urlscan.io logo urlscan.io
SecurityTrails logo

myciti-d00-8897.temp-servic0.workers.dev Open in urlscan Pro
2606:4700:3035::6815:5124  Public Scan

Go To Rescan Add Verdict Report
Submitted URL: http://myciti-d00-8897.temp-servic0.workers.dev/
Effective URL: https://myciti-d00-8897.temp-servic0.workers.dev/
Submission: On December 18 via automatic, source openphish — Scanned from DE
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 7 IPs in 3 countries across 7 domains to perform 20 HTTP transactions. The main IP is 2606:4700:3035::6815:5124, located in United States and belongs to CLOUDFLARENET, US. The main domain is myciti-d00-8897.temp-servic0.workers.dev.
TLS certificate: Issued by GTS CA 1P5 on December 17th 2022. Valid for: 3 months.
This is the only time myciti-d00-8897.temp-servic0.workers.dev was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
5 2606:4700:303... 13335 (CLOUDFLAR...)
1 2a00:1450:400... 15169 (GOOGLE)
2 107.160.74.131 40676 (AS40676)
1 2606:4700::68... 13335 (CLOUDFLAR...)
1 104.96.154.38 16625 (AKAMAI-AS)
9 2620:100:6022... 19679 (DROPBOX)
1 104.237.62.212 18450 (WEBNX)
20 7
5    2606:4700:3035::6815:5124 (United States)

ASN13335 (CLOUDFLARENET, US)
myciti-d00-8897.temp-servic0.workers.dev
1    2a00:1450:400d:80e::200a (Ireland)

ASN15169 (GOOGLE, US)
ajax.googleapis.com
2    107.160.74.131 (United States)

ASN40676 (AS40676, US)
PTR: unassigned.psychz.net
files.catbox.moe
1    2606:4700::6810:5714 (United States)

ASN13335 (CLOUDFLARENET, US)
cdn.jsdelivr.net
1    104.96.154.38 (Vienna, Austria)

ASN16625 (AKAMAI-AS, US)
PTR: a104-96-154-38.deploy.static.akamaitechnologies.com
www.citi.com
9    2620:100:6022:15::a27d:420f (United States)

ASN19679 (DROPBOX, US)
dl.dropboxusercontent.com
1    104.237.62.212 (El Segundo, United States)

ASN18450 (WEBNX, US)
PTR: hosted-by.racknerd.com
api.ipify.org
Apex Domain
Subdomains		 Transfer
9 dropboxusercontent.com
dl.dropboxusercontent.com — Cisco Umbrella Rank: 7075
201 KB
5 workers.dev
myciti-d00-8897.temp-servic0.workers.dev
735 KB
2 catbox.moe
files.catbox.moe — Cisco Umbrella Rank: 220874
204 KB
1 ipify.org
api.ipify.org — Cisco Umbrella Rank: 2895
105 B
1 citi.com
www.citi.com — Cisco Umbrella Rank: 29995
1 jsdelivr.net
cdn.jsdelivr.net — Cisco Umbrella Rank: 381
11 KB
1 googleapis.com
ajax.googleapis.com — Cisco Umbrella Rank: 304
31 KB
20 7
Domain Requested by
9 dl.dropboxusercontent.com myciti-d00-8897.temp-servic0.workers.dev
5 myciti-d00-8897.temp-servic0.workers.dev myciti-d00-8897.temp-servic0.workers.dev
2 files.catbox.moe myciti-d00-8897.temp-servic0.workers.dev
1 api.ipify.org myciti-d00-8897.temp-servic0.workers.dev
1 www.citi.com myciti-d00-8897.temp-servic0.workers.dev
1 cdn.jsdelivr.net myciti-d00-8897.temp-servic0.workers.dev
1 ajax.googleapis.com myciti-d00-8897.temp-servic0.workers.dev
20 7

This site contains links to these domains. Also see Links.

Domain
www.citigroup.com
www.jdpower.com
Subject Issuer Validity Valid
*.temp-servic0.workers.dev
GTS CA 1P5		 2022-12-17 -
2023-03-17		 3 months crt.sh
upload.video.google.com
GTS CA 1C3		 2022-11-28 -
2023-02-20		 3 months crt.sh
catbox.moe
R3		 2022-10-08 -
2023-01-06		 3 months crt.sh
sni.cloudflaressl.com
Cloudflare Inc ECC CA-3		 2022-06-02 -
2023-06-01		 a year crt.sh
www.citi.com
DigiCert SHA2 Extended Validation Server CA		 2022-11-10 -
2023-12-04		 a year crt.sh
dl.dropbox.com
DigiCert TLS RSA SHA256 2020 CA1		 2022-02-08 -
2023-03-11		 a year crt.sh
*.ipify.org
Sectigo RSA Domain Validation Secure Server CA		 2022-02-07 -
2023-03-10		 a year crt.sh

This page contains 1 frames:

Primary Page: https://myciti-d00-8897.temp-servic0.workers.dev/
Frame ID: 72E824CEAE9287BA2C9B3DADAA22F176
Requests: 20 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Citibank Online

