citi-web.page Open in urlscan Pro
129.153.5.241 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
https://citi-web.page/main/
Submission: On March 12 via automatic, source openphish (March 12th 2022, 1:17:56 am UTC) — Scanned from DE

Summary HTTP 41 Redirects Links 17 Behaviour Indicators

Summary

This website contacted 9 IPs in 3 countries across 8 domains to perform 41 HTTP transactions. The main IP is 129.153.5.241, located in Ashburn, United States and belongs to ORACLE-BMC-31898, US. The main domain is citi-web.page.
TLS certificate: Issued by cPanel, Inc. Certification Authority on March 11th 2022. Valid for: 3 months.

This is the only time citi-web.page was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Citibank (Banking)

Domain & IP information

	IP Address	AS Autonomous System
1 23	129.153.5.241 129.153.5.241	31898 (ORACLE-BM...) (ORACLE-BMC-31898)
2	2001:4de0:ac1... 2001:4de0:ac18::1:a:1b	20446 (STACKPATH...) (STACKPATH-CDN)
1	2606:4700::68... 2606:4700::6810:135e	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2606:4700::68... 2606:4700::6812:bcf	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2a00:1450:400... 2a00:1450:4001:82a::200a	15169 (GOOGLE) (GOOGLE)
8	2606:4700::68... 2606:4700::6810:5514	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	104.117.204.150 104.117.204.150	16625 (AKAMAI-AS) (AKAMAI-AS)
2	52.43.32.23 52.43.32.23	16509 (AMAZON-02) (AMAZON-02)
41	9

23 129.153.5.241 (Ashburn, United States) 1 redirects

ASN31898 (ORACLE-BMC-31898, US)

citi-web.page	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2001:4de0:ac18::1:a:1b (Netherlands)

ASN20446 (STACKPATH-CDN, US)

code.jquery.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6810:135e (United States)

ASN13335 (CLOUDFLARENET, US)

cdnjs.cloudflare.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6812:bcf (United States)

ASN13335 (CLOUDFLARENET, US)

stackpath.bootstrapcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:82a::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

ajax.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 2606:4700::6810:5514 (United States)

ASN13335 (CLOUDFLARENET, US)

cdn.jsdelivr.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.117.204.150 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a104-117-204-150.deploy.static.akamaitechnologies.com

www.citi.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 52.43.32.23 (Boardman, United States)

ASN16509 (AMAZON-02, US)
PTR: ec2-52-43-32-23.us-west-2.compute.amazonaws.com

ci-mpsnare.iovation.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
23	citi-web.page 1 redirects citi-web.page	2 MB
8	jsdelivr.net cdn.jsdelivr.net — Cisco Umbrella Rank: 403	64 KB
2	iovation.com ci-mpsnare.iovation.com — Cisco Umbrella Rank: 58286	14 KB
2	jquery.com code.jquery.com — Cisco Umbrella Rank: 588	53 KB
1	citi.com www.citi.com — Cisco Umbrella Rank: 25372 Failed	3 KB
1	googleapis.com ajax.googleapis.com — Cisco Umbrella Rank: 251	32 KB
1	bootstrapcdn.com stackpath.bootstrapcdn.com — Cisco Umbrella Rank: 2181	15 KB
1	cloudflare.com cdnjs.cloudflare.com — Cisco Umbrella Rank: 194	7 KB
41	8

	Domain	Requested by
23	citi-web.page	1 redirects citi-web.page
8	cdn.jsdelivr.net	citi-web.page
2	ci-mpsnare.iovation.com	citi-web.page ci-mpsnare.iovation.com
2	code.jquery.com	citi-web.page
1	www.citi.com	citi-web.page
1	ajax.googleapis.com	citi-web.page
1	stackpath.bootstrapcdn.com	citi-web.page
1	cdnjs.cloudflare.com	citi-web.page
41	8

This site contains links to these domains. Also see Links.

Domain
www.citi.com
www.citicards.com
online.citi.com
citigoldprivateclient.citi.com

Subject Issuer	Validity	Valid
citi-web.page cPanel, Inc. Certification Authority	`2022-03-11` - `2022-06-09`	3 months	crt.sh
*.jquery.com Sectigo RSA Domain Validation Secure Server CA	`2021-07-14` - `2022-08-14`	a year	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2021-09-21` - `2022-09-20`	a year	crt.sh
upload.video.google.com GTS CA 1C3	`2022-02-17` - `2022-05-12`	3 months	crt.sh
www.citi.com DigiCert SHA2 Extended Validation Server CA	`2021-11-02` - `2022-12-03`	a year	crt.sh
ci-mpsnare.iovation.com DigiCert SHA2 Extended Validation Server CA	`2021-04-21` - `2022-05-10`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://citi-web.page/main/
Frame ID: 2D4F97611B027CF398675EDA8BF11C99
Requests: 41 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Sign On to Your Citi Account - Citibank

Page URL History Show full URLs

https://citi-web.page/main HTTP 301
https://citi-web.page/main/ Page URL

Detected technologies

Bootstrap (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js

Popper (Miscellaneous) Expand

Overall confidence: 100%
Detected patterns

<script [^>]*src="[^"]*/popper\.js/([0-9.]+)
/popper\.js/([0-9.]+)

SweetAlert2 (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

sweetalert2(?:\.all)?(?:\.min)?\.js
/npm/sweetalert2@([\d.]+)

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery[.-]([\d.]*\d)[^/]*\.js
/([\d.]+)/jquery(?:\.min)?\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

jsDelivr (CDN) Expand

Overall confidence: 100%
Detected patterns

//cdn\.jsdelivr\.net/

Page Statistics

41
Requests

93 %
HTTPS

63 %
IPv6

8
Domains

8
Subdomains

9
IPs

3
Countries

1789 kB
Transfer

2273 kB
Size

2
Cookies

17 Outgoing links

These are links going to different origins than the main page.

URL: https://www.citi.com/US/ag/citibank-location-finder
Title: ATM / Branch

Search URL Search Domain Scan URL

URL: https://www.citi.com/login
Title: Continuar

Search URL Search Domain Scan URL

URL: https://www.citi.com/credit-cards/knowledge-center/citi-articles/citi.action?ID=citi-credit-knowledge-center
Title: Citi® Credit Knowledge Center

Search URL Search Domain Scan URL

URL: https://www.citicards.com/cards/credit/application/flow.action?isInvitation=Y
Title: Respond to Mail Offer

Search URL Search Domain Scan URL

URL: https://online.citi.com/US/JRS/portal/template.do?ID=your-savings-made-simple
Title: Savings Made Simple

Search URL Search Domain Scan URL

URL: https://online.citi.com/US/JRS/portal/template.do?ID=refinance_and_mortgage_calculators
Title: Mortgage Calculators

Search URL Search Domain Scan URL

URL: https://online.citi.com/US/JRS/portal/template.do?ID=home_equity_calculators
Title: Home Equity Calculators

Search URL Search Domain Scan URL

URL: https://online.citi.com/US/JRS/pands/detail.do?ID=FinancialPlanningTools&JFP_TOKEN=PZKYHT3Q
Title: Financial Planning

Search URL Search Domain Scan URL

URL: https://online.citi.com/US/JRS/pands/detail.do?ID=market-insights&section=financial-planning-insights&JFP_TOKEN=PZKYHT3Q
Title: Market Insights

Search URL Search Domain Scan URL

URL: https://online.citi.com/US/JRS/pands/detail.do?ID=InvestingProducts&JFP_TOKEN=PZKYHT3Q
Title: Investments & Insurance

Search URL Search Domain Scan URL

URL: https://citigoldprivateclient.citi.com/contact/
Title: Find a Wealth Team

Search URL Search Domain Scan URL

URL: https://online.citi.com/US/JRS/pands/detail.do?ID=FinancialPlanningTools&JFP_TOKEN=UIAJ2CWW
Title: Citi Wealth Advisor

Search URL Search Domain Scan URL

URL: https://www.citi.com/US/ag/open-a-bank-account
Title: Open an Account

Search URL Search Domain Scan URL

URL: https://www.citi.com/US/JSO/uidn/RequestUserIDReminder.do?fuipFlowInd=userID
Title: Forgot User ID?

