banking.citi.com Open in urlscan Pro
35.190.22.40 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://banking.citi.com/cbol/checking/tiered/default.htm
Effective URL:
https://banking.citi.com/cbol/OM/checking/tiered/featured-offers/default.htm?BT_TX=1&ProspectID=326D0D64EAD743E4BE6193A91...
Submission: On December 05 via api (December 5th 2023, 4:52:20 am UTC) from NL — Scanned from NL

Summary HTTP 157 Redirects Links 22 Behaviour Indicators

Summary

This website contacted 38 IPs in 5 countries across 26 domains to perform 157 HTTP transactions. The main IP is 35.190.22.40, located in Kansas City, United States and belongs to GOOGLE, US. The main domain is banking.citi.com. The Cisco Umbrella rank of the primary domain is 495850.
TLS certificate: Issued by DigiCert EV RSA CA G2 on December 26th 2022. Valid for: a year.

This is the only time banking.citi.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
3 27	35.190.22.40 35.190.22.40	15169 (GOOGLE) (GOOGLE)
4	2606:4700::68... 2606:4700::6813:9308	13335 (CLOUDFLAR...) (CLOUDFLARENET)
16	2600:9000:206... 2600:9000:206f:b400:2:8f43:5780:93a1	16509 (AMAZON-02) (AMAZON-02)
1 4	54.73.141.201 54.73.141.201	16509 (AMAZON-02) (AMAZON-02)
8	3.124.119.57 3.124.119.57	16509 (AMAZON-02) (AMAZON-02)
2	63.140.62.164 63.140.62.164	16509 (AMAZON-02) (AMAZON-02)
1 1	54.78.218.204 54.78.218.204	16509 (AMAZON-02) (AMAZON-02)
1	18.66.248.26 18.66.248.26	16509 (AMAZON-02) (AMAZON-02)
1	18.66.122.45 18.66.122.45	16509 (AMAZON-02) (AMAZON-02)
1	2600:9000:224... 2600:9000:224a:fa00:1:76cf:fe80:93a1	16509 (AMAZON-02) (AMAZON-02)
17	2a00:1450:400... 2a00:1450:4001:80f::2008	15169 (GOOGLE) (GOOGLE)
1	2606:4700::68... 2606:4700::6812:190d	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	54.154.232.97 54.154.232.97	16509 (AMAZON-02) (AMAZON-02)
2	193.0.160.131 193.0.160.131	54312 (ROCKETFUEL) (ROCKETFUEL)
1	66.235.152.143 66.235.152.143	16509 (AMAZON-02) (AMAZON-02)
3	34.107.138.236 34.107.138.236	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
8	104.17.209.240 104.17.209.240	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1 3	216.58.206.38 216.58.206.38	15169 (GOOGLE) (GOOGLE)
3	2a00:1288:80:... 2a00:1288:80:807::2	203220 (YAHOO-DEB) (YAHOO-DEB)
3	2620:1ec:c11:... 2620:1ec:c11::200	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1	35.244.154.8 35.244.154.8	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
1	2600:9000:224... 2600:9000:224a:e000:1d:bf0a:0:93a1	16509 (AMAZON-02) (AMAZON-02)
1	13.32.27.28 13.32.27.28	16509 (AMAZON-02) (AMAZON-02)
1 2	52.46.130.91 52.46.130.91	16509 (AMAZON-02) (AMAZON-02)
1	54.211.113.206 54.211.113.206	14618 (AMAZON-AES) (AMAZON-AES)
2 12	2a00:1450:400... 2a00:1450:4001:827::2002	15169 (GOOGLE) (GOOGLE)
3	142.250.186.98 142.250.186.98	15169 (GOOGLE) (GOOGLE)
2	52.44.233.116 52.44.233.116	14618 (AMAZON-AES) (AMAZON-AES)
1 2	108.157.4.15 108.157.4.15	16509 (AMAZON-02) (AMAZON-02)
2 12	2a00:1450:400... 2a00:1450:4001:81c::2004	15169 (GOOGLE) (GOOGLE)
12	2a00:1450:400... 2a00:1450:4001:828::2003	15169 (GOOGLE) (GOOGLE)
1	2a00:1450:400... 2a00:1450:4001:81c::2002	15169 (GOOGLE) (GOOGLE)
2	212.82.100.181 212.82.100.181	34010 (YAHOO-IRD) (YAHOO-IRD)
1	18.173.233.115 18.173.233.115	16509 (AMAZON-02) (AMAZON-02)
3	104.17.208.240 104.17.208.240	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1 1	2a00:1450:400... 2a00:1450:4001:80e::2002	15169 (GOOGLE) (GOOGLE)
1	184.30.20.101 184.30.20.101	16625 (AKAMAI-AS) (AKAMAI-AS)
1	52.45.23.69 52.45.23.69	14618 (AMAZON-AES) (AMAZON-AES)
1	34.193.174.103 34.193.174.103	14618 (AMAZON-AES) (AMAZON-AES)
157	38

27 35.190.22.40 (Kansas City, United States) 3 redirects

ASN15169 (GOOGLE, US)
PTR: 40.22.190.35.bc.googleusercontent.com

banking.citi.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
citi.bridgetrack.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2606:4700::6813:9308 (United States)

ASN13335 (CLOUDFLARENET, US)

script.crazyegg.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

16 2600:9000:206f:b400:2:8f43:5780:93a1 (United States)

ASN16509 (AMAZON-02, US)

nexus.ensighten.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 54.73.141.201 (Dublin, Ireland) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-54-73-141-201.eu-west-1.compute.amazonaws.com

dpm.demdex.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
citi.demdex.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 3.124.119.57 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-3-124-119-57.eu-central-1.compute.amazonaws.com

tagmanager1.citi.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
data.privacy.ensighten.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 63.140.62.164 (United States)

ASN16509 (AMAZON-02, US)
PTR: ip-63-140-62-164.data.adobedc.net

metrics1.citi.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 54.78.218.204 (Dublin, Ireland) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-54-78-218-204.eu-west-1.compute.amazonaws.com

cm.everesttech.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 18.66.248.26 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-18-66-248-26.dus51.r.cloudfront.net

pagestates-tracking.crazyegg.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 18.66.122.45 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-18-66-122-45.fra60.r.cloudfront.net

assets-tracking.crazyegg.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:224a:fa00:1:76cf:fe80:93a1 (United States)

ASN16509 (AMAZON-02, US)

c1.rfihub.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

17 2a00:1450:4001:80f::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6812:190d (United States)

ASN13335 (CLOUDFLARENET, US)

cdn.gbqofs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 54.154.232.97 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-54-154-232-97.eu-west-1.compute.amazonaws.com

tracking.crazyegg.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 193.0.160.131 (United States)

ASN54312 (ROCKETFUEL, US)

20766699p.rfihub.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
a.rfihub.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 66.235.152.143 (United States)

ASN16509 (AMAZON-02, US)
PTR: ip-66-235-152-143.data.adobedc.net

citicorpcreditservic.tt.omtrdc.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 34.107.138.236 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 236.138.107.34.bc.googleusercontent.com

cdn.digitalmarketing.citibankonline.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 104.17.209.240 (None, )

ASN13335 (CLOUDFLARENET, US)

zn3vi8kkuds0jjrfc-citifeedback.siteintercept.qualtrics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
siteintercept.qualtrics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 216.58.206.38 (United States) 1 redirects

ASN15169 (GOOGLE, US)
PTR: mil07s07-in-f6.1e100.net

6269322.fls.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1288:80:807::2 (United Kingdom)

ASN203220 (YAHOO-DEB, GB)

s.yimg.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2620:1ec:c11::200 (United States)

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

bat.bing.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 35.244.154.8 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 8.154.244.35.bc.googleusercontent.com

sr.rlcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:224a:e000:1d:bf0a:0:93a1 (United States)

ASN16509 (AMAZON-02, US)

c.tvpixel.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.32.27.28 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-32-27-28.fra56.r.cloudfront.net

live.rezync.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 52.46.130.91 (Ashburn, United States) 1 redirects

ASN16509 (AMAZON-02, US)

s.amazon-adsystem.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 54.211.113.206 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-54-211-113-206.compute-1.amazonaws.com

prod.report.nacustomerexperience.citi.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

12 2a00:1450:4001:827::2002 (Frankfurt am Main, Germany) 2 redirects

ASN15169 (GOOGLE, US)

googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 142.250.186.98 (United States)

ASN15169 (GOOGLE, US)
PTR: fra24s06-in-f2.1e100.net

www.googleadservices.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 52.44.233.116 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-52-44-233-116.compute-1.amazonaws.com

p.tvpixel.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 108.157.4.15 (Germany) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: server-108-157-4-15.dus51.r.cloudfront.net

sb.scorecardresearch.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

12 2a00:1450:4001:81c::2004 (Frankfurt am Main, Germany) 2 redirects

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

12 2a00:1450:4001:828::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.nl	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:81c::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

adservice.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 212.82.100.181 (Dublin, Ireland)

ASN34010 (YAHOO-IRD, GB)
PTR: spdc.pbp.vip.ir2.yahoo.com

sp.analytics.yahoo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 18.173.233.115 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-18-173-233-115.dus51.r.cloudfront.net

cdn.boomtrain.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 104.17.208.240 (None, )

ASN13335 (CLOUDFLARENET, US)

siteintercept.qualtrics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:80e::2002 (Frankfurt am Main, Germany) 1 redirects

ASN15169 (GOOGLE, US)

adservice.google.nl	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 184.30.20.101 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a184-30-20-101.deploy.static.akamaitechnologies.com

iad1.qualtrics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.45.23.69 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-52-45-23-69.compute-1.amazonaws.com

people.api.boomtrain.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 34.193.174.103 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-34-193-174-103.compute-1.amazonaws.com

events.api.boomtrain.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
29	citi.com 2 redirects banking.citi.com — Cisco Umbrella Rank: 495850 tagmanager1.citi.com — Cisco Umbrella Rank: 50213 metrics1.citi.com — Cisco Umbrella Rank: 24881 prod.report.nacustomerexperience.citi.com — Cisco Umbrella Rank: 19348	444 KB
23	ensighten.com nexus.ensighten.com — Cisco Umbrella Rank: 3429 data.privacy.ensighten.com — Cisco Umbrella Rank: 7394	215 KB
17	googletagmanager.com www.googletagmanager.com — Cisco Umbrella Rank: 36	1 MB
15	doubleclick.net 3 redirects 6269322.fls.doubleclick.net — Cisco Umbrella Rank: 202414 googleads.g.doubleclick.net — Cisco Umbrella Rank: 33	18 KB
13	google.nl 1 redirects www.google.nl — Cisco Umbrella Rank: 9642 adservice.google.nl — Cisco Umbrella Rank: 21366	2 KB
13	google.com 2 redirects www.google.com — Cisco Umbrella Rank: 2 adservice.google.com — Cisco Umbrella Rank: 93	3 KB
12	qualtrics.com zn3vi8kkuds0jjrfc-citifeedback.siteintercept.qualtrics.com — Cisco Umbrella Rank: 32985 siteintercept.qualtrics.com — Cisco Umbrella Rank: 891 iad1.qualtrics.com — Cisco Umbrella Rank: 9493	96 KB
7	crazyegg.com script.crazyegg.com — Cisco Umbrella Rank: 2199 pagestates-tracking.crazyegg.com — Cisco Umbrella Rank: 4875 assets-tracking.crazyegg.com — Cisco Umbrella Rank: 4900 tracking.crazyegg.com — Cisco Umbrella Rank: 4175	37 KB
4	demdex.net 1 redirects dpm.demdex.net — Cisco Umbrella Rank: 208 citi.demdex.net — Cisco Umbrella Rank: 39616	5 KB
3	boomtrain.com cdn.boomtrain.com — Cisco Umbrella Rank: 5394 people.api.boomtrain.com — Cisco Umbrella Rank: 5726 events.api.boomtrain.com — Cisco Umbrella Rank: 7926	31 KB
3	googleadservices.com www.googleadservices.com — Cisco Umbrella Rank: 138	22 KB
3	tvpixel.com c.tvpixel.com — Cisco Umbrella Rank: 9225 p.tvpixel.com — Cisco Umbrella Rank: 1973	32 KB
3	bing.com bat.bing.com — Cisco Umbrella Rank: 329	14 KB
3	yimg.com s.yimg.com — Cisco Umbrella Rank: 630	7 KB
3	citibankonline.com cdn.digitalmarketing.citibankonline.com — Cisco Umbrella Rank: 70554	52 KB
2	yahoo.com sp.analytics.yahoo.com — Cisco Umbrella Rank: 1308	876 B
2	scorecardresearch.com 1 redirects sb.scorecardresearch.com — Cisco Umbrella Rank: 172	905 B
2	amazon-adsystem.com 1 redirects s.amazon-adsystem.com — Cisco Umbrella Rank: 285	763 B
2	rfihub.com 20766699p.rfihub.com — Cisco Umbrella Rank: 144667 a.rfihub.com — Cisco Umbrella Rank: 2935	4 KB
2	bridgetrack.com 1 redirects citi.bridgetrack.com — Cisco Umbrella Rank: 83587	1 KB
1	rezync.com live.rezync.com — Cisco Umbrella Rank: 1785	1 KB
1	rlcdn.com sr.rlcdn.com — Cisco Umbrella Rank: 25926	98 B
1	omtrdc.net citicorpcreditservic.tt.omtrdc.net — Cisco Umbrella Rank: 30625	2 KB
1	gbqofs.com cdn.gbqofs.com — Cisco Umbrella Rank: 6332	148 KB
1	rfihub.net c1.rfihub.net — Cisco Umbrella Rank: 5475	6 KB
1	everesttech.net 1 redirects cm.everesttech.net — Cisco Umbrella Rank: 1110	517 B
157	26

	Domain	Requested by
25	banking.citi.com	2 redirects banking.citi.com nexus.ensighten.com
17	www.googletagmanager.com	nexus.ensighten.com
16	nexus.ensighten.com	banking.citi.com nexus.ensighten.com
12	www.google.nl	6269322.fls.doubleclick.net
12	www.google.com	2 redirects
12	googleads.g.doubleclick.net	2 redirects nexus.ensighten.com
10	siteintercept.qualtrics.com	nexus.ensighten.com
7	data.privacy.ensighten.com	banking.citi.com
4	script.crazyegg.com	banking.citi.com script.crazyegg.com
3	www.googleadservices.com	nexus.ensighten.com 6269322.fls.doubleclick.net www.googleadservices.com
3	bat.bing.com	nexus.ensighten.com
3	s.yimg.com	nexus.ensighten.com
3	6269322.fls.doubleclick.net	1 redirects www.googletagmanager.com adservice.google.com
3	cdn.digitalmarketing.citibankonline.com	banking.citi.com
3	dpm.demdex.net	1 redirects banking.citi.com
2	sp.analytics.yahoo.com
2	sb.scorecardresearch.com	1 redirects
2	p.tvpixel.com	nexus.ensighten.com
2	s.amazon-adsystem.com	1 redirects
2	metrics1.citi.com	nexus.ensighten.com
2	citi.bridgetrack.com	1 redirects banking.citi.com
1	a.rfihub.com	nexus.ensighten.com
1	events.api.boomtrain.com	nexus.ensighten.com
1	people.api.boomtrain.com	nexus.ensighten.com
1	iad1.qualtrics.com
1	adservice.google.nl	1 redirects
1	cdn.boomtrain.com	nexus.ensighten.com
1	adservice.google.com	6269322.fls.doubleclick.net
1	prod.report.nacustomerexperience.citi.com	nexus.ensighten.com
1	live.rezync.com	nexus.ensighten.com
1	c.tvpixel.com	nexus.ensighten.com
1	sr.rlcdn.com	nexus.ensighten.com
1	zn3vi8kkuds0jjrfc-citifeedback.siteintercept.qualtrics.com	nexus.ensighten.com
1	citicorpcreditservic.tt.omtrdc.net	nexus.ensighten.com
1	20766699p.rfihub.com	nexus.ensighten.com
1	tracking.crazyegg.com	script.crazyegg.com
1	cdn.gbqofs.com	nexus.ensighten.com
1	c1.rfihub.net	nexus.ensighten.com
1	assets-tracking.crazyegg.com	script.crazyegg.com
1	pagestates-tracking.crazyegg.com	script.crazyegg.com
1	cm.everesttech.net	1 redirects
1	citi.demdex.net	nexus.ensighten.com
1	tagmanager1.citi.com	nexus.ensighten.com
157	43

This site contains links to these domains. Also see Links.

