0780012.01
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 29 Sep 2020 14:21:24 GMT
content-encoding: gzip
last-modified: Tue, 29 Sep 2020 14:03:58 GMT
server: nginx
etag: W/"5f733ece-457bb"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
status: 200
cache-control: max-age=300

GET
H2 200 homePage.min.css
online.citi.com/loginpage/styles/ 24 KB
5 KB 103ms
101ms Stylesheet
text/css 104.109.92.187
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://online.citi.com/loginpage/styles/homePage.min.css

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.109.92.187 , Netherlands, ASN20940 (AKAMAI-ASN1, EU),

Reverse DNS

a104-109-92-187.deploy.static.akamaitechnologies.com

Software

Resource Hash

ed48ae9c1a324d49404d9fb4c508b880ca97a65f8fd21d352e241d1e4dfc50e2

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

Referer: https://online.citi.com/US/JSO/signon/DisplayUsernameSignon.do?userType=tyLogin&locale=en_US&TYNewUser=false&TYForgotUUID=false&TYMigration=&SAMLPostURL=https://www.thankyou.com//gateway2.htm&ErrorCode=&TYPostURL=https://www.thankyou.com//tyLoginGateway.htm&cmp=EMC-CRG0780012.01
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=300
content-encoding: gzip
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
status: 200
content-length: 5032
pragma: no-cache
last-modified: Tue, 12 Jun 2018 05:31:28 GMT
x-akamai-citisite: GTDC
date: Tue, 29 Sep 2020 14:21:24 GMT
vary: Accept-Encoding
content-type: text/css
cache-control: no-cache, no-store, must-revalidate
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
expires: Tue, 29 Sep 2020 14:21:24 GMT

GET
H2 200 jquery.tmpl.js Show response
online.citi.com/JFP/js/jquery/plugins/ 6 KB
3 KB 130ms
128ms Script
application/x-javascript 104.109.92.187
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://online.citi.com/JFP/js/jquery/plugins/jquery.tmpl.js

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.109.92.187 , Netherlands, ASN20940 (AKAMAI-ASN1, EU),

Reverse DNS

a104-109-92-187.deploy.static.akamaitechnologies.com

Software

Resource Hash

629b48196dcc270143a42ce57535b251c655617f8d510277d4a05306c426fd38

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

Referer: https://online.citi.com/US/JSO/signon/DisplayUsernameSignon.do?userType=tyLogin&locale=en_US&TYNewUser=false&TYForgotUUID=false&TYMigration=&SAMLPostURL=https://www.thankyou.com//gateway2.htm&ErrorCode=&TYPostURL=https://www.thankyou.com//tyLoginGateway.htm&cmp=EMC-CRG0780012.01
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=300
content-encoding: gzip
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
status: 200
content-length: 2905
pragma: no-cache
last-modified: Tue, 12 Sep 2017 16:59:12 GMT
x-akamai-citisite: GTDC
date: Tue, 29 Sep 2020 14:21:24 GMT
vary: Accept-Encoding
content-type: application/x-javascript
cache-control: no-cache, no-store, must-revalidate
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
expires: Tue, 29 Sep 2020 14:21:24 GMT

GET
H2 200 fp.min.js Show response
online.citi.com/JSO/js/ 15 KB
5 KB 195ms
193ms Script
application/x-javascript 104.109.92.187
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://online.citi.com/JSO/js/fp.min.js

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.109.92.187 , Netherlands, ASN20940 (AKAMAI-ASN1, EU),

Reverse DNS

a104-109-92-187.deploy.static.akamaitechnologies.com

Software

Resource Hash

c3c994c3fe9bd4e055f6d0eb42067ecd6bdd3247e136bc22835b9882cfe77c61

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

Referer: https://online.citi.com/US/JSO/signon/DisplayUsernameSignon.do?userType=tyLogin&locale=en_US&TYNewUser=false&TYForgotUUID=false&TYMigration=&SAMLPostURL=https://www.thankyou.com//gateway2.htm&ErrorCode=&TYPostURL=https://www.thankyou.com//tyLoginGateway.htm&cmp=EMC-CRG0780012.01
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=300
content-encoding: gzip
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
status: 200
content-length: 4322
pragma: no-cache
last-modified: Tue, 12 Sep 2017 17:12:07 GMT
x-akamai-citisite: GTDC
date: Tue, 29 Sep 2020 14:21:24 GMT
vary: Accept-Encoding
content-type: application/x-javascript
cache-control: no-cache, no-store, must-revalidate
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
expires: Tue, 29 Sep 2020 14:21:24 GMT

GET
H2 200 bcsid.js Show response
online.citi.com/passivebio/ 947 B
947 B 155ms
153ms Script
application/x-javascript 104.109.92.187
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://online.citi.com/passivebio/bcsid.js

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.109.92.187 , Netherlands, ASN20940 (AKAMAI-ASN1, EU),

Reverse DNS

a104-109-92-187.deploy.static.akamaitechnologies.com

Software

Resource Hash

7d481eb36581746fd3662c7c452856b695df90cdce24664c48f565aa119c8b16

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

Referer: https://online.citi.com/US/JSO/signon/DisplayUsernameSignon.do?userType=tyLogin&locale=en_US&TYNewUser=false&TYForgotUUID=false&TYMigration=&SAMLPostURL=https://www.thankyou.com//gateway2.htm&ErrorCode=&TYPostURL=https://www.thankyou.com//tyLoginGateway.htm&cmp=EMC-CRG0780012.01
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=300
content-encoding: gzip
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
status: 200
content-length: 427
pragma: no-cache
last-modified: Tue, 30 Oct 2018 06:18:02 GMT
x-akamai-citisite: GTDC
date: Tue, 29 Sep 2020 14:21:24 GMT
vary: Accept-Encoding
content-type: application/x-javascript
cache-control: no-cache, no-store, must-revalidate
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
expires: Tue, 29 Sep 2020 14:21:24 GMT

GET
H2 200 BiocatchATO.js Show response
online.citi.com/passivebio/ 698 KB
142 KB 173ms
171ms Script
application/x-javascript 104.109.92.187
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://online.citi.com/passivebio/BiocatchATO.js

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.109.92.187 , Netherlands, ASN20940 (AKAMAI-ASN1, EU),

Reverse DNS

a104-109-92-187.deploy.static.akamaitechnologies.com

Software

Resource Hash

95fee5c0c07c5bf834c9c3d6678d686b9825bb2e3de1cc22dcade495349fb242

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

Referer: https://online.citi.com/US/JSO/signon/DisplayUsernameSignon.do?userType=tyLogin&locale=en_US&TYNewUser=false&TYForgotUUID=false&TYMigration=&SAMLPostURL=https://www.thankyou.com//gateway2.htm&ErrorCode=&TYPostURL=https://www.thankyou.com//tyLoginGateway.htm&cmp=EMC-CRG0780012.01
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=300
content-encoding: gzip
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
status: 200
content-length: 144308
pragma: no-cache
last-modified: Wed, 16 Sep 2020 07:27:38 GMT
x-akamai-citisite: GTDC
date: Tue, 29 Sep 2020 14:21:24 GMT
vary: Accept-Encoding
content-type: application/x-javascript
cache-control: no-cache, no-store, must-revalidate
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
expires: Tue, 29 Sep 2020 14:21:24 GMT

GET
H2 200 Citi-Thankyou.png
online.citi.com/GFC/branding/ThankYou/img/ 2 KB
2 KB 195ms
194ms Image
image/png 104.109.92.187
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://online.citi.com/GFC/branding/ThankYou/img/Citi-Thankyou.png

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.109.92.187 , Netherlands, ASN20940 (AKAMAI-ASN1, EU),

Reverse DNS

a104-109-92-187.deploy.static.akamaitechnologies.com

Software

Resource Hash

0f5de2f9da1bb346abebdae4127db29e587095c66f3539b5eb8c392e853d3af3

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

Referer: https://online.citi.com/US/JSO/signon/DisplayUsernameSignon.do?userType=tyLogin&locale=en_US&TYNewUser=false&TYForgotUUID=false&TYMigration=&SAMLPostURL=https://www.thankyou.com//gateway2.htm&ErrorCode=&TYPostURL=https://www.thankyou.com//tyLoginGateway.htm&cmp=EMC-CRG0780012.01
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
strict-transport-security: max-age=300
last-modified: Tue, 12 Sep 2017 17:16:57 GMT
x-akamai-citisite: GTDC
date: Tue, 29 Sep 2020 14:21:24 GMT
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
status: 200
expires: Tue, 29 Sep 2020 14:21:24 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 1965
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
accept-ranges: bytes
content-type: image/png
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 200 main.css
online.citi.com/GFC/branding/responsivebranding/css/ 46 KB
8 KB 31ms
31ms Stylesheet
text/css 104.109.92.187
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://online.citi.com/GFC/branding/responsivebranding/css/main.css

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.109.92.187 , Netherlands, ASN20940 (AKAMAI-ASN1, EU),

Reverse DNS

a104-109-92-187.deploy.static.akamaitechnologies.com

Software

Resource Hash

92861ebb7d832a714480a5b33cd9f11b2587406e5728d010a8ff7285d9c511be

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

Referer: https://online.citi.com/US/JSO/signon/DisplayUsernameSignon.do?userType=tyLogin&locale=en_US&TYNewUser=false&TYForgotUUID=false&TYMigration=&SAMLPostURL=https://www.thankyou.com//gateway2.htm&ErrorCode=&TYPostURL=https://www.thankyou.com//tyLoginGateway.htm&cmp=EMC-CRG0780012.01
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=300
content-encoding: gzip
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
status: 200
content-length: 7270
pragma: no-cache
last-modified: Tue, 12 May 2020 06:26:23 GMT
x-akamai-citisite: GTDC
date: Tue, 29 Sep 2020 14:21:24 GMT
vary: Accept-Encoding
content-type: text/css
cache-control: no-cache, no-store, must-revalidate
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
expires: Tue, 29 Sep 2020 14:21:24 GMT

GET
H2 200 modernizr-2.6.2.js Show response
online.citi.com/JFP/js/widgets/ 15 KB
7 KB 34ms
33ms Script
application/x-javascript 104.109.92.187
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://online.citi.com/JFP/js/widgets/modernizr-2.6.2.js

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.109.92.187 , Netherlands, ASN20940 (AKAMAI-ASN1, EU),

Reverse DNS

a104-109-92-187.deploy.static.akamaitechnologies.com

Software

Resource Hash

41a0f71e6a35be385ce9ed32dc98d4a45832e59c168c28139e679ee75288e8b5

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

Referer: https://online.citi.com/US/JSO/signon/DisplayUsernameSignon.do?userType=tyLogin&locale=en_US&TYNewUser=false&TYForgotUUID=false&TYMigration=&SAMLPostURL=https://www.thankyou.com//gateway2.htm&ErrorCode=&TYPostURL=https://www.thankyou.com//tyLoginGateway.htm&cmp=EMC-CRG0780012.01
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=300
content-encoding: gzip
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
status: 200
content-length: 6127
pragma: no-cache
last-modified: Tue, 12 Sep 2017 17:24:52 GMT
x-akamai-citisite: GTDC
date: Tue, 29 Sep 2020 14:21:24 GMT
vary: Accept-Encoding
content-type: application/x-javascript
cache-control: no-cache, no-store, must-revalidate
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
expires: Tue, 29 Sep 2020 14:21:24 GMT

GET
H2 200 jfpw.accordion-menu.js Show response
online.citi.com/JFP/js/widgets/ 7 KB
2 KB 46ms
43ms Script
application/x-javascript 104.109.92.187
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://online.citi.com/JFP/js/widgets/jfpw.accordion-menu.js

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.109.92.187 , Netherlands, ASN20940 (AKAMAI-ASN1, EU),

Reverse DNS

a104-109-92-187.deploy.static.akamaitechnologies.com

Software

Resource Hash

ca99ffb7633ae3c0a6bc357abc80e00a5236dcfe66cc915d805582cf8e05c983

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

Referer: https://online.citi.com/US/JSO/signon/DisplayUsernameSignon.do?userType=tyLogin&locale=en_US&TYNewUser=false&TYForgotUUID=false&TYMigration=&SAMLPostURL=https://www.thankyou.com//gateway2.htm&ErrorCode=&TYPostURL=https://www.thankyou.com//tyLoginGateway.htm&cmp=EMC-CRG0780012.01
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=300
content-encoding: gzip
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
status: 200
content-length: 1991
pragma: no-cache
last-modified: Tue, 12 Sep 2017 17:24:52 GMT
x-akamai-citisite: GTDC
date: Tue, 29 Sep 2020 14:21:24 GMT
vary: Accept-Encoding
content-type: application/x-javascript
cache-control: no-cache, no-store, must-revalidate
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
expires: Tue, 29 Sep 2020 14:21:24 GMT

GET
H2 200 rsa.js Show response
online.citi.com/CBOL/sec/debcaract/js/ 36 KB
11 KB 46ms
43ms Script
application/x-javascript 104.109.92.187
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://online.citi.com/CBOL/sec/debcaract/js/rsa.js

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.109.92.187 , Netherlands, ASN20940 (AKAMAI-ASN1, EU),

Reverse DNS

a104-109-92-187.deploy.static.akamaitechnologies.com

Software

Resource Hash

793c2f3d02d0bc3ad8a2cdc901b2134159b66245e951ac258fee1ac8b2709f44

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

Referer: https://online.citi.com/US/JSO/signon/DisplayUsernameSignon.do?userType=tyLogin&locale=en_US&TYNewUser=false&TYForgotUUID=false&TYMigration=&SAMLPostURL=https://www.thankyou.com//gateway2.htm&ErrorCode=&TYPostURL=https://www.thankyou.com//tyLoginGateway.htm&cmp=EMC-CRG0780012.01
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=300
content-encoding: gzip
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
status: 200
content-length: 10616
pragma: no-cache
last-modified: Tue, 12 Sep 2017 16:59:12 GMT
x-akamai-citisite: GTDC
date: Tue, 29 Sep 2020 14:21:24 GMT
vary: Accept-Encoding
content-type: application/x-javascript
cache-control: no-cache, no-store, must-revalidate
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
expires: Tue, 29 Sep 2020 14:21:24 GMT

GET
H2 200 TMXProfiling.js Show response
online.citi.com/TMX/ 1 KB
1 KB 66ms
63ms Script
application/x-javascript 104.109.92.187
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://online.citi.com/TMX/TMXProfiling.js

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.109.92.187 , Netherlands, ASN20940 (AKAMAI-ASN1, EU),

Reverse DNS

a104-109-92-187.deploy.static.akamaitechnologies.com

Software

Resource Hash

157430093a6d2ee63082eae5dabf826926d3b6259d33482aa6713c48728e82fa

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

Referer: https://online.citi.com/US/JSO/signon/DisplayUsernameSignon.do?userType=tyLogin&locale=en_US&TYNewUser=false&TYForgotUUID=false&TYMigration=&SAMLPostURL=https://www.thankyou.com//gateway2.htm&ErrorCode=&TYPostURL=https://www.thankyou.com//tyLoginGateway.htm&cmp=EMC-CRG0780012.01
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=300
content-encoding: gzip
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
status: 200
content-length: 546
pragma: no-cache
last-modified: Fri, 10 Aug 2018 07:26:42 GMT
x-akamai-citisite: GTDC
date: Tue, 29 Sep 2020 14:21:24 GMT
vary: Accept-Encoding
content-type: application/x-javascript
cache-control: no-cache, no-store, must-revalidate
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
expires: Tue, 29 Sep 2020 14:21:24 GMT

GET
H2 200 le-mtagconfig.js Show response
online.citi.com/JRS/js/chat/ 2 KB
1 KB 67ms
64ms Script
application/x-javascript 104.109.92.187
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://online.citi.com/JRS/js/chat/le-mtagconfig.js

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.109.92.187 , Netherlands, ASN20940 (AKAMAI-ASN1, EU),

Reverse DNS

a104-109-92-187.deploy.static.akamaitechnologies.com

Software

Resource Hash

d8b32a1e0f5d3d3d05cda5e3e109a8198be3ceca3ae8b4fe63d2bd471920ef7f

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

Referer: https://online.citi.com/US/JSO/signon/DisplayUsernameSignon.do?userType=tyLogin&locale=en_US&TYNewUser=false&TYForgotUUID=false&TYMigration=&SAMLPostURL=https://www.thankyou.com//gateway2.htm&ErrorCode=&TYPostURL=https://www.thankyou.com//tyLoginGateway.htm&cmp=EMC-CRG0780012.01
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=300
content-encoding: gzip
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
status: 200
content-length: 745
pragma: no-cache
last-modified: Tue, 12 Sep 2017 17:24:53 GMT
x-akamai-citisite: GTDC
date: Tue, 29 Sep 2020 14:21:24 GMT
vary: Accept-Encoding
content-type: application/x-javascript
cache-control: no-cache, no-store, must-revalidate
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
expires: Tue, 29 Sep 2020 14:21:24 GMT

GET
H2 200 LPAttributes.js Show response
online.citi.com/JRS/js/chat/ 14 KB
4 KB 88ms
85ms Script
application/x-javascript 104.109.92.187
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://online.citi.com/JRS/js/chat/LPAttributes.js

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.109.92.187 , Netherlands, ASN20940 (AKAMAI-ASN1, EU),

Reverse DNS

a104-109-92-187.deploy.static.akamaitechnologies.com

Software

Resource Hash

015e6103bdf04fef85eeb4c098ee7f0fa746ece89b30738106a50fa64b40d444

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

Referer: https://online.citi.com/US/JSO/signon/DisplayUsernameSignon.do?userType=tyLogin&locale=en_US&TYNewUser=false&TYForgotUUID=false&TYMigration=&SAMLPostURL=https://www.thankyou.com//gateway2.htm&ErrorCode=&TYPostURL=https://www.thankyou.com//tyLoginGateway.htm&cmp=EMC-CRG0780012.01
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=300
content-encoding: gzip
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
status: 200
content-length: 3775
pragma: no-cache
last-modified: Mon, 20 Jan 2020 19:26:26 GMT
x-akamai-citisite: GTDC
date: Tue, 29 Sep 2020 14:21:24 GMT
vary: Accept-Encoding
content-type: application/x-javascript
cache-control: no-cache, no-store, must-revalidate
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
expires: Tue, 29 Sep 2020 14:21:24 GMT

GET
H2 200 chatMask.js Show response
online.citi.com/JRS/js/chat/ 802 B
809 B 88ms
86ms Script
application/x-javascript 104.109.92.187
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://online.citi.com/JRS/js/chat/chatMask.js

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.109.92.187 , Netherlands, ASN20940 (AKAMAI-ASN1, EU),

Reverse DNS

a104-109-92-187.deploy.static.akamaitechnologies.com

Software

Resource Hash

3975b76cc53eb1aeb0a232bc60d18c3aa1ddd3e8a7a08db6abbc14392662ca67

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

Referer: https://online.citi.com/US/JSO/signon/DisplayUsernameSignon.do?userType=tyLogin&locale=en_US&TYNewUser=false&TYForgotUUID=false&TYMigration=&SAMLPostURL=https://www.thankyou.com//gateway2.htm&ErrorCode=&TYPostURL=https://www.thankyou.com//tyLoginGateway.htm&cmp=EMC-CRG0780012.01
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=300
content-encoding: gzip
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
status: 200
content-length: 290
pragma: no-cache
last-modified: Tue, 12 Sep 2017 17:20:58 GMT
x-akamai-citisite: GTDC
date: Tue, 29 Sep 2020 14:21:24 GMT
vary: Accept-Encoding
content-type: application/x-javascript
cache-control: no-cache, no-store, must-revalidate
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
expires: Tue, 29 Sep 2020 14:21:24 GMT

GET
H2 200 chatLPHandler.js Show response
online.citi.com/JRS/js/chat/ 5 KB
2 KB 114ms
112ms Script
application/x-javascript 104.109.92.187
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://online.citi.com/JRS/js/chat/chatLPHandler.js

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.109.92.187 , Netherlands, ASN20940 (AKAMAI-ASN1, EU),

Reverse DNS

a104-109-92-187.deploy.static.akamaitechnologies.com

Software

Resource Hash

e1739237d530e65b6e4b1a4d0a11223446e78b94d4dd7db657f48fede05e1d6e

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

Referer: https://online.citi.com/US/JSO/signon/DisplayUsernameSignon.do?userType=tyLogin&locale=en_US&TYNewUser=false&TYForgotUUID=false&TYMigration=&SAMLPostURL=https://www.thankyou.com//gateway2.htm&ErrorCode=&TYPostURL=https://www.thankyou.com//tyLoginGateway.htm&cmp=EMC-CRG0780012.01
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=300
content-encoding: gzip
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
status: 200
content-length: 1701
pragma: no-cache
last-modified: Tue, 12 Sep 2017 17:22:45 GMT
x-akamai-citisite: GTDC
date: Tue, 29 Sep 2020 14:21:24 GMT
vary: Accept-Encoding
content-type: application/x-javascript
cache-control: no-cache, no-store, must-revalidate
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
expires: Tue, 29 Sep 2020 14:21:24 GMT

GET
H2 200 chatSiteCatTagging.js Show response
online.citi.com/JRS/js/chat/ 2 KB
1 KB 115ms
112ms Script
application/x-javascript 104.109.92.187
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://online.citi.com/JRS/js/chat/chatSiteCatTagging.js

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.109.92.187 , Netherlands, ASN20940 (AKAMAI-ASN1, EU),

Reverse DNS

a104-109-92-187.deploy.static.akamaitechnologies.com

Software

Resource Hash

5c3344d6f25b95a3561326b43bdea1a94d3dcd65097a6db527442978a3ebf86f

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

Referer: https://online.citi.com/US/JSO/signon/DisplayUsernameSignon.do?userType=tyLogin&locale=en_US&TYNewUser=false&TYForgotUUID=false&TYMigration=&SAMLPostURL=https://www.thankyou.com//gateway2.htm&ErrorCode=&TYPostURL=https://www.thankyou.com//tyLoginGateway.htm&cmp=EMC-CRG0780012.01
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=300
content-encoding: gzip
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
status: 200
content-length: 646
pragma: no-cache
last-modified: Tue, 09 Jul 2019 07:57:08 GMT
x-akamai-citisite: GTDC
date: Tue, 29 Sep 2020 14:21:24 GMT
vary: Accept-Encoding
content-type: application/x-javascript
cache-control: no-cache, no-store, must-revalidate
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
expires: Tue, 29 Sep 2020 14:21:24 GMT

GET
H2 200 cobrowse_overlay.css
online.citi.com/GPS/portal/css/ 7 KB
2 KB 157ms
155ms Stylesheet
text/css 104.109.92.187
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://online.citi.com/GPS/portal/css/cobrowse_overlay.css

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.109.92.187 , Netherlands, ASN20940 (AKAMAI-ASN1, EU),

Reverse DNS

a104-109-92-187.deploy.static.akamaitechnologies.com

Software

Resource Hash

a9623118fb6ec3944d1312cd0d492c3f32455e89bc1e01eafa67628a309d9c60

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

Referer: https://online.citi.com/US/JSO/signon/DisplayUsernameSignon.do?userType=tyLogin&locale=en_US&TYNewUser=false&TYForgotUUID=false&TYMigration=&SAMLPostURL=https://www.thankyou.com//gateway2.htm&ErrorCode=&TYPostURL=https://www.thankyou.com//tyLoginGateway.htm&cmp=EMC-CRG0780012.01
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=300
content-encoding: gzip
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
status: 200
content-length: 1597
pragma: no-cache
last-modified: Tue, 13 Aug 2019 07:17:14 GMT
x-akamai-citisite: GTDC
date: Tue, 29 Sep 2020 14:21:24 GMT
vary: Accept-Encoding
content-type: text/css
cache-control: no-cache, no-store, must-revalidate
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
expires: Tue, 29 Sep 2020 14:21:24 GMT

GET
H2 200 tagging_transformation.json Show response
online.citi.com/gcgapi/prod/public/v1/staticcms/USGCB/en_US/appid/ 671 KB
102 KB 41ms
40ms XHR
application/json 104.109.92.187
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://online.citi.com/gcgapi/prod/public/v1/staticcms/USGCB/en_US/appid/tagging_transformation.json

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.109.92.187 , Netherlands, ASN20940 (AKAMAI-ASN1, EU),

Reverse DNS

a104-109-92-187.deploy.static.akamaitechnologies.com

Software

Resource Hash

0aa5d7acd53d6f73b4ac08bf6e99198f3cca15f6ded0efadc8b8a383ae824980

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

appVersion: CBOLV1.0.0
Referer: https://online.citi.com/US/JSO/signon/DisplayUsernameSignon.do?userType=tyLogin&locale=en_US&TYNewUser=false&TYForgotUUID=false&TYMigration=&SAMLPostURL=https://www.thankyou.com//gateway2.htm&ErrorCode=&TYPostURL=https://www.thankyou.com//tyLoginGateway.htm&cmp=EMC-CRG0780012.01
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
client_id: 4a51fb19-a1a7-4247-bc7e-18aa56dd1c40

Response headers

date: Tue, 29 Sep 2020 14:21:24 GMT
content-encoding: gzip
x-route-target: DIGITAL-DEFAULT:DEFAULT
citiuuid: 51a9376a-0657-4607-9cf6-70a3b6980e7f7801438
router-host: api.citi.com
access-control-allow-origin
status: 200
access-control-max-age: 2147483647
x-global-transaction-id: 98b6a3705f7335f49b259cbf
dclocation: GT1DMS
content-length: 103401
uuid: 41e14bec-09a2-4a84-8762-8600728e547d
x-akamai-citisite: GTDC
vary: Accept-Encoding
access-control-allow-methods: GET,PUT,POST,DELETE,HEAD
content-type: application/json
x-backside-transport: OK OK,OK OK,OK OK
x-vcap-request-id: 8ba96d85-69f8-4674-6055-a87aa93a5bdb,585a3ab4-081d-4682-539a-b1c3686e18c2
access-control-expose-headers: APIm-Debug-Trans-Id, X-RateLimit-Limit, X-RateLimit-Remaining, X-RateLimit-Reset, X-Global-Transaction-ID,action,challengeType,bizToken,eventid,Eventid,Eventidexpirytime,eventidexpirytime,accesstoken,Authorization,sid,SessionId,CCPToken,CFIToken
cache-control: public, max-age=60
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
access-control-allow-headers: action,challengeType,accesstoken,appVersion,,Content-Type,sid,CCPToken,CFIToken,countryCode,businessCode,channelId,uuid,client_id,environmentId
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H/1.1

200
OK

rd Show response
dpm.demdex.net/id/
Redirect Chain

https://dpm.demdex.net/id?d_visid_ver=3.1.2&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=61834D9B5228A7430A490D45%40AdobeOrg&d_nsid=0&ts=1601389284642
https://dpm.demdex.net/id/rd?d_visid_ver=3.1.2&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=61834D9B5228A7430A490D45%40AdobeOrg&d_nsid=0&ts=1601389284642

363 B
1 KB

42ms
42ms

XHR
application/json

34.249.46.6
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://dpm.demdex.net/id/rd?d_visid_ver=3.1.2&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=61834D9B5228A7430A490D45%40AdobeOrg&d_nsid=0&ts=1601389284642

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

34.249.46.6 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-34-249-46-6.eu-west-1.compute.amazonaws.com

Software

Resource Hash

81affcfb1bbe1cb5141f0f801523c49ca32e631606d0bc57d30bcb972af3082a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://online.citi.com/US/JSO/signon/DisplayUsernameSignon.do?userType=tyLogin&locale=en_US&TYNewUser=false&TYForgotUUID=false&TYMigration=&SAMLPostURL=https://www.thankyou.com//gateway2.htm&ErrorCode=&TYPostURL=https://www.thankyou.com//tyLoginGateway.htm&cmp=EMC-CRG0780012.01
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

DCS: dcs-prod-irl1-v081-0ef7259d9.edge-irl1.demdex.com 5.78.0.20200908113611 8ms (+1ms)
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Encoding: gzip
X-TID: lIhrcDSYQlQ=
Vary: Origin, Accept-Encoding, User-Agent
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Access-Control-Allow-Origin: https://online.citi.com
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/json;charset=utf-8
Content-Length: 300
Expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
Access-Control-Allow-Origin: https://online.citi.com
X-TID: wSbq/h0nRAg=
Vary: Origin
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Location: https://dpm.demdex.net/id/rd?d_visid_ver=3.1.2&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=61834D9B5228A7430A490D45%40AdobeOrg&d_nsid=0&ts=1601389284642
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 0
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2 200 serverComponent.php Show response
nexus.ensighten.com/citi/na_prod/ 1 KB
731 B 41ms
40ms Script
text/javascript 18.195.42.228
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://nexus.ensighten.com/citi/na_prod/serverComponent.php?r=75182.60278417153&namespace=Bootstrapper&staticJsPath=nexus.ensighten.com/citi/na_prod/code/&publishedOn=Tue%20Sep%2029%2014:03:53%20GMT%202020&ClientID=1129&PageID=https%3A%2F%2Fonline.citi.com%2FUS%2FJSO%2Fsignon%2FDisplayUsernameSignon.do%3FuserType%3DtyLogin%26locale%3Den_US%26TYNewUser%3Dfalse%26TYForgotUUID%3Dfalse%26TYMigration%3D%26SAMLPostURL%3Dhttps%3A%2F%2Fwww.thankyou.com%2F%2Fgateway2.htm%26ErrorCode%3D%26TYPostURL%3Dhttps%3A%2F%2Fwww.thankyou.com%2F%2FtyLoginGateway.htm%26cmp%3DEMC-CRG0780012.01
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 18.195.42.228 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-195-42-228.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 96a8568336b187241ee3fff74847d757c25ee6c6cff67295be9ff4be8ea2f640

Request headers

Referer: https://online.citi.com/US/JSO/signon/DisplayUsernameSignon.do?userType=tyLogin&locale=en_US&TYNewUser=false&TYForgotUUID=false&TYMigration=&SAMLPostURL=https://www.thankyou.com//gateway2.htm&ErrorCode=&TYPostURL=https://www.thankyou.com//tyLoginGateway.htm&cmp=EMC-CRG0780012.01
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 29 Sep 2020 14:21:24 GMT
content-encoding: gzip
server: nginx
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: no-cache, no-store
expires: Tue, 29 Sep 2020 14:21:23 GMT

GET
H2 200 Interstate-Light.woff
online.citi.com/CBOL/common/ui/ddl/theme/latest/styles/fonts/interstate/ 74 KB
74 KB 265ms
265ms Font
application/octet-stream 104.109.92.187
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://online.citi.com/CBOL/common/ui/ddl/theme/latest/styles/fonts/interstate/Interstate-Light.woff

Requested by

Host: online.citi.com
URL: https://online.citi.com/CBOL/common/ui/ddl/theme/latest/styles/ddl.min.css

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.109.92.187 , Netherlands, ASN20940 (AKAMAI-ASN1, EU),

Reverse DNS

a104-109-92-187.deploy.static.akamaitechnologies.com

Software

Resource Hash

f327a0ba3e41b1e8154e1c18fc114baff0bd057151e3afe7fa6f33cc0cb18296

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

Origin: https://online.citi.com
Referer: https://online.citi.com/CBOL/common/ui/ddl/theme/latest/styles/ddl.min.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=300
content-encoding: gzip
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
status: 200
content-length: 75483
pragma: no-cache
last-modified: Tue, 12 Sep 2017 17:20:58 GMT
x-akamai-citisite: GTDC
date: Tue, 29 Sep 2020 14:21:24 GMT
vary: Accept-Encoding
content-type: text/plain
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
expires: Tue, 29 Sep 2020 14:21:24 GMT

GET
BLOB 200
OK d4965486-cefa-48c4-a9e6-1157345c8c0e
https://online.citi.com/ 168 KB
0 Other
text/plain

General

Check archive.org

Show headers Download Go to

Full URL: blob:https://online.citi.com/d4965486-cefa-48c4-a9e6-1157345c8c0e
Requested by: Host: online.citi.com
URL: https://online.citi.com/US/JSO/signon/DisplayUsernameSignon.do?userType=tyLogin&locale=en_US&TYNewUser=false&TYForgotUUID=false&TYMigration=&SAMLPostURL=https://www.thankyou.com//gateway2.htm&ErrorCode=&TYPostURL=https://www.thankyou.com//tyLoginGateway.htm&cmp=EMC-CRG0780012.01
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: bfee92627d3ee6ef32f79d53989ba3e960cd5edfafd764f8089e1ad18c18327f

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Length: 171648

GET
H/1.1 200
OK tags.js Show response
content22.online.citi.com/fp/ 49 KB
11 KB 185ms
20ms Script
text/javascript 91.235.133.67
THM