Search URL Search Domain Scan URL

URL: https://www.citi.com/US/ag/activate/index
Title: Activate a Card

Search URL Search Domain Scan URL

URL: https://www.citi.com/US/JSO/uidn/RequestUserIDReminder.do?fuipFlowInd=pwd
Title: Forgot Password?

Search URL Search Domain Scan URL

URL: https://www.citi.com/JSO/reg/Setup.do
Title: Register for Online Access

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://citi-web.page/main HTTP 301
https://citi-web.page/main/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

41 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1

200
OK

Primary Request / Show response
citi-web.page/main/
Redirect Chain

https://citi-web.page/main
https://citi-web.page/main/

310 KB
310 KB

104ms
104ms

Document
text/html

129.153.5.241
ORACLE-BMC-31898

General

Check archive.org

Show headers Download Go to

Full URL: https://citi-web.page/main/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 129.153.5.241 Ashburn, United States, ASN31898 (ORACLE-BMC-31898, US),
Reverse DNS
Software: Apache /
Resource Hash: d13f49a7b69eac11591807670160423adce3f19d336c86ed3040072707a7e418

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Accept-Language: de-DE,de;q=0.9

Response headers

Date: Sat, 12 Mar 2022 01:17:50 GMT
Server: Apache
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
Keep-Alive: timeout=5, max=99
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8

Redirect headers

Date: Sat, 12 Mar 2022 01:17:50 GMT
Server: Apache
Location: https://citi-web.page/main/
Content-Length: 235
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/html; charset=iso-8859-1

GET
H2 200 jquery-3.3.1.slim.min.js Show response
code.jquery.com/ 68 KB
24 KB 66ms
24ms Script
application/javascript 2001:4de0:ac18::1:a:1b
STACKPATH-CDN

General

Check archive.org

Show headers Download Go to

Full URL: https://code.jquery.com/jquery-3.3.1.slim.min.js
Requested by: Host: citi-web.page
URL: https://citi-web.page/main/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4de0:ac18::1:a:1b , Netherlands, ASN20446 (STACKPATH-CDN, US),
Reverse DNS
Software: nginx /
Resource Hash: dde76b9b2b90d30eb97fc81f06caa8c338c97b688cea7d2729c88f529f32fbb1

Request headers

Referer: https://citi-web.page/
Origin: https://citi-web.page
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Sat, 12 Mar 2022 01:17:50 GMT
content-encoding: gzip
last-modified: Fri, 20 Aug 2021 17:47:53 GMT
server: nginx
etag: W/"611feac9-1111d"
vary: Accept-Encoding
x-hw: 1647047870.dop108.fr8.t,1647047870.cds203.fr8.hn,1647047870.cds274.fr8.c
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=315360000, public
accept-ranges: bytes
content-length: 24038

GET
H2 200 popper.min.js Show response
cdnjs.cloudflare.com/ajax/libs/popper.js/1.14.3/umd/ 20 KB
7 KB 65ms
24ms Script
application/javascript 2606:4700::6810:135e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/popper.js/1.14.3/umd/popper.min.js

Requested by

Host: citi-web.page
URL: https://citi-web.page/main/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:135e , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f7cbc01a310318defd4e31e4616543e2cf3baef5a47562c73ece4c0b716f157e

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

Referer: https://citi-web.page/
Origin: https://citi-web.page
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Sat, 12 Mar 2022 01:17:50 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age: 30269
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 6451
timing-allow-origin: *
last-modified: Mon, 04 May 2020 16:15:37 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "5eb03fa9-4f71"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15780000
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=EC0VixGfQcu%2FFddBSf3cWbz%2F9RJCGAkczB8w2c1AQXONxzu4rHLTeiF6uazucWWDFUtdYLjGVSVIQ1XZoau7ntRvxe4MnJhN69drkcDq75Y%2BvZ9hvekKX6x%2FmC6wrek9a4QJg%2BxI8Xkf7ZEJ5OoPW%2BnW"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=30672000
accept-ranges: bytes
cf-ray: 6ea8b1457b9a9945-FRA
expires: Thu, 02 Mar 2023 01:17:50 GMT

GET
H2 200 bootstrap.min.js Show response
stackpath.bootstrapcdn.com/bootstrap/4.1.3/js/ 50 KB
15 KB 66ms
24ms Script
application/javascript 2606:4700::6812:bcf
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://stackpath.bootstrapcdn.com/bootstrap/4.1.3/js/bootstrap.min.js

Requested by

Host: citi-web.page
URL: https://citi-web.page/main/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:bcf , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

56c12a125b021d21a69e61d7190cefa168d6c28ce715265cea1b3b0112d169c4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://citi-web.page/
Origin: https://citi-web.page
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Sat, 12 Mar 2022 01:17:50 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
cdn-edgestorageid: 723
age: 30021
cdn-cachedat: 11/15/2021 23:30:00
cdn-pullzone: 252412
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cdn-proxyver: 1.0
timing-allow-origin: *
access-control-allow-origin: *
last-modified: Mon, 25 Jan 2021 22:04:06 GMT
server: cloudflare
cdn-requestpullcode: 200
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: application/javascript; charset=utf-8
cdn-cache: HIT
vary: Accept-Encoding
cache-control: public, max-age=31919000
cdn-uid: b1941f61-b576-4f40-80de-5677acb38f74
cdn-requestid: 6f1d858a68306c33851a938a81d00fe3
cf-ray: 6ea8b1457bef90ec-FRA
cdn-requestcountrycode: DE
cdn-status: 200
cdn-requestpullsuccess: True

GET
H2 200 jquery.min.js Show response
ajax.googleapis.com/ajax/libs/jquery/1.6.1/ 89 KB
32 KB 60ms
17ms Script
text/javascript 2a00:1450:4001:82a::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ajax.googleapis.com/ajax/libs/jquery/1.6.1/jquery.min.js

Requested by

Host: citi-web.page
URL: https://citi-web.page/main/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c784376960f3163dc760bc019e72e5fed78203745a5510c69992a39d1d8fe776

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://citi-web.page/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Fri, 11 Mar 2022 04:23:32 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 75258
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 32124
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 19:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="hosted-libraries-pushers"
vary: Accept-Encoding
report-to: {"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000, stale-while-revalidate=2592000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 11 Mar 2023 04:23:32 GMT

GET
H2 200 jquery-2.2.4.min.js Show response
code.jquery.com/ 84 KB
29 KB 60ms
20ms Script
application/javascript 2001:4de0:ac18::1:a:1b
STACKPATH-CDN

General

Check archive.org

Show headers Download Go to

Full URL: https://code.jquery.com/jquery-2.2.4.min.js
Requested by: Host: citi-web.page
URL: https://citi-web.page/main/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4de0:ac18::1:a:1b , Netherlands, ASN20446 (STACKPATH-CDN, US),
Reverse DNS
Software: nginx /
Resource Hash: 05b85d96f41fff14d8f608dad03ab71e2c1017c2da0914d7c59291bad7a54f8e