Domain
citi.bridgetrack.com
citi.com
online.citi.com
www.citi.com
www.citibikenyc.com
travel.mastercard.com

Subject Issuer	Validity	Valid
banking.citi.com DigiCert EV RSA CA G2	`2022-12-26` - `2024-01-26`	a year	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2023-03-09` - `2024-03-08`	a year	crt.sh
nexus.ensighten.com Amazon RSA 2048 M02	`2023-09-29` - `2024-10-27`	a year	crt.sh
tagmanager1.citi.com DigiCert EV RSA CA G2	`2023-08-21` - `2024-09-20`	a year	crt.sh
*.privacy.ensighten.com DigiCert TLS RSA SHA256 2020 CA1	`2023-02-03` - `2024-02-16`	a year	crt.sh
*.demdex.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2023-09-26` - `2024-10-26`	a year	crt.sh
metrics1.citi.com DigiCert EV RSA CA G2	`2023-07-10` - `2024-08-09`	a year	crt.sh
crazyegg.com Amazon RSA 2048 M02	`2023-05-28` - `2024-06-26`	a year	crt.sh
*.rfihub.net Amazon RSA 2048 M03	`2023-10-31` - `2024-11-28`	a year	crt.sh
*.google-analytics.com GTS CA 1C3	`2023-10-23` - `2024-01-15`	3 months	crt.sh
gbqofs.com Cloudflare Inc ECC CA-3	`2023-10-12` - `2024-10-11`	a year	crt.sh
*.rfihub.com Sectigo RSA Domain Validation Secure Server CA	`2023-04-27` - `2024-04-27`	a year	crt.sh
*.tt.omtrdc.net DigiCert TLS RSA SHA256 2020 CA1	`2023-08-22` - `2024-09-21`	a year	crt.sh
cdn.digitalmarketing.citibankonline.com DigiCert EV RSA CA G2	`2023-05-23` - `2024-06-22`	a year	crt.sh
citi.bridgetrack.com Thawte EV RSA CA G2	`2023-03-20` - `2024-04-19`	a year	crt.sh
*.qualtrics.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2023-03-27` - `2024-03-26`	a year	crt.sh
*.doubleclick.net GTS CA 1C3	`2023-10-23` - `2024-01-15`	3 months	crt.sh
*.api.fantasysports.yahoo.com DigiCert SHA2 High Assurance Server CA	`2023-11-06` - `2023-12-27`	2 months	crt.sh
www.bing.com Microsoft Azure TLS Issuing CA 01	`2023-10-24` - `2024-04-21`	6 months	crt.sh
*.rlcdn.com Sectigo RSA Domain Validation Secure Server CA	`2023-02-02` - `2024-03-03`	a year	crt.sh
*.tvpixel.com Amazon RSA 2048 M03	`2023-11-15` - `2024-12-13`	a year	crt.sh
*.rezync.com Amazon RSA 2048 M02	`2023-10-25` - `2024-11-21`	a year	crt.sh
prod.report.nacustomerexperience.citi.com DigiCert EV RSA CA G2	`2023-05-19` - `2024-05-22`	a year	crt.sh
*.g.doubleclick.net GTS CA 1C3	`2023-10-23` - `2024-01-15`	3 months	crt.sh
www.googleadservices.com GTS CA 1C3	`2023-10-23` - `2024-01-15`	3 months	crt.sh
www.google.com GTS CA 1C3	`2023-10-23` - `2024-01-15`	3 months	crt.sh
*.google.nl GTS CA 1C3	`2023-10-23` - `2024-01-15`	3 months	crt.sh
*.google.com GTS CA 1C3	`2023-10-23` - `2024-01-15`	3 months	crt.sh
real.sp.analytics.yahoo.com DigiCert SHA2 High Assurance Server CA	`2023-10-24` - `2024-04-17`	6 months	crt.sh
*.boomtrain.com Amazon RSA 2048 M02	`2023-02-09` - `2024-03-09`	a year	crt.sh
*.api.boomtrain.com Amazon RSA 2048 M03	`2023-09-16` - `2024-10-14`	a year	crt.sh
*.googleadservices.com GTS CA 1C3	`2023-10-23` - `2024-01-15`	3 months	crt.sh

This page contains 9 frames:

Primary Page: https://banking.citi.com/cbol/OM/checking/tiered/featured-offers/default.htm?BT_TX=1&ProspectID=326D0D64EAD743E4BE6193A917A2C7ED
Frame ID: 5C7B2709C58B51D2FBFB6E36F1CB5964
Requests: 142 HTTP requests in this frame

Frame: https://script.crazyegg.com/pages/data-scripts/0090/1567/sampling/banking.citi.com.json?t=472708
Frame ID: B1645DDEF8E866A76E42B566418923CD
Requests: 4 HTTP requests in this frame

Frame: https://citi.demdex.net/dest5.html?d_nsid=0
Frame ID: 628204B68EDF30C54486B322E7FF50FB
Requests: 1 HTTP requests in this frame

Frame: https://20766699p.rfihub.com/ca.html?ver=9&ra=1658&rb=648&ca=20766699&_o=17169175&_t=sapientcbol2023reimaginecheckingtiered&_rev=1&_pcode=1&_orderid=1&ssv_cuuid=&ssv_package=null&ssv_prodlist=null&ssv_pagename=sapientcbol2023reimaginecheckingtiered&pe=https%3A%2F%2Fbanking.citi.com%2Fcbol%2FOM%2Fchecking%2Ftiered%2Ffeatured-offers%2Fdefault.htm%3FBT_TX%3D1%26ProspectID%3D326D0D64EAD743E4BE6193A917A2C7ED&pf=&ra=7392344212812738
Frame ID: 57D860235471DFA93D5BED2D5D3C8D13
Requests: 1 HTTP requests in this frame

Frame: https://6269322.fls.doubleclick.net/activityi;dc_pre=CK_xi_2_94IDFcXIOwIdg8APkQ;src=6269322;type=bankp00;cat=proje00b;ord=1;num=6451680302062;auiddc=976096460.1701751935;gtm=45fe3bt0;gcd=11l1l1l1l1;dma_cps=sypham;dma=1;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;epver=2;~oref=https%3A%2F%2Fbanking.citi.com%2Fcbol%2FOM%2Fchecking%2Ftiered%2Ffeatured-offers%2Fdefault.htm%3FBT_TX%3D1%26ProspectID%3D326D0D64EAD743E4BE6193A917A2C7ED
Frame ID: C3930BB0F308E5B0CB4791BC9755B2DC
Requests: 1 HTTP requests in this frame

Frame: https://sr.rlcdn.com/425466.html?es=80676&u=da39a3ee5e6b4b0d3255bfef95601890afd80709
Frame ID: BB637D17DC575C904435DE2C152B0000
Requests: 1 HTTP requests in this frame

Frame: https://adservice.google.com/ddm/fls/i/dc_pre=CK_xi_2_94IDFcXIOwIdg8APkQ;src=6269322;type=bankp00;cat=proje00b;ord=1;num=6451680302062;auiddc=976096460.1701751935;gtm=45fe3bt0;gcd=11l1l1l1l1;dma_cps=sypham;dma=1;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;epver=2;~oref=https%3A%2F%2Fbanking.citi.com%2Fcbol%2FOM%2Fchecking%2Ftiered%2Ffeatured-offers%2Fdefault.htm%3FBT_TX%3D1%26ProspectID%3D326D0D64EAD743E4BE6193A917A2C7ED
Frame ID: 0677889847EC591F5635B1D7C94EE38C
Requests: 1 HTTP requests in this frame

Frame: https://6269322.fls.doubleclick.net/ddm/fls/r/dc_pre=CK_xi_2_94IDFcXIOwIdg8APkQ;src=6269322;type=bankp00;cat=proje00b;ord=1;num=6451680302062;auiddc=976096460.1701751935;gtm=45fe3bt0;gcd=11l1l1l1l1;dma_cps=sypham;dma=1;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;epver=2;~oref=https%3A%2F%2Fbanking.citi.com%2Fcbol%2FOM%2Fchecking%2Ftiered%2Ffeatured-offers%2Fdefault.htm%3FBT_TX%3D1%26ProspectID%3D326D0D64EAD743E4BE6193A917A2C7ED
Frame ID: 906508AFD85A054FA75684FFCA204BF5
Requests: 4 HTTP requests in this frame

Frame: https://a.rfihub.com/pstats.html?rb=648&ca=20766699&ri=e1b1c6846914e46e0b4bbbd9daf0b596&stats=%7B%7D&ra=5887269487514346
Frame ID: 2260897F4589407D60FD86B0A29CA9CF
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Unlock up to $2,000 with a Citi® checking account | Citi.com

Page URL History Show full URLs

https://banking.citi.com/cbol/checking/tiered/default.htm HTTP 301
https://banking.citi.com/cbol/OM/checking/tiered/featured-offers/default.htm HTTP 302
https://citi.bridgetrack.com/cbol/OM/checking/tiered/featured-offers/default.htm?BT_VanityDomain=75D5D212... HTTP 302
https://banking.citi.com/cbol/OM/checking/tiered/featured-offers/default.htm?BT_TX=1&ProspectID=326D0... Page URL

Detected technologies

Bootstrap (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js

Crazy Egg (Analytics) Expand

Overall confidence: 100%
Detected patterns

script\.crazyegg\.com/pages/scripts/\d+/\d+\.js

Ensighten (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

//nexus\.ensighten\.com/

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/gtag/js

Page Statistics

157
Requests

94 %
HTTPS

33 %
IPv6

26
Domains

43
Subdomains

38
IPs

5
Countries

2231 kB
Transfer

6497 kB
Size

59
Cookies

22 Outgoing links

These are links going to different origins than the main page.

URL: https://citi.bridgetrack.com/track/?BT_TX=1&ProspectID=326D0D64EAD743E4BE6193A917A2C7ED&pixID=66462&TGT=22471
Title: Visit a Citi Branch >

Search URL Search Domain Scan URL

URL: https://citi.bridgetrack.com/track/?TGT=28718

Search URL Search Domain Scan URL

URL: https://citi.bridgetrack.com/track/?TGT=28715
Title: Terms & Conditions

Search URL Search Domain Scan URL

URL: https://citi.bridgetrack.com/track/?TGT=28717
Title: Privacy

Search URL Search Domain Scan URL

URL: https://citi.bridgetrack.com/track/?TGT=151056
Title: Notice at Collection

Search URL Search Domain Scan URL

URL: https://citi.bridgetrack.com/track/?TGT=151057
Title: CA Privacy Hub

Search URL Search Domain Scan URL

URL: https://citi.bridgetrack.com/track/?TGT=28716
Title: Security

Search URL Search Domain Scan URL

URL: https://citi.bridgetrack.com/track/?TGT=143095
Title: Contact Us

Search URL Search Domain Scan URL

URL: https://citi.bridgetrack.com/track/?TGT=143097

Search URL Search Domain Scan URL

URL: https://citi.bridgetrack.com/track/?TGT=143098

Search URL Search Domain Scan URL

URL: https://citi.bridgetrack.com/track/?TGT=143100

Search URL Search Domain Scan URL

URL: https://citi.com/earlyaccess
Title: citi.com/earlyaccess

Search URL Search Domain Scan URL

URL: https://citi.com/
Title: citi.com

Search URL Search Domain Scan URL

URL: https://citi.com/simplifiedbanking
Title: citi.com/simplifiedbanking

Search URL Search Domain Scan URL

URL: https://citi.com/accountagreementsandnotices
Title: citi.com/accountagreementsandnotices

Search URL Search Domain Scan URL

URL: https://online.citi.com/JRS/popups/ao/CDAA.pdf
Title: Client Manual Agreement

Search URL Search Domain Scan URL

URL: https://online.citi.com/JRS/portal/template.do?ID=Consumer-Deposit-Account-Agreements
Title: Account Agreement and Notices page

Search URL Search Domain Scan URL

URL: https://online.citi.com/US/JRS/portal/template.do?ID=FDICGovSpeedbump
Title: www.fdic.gov

Search URL Search Domain Scan URL

URL: https://www.citi.com/banking/current-interest-rates/savings-accounts
Title: View Rates >

Search URL Search Domain Scan URL

URL: https://online.citi.com/JRS/portal/template.do?ID=SipcSpeedbump
Title: member SIPC

Search URL Search Domain Scan URL

URL: https://www.citibikenyc.com/
Title: http://www.citibikenyc.com/

Search URL Search Domain Scan URL

URL: https://travel.mastercard.com/
Title: https://travel.mastercard.com

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://banking.citi.com/cbol/checking/tiered/default.htm HTTP 301
https://banking.citi.com/cbol/OM/checking/tiered/featured-offers/default.htm HTTP 302
https://citi.bridgetrack.com/cbol/OM/checking/tiered/featured-offers/default.htm?BT_VanityDomain=75D5D21283638384E0D1F0BE7A3F8F3FA8FC1D5DDA7E08B92F783879A9B6E6062733753445A4A5222623E330D15050B11E1ACFCF7CDCDD5C290AEA4B8B59B8A9BD4977767B5318C0 HTTP 302
https://banking.citi.com/cbol/OM/checking/tiered/featured-offers/default.htm?BT_TX=1&ProspectID=326D0D64EAD743E4BE6193A917A2C7ED Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 5

https://dpm.demdex.net/id?d_visid_ver=4.4.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=61834D9B5228A7430A490D45%40AdobeOrg&d_nsid=0&ts=1701751934675 HTTP 302
https://dpm.demdex.net/id/rd?d_visid_ver=4.4.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=61834D9B5228A7430A490D45%40AdobeOrg&d_nsid=0&ts=1701751934675

Request Chain 28

https://cm.everesttech.net/cm/dd?d_uuid=56065922481724643113778279548108056058 HTTP 302
https://dpm.demdex.net/ibs:dpid=411&dpuuid=ZW6sfwAAAB7hBAN-

Request Chain 65

https://6269322.fls.doubleclick.net/activityi;src=6269322;type=bankp00;cat=proje00b;ord=1;num=6451680302062;auiddc=976096460.1701751935;gtm=45fe3bt0;gcd=11l1l1l1l1;dma_cps=sypham;dma=1;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;epver=2;~oref=https%3A%2F%2Fbanking.citi.com%2Fcbol%2FOM%2Fchecking%2Ftiered%2Ffeatured-offers%2Fdefault.htm%3FBT_TX%3D1%26ProspectID%3D326D0D64EAD743E4BE6193A917A2C7ED HTTP 302
https://6269322.fls.doubleclick.net/activityi;dc_pre=CK_xi_2_94IDFcXIOwIdg8APkQ;src=6269322;type=bankp00;cat=proje00b;ord=1;num=6451680302062;auiddc=976096460.1701751935;gtm=45fe3bt0;gcd=11l1l1l1l1;dma_cps=sypham;dma=1;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;epver=2;~oref=https%3A%2F%2Fbanking.citi.com%2Fcbol%2FOM%2Fchecking%2Ftiered%2Ffeatured-offers%2Fdefault.htm%3FBT_TX%3D1%26ProspectID%3D326D0D64EAD743E4BE6193A917A2C7ED

Request Chain 73

https://s.amazon-adsystem.com/iu3?pid=c3702eea-109e-48b0-9ef4-c856bdd405e2&event=PageView HTTP 302
https://s.amazon-adsystem.com/iu3?pid=c3702eea-109e-48b0-9ef4-c856bdd405e2&event=PageView&dcc=t

Request Chain 96

https://sb.scorecardresearch.com/p?c1=2&c2=34402982&ns_type=hidden&ns_event=page_view&c6=citi-d4f85824-1351-4554-91ff-fdb56f962c5c&c7=https%3A%2F%2Fbanking.citi.com%2Fcbol%2FOM%2Fchecking%2Ftiered%2Ffeatured-offers%2Fdefault.htm%3FBT_TX%3D1%26ProspectID%3D326D0D64EAD743E4BE6193A917A2C7ED&c8=Unlock%20up%20to%20%242%2C000%20with%20a%20Citi%C2%AE%20checking%20account%20%7C%20Citi.com&c9=&rn=1701751935892 HTTP 302
https://sb.scorecardresearch.com/p2?c1=2&c2=34402982&ns_type=hidden&ns_event=page_view&c6=citi-d4f85824-1351-4554-91ff-fdb56f962c5c&c7=https%3A%2F%2Fbanking.citi.com%2Fcbol%2FOM%2Fchecking%2Ftiered%2Ffeatured-offers%2Fdefault.htm%3FBT_TX%3D1%26ProspectID%3D326D0D64EAD743E4BE6193A917A2C7ED&c8=Unlock%20up%20to%20%242%2C000%20with%20a%20Citi%C2%AE%20checking%20account%20%7C%20Citi.com&c9=&rn=1701751935892