General

Check archive.org

Show headers Download Go to

Full URL

https://content22.online.citi.com/fp/tags.js?org_id=89oebq5k&session_id=cf40e4849e45711ff9ddabe667b837a5426267c7c86bb19a726ed881cc7102e3&allow_reprofile=1

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

91.235.133.67 , Netherlands, ASN30286 (THM, US),

Reverse DNS

Software

Apache /

Resource Hash

3580773ed9ca515060fa99db9f30c91c28fe64a5674e5b9a241af5b7733b560c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://online.citi.com/US/JSO/signon/DisplayUsernameSignon.do?userType=tyLogin&locale=en_US&TYNewUser=false&TYForgotUUID=false&TYMigration=&SAMLPostURL=https://www.thankyou.com//gateway2.htm&ErrorCode=&TYPostURL=https://www.thankyou.com//tyLoginGateway.htm&cmp=EMC-CRG0780012.01
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 29 Sep 2020 14:21:24 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Server: Apache
Strict-Transport-Security: max-age=31536000
P3P: CP=IVAa PSAa
Cache-Control: no-cache, no-store, must-revalidate
Transfer-Encoding: chunked
Connection: Keep-Alive, Keep-Alive
Content-Type: text/javascript;charset=UTF-8
Vary: Accept-Encoding
X-XSS-Protection: 1; mode=block
Keep-Alive: timeout=2, max=100
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2 200 ThankYou.jpg
online.citi.com/JSO/loginpage/ 701 KB
703 KB 243ms
242ms Image
image/jpeg 104.109.92.187
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://online.citi.com/JSO/loginpage/ThankYou.jpg

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.109.92.187 , Netherlands, ASN20940 (AKAMAI-ASN1, EU),

Reverse DNS

a104-109-92-187.deploy.static.akamaitechnologies.com

Software

Resource Hash

01489a476b4554af217a5b2a6cf2d5e87c8a628bbc78c302a632d72ec824e708

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

Referer: https://online.citi.com/US/JSO/signon/DisplayUsernameSignon.do?userType=tyLogin&locale=en_US&TYNewUser=false&TYForgotUUID=false&TYMigration=&SAMLPostURL=https://www.thankyou.com//gateway2.htm&ErrorCode=&TYPostURL=https://www.thankyou.com//tyLoginGateway.htm&cmp=EMC-CRG0780012.01
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
strict-transport-security: max-age=300
last-modified: Tue, 09 Jan 2018 07:13:58 GMT
x-akamai-citisite: GTDC
date: Tue, 29 Sep 2020 14:21:25 GMT
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
status: 200
expires: Tue, 29 Sep 2020 14:21:25 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 717952
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
accept-ranges: bytes
content-type: image/jpeg
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 200 arrow-dropdown-down.svg
online.citi.com/CBOL/common/ui/ddl/theme/latest/images/icons/svgs/arrows/ 1 KB
1 KB 463ms
463ms Image
image/svg+xml 104.109.92.187
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://online.citi.com/CBOL/common/ui/ddl/theme/latest/images/icons/svgs/arrows/arrow-dropdown-down.svg

Requested by

Host: online.citi.com
URL: https://online.citi.com/CBOL/common/ui/ddl/theme/latest/styles/ddl.min.css

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.109.92.187 , Netherlands, ASN20940 (AKAMAI-ASN1, EU),

Reverse DNS

a104-109-92-187.deploy.static.akamaitechnologies.com

Software

Resource Hash

799b3441638d39c44c00a199ecd3dec31d13b4e4103839b6f321f72ce5c1e7f7

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

Referer: https://online.citi.com/CBOL/common/ui/ddl/theme/latest/styles/ddl.min.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=300
content-encoding: gzip
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
status: 200
content-length: 571
pragma: no-cache
last-modified: Tue, 12 Sep 2017 17:24:53 GMT
x-akamai-citisite: GTDC
date: Tue, 29 Sep 2020 14:21:25 GMT
vary: Accept-Encoding
content-type: image/svg+xml
cache-control: no-cache, no-store, must-revalidate
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
accept-ranges: bytes
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
expires: 0

GET
H2 200 Interstate-Bold.woff
online.citi.com/CBOL/common/ui/ddl/theme/latest/styles/fonts/interstate/ 70 KB
71 KB 314ms
313ms Font
application/octet-stream 104.109.92.187
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://online.citi.com/CBOL/common/ui/ddl/theme/latest/styles/fonts/interstate/Interstate-Bold.woff

Requested by

Host: online.citi.com
URL: https://online.citi.com/CBOL/common/ui/ddl/theme/latest/styles/ddl.min.css

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.109.92.187 , Netherlands, ASN20940 (AKAMAI-ASN1, EU),

Reverse DNS

a104-109-92-187.deploy.static.akamaitechnologies.com

Software

Resource Hash

e9e9a67395a0d83b584208a19b95af203df8e8e6c6952fe76c690d60ea9381c7

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

Origin: https://online.citi.com
Referer: https://online.citi.com/CBOL/common/ui/ddl/theme/latest/styles/ddl.min.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=300
content-encoding: gzip
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
status: 200
content-length: 71859
pragma: no-cache
last-modified: Tue, 12 Sep 2017 17:24:53 GMT
x-akamai-citisite: GTDC
date: Tue, 29 Sep 2020 14:21:25 GMT
vary: Accept-Encoding
content-type: text/plain
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
expires: Tue, 29 Sep 2020 14:21:25 GMT

GET
H2 200 fdf45a7c15c1cee06bb71e10dac4e26e.js Show response
nexus.ensighten.com/citi/na_prod/code/ 989 B
1 KB 26ms
24ms Script
application/javascript 18.195.42.228
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://nexus.ensighten.com/citi/na_prod/code/fdf45a7c15c1cee06bb71e10dac4e26e.js?conditionId0=4849963
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 18.195.42.228 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-195-42-228.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 7df13706eaab8ce9a3dcd2a501f60bc66987c83834d07dfaf07ae56ef814c110

Request headers

Referer: https://online.citi.com/US/JSO/signon/DisplayUsernameSignon.do?userType=tyLogin&locale=en_US&TYNewUser=false&TYForgotUUID=false&TYMigration=&SAMLPostURL=https://www.thankyou.com//gateway2.htm&ErrorCode=&TYPostURL=https://www.thankyou.com//tyLoginGateway.htm&cmp=EMC-CRG0780012.01
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 29 Sep 2020 14:21:24 GMT
last-modified: Tue, 14 May 2019 17:01:42 GMT
server: nginx
etag: "5cdaf476-3dd"
content-type: application/javascript; charset=utf-8
status: 200
cache-control: max-age=315360000
accept-ranges: bytes
content-length: 989

GET
H2 200 9a7b351075739244d9493ff5f4557b10.js Show response
nexus.ensighten.com/citi/na_prod/code/ 14 KB
4 KB 25ms
24ms Script
application/javascript 18.195.42.228
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://nexus.ensighten.com/citi/na_prod/code/9a7b351075739244d9493ff5f4557b10.js?conditionId0=467299
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 18.195.42.228 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-195-42-228.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 0c6df04bbd3bb79a0cff6479b79137e17eb7e3ff616e9dd9508be396d9fa2ca0

Request headers

Referer: https://online.citi.com/US/JSO/signon/DisplayUsernameSignon.do?userType=tyLogin&locale=en_US&TYNewUser=false&TYForgotUUID=false&TYMigration=&SAMLPostURL=https://www.thankyou.com//gateway2.htm&ErrorCode=&TYPostURL=https://www.thankyou.com//tyLoginGateway.htm&cmp=EMC-CRG0780012.01
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 29 Sep 2020 14:21:24 GMT
content-encoding: gzip
last-modified: Tue, 22 Sep 2020 18:22:55 GMT
server: nginx
etag: W/"5f6a40ff-3767"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
status: 200
cache-control: max-age=315360000

GET
H2 200 8637af7c210f4e79436bc39f71b49bfa.js Show response
nexus.ensighten.com/citi/na_prod/code/ 1 KB
737 B 31ms
30ms Script
application/javascript 18.195.42.228
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://nexus.ensighten.com/citi/na_prod/code/8637af7c210f4e79436bc39f71b49bfa.js?conditionId0=4827153
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 18.195.42.228 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-195-42-228.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 06dfb367edf9bbff810def9f75f8695b3ccfbcb2813306609fc6e18fcacfc17e

Request headers

Referer: https://online.citi.com/US/JSO/signon/DisplayUsernameSignon.do?userType=tyLogin&locale=en_US&TYNewUser=false&TYForgotUUID=false&TYMigration=&SAMLPostURL=https://www.thankyou.com//gateway2.htm&ErrorCode=&TYPostURL=https://www.thankyou.com//tyLoginGateway.htm&cmp=EMC-CRG0780012.01
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 29 Sep 2020 14:21:24 GMT
content-encoding: gzip
last-modified: Wed, 10 Jul 2019 12:57:13 GMT
server: nginx
etag: W/"5d25e0a9-412"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
status: 200
cache-control: max-age=315360000

GET
H2 200 557566dc60916e3de69e006bef252459.js Show response
nexus.ensighten.com/citi/na_prod/code/ 2 KB
961 B 31ms
30ms Script
application/javascript 18.195.42.228
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://nexus.ensighten.com/citi/na_prod/code/557566dc60916e3de69e006bef252459.js?conditionId0=4837456
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 18.195.42.228 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-195-42-228.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 31b00ff4929696dfca06885da68e58c3e09f6ecb4ae0fe1ae287e99a3fd1f716

Request headers

Referer: https://online.citi.com/US/JSO/signon/DisplayUsernameSignon.do?userType=tyLogin&locale=en_US&TYNewUser=false&TYForgotUUID=false&TYMigration=&SAMLPostURL=https://www.thankyou.com//gateway2.htm&ErrorCode=&TYPostURL=https://www.thankyou.com//tyLoginGateway.htm&cmp=EMC-CRG0780012.01
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 29 Sep 2020 14:21:24 GMT
content-encoding: gzip
last-modified: Tue, 27 Aug 2019 16:59:12 GMT
server: nginx
etag: W/"5d656160-887"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
status: 200
cache-control: max-age=315360000

GET
H2 200 c1a82ac98e4d4e503dc1bf30d0ee425e.js Show response
nexus.ensighten.com/citi/na_prod/code/ 2 KB
861 B 31ms
30ms Script
application/javascript 18.195.42.228
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://nexus.ensighten.com/citi/na_prod/code/c1a82ac98e4d4e503dc1bf30d0ee425e.js?conditionId0=480881
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 18.195.42.228 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-195-42-228.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: ef72134da48ff0f5dcc948bd13ab14e28d4d1c8322e71fa2a4796168284b0aef

Request headers

Referer: https://online.citi.com/US/JSO/signon/DisplayUsernameSignon.do?userType=tyLogin&locale=en_US&TYNewUser=false&TYForgotUUID=false&TYMigration=&SAMLPostURL=https://www.thankyou.com//gateway2.htm&ErrorCode=&TYPostURL=https://www.thankyou.com//tyLoginGateway.htm&cmp=EMC-CRG0780012.01
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 29 Sep 2020 14:21:24 GMT
content-encoding: gzip
last-modified: Tue, 30 Jun 2020 19:30:27 GMT
server: nginx
etag: W/"5efb92d3-631"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
status: 200
cache-control: max-age=315360000

GET
H2 200 311098be5b71dfdff3c6fe2e8f229f55.js Show response
nexus.ensighten.com/citi/na_prod/code/ 100 KB
23 KB 35ms
34ms Script
application/javascript 18.195.42.228
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://nexus.ensighten.com/citi/na_prod/code/311098be5b71dfdff3c6fe2e8f229f55.js?conditionId0=421908
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 18.195.42.228 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-195-42-228.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: c03443c95fca2538c411e88702491565c1ea2662ddbc0733b5acdbffc2125017

Request headers

Referer: https://online.citi.com/US/JSO/signon/DisplayUsernameSignon.do?userType=tyLogin&locale=en_US&TYNewUser=false&TYForgotUUID=false&TYMigration=&SAMLPostURL=https://www.thankyou.com//gateway2.htm&ErrorCode=&TYPostURL=https://www.thankyou.com//tyLoginGateway.htm&cmp=EMC-CRG0780012.01
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 29 Sep 2020 14:21:24 GMT
content-encoding: gzip
last-modified: Thu, 24 Sep 2020 21:38:16 GMT
server: nginx
etag: W/"5f6d11c8-18e55"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
status: 200
cache-control: max-age=315360000

GET
H2 200 99c2edc318998e53970675ad2ff59f88.js Show response
nexus.ensighten.com/citi/na_prod/code/ 111 KB
31 KB 32ms
31ms Script
application/javascript 18.195.42.228
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://nexus.ensighten.com/citi/na_prod/code/99c2edc318998e53970675ad2ff59f88.js?conditionId0=486757
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 18.195.42.228 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-195-42-228.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 7afe38f32e579a288de8f251d627ed66d4293977ec24f06d25eac4e5a92b71ac

Request headers

Referer: https://online.citi.com/US/JSO/signon/DisplayUsernameSignon.do?userType=tyLogin&locale=en_US&TYNewUser=false&TYForgotUUID=false&TYMigration=&SAMLPostURL=https://www.thankyou.com//gateway2.htm&ErrorCode=&TYPostURL=https://www.thankyou.com//tyLoginGateway.htm&cmp=EMC-CRG0780012.01
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 29 Sep 2020 14:21:24 GMT
content-encoding: gzip
last-modified: Tue, 22 Sep 2020 18:22:55 GMT
server: nginx
etag: W/"5f6a40ff-1bb3b"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
status: 200
cache-control: max-age=315360000

GET
H2 200 gateway.min.js Show response
gateway.foresee.com/sites/citithankyou/production/ 56 KB
20 KB 124ms
52ms Script
application/javascript 99.86.243.18
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://gateway.foresee.com/sites/citithankyou/production/gateway.min.js
Requested by: Host: online.citi.com
URL: https://online.citi.com/US/JSO/signon/DisplayUsernameSignon.do?userType=tyLogin&locale=en_US&TYNewUser=false&TYForgotUUID=false&TYMigration=&SAMLPostURL=https://www.thankyou.com//gateway2.htm&ErrorCode=&TYPostURL=https://www.thankyou.com//tyLoginGateway.htm&cmp=EMC-CRG0780012.01
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 99.86.243.18 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-243-18.vie50.r.cloudfront.net
Software: nginx/1.12.1 /
Resource Hash: 0ce3adf94d103c61df01f3735e92216bf2b424a1d3cd4fb1563508f6d1e39c29

Request headers

Referer: https://online.citi.com/US/JSO/signon/DisplayUsernameSignon.do?userType=tyLogin&locale=en_US&TYNewUser=false&TYForgotUUID=false&TYMigration=&SAMLPostURL=https://www.thankyou.com//gateway2.htm&ErrorCode=&TYPostURL=https://www.thankyou.com//tyLoginGateway.htm&cmp=EMC-CRG0780012.01
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 29 Sep 2020 13:10:46 GMT
content-encoding: gzip
age: 4238
x-cache: Hit from cloudfront
status: 200, 200
content-length: 20024
access-control-allow-origin: *
last-modified: Fri, 12 Jun 2020 05:10:32 GMT
server: nginx/1.12.1
etag: "1517b10b4f6b1d96f2713e03a3b42a6b"
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: application/javascript; charset=utf-8
via: 1.1 a776ddd883fba0ca203b52822fb50572.cloudfront.net (CloudFront)
cache-control: public, max-age=14400
x-amz-cf-pop: VIE50-C1
access-control-allow-headers: X-Requested-With
x-amz-cf-id: S4sV15Dijq-Z6yhGTHlZcZAbj5u2P9GZ2ybRW1sSsBfVFgoPCZfs3w==
expires: Tue, 29 Sep 2020 17:10:46 GMT

GET
H2 200 Citi-Branding-Sprite.png
online.citi.com/GFC/branding/img/ 5 KB
5 KB 294ms
293ms Image
image/png 104.109.92.187
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://online.citi.com/GFC/branding/img/Citi-Branding-Sprite.png

Requested by

Host: online.citi.com
URL: https://online.citi.com/GFC/branding/responsivebranding/css/main_branding.css

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.109.92.187 , Netherlands, ASN20940 (AKAMAI-ASN1, EU),

Reverse DNS

a104-109-92-187.deploy.static.akamaitechnologies.com

Software

Resource Hash

3fca3de24621f0f10186594054444d608016297c2e853e548710b3521e42a609

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

Referer: https://online.citi.com/GFC/branding/responsivebranding/css/main_branding.css
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
strict-transport-security: max-age=300
last-modified: Wed, 14 Jun 2017 18:29:01 GMT
x-akamai-citisite: GTDC
date: Tue, 29 Sep 2020 14:21:25 GMT
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
status: 200
expires: Tue, 29 Sep 2020 14:21:25 GMT
cache-control: no-cache, no-store, must-revalidate
content-length: 4952
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
accept-ranges: bytes
content-type: image/png
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 200 tag.js Show response
lptag.liveperson.net/tag/ 18 KB
7 KB 54ms
17ms Script
application/javascript 178.249.101.23
LIVEPERSON

General

Check archive.org

Show headers Download Go to

Full URL: https://lptag.liveperson.net/tag/tag.js?site=50929468
Requested by: Host: online.citi.com
URL: https://online.citi.com/JRS/js/chat/le-mtagconfig.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 178.249.101.23 , Netherlands, ASN11054 (LIVEPERSON, US),
Reverse DNS
Software: ws /
Resource Hash: cc490a8ef7deb4c7fba66f332ad8cdd39433675b95d2bd341300ab7b718f8e4e

Request headers

Referer: https://online.citi.com/US/JSO/signon/DisplayUsernameSignon.do?userType=tyLogin&locale=en_US&TYNewUser=false&TYForgotUUID=false&TYMigration=&SAMLPostURL=https://www.thankyou.com//gateway2.htm&ErrorCode=&TYPostURL=https://www.thankyou.com//tyLoginGateway.htm&cmp=EMC-CRG0780012.01
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 29 Sep 2020 14:21:24 GMT
content-encoding: gzip
last-modified: Tue, 21 Aug 2018 07:47:45 GMT
server: ws
etag: "5b7bc3a1-198d"
access-control-allow-methods: GET, POST, PATCH
content-type: application/javascript
status: 200
access-control-expose-headers: X-Requested-With, X-HTTP-Method-Override, LP-DOMAIN-REFERER, LP-URL, ETag, ac-revision, X-LP-Last-Modified, If-Match, Authentication-Method, Credit-Card-Ref, Automation-Secret, Email-Token, x-lp-host, Lp-Req-Time, date, x-application-context, strict-transport-security, x-content-type-options, x-download-options, x-xss-protection, x-cache-status, x-amz-id-2, x-amz-request-id, expires, last-modified, set-cookie, content-security-policy, x-frame-options
cache-control: public, max-age=630
access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization, X-HTTP-Method-Override, LP-DOMAIN-REFERER, LP-URL, ETag, ac-revision, X-LP-Last-Modified, If-Match, Authentication-Method, Credit-Card-Ref, Automation-Secret, Email-Token
content-length: 6541

GET
H/1.1 200
OK Cookie set dest5.html
citi.demdex.net/ Frame 136B 0
0 155ms
37ms Document
text/html 54.154.62.31
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://citi.demdex.net/dest5.html?d_nsid=0

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

54.154.62.31 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-54-154-62-31.eu-west-1.compute.amazonaws.com

Software

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Host: citi.demdex.net
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Referer: https://online.citi.com/US/JSO/signon/DisplayUsernameSignon.do?userType=tyLogin&locale=en_US&TYNewUser=false&TYForgotUUID=false&TYMigration=&SAMLPostURL=https://www.thankyou.com//gateway2.htm&ErrorCode=&TYPostURL=https://www.thankyou.com//tyLoginGateway.htm&cmp=EMC-CRG0780012.01
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Cookie: demdex=44614461522505419113347224304972832399
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://online.citi.com/US/JSO/signon/DisplayUsernameSignon.do?userType=tyLogin&locale=en_US&TYNewUser=false&TYForgotUUID=false&TYMigration=&SAMLPostURL=https://www.thankyou.com//gateway2.htm&ErrorCode=&TYPostURL=https://www.thankyou.com//tyLoginGateway.htm&cmp=EMC-CRG0780012.01

Response headers

Accept-Ranges: bytes
Cache-Control: max-age=21600
Content-Encoding: gzip
Content-Type: text/html
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Last-Modified: Wed, 09 Sep 2020 13:59:45 GMT
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Pragma: no-cache
Set-Cookie: demdex=44614461522505419113347224304972832399;Path=/;Domain=.demdex.net;Expires=Sun, 28-Mar-2021 14:21:25 GMT;Max-Age=15552000;Secure;SameSite=None
Strict-Transport-Security: max-age=31536000; includeSubDomains
Vary: Accept-Encoding, User-Agent
X-TID: 0/gG+IdSRw4=
Content-Length: 2785
Connection: keep-alive

GET
H2 200 id Show response
metrics1.citi.com/ 48 B
478 B 141ms
35ms XHR
application/x-javascript 15.236.9.100
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://metrics1.citi.com/id?d_visid_ver=3.1.2&d_fieldgroup=A&mcorgid=61834D9B5228A7430A490D45%40AdobeOrg&mid=37677268469468034442868829232609339180&ts=1601389284891

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

15.236.9.100 Paris, France, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-15-236-9-100.eu-west-3.compute.amazonaws.com

Software

jag /

Resource Hash

e524a368fa3b7da146675944a77576cdb2c498673184d1dc5157ebda0df4eded

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://online.citi.com/US/JSO/signon/DisplayUsernameSignon.do?userType=tyLogin&locale=en_US&TYNewUser=false&TYForgotUUID=false&TYMigration=&SAMLPostURL=https://www.thankyou.com//gateway2.htm&ErrorCode=&TYPostURL=https://www.thankyou.com//tyLoginGateway.htm&cmp=EMC-CRG0780012.01
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

status: 200
date: Tue, 29 Sep 2020 14:21:24 GMT
x-content-type-options: nosniff
server: jag
xserver: anedge-794d66dbb8-n2867
vary: Origin
x-c: master-1380.Ie4fd2b.M0-456
p3p: CP="This is not a P3P policy"
access-control-allow-origin: https://online.citi.com
cache-control: no-cache, no-store, max-age=0, no-transform, private
access-control-allow-credentials: true
content-type: application/x-javascript;charset=utf-8
content-length: 48
x-xss-protection: 1; mode=block

GET
H/1.1

200
OK

ibs:dpid=411&dpuuid=X3NC5AAAB0ir_BTJ
dpm.demdex.net/
Redirect Chain

https://cm.everesttech.net/cm/dd?d_uuid=44614461522505419113347224304972832399
https://dpm.demdex.net/ibs:dpid=411&dpuuid=X3NC5AAAB0ir_BTJ

42 B
915 B

35ms
35ms

Image
image/gif

34.249.46.6
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dpm.demdex.net/ibs:dpid=411&dpuuid=X3NC5AAAB0ir_BTJ

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

34.249.46.6 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-34-249-46-6.eu-west-1.compute.amazonaws.com

Software

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Referer: https://online.citi.com/US/JSO/signon/DisplayUsernameSignon.do?userType=tyLogin&locale=en_US&TYNewUser=false&TYForgotUUID=false&TYMigration=&SAMLPostURL=https://www.thankyou.com//gateway2.htm&ErrorCode=&TYPostURL=https://www.thankyou.com//tyLoginGateway.htm&cmp=EMC-CRG0780012.01
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

DCS: dcs-prod-irl1-v081-09ee3f1bd.edge-irl1.demdex.com 5.78.0.20200908113611 1ms (+1ms)
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-Content-Type-Options: nosniff
X-TID: KUr9G8tfQic=
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection: keep-alive
Content-Type: image/gif
Content-Length: 42
Expires: Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

Date: Tue, 29 Sep 2020 14:21:24 GMT
Server: AMO-cookiemap/1.1
P3P: CP="NOI NID DEVa PSAa PSDa OUR IND PUR COM NAV INT DEM"
Location: https://dpm.demdex.net/ibs:dpid=411&dpuuid=X3NC5AAAB0ir_BTJ
Cache-Control: no-cache
Connection: Keep-Alive
Keep-Alive: timeout=15,max=100
Content-Length: 0

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 90 KB
36 KB 32ms
31ms Script
application/javascript 2a00:1450:4001:81a::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=DC-6260004

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81a::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

717f12329a056efae65c7ab10d8431327ff9c314e7b4df47815442d99fb02982

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Referer: https://online.citi.com/US/JSO/signon/DisplayUsernameSignon.do?userType=tyLogin&locale=en_US&TYNewUser=false&TYForgotUUID=false&TYMigration=&SAMLPostURL=https://www.thankyou.com//gateway2.htm&ErrorCode=&TYPostURL=https://www.thankyou.com//tyLoginGateway.htm&cmp=EMC-CRG0780012.01
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 29 Sep 2020 14:21:24 GMT
content-encoding: br
vary: Accept-Encoding
status: 200
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 36395
x-xss-protection: 0
last-modified: Tue, 29 Sep 2020 12:00:00 GMT
server: Google Tag Manager
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Tue, 29 Sep 2020 14:21:24 GMT

GET
H/1.1 200
OK bk-coretag.js Show response
tags.bkrtx.com/js/ 31 KB
11 KB 72ms
23ms Script
application/javascript 104.108.63.235
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://tags.bkrtx.com/js/bk-coretag.js

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/code/311098be5b71dfdff3c6fe2e8f229f55.js?conditionId0=421908

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.108.63.235 , Netherlands, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-108-63-235.deploy.static.akamaitechnologies.com

Software

nginx/1.15.8 /

Resource Hash

f62d52a7ff8957da4c0bb6357b4a9c1550cee0ebd00922d62aca8f4ac13ca63e

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; includeSubDomains

Request headers

Referer: https://online.citi.com/US/JSO/signon/DisplayUsernameSignon.do?userType=tyLogin&locale=en_US&TYNewUser=false&TYForgotUUID=false&TYMigration=&SAMLPostURL=https://www.thankyou.com//gateway2.htm&ErrorCode=&TYPostURL=https://www.thankyou.com//tyLoginGateway.htm&cmp=EMC-CRG0780012.01
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Strict-Transport-Security: max-age=15724800; includeSubDomains
Content-Encoding: gzip
Last-Modified: Thu, 20 Aug 2020 19:09:24 GMT
Server: nginx/1.15.8
ETag: W/"5f3eca64-7ca9"
Vary: Accept-Encoding
Content-Type: application/javascript
Cache-Control: max-age=604800
Date: Tue, 29 Sep 2020 14:21:24 GMT
Connection: keep-alive
Content-Length: 10983
Expires: Tue, 06 Oct 2020 14:21:24 GMT

GET
H/1.1 200
OK tc.min.js Show response
c1.rfihub.net/js/ 20 KB
7 KB 105ms
34ms Script
application/x-javascript 104.103.78.138
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://c1.rfihub.net/js/tc.min.js
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/code/9a7b351075739244d9493ff5f4557b10.js?conditionId0=467299
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 104.103.78.138 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-103-78-138.deploy.static.akamaitechnologies.com
Software: Jetty(9.0.6.v20130930) /
Resource Hash: cb2bb21705b9cce9781d02c9223f3344a65bd5314027d11c5a8518ad4bd84e84

Request headers

Referer: https://online.citi.com/US/JSO/signon/DisplayUsernameSignon.do?userType=tyLogin&locale=en_US&TYNewUser=false&TYForgotUUID=false&TYMigration=&SAMLPostURL=https://www.thankyou.com//gateway2.htm&ErrorCode=&TYPostURL=https://www.thankyou.com//tyLoginGateway.htm&cmp=EMC-CRG0780012.01
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Tue, 29 Sep 2020 14:21:25 GMT
Content-Encoding: gzip
Last-Modified: Sat, 22 Aug 2020 16:15:25 GMT
Server: Jetty(9.0.6.v20130930)
Vary: Accept-Encoding
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Cache-Control: public, max-age=3600
Connection: keep-alive
Content-Type: application/x-javascript
Content-Length: 6375
Expires: Tue, 29 Sep 2020 15:21:25 GMT

GET
H2 200 .jsonp Show response
lptag.liveperson.net/lptag/api/account/50929468/configuration/applications/taglets/ 284 KB
103 KB 32ms
31ms Script
application/x-javascript 178.249.101.23
LIVEPERSON

General

Check archive.org

Show headers Download Go to

Full URL: https://lptag.liveperson.net/lptag/api/account/50929468/configuration/applications/taglets/.jsonp?v=2.0&df=0&b=1
Requested by: Host: online.citi.com
URL: https://online.citi.com/JRS/js/chat/le-mtagconfig.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 178.249.101.23 , Netherlands, ASN11054 (LIVEPERSON, US),
Reverse DNS
Software: ws /
Resource Hash: 4872a31684ed0aebe597d43e1185f1911f412c310b1dd06401a9da51828fa2a2

Request headers

Referer: https://online.citi.com/US/JSO/signon/DisplayUsernameSignon.do?userType=tyLogin&locale=en_US&TYNewUser=false&TYForgotUUID=false&TYMigration=&SAMLPostURL=https://www.thankyou.com//gateway2.htm&ErrorCode=&TYPostURL=https://www.thankyou.com//tyLoginGateway.htm&cmp=EMC-CRG0780012.01
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 29 Sep 2020 14:21:24 GMT
content-encoding: gzip
server: ws
x-cache-status: HIT
access-control-allow-methods: GET, POST, PATCH
content-type: application/x-javascript
status: 200
access-control-expose-headers: X-Requested-With, X-HTTP-Method-Override, LP-DOMAIN-REFERER, LP-URL, ETag, ac-revision, X-LP-Last-Modified, If-Match, Authentication-Method, Credit-Card-Ref, Automation-Secret, Email-Token, x-lp-host, Lp-Req-Time, date, x-application-context, strict-transport-security, x-content-type-options, x-download-options, x-xss-protection, x-cache-status, x-amz-id-2, x-amz-request-id, expires, last-modified, set-cookie, content-security-policy, x-frame-options
cache-control: public, max-age=630
access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization, X-HTTP-Method-Override, LP-DOMAIN-REFERER, LP-URL, ETag, ac-revision, X-LP-Last-Modified, If-Match, Authentication-Method, Credit-Card-Ref, Automation-Secret, Email-Token

GET
H2 200 fs.record.js Show response
gateway.foresee.com/code/19.6.8/ 61 KB
19 KB 44ms
42ms Script
application/javascript 99.86.243.18
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://gateway.foresee.com/code/19.6.8/fs.record.js
Requested by: Host: gateway.foresee.com
URL: https://gateway.foresee.com/sites/citithankyou/production/gateway.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 99.86.243.18 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-243-18.vie50.r.cloudfront.net
Software: nginx/1.12.1 /
Resource Hash: b527ff8f2705973222d157842b57b19762cd73f0053116d9ae3a8c7fac7e5c01

Request headers

Referer: https://online.citi.com/US/JSO/signon/DisplayUsernameSignon.do?userType=tyLogin&locale=en_US&TYNewUser=false&TYForgotUUID=false&TYMigration=&SAMLPostURL=https://www.thankyou.com//gateway2.htm&ErrorCode=&TYPostURL=https://www.thankyou.com//tyLoginGateway.htm&cmp=EMC-CRG0780012.01
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Sun, 27 Sep 2020 11:21:28 GMT
content-encoding: gzip
age: 183597
x-cache: Hit from cloudfront
status: 200, 200
content-length: 19343
access-control-allow-origin: *
last-modified: Fri, 01 Jun 2018 20:03:26 GMT
server: nginx/1.12.1
etag: W/"9c069fe876774bccfe01c38f2477518d"
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: application/javascript; charset=utf-8
via: 1.1 a776ddd883fba0ca203b52822fb50572.cloudfront.net (CloudFront)
cache-control: public, max-age=2419200
x-amz-cf-pop: VIE50-C1
access-control-allow-headers: X-Requested-With
x-amz-cf-id: aOdCwx_m6lWkbFI-ap8wq_mkOFoEXn9xYkfTGNmd2YJh3o2emdECew==
expires: Sun, 25 Oct 2020 11:21:28 GMT

GET
H2 200 fs.utils.js Show response
gateway.foresee.com/code/19.6.8/ 82 KB
25 KB 43ms
42ms Script
application/javascript 99.86.243.18
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://gateway.foresee.com/code/19.6.8/fs.utils.js
Requested by: Host: gateway.foresee.com
URL: https://gateway.foresee.com/sites/citithankyou/production/gateway.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 99.86.243.18 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-243-18.vie50.r.cloudfront.net
Software: nginx/1.12.1 /
Resource Hash: d39a392943baf815cb7728e27d5a912eb2e6da02cfa63fb43b4dad1f7a5a5f72