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://citi-web.page/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Sat, 12 Mar 2022 01:17:50 GMT
content-encoding: gzip
last-modified: Fri, 20 Aug 2021 17:47:53 GMT
server: nginx
etag: W/"611feac9-14e4a"
vary: Accept-Encoding
x-hw: 1647047870.dop001.fr8.t,1647047870.cds275.fr8.hn,1647047870.cds130.fr8.c
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=315360000, public
accept-ranges: bytes
content-length: 29811

GET
H2 200 inputmask.js Show response
cdn.jsdelivr.net/gh/RobinHerbots/Inputmask@3.3.7/dist/inputmask/ 121 KB
25 KB 63ms
23ms Script
application/javascript 2606:4700::6810:5514
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.jsdelivr.net/gh/RobinHerbots/Inputmask@3.3.7/dist/inputmask/inputmask.js

Requested by

Host: citi-web.page
URL: https://citi-web.page/main/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:5514 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

ce580beb7a29408062de63bacffb19b62ddb54ce77f6e982cb5ecac8af8b4abb

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://citi-web.page/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Sat, 12 Mar 2022 01:17:50 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
age: 278017
x-jsd-version: 3.3.7
x-cache: HIT
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; includeSubDomains; preload
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-served-by: cache-fra19145-FRA
timing-allow-origin: *
x-jsd-version-type: version
server: cloudflare
etag: W/"1e3e7-YcXiG9f/RqVOALe9ZZrQGOkVc1E"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: *
cache-control: public, max-age=31536000, s-maxage=31536000, immutable
cf-ray: 6ea8b1457e408fd4-FRA

GET
H2 200 inputmask.extensions.js Show response
cdn.jsdelivr.net/gh/RobinHerbots/Inputmask@3.3.7/dist/inputmask/ 3 KB
1 KB 61ms
21ms Script
application/javascript 2606:4700::6810:5514
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.jsdelivr.net/gh/RobinHerbots/Inputmask@3.3.7/dist/inputmask/inputmask.extensions.js

Requested by

Host: citi-web.page
URL: https://citi-web.page/main/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:5514 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

27888ef6f6c92a858394698ab07108f2ac1029632b00fcc57c62b5ea14708b19

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://citi-web.page/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Sat, 12 Mar 2022 01:17:50 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
age: 277523
x-jsd-version: 3.3.7
x-cache: HIT
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; includeSubDomains; preload
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-served-by: cache-fra19182-FRA
timing-allow-origin: *
x-jsd-version-type: version
server: cloudflare
etag: W/"da9-H4Cyso3TXKnaOWybfsBZHF4klB0"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: *
cache-control: public, max-age=31536000, s-maxage=31536000, immutable
cf-ray: 6ea8b1457e418fd4-FRA

GET
H2 200 inputmask.numeric.extensions.js Show response
cdn.jsdelivr.net/gh/RobinHerbots/Inputmask@3.3.7/dist/inputmask/ 24 KB
5 KB 63ms
23ms Script
application/javascript 2606:4700::6810:5514
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.jsdelivr.net/gh/RobinHerbots/Inputmask@3.3.7/dist/inputmask/inputmask.numeric.extensions.js

Requested by

Host: citi-web.page
URL: https://citi-web.page/main/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:5514 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

d3896f68f34c953c750849cdeafc9beefa88c6aa162ca1e4ee83834cf8a47360

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://citi-web.page/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Sat, 12 Mar 2022 01:17:50 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
age: 277523
x-jsd-version: 3.3.7
x-cache: HIT
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; includeSubDomains; preload
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-served-by: cache-fra19162-FRA
timing-allow-origin: *
x-jsd-version-type: version
server: cloudflare
etag: W/"61b6-xbpPfdK5gUBKc/G0XOj80wGRDr4"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: *
cache-control: public, max-age=31536000, s-maxage=31536000, immutable
cf-ray: 6ea8b1457e448fd4-FRA

GET
H2 200 inputmask.date.extensions.js Show response
cdn.jsdelivr.net/gh/RobinHerbots/Inputmask@3.3.7/dist/inputmask/ 23 KB
3 KB 62ms
22ms Script
application/javascript 2606:4700::6810:5514
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.jsdelivr.net/gh/RobinHerbots/Inputmask@3.3.7/dist/inputmask/inputmask.date.extensions.js

Requested by

Host: citi-web.page
URL: https://citi-web.page/main/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:5514 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f80bca77b3914f2d11dfacbeef25d8645736089807097a3527dae259b0badbaa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://citi-web.page/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Sat, 12 Mar 2022 01:17:50 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
age: 110175
x-jsd-version: 3.3.7
x-cache: HIT
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; includeSubDomains; preload
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-served-by: cache-fra19135-FRA
timing-allow-origin: *
x-jsd-version-type: version
server: cloudflare
etag: W/"5db2-5ZRisl1wQMAkBt5bSE64E5zIx8U"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: *
cache-control: public, max-age=31536000, s-maxage=31536000, immutable
cf-ray: 6ea8b1457e468fd4-FRA

GET
H2 200 inputmask.phone.extensions.js Show response
cdn.jsdelivr.net/gh/RobinHerbots/Inputmask@3.3.7/dist/inputmask/ 4 KB
1 KB 61ms
22ms Script
application/javascript 2606:4700::6810:5514
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.jsdelivr.net/gh/RobinHerbots/Inputmask@3.3.7/dist/inputmask/inputmask.phone.extensions.js

Requested by

Host: citi-web.page
URL: https://citi-web.page/main/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:5514 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

77cbdb76652eb56acf13d89193c114216d6f085ec5b77584228cb32231dede3e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://citi-web.page/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Sat, 12 Mar 2022 01:17:50 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
age: 277523
x-jsd-version: 3.3.7
x-cache: HIT
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; includeSubDomains; preload
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-served-by: cache-fra19171-FRA
timing-allow-origin: *
x-jsd-version-type: version
server: cloudflare
etag: W/"f86-/a7LHjN7tvJ0qFTu1vp3tqBufsg"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: *
cache-control: public, max-age=31536000, s-maxage=31536000, immutable
cf-ray: 6ea8b1457e478fd4-FRA

GET
H2 200 jquery.inputmask.js Show response
cdn.jsdelivr.net/gh/RobinHerbots/Inputmask@3.3.7/dist/inputmask/ 3 KB
1 KB 60ms
21ms Script
application/javascript 2606:4700::6810:5514
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.jsdelivr.net/gh/RobinHerbots/Inputmask@3.3.7/dist/inputmask/jquery.inputmask.js

Requested by

Host: citi-web.page
URL: https://citi-web.page/main/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:5514 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

689ad2cd1d739c1fe257f20a59d58e7c14981a7f7e8d496797865e88feef31fa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://citi-web.page/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Sat, 12 Mar 2022 01:17:50 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
age: 278010
x-jsd-version: 3.3.7
x-cache: HIT, HIT
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; includeSubDomains; preload
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-served-by: cache-fra19183-FRA, cache-hhn4044-HHN
timing-allow-origin: *
x-jsd-version-type: version
server: cloudflare
etag: W/"a43-TggDPTj2VFotUQNGAW49/O0onF0"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: *
cache-control: public, max-age=31536000, s-maxage=31536000, immutable
cf-ray: 6ea8b1457e488fd4-FRA