Request Chain 122

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/658128868/?random=1984316251&cv=11&fst=1701751935876&bg=ffffff&guid=ON&async=1&gtm=45be3bt0v9138128184&gcd=11l1l1l1l1&dma_cps=sypham&dma=1&u_w=1600&u_h=1200&url=https%3A%2F%2Fbanking.citi.com%2Fcbol%2FOM%2Fchecking%2Ftiered%2Ffeatured-offers%2Fdefault.htm%3FBT_TX%3D1%26ProspectID%3D326D0D64EAD743E4BE6193A917A2C7ED&label=JUEtCL3Qv8oBEOT_6LkC&hn=www.googleadservices.com&frm=0&tiba=Unlock%20up%20to%20%242%2C000%20with%20a%20Citi%C2%AE%20checking%20account%20%7C%20Citi.com&gtm_ee=1&auid=976096460.1701751935&uamb=0&uaw=0&data=event%3Dconversion&fmt=3&ct_cookie_present=false&ocp_id=gKxuZceEAsqSgAff3J64DQ&sscte=1&crd=&pscrd=EkxDaEFJZ0k2MnF3WVEyWXZWbUlpWl9mRm5FaVVBZkloUHNvVnI4WWNJQ25QaUt3Wm10MktGZmNBTWxHY3NPWlNjN1c1UjBfQVhROEZuGldDaEFJZ0k2MnF3WVFwdGZCLUxMLWhkbHdFaTBBSDVqUHFfVXNtMThaRFhYTDU0RjNRYnhLYURvR1RxRTVkSzR0ODJ4bUFMcTFTeC12bHMzalhfUGNTQ1UiEwjHxJL9v_eCAxVKCeAKHV-uB9c HTTP 302
https://www.google.com/pagead/1p-conversion/658128868/?random=1984316251&cv=11&fst=1701751935876&bg=ffffff&guid=ON&async=1&gtm=45be3bt0v9138128184&gcd=11l1l1l1l1&dma_cps=sypham&dma=1&u_w=1600&u_h=1200&url=https%3A%2F%2Fbanking.citi.com%2Fcbol%2FOM%2Fchecking%2Ftiered%2Ffeatured-offers%2Fdefault.htm%3FBT_TX%3D1%26ProspectID%3D326D0D64EAD743E4BE6193A917A2C7ED&label=JUEtCL3Qv8oBEOT_6LkC&hn=www.googleadservices.com&frm=0&tiba=Unlock%20up%20to%20%242%2C000%20with%20a%20Citi%C2%AE%20checking%20account%20%7C%20Citi.com&gtm_ee=1&auid=976096460.1701751935&uamb=0&uaw=0&data=event%3Dconversion&fmt=3&ct_cookie_present=false&sscte=1&crd=&pscrd=EkxDaEFJZ0k2MnF3WVEyWXZWbUlpWl9mRm5FaVVBZkloUHNvVnI4WWNJQ25QaUt3Wm10MktGZmNBTWxHY3NPWlNjN1c1UjBfQVhROEZuGldDaEFJZ0k2MnF3WVFwdGZCLUxMLWhkbHdFaTBBSDVqUHFfVXNtMThaRFhYTDU0RjNRYnhLYURvR1RxRTVkSzR0ODJ4bUFMcTFTeC12bHMzalhfUGNTQ1UiEwjHxJL9v_eCAxVKCeAKHV-uB9c&is_vtc=1&ocp_id=gKxuZceEAsqSgAff3J64DQ&cid=CAQSKQDICaaNqnxL7zmYSIIKS5nMzV9iKD4BUXSdTTXv1MFV5bdnLUUNT5E5&random=4018001958 HTTP 302
https://www.google.nl/pagead/1p-conversion/658128868/?random=1984316251&cv=11&fst=1701751935876&bg=ffffff&guid=ON&async=1&gtm=45be3bt0v9138128184&gcd=11l1l1l1l1&dma_cps=sypham&dma=1&u_w=1600&u_h=1200&url=https%3A%2F%2Fbanking.citi.com%2Fcbol%2FOM%2Fchecking%2Ftiered%2Ffeatured-offers%2Fdefault.htm%3FBT_TX%3D1%26ProspectID%3D326D0D64EAD743E4BE6193A917A2C7ED&label=JUEtCL3Qv8oBEOT_6LkC&hn=www.googleadservices.com&frm=0&tiba=Unlock%20up%20to%20%242%2C000%20with%20a%20Citi%C2%AE%20checking%20account%20%7C%20Citi.com&gtm_ee=1&auid=976096460.1701751935&uamb=0&uaw=0&data=event%3Dconversion&fmt=3&ct_cookie_present=false&sscte=1&crd=&pscrd=EkxDaEFJZ0k2MnF3WVEyWXZWbUlpWl9mRm5FaVVBZkloUHNvVnI4WWNJQ25QaUt3Wm10MktGZmNBTWxHY3NPWlNjN1c1UjBfQVhROEZuGldDaEFJZ0k2MnF3WVFwdGZCLUxMLWhkbHdFaTBBSDVqUHFfVXNtMThaRFhYTDU0RjNRYnhLYURvR1RxRTVkSzR0ODJ4bUFMcTFTeC12bHMzalhfUGNTQ1UiEwjHxJL9v_eCAxVKCeAKHV-uB9c&is_vtc=1&ocp_id=gKxuZceEAsqSgAff3J64DQ&cid=CAQSKQDICaaNqnxL7zmYSIIKS5nMzV9iKD4BUXSdTTXv1MFV5bdnLUUNT5E5&random=4018001958&ipr=y

Request Chain 141

https://adservice.google.nl/ddm/fls/i/dc_pre=CK_xi_2_94IDFcXIOwIdg8APkQ;src=6269322;type=bankp00;cat=proje00b;ord=1;num=6451680302062;auiddc=976096460.1701751935;gtm=45fe3bt0;gcd=11l1l1l1l1;dma_cps=sypham;dma=1;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;epver=2;~oref=https%3A%2F%2Fbanking.citi.com%2Fcbol%2FOM%2Fchecking%2Ftiered%2Ffeatured-offers%2Fdefault.htm%3FBT_TX%3D1%26ProspectID%3D326D0D64EAD743E4BE6193A917A2C7ED HTTP 302
https://6269322.fls.doubleclick.net/ddm/fls/r/dc_pre=CK_xi_2_94IDFcXIOwIdg8APkQ;src=6269322;type=bankp00;cat=proje00b;ord=1;num=6451680302062;auiddc=976096460.1701751935;gtm=45fe3bt0;gcd=11l1l1l1l1;dma_cps=sypham;dma=1;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;epver=2;~oref=https%3A%2F%2Fbanking.citi.com%2Fcbol%2FOM%2Fchecking%2Ftiered%2Ffeatured-offers%2Fdefault.htm%3FBT_TX%3D1%26ProspectID%3D326D0D64EAD743E4BE6193A917A2C7ED

Request Chain 148

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/857721185/?random=692069601&cv=9&fst=1701751936636&num=1&npa=1&label=1foCCOHD6eoYEOGS_5gD&guid=ON&resp=GooglemKTybQhCsO&eid=375603260%2C466465925%2C512247839&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=3&u_nmime=4&sendb=1&ig=1&frm=2&url=https%3A%2F%2F6269322.fls.doubleclick.net%2Fddm%2Ffls%2Fr%2Fdc_pre%3DCK_xi_2_94IDFcXIOwIdg8APkQ%3Bsrc%3D6269322%3Btype%3Dbankp00%3Bcat%3Dproje00b%3Bord%3D1%3Bnum%3D6451680302062%3Bauiddc%3D976096460.1701751935%3Bgtm%3D45fe3bt0%3Bgcd%3D11l1l1l1l1%3Bdma_cps%3Dsypham%3Bdma%3D1%3Buaa%3D%3Buab%3D%3Buafvl%3D%3Buamb%3D0%3Buam%3D%3Buap%3D%3Buapv%3D%3Buaw%3D0%3Bepver%3D2%3B~oref%3Dhttps%253A%252F%252Fbanking.citi.com%252Fcbol%252FOM%252Fchecking%252Ftiered%252Ffeatured-offers%252Fdefault.htm%253FBT_TX%253D1%2526ProspectID%253D326D0D64EAD743E4BE6193A917A2C7ED&ref=https%3A%2F%2Fadservice.google.com%2F&top=https%3A%2F%2Fbanking.citi.com%2F&hn=www.googleadservices.com&fmt=3&ct_cookie_present=false&ocp_id=gKxuZe3lKPyzx_APsemOqAw&sscte=1&crd=&pscrd=IhMI7aW5_b_3ggMV_NkRCB2xtAPF HTTP 302
https://www.google.com/pagead/1p-conversion/857721185/?random=692069601&cv=9&fst=1701751936636&num=1&npa=1&label=1foCCOHD6eoYEOGS_5gD&guid=ON&resp=GooglemKTybQhCsO&eid=375603260%2C466465925%2C512247839&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=3&u_nmime=4&sendb=1&ig=1&frm=2&url=https%3A%2F%2F6269322.fls.doubleclick.net%2Fddm%2Ffls%2Fr%2Fdc_pre%3DCK_xi_2_94IDFcXIOwIdg8APkQ%3Bsrc%3D6269322%3Btype%3Dbankp00%3Bcat%3Dproje00b%3Bord%3D1%3Bnum%3D6451680302062%3Bauiddc%3D976096460.1701751935%3Bgtm%3D45fe3bt0%3Bgcd%3D11l1l1l1l1%3Bdma_cps%3Dsypham%3Bdma%3D1%3Buaa%3D%3Buab%3D%3Buafvl%3D%3Buamb%3D0%3Buam%3D%3Buap%3D%3Buapv%3D%3Buaw%3D0%3Bepver%3D2%3B~oref%3Dhttps%253A%252F%252Fbanking.citi.com%252Fcbol%252FOM%252Fchecking%252Ftiered%252Ffeatured-offers%252Fdefault.htm%253FBT_TX%253D1%2526ProspectID%253D326D0D64EAD743E4BE6193A917A2C7ED&ref=https%3A%2F%2Fadservice.google.com%2F&top=https%3A%2F%2Fbanking.citi.com%2F&hn=www.googleadservices.com&fmt=3&ct_cookie_present=false&sscte=1&crd=&pscrd=IhMI7aW5_b_3ggMV_NkRCB2xtAPF&is_vtc=1&ocp_id=gKxuZe3lKPyzx_APsemOqAw&cid=CAQSKQDICaaN-K4265GwSYVZcmU63ol3uI1cWdMfGX56eMlFlurNOdntutiJ&random=2372630858&resp=GooglemKTybQhCsO HTTP 302
https://www.google.nl/pagead/1p-conversion/857721185/?random=692069601&cv=9&fst=1701751936636&num=1&npa=1&label=1foCCOHD6eoYEOGS_5gD&guid=ON&resp=GooglemKTybQhCsO&eid=375603260%2C466465925%2C512247839&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=3&u_nmime=4&sendb=1&ig=1&frm=2&url=https%3A%2F%2F6269322.fls.doubleclick.net%2Fddm%2Ffls%2Fr%2Fdc_pre%3DCK_xi_2_94IDFcXIOwIdg8APkQ%3Bsrc%3D6269322%3Btype%3Dbankp00%3Bcat%3Dproje00b%3Bord%3D1%3Bnum%3D6451680302062%3Bauiddc%3D976096460.1701751935%3Bgtm%3D45fe3bt0%3Bgcd%3D11l1l1l1l1%3Bdma_cps%3Dsypham%3Bdma%3D1%3Buaa%3D%3Buab%3D%3Buafvl%3D%3Buamb%3D0%3Buam%3D%3Buap%3D%3Buapv%3D%3Buaw%3D0%3Bepver%3D2%3B~oref%3Dhttps%253A%252F%252Fbanking.citi.com%252Fcbol%252FOM%252Fchecking%252Ftiered%252Ffeatured-offers%252Fdefault.htm%253FBT_TX%253D1%2526ProspectID%253D326D0D64EAD743E4BE6193A917A2C7ED&ref=https%3A%2F%2Fadservice.google.com%2F&top=https%3A%2F%2Fbanking.citi.com%2F&hn=www.googleadservices.com&fmt=3&ct_cookie_present=false&sscte=1&crd=&pscrd=IhMI7aW5_b_3ggMV_NkRCB2xtAPF&is_vtc=1&ocp_id=gKxuZe3lKPyzx_APsemOqAw&cid=CAQSKQDICaaN-K4265GwSYVZcmU63ol3uI1cWdMfGX56eMlFlurNOdntutiJ&random=2372630858&resp=GooglemKTybQhCsO&ipr=y

157 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H3

200

Primary Request default.htm Show response
banking.citi.com/cbol/OM/checking/tiered/featured-offers/
Redirect Chain

https://banking.citi.com/cbol/checking/tiered/default.htm
https://banking.citi.com/cbol/OM/checking/tiered/featured-offers/default.htm
https://citi.bridgetrack.com/cbol/OM/checking/tiered/featured-offers/default.htm?BT_VanityDomain=75D5D21283638384E0D1F0BE7A3F8F3FA8FC1D5DDA7E08B92F783879A9B6E6062733753445A4A5222623E330D15050B11E1A...
https://banking.citi.com/cbol/OM/checking/tiered/featured-offers/default.htm?BT_TX=1&ProspectID=326D0D64EAD743E4BE6193A917A2C7ED

4 KB
2 KB

160ms
159ms

Document
text/html

35.190.22.40
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://banking.citi.com/cbol/OM/checking/tiered/featured-offers/default.htm?BT_TX=1&ProspectID=326D0D64EAD743E4BE6193A917A2C7ED

Protocol

Security

QUIC, , AES_128_GCM

Server

35.190.22.40 Kansas City, United States, ASN15169 (GOOGLE, US),

Reverse DNS

40.22.190.35.bc.googleusercontent.com

Software

Resource Hash

b9019a5dd9f4d4fcc56120fed94484b648f0088feafcc09e3a43650908185d06

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.bridgetrack.com; report-uri https://csp-reporter-ui3464xpjq-uc.a.run.app/api/csp-report/?env=prod
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
accept-language: nl-NL,nl;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-encoding: gzip
content-length: 2251
content-security-policy: frame-ancestors https://*.citi.com https://*.bridgetrack.com; report-uri https://csp-reporter-ui3464xpjq-uc.a.run.app/api/csp-report/?env=prod
content-type: text/html
date: Tue, 05 Dec 2023 04:52:13 GMT
expires: Mon, 04 Dec 2023 04:52:14 GMT
p3p: CP="NON DSP COR DEVa PSAa IVAo CONo OUR IND UNI PUR NAV DEM LOC", policyref="http://citi.bridgetrack.com/w3c/p3p.xml" CP="NON DSP COR DEVa PSAa IVAo CONo OUR IND UNI PUR NAV DEM LOC", policyref="http://citi.bridgetrack.com/w3c/p3p.xml"
referrer-policy: strict-origin-when-cross-origin
strict-transport-security: max-age=31536000; includeSubDomains
vary: Accept-Encoding
via: 1.1 google
x-content-type-options: nosniff
x-xss-protection: 1; mode=block

Redirect headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private
content-length: 0
content-security-policy: frame-ancestors https://*.citi.com https://*.bridgetrack.com; report-uri https://csp-reporter-ui3464xpjq-uc.a.run.app/api/csp-report/?env=prod
content-type: text/html
date: Tue, 05 Dec 2023 04:52:13 GMT
expires: Mon, 04 Dec 2023 04:52:14 GMT
location: https://banking.citi.com/cbol/OM/checking/tiered/featured-offers/default.htm?BT_TX=1&ProspectID=326D0D64EAD743E4BE6193A917A2C7ED
p3p: CP="NON DSP COR DEVa PSAa IVAo CONo OUR IND UNI PUR NAV DEM LOC", policyref="http://citi.bridgetrack.com/w3c/p3p.xml" CP="NON DSP COR DEVa PSAa IVAo CONo OUR IND UNI PUR NAV DEM LOC", policyref="http://citi.bridgetrack.com/w3c/p3p.xml"
referrer-policy: strict-origin-when-cross-origin
strict-transport-security: max-age=31536000; includeSubDomains
via: 1.1 google
x-content-type-options: nosniff
x-xss-protection: 1; mode=block

GET
H2 200 1567.js Show response
script.crazyegg.com/pages/scripts/0090/ 6 KB
2 KB 89ms
34ms Script
text/javascript 2606:4700::6813:9308
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://script.crazyegg.com/pages/scripts/0090/1567.js
Requested by: Host: banking.citi.com
URL: https://banking.citi.com/cbol/OM/checking/tiered/featured-offers/default.htm?BT_TX=1&ProspectID=326D0D64EAD743E4BE6193A917A2C7ED
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6813:9308 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 5cb0744a6ae142c18ccd21be428b918a44e556af99a328c40cb06ba5123e797c

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://banking.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Tue, 05 Dec 2023 04:52:14 GMT
content-encoding: gzip
cf-cache-status: HIT
age: 42658
cf-polished: origSize=5984
ce-version: 11.5.153
cf-bgj: minify
last-modified: Mon, 04 Dec 2023 17:01:16 GMT
server: cloudflare
vary: Accept-Encoding
content-type: text/javascript
access-control-allow-origin: *
access-control-expose-headers: CE-Version
cache-control: public, max-age=300, s-maxage=1209600
timing-allow-origin: *
cf-ray: 8309adb6b9a16722-AMS

GET
H2 200 Bootstrap.js Show response
nexus.ensighten.com/citi/na_prod/ 615 KB
143 KB 145ms
38ms Script
application/javascript 2600:9000:206f:b400:2:8f43:5780:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Requested by: Host: banking.citi.com
URL: https://banking.citi.com/cbol/OM/checking/tiered/featured-offers/default.htm?BT_TX=1&ProspectID=326D0D64EAD743E4BE6193A917A2C7ED
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:206f:b400:2:8f43:5780:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: CloudFront /
Resource Hash: 6dd5a078b24c5d9d87ca287fbe4992f0fd457fb7c700ed43cbb94cfddb3fd1a5