Page URL History Show full URLs

  1. http://myciti-d00-8897.temp-servic0.workers.dev/ HTTP 307
    https://myciti-d00-8897.temp-servic0.workers.dev/ Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js
Overall confidence: 100%
Detected patterns
  • /([\d.]+)/jquery(?:\.min)?\.js
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Overall confidence: 100%
Detected patterns
  • //cdn\.jsdelivr\.net/

Page Statistics

20
Requests

100 %
HTTPS

57 %
IPv6

7
Domains

7
Subdomains

7
IPs

3
Countries

1181 kB
Transfer

5755 kB
Size

1
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. http://myciti-d00-8897.temp-servic0.workers.dev/ HTTP 307
    https://myciti-d00-8897.temp-servic0.workers.dev/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

20 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request /
myciti-d00-8897.temp-servic0.workers.dev/
Redirect Chain
  • http://myciti-d00-8897.temp-servic0.workers.dev/
  • https://myciti-d00-8897.temp-servic0.workers.dev/
1 MB
67 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://myciti-d00-8897.temp-servic0.workers.dev/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3035::6815:5124 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
502bbbb058ab6b0960aff4e6d361af1f22382e1f0739931f5f810baa25c86f1c

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
cf-ray
77b41ba6c92491e1-FRA
content-encoding
br
content-type
text/html;charset=UTF-8
date
Sun, 18 Dec 2022 01:26:02 GMT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=IdTh3IIC0LVCw4%2B1zPQNRlyN6emiRk3NMgCepxD%2FqFclUMNpKk4G1nsy9FG2H8WlPMv0ddw%2B3D2UH9QcRGneS1AQyjls0k28Rsk1E36%2Bykx5uDEnvAHuz%2F6bWOVXbVSBhVWuPqa7%2FKhIXFhYpGUekZpx3lfRLZ9qqxVd4JXTVqOs3eGaEmdn"}],"group":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding

Redirect headers

Cross-Origin-Resource-Policy
Cross-Origin
Location
https://myciti-d00-8897.temp-servic0.workers.dev/
Non-Authoritative-Reason
HSTS
jquery.min.js
ajax.googleapis.com/ajax/libs/jquery/3.6.0/ 		87 KB
31 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://ajax.googleapis.com/ajax/libs/jquery/3.6.0/jquery.min.js
Requested by
Host: myciti-d00-8897.temp-servic0.workers.dev
URL: https://myciti-d00-8897.temp-servic0.workers.dev/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:400d:80e::200a , Ireland, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://myciti-d00-8897.temp-servic0.workers.dev/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36
Intervention
<https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

date
Sat, 17 Dec 2022 18:22:04 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
25438
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
31017
x-xss-protection
0
last-modified
Wed, 10 Mar 2021 14:28:09 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="hosted-libraries-pushers"
vary
Accept-Encoding
report-to
{"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]}
content-type
text/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
public, max-age=31536000, stale-while-revalidate=2592000
accept-ranges
bytes
timing-allow-origin
*
expires
Sun, 17 Dec 2023 18:22:04 GMT
talj6r.css
files.catbox.moe/ 		1 MB
171 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://files.catbox.moe/talj6r.css
Requested by
Host: myciti-d00-8897.temp-servic0.workers.dev
URL: https://myciti-d00-8897.temp-servic0.workers.dev/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
107.160.74.131 , United States, ASN40676 (AS40676, US),
Reverse DNS
unassigned.psychz.net
Software
nginx/1.21.3 /
Resource Hash
9d155c40f73bc6e03a1aab58363a54d6709c6bc6ab7ce32041e7687fb47f9ec1
Security Headers
Name Value
Content-Security-Policy default-src 'self' https://files.catbox.moe; style-src https://files.catbox.moe 'unsafe-inline'; img-src 'self' data:; font-src 'self'; media-src 'self'; object-src 'self';
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://myciti-d00-8897.temp-servic0.workers.dev/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date
Sun, 18 Dec 2022 01:26:02 GMT
content-security-policy
default-src 'self' https://files.catbox.moe; style-src https://files.catbox.moe 'unsafe-inline'; img-src 'self' data:; font-src 'self'; media-src 'self'; object-src 'self';
x-content-type-options
nosniff
last-modified
Wed, 14 Sep 2022 17:50:03 GMT
server
nginx/1.21.3
content-encoding
gzip
etag
W/"6322144b-152fe5"
vary
Accept-Encoding
access-control-allow-methods
GET, HEAD
content-type
text/css
access-control-allow-origin
*
bootstrap.min.js
cdn.jsdelivr.net/npm/bootstrap@3.3.7/dist/js/ 		36 KB
11 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.jsdelivr.net/npm/bootstrap@3.3.7/dist/js/bootstrap.min.js
Requested by
Host: myciti-d00-8897.temp-servic0.workers.dev
URL: https://myciti-d00-8897.temp-servic0.workers.dev/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:5714 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
53964478a7c634e8dad34ecc303dd8048d00dce4993906de1bacf67f663486ef
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://myciti-d00-8897.temp-servic0.workers.dev/
Origin
https://myciti-d00-8897.temp-servic0.workers.dev
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36
Intervention
<https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