Request headers

Referer: https://online.citi.com/US/JSO/signon/DisplayUsernameSignon.do?userType=tyLogin&locale=en_US&TYNewUser=false&TYForgotUUID=false&TYMigration=&SAMLPostURL=https://www.thankyou.com//gateway2.htm&ErrorCode=&TYPostURL=https://www.thankyou.com//tyLoginGateway.htm&cmp=EMC-CRG0780012.01
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 02 Sep 2020 02:18:34 GMT
content-encoding: gzip
age: 2376170
x-cache: Hit from cloudfront
status: 200, 200
content-length: 25414
access-control-allow-origin: *
last-modified: Fri, 01 Jun 2018 20:03:26 GMT
server: nginx/1.12.1
etag: W/"dfe2ccafc90acadbb113edd880585099"
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: application/javascript; charset=utf-8
via: 1.1 a776ddd883fba0ca203b52822fb50572.cloudfront.net (CloudFront)
cache-control: public, max-age=2419200
x-amz-cf-pop: VIE50-C1
access-control-allow-headers: X-Requested-With
x-amz-cf-id: TzB4HHKpzNDrqiP-DXo-qqXuL-9tervhkNF5Ao-tdgIioT77EmByAQ==
expires: Wed, 30 Sep 2020 02:18:34 GMT

GET
H2 200 fs.trigger.js Show response
gateway.foresee.com/code/19.6.8/ 30 KB
10 KB 52ms
51ms Script
application/javascript 99.86.243.18
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://gateway.foresee.com/code/19.6.8/fs.trigger.js
Requested by: Host: gateway.foresee.com
URL: https://gateway.foresee.com/sites/citithankyou/production/gateway.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 99.86.243.18 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-99-86-243-18.vie50.r.cloudfront.net
Software: nginx/1.12.1 /
Resource Hash: 5c89ced709eea1940ac9d955c373db2211ea68df46882fbfdc29afce1fef69e9

Request headers

Referer: https://online.citi.com/US/JSO/signon/DisplayUsernameSignon.do?userType=tyLogin&locale=en_US&TYNewUser=false&TYForgotUUID=false&TYMigration=&SAMLPostURL=https://www.thankyou.com//gateway2.htm&ErrorCode=&TYPostURL=https://www.thankyou.com//tyLoginGateway.htm&cmp=EMC-CRG0780012.01
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Wed, 02 Sep 2020 02:35:52 GMT
content-encoding: gzip
age: 2375133
x-cache: Hit from cloudfront
status: 200, 200
content-length: 10048
access-control-allow-origin: *
last-modified: Fri, 01 Jun 2018 20:03:26 GMT
server: nginx/1.12.1
etag: W/"b5cb7395c8bec1806ace743928bcd62d"
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: application/javascript; charset=utf-8
via: 1.1 a776ddd883fba0ca203b52822fb50572.cloudfront.net (CloudFront)
cache-control: public, max-age=2419200
x-amz-cf-pop: VIE50-C1
access-control-allow-headers: X-Requested-With
x-amz-cf-id: FwWxAnt8x5QOxnDx6CaFcUu9bIjLTcT6wLLyhq_Yu2PKjb0mpcbQ2g==
expires: Wed, 30 Sep 2020 02:35:52 GMT

GET
H/1.1 200
OK idr.js Show response
a.rfihub.com/ 83 B
678 B 70ms
18ms Script
application/javascript 193.0.160.128
ROCKETFUEL

General

Check archive.org

Show headers Download Go to

Full URL: https://a.rfihub.com/idr.js?_callback=window.RocketfuelBCP.jsonpCallbacks.request_cmZpSWRJbkNhY2hl
Requested by: Host: c1.rfihub.net
URL: https://c1.rfihub.net/js/tc.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_256_CBC
Server: 193.0.160.128 , Netherlands, ASN54312 (ROCKETFUEL, US),
Reverse DNS
Software: Jetty(9.0.6.v20130930) /
Resource Hash: 7b4a1d53c179154285284c81ce107b9dd4a02a21f9c123c7501bf4a30177ebe7

Request headers

Referer: https://online.citi.com/US/JSO/signon/DisplayUsernameSignon.do?userType=tyLogin&locale=en_US&TYNewUser=false&TYForgotUUID=false&TYMigration=&SAMLPostURL=https://www.thankyou.com//gateway2.htm&ErrorCode=&TYPostURL=https://www.thankyou.com//tyLoginGateway.htm&cmp=EMC-CRG0780012.01
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Cache-Control: public, max-age=33696000
Content-Type: application/javascript
Server: Jetty(9.0.6.v20130930)
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Content-Length: 83
Expires: Sun, 24 Oct 2021 14:21:25 GMT

GET
H3-Q050 200 js Show response
www.googletagmanager.com/gtag/ 90 KB
36 KB 38ms
23ms Script
application/javascript 2a00:1450:4001:809::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=DC-6269322&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=DC-6260004

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

476b7727fa249a10be611286fe5bd66c270340b15944aecb9e263d53b4b0195d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Referer: https://online.citi.com/US/JSO/signon/DisplayUsernameSignon.do?userType=tyLogin&locale=en_US&TYNewUser=false&TYForgotUUID=false&TYMigration=&SAMLPostURL=https://www.thankyou.com//gateway2.htm&ErrorCode=&TYPostURL=https://www.thankyou.com//tyLoginGateway.htm&cmp=EMC-CRG0780012.01
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 29 Sep 2020 14:21:25 GMT
content-encoding: br
vary: Accept-Encoding
status: 200
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 36428
x-xss-protection: 0
last-modified: Tue, 29 Sep 2020 12:00:00 GMT
server: Google Tag Manager
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Tue, 29 Sep 2020 14:21:25 GMT

GET
H3-Q050 200 js Show response
www.googletagmanager.com/gtag/ 90 KB
36 KB 39ms
25ms Script
application/javascript 2a00:1450:4001:809::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=DC-6256710&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=DC-6260004

Protocol

H3-Q050

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:809::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

c2f312ddb77bec10a33cce6e41f5d8d45f42531d7c1ce41c78fb58668be652fa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

Referer: https://online.citi.com/US/JSO/signon/DisplayUsernameSignon.do?userType=tyLogin&locale=en_US&TYNewUser=false&TYForgotUUID=false&TYMigration=&SAMLPostURL=https://www.thankyou.com//gateway2.htm&ErrorCode=&TYPostURL=https://www.thankyou.com//tyLoginGateway.htm&cmp=EMC-CRG0780012.01
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 29 Sep 2020 14:21:25 GMT
content-encoding: br
vary: Accept-Encoding
status: 200
alt-svc: h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 36427
x-xss-protection: 0
last-modified: Tue, 29 Sep 2020 12:00:00 GMT
server: Google Tag Manager
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Tue, 29 Sep 2020 14:21:25 GMT

GET
H2 200 / Show response
lp-01.chat.online.citi.com/api/account/50929468/configuration/setting/accountproperties/ 4 KB
1 KB 90ms
18ms Script
application/javascript 2a03:6400:10:0:178:249:97:99
LIVEPERSON

General

Check archive.org

Show headers Download Go to

Full URL: https://lp-01.chat.online.citi.com/api/account/50929468/configuration/setting/accountproperties/?cb=lpCb94678x72397
Requested by: Host: lptag.liveperson.net
URL: https://lptag.liveperson.net/lptag/api/account/50929468/configuration/applications/taglets/.jsonp?v=2.0&df=0&b=1
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2a03:6400:10:0:178:249:97:99 , United Kingdom, ASN11054 (LIVEPERSON, US),
Reverse DNS
Software: ws /
Resource Hash: 79870591b22b013171ce01beccaa6671cf278953d613691b19060140097ce2c3

Request headers

Referer: https://online.citi.com/US/JSO/signon/DisplayUsernameSignon.do?userType=tyLogin&locale=en_US&TYNewUser=false&TYForgotUUID=false&TYMigration=&SAMLPostURL=https://www.thankyou.com//gateway2.htm&ErrorCode=&TYPostURL=https://www.thankyou.com//tyLoginGateway.htm&cmp=EMC-CRG0780012.01
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 29 Sep 2020 14:21:25 GMT
content-encoding: gzip
server: ws
x-cache-status: HIT
vary: Accept
content-type: application/javascript
status: 200
x-envoy-upstream-service-time: 1
expires: Tue, 29 Sep 2020 14:22:23 GMT

GET
H/1.1 200
OK taglet_v2.2.js Show response
static-assets.fs.liveperson.com/citi/taglets/ 9 KB
3 KB 81ms
26ms Script
application/javascript 13.225.73.20
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://static-assets.fs.liveperson.com/citi/taglets/taglet_v2.2.js
Requested by: Host: lptag.liveperson.net
URL: https://lptag.liveperson.net/lptag/api/account/50929468/configuration/applications/taglets/.jsonp?v=2.0&df=0&b=1
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 13.225.73.20 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-225-73-20.fra2.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 5fed06c270b4eefc001f362ca7a78b8a5430441b61a9389b7e591224b786503c

Request headers

Referer: https://online.citi.com/US/JSO/signon/DisplayUsernameSignon.do?userType=tyLogin&locale=en_US&TYNewUser=false&TYForgotUUID=false&TYMigration=&SAMLPostURL=https://www.thankyou.com//gateway2.htm&ErrorCode=&TYPostURL=https://www.thankyou.com//tyLoginGateway.htm&cmp=EMC-CRG0780012.01
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-amz-server-side-encryption: AES256
Date: Tue, 29 Sep 2020 14:18:34 GMT
Content-Encoding: gzip
Vary: Accept-Encoding
Last-Modified: Mon, 28 Sep 2020 22:10:53 GMT
Server: AmazonS3
Age: 172
ETag: "d35e506baa0d5dac1b4b7bd03dd096af"
Transfer-Encoding: chunked
X-Cache: Hit from cloudfront
Content-Type: application/javascript
Via: 1.1 e56e6732f380db727425bac2d6158761.cloudfront.net (CloudFront)
Connection: keep-alive
X-Amz-Cf-Pop: FRA2-C2
X-Amz-Cf-Id: 4NAFm8caMG--L2-Qe-jMpyXQjAaplTX26nItRMkGxtb7usgL2m9Vng==

GET
H2 200 zones Show response
lp-01.chat.online.citi.com/api/account/50929468/configuration/le-campaigns/ 5 KB
1020 B 85ms
34ms Script
application/javascript 2a03:6400:10:0:178:249:97:99
LIVEPERSON

General

Check archive.org

Show headers Download Go to

Full URL: https://lp-01.chat.online.citi.com/api/account/50929468/configuration/le-campaigns/zones?fields=id&fields=zoneValue&cb=lpZonesStaticCB
Requested by: Host: lptag.liveperson.net
URL: https://lptag.liveperson.net/lptag/api/account/50929468/configuration/applications/taglets/.jsonp?v=2.0&df=0&b=1
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2a03:6400:10:0:178:249:97:99 , United Kingdom, ASN11054 (LIVEPERSON, US),
Reverse DNS
Software: ws /
Resource Hash: 4e4ab72725ca42cc6c17f9f590583a9cee49c62e570be8734ee1107bffc3a200

Request headers

Referer: https://online.citi.com/US/JSO/signon/DisplayUsernameSignon.do?userType=tyLogin&locale=en_US&TYNewUser=false&TYForgotUUID=false&TYMigration=&SAMLPostURL=https://www.thankyou.com//gateway2.htm&ErrorCode=&TYPostURL=https://www.thankyou.com//tyLoginGateway.htm&cmp=EMC-CRG0780012.01
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 29 Sep 2020 14:21:25 GMT
content-encoding: gzip
server: ws
x-cache-status: HIT
vary: Accept
content-type: application/javascript
status: 200
x-envoy-upstream-service-time: 1
expires: Tue, 29 Sep 2020 14:21:43 GMT

GET
H/1.1 200
OK Cookie set ca.html
20766699p.rfihub.com/ Frame E06E 0
0 76ms
22ms Document
text/html 193.0.160.128
ROCKETFUEL

General

Check archive.org

Show headers Download Go to

Full URL: https://20766699p.rfihub.com/ca.html?rfiidc=1871878971826550442&rfiaid=5344eddb4ef74dd8a4ef7411f4845e08&ver=9&ra=1467&rb=648&ca=20766699&_o=17169175&_t=thankyousignonpage&ssv_cuuid=&ssv_package=null&ssv_prodlist=null&ssv_pagename=thankyousignonpage&pe=https%3A%2F%2Fonline.citi.com%2FUS%2FJSO%2Fsignon%2FDisplayUsernameSignon.do%3FuserType%3DtyLogin%26locale%3Den_US%26TYNewUser%3Dfalse%26TYForgotUUID%3Dfalse%26TYMigration%3D%26SAMLPostURL%3Dhttps%3A%2F%2Fwww.thankyou.com%2F%2Fgateway2.htm%26ErrorCode%3D%26TYPostURL%3Dhttps%3A%2F%2Fwww.thankyou.com%2F%2FtyLoginGateway.htm%26cmp%3DEMC-CRG0780012.01&pf=&ra=8469396024789038
Requested by: Host: c1.rfihub.net
URL: https://c1.rfihub.net/js/tc.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, RSA, AES_256_CBC
Server: 193.0.160.128 , Netherlands, ASN54312 (ROCKETFUEL, US),
Reverse DNS
Software: Jetty(9.0.6.v20130930) /
Resource Hash

Request headers

Host: 20766699p.rfihub.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Referer: https://online.citi.com/US/JSO/signon/DisplayUsernameSignon.do?userType=tyLogin&locale=en_US&TYNewUser=false&TYForgotUUID=false&TYMigration=&SAMLPostURL=https://www.thankyou.com//gateway2.htm&ErrorCode=&TYPostURL=https://www.thankyou.com//tyLoginGateway.htm&cmp=EMC-CRG0780012.01
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Cookie: rud=H4sIAAAAAAAAAOMSNrQwByILSyBpZGZqamBiYiTEZ6hrke5dqVtYGGFk4hcpxWtoZmBobGFpZGFqaGkCAOzR9-I0AAAA; ruds=H4sIAAAAAAAAAOMSNrQwByILSyBpZGZqamBiYiTEZ6hrke5dqVtYGGFk4hcJAA6AKlklAAAA
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://online.citi.com/US/JSO/signon/DisplayUsernameSignon.do?userType=tyLogin&locale=en_US&TYNewUser=false&TYForgotUUID=false&TYMigration=&SAMLPostURL=https://www.thankyou.com//gateway2.htm&ErrorCode=&TYPostURL=https://www.thankyou.com//tyLoginGateway.htm&cmp=EMC-CRG0780012.01

Response headers

P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Set-Cookie: rud=H4sIAAAAAAAAAOMSNrQwByILSyBpZGZqamBiYiTEZ6hrke5dqVtYGGFk4hcpxWtoZmBobGFpZGFqaGkCAOzR9-I0AAAA; Path=/; Domain=.rfihub.com; Expires=Sun, 24 Oct 2021 14:21:25 GMT; Secure; SameSite=None ruds=H4sIAAAAAAAAAOMSNrQwByILSyBpZGZqamBiYiTEZ6hrke5dqVtYGGFk4hcJAA6AKlklAAAA; Path=/; Domain=.rfihub.com; Secure; SameSite=None
Cache-Control: no-cache
Content-Type: text/html
Content-Encoding: gzip
Vary: Accept-Encoding, User-Agent
Transfer-Encoding: chunked
Server: Jetty(9.0.6.v20130930)

GET
H/1.1 200
OK cr.png Show response
contents3.00110.citi.com/api/v1/ 4 B
397 B 455ms
140ms XHR
application/json 52.141.218.213
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://contents3.00110.citi.com/api/v1/cr.png?cid=cedric&snum=1601389285204-sjn0000813-93831140-c995-4a1e-8693-9d5d6ddfaaa8&muid=1601389284719-91F6DA58-2385-4E90-B6C4-05D4887ACE8F
Requested by: Host: online.citi.com
URL: https://online.citi.com/US/JSO/signon/DisplayUsernameSignon.do?userType=tyLogin&locale=en_US&TYNewUser=false&TYForgotUUID=false&TYMigration=&SAMLPostURL=https://www.thankyou.com//gateway2.htm&ErrorCode=&TYPostURL=https://www.thankyou.com//tyLoginGateway.htm&cmp=EMC-CRG0780012.01
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.141.218.213 Des Moines, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: nginx /
Resource Hash: 74234e98afe7498fb5daf1f36ac2d78acc339464f950703b8c019892f982b90b

Request headers

Referer: https://online.citi.com/US/JSO/signon/DisplayUsernameSignon.do?userType=tyLogin&locale=en_US&TYNewUser=false&TYForgotUUID=false&TYMigration=&SAMLPostURL=https://www.thankyou.com//gateway2.htm&ErrorCode=&TYPostURL=https://www.thankyou.com//tyLoginGateway.htm&cmp=EMC-CRG0780012.01
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
Date: Tue, 29 Sep 2020 14:21:25 GMT
Server: nginx
tail-id: 0d161050-f682-40e4-b7b6-258085f270d5
X-Kong-Proxy-Latency: 0
Content-Type: application/json
access-control-allow-origin: https://online.citi.com
X-Kong-Upstream-Latency: 3
cache-control: no-cache, no-store
access-control-allow-credentials: true
Connection: keep-alive
Content-Length: 4

POST
H2 200 TMXProfile.jws Show response
online.citi.com/US/REST/ManageTMXProfile/ 264 B
944 B 199ms
199ms XHR
application/json 104.109.92.187
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://online.citi.com/US/REST/ManageTMXProfile/TMXProfile.jws

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.109.92.187 , Netherlands, ASN20940 (AKAMAI-ASN1, EU),

Reverse DNS

a104-109-92-187.deploy.static.akamaitechnologies.com

Software

Resource Hash

1855a50f9593d06a3465f3677445e6a4fba2ebd59a86cef398512ea9ab2ea0f6

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

Accept: */*
Referer: https://online.citi.com/US/JSO/signon/DisplayUsernameSignon.do?userType=tyLogin&locale=en_US&TYNewUser=false&TYForgotUUID=false&TYMigration=&SAMLPostURL=https://www.thankyou.com//gateway2.htm&ErrorCode=&TYPostURL=https://www.thankyou.com//tyLoginGateway.htm&cmp=EMC-CRG0780012.01
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security: max-age=300
content-encoding: gzip
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
status: 200
cid: gt67p-srv1, gt67p-srv1
x-ua-compatible: IE=edge, IE=edge
pragma: no-cache
x-akamai-citisite: GTDC
jid: 200929102125650134007062, 200929102125650134007062
date: Tue, 29 Sep 2020 14:21:26 GMT
vary: Accept-Encoding
content-language: en-US
expires: 0
cache-control: no-cache, must-revalidate, proxy-revalidate, no-store
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
content-length: 235
content-type: application/json
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H/1.1 200
OK tags.js Show response
content22.online.citi.com/fp/ 49 KB
11 KB 21ms
20ms Script
text/javascript 91.235.133.67
THM

General

Check archive.org

Show headers Download Go to

Full URL

https://content22.online.citi.com/fp/tags.js?org_id=89oebq5k&session_id=7959029db1a8d9b4b554fe6564f43bf1d57a69340cdd92a73beb688ce71dded6&allow_reprofile=1

Requested by

Host: online.citi.com
URL: https://online.citi.com/TMX/TMXProfiling.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

91.235.133.67 , Netherlands, ASN30286 (THM, US),

Reverse DNS

Software

Apache /

Resource Hash

e1f473983c0fd72a542ea1bc830eecea1e2ee62d67b2f1bb455963ad22ec7769

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://online.citi.com/US/JSO/signon/DisplayUsernameSignon.do?userType=tyLogin&locale=en_US&TYNewUser=false&TYForgotUUID=false&TYMigration=&SAMLPostURL=https://www.thankyou.com//gateway2.htm&ErrorCode=&TYPostURL=https://www.thankyou.com//tyLoginGateway.htm&cmp=EMC-CRG0780012.01
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 29 Sep 2020 14:21:26 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Server: Apache
Strict-Transport-Security: max-age=31536000
Content-Type: text/javascript;charset=UTF-8
Cache-Control: no-cache, no-store, must-revalidate
Transfer-Encoding: chunked
Connection: Keep-Alive, Keep-Alive
Vary: Accept-Encoding
X-XSS-Protection: 1; mode=block
Keep-Alive: timeout=2, max=99
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2 451 425466.html
sr.rlcdn.com/ Frame 8EDD 0
0 184ms
135ms Document
text/plain 35.244.245.222
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://sr.rlcdn.com/425466.html?es=80676&u=da39a3ee5e6b4b0d3255bfef95601890afd80709
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/code/9a7b351075739244d9493ff5f4557b10.js?conditionId0=467299
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.245.222 Mountain View, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 222.245.244.35.bc.googleusercontent.com
Software: /
Resource Hash

Request headers

:method: GET
:authority: sr.rlcdn.com
:scheme: https
:path: /425466.html?es=80676&u=da39a3ee5e6b4b0d3255bfef95601890afd80709
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://online.citi.com/US/JSO/signon/DisplayUsernameSignon.do?userType=tyLogin&locale=en_US&TYNewUser=false&TYForgotUUID=false&TYMigration=&SAMLPostURL=https://www.thankyou.com//gateway2.htm&ErrorCode=&TYPostURL=https://www.thankyou.com//tyLoginGateway.htm&cmp=EMC-CRG0780012.01
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://online.citi.com/US/JSO/signon/DisplayUsernameSignon.do?userType=tyLogin&locale=en_US&TYNewUser=false&TYForgotUUID=false&TYMigration=&SAMLPostURL=https://www.thankyou.com//gateway2.htm&ErrorCode=&TYPostURL=https://www.thankyou.com//tyLoginGateway.htm&cmp=EMC-CRG0780012.01

Response headers

status: 451
date: Tue, 29 Sep 2020 14:21:26 GMT
content-length: 0
via: 1.1 google
alt-svc: clear

GET
H2 200 embed.js Show response
resources.digital-cloud-citi.medallia.com/wdcusciti/50/onsite/ 2 KB
1 KB 53ms
17ms Script
application/javascript 151.101.194.133
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://resources.digital-cloud-citi.medallia.com/wdcusciti/50/onsite/embed.js
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/code/fdf45a7c15c1cee06bb71e10dac4e26e.js?conditionId0=4849963
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.194.133 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: c657e07408dbbea092f0debde9d99f631cc1771a645e957eaf02e1a5dd1b60b5

Request headers

Referer: https://online.citi.com/US/JSO/signon/DisplayUsernameSignon.do?userType=tyLogin&locale=en_US&TYNewUser=false&TYForgotUUID=false&TYMigration=&SAMLPostURL=https://www.thankyou.com//gateway2.htm&ErrorCode=&TYPostURL=https://www.thankyou.com//tyLoginGateway.htm&cmp=EMC-CRG0780012.01
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-amz-version-id: DMbNU8DUkU9FKIwti7XWu9RIBg44gi9h
content-encoding: gzip
etag: "1ddf19523d1ce483cec98d7f0bb10b6e"
age: 109
via: 1.1 varnish
x-cache: HIT
status: 200
content-length: 674
x-amz-id-2: qiUloTUdUWw7wffVfS0mQV8qDtDGso7fDRsg3olYeTCUJQ1H1L384/k3J7GnUaJ1RecM6AjlYF0=
x-served-by: cache-ams21023-AMS
last-modified: Mon, 28 Sep 2020 02:04:12 GMT
server: AmazonS3
x-timer: S1601389286.092487,VS0,VE1
date: Tue, 29 Sep 2020 14:21:26 GMT
vary: Accept-Encoding
x-amz-request-id: 713172900BA4016B
access-control-allow-origin: *
cache-control: max-age=0,must-revalidate
accept-ranges: bytes
content-type: application/javascript
x-cache-hits: 1

GET
H2 200 1560.js Show response
cdn.pbbl.co/r/ 32 KB
9 KB 195ms
130ms Script
application/javascript 143.204.94.11
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.pbbl.co/r/1560.js

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/code/8637af7c210f4e79436bc39f71b49bfa.js?conditionId0=4827153

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

143.204.94.11 Seattle, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-143-204-94-11.fra50.r.cloudfront.net

Software

nginx/1.10.3 (Ubuntu) /

Resource Hash

51ae37d6c7ae7327c5ff7263e9258d998d303fda16ed063fea667c23030f83c1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Xss-Protection	1

Request headers

Referer: https://online.citi.com/US/JSO/signon/DisplayUsernameSignon.do?userType=tyLogin&locale=en_US&TYNewUser=false&TYForgotUUID=false&TYMigration=&SAMLPostURL=https://www.thankyou.com//gateway2.htm&ErrorCode=&TYPostURL=https://www.thankyou.com//tyLoginGateway.htm&cmp=EMC-CRG0780012.01
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 29 Sep 2020 14:21:26 GMT
content-encoding: gzip
vary: Accept-Encoding
x-amz-cf-pop: FRA50-C1
x-cache: Miss from cloudfront
status: 200
x-xss-protection: 1
last-modified: Wed, 23 Sep 2020 19:01:22 GMT
server: nginx/1.10.3 (Ubuntu)
etag: W/"5f6b9b82-7eec"
strict-transport-security: max-age=31536000
content-type: application/javascript
via: 1.1 0d37b2e69745cd9f0c5457fbf1a83129.cloudfront.net (CloudFront)
cache-control: max-age=1800, public
x-amz-cf-id: RUTWTtXTcnZc-sQCxy1mwEPbnqU8lOKQLOY27rm7qTHuM6c3baILfA==
expires: Tue, 29 Sep 2020 14:51:26 GMT

GET
H/1.1 200
OK check.js;CIS3SID=67976A93C8D450F65E37A1CD641DB509 Show response
content22.online.citi.com/fp/ Frame 0976 174 KB
44 KB 29ms
29ms Script
text/javascript 91.235.133.67
THM

General

Check archive.org

Show headers Download Go to

Full URL

https://content22.online.citi.com/fp/check.js;CIS3SID=67976A93C8D450F65E37A1CD641DB509?org_id=89oebq5k&session_id=cf40e4849e45711ff9ddabe667b837a5426267c7c86bb19a726ed881cc7102e3&nonce=b40b017a1adcd64d&pageid=1&jb=313526266a736775354c696e7778266871673d4c696c757a2468716a3f4168726f6f672730323a31

Requested by

Host: content22.online.citi.com
URL: https://content22.online.citi.com/fp/tags.js?org_id=89oebq5k&session_id=cf40e4849e45711ff9ddabe667b837a5426267c7c86bb19a726ed881cc7102e3&allow_reprofile=1

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

91.235.133.67 , Netherlands, ASN30286 (THM, US),

Reverse DNS

Software

Apache /

Resource Hash

b381eaccfca885e5455f9585d1789bf31b0b06bbb4c1592c08723fcc0d225feb

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://online.citi.com/US/JSO/signon/DisplayUsernameSignon.do?userType=tyLogin&locale=en_US&TYNewUser=false&TYForgotUUID=false&TYMigration=&SAMLPostURL=https://www.thankyou.com//gateway2.htm&ErrorCode=&TYPostURL=https://www.thankyou.com//tyLoginGateway.htm&cmp=EMC-CRG0780012.01
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 29 Sep 2020 14:21:26 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Server: Apache
Strict-Transport-Security: max-age=31536000
Content-Type: text/javascript;charset=UTF-8
Cache-Control: no-cache, no-store, must-revalidate
Transfer-Encoding: chunked
tmx-nonce: b40b017a1adcd64d
Connection: Keep-Alive, Keep-Alive
Vary: Accept-Encoding
X-XSS-Protection: 1; mode=block
Keep-Alive: timeout=2, max=98
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H/1.1 200
OK clear.png
content22.online.citi.com/fp/ Frame 0976 81 B
475 B 48ms
17ms Image
image/png 91.235.133.67
THM

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://content22.online.citi.com/fp/clear.png?org_id=89oebq5k&session_id=cf40e4849e45711ff9ddabe667b837a5426267c7c86bb19a726ed881cc7102e3&nonce=b40b017a1adcd64d&pageid=1&w=be94d442a7b3453f&ck=0&m=1

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

91.235.133.67 , Netherlands, ASN30286 (THM, US),

Reverse DNS

Software

Apache /

Resource Hash

95518cbec0d55a574a9c8ef72a2a7d62ac0d40a4de5dfe67a76a7d214dc8b743

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://online.citi.com/US/JSO/signon/DisplayUsernameSignon.do?userType=tyLogin&locale=en_US&TYNewUser=false&TYForgotUUID=false&TYMigration=&SAMLPostURL=https://www.thankyou.com//gateway2.htm&ErrorCode=&TYPostURL=https://www.thankyou.com//tyLoginGateway.htm&cmp=EMC-CRG0780012.01
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 29 Sep 2020 14:21:26 GMT
X-Content-Type-Options: nosniff
Server: Apache
Strict-Transport-Security: max-age=31536000
Content-Type: image/png
Cache-Control: no-cache, no-store, must-revalidate
Connection: Keep-Alive
Keep-Alive: timeout=2, max=100
Content-Length: 81
X-XSS-Protection: 1; mode=block
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H/1.1 200
OK clear.png
content22.online.citi.com/fp/ Frame 0976 81 B
475 B 48ms
17ms Image
image/png 91.235.133.67
THM

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://content22.online.citi.com/fp/clear.png?org_id=89oebq5k&session_id=cf40e4849e45711ff9ddabe667b837a5426267c7c86bb19a726ed881cc7102e3&nonce=b40b017a1adcd64d&pageid=1&ck=0&m=2

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

91.235.133.67 , Netherlands, ASN30286 (THM, US),

Reverse DNS

Software

Apache /

Resource Hash

95518cbec0d55a574a9c8ef72a2a7d62ac0d40a4de5dfe67a76a7d214dc8b743

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://online.citi.com/US/JSO/signon/DisplayUsernameSignon.do?userType=tyLogin&locale=en_US&TYNewUser=false&TYForgotUUID=false&TYMigration=&SAMLPostURL=https://www.thankyou.com//gateway2.htm&ErrorCode=&TYPostURL=https://www.thankyou.com//tyLoginGateway.htm&cmp=EMC-CRG0780012.01
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 29 Sep 2020 14:21:26 GMT
X-Content-Type-Options: nosniff
Server: Apache
Strict-Transport-Security: max-age=31536000
Content-Type: image/png
Cache-Control: no-cache, no-store, must-revalidate
Connection: Keep-Alive
Keep-Alive: timeout=2, max=100
Content-Length: 81
X-XSS-Protection: 1; mode=block
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H/1.1 200
OK 63068
stags.bluekai.com/site/ Frame 66E9 0
0 534ms
271ms Document
text/html 184.30.210.81
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://stags.bluekai.com/site/63068?ret=html&phint=language%3DEnglish&phint=product%3D&phint=event&phint=category%3Dprelogin%20sign%20on%20page&phint=page%3Dthankyou%20signon%20page&phint=section1%3Dother&phint=section2%3Dpublic&phint=section3%3Dthankyou&phint=section4%3Dsignon&phint=bankappstatus&phint=productID&phint=__bk_t%3DCiti%20ThankYou%C2%AE%20Rewards%20%3F%20Sign%20On&phint=__bk_k%3D&phint=__bk_l%3Dhttps%3A%2F%2Fonline.citi.com%2FUS%2FJSO%2Fsignon%2FDisplayUsernameSignon.do%3FuserType%3DtyLogin%26locale%3Den_US%26TYNewUser%3Dfalse%26TYForgotUUID%3Dfalse%26TYMigration%3D%26SAMLPostURL%3Dhttps%3A%2F%2Fwww.thankyou.com%2F%2Fgateway2.htm%26ErrorCode%3D%26TYPostURL%3Dhttps%3A%2F%2Fwww.thankyou.com%2F%2FtyLoginGateway.htm%26cmp%3DEMC-CRG0780012.01&phint=__bk_v%3D3.1.6&limit=10&r=33734178
Requested by: Host: tags.bkrtx.com
URL: https://tags.bkrtx.com/js/bk-coretag.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 184.30.210.81 , Netherlands, ASN20940 (AKAMAI-ASN1, EU),
Reverse DNS: a184-30-210-81.deploy.static.akamaitechnologies.com
Software: /
Resource Hash

Request headers

Host: stags.bluekai.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Referer: https://online.citi.com/US/JSO/signon/DisplayUsernameSignon.do?userType=tyLogin&locale=en_US&TYNewUser=false&TYForgotUUID=false&TYMigration=&SAMLPostURL=https://www.thankyou.com//gateway2.htm&ErrorCode=&TYPostURL=https://www.thankyou.com//tyLoginGateway.htm&cmp=EMC-CRG0780012.01
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://online.citi.com/US/JSO/signon/DisplayUsernameSignon.do?userType=tyLogin&locale=en_US&TYNewUser=false&TYForgotUUID=false&TYMigration=&SAMLPostURL=https://www.thankyou.com//gateway2.htm&ErrorCode=&TYPostURL=https://www.thankyou.com//tyLoginGateway.htm&cmp=EMC-CRG0780012.01