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://banking.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Tue, 28 Nov 2023 23:48:14 GMT
x-amz-version-id: V2ZnLmZjS8aahcGnxE8H6C16WtxEAmh5
content-encoding: br
via: 1.1 cc763905c39a59494c951c09271b0422.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-C1
age: 536641
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: PENDING
alt-svc: h3=":443"; ma=86400
last-modified: Tue, 28 Nov 2023 23:47:52 GMT
server: CloudFront
etag: W/"ae38d2d8c6f822c1d00e167a8559760c"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
cache-control: max-age=300
x-amz-cf-id: nuE2ofLtxCaXCxh7hcnDGM6Jgze8gOfYE4FqSjCudhVxWlYlaHvPrA==

GET
H3 200 main.6cc5e2d90c9584caf761.bundle.js Show response
banking.citi.com/cbol/OM/checking/tiered/featured-offers/js/ 189 KB
66 KB 132ms
132ms Script
application/javascript 35.190.22.40
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://banking.citi.com/cbol/OM/checking/tiered/featured-offers/js/main.6cc5e2d90c9584caf761.bundle.js

Requested by

Host: banking.citi.com
URL: https://banking.citi.com/cbol/OM/checking/tiered/featured-offers/default.htm?BT_TX=1&ProspectID=326D0D64EAD743E4BE6193A917A2C7ED

Protocol

Security

QUIC, , AES_128_GCM

Server

35.190.22.40 Kansas City, United States, ASN15169 (GOOGLE, US),

Reverse DNS

40.22.190.35.bc.googleusercontent.com

Software

Resource Hash

0536ba1b7856fc8a2c3fecf43e40377f3e30a3a158084069c4aeb338dd0b9ffe

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.bridgetrack.com; report-uri https://csp-reporter-ui3464xpjq-uc.a.run.app/api/csp-report/?env=prod
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://banking.citi.com/cbol/OM/checking/tiered/featured-offers/default.htm?BT_TX=1&ProspectID=326D0D64EAD743E4BE6193A917A2C7ED
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Tue, 05 Dec 2023 04:52:13 GMT
content-encoding: gzip
via: 1.1 google
content-security-policy: frame-ancestors https://*.citi.com https://*.bridgetrack.com; report-uri https://csp-reporter-ui3464xpjq-uc.a.run.app/api/csp-report/?env=prod
last-modified: Thu, 12 Oct 2023 21:17:47 GMT
referrer-policy: strict-origin-when-cross-origin
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
etag: "80cf2b8c51fdd91:0"
vary: Accept-Encoding
content-type: application/javascript
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 67492
x-xss-protection: 1; mode=block

GET
H2 200 banking.citi.com.json Show response
script.crazyegg.com/pages/data-scripts/0090/1567/site/ 7 KB
2 KB 91ms
37ms XHR
application/json 2606:4700::6813:9308
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://script.crazyegg.com/pages/data-scripts/0090/1567/site/banking.citi.com.json?t=1
Requested by: Host: script.crazyegg.com
URL: https://script.crazyegg.com/pages/scripts/0090/1567.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6813:9308 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 3ccce4810438a0542e2ce9572c0ce8a8ceae9f88f40f05e1ecb32b1562b04278

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://banking.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Tue, 05 Dec 2023 04:52:14 GMT
content-encoding: gzip
cf-cache-status: HIT
age: 16041
ce-version: 11.5.153
content-length: 1935
last-modified: Tue, 05 Dec 2023 00:24:53 GMT
server: cloudflare
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: *
access-control-expose-headers: CE-Version
cache-control: public, max-age=300, s-maxage=1209600
accept-ranges: bytes
timing-allow-origin: *
cf-ray: 8309adb74f866560-AMS

GET
H2 200 9df44f40c781bed54449cd8b7788ab5b.js Show response
script.crazyegg.com/pages/versioned/common-scripts/ 95 KB
31 KB 32ms
32ms Script
text/javascript 2606:4700::6813:9308
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://script.crazyegg.com/pages/versioned/common-scripts/9df44f40c781bed54449cd8b7788ab5b.js
Requested by: Host: script.crazyegg.com
URL: https://script.crazyegg.com/pages/scripts/0090/1567.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6813:9308 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 6f167fb91dda50241e3efeb657237e636519103b823204f7f127701bf20c8ecf

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://banking.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Tue, 05 Dec 2023 04:52:14 GMT
content-encoding: gzip
cf-cache-status: HIT
last-modified: Fri, 01 Dec 2023 10:29:22 GMT
server: cloudflare
age: 294827
vary: Accept-Encoding
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000, s-maxage=31536000
accept-ranges: bytes
timing-allow-origin: *
cf-ray: 8309adb7ca5f6722-AMS
content-length: 31878

GET
H2

200

rd Show response
dpm.demdex.net/id/
Redirect Chain

https://dpm.demdex.net/id?d_visid_ver=4.4.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=61834D9B5228A7430A490D45%40AdobeOrg&d_nsid=0&ts=1701751934675
https://dpm.demdex.net/id/rd?d_visid_ver=4.4.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=61834D9B5228A7430A490D45%40AdobeOrg&d_nsid=0&ts=1701751934675

363 B
908 B

45ms
45ms

XHR
application/json

54.73.141.201
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://dpm.demdex.net/id/rd?d_visid_ver=4.4.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=61834D9B5228A7430A490D45%40AdobeOrg&d_nsid=0&ts=1701751934675

Requested by

Host: banking.citi.com
URL: https://banking.citi.com/cbol/OM/checking/tiered/featured-offers/default.htm?BT_TX=1&ProspectID=326D0D64EAD743E4BE6193A917A2C7ED

Protocol

Server

54.73.141.201 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-54-73-141-201.eu-west-1.compute.amazonaws.com

Software

Resource Hash

779baa9baef660e39a495e550aa4fc9d42b9570b2b693b6df8f8bbbbcc073b34

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://banking.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

dcs: dcs-prod-irl1-2-v054-074d8d8ae.edge-irl1.demdex.com 1 ms
pragma: no-cache
date: Tue, 05 Dec 2023 04:52:15 GMT
strict-transport-security: max-age=31536000; includeSubDomains
content-encoding: gzip
x-tid: SWy1NJTuS3A=
vary: Origin
content-type: application/json;charset=utf-8
p3p: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
access-control-allow-origin: https://banking.citi.com
cache-control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
access-control-allow-credentials: true
content-length: 304
expires: Thu, 01 Jan 1970 00:00:00 UTC

Redirect headers

dcs: dcs-prod-irl1-1-v054-097c24447.edge-irl1.demdex.com 0 ms
pragma: no-cache
date: Tue, 05 Dec 2023 04:52:14 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-tid: Cr+06whnS7s=
vary: Origin
p3p: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
location: https://dpm.demdex.net/id/rd?d_visid_ver=4.4.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=61834D9B5228A7430A490D45%40AdobeOrg&d_nsid=0&ts=1701751934675
access-control-allow-origin: https://banking.citi.com
cache-control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
access-control-allow-credentials: true
content-length: 0
expires: Thu, 01 Jan 1970 00:00:00 UTC

GET
H2 200 0026e2283f933a40df5fc08a40e7f7701eec5ffae7215cf480eb59889d9d27de Show response
tagmanager1.citi.com/one/v1/profiles/ 990 B
893 B 166ms
70ms XHR
application/json 3.124.119.57
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tagmanager1.citi.com/one/v1/profiles/0026e2283f933a40df5fc08a40e7f7701eec5ffae7215cf480eb59889d9d27de
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 3.124.119.57 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-124-119-57.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 53b6b39640495b98726ecd077a0404135f6eb35ac18da1fcce586dc4400c43df

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://banking.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Tue, 05 Dec 2023 04:52:14 GMT
content-encoding: gzip
server: nginx
x-ens-one-is-anonymous: true
vary: Accept-Encoding
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS
content-type: application/json
access-control-allow-origin: *
access-control-expose-headers: *
access-control-allow-headers: *
x-ens-one-ttl: 1709135097
apigw-requestid: Pc_j4jy0liAEPiQ=

GET
H2 200 serverComponent.php Show response
nexus.ensighten.com/citi/na_prod/ 2 KB
1 KB 60ms
60ms Script
text/javascript 2600:9000:206f:b400:2:8f43:5780:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://nexus.ensighten.com/citi/na_prod/serverComponent.php?namespace=Bootstrapper&staticJsPath=nexus.ensighten.com/citi/na_prod/code/&publishedOn=Tue%20Nov%2028%2023:47:49%20GMT%202023&ClientID=1129&PageID=https%3A%2F%2Fbanking.citi.com%2Fcbol%2FOM%2Fchecking%2Ftiered%2Ffeatured-offers%2Fdefault.htm%3FBT_TX%3D1%26ProspectID%3D326D0D64EAD743E4BE6193A917A2C7ED
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:206f:b400:2:8f43:5780:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: CloudFront /
Resource Hash: deed8329f425061be91d6c3ac2fb6b0b2a13b678221438461b6acb31df12dda4

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://banking.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Tue, 05 Dec 2023 04:52:15 GMT
content-encoding: gzip
via: 1.1 cc763905c39a59494c951c09271b0422.cloudfront.net (CloudFront)
server: CloudFront
x-amz-cf-pop: FRA56-C1
vary: Accept-Encoding
x-cache: Miss from cloudfront
content-type: text/javascript
cache-control: no-cache, no-store
alt-svc: h3=":443"; ma=86400
x-amz-cf-id: u1gRLqgVENRyeKhd3KD-jYe31OrVoj-rL81-rmRJWj9hxqAg6CiDkA==
expires: Tue, 05 Dec 2023 04:52:14 GMT

GET
H3 200 533.2c5ff0b9d9666a88935c.bundle.js Show response
banking.citi.com/cbol/OM/checking/tiered/featured-offers/js/ 84 KB
16 KB 139ms
139ms Script
application/javascript 35.190.22.40
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://banking.citi.com/cbol/OM/checking/tiered/featured-offers/js/533.2c5ff0b9d9666a88935c.bundle.js

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

Security

QUIC, , AES_128_GCM

Server

35.190.22.40 Kansas City, United States, ASN15169 (GOOGLE, US),

Reverse DNS

40.22.190.35.bc.googleusercontent.com

Software

Resource Hash

6441565da997dbdbdf1d5ed8b26561e457f4bdbea97d5f53d03c727b7fe278c3

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.bridgetrack.com; report-uri https://csp-reporter-ui3464xpjq-uc.a.run.app/api/csp-report/?env=prod
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://banking.citi.com/cbol/OM/checking/tiered/featured-offers/default.htm?BT_TX=1&ProspectID=326D0D64EAD743E4BE6193A917A2C7ED
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Tue, 05 Dec 2023 04:52:15 GMT
content-encoding: gzip
via: 1.1 google
content-security-policy: frame-ancestors https://*.citi.com https://*.bridgetrack.com; report-uri https://csp-reporter-ui3464xpjq-uc.a.run.app/api/csp-report/?env=prod
last-modified: Thu, 12 Oct 2023 21:17:47 GMT
referrer-policy: strict-origin-when-cross-origin
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
etag: "80cf2b8c51fdd91:0"
vary: Accept-Encoding
content-type: application/javascript
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 16786
x-xss-protection: 1; mode=block

GET
H3 200 775.3964d622f568f2b1db59.bundle.js Show response
banking.citi.com/cbol/OM/checking/tiered/featured-offers/js/ 19 KB
6 KB 134ms
134ms Script
application/javascript 35.190.22.40
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://banking.citi.com/cbol/OM/checking/tiered/featured-offers/js/775.3964d622f568f2b1db59.bundle.js

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

Security

QUIC, , AES_128_GCM

Server

35.190.22.40 Kansas City, United States, ASN15169 (GOOGLE, US),

Reverse DNS

40.22.190.35.bc.googleusercontent.com

Software

Resource Hash

96d2de06ab91b481fa1410e1f4e245a86d60b496c32145dc8dcb059d3ca34523

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.bridgetrack.com; report-uri https://csp-reporter-ui3464xpjq-uc.a.run.app/api/csp-report/?env=prod
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://banking.citi.com/cbol/OM/checking/tiered/featured-offers/default.htm?BT_TX=1&ProspectID=326D0D64EAD743E4BE6193A917A2C7ED
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Tue, 05 Dec 2023 04:52:14 GMT
content-encoding: gzip
via: 1.1 google
content-security-policy: frame-ancestors https://*.citi.com https://*.bridgetrack.com; report-uri https://csp-reporter-ui3464xpjq-uc.a.run.app/api/csp-report/?env=prod
last-modified: Tue, 15 Aug 2023 18:51:28 GMT
referrer-policy: strict-origin-when-cross-origin
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
etag: "038857fa9cfd91:0"
vary: Accept-Encoding
content-type: application/javascript
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 5980
x-xss-protection: 1; mode=block

GET
H3 200 476.e3a77f8c10fb7cfe4bd0.bundle.js Show response
banking.citi.com/cbol/OM/checking/tiered/featured-offers/js/ 21 KB
7 KB 131ms
130ms Script
application/javascript 35.190.22.40
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://banking.citi.com/cbol/OM/checking/tiered/featured-offers/js/476.e3a77f8c10fb7cfe4bd0.bundle.js

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

Security

QUIC, , AES_128_GCM

Server

35.190.22.40 Kansas City, United States, ASN15169 (GOOGLE, US),

Reverse DNS

40.22.190.35.bc.googleusercontent.com

Software

Resource Hash

0a40bd4fb31d93b2a831a50eb0f96a73131ea5672b61afa7d21eebb15e88925f

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.bridgetrack.com; report-uri https://csp-reporter-ui3464xpjq-uc.a.run.app/api/csp-report/?env=prod
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://banking.citi.com/cbol/OM/checking/tiered/featured-offers/default.htm?BT_TX=1&ProspectID=326D0D64EAD743E4BE6193A917A2C7ED
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Tue, 05 Dec 2023 04:52:15 GMT
content-encoding: gzip
via: 1.1 google
content-security-policy: frame-ancestors https://*.citi.com https://*.bridgetrack.com; report-uri https://csp-reporter-ui3464xpjq-uc.a.run.app/api/csp-report/?env=prod
last-modified: Mon, 02 Oct 2023 17:42:28 GMT
referrer-policy: strict-origin-when-cross-origin
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
etag: "05ab7cf57f5d91:0"
vary: Accept-Encoding
content-type: application/javascript
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 7206
x-xss-protection: 1; mode=block

GET
H3 200 4.22c3c05643699c96281b.bundle.js Show response
banking.citi.com/cbol/OM/checking/tiered/featured-offers/js/ 33 KB
10 KB 135ms
135ms Script
application/javascript 35.190.22.40
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://banking.citi.com/cbol/OM/checking/tiered/featured-offers/js/4.22c3c05643699c96281b.bundle.js

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

Security

QUIC, , AES_128_GCM

Server

35.190.22.40 Kansas City, United States, ASN15169 (GOOGLE, US),

Reverse DNS

40.22.190.35.bc.googleusercontent.com

Software

Resource Hash

bac45e872102a5a0b7fc497f803585d15e36dce152cb94dd78d353dcd4fc7b6a

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.bridgetrack.com; report-uri https://csp-reporter-ui3464xpjq-uc.a.run.app/api/csp-report/?env=prod
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://banking.citi.com/cbol/OM/checking/tiered/featured-offers/default.htm?BT_TX=1&ProspectID=326D0D64EAD743E4BE6193A917A2C7ED
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Tue, 05 Dec 2023 04:52:15 GMT
content-encoding: gzip
via: 1.1 google
content-security-policy: frame-ancestors https://*.citi.com https://*.bridgetrack.com; report-uri https://csp-reporter-ui3464xpjq-uc.a.run.app/api/csp-report/?env=prod
last-modified: Tue, 15 Aug 2023 19:07:43 GMT
referrer-policy: strict-origin-when-cross-origin
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
etag: "8069aac4abcfd91:0"
vary: Accept-Encoding
content-type: application/javascript
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 9728
x-xss-protection: 1; mode=block