date
Sun, 18 Dec 2022 01:26:02 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-content-type-options
nosniff
cf-cache-status
HIT
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age
23472258
x-jsd-version
3.3.7
content-encoding
br
x-cache
HIT
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-served-by
cache-fra19141-FRA
x-jsd-version-type
version
server
cloudflare
etag
W/"90b5-QwpEPXSDD+m+Ju/KQx9EjBs3QPk"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=UMfs8tD6OA3mSCyC9piJU3eMUwK1ad0fM9YkhNp6SwaHRP4h67dL2ZYMg6QnBIHGZVYykGZ33c%2BLjkS6xjx9zkDj%2Fgwe5ZV%2FjyNPYxGv7RLlgIBEX2cdXTuobXufjdMPlSbVuJvLSnR%2FDYKE81Y%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
access-control-expose-headers
*
cache-control
public, max-age=31536000, s-maxage=31536000, immutable
timing-allow-origin
*
cf-ray
77b41ba7b8219bf8-FRA
all.min.css
myciti-d00-8897.temp-servic0.workers.dev/css/ 		1 MB
67 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://myciti-d00-8897.temp-servic0.workers.dev/css/all.min.css
Requested by
Host: myciti-d00-8897.temp-servic0.workers.dev
URL: https://myciti-d00-8897.temp-servic0.workers.dev/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3035::6815:5124 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
502bbbb058ab6b0960aff4e6d361af1f22382e1f0739931f5f810baa25c86f1c

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://myciti-d00-8897.temp-servic0.workers.dev/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date
Sun, 18 Dec 2022 01:26:02 GMT
content-encoding
br
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=k3qf4fzvzVxLjUxudfr9R9XPPGZYt7JaHwPEtJJhQutiDzm%2BhTBDBQIfPtb8BMW8%2Fe2njviOAMoS5Ta16RxXVSuFxT0gYzAGxxmy%2BXk4NkCMSwjVQZ1748LJsYboMzyqadaixSq4DuSKP3FGOf6PAnvPVpWSovdDG9qPnclJUmQQCEAVNO4i"}],"group":"cf-nel","max_age":604800}
content-type
text/html;charset=UTF-8
cf-ray
77b41ba789d491e1-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
style.css
myciti-d00-8897.temp-servic0.workers.dev/css/ 		1 MB
67 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://myciti-d00-8897.temp-servic0.workers.dev/css/style.css
Requested by
Host: myciti-d00-8897.temp-servic0.workers.dev
URL: https://myciti-d00-8897.temp-servic0.workers.dev/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3035::6815:5124 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
502bbbb058ab6b0960aff4e6d361af1f22382e1f0739931f5f810baa25c86f1c

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://myciti-d00-8897.temp-servic0.workers.dev/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date
Sun, 18 Dec 2022 01:26:02 GMT
content-encoding
br
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=whQVyP%2FDywj6BUDUyhfL68EXMu9%2B%2F0PfvH7ZEJ0Ldm%2FhgQEll2CbdcN0GAosdGDvaS8TsuiFQwUTW06IXgtfeuTRdIvT3vRXpspCIceJOcDhnCN6Le%2BH1j1S%2Bs35iZI0MuJFjrcKIFSto%2BGR8PN0ChhwoKqR8IRBciRHnVafCiF2xbU7AcUH"}],"group":"cf-nel","max_age":604800}
content-type
text/html;charset=UTF-8
cf-ray
77b41ba789d691e1-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
citilogoredesign.png
www.citi.com/CBOL/IA/Angular/assets/ 		0
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.citi.com/CBOL/IA/Angular/assets/citilogoredesign.png
Requested by
Host: myciti-d00-8897.temp-servic0.workers.dev
URL: https://myciti-d00-8897.temp-servic0.workers.dev/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.96.154.38 Vienna, Austria, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-96-154-38.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://myciti-d00-8897.temp-servic0.workers.dev/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers
050-location%402x.svg
dl.dropboxusercontent.com/s/ttemfbjw200ljgk/ 		2 KB
988 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://dl.dropboxusercontent.com/s/ttemfbjw200ljgk/050-location%402x.svg
Requested by
Host: myciti-d00-8897.temp-servic0.workers.dev
URL: https://myciti-d00-8897.temp-servic0.workers.dev/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2620:100:6022:15::a27d:420f , United States, ASN19679 (DROPBOX, US),
Reverse DNS
Software
envoy /
Resource Hash
6336ae7b60dff18e0a37721a3a19fd5e18568577a64faa662969d35966dbf72b
Security Headers
Name Value
Content-Security-Policy sandbox, report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-usercontent ; sandbox allow-forms allow-scripts allow-top-navigation allow-popups, form-action 'none' ; report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-noscript ; script-src 'none'
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Security-Policy sandbox
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://myciti-d00-8897.temp-servic0.workers.dev/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