Response headers

Content-Type: text/html
Content-Length: 71
P3P: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV", policyref="http://tags.bluekai.com/w3c/p3p.xml"
BK-Server: 4eb4
Date: Tue, 29 Sep 2020 14:21:26 GMT
Connection: keep-alive
X-N: S

GET
H2 200 storage.secure.min.html Show response
lpcdn.chat.online.citi.com/le_secure_storage/3.10.0.1-release_5033/ Frame AF4B 38 KB
16 KB 1465ms
21ms Document
text/html 2a03:6400:10:0:178:249:97:98
LIVEPERSON

General

Check archive.org

Show headers Download Go to

Full URL: https://lpcdn.chat.online.citi.com/le_secure_storage/3.10.0.1-release_5033/storage.secure.min.html?loc=https%3A%2F%2Fonline.citi.com&site=50929468&env=prod
Requested by: Host: lptag.liveperson.net
URL: https://lptag.liveperson.net/lptag/api/account/50929468/configuration/applications/taglets/.jsonp?v=2.0&df=0&b=1
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2a03:6400:10:0:178:249:97:98 , United Kingdom, ASN11054 (LIVEPERSON, US),
Reverse DNS
Software: ws /
Resource Hash: c9e14253e4c22e98945e45a455a7e7f967c183a62f032e4264fb073dec2ee0e8

Request headers

:method: GET
:authority: lpcdn.chat.online.citi.com
:scheme: https
:path: /le_secure_storage/3.10.0.1-release_5033/storage.secure.min.html?loc=https%3A%2F%2Fonline.citi.com&site=50929468&env=prod
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: same-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://online.citi.com/US/JSO/signon/DisplayUsernameSignon.do?userType=tyLogin&locale=en_US&TYNewUser=false&TYForgotUUID=false&TYMigration=&SAMLPostURL=https://www.thankyou.com//gateway2.htm&ErrorCode=&TYPostURL=https://www.thankyou.com//tyLoginGateway.htm&cmp=EMC-CRG0780012.01
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://online.citi.com/US/JSO/signon/DisplayUsernameSignon.do?userType=tyLogin&locale=en_US&TYNewUser=false&TYForgotUUID=false&TYMigration=&SAMLPostURL=https://www.thankyou.com//gateway2.htm&ErrorCode=&TYPostURL=https://www.thankyou.com//tyLoginGateway.htm&cmp=EMC-CRG0780012.01

Response headers

status: 200
date: Tue, 29 Sep 2020 14:21:28 GMT
content-type: text/html
last-modified: Mon, 30 Mar 2020 14:49:28 GMT
content-encoding: gzip
server: ws
vary: Origin
access-control-allow-methods: GET, POST, PATCH
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization, X-HTTP-Method-Override, LP-DOMAIN-REFERER, LP-URL, ETag, ac-revision, X-LP-Last-Modified, If-Match, Authentication-Method, Credit-Card-Ref, Automation-Secret, Email-Token
access-control-expose-headers: X-Requested-With, X-HTTP-Method-Override, LP-DOMAIN-REFERER, LP-URL, ETag, ac-revision, X-LP-Last-Modified, If-Match, Authentication-Method, Credit-Card-Ref, Automation-Secret, Email-Token, x-lp-host, Lp-Req-Time, date, x-application-context, strict-transport-security, x-content-type-options, x-download-options, x-xss-protection, x-cache-status, x-amz-id-2, x-amz-request-id, expires, last-modified, set-cookie, content-security-policy, x-frame-options
access-control-allow-credentials: true
expires: Tue, 29 Sep 2020 14:31:28 GMT
cache-control: max-age=600

GET
H/1.1 200
OK check.js;CIS3SID=40DB560ABF04134584AF178535767951 Show response
content22.online.citi.com/fp/ Frame CDA9 174 KB
44 KB 1286ms
27ms Script
text/javascript 91.235.133.67
THM

General

Check archive.org

Show headers Download Go to

Full URL

https://content22.online.citi.com/fp/check.js;CIS3SID=40DB560ABF04134584AF178535767951?org_id=89oebq5k&session_id=7959029db1a8d9b4b554fe6564f43bf1d57a69340cdd92a73beb688ce71dded6&nonce=22322e055d970a9b&pageid=1&jb=313f262e6a7167753f4c69667570246a716f3d4c6b6e7778246a71623f416a726f6d672530383a33

Requested by

Host: content22.online.citi.com
URL: https://content22.online.citi.com/fp/tags.js?org_id=89oebq5k&session_id=7959029db1a8d9b4b554fe6564f43bf1d57a69340cdd92a73beb688ce71dded6&allow_reprofile=1

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

91.235.133.67 , Netherlands, ASN30286 (THM, US),

Reverse DNS

Software

Apache /

Resource Hash

5e618c111ca132b80545bda22b41c930f1a370b4750bfc127476803b6fa26690

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://online.citi.com/US/JSO/signon/DisplayUsernameSignon.do?userType=tyLogin&locale=en_US&TYNewUser=false&TYForgotUUID=false&TYMigration=&SAMLPostURL=https://www.thankyou.com//gateway2.htm&ErrorCode=&TYPostURL=https://www.thankyou.com//tyLoginGateway.htm&cmp=EMC-CRG0780012.01
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Tue, 29 Sep 2020 14:21:28 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Transfer-Encoding: chunked
P3P: CP=IVAa PSAa
tmx-nonce: 22322e055d970a9b
Connection: Keep-Alive, Keep-Alive
X-XSS-Protection: 1; mode=block
Pragma: no-cache
Server: Apache
Vary: Accept-Encoding
Strict-Transport-Security: max-age=31536000
Content-Type: text/javascript;charset=UTF-8
Cache-Control: no-cache, no-store, must-revalidate
Keep-Alive: timeout=2, max=98
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H/1.1 200
OK clear.png
content22.online.citi.com/fp/ Frame CDA9 81 B
474 B 1262ms
16ms Image
image/png 91.235.133.67
THM

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://content22.online.citi.com/fp/clear.png?org_id=89oebq5k&session_id=7959029db1a8d9b4b554fe6564f43bf1d57a69340cdd92a73beb688ce71dded6&nonce=22322e055d970a9b&pageid=1&w=be96d442a7b3453f&ck=0&m=1

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

91.235.133.67 , Netherlands, ASN30286 (THM, US),

Reverse DNS

Software

Apache /

Resource Hash

95518cbec0d55a574a9c8ef72a2a7d62ac0d40a4de5dfe67a76a7d214dc8b743

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://online.citi.com/US/JSO/signon/DisplayUsernameSignon.do?userType=tyLogin&locale=en_US&TYNewUser=false&TYForgotUUID=false&TYMigration=&SAMLPostURL=https://www.thankyou.com//gateway2.htm&ErrorCode=&TYPostURL=https://www.thankyou.com//tyLoginGateway.htm&cmp=EMC-CRG0780012.01
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 29 Sep 2020 14:21:28 GMT
X-Content-Type-Options: nosniff
Server: Apache
Strict-Transport-Security: max-age=31536000
Content-Type: image/png
Cache-Control: no-cache, no-store, must-revalidate
Connection: Keep-Alive
Keep-Alive: timeout=2, max=99
Content-Length: 81
X-XSS-Protection: 1; mode=block
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H/1.1 200
OK clear.png
content22.online.citi.com/fp/ Frame CDA9 81 B
474 B 1260ms
16ms Image
image/png 91.235.133.67
THM

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://content22.online.citi.com/fp/clear.png?org_id=89oebq5k&session_id=7959029db1a8d9b4b554fe6564f43bf1d57a69340cdd92a73beb688ce71dded6&nonce=22322e055d970a9b&pageid=1&ck=0&m=2

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

91.235.133.67 , Netherlands, ASN30286 (THM, US),

Reverse DNS

Software

Apache /

Resource Hash

95518cbec0d55a574a9c8ef72a2a7d62ac0d40a4de5dfe67a76a7d214dc8b743

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://online.citi.com/US/JSO/signon/DisplayUsernameSignon.do?userType=tyLogin&locale=en_US&TYNewUser=false&TYForgotUUID=false&TYMigration=&SAMLPostURL=https://www.thankyou.com//gateway2.htm&ErrorCode=&TYPostURL=https://www.thankyou.com//tyLoginGateway.htm&cmp=EMC-CRG0780012.01
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 29 Sep 2020 14:21:28 GMT
X-Content-Type-Options: nosniff
Server: Apache
Strict-Transport-Security: max-age=31536000
Content-Type: image/png
Cache-Control: no-cache, no-store, must-revalidate
Connection: Keep-Alive
Keep-Alive: timeout=2, max=99
Content-Length: 81
X-XSS-Protection: 1; mode=block
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2 200 generic1601258650900.js Show response
resources.digital-cloud-citi.medallia.com/wdcusciti/50/onsite/ 356 KB
63 KB 1204ms
1204ms Script
application/javascript 151.101.194.133
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://resources.digital-cloud-citi.medallia.com/wdcusciti/50/onsite/generic1601258650900.js
Requested by: Host: resources.digital-cloud-citi.medallia.com
URL: https://resources.digital-cloud-citi.medallia.com/wdcusciti/50/onsite/embed.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.194.133 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 57d2da56bf34e445e118b213e19860af009e9109ea36c0f73c94027e4696e0f5

Request headers

Referer: https://online.citi.com/US/JSO/signon/DisplayUsernameSignon.do?userType=tyLogin&locale=en_US&TYNewUser=false&TYForgotUUID=false&TYMigration=&SAMLPostURL=https://www.thankyou.com//gateway2.htm&ErrorCode=&TYPostURL=https://www.thankyou.com//tyLoginGateway.htm&cmp=EMC-CRG0780012.01
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-amz-version-id: ya2A6E7vjpoc0mnzLJH5ITX0Ej8bfkcV
content-encoding: gzip
etag: "3875eaaa80b4b26a2ae59c21b91bfb72"
age: 76
via: 1.1 varnish
x-cache: HIT
status: 200
content-length: 64037
x-amz-id-2: GISKBeFrGHqKW1bi1IwMHMby7YT2BUff5vgPVFWhUR4317jtllPTRJC5syZRpGvUrjSumJ+eJUs=
x-served-by: cache-ams21023-AMS
last-modified: Mon, 28 Sep 2020 02:04:12 GMT
server: AmazonS3
x-timer: S1601389289.639117,VS0,VE1
date: Tue, 29 Sep 2020 14:21:28 GMT
vary: Accept-Encoding
x-amz-request-id: 0BC02B08BA6B8C47
access-control-allow-origin: *
cache-control: max-age=0,must-revalidate
accept-ranges: bytes
content-type: application/javascript
x-cache-hits: 1

GET
H2 200 pp.html
cdn.pbbl.co/i/ Frame F7E7 0
0 1277ms
1277ms Document
text/html 143.204.94.11
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.pbbl.co/i/pp.html
Requested by: Host: cdn.pbbl.co
URL: https://cdn.pbbl.co/r/1560.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 143.204.94.11 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-143-204-94-11.fra50.r.cloudfront.net
Software: nginx/1.10.3 (Ubuntu) /
Resource Hash

Request headers

:method: GET
:authority: cdn.pbbl.co
:scheme: https
:path: /i/pp.html
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://online.citi.com/US/JSO/signon/DisplayUsernameSignon.do?userType=tyLogin&locale=en_US&TYNewUser=false&TYForgotUUID=false&TYMigration=&SAMLPostURL=https://www.thankyou.com//gateway2.htm&ErrorCode=&TYPostURL=https://www.thankyou.com//tyLoginGateway.htm&cmp=EMC-CRG0780012.01
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://online.citi.com/US/JSO/signon/DisplayUsernameSignon.do?userType=tyLogin&locale=en_US&TYNewUser=false&TYForgotUUID=false&TYMigration=&SAMLPostURL=https://www.thankyou.com//gateway2.htm&ErrorCode=&TYPostURL=https://www.thankyou.com//tyLoginGateway.htm&cmp=EMC-CRG0780012.01

Response headers

status: 200
content-type: text/html
server: nginx/1.10.3 (Ubuntu)
date: Tue, 29 Sep 2020 14:21:28 GMT
last-modified: Thu, 30 Jan 2020 18:07:58 GMT
etag: W/"5e331b7e-6cd"
content-encoding: gzip
vary: Accept-Encoding
x-cache: Miss from cloudfront
via: 1.1 0d37b2e69745cd9f0c5457fbf1a83129.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA50-C1
x-amz-cf-id: DbZfl6isQ-BrSDIhrn9xiIGY-I4ePNk5VmgIruhgR4HOmNTKBFqhlA==

GET
H/1.1 200
OK clear.png Show response
content22.online.citi.com/fp/ Frame 0976 81 B
531 B 1306ms
17ms XHR
image/png 91.235.133.67
THM

General

Check archive.org

Show headers Download Go to

Full URL

https://content22.online.citi.com/fp/clear.png

Requested by

Host: content22.online.citi.com
URL: https://content22.online.citi.com/fp/check.js;CIS3SID=67976A93C8D450F65E37A1CD641DB509?org_id=89oebq5k&session_id=cf40e4849e45711ff9ddabe667b837a5426267c7c86bb19a726ed881cc7102e3&nonce=b40b017a1adcd64d&pageid=1&jb=313526266a736775354c696e7778266871673d4c696c757a2468716a3f4168726f6f672730323a31

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

91.235.133.67 , Netherlands, ASN30286 (THM, US),

Reverse DNS

Software

Apache /

Resource Hash

95518cbec0d55a574a9c8ef72a2a7d62ac0d40a4de5dfe67a76a7d214dc8b743

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Accept: */*, 89oebq5k/b40b017a1adcd64dcf40e4849e45711ff9ddabe667b837a5426267c7c86bb19a726ed881cc7102e3
Referer: https://online.citi.com/US/JSO/signon/DisplayUsernameSignon.do?userType=tyLogin&locale=en_US&TYNewUser=false&TYForgotUUID=false&TYMigration=&SAMLPostURL=https://www.thankyou.com//gateway2.htm&ErrorCode=&TYPostURL=https://www.thankyou.com//tyLoginGateway.htm&cmp=EMC-CRG0780012.01
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Tue, 29 Sep 2020 14:21:28 GMT
Last-Modified: Tue, 29 Sep 2020 14:21:28 GMT
Server: Apache
Etag: fe73c0b2780445718822ec812ffee064
Strict-Transport-Security: max-age=31536000
Content-Type: image/png
Access-Control-Allow-Origin: https://online.citi.com
Cache-Control: private, must-revalidate, max-age=0
Connection: Keep-Alive
Keep-Alive: timeout=2, max=100
Content-Length: 81
Expires: Sun, 28 Sep 2025 14:21:28 GMT

GET
H/1.1 200
OK ls_fp.html;CIS3SID=67976A93C8D450F65E37A1CD641DB509 Show response
content22.online.citi.com/fp/ Frame 3B4D 48 KB
12 KB 1185ms
21ms Document
text/html 91.235.133.67
THM

General

Check archive.org

Show headers Download Go to

Full URL

https://content22.online.citi.com/fp/ls_fp.html;CIS3SID=67976A93C8D450F65E37A1CD641DB509?org_id=89oebq5k&session_id=cf40e4849e45711ff9ddabe667b837a5426267c7c86bb19a726ed881cc7102e3&nonce=b40b017a1adcd64d&pageid=1

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

91.235.133.67 , Netherlands, ASN30286 (THM, US),

Reverse DNS

Software

Apache /

Resource Hash

d57d88d75a6b978bccea69f0ddf436826b570c9b911889a2718a59e1fa521a6d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Host: content22.online.citi.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: same-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Referer: https://online.citi.com/US/JSO/signon/DisplayUsernameSignon.do?userType=tyLogin&locale=en_US&TYNewUser=false&TYForgotUUID=false&TYMigration=&SAMLPostURL=https://www.thankyou.com//gateway2.htm&ErrorCode=&TYPostURL=https://www.thankyou.com//tyLoginGateway.htm&cmp=EMC-CRG0780012.01
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Cookie: _4c_=hVLPj5s8EP1XVj7klIJtfplIqKqy21WrpK2W5fCdVsYMCQrByDildJX%2Ffcck2UqfVJWD5XnMvPfGM69k3ENHViymLBApF0kYiiU5wDSQ1StRvTt%2FuuNkWrIie2v7YeX7umubDjzV2MZT%2BugXuf81%2F%2B4Pza7TnX%2FfDH0rp2IA08kj5DPqVfrjCZHnqYfMThu9a7pFq5VsIYPupcgXz%2F99g9EVZbVsB8D4szY7bYviy%2F07tG12RtpGd9ki%2F7Td%2FNCDLZ422c3YOI6e3cvuMOnT7MzfSQujnLi3t8fFgzHarHUFGVL9u%2FZq8%2FFCMTOoY589bNcf1k%2BPNBGUMu5RRpZEISk%2BEEu92BMY298u4hSvvdHVSdkXi50jOEJ5N1QH%2FFEaPWK7iK33Rh%2FhTgSI1vjoJK5B1alSIuYyCVlFE5lSXkdJCYKVVY15GkdEtlLh1UANxsxMGA2NdTq34VwRnOkVvPXorOFsCSPnJfl1WYIwiWJcgoBjBxYnLuKQug8zTFNdt4EEdZhWXASqrGVUJZEMkzJgPA0gAJrGrv8LX8riiItIBI6gR765nv2Ro8Esh8gsx8J3OWft%2F9l%2FM3c%2BvwE%3D
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://online.citi.com/US/JSO/signon/DisplayUsernameSignon.do?userType=tyLogin&locale=en_US&TYNewUser=false&TYForgotUUID=false&TYMigration=&SAMLPostURL=https://www.thankyou.com//gateway2.htm&ErrorCode=&TYPostURL=https://www.thankyou.com//tyLoginGateway.htm&cmp=EMC-CRG0780012.01

Response headers

Date: Tue, 29 Sep 2020 14:21:28 GMT
Server: Apache
Strict-Transport-Security: max-age=31536000
Cache-Control: no-cache, no-store, must-revalidate
Pragma: no-cache
Connection: Keep-Alive, Keep-Alive
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Content-Type: text/html;charset=UTF-8
Vary: Accept-Encoding
Content-Encoding: gzip
Keep-Alive: timeout=2, max=100
Transfer-Encoding: chunked

GET
H/1.1 204
No Content clear.png Show response
content22.online.citi.com/fp/ Frame 0976 0
388 B 1180ms
16ms Script
text/javascript 91.235.133.67
THM

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

91.235.133.67 , Netherlands, ASN30286 (THM, US),

Reverse DNS

Software

Apache /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://online.citi.com/US/JSO/signon/DisplayUsernameSignon.do?userType=tyLogin&locale=en_US&TYNewUser=false&TYForgotUUID=false&TYMigration=&SAMLPostURL=https://www.thankyou.com//gateway2.htm&ErrorCode=&TYPostURL=https://www.thankyou.com//tyLoginGateway.htm&cmp=EMC-CRG0780012.01
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 29 Sep 2020 14:21:28 GMT
X-Content-Type-Options: nosniff
Server: Apache
Strict-Transport-Security: max-age=31536000
Content-Type: text/javascript
Cache-Control: no-cache, no-store, must-revalidate
Connection: Keep-Alive
Keep-Alive: timeout=2, max=100
X-XSS-Protection: 1; mode=block
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H/1.1 200
OK sid_fp.html;CIS3SID=67976A93C8D450F65E37A1CD641DB509
h.online-metrix.net/fp/ Frame 7322 0
0 1316ms
20ms Document
text/html 91.235.132.130
THM

General

Check archive.org

Show headers Download Go to

Full URL

https://h.online-metrix.net/fp/sid_fp.html;CIS3SID=67976A93C8D450F65E37A1CD641DB509?org_id=89oebq5k&session_id=cf40e4849e45711ff9ddabe667b837a5426267c7c86bb19a726ed881cc7102e3&nonce=b40b017a1adcd64d&pageid=1

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

91.235.132.130 , Netherlands, ASN30286 (THM, US),

Reverse DNS

h.online-metrix.net

Software

Apache /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Host: h.online-metrix.net
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Referer: https://online.citi.com/US/JSO/signon/DisplayUsernameSignon.do?userType=tyLogin&locale=en_US&TYNewUser=false&TYForgotUUID=false&TYMigration=&SAMLPostURL=https://www.thankyou.com//gateway2.htm&ErrorCode=&TYPostURL=https://www.thankyou.com//tyLoginGateway.htm&cmp=EMC-CRG0780012.01
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://online.citi.com/US/JSO/signon/DisplayUsernameSignon.do?userType=tyLogin&locale=en_US&TYNewUser=false&TYForgotUUID=false&TYMigration=&SAMLPostURL=https://www.thankyou.com//gateway2.htm&ErrorCode=&TYPostURL=https://www.thankyou.com//tyLoginGateway.htm&cmp=EMC-CRG0780012.01

Response headers

Date: Tue, 29 Sep 2020 14:21:28 GMT
Server: Apache
Strict-Transport-Security: max-age=31536000
Cache-Control: no-cache, no-store, must-revalidate
Pragma: no-cache
Connection: Keep-Alive, Keep-Alive
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Content-Type: text/html;charset=UTF-8
Vary: Accept-Encoding
Content-Encoding: gzip
Keep-Alive: timeout=2, max=100
Transfer-Encoding: chunked

GET
H/1.1 204
No Content clear.png Show response
content22.online.citi.com/fp/ Frame 0976 0
387 B 935ms
17ms Script
text/javascript 91.235.133.67
THM

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

91.235.133.67 , Netherlands, ASN30286 (THM, US),

Reverse DNS

Software

Apache /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://online.citi.com/US/JSO/signon/DisplayUsernameSignon.do?userType=tyLogin&locale=en_US&TYNewUser=false&TYForgotUUID=false&TYMigration=&SAMLPostURL=https://www.thankyou.com//gateway2.htm&ErrorCode=&TYPostURL=https://www.thankyou.com//tyLoginGateway.htm&cmp=EMC-CRG0780012.01
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 29 Sep 2020 14:21:28 GMT
X-Content-Type-Options: nosniff
Server: Apache
Strict-Transport-Security: max-age=31536000
Content-Type: text/javascript
Cache-Control: no-cache, no-store, must-revalidate
Connection: Keep-Alive
Keep-Alive: timeout=2, max=99
X-XSS-Protection: 1; mode=block
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H/1.1 200
OK top_fp.html;CIS3SID=67976A93C8D450F65E37A1CD641DB509 Show response
content22.online.citi.com/fp/ Frame C68C 47 KB
12 KB 916ms
20ms Document
text/html 91.235.133.67
THM

General

Check archive.org

Show headers Download Go to

Full URL

https://content22.online.citi.com/fp/top_fp.html;CIS3SID=67976A93C8D450F65E37A1CD641DB509?org_id=89oebq5k&session_id=cf40e4849e45711ff9ddabe667b837a5426267c7c86bb19a726ed881cc7102e3&nonce=b40b017a1adcd64d&pageid=1

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

91.235.133.67 , Netherlands, ASN30286 (THM, US),

Reverse DNS

Software

Apache /

Resource Hash

ff2631e3ff27482f9c7e83d41e5f90cca00fbca2fe749c24fae417bd8735ce09

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Host: content22.online.citi.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: same-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Referer: https://online.citi.com/US/JSO/signon/DisplayUsernameSignon.do?userType=tyLogin&locale=en_US&TYNewUser=false&TYForgotUUID=false&TYMigration=&SAMLPostURL=https://www.thankyou.com//gateway2.htm&ErrorCode=&TYPostURL=https://www.thankyou.com//tyLoginGateway.htm&cmp=EMC-CRG0780012.01
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Cookie: _4c_=hVLPj5s8EP1XVj7klIJtfplIqKqy21WrpK2W5fCdVsYMCQrByDildJX%2Ffcck2UqfVJWD5XnMvPfGM69k3ENHViymLBApF0kYiiU5wDSQ1StRvTt%2FuuNkWrIie2v7YeX7umubDjzV2MZT%2BugXuf81%2F%2B4Pza7TnX%2FfDH0rp2IA08kj5DPqVfrjCZHnqYfMThu9a7pFq5VsIYPupcgXz%2F99g9EVZbVsB8D4szY7bYviy%2F07tG12RtpGd9ki%2F7Td%2FNCDLZ422c3YOI6e3cvuMOnT7MzfSQujnLi3t8fFgzHarHUFGVL9u%2FZq8%2FFCMTOoY589bNcf1k%2BPNBGUMu5RRpZEISk%2BEEu92BMY298u4hSvvdHVSdkXi50jOEJ5N1QH%2FFEaPWK7iK33Rh%2FhTgSI1vjoJK5B1alSIuYyCVlFE5lSXkdJCYKVVY15GkdEtlLh1UANxsxMGA2NdTq34VwRnOkVvPXorOFsCSPnJfl1WYIwiWJcgoBjBxYnLuKQug8zTFNdt4EEdZhWXASqrGVUJZEMkzJgPA0gAJrGrv8LX8riiItIBI6gR765nv2Ro8Esh8gsx8J3OWft%2F9l%2FM3c%2BvwE%3D
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://online.citi.com/US/JSO/signon/DisplayUsernameSignon.do?userType=tyLogin&locale=en_US&TYNewUser=false&TYForgotUUID=false&TYMigration=&SAMLPostURL=https://www.thankyou.com//gateway2.htm&ErrorCode=&TYPostURL=https://www.thankyou.com//tyLoginGateway.htm&cmp=EMC-CRG0780012.01

Response headers

Date: Tue, 29 Sep 2020 14:21:28 GMT
Server: Apache
Strict-Transport-Security: max-age=31536000
Cache-Control: no-cache, no-store, must-revalidate
Pragma: no-cache
Connection: Keep-Alive, Keep-Alive
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Content-Type: text/html;charset=UTF-8
Vary: Accept-Encoding
Content-Encoding: gzip
Keep-Alive: timeout=2, max=100
Transfer-Encoding: chunked

GET
H/1.1 204
204 clear.png Show response
content22.online.citi.com/fp/ Frame 0976 0
218 B 40ms
18ms Script
text/javascript 91.235.133.67
THM

General

Check archive.org

Show headers Download Go to

Full URL

https://content22.online.citi.com/fp/clear.png?org_id=89oebq5k&session_id=cf40e4849e45711ff9ddabe667b837a5426267c7c86bb19a726ed881cc7102e3&nonce=b40b017a1adcd64d&pageid=1&ja=3b303026267735626d39366436343263356a333435316624613f343824783d363024643f333432327a393032322669663f3334303070393232322473787b3d327a3226647072353124313630322c313032382c313632302e333032382e333630302e333032322e333438322e333238302e322e30267b6b643f3036266c6a3d6a76767073253349253a462532446f6e6e6b66652e636b746b2c616d65273046555327304448514d27304e716b656e676e27304444697b786c637b577365706e636f675369676e676e26646f2531467571677a54797067253146767b446d65696e2530346e6d61636e672d3146676e57555127303654514665755771657227334664636c7365253a365c59466f70676f76575d494425314464636e716d27303654594f6b657063766b6d66273146253a3651434f4c50677b7457504e25334668767672732533412d324e2532467577772c7660616e6b7b6f772c616d652730462532446563766775637b3a2c6a766d2d32344770726f7a4b6f6667273344273234565b506f73745d52442533446a747472712d3341253046273044757f752c7468616c697b6d772c616d65273044253a46767b4e6f6761664763766777617b2e6a2466723d2668603d6d6337343135643235303337346730346735603e6032343764363331663566362462716d3f4c616e777a246a736a35436a706d6d652732323a31266a736f7d3d44696e757a266e6a61353136266c646f3f3a247c78663d4575706d7267273044406d706e6b6e2e6d63766a723d3c383031663363326065613230653663633d363830383263643137373c3031666634373a3a333c336636656163303666613b36636e606635323b3131333b36612e783d726e7767696c5f646e6373685e66696c7b6521706e75676b6c5777696e666f75715d6f6d666b615f706e637b67705c646364716723706475656b6c5f616c6762675d6363726d6263765c66616c736d21786c75676b6e5f737761636b746b6d675c646364716721706c77656b6c5d716a6d6b697563766d5e64636e736529786c77656b6e5f7065636e726c6179657a5e6e616c736721706e776f696e5f746c615d726e697b67725e66636e716723726e776f6b6c5d646d76636e74725e6e696c716723706c77676b6c5d7376675f7e696d7765725c66616e716d21706c77676b6c5d686974635e66616e716724677a313f6b3a3664343f6435343b63623b3f6131366132306732663b336666373330343863613732356136612e6363643f323232323238&jb=333739266c71354d677a696c6e612530443d2e302530302a4f6361616c766f73682731402730324b6c7c676e2732384d6361273230475b2530325a25323231325d33345f35292d32384170706e655767604369742530463731352c3b3427323028494a564f4e2730412d30326e69636527303247656b636f2b273030436a726d6f67253246383b2e382e343132332e34332d323053636663706b273a443733372e3134

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

91.235.133.67 , Netherlands, ASN30286 (THM, US),

Reverse DNS

Software

Apache /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://online.citi.com/US/JSO/signon/DisplayUsernameSignon.do?userType=tyLogin&locale=en_US&TYNewUser=false&TYForgotUUID=false&TYMigration=&SAMLPostURL=https://www.thankyou.com//gateway2.htm&ErrorCode=&TYPostURL=https://www.thankyou.com//tyLoginGateway.htm&cmp=EMC-CRG0780012.01
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Tue, 29 Sep 2020 14:21:28 GMT
Server: Apache
Connection: Keep-Alive
Keep-Alive: timeout=2, max=98
Strict-Transport-Security: max-age=31536000
Content-Type: text/javascript;charset=UTF-8

GET
H/1.1 200
OK clear.png
89oebq5kxcr3y72iozsn5deq4lvf2s6natzr77jyb40b017a1adcd64dam1.e.aa.online-metrix.net/fp/ Frame 0976 81 B
438 B 1085ms
23ms Image
image/png 91.235.134.131
THM

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://89oebq5kxcr3y72iozsn5deq4lvf2s6natzr77jyb40b017a1adcd64dam1.e.aa.online-metrix.net/fp/clear.png?org_id=89oebq5k&session_id=cf40e4849e45711ff9ddabe667b837a5426267c7c86bb19a726ed881cc7102e3&nonce=b40b017a1adcd64d&pageid=1&di=yes

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

91.235.134.131 , Netherlands, ASN30286 (THM, US),

Reverse DNS

Software

Apache /

Resource Hash

95518cbec0d55a574a9c8ef72a2a7d62ac0d40a4de5dfe67a76a7d214dc8b743

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://online.citi.com/US/JSO/signon/DisplayUsernameSignon.do?userType=tyLogin&locale=en_US&TYNewUser=false&TYForgotUUID=false&TYMigration=&SAMLPostURL=https://www.thankyou.com//gateway2.htm&ErrorCode=&TYPostURL=https://www.thankyou.com//tyLoginGateway.htm&cmp=EMC-CRG0780012.01
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 29 Sep 2020 14:21:28 GMT
X-Content-Type-Options: nosniff
Server: Apache
Strict-Transport-Security: max-age=31536000
Content-Type: image/png
Cache-Control: no-cache, no-store, must-revalidate
Connection: close
Content-Length: 81
X-XSS-Protection: 1; mode=block
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
DATA 200
OK truncated
/ 420 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 852bbf67c9988f8ed7e43118f914e581efb96fa4eb6d06eaf626672df92ce5fe

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type: image/png

GET
H2

200

s63555186440240
metrics1.citi.com/b/ss/citinaprod/1/JS-2.0.0/
Redirect Chain

https://metrics1.citi.com/b/ss/citinaprod/1/JS-2.0.0/s63555186440240?AQB=1&ndh=1&pf=1&t=29%2F8%2F2020%2016%3A21%3A27%202%20-120&fid=63F902CF85FB5BD0-15F73831CC713931&ce=UTF-8&pageName=thankyou%20si...
https://metrics1.citi.com/b/ss/citinaprod/1/JS-2.0.0/s63555186440240?AQB=1&pccr=true&vidn=2FB9A1740515E5AE-600008C8A338E10E&ndh=1&pf=1&t=29%2F8%2F2020%2016%3A21%3A27%202%20-120&fid=63F902CF85FB5BD0...