GET
H2 204 r.rnc
data.privacy.ensighten.com/privacy/v1/b/ 0
106 B 131ms
33ms Image
text/plain 3.124.119.57
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://data.privacy.ensighten.com/privacy/v1/b/r.rnc?n=0&c=1129&i=6ot4yv&p=na_prod&s=354&d=8HB7InZlcnNpb24iOiIxLjAuMCIsImdhdGV3YXkiOiIyLjMuNjExIiwiY2xpZW50SWQiOjExMjksInB1Ymxpc2hQYXRoIjoibmFfcHJvZCIsImluc3RhbmNlSWQiOiI2b3Q0eXYiLCJwYWNrZXQiOjAsIm1vZGUiOiJlbmZvcmNlWgDwCG9va2llcyI6eyJCQU5ORVJfTE9BREVEkQDyJyJ9LCJlbnZpcm9ubWVudCI6IkNCT0wgUHJpdmFjeSIsInJlcXVlc3RzIjpbeyJkZXN0aW5hdM4A8BkiLCJ0eXBlIjoiYmlsbGluZyIsInN0YXJ0IjoxNzAxNzUxOTM1MDMwYgDAZCI6LTEsInNvdXJjMgACKwBhdHVzIjoiZgBAYXNvbmUA1F0sImRhdGFQYXR0ZXISALBsaXN0IjpbXSwiaSAB8AA3MDE3NTE5MzUwMzB9XX0
Requested by: Host: banking.citi.com
URL: https://banking.citi.com/cbol/OM/checking/tiered/featured-offers/default.htm?BT_TX=1&ProspectID=326D0D64EAD743E4BE6193A917A2C7ED
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 3.124.119.57 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-124-119-57.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://banking.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Tue, 05 Dec 2023 04:52:15 GMT
cache-control: no-cache, no-store
server: nginx
expires: Tue, 05 Dec 2023 04:52:14 GMT

GET
H2 204 r.rnc
data.privacy.ensighten.com/privacy/v1/c/ 0
107 B 128ms
32ms Image
text/plain 3.124.119.57
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://data.privacy.ensighten.com/privacy/v1/c/r.rnc?n=0&c=1129&i=8fj254&p=na_prod&s=381&d=9Cd7InZlcnNpb24iOiIxLjAuMCIsImdhdGV3YXkiOiIyLjMuNjExIiwiY2xpZW50SWQiOjExMjkQAPAaTmFtZSI6ImNpdGkiLCJwdWJsaXNoUGF0aCI6Im5hX3Byb2QiLCJtb2QmAJBibGFja2xpc3RPAPAfb29raWVzIjp7IkNJVElfRU5TSUdIVEVOX1BSSVZBQ1lfQkFOTkVSX0xPQURFRJ0A8Q8ifSwiZHQiOjE3MDE3NTE5MzUwMzQsInNldHRpbmdLAPEqbW9kYWwiOiJlbnRlcnByaXNlIiwiZW52aXJvbm1lbnQiOiJDQk9MIFByaXZhY3kiLCJkZWZhdWx0PgD0CFBlcmZvcm1hbmNlLUFuYWx5dGljcyBDqgD5CDEsIkVzc2VudGlhbC1GdW5jdGlvbmFsIQDwAkFkdmVydGlzaW5nLVRhcmdlmwAHIgDwAH19LCJldmVudHMiOltdfQ
Requested by: Host: banking.citi.com
URL: https://banking.citi.com/cbol/OM/checking/tiered/featured-offers/default.htm?BT_TX=1&ProspectID=326D0D64EAD743E4BE6193A917A2C7ED
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 3.124.119.57 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-124-119-57.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://banking.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Tue, 05 Dec 2023 04:52:15 GMT
cache-control: no-cache, no-store
server: nginx
expires: Tue, 05 Dec 2023 04:52:14 GMT

GET
H2 200 banking.citi.com.json Show response
script.crazyegg.com/pages/data-scripts/0090/1567/sampling/ Frame B164 154 B
260 B 34ms
34ms XHR
application/json 2606:4700::6813:9308
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://script.crazyegg.com/pages/data-scripts/0090/1567/sampling/banking.citi.com.json?t=472708
Requested by: Host: script.crazyegg.com
URL: https://script.crazyegg.com/pages/versioned/common-scripts/9df44f40c781bed54449cd8b7788ab5b.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6813:9308 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 270582fd72e8c2ee580f267aa9d0fcd5424922670026acae16b41bfe55c44fe7

Request headers

accept-language: nl-NL,nl;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Tue, 05 Dec 2023 04:52:15 GMT
content-encoding: gzip
cf-cache-status: HIT
age: 28090
ce-version: 11.5.153
content-length: 144
last-modified: Mon, 04 Dec 2023 21:04:05 GMT
server: cloudflare
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: *
access-control-expose-headers: CE-Version
cache-control: public, max-age=300, s-maxage=1209600
accept-ranges: bytes
timing-allow-origin: *
cf-ray: 8309adba29d66560-AMS

GET
H3 200 93935a4096516447172d9d3f1d23710d.js Show response
nexus.ensighten.com/citi/na_prod/code/ 1 KB
912 B 35ms
34ms Script
application/javascript 2600:9000:206f:b400:2:8f43:5780:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://nexus.ensighten.com/citi/na_prod/code/93935a4096516447172d9d3f1d23710d.js?conditionId0=433072
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2600:9000:206f:b400:2:8f43:5780:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: CloudFront /
Resource Hash: f071110e088267097a0946520a2a08bd589f971f3ce4cb989feda1415026ac49

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://banking.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Tue, 26 Sep 2023 04:39:10 GMT
x-amz-version-id: .9Yu1fA6u9LpETfeDT0_cOHllcbsIoL2
content-encoding: br
via: 1.1 cc763905c39a59494c951c09271b0422.cloudfront.net (CloudFront)
age: 6048786
x-amz-cf-pop: FRA56-C1
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
alt-svc: h3=":443"; ma=86400
last-modified: Tue, 20 Jul 2021 20:01:11 GMT
server: CloudFront
etag: W/"22035994ea9f0b167d391afd37705f26"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
cache-control: max-age=315360000
x-amz-cf-id: HKSQcqdoBjau2_soeTaGsFBfshK7yNqE_CLFjIEcUopd2g13dNS2qQ==

GET
H3 200 7c8ae1f9c206930028672949c6703f6d.js Show response
nexus.ensighten.com/citi/na_prod/code/ 2 KB
1 KB 33ms
33ms Script
application/javascript 2600:9000:206f:b400:2:8f43:5780:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://nexus.ensighten.com/citi/na_prod/code/7c8ae1f9c206930028672949c6703f6d.js?conditionId0=4849963
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2600:9000:206f:b400:2:8f43:5780:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: CloudFront /
Resource Hash: 9a74546a8f511f31b5252f115d2db7aa69370ca5eeaf6828f60abb197f35a169

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://banking.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Thu, 12 Oct 2023 16:46:56 GMT
x-amz-version-id: fn0OQIG24n9jjHSfN2OozphT08M6eW_x
content-encoding: br
via: 1.1 cc763905c39a59494c951c09271b0422.cloudfront.net (CloudFront)
age: 4622720
x-amz-cf-pop: FRA56-C1
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
alt-svc: h3=":443"; ma=86400
last-modified: Tue, 18 Oct 2022 17:52:59 GMT
server: CloudFront
etag: W/"7df0440e45009010a99db868682aafb3"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
cache-control: max-age=315360000
x-amz-cf-id: FKcSJaC-1VNOd2z12co-fiV7SXrQRhAasUulQ8_Mh-ls8nMsWiD11g==

GET
H3 200 8df354027bf584555339e7ab4e3a74f7.js Show response
nexus.ensighten.com/citi/na_prod/code/ 3 KB
1 KB 36ms
36ms Script
application/javascript 2600:9000:206f:b400:2:8f43:5780:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://nexus.ensighten.com/citi/na_prod/code/8df354027bf584555339e7ab4e3a74f7.js?conditionId0=4953721
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2600:9000:206f:b400:2:8f43:5780:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: CloudFront /
Resource Hash: 6b00314574d978730478a30416dc243901188049309459daa1a0250fd1508752

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://banking.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Tue, 28 Nov 2023 21:55:25 GMT
x-amz-version-id: C7mpJ7asIBWYIPBhW1pmvcdx7m_AQ1uh
content-encoding: br
via: 1.1 cc763905c39a59494c951c09271b0422.cloudfront.net (CloudFront)
age: 543411
x-amz-cf-pop: FRA56-C1
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
alt-svc: h3=":443"; ma=86400
last-modified: Tue, 28 Nov 2023 21:25:53 GMT
server: CloudFront
etag: W/"b0744ae07e67377dcbeebf0f90532287"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
cache-control: max-age=315360000
x-amz-cf-id: R6WpfYw71kPwYcL9Xl3JItJF4Y43RqfCCnpNIWzFnC5vzWRf-_hlGg==

GET
H3 200 f0db1cf4496c8b42c5a1b2fa40b4f157.js Show response
nexus.ensighten.com/citi/na_prod/code/ 5 KB
2 KB 36ms
36ms Script
application/javascript 2600:9000:206f:b400:2:8f43:5780:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://nexus.ensighten.com/citi/na_prod/code/f0db1cf4496c8b42c5a1b2fa40b4f157.js?conditionId0=4897099
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2600:9000:206f:b400:2:8f43:5780:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: CloudFront /
Resource Hash: 13a59cfac1785dd94d0005457ed1e12cf77fee65b975fe6fd91af77b7ac6cd77

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://banking.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 06 Nov 2023 18:29:35 GMT
x-amz-version-id: _NJEt9Au7TfYHRltPN9x_4PZSTxTzbkJ
content-encoding: br
via: 1.1 cc763905c39a59494c951c09271b0422.cloudfront.net (CloudFront)
age: 2456561
x-amz-cf-pop: FRA56-C1
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
alt-svc: h3=":443"; ma=86400
last-modified: Wed, 02 Aug 2023 16:06:47 GMT
server: CloudFront
etag: W/"f21df27f4d3e67ca5151a737dacd6837"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
cache-control: max-age=315360000
x-amz-cf-id: 5kUFC_t3Quro3XsOThZSx9YLy0NYYWmQI-_vhshgIyjNW_PZEj58vQ==

GET
H3 200 c65a3609e1beed72955b88afac8cd31d.js Show response
nexus.ensighten.com/citi/na_prod/code/ 2 KB
1 KB 35ms
34ms Script
application/javascript 2600:9000:206f:b400:2:8f43:5780:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://nexus.ensighten.com/citi/na_prod/code/c65a3609e1beed72955b88afac8cd31d.js?conditionId0=480881
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2600:9000:206f:b400:2:8f43:5780:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: CloudFront /
Resource Hash: 686eb5d7c927dd741ef72adda5c719b478d36f1e29520ee16d5121854c174b10

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://banking.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Sun, 08 Oct 2023 08:14:56 GMT
x-amz-version-id: wXRQEmBG4QJsg2TZDdHUFOaVLJIZHKhf
content-encoding: br
via: 1.1 cc763905c39a59494c951c09271b0422.cloudfront.net (CloudFront)
age: 4999040
x-amz-cf-pop: FRA56-C1
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
alt-svc: h3=":443"; ma=86400
last-modified: Thu, 15 Dec 2022 04:55:25 GMT
server: CloudFront
etag: W/"e9bda8e342fda2a02ffa59c9064942d8"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
cache-control: max-age=315360000
x-amz-cf-id: ZLeHdzZYZjymkrv_wlvs2EpLOjM9di9kiAc1648lqn4RAjUO26s7vQ==

GET
H3 200 1be07aaf2c6e9c0300c3e907e304bb97.js Show response
nexus.ensighten.com/citi/na_prod/code/ 438 KB
49 KB 39ms
38ms Script
application/javascript 2600:9000:206f:b400:2:8f43:5780:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://nexus.ensighten.com/citi/na_prod/code/1be07aaf2c6e9c0300c3e907e304bb97.js?conditionId0=421908
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2600:9000:206f:b400:2:8f43:5780:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: CloudFront /
Resource Hash: 6b2072bf88cef02065acb1e2fb1efcf0132d0b0905e279e8da291d9ecf84f4b6

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://banking.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Tue, 28 Nov 2023 23:47:59 GMT
x-amz-version-id: KYZTxfCuV4A209jq4oauihwd6td7.cKl
content-encoding: br
via: 1.1 cc763905c39a59494c951c09271b0422.cloudfront.net (CloudFront)
age: 536657
x-amz-cf-pop: FRA56-C1
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: PENDING
alt-svc: h3=":443"; ma=86400
last-modified: Tue, 28 Nov 2023 23:47:52 GMT
server: CloudFront
etag: W/"6b052f601ceed979371fb6663543c90a"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
cache-control: max-age=315360000
x-amz-cf-id: EPIZYAy3wRmeCHFnfNAWwtme1eezg_C9Bh5km1_KmF-ZN3pICAyKtw==

GET
H3 200 a9607bbeb2e6e06c07801d4745900799.js Show response
nexus.ensighten.com/citi/na_prod/code/ 23 KB
5 KB 37ms
37ms Script
application/javascript 2600:9000:206f:b400:2:8f43:5780:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://nexus.ensighten.com/citi/na_prod/code/a9607bbeb2e6e06c07801d4745900799.js?conditionId0=486757
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2600:9000:206f:b400:2:8f43:5780:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: CloudFront /
Resource Hash: 3556b4fa28a41290454dc84939dae439fcf5bda8a1eac70efdf2647bf041d43d

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://banking.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Thu, 12 Oct 2023 16:46:56 GMT
x-amz-version-id: TUtp2N9e.3Mq3kFsEinWRYvNz9Zemh3C
content-encoding: br
via: 1.1 cc763905c39a59494c951c09271b0422.cloudfront.net (CloudFront)
age: 4622720
x-amz-cf-pop: FRA56-C1
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
alt-svc: h3=":443"; ma=86400
last-modified: Tue, 19 Sep 2023 17:48:03 GMT
server: CloudFront
etag: W/"e4e9e801aca9bba5a66c95552720097c"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
cache-control: max-age=315360000
x-amz-cf-id: ng3UNIZ0T-dcUTLTfJ8Bz-iXAmkdYnsi8pPtwVMTiQES638OxPKGVg==

GET
H3 200 f120449dcdb84c3b6d0f58c8b98ad8a3.js Show response
nexus.ensighten.com/citi/na_prod/code/ 24 KB
6 KB 36ms
36ms Script
application/javascript 2600:9000:206f:b400:2:8f43:5780:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://nexus.ensighten.com/citi/na_prod/code/f120449dcdb84c3b6d0f58c8b98ad8a3.js?conditionId0=467299
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2600:9000:206f:b400:2:8f43:5780:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: CloudFront /
Resource Hash: bf39c7a23da56a09d7fba494ab7a46604dc02a19fabfaf8d4c3ab6629aad0692

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://banking.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Tue, 19 Sep 2023 17:48:16 GMT
x-amz-version-id: nWKpv6NjQeNKdUj5cLa_yhYRraA7P2n3
content-encoding: br
via: 1.1 cc763905c39a59494c951c09271b0422.cloudfront.net (CloudFront)
age: 6606240
x-amz-cf-pop: FRA56-C1
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: PENDING
alt-svc: h3=":443"; ma=86400
last-modified: Tue, 19 Sep 2023 17:48:03 GMT
server: CloudFront
etag: W/"79a1f615128893a73faf5e48cfd01107"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
cache-control: max-age=315360000
x-amz-cf-id: B9N4dcfxFnXIRM6nTOsUHScNLb8kSpv_pKLipmCryLTBhMOPviKglA==

GET
H3 200 501175129083d695b433d40e43dcf4dd.js Show response
nexus.ensighten.com/citi/na_prod/code/ 1 KB
973 B 37ms
37ms Script
application/javascript 2600:9000:206f:b400:2:8f43:5780:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://nexus.ensighten.com/citi/na_prod/code/501175129083d695b433d40e43dcf4dd.js?conditionId0=4951300
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2600:9000:206f:b400:2:8f43:5780:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: CloudFront /
Resource Hash: 7337d0aa06e2a7d2555a60936c9243f8f93c24dcd64e064d0181e6790294607b

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://banking.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 06 Nov 2023 18:29:35 GMT
x-amz-version-id: LXNmF0WWctVwrG36aJ.jkMTI8bp3KIhL
content-encoding: br
via: 1.1 cc763905c39a59494c951c09271b0422.cloudfront.net (CloudFront)
age: 2456561
x-amz-cf-pop: FRA56-C1
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
alt-svc: h3=":443"; ma=86400
last-modified: Tue, 25 Jul 2023 19:27:55 GMT
server: CloudFront
etag: W/"4355ffb7776a87cb3f6308e895da7ddd"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
cache-control: max-age=315360000
x-amz-cf-id: hh1kwHRYxZqNicsn4w6PXKCJQ65QCUL7k6X0PAwoKvdyw0XsxIEH1A==

GET
H3 200 e6b9fe1f920efcc9ea8e7e604b897c8c.js Show response
nexus.ensighten.com/citi/na_prod/code/ 321 B
738 B 39ms
38ms Script
application/javascript 2600:9000:206f:b400:2:8f43:5780:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://nexus.ensighten.com/citi/na_prod/code/e6b9fe1f920efcc9ea8e7e604b897c8c.js?conditionId0=3013337
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2600:9000:206f:b400:2:8f43:5780:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: CloudFront /
Resource Hash: 1c34a537ea8a62cb24c782a11aaf49c1cbd671e5d264d81c6732e2338e05d2af