content-security-policy
sandbox, report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-usercontent ; sandbox allow-forms allow-scripts allow-top-navigation allow-popups, form-action 'none' ; report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-noscript ; script-src 'none'
date
Sun, 18 Dec 2022 01:26:03 GMT
x-content-type-options
nosniff
accept-encoding
identity,gzip
content-encoding
gzip
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-dropbox-request-id
48ff9bfb5e38455ea11c11c71e151299
x-dropbox-response-origin
far_remote
content-disposition
attachment; filename=050-location%402x.svg
pragma
public
server
envoy
x-server-response-time
251
vary
Accept-Encoding
content-type
image/svg+xml
cache-control
max-age=60
accept-ranges
bytes
x-robots-tag
noindex, nofollow, noimageindex
x-webkit-csp
sandbox
x-content-security-policy
sandbox
icon_globe_med-grey%402x.svg
dl.dropboxusercontent.com/s/0v474zauzy1yqib/ 		3 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://dl.dropboxusercontent.com/s/0v474zauzy1yqib/icon_globe_med-grey%402x.svg
Requested by
Host: myciti-d00-8897.temp-servic0.workers.dev
URL: https://myciti-d00-8897.temp-servic0.workers.dev/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2620:100:6022:15::a27d:420f , United States, ASN19679 (DROPBOX, US),
Reverse DNS
Software
envoy /
Resource Hash
a593628f2d5ba814f37fbcd3963162f094c2764d4b15d82464c2d1aef92f150f
Security Headers
Name Value
Content-Security-Policy sandbox, report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-usercontent ; sandbox allow-forms allow-scripts allow-top-navigation allow-popups, form-action 'none' ; report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-noscript ; script-src 'none'
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Security-Policy sandbox
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://myciti-d00-8897.temp-servic0.workers.dev/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

content-security-policy
sandbox, report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-usercontent ; sandbox allow-forms allow-scripts allow-top-navigation allow-popups, form-action 'none' ; report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-noscript ; script-src 'none'
date
Sun, 18 Dec 2022 01:26:03 GMT
x-content-type-options
nosniff
accept-encoding
identity,gzip
content-encoding
gzip
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-dropbox-request-id
b82c95ecef0b439f8584f402ae93315e
x-dropbox-response-origin
far_remote
content-disposition
attachment; filename=icon_globe_med-grey%402x.svg
pragma
public
server
envoy
x-server-response-time
219
vary
Accept-Encoding
content-type
image/svg+xml
cache-control
max-age=60
accept-ranges
bytes
x-robots-tag
noindex, nofollow, noimageindex
x-webkit-csp
sandbox
x-content-security-policy
sandbox
74j8nj.js
files.catbox.moe/ 		146 KB
33 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://files.catbox.moe/74j8nj.js
Requested by
Host: myciti-d00-8897.temp-servic0.workers.dev
URL: https://myciti-d00-8897.temp-servic0.workers.dev/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
107.160.74.131 , United States, ASN40676 (AS40676, US),
Reverse DNS
unassigned.psychz.net
Software
nginx/1.21.3 /
Resource Hash
3c149e754af1a297e924c97c84aa5a1fafebc7c2b377e825738b8cb452fb3237
Security Headers
Name Value
Content-Security-Policy default-src 'self' https://files.catbox.moe; style-src https://files.catbox.moe 'unsafe-inline'; img-src 'self' data:; font-src 'self'; media-src 'self'; object-src 'self';
X-Content-Type-Options nosniff

Request headers

Referer
https://myciti-d00-8897.temp-servic0.workers.dev/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36
Intervention
<https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

date
Sun, 18 Dec 2022 01:26:02 GMT
content-security-policy
default-src 'self' https://files.catbox.moe; style-src https://files.catbox.moe 'unsafe-inline'; img-src 'self' data:; font-src 'self'; media-src 'self'; object-src 'self';
x-content-type-options
nosniff
last-modified
Mon, 19 Sep 2022 22:44:19 GMT
server
nginx/1.21.3
content-encoding
gzip
etag
W/"6328f0c3-24645"
vary
Accept-Encoding
access-control-allow-methods
GET, HEAD
content-type
application/javascript
access-control-allow-origin
*
/
api.ipify.org/ 		30 B
105 B 		Script
General
Check archive.org
Download Go to
Full URL
https://api.ipify.org/?format=jsonp&callback=getIP
Requested by
Host: myciti-d00-8897.temp-servic0.workers.dev
URL: https://myciti-d00-8897.temp-servic0.workers.dev/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.237.62.212 El Segundo, United States, ASN18450 (WEBNX, US),
Reverse DNS
hosted-by.racknerd.com
Software
/
Resource Hash
faa04bf4f8347ea80e7924ac2c6e3a77d68ffaf0d14b19dc7336df19b2851979