43 B
267 B

34ms
33ms

Image
image/gif

15.236.9.100
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://metrics1.citi.com/b/ss/citinaprod/1/JS-2.0.0/s63555186440240?AQB=1&pccr=true&vidn=2FB9A1740515E5AE-600008C8A338E10E&ndh=1&pf=1&t=29%2F8%2F2020%2016%3A21%3A27%202%20-120&fid=63F902CF85FB5BD0-15F73831CC713931&ce=UTF-8&pageName=thankyou%20signon%20page&g=https%3A%2F%2Fonline.citi.com%2FUS%2FJSO%2Fsignon%2FDisplayUsernameSignon.do%3FuserType%3DtyLogin%26locale%3Den_US%26TYNewUser%3Dfalse%26TYForgotUUID%3Dfalse%26TYMigration%3D%26SAMLPostURL%3Dhttps%3A%2F%2Fwww.thankyou.com%2F%2Fgateway2.htm%26ErrorCode%3D%26TYPostURL%3Dhttps%3A%2F%2Fwww.thankyou.com%2F%2FtyLoginGateway.h&c.&visitStart=1&.c&cc=USD&ch=us&v0=EMC-CRG0780012.01&c1=other&h1=us%2Fother%2Fpublic%2Fthankyou%2Fsignon&c2=public&c3=thankyou&c4=signon&c8=prelogin%20sign%20on%20page&c9=us&v9=no%20call%2C%20no%20cache&c11=English&c22=thankyou%20signon%20page&c26=no%20value&c37=na_prod&v38=thankyou%20signon%20page&v42=en_US_USTYN&v52=no%20value&c59=jUSCBOL_CustomizedThankYou&c61=21&c63=https%3A%2F%2Fonline.citi.com%2FUS%2FJSO%2Fsignon%2FDisplayUsernameSignon.do%3FuserType%3DtyLogin%26locale%3Den_US%26TYNewUser%3Dfalse%26TYForgotUUID%3Dfalse%26TYMigration%3D%26SAMLPostURL%3Dhttps%3A%2F%2Fwww.thankyou.com%2F%2Fgateway2.htm%26ErrorCode%3D%26TYPostURL%3Dhttps%3A%2F%2Fwww.thankyou.com%2F%2FtyLoginGateway.htm%26cmp%3DEMC-CRG0780012.01&c64=10%3A21AM&v64=10%3A21AM&c65=Tuesday&v65=Tuesday&c66=Tuesday%7C10%3A21AM&v67=New&v68=1&c69=not%20logged%20in&c73=354602%2C578278%2C358910%2C552021%2C373773%2C490004%2C622672%2C624610%2C531459%2C507276%2C600937%2C593700%2C495376%2C495377%2C593103%2C584566%2C495374%2C495375%2C573017%2C522574%2C652314%2C588511%2C639140%2C542251%2C632449%2C522572%2C490141%2C580663%2C626438%2C654259%2C515853%2C522576%2C562734%2C551962%2C582775%2C494437%2C551970%2C571630%2C385436%2C572752%2C609397%2C609396%2C388219%2C569456%2C565689%2C606935%2C512346%2C578262%2C521100%2C578343%2C359218%2C528144%2C488122%2C572750%2C359214%2C486892%2C510670%2C369351&v73=medium%7C1600&v79=3afd3d39-ebdc-416a-825a-65ff4374b3ba&v87=online.citi.com&v96=cl%7Cbos%3Ana%7Cdsa%3Ana%7Cax%3Ano%20call%7Cdsr%3Ana%7Crf%3A-%7Ccms%3A-&v114=%23&s=1600x1200&c=24&j=1.6&v=N&k=Y&bw=1600&bh=1200&-g=tm%26cmp%3DEMC-CRG0780012.01&AQE=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

15.236.9.100 Paris, France, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-15-236-9-100.eu-west-3.compute.amazonaws.com

Software

jag /

Resource Hash

a1ecbaed793a1f564c49c671f2dd0ce36f858534ef6d26b55783a06b884cc506

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://online.citi.com/US/JSO/signon/DisplayUsernameSignon.do?userType=tyLogin&locale=en_US&TYNewUser=false&TYForgotUUID=false&TYMigration=&SAMLPostURL=https://www.thankyou.com//gateway2.htm&ErrorCode=&TYPostURL=https://www.thankyou.com//tyLoginGateway.htm&cmp=EMC-CRG0780012.01
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 29 Sep 2020 14:21:28 GMT
x-content-type-options: nosniff
x-c: master-1380.Ie4fd2b.M0-456
p3p: CP="This is not a P3P policy"
status: 200
content-length: 43
x-xss-protection: 1; mode=block
pragma: no-cache
last-modified: Wed, 30 Sep 2020 14:21:28 GMT
server: jag
xserver: anedge-794d66dbb8-4pddm
etag: 3438957310147657728-4621759318277460949
vary: *
content-type: image/gif;charset=utf-8
access-control-allow-origin: *
cache-control: no-cache, no-store, max-age=0, no-transform, private
expires: Mon, 28 Sep 2020 14:21:28 GMT

Redirect headers

date: Tue, 29 Sep 2020 14:21:28 GMT
x-content-type-options: nosniff
access-control-allow-origin: *
x-c: master-1380.Ie4fd2b.M0-456
p3p: CP="This is not a P3P policy"
status: 302
content-length: 0
x-xss-protection: 1; mode=block
pragma: no-cache
last-modified: Wed, 30 Sep 2020 14:21:28 GMT
server: jag
xserver: anedge-794d66dbb8-h25mb
content-type: text/plain;charset=utf-8
location: https://metrics1.citi.com/b/ss/citinaprod/1/JS-2.0.0/s63555186440240?AQB=1&pccr=true&vidn=2FB9A1740515E5AE-600008C8A338E10E&ndh=1&pf=1&t=29%2F8%2F2020%2016%3A21%3A27%202%20-120&fid=63F902CF85FB5BD0-15F73831CC713931&ce=UTF-8&pageName=thankyou%20signon%20page&g=https%3A%2F%2Fonline.citi.com%2FUS%2FJSO%2Fsignon%2FDisplayUsernameSignon.do%3FuserType%3DtyLogin%26locale%3Den_US%26TYNewUser%3Dfalse%26TYForgotUUID%3Dfalse%26TYMigration%3D%26SAMLPostURL%3Dhttps%3A%2F%2Fwww.thankyou.com%2F%2Fgateway2.htm%26ErrorCode%3D%26TYPostURL%3Dhttps%3A%2F%2Fwww.thankyou.com%2F%2FtyLoginGateway.h&c.&visitStart=1&.c&cc=USD&ch=us&v0=EMC-CRG0780012.01&c1=other&h1=us%2Fother%2Fpublic%2Fthankyou%2Fsignon&c2=public&c3=thankyou&c4=signon&c8=prelogin%20sign%20on%20page&c9=us&v9=no%20call%2C%20no%20cache&c11=English&c22=thankyou%20signon%20page&c26=no%20value&c37=na_prod&v38=thankyou%20signon%20page&v42=en_US_USTYN&v52=no%20value&c59=jUSCBOL_CustomizedThankYou&c61=21&c63=https%3A%2F%2Fonline.citi.com%2FUS%2FJSO%2Fsignon%2FDisplayUsernameSignon.do%3FuserType%3DtyLogin%26locale%3Den_US%26TYNewUser%3Dfalse%26TYForgotUUID%3Dfalse%26TYMigration%3D%26SAMLPostURL%3Dhttps%3A%2F%2Fwww.thankyou.com%2F%2Fgateway2.htm%26ErrorCode%3D%26TYPostURL%3Dhttps%3A%2F%2Fwww.thankyou.com%2F%2FtyLoginGateway.htm%26cmp%3DEMC-CRG0780012.01&c64=10%3A21AM&v64=10%3A21AM&c65=Tuesday&v65=Tuesday&c66=Tuesday%7C10%3A21AM&v67=New&v68=1&c69=not%20logged%20in&c73=354602%2C578278%2C358910%2C552021%2C373773%2C490004%2C622672%2C624610%2C531459%2C507276%2C600937%2C593700%2C495376%2C495377%2C593103%2C584566%2C495374%2C495375%2C573017%2C522574%2C652314%2C588511%2C639140%2C542251%2C632449%2C522572%2C490141%2C580663%2C626438%2C654259%2C515853%2C522576%2C562734%2C551962%2C582775%2C494437%2C551970%2C571630%2C385436%2C572752%2C609397%2C609396%2C388219%2C569456%2C565689%2C606935%2C512346%2C578262%2C521100%2C578343%2C359218%2C528144%2C488122%2C572750%2C359214%2C486892%2C510670%2C369351&v73=medium%7C1600&v79=3afd3d39-ebdc-416a-825a-65ff4374b3ba&v87=online.citi.com&v96=cl%7Cbos%3Ana%7Cdsa%3Ana%7Cax%3Ano%20call%7Cdsr%3Ana%7Crf%3A-%7Ccms%3A-&v114=%23&s=1600x1200&c=24&j=1.6&v=N&k=Y&bw=1600&bh=1200&-g=tm%26cmp%3DEMC-CRG0780012.01&AQE=1
cache-control: no-cache, no-store, max-age=0, no-transform, private
expires: Mon, 28 Sep 2020 14:21:28 GMT

GET
H2 200 .jsonp Show response
lptag.liveperson.net/lptag/api/account/50929468/configuration/applications/taglets/ 12 KB
3 KB 861ms
860ms Script
application/x-javascript 178.249.101.23
LIVEPERSON

General

Check archive.org

Show headers Download Go to

Full URL: https://lptag.liveperson.net/lptag/api/account/50929468/configuration/applications/taglets/.jsonp?v=2.0&df=0&ct=lpSecureStorage%2CsdeInfoScraper%2Clp_sdes%2Ccobrowse%2Cscraper%2ClpSDEFilter%2Cdjv%2ClpActivityMonitor%2CrendererStub%2Clp_monitoringSDK%2Clp_version_detector%2Clp_external_js%2ClpTransporter%2ClpUnifiedWindow%2CSMT%2Chooks%2Clp_SMT%2Cauthenticator%2CcleanCCPatterns%2Clp_global_utils%2CunAuthMessaging%2CjsLoader&b=1
Requested by: Host: online.citi.com
URL: https://online.citi.com/JRS/js/chat/le-mtagconfig.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 178.249.101.23 , Netherlands, ASN11054 (LIVEPERSON, US),
Reverse DNS
Software: ws /
Resource Hash: 0f0a91324802b248c7e2c624ffe7bc5fdc945c840d141cb7374dd6149750a7ee

Request headers

Referer: https://online.citi.com/US/JSO/signon/DisplayUsernameSignon.do?userType=tyLogin&locale=en_US&TYNewUser=false&TYForgotUUID=false&TYMigration=&SAMLPostURL=https://www.thankyou.com//gateway2.htm&ErrorCode=&TYPostURL=https://www.thankyou.com//tyLoginGateway.htm&cmp=EMC-CRG0780012.01
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 29 Sep 2020 14:21:28 GMT
content-encoding: gzip
server: ws
x-cache-status: HIT
access-control-allow-methods: GET, POST, PATCH
content-type: application/x-javascript
status: 200
access-control-expose-headers: X-Requested-With, X-HTTP-Method-Override, LP-DOMAIN-REFERER, LP-URL, ETag, ac-revision, X-LP-Last-Modified, If-Match, Authentication-Method, Credit-Card-Ref, Automation-Secret, Email-Token, x-lp-host, Lp-Req-Time, date, x-application-context, strict-transport-security, x-content-type-options, x-download-options, x-xss-protection, x-cache-status, x-amz-id-2, x-amz-request-id, expires, last-modified, set-cookie, content-security-policy, x-frame-options
cache-control: public, max-age=630
access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization, X-HTTP-Method-Override, LP-DOMAIN-REFERER, LP-URL, ETag, ac-revision, X-LP-Last-Modified, If-Match, Authentication-Method, Credit-Card-Ref, Automation-Secret, Email-Token

GET
H/1.1 204
204 clear1.png;CIS3SID=67976A93C8D450F65E37A1CD641DB509
content22.online.citi.com/fp/ Frame 0976 0
386 B 23ms
18ms Image
image/png 91.235.133.67
THM

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://content22.online.citi.com/fp/clear1.png;CIS3SID=67976A93C8D450F65E37A1CD641DB509?org_id=89oebq5k&session_id=cf40e4849e45711ff9ddabe667b837a5426267c7c86bb19a726ed881cc7102e3&nonce=b40b017a1adcd64d&pageid=1&jf=3633382673696c5f7a6e643d7664725d417a3659617a4e4946564d47374a6a6826716b665d6663766735333432313b383b303a37267b61645d767b70653f776760386563647369267b69645f6965793f31383539333231313234323f30633836343a6167316632303239323432383a613a343638636d3b6432313231303530313630303030343a663864613131616263353a61623737373b333a643f66666362303433313a316131373f3b3230333d6360346666326c6934613667613630373a6330623038343f663833373833653167366a6439353b393634316169356431626632346132633734343d676061336b3630603638616b6e3730603b31386034363530396664302e7361645f736b673d31323c36303230313232673a693b63353738346434643b6133343d633b36623f39343a3662666c39343b376165613565613433623161306d366b663836363361333b3c3837663066616032303a333230633430613a363a6163646a333b63366e6430363364363a383531323a61643239313132663036666c376c35323135303437376c6232336730303b3a323937343726736b64703f32

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

91.235.133.67 , Netherlands, ASN30286 (THM, US),

Reverse DNS

Software

Apache /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://online.citi.com/US/JSO/signon/DisplayUsernameSignon.do?userType=tyLogin&locale=en_US&TYNewUser=false&TYForgotUUID=false&TYMigration=&SAMLPostURL=https://www.thankyou.com//gateway2.htm&ErrorCode=&TYPostURL=https://www.thankyou.com//tyLoginGateway.htm&cmp=EMC-CRG0780012.01
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 29 Sep 2020 14:21:28 GMT
X-Content-Type-Options: nosniff
Server: Apache
Strict-Transport-Security: max-age=31536000
Content-Type: image/png
Cache-Control: no-cache, no-store, must-revalidate
Connection: Keep-Alive, Keep-Alive
Keep-Alive: timeout=2, max=98
X-XSS-Protection: 1; mode=block
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H/1.1 204
No Content clear.png Show response
content22.online.citi.com/fp/ Frame 0976 0
387 B 35ms
16ms Script
text/javascript 91.235.133.67
THM

General

Check archive.org

Show headers Download Go to

Full URL

https://content22.online.citi.com/fp/clear.png?org_id=89oebq5k&session_id=cf40e4849e45711ff9ddabe667b837a5426267c7c86bb19a726ed881cc7102e3&nonce=b40b017a1adcd64d&pageid=1&jac=1&je=333337262670653d666f2662637473763f73226c6574656e2038332632322c227376637677712038206b6a637067616e65207f26617d6c683f643b64613239603530316631613e626e61613664303033676b3933343738306161373835333632656030603563343a33313a363a356a6564323637616c3f3733

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

91.235.133.67 , Netherlands, ASN30286 (THM, US),

Reverse DNS

Software

Apache /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://online.citi.com/US/JSO/signon/DisplayUsernameSignon.do?userType=tyLogin&locale=en_US&TYNewUser=false&TYForgotUUID=false&TYMigration=&SAMLPostURL=https://www.thankyou.com//gateway2.htm&ErrorCode=&TYPostURL=https://www.thankyou.com//tyLoginGateway.htm&cmp=EMC-CRG0780012.01
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 29 Sep 2020 14:21:28 GMT
X-Content-Type-Options: nosniff
Server: Apache
Strict-Transport-Security: max-age=31536000
Content-Type: text/javascript
Cache-Control: no-cache, no-store, must-revalidate
Connection: Keep-Alive
Keep-Alive: timeout=2, max=97
X-XSS-Protection: 1; mode=block
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2 200 cool-2.1.15.min.js Show response
nebula-cdn.kampyle.com/resources/onsite/js/ 14 KB
5 KB 80ms
25ms Script
application/javascript 151.101.13.175
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://nebula-cdn.kampyle.com/resources/onsite/js/cool-2.1.15.min.js
Requested by: Host: resources.digital-cloud-citi.medallia.com
URL: https://resources.digital-cloud-citi.medallia.com/wdcusciti/50/onsite/generic1601258650900.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.13.175 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 3e72de5de67d6d80b65a114af684eaf880c53c250155a663cb17d677ff064bc1

Request headers

Referer: https://online.citi.com/US/JSO/signon/DisplayUsernameSignon.do?userType=tyLogin&locale=en_US&TYNewUser=false&TYForgotUUID=false&TYMigration=&SAMLPostURL=https://www.thankyou.com//gateway2.htm&ErrorCode=&TYPostURL=https://www.thankyou.com//tyLoginGateway.htm&cmp=EMC-CRG0780012.01
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-amz-version-id: 0OTdpKixh0SS794XSYeUvg7VD7EDv2Rr
content-encoding: gzip
etag: "80dd5e3be5152c5c72d552c6a26ef6ff"
age: 0
via: 1.1 varnish, 1.1 varnish
x-cache: HIT, HIT
status: 200
x-amz-request-id: 53F522770558A8D1
x-amz-id-2: pdYkS9YKZxNLgaWA4xUWMk2j5yw9+GT1YZvnFHCdoQ7jAw5fN+AuzS/9nCiUWPM9WVubd7ZC6mI=
x-served-by: cache-dca17769-DCA, cache-fra19127-FRA
accept-ranges: bytes
last-modified: Sun, 13 Sep 2020 16:38:29 GMT
server: AmazonS3
x-timer: S1601389289.793157,VS0,VE0
date: Tue, 29 Sep 2020 14:21:28 GMT
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=31536000
content-length: 5197
x-cache-hits: 11, 370402

GET
H2 200 1592741950571_CTA_Feedback(final).png
resources.digital-cloud-citi.medallia.com/wdcusciti/50/resources/image/ 2 KB
2 KB 18ms
17ms Image
image/png 151.101.194.133
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://resources.digital-cloud-citi.medallia.com/wdcusciti/50/resources/image/1592741950571_CTA_Feedback(final).png
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 151.101.194.133 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 25f4eeb23f67fe1d74534ed37230ecd54ab4f57524276970dcbeaaf3b0fc64f9

Request headers

Referer: https://online.citi.com/US/JSO/signon/DisplayUsernameSignon.do?userType=tyLogin&locale=en_US&TYNewUser=false&TYForgotUUID=false&TYMigration=&SAMLPostURL=https://www.thankyou.com//gateway2.htm&ErrorCode=&TYPostURL=https://www.thankyou.com//tyLoginGateway.htm&cmp=EMC-CRG0780012.01
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-amz-version-id: Yu5KFpG13jOL6lsHUOzbaMYLsyQXTr7u
content-encoding: gzip
etag: "e6ed675f115fb1568bb1aabc00aa3f30"
age: 30
via: 1.1 varnish
x-cache: HIT
status: 200
content-length: 2219
x-amz-id-2: Y9Nn7lIBbBmDQ2I1iiKHrxHKudEMATP1lFgo3qHYAQLQa1DApk3E9tivfmJb3GU5mnCyq5AZ/L8=
x-served-by: cache-ams21023-AMS
last-modified: Sun, 21 Jun 2020 12:19:35 GMT
server: AmazonS3
x-timer: S1601389289.760272,VS0,VE1
date: Tue, 29 Sep 2020 14:21:28 GMT
vary: Accept-Encoding
x-amz-request-id: CD1C96D6153DFF3C
access-control-allow-origin: *
cache-control: max-age=0,must-revalidate
accept-ranges: bytes
content-type: image/png
x-cache-hits: 1

GET
H/1.1 204
No Content clear.png Show response
content22.online.citi.com/fp/ Frame 3B4D 0
387 B 17ms
16ms Script
text/javascript 91.235.133.67
THM

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Host: content22.online.citi.com
URL: https://content22.online.citi.com/fp/ls_fp.html;CIS3SID=67976A93C8D450F65E37A1CD641DB509?org_id=89oebq5k&session_id=cf40e4849e45711ff9ddabe667b837a5426267c7c86bb19a726ed881cc7102e3&nonce=b40b017a1adcd64d&pageid=1

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

91.235.133.67 , Netherlands, ASN30286 (THM, US),

Reverse DNS

Software

Apache /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://content22.online.citi.com/fp/ls_fp.html;CIS3SID=67976A93C8D450F65E37A1CD641DB509?org_id=89oebq5k&session_id=cf40e4849e45711ff9ddabe667b837a5426267c7c86bb19a726ed881cc7102e3&nonce=b40b017a1adcd64d&pageid=1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 29 Sep 2020 14:21:28 GMT
X-Content-Type-Options: nosniff
Server: Apache
Strict-Transport-Security: max-age=31536000
Content-Type: text/javascript
Cache-Control: no-cache, no-store, must-revalidate
Connection: Keep-Alive
Keep-Alive: timeout=2, max=96
X-XSS-Protection: 1; mode=block
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2

200

adadvisor.gif
px0.pbbl.co/
Redirect Chain

https://px0.pbbl.co/ns/__p2.gif?ppid=667e9e17-f3e5-4a2b-bd90-6c1a5ef55003&chk=false&brid=1560&brcid=&email=&orderId=&orderValue=&productId=&offerCode=&label=&pageUrl=https%3A%2F%2Fonline.citi.com%2...
https://aa.agkn.com/adscores/g.pixel?sid=9212282598&_ppid=667e9e17-f3e5-4a2b-bd90-6c1a5ef55003&_segid=99&iid=64d96b3d-fa9e-4836-bb74-bb3c120f6d08
https://px0.pbbl.co/adadvisor.gif?segment=000&_ppid=667e9e17-f3e5-4a2b-bd90-6c1a5ef55003&_segid=99&_zip=&hk=&iid=64d96b3d-fa9e-4836-bb74-bb3c120f6d08&mt=&bd=

42 B
132 B

142ms
142ms

Image
image/gif

2a00:1450:4001:801::2013
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://px0.pbbl.co/adadvisor.gif?segment=000&_ppid=667e9e17-f3e5-4a2b-bd90-6c1a5ef55003&_segid=99&_zip=&hk=&iid=64d96b3d-fa9e-4836-bb74-bb3c120f6d08&mt=&bd=

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:801::2013 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Frontend /

Resource Hash

99c2917ee5b2a01459a923bdd1c676f15ee73b62b87f696e6735312d26f51e12

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1

Request headers

Referer: https://online.citi.com/US/JSO/signon/DisplayUsernameSignon.do?userType=tyLogin&locale=en_US&TYNewUser=false&TYForgotUUID=false&TYMigration=&SAMLPostURL=https://www.thankyou.com//gateway2.htm&ErrorCode=&TYPostURL=https://www.thankyou.com//tyLoginGateway.htm&cmp=EMC-CRG0780012.01
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 29 Sep 2020 14:21:29 GMT
x-content-type-options: nosniff
server: Google Frontend
content-type: image/gif
status: 200
x-cloud-trace-context: 5aa5871c8ca77d7b502b346c3ae99515
cache-control: must-revalidate, no-cache, no-store
content-length: 42
x-xss-protection: 1
expires: 0

Redirect headers

pragma: no-cache
date: Tue, 29 Sep 2020 14:21:29 GMT
server: AAWebServer
status: 302
p3p: policyref="https://www.agkn.com/p3p/p3p.xml",CP="NOI NID"
location: https://px0.pbbl.co/adadvisor.gif?segment=000&_ppid=667e9e17-f3e5-4a2b-bd90-6c1a5ef55003&_segid=99&_zip=&hk=&iid=64d96b3d-fa9e-4836-bb74-bb3c120f6d08&mt=&bd=
cache-control: no-cache, no-store, must-revalidate
content-length: 0
expires: 0

GET
H/1.1 200
OK clear.png Show response
content22.online.citi.com/fp/ Frame CDA9 81 B
530 B 27ms
16ms XHR
image/png 91.235.133.67
THM

General

Check archive.org

Show headers Download Go to

Full URL

https://content22.online.citi.com/fp/clear.png

Requested by

Host: content22.online.citi.com
URL: https://content22.online.citi.com/fp/check.js;CIS3SID=40DB560ABF04134584AF178535767951?org_id=89oebq5k&session_id=7959029db1a8d9b4b554fe6564f43bf1d57a69340cdd92a73beb688ce71dded6&nonce=22322e055d970a9b&pageid=1&jb=313f262e6a7167753f4c69667570246a716f3d4c6b6e7778246a71623f416a726f6d672530383a33

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

91.235.133.67 , Netherlands, ASN30286 (THM, US),

Reverse DNS

Software

Apache /

Resource Hash

95518cbec0d55a574a9c8ef72a2a7d62ac0d40a4de5dfe67a76a7d214dc8b743

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Accept: */*, 89oebq5k/22322e055d970a9b7959029db1a8d9b4b554fe6564f43bf1d57a69340cdd92a73beb688ce71dded6
Referer: https://online.citi.com/US/JSO/signon/DisplayUsernameSignon.do?userType=tyLogin&locale=en_US&TYNewUser=false&TYForgotUUID=false&TYMigration=&SAMLPostURL=https://www.thankyou.com//gateway2.htm&ErrorCode=&TYPostURL=https://www.thankyou.com//tyLoginGateway.htm&cmp=EMC-CRG0780012.01
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Tue, 29 Sep 2020 14:21:28 GMT
Last-Modified: Tue, 29 Sep 2020 14:21:28 GMT
Server: Apache
Etag: f81010c8ef55427e9c36ba7d2aa08a56
Strict-Transport-Security: max-age=31536000
Content-Type: image/png
Access-Control-Allow-Origin: https://online.citi.com
Cache-Control: private, must-revalidate, max-age=0
Connection: Keep-Alive
Keep-Alive: timeout=2, max=99
Content-Length: 81
Expires: Sun, 28 Sep 2025 14:21:28 GMT

GET
H/1.1 200
OK ls_fp.html;CIS3SID=40DB560ABF04134584AF178535767951 Show response
content22.online.citi.com/fp/ Frame 7BFB 48 KB
12 KB 20ms
20ms Document
text/html 91.235.133.67
THM

General

Check archive.org

Show headers Download Go to

Full URL

https://content22.online.citi.com/fp/ls_fp.html;CIS3SID=40DB560ABF04134584AF178535767951?org_id=89oebq5k&session_id=7959029db1a8d9b4b554fe6564f43bf1d57a69340cdd92a73beb688ce71dded6&nonce=22322e055d970a9b&pageid=1

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

91.235.133.67 , Netherlands, ASN30286 (THM, US),

Reverse DNS

Software

Apache /

Resource Hash

07bfad77c7f8032108227f9489733fa4c62724a60ad016c083d1f82cc72b0063

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Host: content22.online.citi.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: same-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Referer: https://online.citi.com/US/JSO/signon/DisplayUsernameSignon.do?userType=tyLogin&locale=en_US&TYNewUser=false&TYForgotUUID=false&TYMigration=&SAMLPostURL=https://www.thankyou.com//gateway2.htm&ErrorCode=&TYPostURL=https://www.thankyou.com//tyLoginGateway.htm&cmp=EMC-CRG0780012.01
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Cookie: _4c_=hVLPj5s8EP1XVj7klIJtfplIqKqy21WrpK2W5fCdVsYMCQrByDildJX%2Ffcck2UqfVJWD5XnMvPfGM69k3ENHViymLBApF0kYiiU5wDSQ1StRvTt%2FuuNkWrIie2v7YeX7umubDjzV2MZT%2BugXuf81%2F%2B4Pza7TnX%2FfDH0rp2IA08kj5DPqVfrjCZHnqYfMThu9a7pFq5VsIYPupcgXz%2F99g9EVZbVsB8D4szY7bYviy%2F07tG12RtpGd9ki%2F7Td%2FNCDLZ422c3YOI6e3cvuMOnT7MzfSQujnLi3t8fFgzHarHUFGVL9u%2FZq8%2FFCMTOoY589bNcf1k%2BPNBGUMu5RRpZEISk%2BEEu92BMY298u4hSvvdHVSdkXi50jOEJ5N1QH%2FFEaPWK7iK33Rh%2FhTgSI1vjoJK5B1alSIuYyCVlFE5lSXkdJCYKVVY15GkdEtlLh1UANxsxMGA2NdTq34VwRnOkVvPXorOFsCSPnJfl1WYIwiWJcgoBjBxYnLuKQug8zTFNdt4EEdZhWXASqrGVUJZEMkzJgPA0gAJrGrv8LX8riiItIBI6gR765nv2Ro8Esh8gsx8J3OWft%2F9l%2FM3c%2BvwE%3D; s_fid=63F902CF85FB5BD0-15F73831CC713931; s_pers=%20gpv_p7%3Dthankyou%2520signon%2520page%7C1601391087816%3B%20s_visit%3D1%7C1601391087817%3B%20s_vnum%3D1601503200818%2526vn%253D1%7C1601503200818%3B%20s_invisit%3Dtrue%7C1601391087818%3B%20s_nr%3D1601389287819-New%7C1759069287819%3B; s_sess=%20SC_LINKS%3D%3B%20s_gvo_v0%3DEMC-CRG0780012.01%3B%20s_vstart%3D1601389287821%3B; s_cc=true; s_vi=[CS]v1|2FB9A1740515E5AE-600008C8A338E10E[CE]; thx_guid=8ce73aa5462e42be9a42f7875ed78fbc
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://online.citi.com/US/JSO/signon/DisplayUsernameSignon.do?userType=tyLogin&locale=en_US&TYNewUser=false&TYForgotUUID=false&TYMigration=&SAMLPostURL=https://www.thankyou.com//gateway2.htm&ErrorCode=&TYPostURL=https://www.thankyou.com//tyLoginGateway.htm&cmp=EMC-CRG0780012.01

Response headers

Date: Tue, 29 Sep 2020 14:21:28 GMT
Server: Apache
Strict-Transport-Security: max-age=31536000
Cache-Control: no-cache, no-store, must-revalidate
Pragma: no-cache
Connection: Keep-Alive, Keep-Alive
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Content-Type: text/html;charset=UTF-8
Vary: Accept-Encoding
Content-Encoding: gzip
Keep-Alive: timeout=2, max=95
Transfer-Encoding: chunked

GET
H/1.1 204
No Content clear.png Show response
content22.online.citi.com/fp/ Frame CDA9 0
387 B 17ms
16ms Script
text/javascript 91.235.133.67
THM

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

91.235.133.67 , Netherlands, ASN30286 (THM, US),

Reverse DNS

Software

Apache /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://online.citi.com/US/JSO/signon/DisplayUsernameSignon.do?userType=tyLogin&locale=en_US&TYNewUser=false&TYForgotUUID=false&TYMigration=&SAMLPostURL=https://www.thankyou.com//gateway2.htm&ErrorCode=&TYPostURL=https://www.thankyou.com//tyLoginGateway.htm&cmp=EMC-CRG0780012.01
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 29 Sep 2020 14:21:28 GMT
X-Content-Type-Options: nosniff
Server: Apache
Strict-Transport-Security: max-age=31536000
Content-Type: text/javascript
Cache-Control: no-cache, no-store, must-revalidate
Connection: Keep-Alive
Keep-Alive: timeout=2, max=97
X-XSS-Protection: 1; mode=block
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H/1.1 200
OK sid_fp.html;CIS3SID=40DB560ABF04134584AF178535767951
h.online-metrix.net/fp/ Frame 1C11 0
0 42ms
22ms Document
text/html 91.235.132.130
THM

General

Check archive.org

Show headers Download Go to

Full URL

https://h.online-metrix.net/fp/sid_fp.html;CIS3SID=40DB560ABF04134584AF178535767951?org_id=89oebq5k&session_id=7959029db1a8d9b4b554fe6564f43bf1d57a69340cdd92a73beb688ce71dded6&nonce=22322e055d970a9b&pageid=1

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

91.235.132.130 , Netherlands, ASN30286 (THM, US),

Reverse DNS

h.online-metrix.net

Software

Apache /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Host: h.online-metrix.net
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Referer: https://online.citi.com/US/JSO/signon/DisplayUsernameSignon.do?userType=tyLogin&locale=en_US&TYNewUser=false&TYForgotUUID=false&TYMigration=&SAMLPostURL=https://www.thankyou.com//gateway2.htm&ErrorCode=&TYPostURL=https://www.thankyou.com//tyLoginGateway.htm&cmp=EMC-CRG0780012.01
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://online.citi.com/US/JSO/signon/DisplayUsernameSignon.do?userType=tyLogin&locale=en_US&TYNewUser=false&TYForgotUUID=false&TYMigration=&SAMLPostURL=https://www.thankyou.com//gateway2.htm&ErrorCode=&TYPostURL=https://www.thankyou.com//tyLoginGateway.htm&cmp=EMC-CRG0780012.01

Response headers

Date: Tue, 29 Sep 2020 14:21:28 GMT
Server: Apache
Strict-Transport-Security: max-age=31536000
Cache-Control: no-cache, no-store, must-revalidate
Pragma: no-cache
Connection: Keep-Alive, Keep-Alive
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Content-Type: text/html;charset=UTF-8
Vary: Accept-Encoding
Content-Encoding: gzip
Keep-Alive: timeout=2, max=99
Transfer-Encoding: chunked