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://banking.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Tue, 10 Oct 2023 18:47:03 GMT
x-amz-version-id: vaBGtucfcpfHvM_CMxnO.fJKgerOHEtE
via: 1.1 cc763905c39a59494c951c09271b0422.cloudfront.net (CloudFront)
age: 4788313
x-amz-cf-pop: FRA56-C1
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
alt-svc: h3=":443"; ma=86400
content-length: 321
last-modified: Thu, 03 Aug 2023 21:05:53 GMT
server: CloudFront
etag: "31ca559990bbe8a9a1b2319b45c0f49b"
content-type: application/javascript; charset=utf-8
cache-control: max-age=315360000
accept-ranges: bytes
x-amz-cf-id: BVsRr0i67_ZMGULczeiMGfyAeZdRwFHUAqqlA3RTXdDfm5cIFl3m2w==

GET
H3 200 7349fcb852dc064a78ef55e132b72441.js Show response
nexus.ensighten.com/citi/na_prod/code/ 340 B
757 B 39ms
39ms Script
application/javascript 2600:9000:206f:b400:2:8f43:5780:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://nexus.ensighten.com/citi/na_prod/code/7349fcb852dc064a78ef55e132b72441.js?conditionId0=4906371
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2600:9000:206f:b400:2:8f43:5780:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: CloudFront /
Resource Hash: ea9362709bbb4d2ac09a1b684fa0276e535b8b2a2809e27ad46c3def2dae1850

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://banking.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 06 Nov 2023 18:29:35 GMT
x-amz-version-id: Su8ds1Rr4g_xlQQNcgVgERL8egfTi_hX
via: 1.1 cc763905c39a59494c951c09271b0422.cloudfront.net (CloudFront)
age: 2456561
x-amz-cf-pop: FRA56-C1
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
alt-svc: h3=":443"; ma=86400
content-length: 340
last-modified: Wed, 08 Mar 2023 15:45:15 GMT
server: CloudFront
etag: "8990a8a1b012a959f263cdd1fac2ede3"
content-type: application/javascript; charset=utf-8
cache-control: max-age=315360000
accept-ranges: bytes
x-amz-cf-id: UpLwZnXNZe76F9XTzqOryTi83vvag2WC0slXvW5mqRAIIXbZMNd9uA==

GET
H2 200 dest5.html Show response
citi.demdex.net/ Frame 6282 7 KB
3 KB 54ms
43ms Document
text/html 54.73.141.201
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://citi.demdex.net/dest5.html?d_nsid=0

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

54.73.141.201 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-54-73-141-201.eu-west-1.compute.amazonaws.com

Software

Resource Hash

7bea17a80a61ed0f54248b4ffc4c718f7c8ff2619742577a73591d62ce074da8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://banking.citi.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
accept-language: nl-NL,nl;q=0.9

Response headers

accept-ranges: bytes
cache-control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
content-encoding: gzip
content-type: text/html;charset=UTF-8
date: Tue, 05 Dec 2023 04:52:15 GMT
dcs: dcs-prod-irl1-1-v054-074995c50.edge-irl1.demdex.com 0 ms
expires: Thu, 01 Jan 1970 00:00:00 UTC
last-modified: Wed, 8 Nov 2023 20:59:58 GMT
p3p: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
pragma: no-cache
strict-transport-security: max-age=31536000; includeSubDomains
vary: accept-encoding
x-tid: diSMDJ3qSNY=

GET
H2 200 id Show response
metrics1.citi.com/ 48 B
462 B 162ms
43ms XHR
application/x-javascript 63.140.62.164
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://metrics1.citi.com/id?d_visid_ver=4.4.0&d_fieldgroup=A&mcorgid=61834D9B5228A7430A490D45%40AdobeOrg&mid=49306057246851361484453144149901745241&ts=1701751935084

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

63.140.62.164 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ip-63-140-62-164.data.adobedc.net

Software

jag /

Resource Hash

306ad7d7f5fd01c56a1f8854b938feeaf79dc278e2e215440565b5034aa32762

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://banking.citi.com/
accept-language: nl-NL,nl;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

date: Tue, 05 Dec 2023 04:52:15 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
server: jag
vary: Origin
content-type: application/x-javascript;charset=utf-8
access-control-allow-origin: https://banking.citi.com
p3p: CP="This is not a P3P policy"
cache-control: no-cache, no-store, max-age=0, no-transform, private
access-control-allow-credentials: true
content-length: 48
x-xss-protection: 1; mode=block

GET
H2

200

ibs:dpid=411&dpuuid=ZW6sfwAAAB7hBAN-
dpm.demdex.net/
Redirect Chain

https://cm.everesttech.net/cm/dd?d_uuid=56065922481724643113778279548108056058
https://dpm.demdex.net/ibs:dpid=411&dpuuid=ZW6sfwAAAB7hBAN-

42 B
717 B

45ms
45ms

Image
image/gif

54.73.141.201
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dpm.demdex.net/ibs:dpid=411&dpuuid=ZW6sfwAAAB7hBAN-

Requested by

Host: banking.citi.com
URL: https://banking.citi.com/cbol/OM/checking/tiered/featured-offers/default.htm?BT_TX=1&ProspectID=326D0D64EAD743E4BE6193A917A2C7ED

Protocol

Server

54.73.141.201 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-54-73-141-201.eu-west-1.compute.amazonaws.com

Software

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://banking.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

dcs: dcs-prod-irl1-2-v054-0c81d9436.edge-irl1.demdex.com 2 ms
pragma: no-cache
date: Tue, 05 Dec 2023 04:52:15 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
content-encoding: gzip
x-tid: pCTvdxq6ST0=
content-type: image/gif
p3p: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
cache-control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
content-length: 59
expires: Thu, 01 Jan 1970 00:00:00 UTC

Redirect headers

Location: https://dpm.demdex.net/ibs:dpid=411&dpuuid=ZW6sfwAAAB7hBAN-
Date: Tue, 05 Dec 2023 04:52:15 GMT
Cache-Control: no-cache
Server: AMO-cookiemap/1.1
Connection: keep-alive
Content-Length: 0
P3P: CP="NOI NID DEVa PSAa PSDa OUR IND PUR COM NAV INT DEM"

GET
H2 200 healthcheck Show response
pagestates-tracking.crazyegg.com/ Frame B164 19 B
470 B 107ms
36ms XHR
application/json 18.66.248.26
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://pagestates-tracking.crazyegg.com/healthcheck
Requested by: Host: script.crazyegg.com
URL: https://script.crazyegg.com/pages/versioned/common-scripts/9df44f40c781bed54449cd8b7788ab5b.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.66.248.26 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-66-248-26.dus51.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 830e67bda2532cd5880ee86e3b33e69721082f8458bb0df0cd4edbb1577fd375

Request headers

accept-language: nl-NL,nl;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Wed, 20 Sep 2023 01:43:28 GMT
via: 1.1 1f16598f51b4c33e5f56e49ea72a6154.cloudfront.net (CloudFront)
x-amz-cf-pop: DUS51-P1
age: 6577728
x-cache: Hit from cloudfront
content-length: 19
last-modified: Fri, 08 Jul 2022 22:25:51 GMT
server: AmazonS3
etag: "d06f04fccf68d0b228a5923187ce1afd"
access-control-max-age: 31536000
access-control-allow-methods: GET, HEAD
content-type: application/json
access-control-allow-origin: *
access-control-expose-headers: Access-Control-Allow-Origin
accept-ranges: bytes
x-amz-cf-id: cypnrcYwk_fC35rqRWQoL2QW-G0s3nZlG0uTufDj4KE5N01iJpLnCA==

GET
H2 200 healthcheck Show response
assets-tracking.crazyegg.com/ Frame B164 19 B
461 B 98ms
32ms XHR
application/json 18.66.122.45
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://assets-tracking.crazyegg.com/healthcheck
Requested by: Host: script.crazyegg.com
URL: https://script.crazyegg.com/pages/versioned/common-scripts/9df44f40c781bed54449cd8b7788ab5b.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.66.122.45 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-66-122-45.fra60.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 830e67bda2532cd5880ee86e3b33e69721082f8458bb0df0cd4edbb1577fd375

Request headers

accept-language: nl-NL,nl;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Sat, 19 Aug 2023 04:00:49 GMT
via: 1.1 2816426ad1adbedbdd23d4cdf80c2de2.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA60-P2
age: 9334287
x-cache: Hit from cloudfront
content-length: 19
last-modified: Fri, 08 Jul 2022 22:25:51 GMT
server: AmazonS3
etag: "d06f04fccf68d0b228a5923187ce1afd"
access-control-max-age: 31536000
access-control-allow-methods: GET, HEAD
content-type: application/json
access-control-allow-origin: *
access-control-expose-headers: Access-Control-Allow-Origin
accept-ranges: bytes
x-amz-cf-id: vNTziy6ieKgw-qIPaPezWv-Aa41AKgTrwHINeuAMRdeCN6QPcyrt8A==

GET
BLOB 200
OK 31ba6494-c217-4132-9608-7430b11feb9a
https://banking.citi.com/ 45 B
0 Other
text/javascript

General

Check archive.org

Show headers Download Go to

Full URL: blob:https://banking.citi.com/31ba6494-c217-4132-9608-7430b11feb9a
Requested by: Host: banking.citi.com
URL: https://banking.citi.com/cbol/OM/checking/tiered/featured-offers/default.htm?BT_TX=1&ProspectID=326D0D64EAD743E4BE6193A917A2C7ED
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 86551808dbfbf8bc9b23ab3d0725794c2e1f2b4265c96715f2945638160edc2b

Request headers

accept-language: nl-NL,nl;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

Content-Length: 45
Content-Type: text/javascript

GET
H2 200 tc.min.js Show response
c1.rfihub.net/js/ 19 KB
6 KB 145ms
42ms Script
application/x-javascript 2600:9000:224a:fa00:1:76cf:fe80:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c1.rfihub.net/js/tc.min.js
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:224a:fa00:1:76cf:fe80:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: Jetty(9.4.51.v20230217) /
Resource Hash: 7ef97b12890fc6fee67f869c6e1f74b6719de7d66ac0d649c8d7386a80b4c30f

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://banking.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Tue, 05 Dec 2023 04:10:35 GMT
content-encoding: gzip
via: 1.1 ed18d8ae19db26837eda53bbf8f03c08.cloudfront.net (CloudFront)
last-modified: Tue, 05 Dec 2023 04:10:25 GMT
server: Jetty(9.4.51.v20230217)
x-amz-cf-pop: DUS51-P1
age: 2500
x-cache: Hit from cloudfront
content-type: application/x-javascript
p3p: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
cache-control: public, max-age=3600
content-length: 6162
x-amz-cf-id: ctlkKdEXG4UwovhP-TxSe6qlteBEI84m7KMXge313_Yr0YLZePjs5A==
expires: Tue, 05 Dec 2023 05:10:35 GMT

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 180 KB
66 KB 199ms
74ms Script
application/javascript 2a00:1450:4001:80f::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=DC-6260004

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

f2667114758b49aeb3fe623efe7be3272d67a65f8ed36ec5d0afd2ee6886fb50

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://banking.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Tue, 05 Dec 2023 04:52:15 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 67460
x-xss-protection: 0
last-modified: Tue, 05 Dec 2023 03:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Tue, 05 Dec 2023 04:52:15 GMT

GET
H2 200 detector-dom.min.js Show response
cdn.gbqofs.com/citi-na-prod/p/ 493 KB
148 KB 97ms
33ms Script
application/javascript 2606:4700::6812:190d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.gbqofs.com/citi-na-prod/p/detector-dom.min.js
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:190d , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 951e71b9c55c57d430c507899d10d5ee1b6479e4d5ad826d6d5f18382008d934

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://banking.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Tue, 05 Dec 2023 04:52:15 GMT
x-amz-version-id: C07fEK0C2D5tpBxCHINy5JZodT1XEv3e
content-encoding: gzip
cf-cache-status: HIT
via: 1.1 9929448596fb4faec2a082aabe759212.cloudfront.net (CloudFront)
x-amz-cf-pop: AMS58-P1
age: 2216
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
last-modified: Tue, 07 Nov 2023 04:23:04 GMT
server: cloudflare
etag: W/"e7d85a7f506aadac424e30e46a385bc2"
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=14400
cf-ray: 8309adbae9ae773c-AMS
x-amz-cf-id: oiiZmCbUp5VTEJkwVz_VKiXDtp8RDjR3VhKG6kp9O2Koku0fZx7VGw==
expires: Tue, 05 Dec 2023 08:52:15 GMT

GET
H3 200 51.a3183199219e7d33742c.bundle.js Show response
banking.citi.com/cbol/OM/checking/tiered/featured-offers/js/ 121 KB
40 KB 147ms
147ms Script
application/javascript 35.190.22.40
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://banking.citi.com/cbol/OM/checking/tiered/featured-offers/js/51.a3183199219e7d33742c.bundle.js

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

Security

QUIC, , AES_128_GCM

Server

35.190.22.40 Kansas City, United States, ASN15169 (GOOGLE, US),

Reverse DNS

40.22.190.35.bc.googleusercontent.com

Software

Resource Hash

ccd3fac575dcd761bba85736d31f2f87805852ef256efec11464f502b247bd6c

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.bridgetrack.com; report-uri https://csp-reporter-ui3464xpjq-uc.a.run.app/api/csp-report/?env=prod
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://banking.citi.com/cbol/OM/checking/tiered/featured-offers/default.htm?BT_TX=1&ProspectID=326D0D64EAD743E4BE6193A917A2C7ED
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Tue, 05 Dec 2023 04:52:15 GMT
content-encoding: gzip
via: 1.1 google
content-security-policy: frame-ancestors https://*.citi.com https://*.bridgetrack.com; report-uri https://csp-reporter-ui3464xpjq-uc.a.run.app/api/csp-report/?env=prod
last-modified: Mon, 18 Sep 2023 17:42:35 GMT
referrer-policy: strict-origin-when-cross-origin
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
etag: "80f71a8257ead91:0"
vary: Accept-Encoding
content-type: application/javascript
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 41225
x-xss-protection: 1; mode=block

GET
H3 200 278.0067645e806ead6081db.bundle.js Show response
banking.citi.com/cbol/OM/checking/tiered/featured-offers/js/ 342 KB
67 KB 160ms
160ms Script
application/javascript 35.190.22.40
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://banking.citi.com/cbol/OM/checking/tiered/featured-offers/js/278.0067645e806ead6081db.bundle.js

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

Security

QUIC, , AES_128_GCM

Server

35.190.22.40 Kansas City, United States, ASN15169 (GOOGLE, US),

Reverse DNS

40.22.190.35.bc.googleusercontent.com

Software

Resource Hash

e18c255ce0e35cbf2fbdc9c9cb584d8259462d3dd3592e8cab6b74f41b55bcbf

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.bridgetrack.com; report-uri https://csp-reporter-ui3464xpjq-uc.a.run.app/api/csp-report/?env=prod
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://banking.citi.com/cbol/OM/checking/tiered/featured-offers/default.htm?BT_TX=1&ProspectID=326D0D64EAD743E4BE6193A917A2C7ED
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Tue, 05 Dec 2023 04:52:14 GMT
content-encoding: gzip
via: 1.1 google
content-security-policy: frame-ancestors https://*.citi.com https://*.bridgetrack.com; report-uri https://csp-reporter-ui3464xpjq-uc.a.run.app/api/csp-report/?env=prod
last-modified: Mon, 25 Sep 2023 18:52:12 GMT
referrer-policy: strict-origin-when-cross-origin
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
etag: "0d6ae64e1efd91:0"
vary: Accept-Encoding
content-type: application/javascript
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 1; mode=block

GET
H2 200 clock Show response
tracking.crazyegg.com/ Frame B164 30 B
137 B 279ms
185ms XHR
text/plain 54.154.232.97
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tracking.crazyegg.com/clock?t=1701751935202&tk=3353697c62395c48c0b0030a6d85efcd&s=340498&p=%2Fcbol%2FOM%2Fchecking%2Ftiered%2Ffeatured-offers%2Fdefault.htm&u=901567&v=336e7794804c2a6e08097fd1a494f34410ab747c&f=banking.citi.com%2Fcbol%2Fom%2Fchecking%2Ftiered%2Ffeatured-offers%2Fdefault.htm&ul=https%3A%2F%2Fbanking.citi.com%2Fcbol%2FOM%2Fchecking%2Ftiered%2Ffeatured-offers%2Fdefault.htm%3FBT_TX%3D1%26ProspectID%3D326D0D64EAD743E4BE6193A917A2C7ED
Requested by: Host: script.crazyegg.com
URL: https://script.crazyegg.com/pages/versioned/common-scripts/9df44f40c781bed54449cd8b7788ab5b.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 54.154.232.97 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-54-154-232-97.eu-west-1.compute.amazonaws.com
Software: awselb/2.0 /
Resource Hash: e440ce0ab1e98a2b30997ffb70df88164f80f93f4b294c0d9981acbc3844c0e2

Request headers

accept-language: nl-NL,nl;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

access-control-allow-origin: *
date: Tue, 05 Dec 2023 04:52:15 GMT
cache-control: no-store
server: awselb/2.0
content-length: 30
content-type: text/plain

GET
H/1.1 200
OK ca.html Show response
20766699p.rfihub.com/ Frame 57D8 3 KB
4 KB 189ms
29ms Document
text/html 193.0.160.131
ROCKETFUEL