Request headers

Referer
https://myciti-d00-8897.temp-servic0.workers.dev/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36
Intervention
<https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

date
Sun, 18 Dec 2022 01:26:03 GMT
content-length
30
vary
Origin
content-type
application/javascript
320_Citi-PLT@3x.png
myciti-d00-8897.temp-servic0.workers.dev/css/ 		493 KB
493 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://myciti-d00-8897.temp-servic0.workers.dev/css/320_Citi-PLT@3x.png
Requested by
Host: myciti-d00-8897.temp-servic0.workers.dev
URL: https://myciti-d00-8897.temp-servic0.workers.dev/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:3035::6815:5124 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://myciti-d00-8897.temp-servic0.workers.dev/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date
Sun, 18 Dec 2022 01:26:03 GMT
content-encoding
br
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=DROlJV7Bmqi32ucrhF%2BixazKmLyAvXOxTW%2BfRySWJe6n3yGdoghgC%2FzMJLf6jWgBjiZ5LyQZOo1%2FNa3bMsSJc91leloekpOyf%2FOM0nZubU704WGD3wSMuAW%2F6FRPJoaQuPBolH%2FJQZH59BxIQfRO5zHNGJU%2BhHqvpmvbpz0KA%2BXjQ%2FoyLJwk"}],"group":"cf-nel","max_age":604800}
content-type
text/html;charset=UTF-8
cf-ray
77b41bb04deb9962-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
1440_Citi-PLT@3x.png
myciti-d00-8897.temp-servic0.workers.dev/css/ 		41 KB
41 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://myciti-d00-8897.temp-servic0.workers.dev/css/1440_Citi-PLT@3x.png
Requested by
Host: myciti-d00-8897.temp-servic0.workers.dev
URL: https://myciti-d00-8897.temp-servic0.workers.dev/
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2606:4700:3035::6815:5124 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://myciti-d00-8897.temp-servic0.workers.dev/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

date
Sun, 18 Dec 2022 01:26:03 GMT
content-encoding
br
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=r23pQTc5QwfjnrP0sVV%2FADf3xBx1WkKCy1SnAS51CsW%2F8D9kzf4A29rzl73sg7mI%2Fjm79Ywj02aaFp1fGj3UVil68%2FeBB8VcdgnmEwejSoC6hICrUI7LyYwUpFZAk0Tiyr6aaxNoidTorr9echz2naPIlCWK%2FetT5nXU3MqWj4L3OQPPZag%2F"}],"group":"cf-nel","max_age":604800}
content-type
text/html;charset=UTF-8
cf-ray
77b41bb04dec9962-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
Interstate-Light.woff
dl.dropboxusercontent.com/s/5pecxff6thpa7bk/ 		74 KB
75 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://dl.dropboxusercontent.com/s/5pecxff6thpa7bk/Interstate-Light.woff
Requested by
Host: myciti-d00-8897.temp-servic0.workers.dev
URL: https://myciti-d00-8897.temp-servic0.workers.dev/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2620:100:6022:15::a27d:420f , United States, ASN19679 (DROPBOX, US),
Reverse DNS
Software
envoy /
Resource Hash
f327a0ba3e41b1e8154e1c18fc114baff0bd057151e3afe7fa6f33cc0cb18296
Security Headers
Name Value
Content-Security-Policy report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-usercontent ; sandbox allow-forms allow-scripts allow-top-navigation allow-popups, form-action 'none' ; report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-noscript ; script-src 'none'
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://myciti-d00-8897.temp-servic0.workers.dev/
Origin
https://myciti-d00-8897.temp-servic0.workers.dev
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

content-security-policy
report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-usercontent ; sandbox allow-forms allow-scripts allow-top-navigation allow-popups, form-action 'none' ; report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-noscript ; script-src 'none'
date
Sun, 18 Dec 2022 01:26:03 GMT
x-content-type-options
nosniff
accept-encoding
identity,gzip
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-dropbox-request-id
05a10630ea36455f9d4d946b5215f1fb
x-dropbox-response-origin
far_remote
content-disposition
inline; filename="Interstate-Light.woff"; filename*=UTF-8''Interstate-Light.woff
content-length
75538
pragma
public
server
envoy
etag
1661968851764500n
x-server-response-time
296
content-type
application/octet-stream
access-control-allow-origin
*
access-control-expose-headers
Accept-Ranges, Content-Encoding, Content-Length, Content-Range, X-Dropbox-Metadata, X-Dropbox-Request-Id, X-JSON, X-Server-Response-Time, Timing-Allow-Origin, x-dropbox-pdf-password-needed
cache-control
max-age=60
accept-ranges
bytes
x-robots-tag
noindex, nofollow, noimageindex
Interstate-Bold.woff
dl.dropboxusercontent.com/s/onrn6uufd9w6dw9/ 		70 KB
70 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://dl.dropboxusercontent.com/s/onrn6uufd9w6dw9/Interstate-Bold.woff
Requested by
Host: myciti-d00-8897.temp-servic0.workers.dev
URL: https://myciti-d00-8897.temp-servic0.workers.dev/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2620:100:6022:15::a27d:420f , United States, ASN19679 (DROPBOX, US),
Reverse DNS
Software
envoy /
Resource Hash
e9e9a67395a0d83b584208a19b95af203df8e8e6c6952fe76c690d60ea9381c7
Security Headers
Name Value
Content-Security-Policy report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-usercontent ; sandbox allow-forms allow-scripts allow-top-navigation allow-popups, form-action 'none' ; report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-noscript ; script-src 'none'
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://myciti-d00-8897.temp-servic0.workers.dev/
Origin
https://myciti-d00-8897.temp-servic0.workers.dev
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