GET
H/1.1 204
No Content clear.png Show response
content22.online.citi.com/fp/ Frame CDA9 0
387 B 17ms
16ms Script
text/javascript 91.235.133.67
THM

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

91.235.133.67 , Netherlands, ASN30286 (THM, US),

Reverse DNS

Software

Apache /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://online.citi.com/US/JSO/signon/DisplayUsernameSignon.do?userType=tyLogin&locale=en_US&TYNewUser=false&TYForgotUUID=false&TYMigration=&SAMLPostURL=https://www.thankyou.com//gateway2.htm&ErrorCode=&TYPostURL=https://www.thankyou.com//tyLoginGateway.htm&cmp=EMC-CRG0780012.01
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 29 Sep 2020 14:21:28 GMT
X-Content-Type-Options: nosniff
Server: Apache
Strict-Transport-Security: max-age=31536000
Content-Type: text/javascript
Cache-Control: no-cache, no-store, must-revalidate
Connection: Keep-Alive
Keep-Alive: timeout=2, max=97
X-XSS-Protection: 1; mode=block
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H/1.1 200
OK top_fp.html;CIS3SID=40DB560ABF04134584AF178535767951 Show response
content22.online.citi.com/fp/ Frame E26C 47 KB
12 KB 26ms
25ms Document
text/html 91.235.133.67
THM

General

Check archive.org

Show headers Download Go to

Full URL

https://content22.online.citi.com/fp/top_fp.html;CIS3SID=40DB560ABF04134584AF178535767951?org_id=89oebq5k&session_id=7959029db1a8d9b4b554fe6564f43bf1d57a69340cdd92a73beb688ce71dded6&nonce=22322e055d970a9b&pageid=1

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

91.235.133.67 , Netherlands, ASN30286 (THM, US),

Reverse DNS

Software

Apache /

Resource Hash

b3601f582b4f4108514d25470fd306991632a98542569e15c3a25da8a64a3c81

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Host: content22.online.citi.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: same-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Referer: https://online.citi.com/US/JSO/signon/DisplayUsernameSignon.do?userType=tyLogin&locale=en_US&TYNewUser=false&TYForgotUUID=false&TYMigration=&SAMLPostURL=https://www.thankyou.com//gateway2.htm&ErrorCode=&TYPostURL=https://www.thankyou.com//tyLoginGateway.htm&cmp=EMC-CRG0780012.01
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Cookie: _4c_=hVLPj5s8EP1XVj7klIJtfplIqKqy21WrpK2W5fCdVsYMCQrByDildJX%2Ffcck2UqfVJWD5XnMvPfGM69k3ENHViymLBApF0kYiiU5wDSQ1StRvTt%2FuuNkWrIie2v7YeX7umubDjzV2MZT%2BugXuf81%2F%2B4Pza7TnX%2FfDH0rp2IA08kj5DPqVfrjCZHnqYfMThu9a7pFq5VsIYPupcgXz%2F99g9EVZbVsB8D4szY7bYviy%2F07tG12RtpGd9ki%2F7Td%2FNCDLZ422c3YOI6e3cvuMOnT7MzfSQujnLi3t8fFgzHarHUFGVL9u%2FZq8%2FFCMTOoY589bNcf1k%2BPNBGUMu5RRpZEISk%2BEEu92BMY298u4hSvvdHVSdkXi50jOEJ5N1QH%2FFEaPWK7iK33Rh%2FhTgSI1vjoJK5B1alSIuYyCVlFE5lSXkdJCYKVVY15GkdEtlLh1UANxsxMGA2NdTq34VwRnOkVvPXorOFsCSPnJfl1WYIwiWJcgoBjBxYnLuKQug8zTFNdt4EEdZhWXASqrGVUJZEMkzJgPA0gAJrGrv8LX8riiItIBI6gR765nv2Ro8Esh8gsx8J3OWft%2F9l%2FM3c%2BvwE%3D; s_fid=63F902CF85FB5BD0-15F73831CC713931; s_pers=%20gpv_p7%3Dthankyou%2520signon%2520page%7C1601391087816%3B%20s_visit%3D1%7C1601391087817%3B%20s_vnum%3D1601503200818%2526vn%253D1%7C1601503200818%3B%20s_invisit%3Dtrue%7C1601391087818%3B%20s_nr%3D1601389287819-New%7C1759069287819%3B; s_sess=%20SC_LINKS%3D%3B%20s_gvo_v0%3DEMC-CRG0780012.01%3B%20s_vstart%3D1601389287821%3B; s_cc=true; s_vi=[CS]v1|2FB9A1740515E5AE-600008C8A338E10E[CE]; thx_guid=8ce73aa5462e42be9a42f7875ed78fbc
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://online.citi.com/US/JSO/signon/DisplayUsernameSignon.do?userType=tyLogin&locale=en_US&TYNewUser=false&TYForgotUUID=false&TYMigration=&SAMLPostURL=https://www.thankyou.com//gateway2.htm&ErrorCode=&TYPostURL=https://www.thankyou.com//tyLoginGateway.htm&cmp=EMC-CRG0780012.01

Response headers

Date: Tue, 29 Sep 2020 14:21:28 GMT
Server: Apache
Strict-Transport-Security: max-age=31536000
Cache-Control: no-cache, no-store, must-revalidate
Pragma: no-cache
Connection: Keep-Alive, Keep-Alive
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Content-Type: text/html;charset=UTF-8
Vary: Accept-Encoding
Content-Encoding: gzip
Keep-Alive: timeout=2, max=96
Transfer-Encoding: chunked

GET
H/1.1 204
204 clear.png Show response
content22.online.citi.com/fp/ Frame CDA9 0
219 B 24ms
23ms Script
text/javascript 91.235.133.67
THM

General

Check archive.org

Show headers Download Go to

Full URL

https://content22.online.citi.com/fp/clear.png?org_id=89oebq5k&session_id=7959029db1a8d9b4b554fe6564f43bf1d57a69340cdd92a73beb688ce71dded6&nonce=22322e055d970a9b&pageid=1&ja=3b3a302e267535626739386c343c30613562333437336426613d343024783f363026643d333e323078333230382461643f333632327039303032267378793d327a38266c707035312e3136383024333232302c313430322c333232302e333430302c333232382e313632302c393030322e322c32247b6b663d3034266c683d6a767c707b253149253046253a46676c6c6b6e652e616976692c636d6d2730445553253046485b4d25324473696f6c6f6c273046466b7b786e617b557365726e636f6d5361676c676e2c646f2d334e7773677254797265273346747b4c6d656b6e2532346c6d6b636c652733446d6c5f575127323456514667775773657225334664696c7b65273a3656594667726f6d745755494427334666636c716527303454594d6b67706976696f6c25334c27323451434d4e52677b7655504c25334468767678732d33432d324425324e777f752e7668616e69796d752c636d6d2730442532466561766d756179302e687c6f2530344772706d7a4b6d64672533442532345651506773765d524e25334c687c7670712533412732442530467577752c7668616e69796d7d2c636f6f25324e273244767b4c6d656166456176657761792e6a246c7235266a603d3a65643c633c3336673765386366606434373130633b336632323066673c61622668736f354e696c777a2668716a354168706f6d652532323a3b2662736d7d3d4e696e7d782e6c68613d3136246e666d3f38247478663f4575726d70672d30464267726c616c266f637668703f3c38323366316332626561323a653e63613d363230383a616c333537343031646436353a3833343366346561613034666b3b34616462643f30333331333934632e783f706e7567696e5f646e6973605e64696c716521786c7d65696c5f77696c646d77715f6f65666b635f706c6379677a5c66616e736529726c77656b6e5d636c6760655d6163726f6263765666696c716d21726c756f69665d717769636b76696f655c66636c716723706c7565696c5771686f616b776974655c64636c716729786e7565696e5f7265636e786c6979677a5e64616c7b6529726c7767696e5d766e635d706e617b67705e66616e736729726c7565696e57666574636e76705c6e696e736721706c75676b6c57737e675d7e696777657a5e6e636c716521706e7565696c5f686174635c66616c7165246d7a333d6138346e36376635343961603b3f6333366332306532663b39666e373130343263613f303d633461266363663d303032303230&jb=333d392e6c73354d6d7a69646c69273244352e30273232284f6161696c766d7368253142273a32496e76656c2d30304f6361253032475b2732325825323031325d393457352b2d32324170786c6d5565604b69742732443531372c3334273030284b4a544f44273243273230646b6b6727303045676b636d292732304368726d6f6d253a463a3b2e322e3439303b2c36332532305161646170692732443731372e3334

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

91.235.133.67 , Netherlands, ASN30286 (THM, US),

Reverse DNS

Software

Apache /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://online.citi.com/US/JSO/signon/DisplayUsernameSignon.do?userType=tyLogin&locale=en_US&TYNewUser=false&TYForgotUUID=false&TYMigration=&SAMLPostURL=https://www.thankyou.com//gateway2.htm&ErrorCode=&TYPostURL=https://www.thankyou.com//tyLoginGateway.htm&cmp=EMC-CRG0780012.01
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Tue, 29 Sep 2020 14:21:28 GMT
Server: Apache
Connection: Keep-Alive
Keep-Alive: timeout=2, max=100
Strict-Transport-Security: max-age=31536000
Content-Type: text/javascript;charset=UTF-8

GET
H/1.1 200
OK clear.png
89oebq5kozitf5zyuxbugh4stmsdoa5wlb4pa4ap22322e055d970a9bam1.e.aa.online-metrix.net/fp/ Frame CDA9 81 B
438 B 68ms
16ms Image
image/png 91.235.134.131
THM

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://89oebq5kozitf5zyuxbugh4stmsdoa5wlb4pa4ap22322e055d970a9bam1.e.aa.online-metrix.net/fp/clear.png?org_id=89oebq5k&session_id=7959029db1a8d9b4b554fe6564f43bf1d57a69340cdd92a73beb688ce71dded6&nonce=22322e055d970a9b&pageid=1&di=yes

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

91.235.134.131 , Netherlands, ASN30286 (THM, US),

Reverse DNS

Software

Apache /

Resource Hash

95518cbec0d55a574a9c8ef72a2a7d62ac0d40a4de5dfe67a76a7d214dc8b743

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://online.citi.com/US/JSO/signon/DisplayUsernameSignon.do?userType=tyLogin&locale=en_US&TYNewUser=false&TYForgotUUID=false&TYMigration=&SAMLPostURL=https://www.thankyou.com//gateway2.htm&ErrorCode=&TYPostURL=https://www.thankyou.com//tyLoginGateway.htm&cmp=EMC-CRG0780012.01
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 29 Sep 2020 14:21:28 GMT
X-Content-Type-Options: nosniff
Server: Apache
Strict-Transport-Security: max-age=31536000
Content-Type: image/png
Cache-Control: no-cache, no-store, must-revalidate
Connection: close
Content-Length: 81
X-XSS-Protection: 1; mode=block
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2 200 __cool.gif
udc-neb.kampyle.com/egw/5/qceuv8449dzg58ptt1bhda9g8ue19c7s/track/ 0
317 B 164ms
112ms Image
image/gif 35.241.45.82
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://udc-neb.kampyle.com/egw/5/qceuv8449dzg58ptt1bhda9g8ue19c7s/track/__cool.gif?data=eyJldmVudHMiOiBbCiAgICB7InNlc3Npb25fc2NyZWVuX3NpemUiOiAiMTYwMHgxMjAwIiwic2Vzc2lvbl9kdWEiOiAiTW96aWxsYS81LjAgKE1hY2ludG9zaDsgSW50ZWwgTWFjIE9TIFggMTBfMTRfNSkgQXBwbGVXZWJLaXQvNTM3LjM2IChLSFRNTCwgbGlrZSBHZWNrbykgQ2hyb21lLzgzLjAuNDEwMy42MSBTYWZhcmkvNTM3LjM2Iiwic2Vzc2lvbl9wbGF0Zm9ybSI6ICJMaW51eCB4ODZfNjQiLCJ0cmFja2VyX3R5cGUiOiAiamF2YXNjcmlwdCIsInRyYWNrZXJfdmVyc2lvbiI6ICIyLjEuMTUiLCJldmVudF9uYW1lIjogIm5lYnVsYV9wYWdlX3ZpZXciLCJldmVudF90aW1lc3RhbXBfZXBvY2giOiAiMTYwMTM4OTI4ODk3MyIsImV2ZW50X3RpbWV6b25lX29mZnNldCI6IDIsInVzZXJfaWQiOiAiMTc0ZGEzZDVlMGI2MTUtMDEyYmU3ZDZlODYzNTgtMWIzOTYyNTYtMWQ0YzAwLTE3NGRhM2Q1ZTBjNjYwIiwiZW52aXJvbWVudCI6ICJkaWdpdGFsLWNsb3VkLXVzLWNpdGkiLCJhY2NvdW50SWQiOiA0OSwidXJsIjogImh0dHBzOi8vb25saW5lLmNpdGkuY29tL1VTL0pTTy9zaWdub24vRGlzcGxheVVzZXJuYW1lU2lnbm9uLmRvP3VzZXJUeXBlPXR5TG9naW4mbG9jYWxlPWVuX1VTJlRZTmV3VXNlcj1mYWxzZSZUWUZvcmdvdFVVSUQ9ZmFsc2UmVFlNaWdyYXRpb249JlNBTUxQb3N0VVJMPWh0dHBzOi8vd3d3LnRoYW5reW91LmNvbS8vZ2F0ZXdheTIuaHRtJkVycm9yQ29kZT0mVFlQb3N0VVJMPWh0dHBzOi8vd3d3LnRoYW5reW91LmNvbS8vdHlMb2dpbkdhdGV3YXkuaHRtJmNtcD1FTUMtQ1JHMDc4MDAxMi4wMSIsIndlYnNpdGVJZCI6IDUwLCJmZWVkYmFja191dWlkIjogbnVsbCwiZm9ybUlkIjogbnVsbCwiZm9ybVRyaWdnZXJUeXBlIjogbnVsbCwia2FtcHlsZV9kYXRhIjogeyJMQVNUX0lOVklUQVRJT05fVklFVyI6ICIiLCJERUNMSU5FRF9EQVRFIjogIiIsImthbXB5bGVJbnZpdGVQcmVzZW50ZWQiOiAiIiwia2FtcHlsZV91c2VyaWQiOiAiZDBkYy0wOWUxLWJhODMtODcwOS02ZDdlLWNhMWMtYTQwYS05MWQ5Iiwia2FtcHlsZVVzZXJTZXNzaW9uIjogIjE2MDEzODkyODg3MzUiLCJrYW1weWxlVXNlclBlcmNlbnRpbGUiOiAiIiwiU1VCTUlUVEVEX0RBVEUiOiAiIn0sImNvb2tpZV9zaXplIjogMTQxMiwia2FtcHlsZV92ZXJzaW9uIjogIjIuMzQuMCIsIm9uc2l0ZV92ZXJzaW9uIjogIjIuMzQuMCIsImhpc3RvcnlfbGVuZ3RoIjogMiwiZXZlbnRfbG9jYWxfdGltZXN0YW1wIjogMTYwMTM4OTI4ODczOCwicG9zaXRpb24iOiBudWxsLCJpc1VzZXJJZGVudGlmaWVkIjogZmFsc2V9Cl19
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.241.45.82 , Ascension Island, ASN15169 (GOOGLE, US),
Reverse DNS: 82.45.241.35.bc.googleusercontent.com
Software: Jetty(9.2.11.v20150529) /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://online.citi.com/US/JSO/signon/DisplayUsernameSignon.do?userType=tyLogin&locale=en_US&TYNewUser=false&TYForgotUUID=false&TYMigration=&SAMLPostURL=https://www.thankyou.com//gateway2.htm&ErrorCode=&TYPostURL=https://www.thankyou.com//tyLoginGateway.htm&cmp=EMC-CRG0780012.01
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-me: prod-instance-gatewayservice-blue-39fz
date: Tue, 29 Sep 2020 14:21:29 GMT
via: 1.1 google
server: Jetty(9.2.11.v20150529)
access-control-allow-headers: X-Requested-With, Origin, Content-Type, Accept
status: 200
access-control-max-age: 1800
access-control-allow-methods: GET, POST, PUT, DELETE
content-type: image/gif; charset=UTF-8
access-control-allow-origin: *
access-control-allow-credentials: true
alt-svc: clear
content-length: 0
x-application-context: application:9090

GET
H/1.1 204
No Content clear.png Show response
content22.online.citi.com/fp/ Frame 7BFB 0
387 B 16ms
16ms Script
text/javascript 91.235.133.67
THM

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Host: content22.online.citi.com
URL: https://content22.online.citi.com/fp/ls_fp.html;CIS3SID=40DB560ABF04134584AF178535767951?org_id=89oebq5k&session_id=7959029db1a8d9b4b554fe6564f43bf1d57a69340cdd92a73beb688ce71dded6&nonce=22322e055d970a9b&pageid=1

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

91.235.133.67 , Netherlands, ASN30286 (THM, US),

Reverse DNS

Software

Apache /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://content22.online.citi.com/fp/ls_fp.html;CIS3SID=40DB560ABF04134584AF178535767951?org_id=89oebq5k&session_id=7959029db1a8d9b4b554fe6564f43bf1d57a69340cdd92a73beb688ce71dded6&nonce=22322e055d970a9b&pageid=1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 29 Sep 2020 14:21:28 GMT
X-Content-Type-Options: nosniff
Server: Apache
Strict-Transport-Security: max-age=31536000
Content-Type: text/javascript
Cache-Control: no-cache, no-store, must-revalidate
Connection: Keep-Alive
Keep-Alive: timeout=2, max=95
X-XSS-Protection: 1; mode=block
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H/1.1 204
204 clear1.png;CIS3SID=40DB560ABF04134584AF178535767951
content22.online.citi.com/fp/ Frame CDA9 0
386 B 18ms
18ms Image
image/png 91.235.133.67
THM

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://content22.online.citi.com/fp/clear1.png;CIS3SID=40DB560ABF04134584AF178535767951?org_id=89oebq5k&session_id=7959029db1a8d9b4b554fe6564f43bf1d57a69340cdd92a73beb688ce71dded6&nonce=22322e055d970a9b&pageid=1&jf=3639362e736b6c5f706e6435746c705f6b32584670394d6f716749436f76335a26736b645d6c6374653f31363833333a3b303835247b61665f767970653d77676032656b64716926716964576b6d7b3d31303539313033333236323730633a3634386165316c323230333036383a32633a34343a616d3b663031303130373031363a303830363a66326461393369606135326162353535393338643766666162303633333a3b6133353539303a31356160346464306c6936633665613632373a633a623838363f6632333730316d33653662643937393b3434336161356433626630346332693736363765626b3163343060343a636b6e353260393138623436353a396e64322e736b645f7b696f3f333234353030323330326667353136613763393361336c3538616337386a3338646764373b64386a3433373761616138313a6c643f64603b383264663e376b3a383a34363836616331663030323235363335643b32643b6136336766316c32383736333461326e30323364626631326267376d323a336730383a66386a65383230646166313b3260633b363b326124716966723f30

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

91.235.133.67 , Netherlands, ASN30286 (THM, US),

Reverse DNS

Software

Apache /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://online.citi.com/US/JSO/signon/DisplayUsernameSignon.do?userType=tyLogin&locale=en_US&TYNewUser=false&TYForgotUUID=false&TYMigration=&SAMLPostURL=https://www.thankyou.com//gateway2.htm&ErrorCode=&TYPostURL=https://www.thankyou.com//tyLoginGateway.htm&cmp=EMC-CRG0780012.01
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 29 Sep 2020 14:21:29 GMT
X-Content-Type-Options: nosniff
Server: Apache
Strict-Transport-Security: max-age=31536000
Content-Type: image/png
Cache-Control: no-cache, no-store, must-revalidate
Connection: Keep-Alive, Keep-Alive
Keep-Alive: timeout=2, max=94
X-XSS-Protection: 1; mode=block
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2 200 50929468 Show response
lp-03.chat.online.citi.com/api/js/ 233 B
1 KB 528ms
253ms Script
application/javascript 208.89.12.87
LIVEPERSON

General

Check archive.org

Show headers Download Go to

Full URL: https://lp-03.chat.online.citi.com/api/js/50929468?&cb=lpCb31480x71281&t=sp&ts=1601389288692&pid=4611332731&tid=4350824208&pt=Citi%20ThankYou%C2%AE%20Rewards%20%3F%20Sign%20On&u=https%3A%2F%2Fonline.citi.com%2FUS%2FJSO%2Fsignon%2FDisplayUsernameSignon.do%3FuserType%3DtyLogin%26locale%3Den_US%26TYNewUser%3Dfalse%26TYForgotUUID%3Dfalse%26TYMigration%3D%26SAMLPostURL%3Dhttps%3A%2F%2Fwww.thankyou.com%2F%2Fgateway2.htm%26ErrorCode%3D%26TYPostURL%3Dhttps%3A%2F%2Fwww.thankyou.com%2F%2FtyLoginGateway.htm%26cmp%3DEMC-CRG0780012.01&sec=%5B%22Other%22%2C%22jUSCBOL_CustomizedThankYou%22%2C%22thankyou%20signon%20page%22%2Cnull%2C%22%22%2Cnull%5D&df=0&os=1&identities=%5B%7B%22iss%22%3A%22Citi%22%2C%22acr%22%3A%22loa1%22%2C%22sub%22%3A%22livechat%22%7D%2C%7B%22iss%22%3A%22LivePerson%22%2C%22acr%22%3A%220%22%7D%5D
Requested by: Host: lptag.liveperson.net
URL: https://lptag.liveperson.net/lptag/api/account/50929468/configuration/applications/taglets/.jsonp?v=2.0&df=0&b=1
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 208.89.12.87 , United States, ASN11054 (LIVEPERSON, US),
Reverse DNS: va.v.liveperson.net
Software: ws /
Resource Hash: 9a9227aa658061dcca4a55c86ca9b517d5b44f03eeac9c3849af1bd8e771ad51

Request headers

Referer: https://online.citi.com/US/JSO/signon/DisplayUsernameSignon.do?userType=tyLogin&locale=en_US&TYNewUser=false&TYForgotUUID=false&TYMigration=&SAMLPostURL=https://www.thankyou.com//gateway2.htm&ErrorCode=&TYPostURL=https://www.thankyou.com//tyLoginGateway.htm&cmp=EMC-CRG0780012.01
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 29 Sep 2020 14:21:29 GMT
content-encoding: gzip
server: ws
access-control-allow-methods: GET, POST, PATCH
content-type: application/javascript
status: 200
access-control-expose-headers: X-Requested-With, X-HTTP-Method-Override, LP-DOMAIN-REFERER, LP-URL, ETag, ac-revision, X-LP-Last-Modified, If-Match, Authentication-Method, Credit-Card-Ref, Automation-Secret, Email-Token, x-lp-host, Lp-Req-Time, date, x-application-context, strict-transport-security, x-content-type-options, x-download-options, x-xss-protection, x-cache-status, x-amz-id-2, x-amz-request-id, expires, last-modified, set-cookie, content-security-policy, x-frame-options
cache-control: no-store
access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization, X-HTTP-Method-Override, LP-DOMAIN-REFERER, LP-URL, ETag, ac-revision, X-LP-Last-Modified, If-Match, Authentication-Method, Credit-Card-Ref, Automation-Secret, Email-Token

GET
H/1.1 204
No Content clear.png Show response
content22.online.citi.com/fp/ Frame CDA9 0
387 B 17ms
16ms Script
text/javascript 91.235.133.67
THM

General

Check archive.org

Show headers Download Go to

Full URL

https://content22.online.citi.com/fp/clear.png?org_id=89oebq5k&session_id=7959029db1a8d9b4b554fe6564f43bf1d57a69340cdd92a73beb688ce71dded6&nonce=22322e055d970a9b&pageid=1&jac=1&je=3339372e2672653d6c6f266a617c71743f7b226c6776676c203a332e32322e2273746374777b203a226168617a65696c65207d24637d6c6a3d64396461303960353a316e31633e626461613e663832316763393336353a3261633730353334326562306235693438313b38343037626764323435636c3f3531

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

91.235.133.67 , Netherlands, ASN30286 (THM, US),

Reverse DNS

Software

Apache /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://online.citi.com/US/JSO/signon/DisplayUsernameSignon.do?userType=tyLogin&locale=en_US&TYNewUser=false&TYForgotUUID=false&TYMigration=&SAMLPostURL=https://www.thankyou.com//gateway2.htm&ErrorCode=&TYPostURL=https://www.thankyou.com//tyLoginGateway.htm&cmp=EMC-CRG0780012.01
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 29 Sep 2020 14:21:29 GMT
X-Content-Type-Options: nosniff
Server: Apache
Strict-Transport-Security: max-age=31536000
Content-Type: text/javascript
Cache-Control: no-cache, no-store, must-revalidate
Connection: Keep-Alive
Keep-Alive: timeout=2, max=93
X-XSS-Protection: 1; mode=block
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2 200 .jsonp Show response
lptag.liveperson.net/lptag/api/account/50929468/configuration/applications/taglets/ 12 KB
3 KB 20ms
19ms Script
application/x-javascript 178.249.101.23
LIVEPERSON

General

Check archive.org

Show headers Download Go to

Full URL: https://lptag.liveperson.net/lptag/api/account/50929468/configuration/applications/taglets/.jsonp?v=2.0&df=0&ct=lpSecureStorage%2CsdeInfoScraper%2Clp_sdes%2Ccobrowse%2Cscraper%2ClpSDEFilter%2Cdjv%2ClpActivityMonitor%2CrendererStub%2Clp_monitoringSDK%2Clp_version_detector%2Clp_external_js%2ClpTransporter%2ClpUnifiedWindow%2CSMT%2Chooks%2Clp_SMT%2Cauthenticator%2CcleanCCPatterns%2Clp_global_utils%2CunAuthMessaging%2CjsLoader&b=1
Requested by: Host: online.citi.com
URL: https://online.citi.com/JRS/js/chat/le-mtagconfig.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 178.249.101.23 , Netherlands, ASN11054 (LIVEPERSON, US),
Reverse DNS
Software: ws /
Resource Hash: 0f0a91324802b248c7e2c624ffe7bc5fdc945c840d141cb7374dd6149750a7ee

Request headers

Referer: https://online.citi.com/US/JSO/signon/DisplayUsernameSignon.do?userType=tyLogin&locale=en_US&TYNewUser=false&TYForgotUUID=false&TYMigration=&SAMLPostURL=https://www.thankyou.com//gateway2.htm&ErrorCode=&TYPostURL=https://www.thankyou.com//tyLoginGateway.htm&cmp=EMC-CRG0780012.01
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 29 Sep 2020 14:21:29 GMT
content-encoding: gzip
server: ws
x-cache-status: HIT
access-control-allow-methods: GET, POST, PATCH
content-type: application/x-javascript
status: 200
access-control-expose-headers: X-Requested-With, X-HTTP-Method-Override, LP-DOMAIN-REFERER, LP-URL, ETag, ac-revision, X-LP-Last-Modified, If-Match, Authentication-Method, Credit-Card-Ref, Automation-Secret, Email-Token, x-lp-host, Lp-Req-Time, date, x-application-context, strict-transport-security, x-content-type-options, x-download-options, x-xss-protection, x-cache-status, x-amz-id-2, x-amz-request-id, expires, last-modified, set-cookie, content-security-policy, x-frame-options
cache-control: public, max-age=630
access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization, X-HTTP-Method-Override, LP-DOMAIN-REFERER, LP-URL, ETag, ac-revision, X-LP-Last-Modified, If-Match, Authentication-Method, Credit-Card-Ref, Automation-Secret, Email-Token

GET
H2 200 50929468 Show response
lp-03.chat.online.citi.com/api/js/ 233 B
1 KB 199ms
198ms Script
application/javascript 208.89.12.87
LIVEPERSON

General

Check archive.org

Show headers Download Go to

Full URL: https://lp-03.chat.online.citi.com/api/js/50929468?&cb=lpCb76174x50056&t=sp&ts=1601389289454&pid=5563217441&tid=4350824208&pt=Citi%20ThankYou%C2%AE%20Rewards%20%3F%20Sign%20On&u=https%3A%2F%2Fonline.citi.com%2FUS%2FJSO%2Fsignon%2FDisplayUsernameSignon.do%3FuserType%3DtyLogin%26locale%3Den_US%26TYNewUser%3Dfalse%26TYForgotUUID%3Dfalse%26TYMigration%3D%26SAMLPostURL%3Dhttps%3A%2F%2Fwww.thankyou.com%2F%2Fgateway2.htm%26ErrorCode%3D%26TYPostURL%3Dhttps%3A%2F%2Fwww.thankyou.com%2F%2FtyLoginGateway.htm%26cmp%3DEMC-CRG0780012.01&sec=%5B%22Other%22%2C%22jUSCBOL_CustomizedThankYou%22%2C%22thankyou%20signon%20page%22%2Cnull%2C%22%22%2Cnull%5D&df=0&os=1&identities=%5B%7B%22iss%22%3A%22Citi%22%2C%22acr%22%3A%22loa1%22%2C%22sub%22%3A%22livechat%22%7D%2C%7B%22iss%22%3A%22LivePerson%22%2C%22acr%22%3A%220%22%7D%5D
Requested by: Host: lptag.liveperson.net
URL: https://lptag.liveperson.net/lptag/api/account/50929468/configuration/applications/taglets/.jsonp?v=2.0&df=0&b=1
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 208.89.12.87 , United States, ASN11054 (LIVEPERSON, US),
Reverse DNS: va.v.liveperson.net
Software: ws /
Resource Hash: 178f6fad63d4236044e6cf2c7293fc0679fcdb78fa13ec87a52964b5524e4716

Request headers

Referer: https://online.citi.com/US/JSO/signon/DisplayUsernameSignon.do?userType=tyLogin&locale=en_US&TYNewUser=false&TYForgotUUID=false&TYMigration=&SAMLPostURL=https://www.thankyou.com//gateway2.htm&ErrorCode=&TYPostURL=https://www.thankyou.com//tyLoginGateway.htm&cmp=EMC-CRG0780012.01
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 29 Sep 2020 14:21:29 GMT
content-encoding: gzip
server: ws
access-control-allow-methods: GET, POST, PATCH
content-type: application/javascript
status: 200
access-control-expose-headers: X-Requested-With, X-HTTP-Method-Override, LP-DOMAIN-REFERER, LP-URL, ETag, ac-revision, X-LP-Last-Modified, If-Match, Authentication-Method, Credit-Card-Ref, Automation-Secret, Email-Token, x-lp-host, Lp-Req-Time, date, x-application-context, strict-transport-security, x-content-type-options, x-download-options, x-xss-protection, x-cache-status, x-amz-id-2, x-amz-request-id, expires, last-modified, set-cookie, content-security-policy, x-frame-options
cache-control: no-store
access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization, X-HTTP-Method-Override, LP-DOMAIN-REFERER, LP-URL, ETag, ac-revision, X-LP-Last-Modified, If-Match, Authentication-Method, Credit-Card-Ref, Automation-Secret, Email-Token

GET
H2 200 50929468 Show response
lp-03.chat.online.citi.com/api/js/ 92 B
837 B 177ms
177ms Script
application/javascript 208.89.12.87
LIVEPERSON

General

Check archive.org

Show headers Download Go to

Full URL: https://lp-03.chat.online.citi.com/api/js/50929468?sid=MjyyKKhoRz650qUJaAjk7w&cb=lpCb11032x52691&t=uc&ts=1601389289453&pid=5563217441&tid=4350824208&sdes=%5B%7B%22type%22%3A%22ctmrinfo%22%2C%22info%22%3A%7B%22lastPaymentDate%22%3A%7B%7D%2C%22registrationDate%22%3A%7B%7D%2C%22ctype%22%3A%22cbol-blue%22%7D%7D%2C%7B%22type%22%3A%22prodView%22%2C%22products%22%3A%7B%22product%22%3A%7B%22name%22%3A%22Citi%20ThankYou%C2%AE%20Rewards%20%3F%20Sign%20On%22%2C%22category%22%3A%22https%3A%2F%2Fonline.citi.com%2FUS%2FJSO%2Fsignon%2FDisplayUsernameSignon.do%3FuserType%3DtyLogin%26locale%3Den_US%26TYNewUser%3Dfalse%26TYForgotUUID%3Dfalse%26TYMigration%3D%26SAMLPostURL%3Dhttps%3A%2F%2Fwww.thankyou.com%2F%2Fgateway2.htm%26ErrorCode%3D%26TYPostURL%3Dhttps%3A%2F%2Fwww.thankyou.com%2F%2FtyLoginGateway.htm%26cmp%3DEMC-CRG0780012.01%22%2C%22sku%22%3A%22Other%2CjUSCBOL_CustomizedThankYou%2Cthankyou%20signon%20page%2C%2C%2C%22%7D%7D%7D%5D&vid=FjMmFiNWJhMjNiMWVjYzk0
Requested by: Host: lptag.liveperson.net
URL: https://lptag.liveperson.net/lptag/api/account/50929468/configuration/applications/taglets/.jsonp?v=2.0&df=0&b=1
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 208.89.12.87 , United States, ASN11054 (LIVEPERSON, US),
Reverse DNS: va.v.liveperson.net
Software: ws /
Resource Hash: a70821e6424283e1713eb4f44945415163e6f02290cadf8fa7e71e7dc0337899