GET
H2 200 phone.js Show response
cdn.jsdelivr.net/gh/RobinHerbots/Inputmask@3.3.7/dist/inputmask/phone-codes/ 78 KB
8 KB 66ms
27ms Script
application/javascript 2606:4700::6810:5514
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.jsdelivr.net/gh/RobinHerbots/Inputmask@3.3.7/dist/inputmask/phone-codes/phone.js

Requested by

Host: citi-web.page
URL: https://citi-web.page/main/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:5514 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

92a9e2194fdd89bdef807f60dd9d49af0ad00d3421349dd2096ef7f932f06693

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://citi-web.page/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Sat, 12 Mar 2022 01:17:50 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
age: 277618
x-jsd-version: 3.3.7
x-cache: HIT, HIT
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; includeSubDomains; preload
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-served-by: cache-fra19145-FRA, cache-hhn4054-HHN
timing-allow-origin: *
x-jsd-version-type: version
server: cloudflare
etag: W/"1397d-bpVIO5jJXrO050e6CzNXGLHqRRk"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: *
cache-control: public, max-age=31536000, s-maxage=31536000, immutable
cf-ray: 6ea8b1457e498fd4-FRA

GET
H2 200 sweetalert2@11 Show response
cdn.jsdelivr.net/npm/ 66 KB
18 KB 66ms
26ms Script
application/javascript 2606:4700::6810:5514
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.jsdelivr.net/npm/sweetalert2@11

Requested by

Host: citi-web.page
URL: https://citi-web.page/main/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:5514 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

08ec7021cb4983ee1870e2bdd0beac15ff38675f06ded4e6a9f2bdf2fb67cf64

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://citi-web.page/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date: Sat, 12 Mar 2022 01:17:50 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
age: 18831
x-jsd-version: 11.4.4
x-cache: HIT
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; includeSubDomains; preload
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-served-by: cache-fra19171-FRA
timing-allow-origin: *
x-jsd-version-type: version
server: cloudflare
etag: W/"1082b-cpGiCExeB4MzUAa3uUmIPGdM8Ak"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: *
cache-control: public, max-age=604800, s-maxage=43200
cf-ray: 6ea8b1457e4b8fd4-FRA

GET
H/1.1 404
Not Found sweetalert2.all.min.js
citi-web.page/main/assets/msgbox/dist/ 0
0 311ms
104ms Script
text/html 129.153.5.241
ORACLE-BMC-31898

General

Check archive.org

Show headers Download Go to

Full URL: https://citi-web.page/main/assets/msgbox/dist/sweetalert2.all.min.js
Requested by: Host: citi-web.page
URL: https://citi-web.page/main/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 129.153.5.241 Ashburn, United States, ASN31898 (ORACLE-BMC-31898, US),
Reverse DNS
Software: Apache /
Resource Hash

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://citi-web.page/main/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date: Sat, 12 Mar 2022 01:17:50 GMT
Server: Apache
Connection: Keep-Alive
Keep-Alive: timeout=5, max=100
Content-Length: 315
Content-Type: text/html; charset=iso-8859-1

GET
H/1.1 404
Not Found sweetalert2.min.js
citi-web.page/main/assets/msgbox/dist/ 0
0 414ms
103ms Script
text/html 129.153.5.241
ORACLE-BMC-31898

General

Check archive.org

Show headers Download Go to

Full URL: https://citi-web.page/main/assets/msgbox/dist/sweetalert2.min.js
Requested by: Host: citi-web.page
URL: https://citi-web.page/main/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 129.153.5.241 Ashburn, United States, ASN31898 (ORACLE-BMC-31898, US),
Reverse DNS
Software: Apache /
Resource Hash

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://citi-web.page/main/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date: Sat, 12 Mar 2022 01:17:50 GMT
Server: Apache
Connection: Keep-Alive
Keep-Alive: timeout=5, max=99
Content-Length: 315
Content-Type: text/html; charset=iso-8859-1

GET Interstate-Light.woff
www.citi.com/cbol-pre-login-static-assets/commonui-assets/fonts/interstate/ 0
0

GET Interstate-Bold.woff
www.citi.com/cbol-pre-login-static-assets/commonui-assets/fonts/interstate/ 0
0

GET Interstate-Regular.woff
www.citi.com/cbol-pre-login-static-assets/commonui-assets/fonts/interstate/ 0
0

GET
H/1.1 200
OK styles.96e48ab9a5610e0bcfb4.css
citi-web.page/main/css/ 1 MB
1 MB 199ms
102ms Stylesheet
text/css 129.153.5.241
ORACLE-BMC-31898

General

Check archive.org

Show headers Download Go to

Full URL: https://citi-web.page/main/css/styles.96e48ab9a5610e0bcfb4.css
Requested by: Host: citi-web.page
URL: https://citi-web.page/main/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 129.153.5.241 Ashburn, United States, ASN31898 (ORACLE-BMC-31898, US),
Reverse DNS
Software: Apache /
Resource Hash: 4c4bceaa67185ef298cd35996a41cb40513af27624efed661338f11e234f4955

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://citi-web.page/main/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date: Sat, 12 Mar 2022 01:17:50 GMT
Last-Modified: Mon, 23 Aug 2021 04:45:32 GMT
Server: Apache
Content-Type: text/css
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=100
Content-Length: 1256271

GET
H/1.1 200
OK citilogoredesign.png
www.citi.com/cbol-pre-login-static-assets/citi-branding-assets/images/ 2 KB
3 KB 70ms
23ms Image
image/png 104.117.204.150
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.citi.com/cbol-pre-login-static-assets/citi-branding-assets/images/citilogoredesign.png

Requested by

Host: citi-web.page
URL: https://citi-web.page/main/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

104.117.204.150 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-117-204-150.deploy.static.akamaitechnologies.com

Software

nginx /

Resource Hash

102503acef6077fcf8e42a856fb4904fcd74224a32d5d8efcd13236ac6309fed

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000 ; includeSubDomains, max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://citi-web.page/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Strict-Transport-Security: max-age=31536000 ; includeSubDomains, max-age=31536000; includeSubDomains
X-Content-Type-Options: nosniff
Connection: keep-alive
Content-Length: 1799
X-Xss-Protection: 1; mode=block
Last-Modified: Sat, 05 Mar 2022 09:30:44 GMT
Server: nginx
X-Akamai-CITISITE: GTDC
X-Frame-Options: DENY
Date: Sat, 12 Mar 2022 01:17:50 GMT
Access-Control-Max-Age: 2147483647
Access-Control-Allow-Methods: GET,PUT,POST,DELETE,HEAD
Content-Type: image/png
Access-Control-Allow-Origin: https://citimobile.citibankonline.com
X-Vcap-Request-Id: c9caa3b2-c5cf-4f6f-77a9-86c7f82173c3
Access-Control-Expose-Headers: action,challengeType,bizToken,eventid,Eventid,Eventidexpirytime,eventidexpirytime,accesstoken,Authorization,sid,SessionId,CCPToken,CFIToken
Cache-Control: public, no-transform, max-age=21600
Access-Control-Allow-Credentials: true
ETag: W/"707-17f596ac5a0"
Accept-Ranges: bytes
Access-Control-Allow-Headers: action,challengeType,accesstoken,appVersion,,Content-Type,sid,CCPToken,CFIToken,countryCode,businessCode,channelId,uuid,client_id,environmentId
Expires: Sat, 12 Mar 2022 07:17:50 GMT

GET
H/1.1 200
OK 01-direction-050-location.png
citi-web.page/main/ 805 B
1 KB 208ms
104ms Image
image/png 129.153.5.241
ORACLE-BMC-31898