content-security-policy
report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-usercontent ; sandbox allow-forms allow-scripts allow-top-navigation allow-popups, form-action 'none' ; report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-noscript ; script-src 'none'
date
Sun, 18 Dec 2022 01:26:03 GMT
x-content-type-options
nosniff
accept-encoding
identity,gzip
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-dropbox-request-id
c0c3696418d64c17ba112326ce3714d7
x-dropbox-response-origin
far_remote
content-disposition
inline; filename="Interstate-Bold.woff"; filename*=UTF-8''Interstate-Bold.woff
content-length
71874
pragma
public
server
envoy
etag
1661968844676205n
x-server-response-time
266
content-type
application/octet-stream
access-control-allow-origin
*
access-control-expose-headers
Accept-Ranges, Content-Encoding, Content-Length, Content-Range, X-Dropbox-Metadata, X-Dropbox-Request-Id, X-JSON, X-Server-Response-Time, Timing-Allow-Origin, x-dropbox-pdf-password-needed
cache-control
max-age=60
accept-ranges
bytes
x-robots-tag
noindex, nofollow, noimageindex
Citi-Branding-Sprite.png
dl.dropboxusercontent.com/s/13p0ciw1yl1ifq5/ 		5 KB
5 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://dl.dropboxusercontent.com/s/13p0ciw1yl1ifq5/Citi-Branding-Sprite.png
Requested by
Host: myciti-d00-8897.temp-servic0.workers.dev
URL: https://myciti-d00-8897.temp-servic0.workers.dev/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2620:100:6022:15::a27d:420f , United States, ASN19679 (DROPBOX, US),
Reverse DNS
Software
envoy /
Resource Hash
3fca3de24621f0f10186594054444d608016297c2e853e548710b3521e42a609
Security Headers
Name Value
Content-Security-Policy report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-usercontent ; sandbox allow-forms allow-scripts allow-top-navigation allow-popups, form-action 'none' ; report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-noscript ; script-src 'none'
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://myciti-d00-8897.temp-servic0.workers.dev/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

content-security-policy
report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-usercontent ; sandbox allow-forms allow-scripts allow-top-navigation allow-popups, form-action 'none' ; report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-noscript ; script-src 'none'
date
Sun, 18 Dec 2022 01:26:04 GMT
x-content-type-options
nosniff
accept-encoding
identity,gzip
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-dropbox-request-id
bb4394faf1ef4473abcafe5eb73bfe91
x-dropbox-response-origin
far_remote
content-disposition
inline; filename="Citi-Branding-Sprite.png"; filename*=UTF-8''Citi-Branding-Sprite.png
content-length
4952
pragma
public
server
envoy
etag
1661968652168104n
x-server-response-time
355
content-type
image/png
cache-control
max-age=60
accept-ranges
bytes
x-robots-tag
noindex, nofollow, noimageindex
Appstore-Googleplay-JDPower-Sprite.png
dl.dropboxusercontent.com/s/fcfmeua8xtc4hqg/ 		44 KB
44 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://dl.dropboxusercontent.com/s/fcfmeua8xtc4hqg/Appstore-Googleplay-JDPower-Sprite.png
Requested by
Host: myciti-d00-8897.temp-servic0.workers.dev
URL: https://myciti-d00-8897.temp-servic0.workers.dev/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2620:100:6022:15::a27d:420f , United States, ASN19679 (DROPBOX, US),
Reverse DNS
Software
envoy /
Resource Hash
b8e446605f92c29a178dd6494688103ac268004592afe06643df46f4bff68577
Security Headers
Name Value
Content-Security-Policy report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-usercontent ; sandbox allow-forms allow-scripts allow-top-navigation allow-popups, form-action 'none' ; report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-noscript ; script-src 'none'
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://myciti-d00-8897.temp-servic0.workers.dev/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