Request headers

Referer: https://online.citi.com/US/JSO/signon/DisplayUsernameSignon.do?userType=tyLogin&locale=en_US&TYNewUser=false&TYForgotUUID=false&TYMigration=&SAMLPostURL=https://www.thankyou.com//gateway2.htm&ErrorCode=&TYPostURL=https://www.thankyou.com//tyLoginGateway.htm&cmp=EMC-CRG0780012.01
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 29 Sep 2020 14:21:29 GMT
content-encoding: gzip
server: ws
access-control-allow-methods: GET, POST, PATCH
content-type: application/javascript
status: 200
access-control-expose-headers: X-Requested-With, X-HTTP-Method-Override, LP-DOMAIN-REFERER, LP-URL, ETag, ac-revision, X-LP-Last-Modified, If-Match, Authentication-Method, Credit-Card-Ref, Automation-Secret, Email-Token, x-lp-host, Lp-Req-Time, date, x-application-context, strict-transport-security, x-content-type-options, x-download-options, x-xss-protection, x-cache-status, x-amz-id-2, x-amz-request-id, expires, last-modified, set-cookie, content-security-policy, x-frame-options
cache-control: no-store
access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization, X-HTTP-Method-Override, LP-DOMAIN-REFERER, LP-URL, ETag, ac-revision, X-LP-Last-Modified, If-Match, Authentication-Method, Credit-Card-Ref, Automation-Secret, Email-Token

GET
H2 200 50929468 Show response
lp-03.chat.online.citi.com/api/js/ 111 B
853 B 220ms
219ms Script
application/javascript 208.89.12.87
LIVEPERSON

General

Check archive.org

Show headers Download Go to

Full URL: https://lp-03.chat.online.citi.com/api/js/50929468?sid=MjyyKKhoRz650qUJaAjk7w&cb=lpCb88646x20449&t=pl&ts=1601389289463&pid=5563217441&tid=4350824208&vid=FjMmFiNWJhMjNiMWVjYzk0
Requested by: Host: lptag.liveperson.net
URL: https://lptag.liveperson.net/lptag/api/account/50929468/configuration/applications/taglets/.jsonp?v=2.0&df=0&b=1
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 208.89.12.87 , United States, ASN11054 (LIVEPERSON, US),
Reverse DNS: va.v.liveperson.net
Software: ws /
Resource Hash: 360c503e6eb58e095c3bf8b28cf34227ac8faebe491141b3873e20b74a33967b

Request headers

Referer: https://online.citi.com/US/JSO/signon/DisplayUsernameSignon.do?userType=tyLogin&locale=en_US&TYNewUser=false&TYForgotUUID=false&TYMigration=&SAMLPostURL=https://www.thankyou.com//gateway2.htm&ErrorCode=&TYPostURL=https://www.thankyou.com//tyLoginGateway.htm&cmp=EMC-CRG0780012.01
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 29 Sep 2020 14:21:29 GMT
content-encoding: gzip
server: ws
access-control-allow-methods: GET, POST, PATCH
content-type: application/javascript
status: 200
access-control-expose-headers: X-Requested-With, X-HTTP-Method-Override, LP-DOMAIN-REFERER, LP-URL, ETag, ac-revision, X-LP-Last-Modified, If-Match, Authentication-Method, Credit-Card-Ref, Automation-Secret, Email-Token, x-lp-host, Lp-Req-Time, date, x-application-context, strict-transport-security, x-content-type-options, x-download-options, x-xss-protection, x-cache-status, x-amz-id-2, x-amz-request-id, expires, last-modified, set-cookie, content-security-policy, x-frame-options
cache-control: no-store
access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization, X-HTTP-Method-Override, LP-DOMAIN-REFERER, LP-URL, ETag, ac-revision, X-LP-Last-Modified, If-Match, Authentication-Method, Credit-Card-Ref, Automation-Secret, Email-Token

GET
H/1.1 204
No Content clear.png Show response
content22.online.citi.com/fp/ Frame 0976 0
387 B 16ms
16ms Script
text/javascript 91.235.133.67
THM

General

Check archive.org

Show headers Download Go to

Full URL

https://content22.online.citi.com/fp/clear.png?org_id=89oebq5k&session_id=cf40e4849e45711ff9ddabe667b837a5426267c7c86bb19a726ed881cc7102e3&nonce=b40b017a1adcd64d&pageid=1&jac=1&je=373b262677656a727c635f657a7465706c696c5f69723d333a372c3a33302e3137332c343524756b6f35756760727c635d6b6c74657a66616e5d6f646e71

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

91.235.133.67 , Netherlands, ASN30286 (THM, US),

Reverse DNS

Software

Apache /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://online.citi.com/US/JSO/signon/DisplayUsernameSignon.do?userType=tyLogin&locale=en_US&TYNewUser=false&TYForgotUUID=false&TYMigration=&SAMLPostURL=https://www.thankyou.com//gateway2.htm&ErrorCode=&TYPostURL=https://www.thankyou.com//tyLoginGateway.htm&cmp=EMC-CRG0780012.01
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 29 Sep 2020 14:21:29 GMT
X-Content-Type-Options: nosniff
Server: Apache
Strict-Transport-Security: max-age=31536000
Content-Type: text/javascript
Cache-Control: no-cache, no-store, must-revalidate
Connection: Keep-Alive
Keep-Alive: timeout=2, max=92
X-XSS-Protection: 1; mode=block
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H/1.1 204
No Content clear.png Show response
content22.online.citi.com/fp/ Frame CDA9 0
387 B 17ms
16ms Script
text/javascript 91.235.133.67
THM

General

Check archive.org

Show headers Download Go to

Full URL

https://content22.online.citi.com/fp/clear.png?org_id=89oebq5k&session_id=7959029db1a8d9b4b554fe6564f43bf1d57a69340cdd92a73beb688ce71dded6&nonce=22322e055d970a9b&pageid=1&jac=1&je=3731262e77676a7276635f6d787c67726c616c5f6b703f313a352c3233302c3137312c36352e75696d3f77656a7074615d6b6e76677a66636c5d6d646e73

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

91.235.133.67 , Netherlands, ASN30286 (THM, US),

Reverse DNS

Software

Apache /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://online.citi.com/US/JSO/signon/DisplayUsernameSignon.do?userType=tyLogin&locale=en_US&TYNewUser=false&TYForgotUUID=false&TYMigration=&SAMLPostURL=https://www.thankyou.com//gateway2.htm&ErrorCode=&TYPostURL=https://www.thankyou.com//tyLoginGateway.htm&cmp=EMC-CRG0780012.01
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 29 Sep 2020 14:21:30 GMT
X-Content-Type-Options: nosniff
Server: Apache
Strict-Transport-Security: max-age=31536000
Content-Type: text/javascript
Cache-Control: no-cache, no-store, must-revalidate
Connection: Keep-Alive
Keep-Alive: timeout=2, max=91
X-XSS-Protection: 1; mode=block
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2 200 .jsonp Show response
lptag.liveperson.net/lptag/api/account/50929468/configuration/applications/taglets/ 12 KB
3 KB 19ms
18ms Script
application/x-javascript 178.249.101.23
LIVEPERSON

General

Check archive.org

Show headers Download Go to

Full URL: https://lptag.liveperson.net/lptag/api/account/50929468/configuration/applications/taglets/.jsonp?v=2.0&df=0&ct=lpSecureStorage%2CsdeInfoScraper%2Clp_sdes%2Ccobrowse%2Cscraper%2ClpSDEFilter%2Cdjv%2ClpActivityMonitor%2CrendererStub%2Clp_monitoringSDK%2Clp_version_detector%2Clp_external_js%2ClpTransporter%2ClpUnifiedWindow%2CSMT%2Chooks%2Clp_SMT%2Cauthenticator%2CcleanCCPatterns%2Clp_global_utils%2CunAuthMessaging%2CjsLoader&b=1
Requested by: Host: online.citi.com
URL: https://online.citi.com/JRS/js/chat/le-mtagconfig.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 178.249.101.23 , Netherlands, ASN11054 (LIVEPERSON, US),
Reverse DNS
Software: ws /
Resource Hash: 0f0a91324802b248c7e2c624ffe7bc5fdc945c840d141cb7374dd6149750a7ee

Request headers

Referer: https://online.citi.com/US/JSO/signon/DisplayUsernameSignon.do?userType=tyLogin&locale=en_US&TYNewUser=false&TYForgotUUID=false&TYMigration=&SAMLPostURL=https://www.thankyou.com//gateway2.htm&ErrorCode=&TYPostURL=https://www.thankyou.com//tyLoginGateway.htm&cmp=EMC-CRG0780012.01
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 29 Sep 2020 14:21:31 GMT
content-encoding: gzip
server: ws
x-cache-status: HIT
access-control-allow-methods: GET, POST, PATCH
content-type: application/x-javascript
status: 200
access-control-expose-headers: X-Requested-With, X-HTTP-Method-Override, LP-DOMAIN-REFERER, LP-URL, ETag, ac-revision, X-LP-Last-Modified, If-Match, Authentication-Method, Credit-Card-Ref, Automation-Secret, Email-Token, x-lp-host, Lp-Req-Time, date, x-application-context, strict-transport-security, x-content-type-options, x-download-options, x-xss-protection, x-cache-status, x-amz-id-2, x-amz-request-id, expires, last-modified, set-cookie, content-security-policy, x-frame-options
cache-control: public, max-age=630
access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization, X-HTTP-Method-Override, LP-DOMAIN-REFERER, LP-URL, ETag, ac-revision, X-LP-Last-Modified, If-Match, Authentication-Method, Credit-Card-Ref, Automation-Secret, Email-Token

GET
H2 200 50929468 Show response
lp-03.chat.online.citi.com/api/js/ 233 B
1 KB 224ms
223ms Script
application/javascript 208.89.12.87
LIVEPERSON

General

Check archive.org

Show headers Download Go to

Full URL: https://lp-03.chat.online.citi.com/api/js/50929468?&cb=lpCb67293x61840&t=sp&ts=1601389291453&pid=2493555936&tid=4350824208&rvt=1601389289453&pt=Citi%20ThankYou%C2%AE%20Rewards%20%3F%20Sign%20On&u=https%3A%2F%2Fonline.citi.com%2FUS%2FJSO%2Fsignon%2FDisplayUsernameSignon.do%3FuserType%3DtyLogin%26locale%3Den_US%26TYNewUser%3Dfalse%26TYForgotUUID%3Dfalse%26TYMigration%3D%26SAMLPostURL%3Dhttps%3A%2F%2Fwww.thankyou.com%2F%2Fgateway2.htm%26ErrorCode%3D%26TYPostURL%3Dhttps%3A%2F%2Fwww.thankyou.com%2F%2FtyLoginGateway.htm%26cmp%3DEMC-CRG0780012.01&sec=%5B%22Other%22%2C%22jUSCBOL_CustomizedThankYou%22%2C%22thankyou%20signon%20page%22%2Cnull%2C%22%22%2Cnull%5D&df=0&os=1&identities=%5B%7B%22iss%22%3A%22Citi%22%2C%22acr%22%3A%22loa1%22%2C%22sub%22%3A%22livechat%22%7D%2C%7B%22iss%22%3A%22LivePerson%22%2C%22acr%22%3A%220%22%7D%5D
Requested by: Host: lptag.liveperson.net
URL: https://lptag.liveperson.net/lptag/api/account/50929468/configuration/applications/taglets/.jsonp?v=2.0&df=0&b=1
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 208.89.12.87 , United States, ASN11054 (LIVEPERSON, US),
Reverse DNS: va.v.liveperson.net
Software: ws /
Resource Hash: 85eedf8859396c0a29c427dfab2c8543ef8100026fa8d77a69728737a65476d2

Request headers

Referer: https://online.citi.com/US/JSO/signon/DisplayUsernameSignon.do?userType=tyLogin&locale=en_US&TYNewUser=false&TYForgotUUID=false&TYMigration=&SAMLPostURL=https://www.thankyou.com//gateway2.htm&ErrorCode=&TYPostURL=https://www.thankyou.com//tyLoginGateway.htm&cmp=EMC-CRG0780012.01
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 29 Sep 2020 14:21:31 GMT
content-encoding: gzip
server: ws
access-control-allow-methods: GET, POST, PATCH
content-type: application/javascript
status: 200
access-control-expose-headers: X-Requested-With, X-HTTP-Method-Override, LP-DOMAIN-REFERER, LP-URL, ETag, ac-revision, X-LP-Last-Modified, If-Match, Authentication-Method, Credit-Card-Ref, Automation-Secret, Email-Token, x-lp-host, Lp-Req-Time, date, x-application-context, strict-transport-security, x-content-type-options, x-download-options, x-xss-protection, x-cache-status, x-amz-id-2, x-amz-request-id, expires, last-modified, set-cookie, content-security-policy, x-frame-options
cache-control: no-store
access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization, X-HTTP-Method-Override, LP-DOMAIN-REFERER, LP-URL, ETag, ac-revision, X-LP-Last-Modified, If-Match, Authentication-Method, Credit-Card-Ref, Automation-Secret, Email-Token

GET
H2 200 50929468 Show response
lp-03.chat.online.citi.com/api/js/ 42 B
792 B 227ms
226ms Script
application/javascript 208.89.12.87
LIVEPERSON

General

Check archive.org

Show headers Download Go to

Full URL: https://lp-03.chat.online.citi.com/api/js/50929468?sid=qYR9O6FqQHiHlW3qk5YBXA&cb=lpCb18900x48487&t=uc&ts=1601389291452&pid=2493555936&tid=4350824208&sdes=%5B%7B%22type%22%3A%22ctmrinfo%22%2C%22info%22%3A%7B%22lastPaymentDate%22%3A%7B%7D%2C%22registrationDate%22%3A%7B%7D%2C%22ctype%22%3A%22cbol-blue%22%7D%7D%2C%7B%22type%22%3A%22prodView%22%2C%22products%22%3A%7B%22product%22%3A%7B%22name%22%3A%22Citi%20ThankYou%C2%AE%20Rewards%20%3F%20Sign%20On%22%2C%22category%22%3A%22https%3A%2F%2Fonline.citi.com%2FUS%2FJSO%2Fsignon%2FDisplayUsernameSignon.do%3FuserType%3DtyLogin%26locale%3Den_US%26TYNewUser%3Dfalse%26TYForgotUUID%3Dfalse%26TYMigration%3D%26SAMLPostURL%3Dhttps%3A%2F%2Fwww.thankyou.com%2F%2Fgateway2.htm%26ErrorCode%3D%26TYPostURL%3Dhttps%3A%2F%2Fwww.thankyou.com%2F%2FtyLoginGateway.htm%26cmp%3DEMC-CRG0780012.01%22%2C%22sku%22%3A%22Other%2CjUSCBOL_CustomizedThankYou%2Cthankyou%20signon%20page%2C%2C%2C%22%7D%7D%7D%5D&vid=IxYzY2OGRjMDdiNTI2NmY5
Requested by: Host: lptag.liveperson.net
URL: https://lptag.liveperson.net/lptag/api/account/50929468/configuration/applications/taglets/.jsonp?v=2.0&df=0&b=1
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 208.89.12.87 , United States, ASN11054 (LIVEPERSON, US),
Reverse DNS: va.v.liveperson.net
Software: ws /
Resource Hash: 013e591f755f081c0dca82a44fe10ec5119bf3621a0769989eddb6a51a0e26c7

Request headers

Referer: https://online.citi.com/US/JSO/signon/DisplayUsernameSignon.do?userType=tyLogin&locale=en_US&TYNewUser=false&TYForgotUUID=false&TYMigration=&SAMLPostURL=https://www.thankyou.com//gateway2.htm&ErrorCode=&TYPostURL=https://www.thankyou.com//tyLoginGateway.htm&cmp=EMC-CRG0780012.01
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 29 Sep 2020 14:21:31 GMT
content-encoding: gzip
server: ws
access-control-allow-methods: GET, POST, PATCH
content-type: application/javascript
status: 200
access-control-expose-headers: X-Requested-With, X-HTTP-Method-Override, LP-DOMAIN-REFERER, LP-URL, ETag, ac-revision, X-LP-Last-Modified, If-Match, Authentication-Method, Credit-Card-Ref, Automation-Secret, Email-Token, x-lp-host, Lp-Req-Time, date, x-application-context, strict-transport-security, x-content-type-options, x-download-options, x-xss-protection, x-cache-status, x-amz-id-2, x-amz-request-id, expires, last-modified, set-cookie, content-security-policy, x-frame-options
cache-control: no-store
access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization, X-HTTP-Method-Override, LP-DOMAIN-REFERER, LP-URL, ETag, ac-revision, X-LP-Last-Modified, If-Match, Authentication-Method, Credit-Card-Ref, Automation-Secret, Email-Token

GET
H2 200 50929468 Show response
lp-03.chat.online.citi.com/api/js/ 110 B
853 B 219ms
219ms Script
application/javascript 208.89.12.87
LIVEPERSON

General

Check archive.org

Show headers Download Go to

Full URL: https://lp-03.chat.online.citi.com/api/js/50929468?sid=qYR9O6FqQHiHlW3qk5YBXA&cb=lpCb36946x73678&t=pl&ts=1601389291459&pid=2493555936&tid=4350824208&vid=IxYzY2OGRjMDdiNTI2NmY5
Requested by: Host: lptag.liveperson.net
URL: https://lptag.liveperson.net/lptag/api/account/50929468/configuration/applications/taglets/.jsonp?v=2.0&df=0&b=1
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 208.89.12.87 , United States, ASN11054 (LIVEPERSON, US),
Reverse DNS: va.v.liveperson.net
Software: ws /
Resource Hash: 3cdfe9ba7795ab392a51ca638aa92dbd285f5182a9760df149da858b9475af5d

Request headers

Referer: https://online.citi.com/US/JSO/signon/DisplayUsernameSignon.do?userType=tyLogin&locale=en_US&TYNewUser=false&TYForgotUUID=false&TYMigration=&SAMLPostURL=https://www.thankyou.com//gateway2.htm&ErrorCode=&TYPostURL=https://www.thankyou.com//tyLoginGateway.htm&cmp=EMC-CRG0780012.01
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 29 Sep 2020 14:21:31 GMT
content-encoding: gzip
server: ws
access-control-allow-methods: GET, POST, PATCH
content-type: application/javascript
status: 200
access-control-expose-headers: X-Requested-With, X-HTTP-Method-Override, LP-DOMAIN-REFERER, LP-URL, ETag, ac-revision, X-LP-Last-Modified, If-Match, Authentication-Method, Credit-Card-Ref, Automation-Secret, Email-Token, x-lp-host, Lp-Req-Time, date, x-application-context, strict-transport-security, x-content-type-options, x-download-options, x-xss-protection, x-cache-status, x-amz-id-2, x-amz-request-id, expires, last-modified, set-cookie, content-security-policy, x-frame-options
cache-control: no-store
access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization, X-HTTP-Method-Override, LP-DOMAIN-REFERER, LP-URL, ETag, ac-revision, X-LP-Last-Modified, If-Match, Authentication-Method, Credit-Card-Ref, Automation-Secret, Email-Token

GET
H2 200 .jsonp Show response
lptag.liveperson.net/lptag/api/account/50929468/configuration/applications/taglets/ 12 KB
3 KB 19ms
18ms Script
application/x-javascript 178.249.101.23
LIVEPERSON

General

Check archive.org

Show headers Download Go to

Full URL: https://lptag.liveperson.net/lptag/api/account/50929468/configuration/applications/taglets/.jsonp?v=2.0&df=0&ct=lpSecureStorage%2CsdeInfoScraper%2Clp_sdes%2Ccobrowse%2Cscraper%2ClpSDEFilter%2Cdjv%2ClpActivityMonitor%2CrendererStub%2Clp_monitoringSDK%2Clp_version_detector%2Clp_external_js%2ClpTransporter%2ClpUnifiedWindow%2CSMT%2Chooks%2Clp_SMT%2Cauthenticator%2CcleanCCPatterns%2Clp_global_utils%2CunAuthMessaging%2CjsLoader&b=1
Requested by: Host: online.citi.com
URL: https://online.citi.com/JRS/js/chat/le-mtagconfig.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 178.249.101.23 , Netherlands, ASN11054 (LIVEPERSON, US),
Reverse DNS
Software: ws /
Resource Hash: 0f0a91324802b248c7e2c624ffe7bc5fdc945c840d141cb7374dd6149750a7ee

Request headers

Referer: https://online.citi.com/US/JSO/signon/DisplayUsernameSignon.do?userType=tyLogin&locale=en_US&TYNewUser=false&TYForgotUUID=false&TYMigration=&SAMLPostURL=https://www.thankyou.com//gateway2.htm&ErrorCode=&TYPostURL=https://www.thankyou.com//tyLoginGateway.htm&cmp=EMC-CRG0780012.01
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 29 Sep 2020 14:21:33 GMT
content-encoding: gzip
server: ws
x-cache-status: HIT
access-control-allow-methods: GET, POST, PATCH
content-type: application/x-javascript
status: 200
access-control-expose-headers: X-Requested-With, X-HTTP-Method-Override, LP-DOMAIN-REFERER, LP-URL, ETag, ac-revision, X-LP-Last-Modified, If-Match, Authentication-Method, Credit-Card-Ref, Automation-Secret, Email-Token, x-lp-host, Lp-Req-Time, date, x-application-context, strict-transport-security, x-content-type-options, x-download-options, x-xss-protection, x-cache-status, x-amz-id-2, x-amz-request-id, expires, last-modified, set-cookie, content-security-policy, x-frame-options
cache-control: public, max-age=630
access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization, X-HTTP-Method-Override, LP-DOMAIN-REFERER, LP-URL, ETag, ac-revision, X-LP-Last-Modified, If-Match, Authentication-Method, Credit-Card-Ref, Automation-Secret, Email-Token

GET
H2 200 50929468 Show response
lp-03.chat.online.citi.com/api/js/ 232 B
941 B 180ms
180ms Script
application/javascript 208.89.12.87
LIVEPERSON

General

Check archive.org

Show headers Download Go to

Full URL: https://lp-03.chat.online.citi.com/api/js/50929468?sid=qYR9O6FqQHiHlW3qk5YBXA&cb=lpCb66433x8957&t=sp&ts=1601389293454&pid=1547021572&tid=4350824208&vid=IxYzY2OGRjMDdiNTI2NmY5&rvt=1601389291555&pt=Citi%20ThankYou%C2%AE%20Rewards%20%3F%20Sign%20On&u=https%3A%2F%2Fonline.citi.com%2FUS%2FJSO%2Fsignon%2FDisplayUsernameSignon.do%3FuserType%3DtyLogin%26locale%3Den_US%26TYNewUser%3Dfalse%26TYForgotUUID%3Dfalse%26TYMigration%3D%26SAMLPostURL%3Dhttps%3A%2F%2Fwww.thankyou.com%2F%2Fgateway2.htm%26ErrorCode%3D%26TYPostURL%3Dhttps%3A%2F%2Fwww.thankyou.com%2F%2FtyLoginGateway.htm%26cmp%3DEMC-CRG0780012.01&sec=%5B%22Other%22%2C%22jUSCBOL_CustomizedThankYou%22%2C%22thankyou%20signon%20page%22%2Cnull%2C%22%22%2Cnull%5D&df=0&os=1&identities=%5B%7B%22iss%22%3A%22Citi%22%2C%22acr%22%3A%22loa1%22%2C%22sub%22%3A%22livechat%22%7D%2C%7B%22iss%22%3A%22LivePerson%22%2C%22acr%22%3A%220%22%7D%5D
Requested by: Host: lptag.liveperson.net
URL: https://lptag.liveperson.net/lptag/api/account/50929468/configuration/applications/taglets/.jsonp?v=2.0&df=0&b=1
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 208.89.12.87 , United States, ASN11054 (LIVEPERSON, US),
Reverse DNS: va.v.liveperson.net
Software: ws /
Resource Hash: 914403b3be0b02ce6722deb930e9ede79841a1c4705ff1e8fdf6e8a76cfff482

Request headers

Referer: https://online.citi.com/US/JSO/signon/DisplayUsernameSignon.do?userType=tyLogin&locale=en_US&TYNewUser=false&TYForgotUUID=false&TYMigration=&SAMLPostURL=https://www.thankyou.com//gateway2.htm&ErrorCode=&TYPostURL=https://www.thankyou.com//tyLoginGateway.htm&cmp=EMC-CRG0780012.01
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 29 Sep 2020 14:21:33 GMT
content-encoding: gzip
server: ws
access-control-allow-methods: GET, POST, PATCH
content-type: application/javascript
status: 200
access-control-expose-headers: X-Requested-With, X-HTTP-Method-Override, LP-DOMAIN-REFERER, LP-URL, ETag, ac-revision, X-LP-Last-Modified, If-Match, Authentication-Method, Credit-Card-Ref, Automation-Secret, Email-Token, x-lp-host, Lp-Req-Time, date, x-application-context, strict-transport-security, x-content-type-options, x-download-options, x-xss-protection, x-cache-status, x-amz-id-2, x-amz-request-id, expires, last-modified, set-cookie, content-security-policy, x-frame-options
cache-control: no-store
access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization, X-HTTP-Method-Override, LP-DOMAIN-REFERER, LP-URL, ETag, ac-revision, X-LP-Last-Modified, If-Match, Authentication-Method, Credit-Card-Ref, Automation-Secret, Email-Token

GET
H2 200 50929468 Show response
lp-03.chat.online.citi.com/api/js/ 42 B
790 B 221ms
221ms Script
application/javascript 208.89.12.87
LIVEPERSON

General

Check archive.org

Show headers Download Go to

Full URL: https://lp-03.chat.online.citi.com/api/js/50929468?sid=qYR9O6FqQHiHlW3qk5YBXA&cb=lpCb64584x56454&t=uc&ts=1601389293452&pid=1547021572&tid=4350824208&vid=IxYzY2OGRjMDdiNTI2NmY5&sdes=%5B%7B%22type%22%3A%22ctmrinfo%22%2C%22info%22%3A%7B%22lastPaymentDate%22%3A%7B%7D%2C%22registrationDate%22%3A%7B%7D%2C%22ctype%22%3A%22cbol-blue%22%7D%7D%2C%7B%22type%22%3A%22prodView%22%2C%22products%22%3A%7B%22product%22%3A%7B%22name%22%3A%22Citi%20ThankYou%C2%AE%20Rewards%20%3F%20Sign%20On%22%2C%22category%22%3A%22https%3A%2F%2Fonline.citi.com%2FUS%2FJSO%2Fsignon%2FDisplayUsernameSignon.do%3FuserType%3DtyLogin%26locale%3Den_US%26TYNewUser%3Dfalse%26TYForgotUUID%3Dfalse%26TYMigration%3D%26SAMLPostURL%3Dhttps%3A%2F%2Fwww.thankyou.com%2F%2Fgateway2.htm%26ErrorCode%3D%26TYPostURL%3Dhttps%3A%2F%2Fwww.thankyou.com%2F%2FtyLoginGateway.htm%26cmp%3DEMC-CRG0780012.01%22%2C%22sku%22%3A%22Other%2CjUSCBOL_CustomizedThankYou%2Cthankyou%20signon%20page%2C%2C%2C%22%7D%7D%7D%5D
Requested by: Host: lptag.liveperson.net
URL: https://lptag.liveperson.net/lptag/api/account/50929468/configuration/applications/taglets/.jsonp?v=2.0&df=0&b=1
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 208.89.12.87 , United States, ASN11054 (LIVEPERSON, US),
Reverse DNS: va.v.liveperson.net
Software: ws /
Resource Hash: 7e46e02ad6a40c475c2eec66ce5f66bec4aa8601415a534fec1e6e26ecfca663

Request headers

Referer: https://online.citi.com/US/JSO/signon/DisplayUsernameSignon.do?userType=tyLogin&locale=en_US&TYNewUser=false&TYForgotUUID=false&TYMigration=&SAMLPostURL=https://www.thankyou.com//gateway2.htm&ErrorCode=&TYPostURL=https://www.thankyou.com//tyLoginGateway.htm&cmp=EMC-CRG0780012.01
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 29 Sep 2020 14:21:33 GMT
content-encoding: gzip
server: ws
access-control-allow-methods: GET, POST, PATCH
content-type: application/javascript
status: 200
access-control-expose-headers: X-Requested-With, X-HTTP-Method-Override, LP-DOMAIN-REFERER, LP-URL, ETag, ac-revision, X-LP-Last-Modified, If-Match, Authentication-Method, Credit-Card-Ref, Automation-Secret, Email-Token, x-lp-host, Lp-Req-Time, date, x-application-context, strict-transport-security, x-content-type-options, x-download-options, x-xss-protection, x-cache-status, x-amz-id-2, x-amz-request-id, expires, last-modified, set-cookie, content-security-policy, x-frame-options
cache-control: no-store
access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization, X-HTTP-Method-Override, LP-DOMAIN-REFERER, LP-URL, ETag, ac-revision, X-LP-Last-Modified, If-Match, Authentication-Method, Credit-Card-Ref, Automation-Secret, Email-Token

GET
H2 200 50929468 Show response
lp-03.chat.online.citi.com/api/js/ 110 B
853 B 218ms
218ms Script
application/javascript 208.89.12.87
LIVEPERSON

General

Check archive.org

Show headers Download Go to

Full URL: https://lp-03.chat.online.citi.com/api/js/50929468?sid=qYR9O6FqQHiHlW3qk5YBXA&cb=lpCb22318x13049&t=pl&ts=1601389293458&pid=1547021572&tid=4350824208&vid=IxYzY2OGRjMDdiNTI2NmY5
Requested by: Host: lptag.liveperson.net
URL: https://lptag.liveperson.net/lptag/api/account/50929468/configuration/applications/taglets/.jsonp?v=2.0&df=0&b=1
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 208.89.12.87 , United States, ASN11054 (LIVEPERSON, US),
Reverse DNS: va.v.liveperson.net
Software: ws /
Resource Hash: 1789c9f0d05885053e041a64847f4d9244e593fbbd59acf75c6077ee772e9564

Request headers

Referer: https://online.citi.com/US/JSO/signon/DisplayUsernameSignon.do?userType=tyLogin&locale=en_US&TYNewUser=false&TYForgotUUID=false&TYMigration=&SAMLPostURL=https://www.thankyou.com//gateway2.htm&ErrorCode=&TYPostURL=https://www.thankyou.com//tyLoginGateway.htm&cmp=EMC-CRG0780012.01
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 29 Sep 2020 14:21:33 GMT
content-encoding: gzip
server: ws
access-control-allow-methods: GET, POST, PATCH
content-type: application/javascript
status: 200
access-control-expose-headers: X-Requested-With, X-HTTP-Method-Override, LP-DOMAIN-REFERER, LP-URL, ETag, ac-revision, X-LP-Last-Modified, If-Match, Authentication-Method, Credit-Card-Ref, Automation-Secret, Email-Token, x-lp-host, Lp-Req-Time, date, x-application-context, strict-transport-security, x-content-type-options, x-download-options, x-xss-protection, x-cache-status, x-amz-id-2, x-amz-request-id, expires, last-modified, set-cookie, content-security-policy, x-frame-options
cache-control: no-store
access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization, X-HTTP-Method-Override, LP-DOMAIN-REFERER, LP-URL, ETag, ac-revision, X-LP-Last-Modified, If-Match, Authentication-Method, Credit-Card-Ref, Automation-Secret, Email-Token

GET
H2 200 .jsonp Show response
lptag.liveperson.net/lptag/api/account/50929468/configuration/applications/taglets/ 12 KB
3 KB 19ms
19ms Script
application/x-javascript 178.249.101.23
LIVEPERSON

General

Check archive.org

Show headers Download Go to

Full URL: https://lptag.liveperson.net/lptag/api/account/50929468/configuration/applications/taglets/.jsonp?v=2.0&df=0&ct=lpSecureStorage%2CsdeInfoScraper%2Clp_sdes%2Ccobrowse%2Cscraper%2ClpSDEFilter%2Cdjv%2ClpActivityMonitor%2CrendererStub%2Clp_monitoringSDK%2Clp_version_detector%2Clp_external_js%2ClpTransporter%2ClpUnifiedWindow%2CSMT%2Chooks%2Clp_SMT%2Cauthenticator%2CcleanCCPatterns%2Clp_global_utils%2CunAuthMessaging%2CjsLoader&b=1
Requested by: Host: online.citi.com
URL: https://online.citi.com/JRS/js/chat/le-mtagconfig.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 178.249.101.23 , Netherlands, ASN11054 (LIVEPERSON, US),
Reverse DNS
Software: ws /
Resource Hash: 0f0a91324802b248c7e2c624ffe7bc5fdc945c840d141cb7374dd6149750a7ee