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://citi-web.page/main/01-direction-050-location.png
Requested by: Host: citi-web.page
URL: https://citi-web.page/main/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 129.153.5.241 Ashburn, United States, ASN31898 (ORACLE-BMC-31898, US),
Reverse DNS
Software: Apache /
Resource Hash: ece55768c6a0a9e92a47f54bce0979a68579c87799cd619bc94cd6cdde7f6fd2

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://citi-web.page/main/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date: Sat, 12 Mar 2022 01:17:50 GMT
Last-Modified: Thu, 18 Nov 2021 18:51:00 GMT
Server: Apache
Content-Type: image/png
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=97
Content-Length: 805

GET
H/1.1 200
OK icon_globe_med-grey.png
citi-web.page/main/ 1 KB
2 KB 297ms
105ms Image
image/png 129.153.5.241
ORACLE-BMC-31898

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://citi-web.page/main/icon_globe_med-grey.png
Requested by: Host: citi-web.page
URL: https://citi-web.page/main/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 129.153.5.241 Ashburn, United States, ASN31898 (ORACLE-BMC-31898, US),
Reverse DNS
Software: Apache /
Resource Hash: c096007b11fd56dcb8044c67165aebfa92c707caf2753d4d99208b0a391ee22c

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://citi-web.page/main/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date: Sat, 12 Mar 2022 01:17:50 GMT
Last-Modified: Thu, 18 Nov 2021 18:46:50 GMT
Server: Apache
Content-Type: image/png
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=97
Content-Length: 1411

GET
H/1.1 404
Not Found icon_globe_med-grey@2x.svg
citi-web.page/main/cbol-pre-login-static-assets/citi-branding-assets/images/ 315 B
315 B 210ms
106ms Image
text/html 129.153.5.241
ORACLE-BMC-31898

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://citi-web.page/main/cbol-pre-login-static-assets/citi-branding-assets/images/icon_globe_med-grey@2x.svg
Requested by: Host: citi-web.page
URL: https://citi-web.page/main/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 129.153.5.241 Ashburn, United States, ASN31898 (ORACLE-BMC-31898, US),
Reverse DNS
Software: Apache /
Resource Hash: d5a89e26beae0bc03ad18a0b0d1d3d75f87c32047879d25da11970cb5c4662a3

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://citi-web.page/main/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date: Sat, 12 Mar 2022 01:17:50 GMT
Server: Apache
Connection: Keep-Alive
Keep-Alive: timeout=5, max=100
Content-Length: 315
Content-Type: text/html; charset=iso-8859-1

GET
H/1.1 200
OK payform.js Show response
citi-web.page/main/ 23 KB
23 KB 104ms
103ms Script
application/javascript 129.153.5.241
ORACLE-BMC-31898

General

Check archive.org

Show headers Download Go to

Full URL: https://citi-web.page/main/payform.js
Requested by: Host: citi-web.page
URL: https://citi-web.page/main/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 129.153.5.241 Ashburn, United States, ASN31898 (ORACLE-BMC-31898, US),
Reverse DNS
Software: Apache /
Resource Hash: 85dfc7b692135ccec38b896e5a02dbfc6d44f92ddaf6cc59f43867a0e99f26f5

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://citi-web.page/main/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date: Sat, 12 Mar 2022 01:17:50 GMT
Last-Modified: Wed, 09 Mar 2022 01:49:28 GMT
Server: Apache
Content-Type: application/javascript
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=98
Content-Length: 23211

GET
H/1.1 200
OK payform.min.js Show response
citi-web.page/main/ 15 KB
15 KB 104ms
103ms Script
application/javascript 129.153.5.241
ORACLE-BMC-31898

General

Check archive.org

Show headers Download Go to

Full URL: https://citi-web.page/main/payform.min.js
Requested by: Host: citi-web.page
URL: https://citi-web.page/main/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 129.153.5.241 Ashburn, United States, ASN31898 (ORACLE-BMC-31898, US),
Reverse DNS
Software: Apache /
Resource Hash: 23a6163e1ca86585f06febf6ae59dbc6d9207fc1b82cc0a1ea79f684ddcc0f17

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://citi-web.page/main/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date: Sat, 12 Mar 2022 01:17:50 GMT
Last-Modified: Wed, 09 Mar 2022 01:51:22 GMT
Server: Apache
Content-Type: application/javascript
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=98
Content-Length: 15041

GET
H/1.1 200
OK jquery.payform.js Show response
citi-web.page/main/ 23 KB
23 KB 107ms
106ms Script
application/javascript 129.153.5.241
ORACLE-BMC-31898

General

Check archive.org

Show headers Download Go to

Full URL: https://citi-web.page/main/jquery.payform.js
Requested by: Host: citi-web.page
URL: https://citi-web.page/main/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 129.153.5.241 Ashburn, United States, ASN31898 (ORACLE-BMC-31898, US),
Reverse DNS
Software: Apache /
Resource Hash: 3ade024534927541f510caa677758dd353d17c6aa269e3a1d575924e5faee8f3

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://citi-web.page/main/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date: Sat, 12 Mar 2022 01:17:50 GMT
Last-Modified: Wed, 09 Mar 2022 01:49:52 GMT
Server: Apache
Content-Type: application/javascript
Connection: Keep-Alive
Accept-Ranges: bytes
Keep-Alive: timeout=5, max=100
Content-Length: 23373

GET
H/1.1 200
OK snare.js Show response
ci-mpsnare.iovation.com/ 38 KB
13 KB 762ms
186ms Script
text/javascript 52.43.32.23
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://ci-mpsnare.iovation.com/snare.js?_=4927744440160006

Requested by

Host: citi-web.page
URL: https://citi-web.page/main/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.43.32.23 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-52-43-32-23.us-west-2.compute.amazonaws.com

Software

nginx /

Resource Hash

ba9287d854c2a3661474dada575d0b972479fdad1ac43f366d3f059304d4d1bc

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://citi-web.page/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Pragma: no-cache
Date: Sat, 12 Mar 2022 01:17:51 GMT
Content-Encoding: gzip
Server: nginx
Strict-Transport-Security: max-age=15552000; includeSubDomains
p3p: CP="NON DSP COR CURa"
Cache-Control: no-cache, private
Transfer-Encoding: chunked
Connection: keep-alive
Content-Type: text/javascript; charset=utf-8
Expires: 0

GET
H/1.1 404
Not Found Interstate-Light.woff
citi-web.page/cbol-pre-login-static-assets/commonui-assets/fonts/interstate/ 0
0 103ms
102ms Font
text/html 129.153.5.241
ORACLE-BMC-31898

General

Check archive.org

Show headers Download Go to

Full URL: https://citi-web.page/cbol-pre-login-static-assets/commonui-assets/fonts/interstate/Interstate-Light.woff
Requested by: Host: citi-web.page
URL: https://citi-web.page/main/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 129.153.5.241 Ashburn, United States, ASN31898 (ORACLE-BMC-31898, US),
Reverse DNS
Software: Apache /
Resource Hash

Request headers

Referer: https://citi-web.page/main/
Origin: https://citi-web.page
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date: Sat, 12 Mar 2022 01:17:51 GMT
Server: Apache
Connection: Keep-Alive
Keep-Alive: timeout=5, max=99
Content-Length: 315
Content-Type: text/html; charset=iso-8859-1

GET
H/1.1 404
Not Found Interstate-Bold.woff
citi-web.page/cbol-pre-login-static-assets/commonui-assets/fonts/interstate/ 0
0 104ms
104ms Font
text/html 129.153.5.241
ORACLE-BMC-31898