General

Check archive.org

Show headers Download Go to

Full URL: https://20766699p.rfihub.com/ca.html?ver=9&ra=1658&rb=648&ca=20766699&_o=17169175&_t=sapientcbol2023reimaginecheckingtiered&_rev=1&_pcode=1&_orderid=1&ssv_cuuid=&ssv_package=null&ssv_prodlist=null&ssv_pagename=sapientcbol2023reimaginecheckingtiered&pe=https%3A%2F%2Fbanking.citi.com%2Fcbol%2FOM%2Fchecking%2Ftiered%2Ffeatured-offers%2Fdefault.htm%3FBT_TX%3D1%26ProspectID%3D326D0D64EAD743E4BE6193A917A2C7ED&pf=&ra=7392344212812738
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 193.0.160.131 , United States, ASN54312 (ROCKETFUEL, US),
Reverse DNS
Software: Jetty(9.4.51.v20230217) /
Resource Hash: 447d8197a2aeea20545bf2cadaa5b675f99c94546058969ca8e0c7302811ee08

Request headers

Referer: https://banking.citi.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
accept-language: nl-NL,nl;q=0.9

Response headers

Cache-Control: no-cache
Content-Length: 3027
Content-Type: text/html;charset=utf-8
Date: Tue, 05 Dec 2023 04:52:15 GMT
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Server: Jetty(9.4.51.v20230217)

POST
H2 200 delivery Show response
citicorpcreditservic.tt.omtrdc.net/rest/v1/ 1 KB
2 KB 169ms
59ms XHR
application/json 66.235.152.143
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://citicorpcreditservic.tt.omtrdc.net/rest/v1/delivery?client=citicorpcreditservic&sessionId=8931956e66e24081988026d1086ac5e1&version=2.10.2

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

66.235.152.143 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ip-66-235-152-143.data.adobedc.net

Software

jag /

Resource Hash

029845ac0901bb43ebb6ee160ae25611973a4cd43cad886903fdd19223e6a977

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://banking.citi.com/
accept-language: nl-NL,nl;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
Content-Type: text/plain

Response headers

date: Tue, 05 Dec 2023 04:52:15 GMT
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains
p3p: CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
x-xss-protection: 1; mode=block
x-request-id: e7d70648-ef41-4ed9-b6da-d84d2167083d
referrer-policy: strict-origin-when-cross-origin
accept-ch: Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version-List
server: jag
vary: origin,access-control-request-method,access-control-request-headers,accept-encoding
content-type: application/json;charset=UTF-8
access-control-allow-origin: https://banking.citi.com
cache-control: no-cache, no-store, max-age=0, no-transform, private
access-control-allow-credentials: true
timing-allow-origin: *

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 180 KB
66 KB 69ms
67ms Script
application/javascript 2a00:1450:4001:80f::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=DC-6269322&l=dataLayer&cx=c

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

19e780399a96b6e832b3da1a97adf6949a62ed9fdee5b8450ae32627068ce041

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://banking.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Tue, 05 Dec 2023 04:52:15 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 67473
x-xss-protection: 0
last-modified: Tue, 05 Dec 2023 03:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Tue, 05 Dec 2023 04:52:15 GMT

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 180 KB
66 KB 95ms
94ms Script
application/javascript 2a00:1450:4001:80f::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=DC-6256710&l=dataLayer&cx=c

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

f13b5f95cd9caa7d12f485a799d69087b7aa611b7605f8f7319b75925484a7bd

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://banking.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Tue, 05 Dec 2023 04:52:15 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 67471
x-xss-protection: 0
last-modified: Tue, 05 Dec 2023 03:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Tue, 05 Dec 2023 04:52:15 GMT

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 180 KB
66 KB 171ms
170ms Script
application/javascript 2a00:1450:4001:80f::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=DC-6415812&l=dataLayer&cx=c

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

ffdddbc1752a639a78297dde0a53e611a93912ef3d2ab813cce57a88350e21ed

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://banking.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Tue, 05 Dec 2023 04:52:15 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 67472
x-xss-protection: 0
last-modified: Tue, 05 Dec 2023 03:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Tue, 05 Dec 2023 04:52:15 GMT

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 180 KB
66 KB 136ms
135ms Script
application/javascript 2a00:1450:4001:80f::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=DC-6268858&l=dataLayer&cx=c

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

b2002babc6cf4478331df036ca8f920767650f26ffea5e00530c15c1984b3ad6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://banking.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Tue, 05 Dec 2023 04:52:15 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 67475
x-xss-protection: 0
last-modified: Tue, 05 Dec 2023 03:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Tue, 05 Dec 2023 04:52:15 GMT

GET
H3 200 hero-desk.0cba1e420764dce4f4c3.png
banking.citi.com/cbol/OM/checking/tiered/featured-offers/images/ 203 KB
203 KB 130ms
130ms Image
image/png 35.190.22.40
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://banking.citi.com/cbol/OM/checking/tiered/featured-offers/images/hero-desk.0cba1e420764dce4f4c3.png

Requested by

Host: banking.citi.com
URL: https://banking.citi.com/cbol/OM/checking/tiered/featured-offers/default.htm?BT_TX=1&ProspectID=326D0D64EAD743E4BE6193A917A2C7ED

Protocol

Security

QUIC, , AES_128_GCM

Server

35.190.22.40 Kansas City, United States, ASN15169 (GOOGLE, US),

Reverse DNS

40.22.190.35.bc.googleusercontent.com

Software

Resource Hash

01db6a0b9a01883cbc70ba6ee0b89735218c97c07da12d3b0981d82c49f4bac1

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.bridgetrack.com; report-uri https://csp-reporter-ui3464xpjq-uc.a.run.app/api/csp-report/?env=prod
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://banking.citi.com/cbol/OM/checking/tiered/featured-offers/default.htm?BT_TX=1&ProspectID=326D0D64EAD743E4BE6193A917A2C7ED
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Tue, 05 Dec 2023 04:52:15 GMT
via: 1.1 google
referrer-policy: strict-origin-when-cross-origin
content-security-policy: frame-ancestors https://*.citi.com https://*.bridgetrack.com; report-uri https://csp-reporter-ui3464xpjq-uc.a.run.app/api/csp-report/?env=prod
last-modified: Mon, 26 Jun 2023 19:04:17 GMT
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains
etag: "80ce39161a8d91:0"
content-type: image/png
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 207429
x-xss-protection: 1; mode=block

GET
H3 200 hero-check.e53089ae6e5b838933cb.png
banking.citi.com/cbol/OM/checking/tiered/featured-offers/images/ 720 B
741 B 129ms
129ms Image
image/png 35.190.22.40
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://banking.citi.com/cbol/OM/checking/tiered/featured-offers/images/hero-check.e53089ae6e5b838933cb.png

Requested by

Host: banking.citi.com
URL: https://banking.citi.com/cbol/OM/checking/tiered/featured-offers/default.htm?BT_TX=1&ProspectID=326D0D64EAD743E4BE6193A917A2C7ED

Protocol

Security

QUIC, , AES_128_GCM

Server

35.190.22.40 Kansas City, United States, ASN15169 (GOOGLE, US),

Reverse DNS

40.22.190.35.bc.googleusercontent.com

Software

Resource Hash

de1f9e444c9c25e3eb076b88114e60e86fd4aed3ccaff18f4a19b86487aece6d

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.bridgetrack.com; report-uri https://csp-reporter-ui3464xpjq-uc.a.run.app/api/csp-report/?env=prod
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://banking.citi.com/cbol/OM/checking/tiered/featured-offers/default.htm?BT_TX=1&ProspectID=326D0D64EAD743E4BE6193A917A2C7ED
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Tue, 05 Dec 2023 04:52:15 GMT
via: 1.1 google
referrer-policy: strict-origin-when-cross-origin
content-security-policy: frame-ancestors https://*.citi.com https://*.bridgetrack.com; report-uri https://csp-reporter-ui3464xpjq-uc.a.run.app/api/csp-report/?env=prod
last-modified: Wed, 21 Jun 2023 16:55:55 GMT
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains
etag: "801f693e61a4d91:0"
content-type: image/png
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 720
x-xss-protection: 1; mode=block

GET
H3 200 star_tiered.faa364c53a197a687770.svg
banking.citi.com/cbol/OM/checking/tiered/featured-offers/images/ 4 KB
2 KB 127ms
127ms Image
image/svg+xml 35.190.22.40
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://banking.citi.com/cbol/OM/checking/tiered/featured-offers/images/star_tiered.faa364c53a197a687770.svg

Requested by

Host: banking.citi.com
URL: https://banking.citi.com/cbol/OM/checking/tiered/featured-offers/default.htm?BT_TX=1&ProspectID=326D0D64EAD743E4BE6193A917A2C7ED

Protocol

Security

QUIC, , AES_128_GCM

Server

35.190.22.40 Kansas City, United States, ASN15169 (GOOGLE, US),

Reverse DNS

40.22.190.35.bc.googleusercontent.com

Software

Resource Hash

e851e33486150e2f6e2d01db6010b1a3203d75793c78d1e5560f776f17364bb1

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.bridgetrack.com; report-uri https://csp-reporter-ui3464xpjq-uc.a.run.app/api/csp-report/?env=prod
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://banking.citi.com/cbol/OM/checking/tiered/featured-offers/default.htm?BT_TX=1&ProspectID=326D0D64EAD743E4BE6193A917A2C7ED
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Tue, 05 Dec 2023 04:52:15 GMT
content-encoding: gzip
via: 1.1 google
content-security-policy: frame-ancestors https://*.citi.com https://*.bridgetrack.com; report-uri https://csp-reporter-ui3464xpjq-uc.a.run.app/api/csp-report/?env=prod
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1728
x-xss-protection: 1; mode=block
referrer-policy: strict-origin-when-cross-origin
last-modified: Tue, 15 Aug 2023 16:49:43 GMT
etag: "80ad667d98cfd91:0"
vary: Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: *
accept-ranges: bytes

GET
H3 200 calendar_tiered.8b1291113f934d935c4a.svg
banking.citi.com/cbol/OM/checking/tiered/featured-offers/images/ 1 KB
1 KB 132ms
132ms Image
image/svg+xml 35.190.22.40
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://banking.citi.com/cbol/OM/checking/tiered/featured-offers/images/calendar_tiered.8b1291113f934d935c4a.svg

Requested by

Host: banking.citi.com
URL: https://banking.citi.com/cbol/OM/checking/tiered/featured-offers/default.htm?BT_TX=1&ProspectID=326D0D64EAD743E4BE6193A917A2C7ED

Protocol

Security

QUIC, , AES_128_GCM

Server

35.190.22.40 Kansas City, United States, ASN15169 (GOOGLE, US),

Reverse DNS

40.22.190.35.bc.googleusercontent.com

Software

Resource Hash

d6675bd276a925d98414b84f6c2c77569fa633c057380150085eedde513d97e2

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.bridgetrack.com; report-uri https://csp-reporter-ui3464xpjq-uc.a.run.app/api/csp-report/?env=prod
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://banking.citi.com/cbol/OM/checking/tiered/featured-offers/default.htm?BT_TX=1&ProspectID=326D0D64EAD743E4BE6193A917A2C7ED
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Tue, 05 Dec 2023 04:52:15 GMT
via: 1.1 google
referrer-policy: strict-origin-when-cross-origin
content-security-policy: frame-ancestors https://*.citi.com https://*.bridgetrack.com; report-uri https://csp-reporter-ui3464xpjq-uc.a.run.app/api/csp-report/?env=prod
last-modified: Tue, 15 Aug 2023 16:49:43 GMT
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains
etag: "80ad667d98cfd91:0"
content-type: image/svg+xml
access-control-allow-origin: *
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1301
x-xss-protection: 1; mode=block

GET
H3 200 balance_tiered.5f8b965735968bce9538.svg
banking.citi.com/cbol/OM/checking/tiered/featured-offers/images/ 2 KB
2 KB 215ms
214ms Image
image/svg+xml 35.190.22.40
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://banking.citi.com/cbol/OM/checking/tiered/featured-offers/images/balance_tiered.5f8b965735968bce9538.svg

Requested by

Host: banking.citi.com
URL: https://banking.citi.com/cbol/OM/checking/tiered/featured-offers/default.htm?BT_TX=1&ProspectID=326D0D64EAD743E4BE6193A917A2C7ED

Protocol

Security

QUIC, , AES_128_GCM

Server

35.190.22.40 Kansas City, United States, ASN15169 (GOOGLE, US),

Reverse DNS

40.22.190.35.bc.googleusercontent.com

Software

Resource Hash

092bd28b116c31f67e5c6c6d1aa38082b807c60381d725c6cd53e9b16a3286f7

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.bridgetrack.com; report-uri https://csp-reporter-ui3464xpjq-uc.a.run.app/api/csp-report/?env=prod
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://banking.citi.com/cbol/OM/checking/tiered/featured-offers/default.htm?BT_TX=1&ProspectID=326D0D64EAD743E4BE6193A917A2C7ED
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Tue, 05 Dec 2023 04:52:15 GMT
via: 1.1 google
referrer-policy: strict-origin-when-cross-origin
content-security-policy: frame-ancestors https://*.citi.com https://*.bridgetrack.com; report-uri https://csp-reporter-ui3464xpjq-uc.a.run.app/api/csp-report/?env=prod
last-modified: Tue, 15 Aug 2023 16:49:43 GMT
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains
etag: "80ad667d98cfd91:0"
content-type: image/svg+xml
access-control-allow-origin: *
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2041
x-xss-protection: 1; mode=block

GET
H3 200 checkmark.63151a023ce6826f5347.svg
banking.citi.com/cbol/OM/checking/tiered/featured-offers/images/ 340 B
362 B 130ms
129ms Image
image/svg+xml 35.190.22.40
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://banking.citi.com/cbol/OM/checking/tiered/featured-offers/images/checkmark.63151a023ce6826f5347.svg

Requested by

Host: banking.citi.com
URL: https://banking.citi.com/cbol/OM/checking/tiered/featured-offers/default.htm?BT_TX=1&ProspectID=326D0D64EAD743E4BE6193A917A2C7ED

Protocol

Security

QUIC, , AES_128_GCM

Server

35.190.22.40 Kansas City, United States, ASN15169 (GOOGLE, US),

Reverse DNS

40.22.190.35.bc.googleusercontent.com

Software

Resource Hash

b771e95f0fb29e75e07f4b1758dfbc37d7537de1ff740a5e9ce4729d32c2a361

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.bridgetrack.com; report-uri https://csp-reporter-ui3464xpjq-uc.a.run.app/api/csp-report/?env=prod
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://banking.citi.com/cbol/OM/checking/tiered/featured-offers/default.htm?BT_TX=1&ProspectID=326D0D64EAD743E4BE6193A917A2C7ED
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Tue, 05 Dec 2023 04:52:15 GMT
via: 1.1 google
referrer-policy: strict-origin-when-cross-origin
content-security-policy: frame-ancestors https://*.citi.com https://*.bridgetrack.com; report-uri https://csp-reporter-ui3464xpjq-uc.a.run.app/api/csp-report/?env=prod
last-modified: Tue, 15 Aug 2023 16:49:43 GMT
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains
etag: "80ad667d98cfd91:0"
content-type: image/svg+xml
access-control-allow-origin: *
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 340
x-xss-protection: 1; mode=block

GET
H3 200 arrow.fb38f1f056612c87a904.svg
banking.citi.com/cbol/OM/checking/tiered/featured-offers/images/ 178 B
200 B 135ms
134ms Image
image/svg+xml 35.190.22.40
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://banking.citi.com/cbol/OM/checking/tiered/featured-offers/images/arrow.fb38f1f056612c87a904.svg

Requested by

Host: banking.citi.com
URL: https://banking.citi.com/cbol/OM/checking/tiered/featured-offers/default.htm?BT_TX=1&ProspectID=326D0D64EAD743E4BE6193A917A2C7ED

Protocol

Security

QUIC, , AES_128_GCM

Server

35.190.22.40 Kansas City, United States, ASN15169 (GOOGLE, US),

Reverse DNS

40.22.190.35.bc.googleusercontent.com

Software

Resource Hash

1027db0787a02f914a07fd6a751d45a230207c2d0cb3e5612abe78fd42ad7086

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.bridgetrack.com; report-uri https://csp-reporter-ui3464xpjq-uc.a.run.app/api/csp-report/?env=prod
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://banking.citi.com/cbol/OM/checking/tiered/featured-offers/default.htm?BT_TX=1&ProspectID=326D0D64EAD743E4BE6193A917A2C7ED
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Tue, 05 Dec 2023 04:52:15 GMT
via: 1.1 google
referrer-policy: strict-origin-when-cross-origin
content-security-policy: frame-ancestors https://*.citi.com https://*.bridgetrack.com; report-uri https://csp-reporter-ui3464xpjq-uc.a.run.app/api/csp-report/?env=prod
last-modified: Tue, 15 Aug 2023 16:49:43 GMT
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains
etag: "80ad667d98cfd91:0"
content-type: image/svg+xml
access-control-allow-origin: *
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 178
x-xss-protection: 1; mode=block