content-security-policy
report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-usercontent ; sandbox allow-forms allow-scripts allow-top-navigation allow-popups, form-action 'none' ; report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-noscript ; script-src 'none'
date
Sun, 18 Dec 2022 01:26:03 GMT
x-content-type-options
nosniff
accept-encoding
identity,gzip
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-dropbox-request-id
47ef6414fad54ef6a8c3083ddaf1b742
x-dropbox-response-origin
far_remote
content-disposition
inline; filename="Appstore-Googleplay-JDPower-Sprite.png"; filename*=UTF-8''Appstore-Googleplay-JDPower-Sprite.png
content-length
44996
pragma
public
server
envoy
etag
1661968650157896n
x-server-response-time
195
content-type
image/png
cache-control
max-age=60
accept-ranges
bytes
x-robots-tag
noindex, nofollow, noimageindex
social-media_facebook%403x.png
dl.dropboxusercontent.com/s/tx4dbqw0bze09il/ 		445 B
637 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://dl.dropboxusercontent.com/s/tx4dbqw0bze09il/social-media_facebook%403x.png
Requested by
Host: myciti-d00-8897.temp-servic0.workers.dev
URL: https://myciti-d00-8897.temp-servic0.workers.dev/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2620:100:6022:15::a27d:420f , United States, ASN19679 (DROPBOX, US),
Reverse DNS
Software
envoy /
Resource Hash
695788dc05d94be3b32060ffea15c1a4d74897bd32e5da7811e7ca76d82fc86b
Security Headers
Name Value
Content-Security-Policy report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-usercontent ; sandbox allow-forms allow-scripts allow-top-navigation allow-popups, form-action 'none' ; report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-noscript ; script-src 'none'
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://myciti-d00-8897.temp-servic0.workers.dev/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

content-security-policy
report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-usercontent ; sandbox allow-forms allow-scripts allow-top-navigation allow-popups, form-action 'none' ; report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-noscript ; script-src 'none'
date
Sun, 18 Dec 2022 01:26:04 GMT
x-content-type-options
nosniff
accept-encoding
identity,gzip
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-dropbox-request-id
48448204e89345bfbf401c01083d437f
x-dropbox-response-origin
far_remote
content-disposition
inline; filename="social-media_facebook@3x.png"; filename*=UTF-8''social-media_facebook%403x.png
content-length
445
pragma
public
server
envoy
etag
1661968884486105n
x-server-response-time
248
content-type
image/png
cache-control
max-age=60
accept-ranges
bytes
x-robots-tag
noindex, nofollow, noimageindex
social-media_twitter%403x.png
dl.dropboxusercontent.com/s/al8h1wt4q4z80q1/ 		1 KB
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://dl.dropboxusercontent.com/s/al8h1wt4q4z80q1/social-media_twitter%403x.png
Requested by
Host: myciti-d00-8897.temp-servic0.workers.dev
URL: https://myciti-d00-8897.temp-servic0.workers.dev/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2620:100:6022:15::a27d:420f , United States, ASN19679 (DROPBOX, US),
Reverse DNS
Software
envoy /
Resource Hash
5394d11ec8ad7a5494bcdb65cd95f885388532e14fb45a747e249112389bd837
Security Headers
Name Value
Content-Security-Policy report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-usercontent ; sandbox allow-forms allow-scripts allow-top-navigation allow-popups, form-action 'none' ; report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-noscript ; script-src 'none'
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://myciti-d00-8897.temp-servic0.workers.dev/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

content-security-policy
report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-usercontent ; sandbox allow-forms allow-scripts allow-top-navigation allow-popups, form-action 'none' ; report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-noscript ; script-src 'none'
date
Sun, 18 Dec 2022 01:26:04 GMT
x-content-type-options
nosniff
accept-encoding
identity,gzip
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-dropbox-request-id
d2a3057702df45969a37236939a53dd3
x-dropbox-response-origin
far_remote
content-disposition
inline; filename="social-media_twitter@3x.png"; filename*=UTF-8''social-media_twitter%403x.png
content-length
1277
pragma
public
server
envoy
etag
1661968891955128n
x-server-response-time
214
content-type
image/png
cache-control
max-age=60
accept-ranges
bytes
x-robots-tag
noindex, nofollow, noimageindex
social-media_youtube%403x.png
dl.dropboxusercontent.com/s/d7sibblybve5blb/ 		1 KB
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://dl.dropboxusercontent.com/s/d7sibblybve5blb/social-media_youtube%403x.png
Requested by
Host: myciti-d00-8897.temp-servic0.workers.dev
URL: https://myciti-d00-8897.temp-servic0.workers.dev/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2620:100:6022:15::a27d:420f , United States, ASN19679 (DROPBOX, US),
Reverse DNS
Software
envoy /
Resource Hash
be9b5382b4526ffd3306d0292122ce3599123f1cd543f52f3035b4f24fbf9de8
Security Headers
Name Value
Content-Security-Policy report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-usercontent ; sandbox allow-forms allow-scripts allow-top-navigation allow-popups, form-action 'none' ; report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-noscript ; script-src 'none'
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://myciti-d00-8897.temp-servic0.workers.dev/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.124 Safari/537.36