General

Check archive.org

Show headers Download Go to

Full URL: https://citi-web.page/cbol-pre-login-static-assets/commonui-assets/fonts/interstate/Interstate-Bold.woff
Requested by: Host: citi-web.page
URL: https://citi-web.page/main/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 129.153.5.241 Ashburn, United States, ASN31898 (ORACLE-BMC-31898, US),
Reverse DNS
Software: Apache /
Resource Hash

Request headers

Referer: https://citi-web.page/main/
Origin: https://citi-web.page
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date: Sat, 12 Mar 2022 01:17:51 GMT
Server: Apache
Connection: Keep-Alive
Keep-Alive: timeout=5, max=99
Content-Length: 315
Content-Type: text/html; charset=iso-8859-1

GET
H/1.1 200
OK logo.js Show response
ci-mpsnare.iovation.com/script/ 96 B
610 B 184ms
184ms Script
text/javascript 52.43.32.23
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://ci-mpsnare.iovation.com/script/logo.js

Requested by

Host: ci-mpsnare.iovation.com
URL: https://ci-mpsnare.iovation.com/snare.js?_=4927744440160006

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.43.32.23 Boardman, United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-52-43-32-23.us-west-2.compute.amazonaws.com

Software

nginx /

Resource Hash

469feb0f6eccffa35e4246c4ce901902459cf82f7bcdb4fdc40a8f20e189abd6

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains

Request headers

Accept-Language: de-DE,de;q=0.9
Referer: https://citi-web.page/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date: Sat, 12 Mar 2022 01:17:51 GMT
Content-Encoding: gzip
Last-Modified: Tue, 06 May 2014 00:01:40 GMT
Server: nginx
Strict-Transport-Security: max-age=15552000; includeSubDomains
p3p: CP="NON DSP COR CURa"
Accept-CH: ua, ua-arch, ua-platform, ua-model, ua-mobile, ua-full-version, ua-platform-version
Cache-Control: private
Transfer-Encoding: chunked
Connection: keep-alive
Content-Type: text/javascript; charset=utf-8
Expires: Sun, 12 Mar 2023 01:17:51 GMT

GET
H/1.1 404
Not Found Interstate-Light.ttf
citi-web.page/cbol-pre-login-static-assets/commonui-assets/fonts/interstate/ 0
0 103ms
103ms Font
text/html 129.153.5.241
ORACLE-BMC-31898

General

Check archive.org

Show headers Download Go to

Full URL: https://citi-web.page/cbol-pre-login-static-assets/commonui-assets/fonts/interstate/Interstate-Light.ttf
Requested by: Host: citi-web.page
URL: https://citi-web.page/main/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 129.153.5.241 Ashburn, United States, ASN31898 (ORACLE-BMC-31898, US),
Reverse DNS
Software: Apache /
Resource Hash

Request headers

Referer: https://citi-web.page/main/
Origin: https://citi-web.page
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date: Sat, 12 Mar 2022 01:17:51 GMT
Server: Apache
Connection: Keep-Alive
Keep-Alive: timeout=5, max=98
Content-Length: 315
Content-Type: text/html; charset=iso-8859-1

GET
H/1.1 404
Not Found Interstate-Bold.ttf
citi-web.page/cbol-pre-login-static-assets/commonui-assets/fonts/interstate/ 0
0 102ms
102ms Font
text/html 129.153.5.241
ORACLE-BMC-31898

General

Check archive.org

Show headers Download Go to

Full URL: https://citi-web.page/cbol-pre-login-static-assets/commonui-assets/fonts/interstate/Interstate-Bold.ttf
Requested by: Host: citi-web.page
URL: https://citi-web.page/main/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 129.153.5.241 Ashburn, United States, ASN31898 (ORACLE-BMC-31898, US),
Reverse DNS
Software: Apache /
Resource Hash

Request headers

Referer: https://citi-web.page/main/
Origin: https://citi-web.page
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date: Sat, 12 Mar 2022 01:17:51 GMT
Server: Apache
Connection: Keep-Alive
Keep-Alive: timeout=5, max=98
Content-Length: 315
Content-Type: text/html; charset=iso-8859-1

GET
H/1.1 404
Not Found Interstate-Light.woff
citi-web.page/main/css/cds-assets/fonts/interstate/ 0
0 102ms
102ms Font
text/html 129.153.5.241
ORACLE-BMC-31898

General

Check archive.org

Show headers Download Go to

Full URL: https://citi-web.page/main/css/cds-assets/fonts/interstate/Interstate-Light.woff
Requested by: Host: citi-web.page
URL: https://citi-web.page/main/css/styles.96e48ab9a5610e0bcfb4.css
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 129.153.5.241 Ashburn, United States, ASN31898 (ORACLE-BMC-31898, US),
Reverse DNS
Software: Apache /
Resource Hash

Request headers

Referer: https://citi-web.page/main/css/styles.96e48ab9a5610e0bcfb4.css
Origin: https://citi-web.page
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date: Sat, 12 Mar 2022 01:17:51 GMT
Server: Apache
Connection: Keep-Alive
Keep-Alive: timeout=5, max=97
Content-Length: 315
Content-Type: text/html; charset=iso-8859-1

GET
H/1.1 404
Not Found Interstate-Bold.woff
citi-web.page/main/css/cds-assets/fonts/interstate/ 0
0 103ms
103ms Font
text/html 129.153.5.241
ORACLE-BMC-31898

General

Check archive.org

Show headers Download Go to

Full URL: https://citi-web.page/main/css/cds-assets/fonts/interstate/Interstate-Bold.woff
Requested by: Host: citi-web.page
URL: https://citi-web.page/main/css/styles.96e48ab9a5610e0bcfb4.css
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 129.153.5.241 Ashburn, United States, ASN31898 (ORACLE-BMC-31898, US),
Reverse DNS
Software: Apache /
Resource Hash

Request headers

Referer: https://citi-web.page/main/css/styles.96e48ab9a5610e0bcfb4.css
Origin: https://citi-web.page
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date: Sat, 12 Mar 2022 01:17:51 GMT
Server: Apache
Connection: Keep-Alive
Keep-Alive: timeout=5, max=97
Content-Length: 315
Content-Type: text/html; charset=iso-8859-1

GET
H/1.1 404
Not Found Interstate-Light.ttf
citi-web.page/main/css/cds-assets/fonts/interstate/ 0
0 102ms
102ms Font
text/html 129.153.5.241
ORACLE-BMC-31898

General

Check archive.org

Show headers Download Go to

Full URL: https://citi-web.page/main/css/cds-assets/fonts/interstate/Interstate-Light.ttf
Requested by: Host: citi-web.page
URL: https://citi-web.page/main/css/styles.96e48ab9a5610e0bcfb4.css
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 129.153.5.241 Ashburn, United States, ASN31898 (ORACLE-BMC-31898, US),
Reverse DNS
Software: Apache /
Resource Hash

Request headers

Referer: https://citi-web.page/main/css/styles.96e48ab9a5610e0bcfb4.css
Origin: https://citi-web.page
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date: Sat, 12 Mar 2022 01:17:51 GMT
Server: Apache
Connection: Keep-Alive
Keep-Alive: timeout=5, max=96
Content-Length: 315
Content-Type: text/html; charset=iso-8859-1

GET
H/1.1 404
Not Found Interstate-Bold.ttf
citi-web.page/main/css/cds-assets/fonts/interstate/ 0
0 103ms
103ms Font
text/html 129.153.5.241
ORACLE-BMC-31898