Request headers

Referer: https://online.citi.com/US/JSO/signon/DisplayUsernameSignon.do?userType=tyLogin&locale=en_US&TYNewUser=false&TYForgotUUID=false&TYMigration=&SAMLPostURL=https://www.thankyou.com//gateway2.htm&ErrorCode=&TYPostURL=https://www.thankyou.com//tyLoginGateway.htm&cmp=EMC-CRG0780012.01
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 29 Sep 2020 14:21:35 GMT
content-encoding: gzip
server: ws
x-cache-status: HIT
access-control-allow-methods: GET, POST, PATCH
content-type: application/x-javascript
status: 200
access-control-expose-headers: X-Requested-With, X-HTTP-Method-Override, LP-DOMAIN-REFERER, LP-URL, ETag, ac-revision, X-LP-Last-Modified, If-Match, Authentication-Method, Credit-Card-Ref, Automation-Secret, Email-Token, x-lp-host, Lp-Req-Time, date, x-application-context, strict-transport-security, x-content-type-options, x-download-options, x-xss-protection, x-cache-status, x-amz-id-2, x-amz-request-id, expires, last-modified, set-cookie, content-security-policy, x-frame-options
cache-control: public, max-age=630
access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization, X-HTTP-Method-Override, LP-DOMAIN-REFERER, LP-URL, ETag, ac-revision, X-LP-Last-Modified, If-Match, Authentication-Method, Credit-Card-Ref, Automation-Secret, Email-Token

GET
H2 200 50929468 Show response
lp-03.chat.online.citi.com/api/js/ 232 B
944 B 179ms
179ms Script
application/javascript 208.89.12.87
LIVEPERSON

General

Check archive.org

Show headers Download Go to

Full URL: https://lp-03.chat.online.citi.com/api/js/50929468?sid=qYR9O6FqQHiHlW3qk5YBXA&cb=lpCb91589x3070&t=sp&ts=1601389295452&pid=1471258011&tid=4350824208&vid=IxYzY2OGRjMDdiNTI2NmY5&rvt=1601389293510&pt=Citi%20ThankYou%C2%AE%20Rewards%20%3F%20Sign%20On&u=https%3A%2F%2Fonline.citi.com%2FUS%2FJSO%2Fsignon%2FDisplayUsernameSignon.do%3FuserType%3DtyLogin%26locale%3Den_US%26TYNewUser%3Dfalse%26TYForgotUUID%3Dfalse%26TYMigration%3D%26SAMLPostURL%3Dhttps%3A%2F%2Fwww.thankyou.com%2F%2Fgateway2.htm%26ErrorCode%3D%26TYPostURL%3Dhttps%3A%2F%2Fwww.thankyou.com%2F%2FtyLoginGateway.htm%26cmp%3DEMC-CRG0780012.01&sec=%5B%22Other%22%2C%22jUSCBOL_CustomizedThankYou%22%2C%22thankyou%20signon%20page%22%2Cnull%2C%22%22%2Cnull%5D&df=0&os=1&identities=%5B%7B%22iss%22%3A%22Citi%22%2C%22acr%22%3A%22loa1%22%2C%22sub%22%3A%22livechat%22%7D%2C%7B%22iss%22%3A%22LivePerson%22%2C%22acr%22%3A%220%22%7D%5D
Requested by: Host: lptag.liveperson.net
URL: https://lptag.liveperson.net/lptag/api/account/50929468/configuration/applications/taglets/.jsonp?v=2.0&df=0&b=1
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 208.89.12.87 , United States, ASN11054 (LIVEPERSON, US),
Reverse DNS: va.v.liveperson.net
Software: ws /
Resource Hash: 2821e62d57d85f69f0db627fb92cedd4c13488e927c24983c566887e7a92e8e5

Request headers

Referer: https://online.citi.com/US/JSO/signon/DisplayUsernameSignon.do?userType=tyLogin&locale=en_US&TYNewUser=false&TYForgotUUID=false&TYMigration=&SAMLPostURL=https://www.thankyou.com//gateway2.htm&ErrorCode=&TYPostURL=https://www.thankyou.com//tyLoginGateway.htm&cmp=EMC-CRG0780012.01
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 29 Sep 2020 14:21:35 GMT
content-encoding: gzip
server: ws
access-control-allow-methods: GET, POST, PATCH
content-type: application/javascript
status: 200
access-control-expose-headers: X-Requested-With, X-HTTP-Method-Override, LP-DOMAIN-REFERER, LP-URL, ETag, ac-revision, X-LP-Last-Modified, If-Match, Authentication-Method, Credit-Card-Ref, Automation-Secret, Email-Token, x-lp-host, Lp-Req-Time, date, x-application-context, strict-transport-security, x-content-type-options, x-download-options, x-xss-protection, x-cache-status, x-amz-id-2, x-amz-request-id, expires, last-modified, set-cookie, content-security-policy, x-frame-options
cache-control: no-store
access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization, X-HTTP-Method-Override, LP-DOMAIN-REFERER, LP-URL, ETag, ac-revision, X-LP-Last-Modified, If-Match, Authentication-Method, Credit-Card-Ref, Automation-Secret, Email-Token

GET
H2 200 50929468 Show response
lp-03.chat.online.citi.com/api/js/ 42 B
792 B 218ms
217ms Script
application/javascript 208.89.12.87
LIVEPERSON

General

Check archive.org

Show headers Download Go to

Full URL: https://lp-03.chat.online.citi.com/api/js/50929468?sid=qYR9O6FqQHiHlW3qk5YBXA&cb=lpCb17547x92374&t=uc&ts=1601389295452&pid=1471258011&tid=4350824208&vid=IxYzY2OGRjMDdiNTI2NmY5&sdes=%5B%7B%22type%22%3A%22ctmrinfo%22%2C%22info%22%3A%7B%22lastPaymentDate%22%3A%7B%7D%2C%22registrationDate%22%3A%7B%7D%2C%22ctype%22%3A%22cbol-blue%22%7D%7D%2C%7B%22type%22%3A%22prodView%22%2C%22products%22%3A%7B%22product%22%3A%7B%22name%22%3A%22Citi%20ThankYou%C2%AE%20Rewards%20%3F%20Sign%20On%22%2C%22category%22%3A%22https%3A%2F%2Fonline.citi.com%2FUS%2FJSO%2Fsignon%2FDisplayUsernameSignon.do%3FuserType%3DtyLogin%26locale%3Den_US%26TYNewUser%3Dfalse%26TYForgotUUID%3Dfalse%26TYMigration%3D%26SAMLPostURL%3Dhttps%3A%2F%2Fwww.thankyou.com%2F%2Fgateway2.htm%26ErrorCode%3D%26TYPostURL%3Dhttps%3A%2F%2Fwww.thankyou.com%2F%2FtyLoginGateway.htm%26cmp%3DEMC-CRG0780012.01%22%2C%22sku%22%3A%22Other%2CjUSCBOL_CustomizedThankYou%2Cthankyou%20signon%20page%2C%2C%2C%22%7D%7D%7D%5D
Requested by: Host: lptag.liveperson.net
URL: https://lptag.liveperson.net/lptag/api/account/50929468/configuration/applications/taglets/.jsonp?v=2.0&df=0&b=1
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 208.89.12.87 , United States, ASN11054 (LIVEPERSON, US),
Reverse DNS: va.v.liveperson.net
Software: ws /
Resource Hash: 615e1ef16b0f59148edaf14de1f17431137b6251a8505b10745541128efe162d

Request headers

Referer: https://online.citi.com/US/JSO/signon/DisplayUsernameSignon.do?userType=tyLogin&locale=en_US&TYNewUser=false&TYForgotUUID=false&TYMigration=&SAMLPostURL=https://www.thankyou.com//gateway2.htm&ErrorCode=&TYPostURL=https://www.thankyou.com//tyLoginGateway.htm&cmp=EMC-CRG0780012.01
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 29 Sep 2020 14:21:35 GMT
content-encoding: gzip
server: ws
access-control-allow-methods: GET, POST, PATCH
content-type: application/javascript
status: 200
access-control-expose-headers: X-Requested-With, X-HTTP-Method-Override, LP-DOMAIN-REFERER, LP-URL, ETag, ac-revision, X-LP-Last-Modified, If-Match, Authentication-Method, Credit-Card-Ref, Automation-Secret, Email-Token, x-lp-host, Lp-Req-Time, date, x-application-context, strict-transport-security, x-content-type-options, x-download-options, x-xss-protection, x-cache-status, x-amz-id-2, x-amz-request-id, expires, last-modified, set-cookie, content-security-policy, x-frame-options
cache-control: no-store
access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization, X-HTTP-Method-Override, LP-DOMAIN-REFERER, LP-URL, ETag, ac-revision, X-LP-Last-Modified, If-Match, Authentication-Method, Credit-Card-Ref, Automation-Secret, Email-Token

GET
H2 200 50929468 Show response
lp-03.chat.online.citi.com/api/js/ 110 B
853 B 224ms
224ms Script
application/javascript 208.89.12.87
LIVEPERSON

General

Check archive.org

Show headers Download Go to

Full URL: https://lp-03.chat.online.citi.com/api/js/50929468?sid=qYR9O6FqQHiHlW3qk5YBXA&cb=lpCb68065x30874&t=pl&ts=1601389295455&pid=1471258011&tid=4350824208&vid=IxYzY2OGRjMDdiNTI2NmY5
Requested by: Host: lptag.liveperson.net
URL: https://lptag.liveperson.net/lptag/api/account/50929468/configuration/applications/taglets/.jsonp?v=2.0&df=0&b=1
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 208.89.12.87 , United States, ASN11054 (LIVEPERSON, US),
Reverse DNS: va.v.liveperson.net
Software: ws /
Resource Hash: 2035002d9fa338dbf45751e5c3f916d69cca93486c3e2d4db05817faa6447b67

Request headers

Referer: https://online.citi.com/US/JSO/signon/DisplayUsernameSignon.do?userType=tyLogin&locale=en_US&TYNewUser=false&TYForgotUUID=false&TYMigration=&SAMLPostURL=https://www.thankyou.com//gateway2.htm&ErrorCode=&TYPostURL=https://www.thankyou.com//tyLoginGateway.htm&cmp=EMC-CRG0780012.01
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Tue, 29 Sep 2020 14:21:35 GMT
content-encoding: gzip
server: ws
access-control-allow-methods: GET, POST, PATCH
content-type: application/javascript
status: 200
access-control-expose-headers: X-Requested-With, X-HTTP-Method-Override, LP-DOMAIN-REFERER, LP-URL, ETag, ac-revision, X-LP-Last-Modified, If-Match, Authentication-Method, Credit-Card-Ref, Automation-Secret, Email-Token, x-lp-host, Lp-Req-Time, date, x-application-context, strict-transport-security, x-content-type-options, x-download-options, x-xss-protection, x-cache-status, x-amz-id-2, x-amz-request-id, expires, last-modified, set-cookie, content-security-policy, x-frame-options
cache-control: no-store
access-control-allow-credentials: true
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Authorization, X-HTTP-Method-Override, LP-DOMAIN-REFERER, LP-URL, ETag, ac-revision, X-LP-Last-Modified, If-Match, Authentication-Method, Credit-Card-Ref, Automation-Secret, Email-Token

Verdicts & Comments Add Verdict or Comment

333 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

22 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.rfihub.com/	1970-01-19 22:11:25	Name: rud Value: H4sIAAAAAAAAAOMSNrQwByILSyBpZGZqamBiYiTEZ6hrke5dqVtYGGFk4hcpxWtoZmBobGFpZGFqaGkCAOzR9-I0AAAA
.citi.com/	1969-12-31 23:59:59	Name: tmx_digitalApptype Value: PC_BROWSER
.citi.com/	1969-12-31 23:59:59	Name: tmx_sessionid Value: 7959029db1a8d9b4b554fe6564f43bf1d57a69340cdd92a73beb688ce71dded6
.citi.com/	1970-01-19 14:59:25	Name: _gcl_au Value: 1.1.1475912185.1601389285
online.citi.com/	1970-01-19 12:49:51	Name: 7018 Value:
online.citi.com/	1970-01-19 12:49:51	Name: 7830 Value: error
.demdex.net/	1970-01-19 17:09:01	Name: demdex Value: 44614461522505419113347224304972832399
.citi.com/	1970-01-20 06:21:01	Name: AMCV_61834D9B5228A7430A490D45%40AdobeOrg Value: -330454231%7CMCIDTS%7C18535%7CMCMID%7C37677268469468034442868829232609339180%7CMCAAMLH-1601994084%7C6%7CMCAAMB-1601994084%7CRKhpRz8krg2tLO6pguXWp5olkAcUniQYPHaMWWgdJ3xzPWQmdj0y%7CMCOPTOUT-1601396484s%7CNONE%7CMCSYNCSOP%7C411-18542%7CMCAID%7CNONE%7CvVersion%7C3.1.2
.citi.com/	1969-12-31 23:59:59	Name: second_tmx_sessionid Value: cf40e4849e45711ff9ddabe667b837a5426267c7c86bb19a726ed881cc7102e3
.citi.com/	1969-12-31 23:59:59	Name: CITI_SITE Value: gtdc
.citi.com/	1970-01-19 21:35:25	Name: bmuid Value: 1601389284719-91F6DA58-2385-4E90-B6C4-05D4887ACE8F
.online.citi.com/	1969-12-31 23:59:59	Name: cdContextId Value: 2
.citi.com/	1969-12-31 23:59:59	Name: cdContextId Value: 2
.citi.com/	1969-12-31 23:59:59	Name: TLTSID Value: 07a058985e5de6f7e7e2f46178defd9d7a95a59c4e92c4ad61e498762ef873f9
online.citi.com/	1969-12-31 23:59:59	Name: JSESSIONID Value: 0000DuujieJPtzTnuSL5zivV7OD:gt67p-srv1
.citi.com/	1969-12-31 23:59:59	Name: bcsid Value: 5D8CD7DC83ECA81A1C824EF937E70584
.citi.com/	1970-01-20 06:21:01	Name: s_ecid Value: MCMID%7C37677268469468034442868829232609339180
.online.citi.com/	1970-01-19 21:35:25	Name: locale Value: en_US
.citi.com/	1970-01-19 21:35:25	Name: cdSNum Value: 1601389285204-sjn0000813-93831140-c995-4a1e-8693-9d5d6ddfaaa8
.citi.com/	1969-12-31 23:59:59	Name: AMCVS_61834D9B5228A7430A490D45%40AdobeOrg Value: 1
.rfihub.com/	1969-12-31 23:59:59	Name: ruds Value: H4sIAAAAAAAAAOMSNrQwByILSyBpZGZqamBiYiTEZ6hrke5dqVtYGGFk4hcJAA6AKlklAAAA
.citi.com/	1969-12-31 23:59:59	Name: AKMTLTSID Value: AB4143A921A01B10C84B23141734329F

23 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
console-api	log	URL: https://online.citi.com/US/JSO/signon/DisplayUsernameSignon.do?userType=tyLogin&locale=en_US&TYNewUser=false&TYForgotUUID=false&TYMigration=&SAMLPostURL=https://www.thankyou.com//gateway2.htm&ErrorCode=&TYPostURL=https://www.thankyou.com//tyLoginGateway.htm&cmp=EMC-CRG0780012.01(Line 46) Message:
console-api	log	URL: https://online.citi.com/CBOL/taggingTransformation/tagging.js(Line 300) Message: Started tagging.js core
console-api	log	URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js(Line 149) Message: Loading at.js
console-api	warning	URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js(Line 223) Message: AT: Adobe Target content delivery is disabled. Update your DOCTYPE to support Standards mode.
console-api	log	URL: https://online.citi.com/passivebio/bcsid.js(Line 5) Message: Setting new bcsid Cookie
console-api	log	URL: https://online.citi.com/CBOL/taggingTransformation/tagging.js(Line 1461) Message: key internal campaign tracking code is not available
console-api	log	URL: https://online.citi.com/US/JSO/signon/DisplayUsernameSignon.do?userType=tyLogin&locale=en_US&TYNewUser=false&TYForgotUUID=false&TYMigration=&SAMLPostURL=https://www.thankyou.com//gateway2.htm&ErrorCode=&TYPostURL=https://www.thankyou.com//tyLoginGateway.htm&cmp=EMC-CRG0780012.01(Line 674) Message: tmx flag value in javascriptfalse
console-api	log	URL: https://online.citi.com/US/JSO/signon/DisplayUsernameSignon.do?userType=tyLogin&locale=en_US&TYNewUser=false&TYForgotUUID=false&TYMigration=&SAMLPostURL=https://www.thankyou.com//gateway2.htm&ErrorCode=&TYPostURL=https://www.thankyou.com//tyLoginGateway.htm&cmp=EMC-CRG0780012.01(Line 1176) Message: rsa flagtrue
console-api	log	URL: https://online.citi.com/TMX/TMXProfiling.js(Line 4) Message: start tmxProfiling.js
console-api	log	URL: https://online.citi.com/US/JSO/signon/DisplayUsernameSignon.do?userType=tyLogin&locale=en_US&TYNewUser=false&TYForgotUUID=false&TYMigration=&SAMLPostURL=https://www.thankyou.com//gateway2.htm&ErrorCode=&TYPostURL=https://www.thankyou.com//tyLoginGateway.htm&cmp=EMC-CRG0780012.01(Line 1492) Message: calcBannerHtOnResize 524 0
console-api	log	URL: https://online.citi.com/US/JSO/signon/DisplayUsernameSignon.do?userType=tyLogin&locale=en_US&TYNewUser=false&TYForgotUUID=false&TYMigration=&SAMLPostURL=https://www.thankyou.com//gateway2.htm&ErrorCode=&TYPostURL=https://www.thankyou.com//tyLoginGateway.htm&cmp=EMC-CRG0780012.01(Line 1510) Message: Height Exist
console-api	log	URL: https://online.citi.com/US/JSO/signon/DisplayUsernameSignon.do?userType=tyLogin&locale=en_US&TYNewUser=false&TYForgotUUID=false&TYMigration=&SAMLPostURL=https://www.thankyou.com//gateway2.htm&ErrorCode=&TYPostURL=https://www.thankyou.com//tyLoginGateway.htm&cmp=EMC-CRG0780012.01(Line 1521) Message: this.calcHeight 524
console-api	log	URL: https://online.citi.com/US/JSO/signon/DisplayUsernameSignon.do?userType=tyLogin&locale=en_US&TYNewUser=false&TYForgotUUID=false&TYMigration=&SAMLPostURL=https://www.thankyou.com//gateway2.htm&ErrorCode=&TYPostURL=https://www.thankyou.com//tyLoginGateway.htm&cmp=EMC-CRG0780012.01(Line 1459) Message: signOnHeight 524
console-api	log	URL: https://lptag.liveperson.net/lptag/api/account/50929468/configuration/applications/taglets/.jsonp?v=2.0&df=0&b=1(Line 1) Message: ext JS_in init
console-api	log	URL: https://lptag.liveperson.net/lptag/api/account/50929468/configuration/applications/taglets/.jsonp?v=2.0&df=0&b=1(Line 1) Message: ext JS_in addexternalscript
console-api	log	URL: https://lptag.liveperson.net/lptag/api/account/50929468/configuration/applications/taglets/.jsonp?v=2.0&df=0&b=1(Line 1) Message: ext JS_in valid check
console-api	log	URL: https://lptag.liveperson.net/lptag/api/account/50929468/configuration/applications/taglets/.jsonp?v=2.0&df=0&b=1(Line 1) Message: ext JS_in_if function
console-api	log	URL: https://lptag.liveperson.net/lptag/api/account/50929468/configuration/applications/taglets/.jsonp?v=2.0&df=0&b=1(Line 1) Message: ext JS_after add
console-api	log	URL: https://online.citi.com/TMX/TMXProfiling.js(Line 6) Message: tmxProfiling js execute
console-api	log	URL: https://online.citi.com/TMX/TMXProfiling.js(Line 12) Message: successfalsePC_BROWSER7959029db1a8d9b4b554fe6564f43bf1d57a69340cdd92a73beb688ce71dded689oebq5khttps://content22.online.citi.com/fp/tags.js
console-api	log	URL: https://online.citi.com/TMX/TMXProfiling.js(Line 14) Message: tmxfallback
console-api	log	URL: https://online.citi.com/TMX/TMXProfiling.js(Line 16) Message: get everyparams89oebq5kPC_BROWSER7959029db1a8d9b4b554fe6564f43bf1d57a69340cdd92a73beb688ce71dded6
console-api	log	(Line 11) Message: test 12

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

20766699p.rfihub.com
89oebq5kozitf5zyuxbugh4stmsdoa5wlb4pa4ap22322e055d970a9bam1.e.aa.online-metrix.net
89oebq5kxcr3y72iozsn5deq4lvf2s6natzr77jyb40b017a1adcd64dam1.e.aa.online-metrix.net
a.rfihub.com
aa.agkn.com
c1.rfihub.net
cdn.pbbl.co
citi.demdex.net
cm.everesttech.net
content22.online.citi.com
contents3.00110.citi.com
dpm.demdex.net
gateway.foresee.com
h.online-metrix.net
lp-01.chat.online.citi.com
lp-03.chat.online.citi.com
lpcdn.chat.online.citi.com
lptag.liveperson.net
metrics1.citi.com
nebula-cdn.kampyle.com
nexus.ensighten.com
online.citi.com
px0.pbbl.co
resources.digital-cloud-citi.medallia.com
sr.rlcdn.com
stags.bluekai.com
static-assets.fs.liveperson.com
tags.bkrtx.com
thankyou.citi.com
udc-neb.kampyle.com
www.googletagmanager.com
www.thankyou.com
104.103.78.138
104.108.63.235
104.109.92.187
13.225.73.20
143.204.94.11
15.236.9.100
151.101.13.175
151.101.194.133
159.127.187.155
159.127.208.20
178.249.101.23
18.195.42.228
184.30.210.81
193.0.160.128
208.89.12.87
2a00:1450:4001:801::2013
2a00:1450:4001:809::2008
2a00:1450:4001:81a::2008
2a03:6400:10:0:178:249:97:98
2a03:6400:10:0:178:249:97:99
34.249.46.6
35.241.45.82
35.244.245.222
52.141.218.213
52.28.175.104
54.154.62.31
66.117.28.86
91.235.132.130
91.235.133.67
91.235.134.131
99.86.243.18
013e591f755f081c0dca82a44fe10ec5119bf3621a0769989eddb6a51a0e26c7
01489a476b4554af217a5b2a6cf2d5e87c8a628bbc78c302a632d72ec824e708
015e6103bdf04fef85eeb4c098ee7f0fa746ece89b30738106a50fa64b40d444
03c736ca1c90e26743865ed80c9766f84ca237b0dc572fab630737aaef70d171
06dfb367edf9bbff810def9f75f8695b3ccfbcb2813306609fc6e18fcacfc17e
07bfad77c7f8032108227f9489733fa4c62724a60ad016c083d1f82cc72b0063
0aa5d7acd53d6f73b4ac08bf6e99198f3cca15f6ded0efadc8b8a383ae824980
0c6df04bbd3bb79a0cff6479b79137e17eb7e3ff616e9dd9508be396d9fa2ca0
0ce3adf94d103c61df01f3735e92216bf2b424a1d3cd4fb1563508f6d1e39c29
0f0a91324802b248c7e2c624ffe7bc5fdc945c840d141cb7374dd6149750a7ee
0f5de2f9da1bb346abebdae4127db29e587095c66f3539b5eb8c392e853d3af3
157430093a6d2ee63082eae5dabf826926d3b6259d33482aa6713c48728e82fa
1789c9f0d05885053e041a64847f4d9244e593fbbd59acf75c6077ee772e9564
178f6fad63d4236044e6cf2c7293fc0679fcdb78fa13ec87a52964b5524e4716
1855a50f9593d06a3465f3677445e6a4fba2ebd59a86cef398512ea9ab2ea0f6
2035002d9fa338dbf45751e5c3f916d69cca93486c3e2d4db05817faa6447b67
242cb1fe2274ec738de60067a2c54568126e01792e55d2db82f8cfb48cbb4f24
25f4eeb23f67fe1d74534ed37230ecd54ab4f57524276970dcbeaaf3b0fc64f9
2821e62d57d85f69f0db627fb92cedd4c13488e927c24983c566887e7a92e8e5
31b00ff4929696dfca06885da68e58c3e09f6ecb4ae0fe1ae287e99a3fd1f716
3580773ed9ca515060fa99db9f30c91c28fe64a5674e5b9a241af5b7733b560c
360c503e6eb58e095c3bf8b28cf34227ac8faebe491141b3873e20b74a33967b
3975b76cc53eb1aeb0a232bc60d18c3aa1ddd3e8a7a08db6abbc14392662ca67
3cdfe9ba7795ab392a51ca638aa92dbd285f5182a9760df149da858b9475af5d
3e72de5de67d6d80b65a114af684eaf880c53c250155a663cb17d677ff064bc1
3fca3de24621f0f10186594054444d608016297c2e853e548710b3521e42a609
41a0f71e6a35be385ce9ed32dc98d4a45832e59c168c28139e679ee75288e8b5
476b7727fa249a10be611286fe5bd66c270340b15944aecb9e263d53b4b0195d
4872a31684ed0aebe597d43e1185f1911f412c310b1dd06401a9da51828fa2a2
4e4ab72725ca42cc6c17f9f590583a9cee49c62e570be8734ee1107bffc3a200
51ae37d6c7ae7327c5ff7263e9258d998d303fda16ed063fea667c23030f83c1
526ecbfda04e308f90edb0153c851212c52048dc779fd0b2ad7c07f30757864f
57d2da56bf34e445e118b213e19860af009e9109ea36c0f73c94027e4696e0f5
5c3344d6f25b95a3561326b43bdea1a94d3dcd65097a6db527442978a3ebf86f
5c89ced709eea1940ac9d955c373db2211ea68df46882fbfdc29afce1fef69e9
5e618c111ca132b80545bda22b41c930f1a370b4750bfc127476803b6fa26690
5fed06c270b4eefc001f362ca7a78b8a5430441b61a9389b7e591224b786503c
615e1ef16b0f59148edaf14de1f17431137b6251a8505b10745541128efe162d
629b48196dcc270143a42ce57535b251c655617f8d510277d4a05306c426fd38
717f12329a056efae65c7ab10d8431327ff9c314e7b4df47815442d99fb02982
74234e98afe7498fb5daf1f36ac2d78acc339464f950703b8c019892f982b90b
793c2f3d02d0bc3ad8a2cdc901b2134159b66245e951ac258fee1ac8b2709f44
79870591b22b013171ce01beccaa6671cf278953d613691b19060140097ce2c3
799b3441638d39c44c00a199ecd3dec31d13b4e4103839b6f321f72ce5c1e7f7
7afe38f32e579a288de8f251d627ed66d4293977ec24f06d25eac4e5a92b71ac
7b4a1d53c179154285284c81ce107b9dd4a02a21f9c123c7501bf4a30177ebe7
7d481eb36581746fd3662c7c452856b695df90cdce24664c48f565aa119c8b16
7df13706eaab8ce9a3dcd2a501f60bc66987c83834d07dfaf07ae56ef814c110
7e46e02ad6a40c475c2eec66ce5f66bec4aa8601415a534fec1e6e26ecfca663
81affcfb1bbe1cb5141f0f801523c49ca32e631606d0bc57d30bcb972af3082a
852bbf67c9988f8ed7e43118f914e581efb96fa4eb6d06eaf626672df92ce5fe
85eedf8859396c0a29c427dfab2c8543ef8100026fa8d77a69728737a65476d2
914403b3be0b02ce6722deb930e9ede79841a1c4705ff1e8fdf6e8a76cfff482
92861ebb7d832a714480a5b33cd9f11b2587406e5728d010a8ff7285d9c511be
95518cbec0d55a574a9c8ef72a2a7d62ac0d40a4de5dfe67a76a7d214dc8b743
95fee5c0c07c5bf834c9c3d6678d686b9825bb2e3de1cc22dcade495349fb242
96a8568336b187241ee3fff74847d757c25ee6c6cff67295be9ff4be8ea2f640
99c2917ee5b2a01459a923bdd1c676f15ee73b62b87f696e6735312d26f51e12
9a9227aa658061dcca4a55c86ca9b517d5b44f03eeac9c3849af1bd8e771ad51
9dad502247a8488c21ef5beb32aed1a78b17b748711bec817c472911f76b4ead
a1ecbaed793a1f564c49c671f2dd0ce36f858534ef6d26b55783a06b884cc506
a2d6045bdb7627674cfbca5eabfba0b1ce71fee823c99bf19ca492693aecf936
a70821e6424283e1713eb4f44945415163e6f02290cadf8fa7e71e7dc0337899
a9623118fb6ec3944d1312cd0d492c3f32455e89bc1e01eafa67628a309d9c60
b3601f582b4f4108514d25470fd306991632a98542569e15c3a25da8a64a3c81
b381eaccfca885e5455f9585d1789bf31b0b06bbb4c1592c08723fcc0d225feb
b527ff8f2705973222d157842b57b19762cd73f0053116d9ae3a8c7fac7e5c01
bfee92627d3ee6ef32f79d53989ba3e960cd5edfafd764f8089e1ad18c18327f
c03443c95fca2538c411e88702491565c1ea2662ddbc0733b5acdbffc2125017
c2f312ddb77bec10a33cce6e41f5d8d45f42531d7c1ce41c78fb58668be652fa
c3c994c3fe9bd4e055f6d0eb42067ecd6bdd3247e136bc22835b9882cfe77c61
c657e07408dbbea092f0debde9d99f631cc1771a645e957eaf02e1a5dd1b60b5
c6c40bd3fc6c2adebe8d892bcbed92c03ee4dbe582f6304f9eee4ae365bdcdfb
c9e14253e4c22e98945e45a455a7e7f967c183a62f032e4264fb073dec2ee0e8
ca99ffb7633ae3c0a6bc357abc80e00a5236dcfe66cc915d805582cf8e05c983
cb2bb21705b9cce9781d02c9223f3344a65bd5314027d11c5a8518ad4bd84e84
cc490a8ef7deb4c7fba66f332ad8cdd39433675b95d2bd341300ab7b718f8e4e
d39a392943baf815cb7728e27d5a912eb2e6da02cfa63fb43b4dad1f7a5a5f72
d57d88d75a6b978bccea69f0ddf436826b570c9b911889a2718a59e1fa521a6d
d8b32a1e0f5d3d3d05cda5e3e109a8198be3ceca3ae8b4fe63d2bd471920ef7f
e1739237d530e65b6e4b1a4d0a11223446e78b94d4dd7db657f48fede05e1d6e
e1f473983c0fd72a542ea1bc830eecea1e2ee62d67b2f1bb455963ad22ec7769
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e524a368fa3b7da146675944a77576cdb2c498673184d1dc5157ebda0df4eded
e9e9a67395a0d83b584208a19b95af203df8e8e6c6952fe76c690d60ea9381c7
ec5a129cf3f2a541423927ce779d4a85dbf647615eeb3c694bc2940fae70fae4
ed48ae9c1a324d49404d9fb4c508b880ca97a65f8fd21d352e241d1e4dfc50e2
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
ef72134da48ff0f5dcc948bd13ab14e28d4d1c8322e71fa2a4796168284b0aef
f327a0ba3e41b1e8154e1c18fc114baff0bd057151e3afe7fa6f33cc0cb18296
f62d52a7ff8957da4c0bb6357b4a9c1550cee0ebd00922d62aca8f4ac13ca63e
fdaf50ba7dfdf74a600dbb9a28a4ebfc536486d8f1e23296d7dfb33d843e1c3b
ff2631e3ff27482f9c7e83d41e5f90cca00fbca2fe749c24fae417bd8735ce09

online.citi.com Open in urlscan Pro 104.109.92.187 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Page Statistics

124 Requests

99 %HTTPS

16 %IPv6

19 Domains

32 Subdomains

28 IPs

7 Countries

2240 kBTransfer

6508 kBSize

22 Cookies

10 Outgoing links

Page URL History

Redirected requests

124 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 1 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

online.citi.com Open in urlscan Pro
104.109.92.187 Public Scan

Screenshot
Live screenshot

Full Image

124
Requests

99 %
HTTPS

16 %
IPv6

19
Domains

32
Subdomains

28
IPs

7
Countries

2240 kB
Transfer

6508 kB
Size

22
Cookies

124 HTTP transactions
1 data transactions