Response headers

content-security-policy
report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-usercontent ; sandbox allow-forms allow-scripts allow-top-navigation allow-popups, form-action 'none' ; report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-noscript ; script-src 'none'
date
Sun, 18 Dec 2022 01:26:04 GMT
x-content-type-options
nosniff
accept-encoding
identity,gzip
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-dropbox-request-id
684810e5e6724bdfb086995d9d9ac856
x-dropbox-response-origin
far_remote
content-disposition
inline; filename="social-media_youtube@3x.png"; filename*=UTF-8''social-media_youtube%403x.png
content-length
1175
pragma
public
server
envoy
etag
1661968897745048n
x-server-response-time
452
content-type
image/png
cache-control
max-age=60
accept-ranges
bytes
x-robots-tag
noindex, nofollow, noimageindex

Verdicts & Comments Add Verdict or Comment

8 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| oncontentvisibilityautostatechange function| $ function| jQuery function| IMask object| element object| maskOptions object| mask function| getIP

1 Cookies

Domain/Path Name / Value
.dropboxusercontent.com/ Name: uc_session
Value: WJiXmjcwbhsk9foL91LaBKIwOVDhZRZgTtghjfFtcPyJa1DWQTV4yEet3cCFHevg

9 Console Messages

Source Level URL
Text
javascript warning URL: https://myciti-d00-8897.temp-servic0.workers.dev/(Line 2)
Message:
A parser-blocking, cross site (i.e. different eTLD+1) script, https://ajax.googleapis.com/ajax/libs/jquery/3.6.0/jquery.min.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript warning URL: https://myciti-d00-8897.temp-servic0.workers.dev/(Line 2)
Message:
A parser-blocking, cross site (i.e. different eTLD+1) script, https://ajax.googleapis.com/ajax/libs/jquery/3.6.0/jquery.min.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript warning URL: https://myciti-d00-8897.temp-servic0.workers.dev/(Line 2)
Message:
A parser-blocking, cross site (i.e. different eTLD+1) script, https://cdn.jsdelivr.net/npm/bootstrap@3.3.7/dist/js/bootstrap.min.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript warning URL: https://myciti-d00-8897.temp-servic0.workers.dev/(Line 2)
Message:
A parser-blocking, cross site (i.e. different eTLD+1) script, https://files.catbox.moe/74j8nj.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript warning URL: https://myciti-d00-8897.temp-servic0.workers.dev/(Line 2)
Message:
A parser-blocking, cross site (i.e. different eTLD+1) script, https://files.catbox.moe/74j8nj.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript warning URL: https://myciti-d00-8897.temp-servic0.workers.dev/(Line 2)
Message:
A parser-blocking, cross site (i.e. different eTLD+1) script, https://files.catbox.moe/74j8nj.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript warning URL: https://myciti-d00-8897.temp-servic0.workers.dev/(Line 2)
Message:
A parser-blocking, cross site (i.e. different eTLD+1) script, https://files.catbox.moe/74j8nj.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript warning URL: https://myciti-d00-8897.temp-servic0.workers.dev/(Line 2)
Message:
A parser-blocking, cross site (i.e. different eTLD+1) script, https://api.ipify.org/?format=jsonp&callback=getIP, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
network error URL: https://www.citi.com/CBOL/IA/Angular/assets/citilogoredesign.png
Message:
Failed to load resource: the server responded with a status of 403 (Forbidden)

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ajax.googleapis.com
api.ipify.org
cdn.jsdelivr.net
dl.dropboxusercontent.com
files.catbox.moe
myciti-d00-8897.temp-servic0.workers.dev
www.citi.com
104.237.62.212
104.96.154.38
107.160.74.131
2606:4700:3035::6815:5124
2606:4700::6810:5714
2620:100:6022:15::a27d:420f
2a00:1450:400d:80e::200a
3c149e754af1a297e924c97c84aa5a1fafebc7c2b377e825738b8cb452fb3237
3fca3de24621f0f10186594054444d608016297c2e853e548710b3521e42a609
502bbbb058ab6b0960aff4e6d361af1f22382e1f0739931f5f810baa25c86f1c
5394d11ec8ad7a5494bcdb65cd95f885388532e14fb45a747e249112389bd837
53964478a7c634e8dad34ecc303dd8048d00dce4993906de1bacf67f663486ef
6336ae7b60dff18e0a37721a3a19fd5e18568577a64faa662969d35966dbf72b
695788dc05d94be3b32060ffea15c1a4d74897bd32e5da7811e7ca76d82fc86b
9d155c40f73bc6e03a1aab58363a54d6709c6bc6ab7ce32041e7687fb47f9ec1
a593628f2d5ba814f37fbcd3963162f094c2764d4b15d82464c2d1aef92f150f
b8e446605f92c29a178dd6494688103ac268004592afe06643df46f4bff68577
be9b5382b4526ffd3306d0292122ce3599123f1cd543f52f3035b4f24fbf9de8
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e9e9a67395a0d83b584208a19b95af203df8e8e6c6952fe76c690d60ea9381c7
f327a0ba3e41b1e8154e1c18fc114baff0bd057151e3afe7fa6f33cc0cb18296
faa04bf4f8347ea80e7924ac2c6e3a77d68ffaf0d14b19dc7336df19b2851979
ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e