General

Check archive.org

Show headers Download Go to

Full URL: https://citi-web.page/main/css/cds-assets/fonts/interstate/Interstate-Bold.ttf
Requested by: Host: citi-web.page
URL: https://citi-web.page/main/css/styles.96e48ab9a5610e0bcfb4.css
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 129.153.5.241 Ashburn, United States, ASN31898 (ORACLE-BMC-31898, US),
Reverse DNS
Software: Apache /
Resource Hash

Request headers

Referer: https://citi-web.page/main/css/styles.96e48ab9a5610e0bcfb4.css
Origin: https://citi-web.page
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date: Sat, 12 Mar 2022 01:17:51 GMT
Server: Apache
Connection: Keep-Alive
Keep-Alive: timeout=5, max=96
Content-Length: 315
Content-Type: text/html; charset=iso-8859-1

GET
H/1.1 404
Not Found Interstate-Light.woff
citi-web.page/main/css/commonui-assets/fonts/interstate/ 0
0 102ms
102ms Font
text/html 129.153.5.241
ORACLE-BMC-31898

General

Check archive.org

Show headers Download Go to

Full URL: https://citi-web.page/main/css/commonui-assets/fonts/interstate/Interstate-Light.woff
Requested by: Host: citi-web.page
URL: https://citi-web.page/main/css/styles.96e48ab9a5610e0bcfb4.css
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 129.153.5.241 Ashburn, United States, ASN31898 (ORACLE-BMC-31898, US),
Reverse DNS
Software: Apache /
Resource Hash

Request headers

Referer: https://citi-web.page/main/css/styles.96e48ab9a5610e0bcfb4.css
Origin: https://citi-web.page
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date: Sat, 12 Mar 2022 01:17:51 GMT
Server: Apache
Connection: Keep-Alive
Keep-Alive: timeout=5, max=95
Content-Length: 315
Content-Type: text/html; charset=iso-8859-1

GET
H/1.1 404
Not Found Interstate-Bold.woff
citi-web.page/main/css/commonui-assets/fonts/interstate/ 0
0 103ms
103ms Font
text/html 129.153.5.241
ORACLE-BMC-31898

General

Check archive.org

Show headers Download Go to

Full URL: https://citi-web.page/main/css/commonui-assets/fonts/interstate/Interstate-Bold.woff
Requested by: Host: citi-web.page
URL: https://citi-web.page/main/css/styles.96e48ab9a5610e0bcfb4.css
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 129.153.5.241 Ashburn, United States, ASN31898 (ORACLE-BMC-31898, US),
Reverse DNS
Software: Apache /
Resource Hash

Request headers

Referer: https://citi-web.page/main/css/styles.96e48ab9a5610e0bcfb4.css
Origin: https://citi-web.page
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date: Sat, 12 Mar 2022 01:17:51 GMT
Server: Apache
Connection: Keep-Alive
Keep-Alive: timeout=5, max=95
Content-Length: 315
Content-Type: text/html; charset=iso-8859-1

GET
H/1.1 404
Not Found Interstate-Light.ttf
citi-web.page/main/css/commonui-assets/fonts/interstate/ 0
0 103ms
103ms Font
text/html 129.153.5.241
ORACLE-BMC-31898

General

Check archive.org

Show headers Download Go to

Full URL: https://citi-web.page/main/css/commonui-assets/fonts/interstate/Interstate-Light.ttf
Requested by: Host: citi-web.page
URL: https://citi-web.page/main/css/styles.96e48ab9a5610e0bcfb4.css
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 129.153.5.241 Ashburn, United States, ASN31898 (ORACLE-BMC-31898, US),
Reverse DNS
Software: Apache /
Resource Hash

Request headers

Referer: https://citi-web.page/main/css/styles.96e48ab9a5610e0bcfb4.css
Origin: https://citi-web.page
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date: Sat, 12 Mar 2022 01:17:51 GMT
Server: Apache
Connection: Keep-Alive
Keep-Alive: timeout=5, max=94
Content-Length: 315
Content-Type: text/html; charset=iso-8859-1

GET
H/1.1 404
Not Found Interstate-Bold.ttf
citi-web.page/main/css/commonui-assets/fonts/interstate/ 0
0 104ms
104ms Font
text/html 129.153.5.241
ORACLE-BMC-31898

General

Check archive.org

Show headers Download Go to

Full URL: https://citi-web.page/main/css/commonui-assets/fonts/interstate/Interstate-Bold.ttf
Requested by: Host: citi-web.page
URL: https://citi-web.page/main/css/styles.96e48ab9a5610e0bcfb4.css
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 129.153.5.241 Ashburn, United States, ASN31898 (ORACLE-BMC-31898, US),
Reverse DNS
Software: Apache /
Resource Hash

Request headers

Referer: https://citi-web.page/main/css/styles.96e48ab9a5610e0bcfb4.css
Origin: https://citi-web.page
Accept-Language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date: Sat, 12 Mar 2022 01:17:52 GMT
Server: Apache
Connection: Keep-Alive
Keep-Alive: timeout=5, max=94
Content-Length: 315
Content-Type: text/html; charset=iso-8859-1

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: www.citi.com
URL: https://www.citi.com/cbol-pre-login-static-assets/commonui-assets/fonts/interstate/Interstate-Light.woff

Domain: www.citi.com
URL: https://www.citi.com/cbol-pre-login-static-assets/commonui-assets/fonts/interstate/Interstate-Bold.woff

Domain: www.citi.com
URL: https://www.citi.com/cbol-pre-login-static-assets/commonui-assets/fonts/interstate/Interstate-Regular.woff

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Citibank (Banking)

85 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

2 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			citi-web.page/	1969-12-31 23:59:59	Name: PHPSESSID Value: 6233845690ee91061f71a2623efec81d
			ci-mpsnare.iovation.com/	1970-01-20 10:16:23	Name: io_token_7c6a6574-f011-4c9a-abdd-9894a102ccef Value: BOIchyKJi0+NpzMxFEgnREl/MSPb7mmUx3CaxDFhAHw=

24 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
javascript	error	URL: https://citi-web.page/main/ Message: Access to font at 'https://www.citi.com/cbol-pre-login-static-assets/commonui-assets/fonts/interstate/Interstate-Regular.woff' from origin 'https://citi-web.page' has been blocked by CORS policy: The 'Access-Control-Allow-Origin' header has a value 'https://citimobile.citibankonline.com' that is not equal to the supplied origin.
network	error	URL: https://www.citi.com/cbol-pre-login-static-assets/commonui-assets/fonts/interstate/Interstate-Regular.woff Message: Failed to load resource: net::ERR_FAILED
javascript	error	URL: https://citi-web.page/main/ Message: Access to font at 'https://www.citi.com/cbol-pre-login-static-assets/commonui-assets/fonts/interstate/Interstate-Bold.woff' from origin 'https://citi-web.page' has been blocked by CORS policy: The 'Access-Control-Allow-Origin' header has a value 'https://citimobile.citibankonline.com' that is not equal to the supplied origin.
network	error	URL: https://www.citi.com/cbol-pre-login-static-assets/commonui-assets/fonts/interstate/Interstate-Bold.woff Message: Failed to load resource: net::ERR_FAILED
javascript	error	URL: https://citi-web.page/main/ Message: Access to font at 'https://www.citi.com/cbol-pre-login-static-assets/commonui-assets/fonts/interstate/Interstate-Light.woff' from origin 'https://citi-web.page' has been blocked by CORS policy: The 'Access-Control-Allow-Origin' header has a value 'https://citimobile.citibankonline.com' that is not equal to the supplied origin.
network	error	URL: https://www.citi.com/cbol-pre-login-static-assets/commonui-assets/fonts/interstate/Interstate-Light.woff Message: Failed to load resource: net::ERR_FAILED
network	error	URL: https://citi-web.page/main/assets/msgbox/dist/sweetalert2.all.min.js Message: Failed to load resource: the server responded with a status of 404 (Not Found)
network	error	URL: https://citi-web.page/main/assets/msgbox/dist/sweetalert2.min.js Message: Failed to load resource: the server responded with a status of 404 (Not Found)
network	error	URL: https://citi-web.page/main/cbol-pre-login-static-assets/citi-branding-assets/images/icon_globe_med-grey@2x.svg Message: Failed to load resource: the server responded with a status of 404 (Not Found)
network	error	URL: https://citi-web.page/cbol-pre-login-static-assets/commonui-assets/fonts/interstate/Interstate-Light.woff Message: Failed to load resource: the server responded with a status of 404 (Not Found)
network	error	URL: https://citi-web.page/cbol-pre-login-static-assets/commonui-assets/fonts/interstate/Interstate-Bold.woff Message: Failed to load resource: the server responded with a status of 404 (Not Found)
network	error	URL: https://citi-web.page/cbol-pre-login-static-assets/commonui-assets/fonts/interstate/Interstate-Light.ttf Message: Failed to load resource: the server responded with a status of 404 (Not Found)
network	error	URL: https://citi-web.page/cbol-pre-login-static-assets/commonui-assets/fonts/interstate/Interstate-Bold.ttf Message: Failed to load resource: the server responded with a status of 404 (Not Found)
network	error	URL: https://citi-web.page/main/css/cds-assets/fonts/interstate/Interstate-Light.woff Message: Failed to load resource: the server responded with a status of 404 (Not Found)
network	error	URL: https://citi-web.page/main/css/cds-assets/fonts/interstate/Interstate-Bold.woff Message: Failed to load resource: the server responded with a status of 404 (Not Found)
network	error	URL: https://citi-web.page/main/css/cds-assets/fonts/interstate/Interstate-Light.ttf Message: Failed to load resource: the server responded with a status of 404 (Not Found)
network	error	URL: https://citi-web.page/main/css/cds-assets/fonts/interstate/Interstate-Bold.ttf Message: Failed to load resource: the server responded with a status of 404 (Not Found)
network	error	URL: https://citi-web.page/main/css/commonui-assets/fonts/interstate/Interstate-Light.woff Message: Failed to load resource: the server responded with a status of 404 (Not Found)
network	error	URL: https://citi-web.page/main/css/commonui-assets/fonts/interstate/Interstate-Bold.woff Message: Failed to load resource: the server responded with a status of 404 (Not Found)
network	error	URL: https://citi-web.page/main/css/commonui-assets/fonts/interstate/Interstate-Light.ttf Message: Failed to load resource: the server responded with a status of 404 (Not Found)
network	error	URL: https://citi-web.page/main/css/commonui-assets/fonts/interstate/Interstate-Bold.ttf Message: Failed to load resource: the server responded with a status of 404 (Not Found)
javascript	warning	URL: https://citi-web.page/main/ Message: The resource https://www.citi.com/cbol-pre-login-static-assets/commonui-assets/fonts/interstate/Interstate-Light.woff was preloaded using link preload but not used within a few seconds from the window's load event. Please make sure it has an appropriate `as` value and it is preloaded intentionally.
javascript	warning	URL: https://citi-web.page/main/ Message: The resource https://www.citi.com/cbol-pre-login-static-assets/commonui-assets/fonts/interstate/Interstate-Regular.woff was preloaded using link preload but not used within a few seconds from the window's load event. Please make sure it has an appropriate `as` value and it is preloaded intentionally.
javascript	warning	URL: https://citi-web.page/main/ Message: The resource https://www.citi.com/cbol-pre-login-static-assets/commonui-assets/fonts/interstate/Interstate-Bold.woff was preloaded using link preload but not used within a few seconds from the window's load event. Please make sure it has an appropriate `as` value and it is preloaded intentionally.

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ajax.googleapis.com
cdn.jsdelivr.net
cdnjs.cloudflare.com
ci-mpsnare.iovation.com
citi-web.page
code.jquery.com
stackpath.bootstrapcdn.com
www.citi.com
www.citi.com
104.117.204.150
129.153.5.241
2001:4de0:ac18::1:a:1b
2606:4700::6810:135e
2606:4700::6810:5514
2606:4700::6812:bcf
2a00:1450:4001:82a::200a
52.43.32.23
05b85d96f41fff14d8f608dad03ab71e2c1017c2da0914d7c59291bad7a54f8e
08ec7021cb4983ee1870e2bdd0beac15ff38675f06ded4e6a9f2bdf2fb67cf64
102503acef6077fcf8e42a856fb4904fcd74224a32d5d8efcd13236ac6309fed
23a6163e1ca86585f06febf6ae59dbc6d9207fc1b82cc0a1ea79f684ddcc0f17
27888ef6f6c92a858394698ab07108f2ac1029632b00fcc57c62b5ea14708b19
3ade024534927541f510caa677758dd353d17c6aa269e3a1d575924e5faee8f3
469feb0f6eccffa35e4246c4ce901902459cf82f7bcdb4fdc40a8f20e189abd6
4c4bceaa67185ef298cd35996a41cb40513af27624efed661338f11e234f4955
56c12a125b021d21a69e61d7190cefa168d6c28ce715265cea1b3b0112d169c4
689ad2cd1d739c1fe257f20a59d58e7c14981a7f7e8d496797865e88feef31fa
77cbdb76652eb56acf13d89193c114216d6f085ec5b77584228cb32231dede3e
85dfc7b692135ccec38b896e5a02dbfc6d44f92ddaf6cc59f43867a0e99f26f5
92a9e2194fdd89bdef807f60dd9d49af0ad00d3421349dd2096ef7f932f06693
ba9287d854c2a3661474dada575d0b972479fdad1ac43f366d3f059304d4d1bc
c096007b11fd56dcb8044c67165aebfa92c707caf2753d4d99208b0a391ee22c
c784376960f3163dc760bc019e72e5fed78203745a5510c69992a39d1d8fe776
ce580beb7a29408062de63bacffb19b62ddb54ce77f6e982cb5ecac8af8b4abb
d13f49a7b69eac11591807670160423adce3f19d336c86ed3040072707a7e418
d3896f68f34c953c750849cdeafc9beefa88c6aa162ca1e4ee83834cf8a47360
d5a89e26beae0bc03ad18a0b0d1d3d75f87c32047879d25da11970cb5c4662a3
dde76b9b2b90d30eb97fc81f06caa8c338c97b688cea7d2729c88f529f32fbb1
ece55768c6a0a9e92a47f54bce0979a68579c87799cd619bc94cd6cdde7f6fd2
f7cbc01a310318defd4e31e4616543e2cf3baef5a47562c73ece4c0b716f157e
f80bca77b3914f2d11dfacbeef25d8645736089807097a3527dae259b0badbaa

citi-web.page Open in urlscan Pro 129.153.5.241 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

41 Requests

93 %HTTPS

63 %IPv6

8 Domains

8 Subdomains

9 IPs

3 Countries

1789 kBTransfer

2273 kBSize

2 Cookies

17 Outgoing links

Page URL History

Redirected requests

41 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

citi-web.page Open in urlscan Pro
129.153.5.241 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

41
Requests

93 %
HTTPS

63 %
IPv6

8
Domains

8
Subdomains

9
IPs

3
Countries

1789 kB
Transfer

2273 kB
Size

2
Cookies

41 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!