GET
H3 200 accordion-arrow.d1471cdcbbb349c66430.png
banking.citi.com/cbol/OM/checking/tiered/featured-offers/images/ 2 KB
2 KB 130ms
129ms Image
image/png 35.190.22.40
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://banking.citi.com/cbol/OM/checking/tiered/featured-offers/images/accordion-arrow.d1471cdcbbb349c66430.png

Requested by

Host: banking.citi.com
URL: https://banking.citi.com/cbol/OM/checking/tiered/featured-offers/default.htm?BT_TX=1&ProspectID=326D0D64EAD743E4BE6193A917A2C7ED

Protocol

Security

QUIC, , AES_128_GCM

Server

35.190.22.40 Kansas City, United States, ASN15169 (GOOGLE, US),

Reverse DNS

40.22.190.35.bc.googleusercontent.com

Software

Resource Hash

8bfedcf685390380481b15318e5d593da7ad43c2ebcb24e4772ff40af8951041

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.bridgetrack.com; report-uri https://csp-reporter-ui3464xpjq-uc.a.run.app/api/csp-report/?env=prod
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://banking.citi.com/cbol/OM/checking/tiered/featured-offers/default.htm?BT_TX=1&ProspectID=326D0D64EAD743E4BE6193A917A2C7ED
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Tue, 05 Dec 2023 04:52:15 GMT
via: 1.1 google
referrer-policy: strict-origin-when-cross-origin
content-security-policy: frame-ancestors https://*.citi.com https://*.bridgetrack.com; report-uri https://csp-reporter-ui3464xpjq-uc.a.run.app/api/csp-report/?env=prod
last-modified: Fri, 30 Jun 2023 17:39:44 GMT
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains
etag: "07022db79abd91:0"
content-type: image/png
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1676
x-xss-protection: 1; mode=block

GET
H3 200 compare-chart-check.3afba26018f6cd052e11.png
banking.citi.com/cbol/OM/checking/tiered/featured-offers/images/ 330 B
351 B 150ms
149ms Image
image/png 35.190.22.40
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://banking.citi.com/cbol/OM/checking/tiered/featured-offers/images/compare-chart-check.3afba26018f6cd052e11.png

Requested by

Host: banking.citi.com
URL: https://banking.citi.com/cbol/OM/checking/tiered/featured-offers/default.htm?BT_TX=1&ProspectID=326D0D64EAD743E4BE6193A917A2C7ED

Protocol

Security

QUIC, , AES_128_GCM

Server

35.190.22.40 Kansas City, United States, ASN15169 (GOOGLE, US),

Reverse DNS

40.22.190.35.bc.googleusercontent.com

Software

Resource Hash

4c0b89ba14ab0e3f25c0da34eaf0d29dd70410e50bfc7154c9d0a280b9fa5b0c

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.bridgetrack.com; report-uri https://csp-reporter-ui3464xpjq-uc.a.run.app/api/csp-report/?env=prod
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://banking.citi.com/cbol/OM/checking/tiered/featured-offers/default.htm?BT_TX=1&ProspectID=326D0D64EAD743E4BE6193A917A2C7ED
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Tue, 05 Dec 2023 04:52:15 GMT
via: 1.1 google
referrer-policy: strict-origin-when-cross-origin
content-security-policy: frame-ancestors https://*.citi.com https://*.bridgetrack.com; report-uri https://csp-reporter-ui3464xpjq-uc.a.run.app/api/csp-report/?env=prod
last-modified: Wed, 21 Jun 2023 16:55:55 GMT
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains
etag: "801f693e61a4d91:0"
content-type: image/png
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 330
x-xss-protection: 1; mode=block

GET
H3 200 compare-chart-dash.45b0990ca1ac9901c414.png
banking.citi.com/cbol/OM/checking/tiered/featured-offers/images/ 157 B
178 B 140ms
140ms Image
image/png 35.190.22.40
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://banking.citi.com/cbol/OM/checking/tiered/featured-offers/images/compare-chart-dash.45b0990ca1ac9901c414.png

Requested by

Host: banking.citi.com
URL: https://banking.citi.com/cbol/OM/checking/tiered/featured-offers/default.htm?BT_TX=1&ProspectID=326D0D64EAD743E4BE6193A917A2C7ED

Protocol

Security

QUIC, , AES_128_GCM

Server

35.190.22.40 Kansas City, United States, ASN15169 (GOOGLE, US),

Reverse DNS

40.22.190.35.bc.googleusercontent.com

Software

Resource Hash

31e24b0971fc0ec71781beed9a616ad1348a72b2a3b9c46cb519afc116f2e880

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.bridgetrack.com; report-uri https://csp-reporter-ui3464xpjq-uc.a.run.app/api/csp-report/?env=prod
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://banking.citi.com/cbol/OM/checking/tiered/featured-offers/default.htm?BT_TX=1&ProspectID=326D0D64EAD743E4BE6193A917A2C7ED
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Tue, 05 Dec 2023 04:52:15 GMT
via: 1.1 google
referrer-policy: strict-origin-when-cross-origin
content-security-policy: frame-ancestors https://*.citi.com https://*.bridgetrack.com; report-uri https://csp-reporter-ui3464xpjq-uc.a.run.app/api/csp-report/?env=prod
last-modified: Wed, 21 Jun 2023 16:55:55 GMT
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains
etag: "801f693e61a4d91:0"
content-type: image/png
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 157
x-xss-protection: 1; mode=block

GET
H2 200 interstate-bold.woff
cdn.digitalmarketing.citibankonline.com/fonts/ 17 KB
17 KB 144ms
32ms Font
application/x-woff 34.107.138.236
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.digitalmarketing.citibankonline.com/fonts/interstate-bold.woff

Requested by

Host: banking.citi.com
URL: https://banking.citi.com/cbol/OM/checking/tiered/featured-offers/default.htm?BT_TX=1&ProspectID=326D0D64EAD743E4BE6193A917A2C7ED

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

34.107.138.236 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

236.138.107.34.bc.googleusercontent.com

Software

Resource Hash

28ced8a7cb30e6f747ad8116dcd11d3dbf5848c2d49a9babbd7d8c94e0a29cf7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://banking.citi.com/
Origin: https://banking.citi.com
accept-language: nl-NL,nl;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Thu, 30 Nov 2023 16:58:57 GMT
via: 1.1 google
x-content-type-options: nosniff
last-modified: Mon, 10 Feb 2020 17:54:07 GMT
cross-origin-opener-policy: same-origin
age: 388398
content-type: application/x-woff
access-control-allow-origin: *
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 17500
x-xss-protection: 0

GET
H2 200 interstate-light.woff
cdn.digitalmarketing.citibankonline.com/fonts/ 17 KB
17 KB 172ms
60ms Font
application/x-woff 34.107.138.236
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.digitalmarketing.citibankonline.com/fonts/interstate-light.woff

Requested by

Host: banking.citi.com
URL: https://banking.citi.com/cbol/OM/checking/tiered/featured-offers/default.htm?BT_TX=1&ProspectID=326D0D64EAD743E4BE6193A917A2C7ED

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

34.107.138.236 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

236.138.107.34.bc.googleusercontent.com

Software

Resource Hash

0a747978746092df6f18fe90ef23b9896959f6a9bb0b58cbab2cbc851793e023

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://banking.citi.com/
Origin: https://banking.citi.com
accept-language: nl-NL,nl;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Thu, 30 Nov 2023 16:39:20 GMT
via: 1.1 google
x-content-type-options: nosniff
last-modified: Mon, 10 Feb 2020 17:54:41 GMT
cross-origin-opener-policy: same-origin
age: 389575
content-type: application/x-woff
access-control-allow-origin: *
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 17596
x-xss-protection: 0

GET
H2 200 interstate-regular.woff
cdn.digitalmarketing.citibankonline.com/fonts/ 17 KB
17 KB 154ms
42ms Font
application/x-woff 34.107.138.236
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.digitalmarketing.citibankonline.com/fonts/interstate-regular.woff

Requested by

Host: banking.citi.com
URL: https://banking.citi.com/cbol/OM/checking/tiered/featured-offers/default.htm?BT_TX=1&ProspectID=326D0D64EAD743E4BE6193A917A2C7ED

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

34.107.138.236 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

236.138.107.34.bc.googleusercontent.com

Software

Resource Hash

6896c70fd430a1ffe69dc778926e1866ca52a12bd341170522ad6278aafd7bcf

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://banking.citi.com/
Origin: https://banking.citi.com
accept-language: nl-NL,nl;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 21:17:11 GMT
via: 1.1 google
x-content-type-options: nosniff
last-modified: Mon, 10 Feb 2020 17:54:07 GMT
cross-origin-opener-policy: same-origin
age: 27304
content-type: application/x-woff
access-control-allow-origin: *
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 17592
x-xss-protection: 0

GET
H3 200 ajax-loader.fb6f3c230cb846e25247.gif
banking.citi.com/cbol/OM/checking/tiered/featured-offers/images/ 4 KB
4 KB 180ms
180ms Image
image/gif 35.190.22.40
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://banking.citi.com/cbol/OM/checking/tiered/featured-offers/images/ajax-loader.fb6f3c230cb846e25247.gif

Requested by

Host: banking.citi.com
URL: https://banking.citi.com/cbol/OM/checking/tiered/featured-offers/default.htm?BT_TX=1&ProspectID=326D0D64EAD743E4BE6193A917A2C7ED

Protocol

Security

QUIC, , AES_128_GCM

Server

35.190.22.40 Kansas City, United States, ASN15169 (GOOGLE, US),

Reverse DNS

40.22.190.35.bc.googleusercontent.com

Software

Resource Hash

e7b44c86b050fca766a96ddac2d0932af0126da6f2305280342d909168dcce6b

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.bridgetrack.com; report-uri https://csp-reporter-ui3464xpjq-uc.a.run.app/api/csp-report/?env=prod
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://banking.citi.com/cbol/OM/checking/tiered/featured-offers/default.htm?BT_TX=1&ProspectID=326D0D64EAD743E4BE6193A917A2C7ED
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Tue, 05 Dec 2023 04:52:15 GMT
via: 1.1 google
referrer-policy: strict-origin-when-cross-origin
content-security-policy: frame-ancestors https://*.citi.com https://*.bridgetrack.com; report-uri https://csp-reporter-ui3464xpjq-uc.a.run.app/api/csp-report/?env=prod
last-modified: Wed, 21 Jun 2023 16:55:55 GMT
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains
etag: "801f693e61a4d91:0"
content-type: image/gif
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4178
x-xss-protection: 1; mode=block

GET
H3 200 carousel-arrow.29959327dd2302859277.svg
banking.citi.com/cbol/OM/checking/tiered/featured-offers/images/ 2 KB
2 KB 126ms
125ms Image
image/svg+xml 35.190.22.40
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://banking.citi.com/cbol/OM/checking/tiered/featured-offers/images/carousel-arrow.29959327dd2302859277.svg

Requested by

Host: banking.citi.com
URL: https://banking.citi.com/cbol/OM/checking/tiered/featured-offers/default.htm?BT_TX=1&ProspectID=326D0D64EAD743E4BE6193A917A2C7ED

Protocol

Security

QUIC, , AES_128_GCM

Server

35.190.22.40 Kansas City, United States, ASN15169 (GOOGLE, US),

Reverse DNS

40.22.190.35.bc.googleusercontent.com

Software

Resource Hash

3a5b60b35698e14383aa5c5108107f9c2b24702c93588ca4d4197240c19a619f

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.bridgetrack.com; report-uri https://csp-reporter-ui3464xpjq-uc.a.run.app/api/csp-report/?env=prod
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://banking.citi.com/cbol/OM/checking/tiered/featured-offers/default.htm?BT_TX=1&ProspectID=326D0D64EAD743E4BE6193A917A2C7ED
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Tue, 05 Dec 2023 04:52:15 GMT
via: 1.1 google
referrer-policy: strict-origin-when-cross-origin
content-security-policy: frame-ancestors https://*.citi.com https://*.bridgetrack.com; report-uri https://csp-reporter-ui3464xpjq-uc.a.run.app/api/csp-report/?env=prod
last-modified: Tue, 15 Aug 2023 16:49:43 GMT
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains
etag: "80ad667d98cfd91:0"
content-type: image/svg+xml
access-control-allow-origin: *
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1650
x-xss-protection: 1; mode=block

GET
H3 200 slick.be6afa24355a2a7f9b35.woff
banking.citi.com/cbol/OM/checking/tiered/featured-offers/images/ 1 KB
1 KB 128ms
128ms Font
application/x-woff 35.190.22.40
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://banking.citi.com/cbol/OM/checking/tiered/featured-offers/images/slick.be6afa24355a2a7f9b35.woff

Requested by

Host: banking.citi.com
URL: https://banking.citi.com/cbol/OM/checking/tiered/featured-offers/default.htm?BT_TX=1&ProspectID=326D0D64EAD743E4BE6193A917A2C7ED

Protocol

Security

QUIC, , AES_128_GCM

Server

35.190.22.40 Kansas City, United States, ASN15169 (GOOGLE, US),

Reverse DNS

40.22.190.35.bc.googleusercontent.com

Software

Resource Hash

56500ab0cde6f2d4378a2b105d7f48f729f23b0b5186c2ae3fc80ab57b1e43b6

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.bridgetrack.com; report-uri https://csp-reporter-ui3464xpjq-uc.a.run.app/api/csp-report/?env=prod
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://banking.citi.com/cbol/OM/checking/tiered/featured-offers/default.htm?BT_TX=1&ProspectID=326D0D64EAD743E4BE6193A917A2C7ED
Origin: https://banking.citi.com
accept-language: nl-NL,nl;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Tue, 05 Dec 2023 04:52:15 GMT
via: 1.1 google
referrer-policy: strict-origin-when-cross-origin
content-security-policy: frame-ancestors https://*.citi.com https://*.bridgetrack.com; report-uri https://csp-reporter-ui3464xpjq-uc.a.run.app/api/csp-report/?env=prod
last-modified: Wed, 21 Jun 2023 16:55:55 GMT
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains
etag: "801f693e61a4d91:0"
content-type: application/x-woff
access-control-allow-origin: *
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1356
x-xss-protection: 1; mode=block

GET
H3 200 header-citi-logo-light.6e897085189798141610.svg
banking.citi.com/cbol/OM/checking/tiered/featured-offers/images/ 4 KB
4 KB 133ms
133ms Image
image/svg+xml 35.190.22.40
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://banking.citi.com/cbol/OM/checking/tiered/featured-offers/images/header-citi-logo-light.6e897085189798141610.svg

Requested by

Host: banking.citi.com
URL: https://banking.citi.com/cbol/OM/checking/tiered/featured-offers/default.htm?BT_TX=1&ProspectID=326D0D64EAD743E4BE6193A917A2C7ED

Protocol

Security

QUIC, , AES_128_GCM

Server

35.190.22.40 Kansas City, United States, ASN15169 (GOOGLE, US),

Reverse DNS

40.22.190.35.bc.googleusercontent.com

Software

Resource Hash

f96f8cde87decef4958dbba76e0a919946c252fbf64bdf69f2ca0b693869e7e7

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.bridgetrack.com; report-uri https://csp-reporter-ui3464xpjq-uc.a.run.app/api/csp-report/?env=prod
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://banking.citi.com/cbol/OM/checking/tiered/featured-offers/default.htm?BT_TX=1&ProspectID=326D0D64EAD743E4BE6193A917A2C7ED
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Tue, 05 Dec 2023 04:52:15 GMT
via: 1.1 google
referrer-policy: strict-origin-when-cross-origin
content-security-policy: frame-ancestors https://*.citi.com https://*.bridgetrack.com; report-uri https://csp-reporter-ui3464xpjq-uc.a.run.app/api/csp-report/?env=prod
last-modified: Tue, 15 Aug 2023 18:51:28 GMT
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains
etag: "038857fa9cfd91:0"
content-type: image/svg+xml
access-control-allow-origin: *
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4071
x-xss-protection: 1; mode=block

GET
H3 200 zip-selector-logo.0dc498e0f5af535b3250.svg
banking.citi.com/cbol/OM/checking/tiered/featured-offers/images/ 4 KB
2 KB 164ms
164ms Image
image/svg+xml 35.190.22.40
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://banking.citi.com/cbol/OM/checking/tiered/featured-offers/images/zip-selector-logo.0dc498e0f5af535b3250.svg

Requested by

Host: banking.citi.com
URL: https://banking.citi.com/cbol/OM/checking/tiered/featured-offers/default.htm?BT_TX=1&ProspectID=326D0D64EAD743E4BE6193A917A2C7ED

Protocol

Security

QUIC, , AES_128_GCM

Server

35.190.22.40 Kansas City, United States, ASN15169 (GOOGLE, US),

Reverse DNS

40.22.190.35.bc.googleusercontent.com

Software

Resource Hash

edb78348ee4e5e7858bc4ee87b7a2b3e5039582d8323621747f51dfd8bc10e4a

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.bridgetrack.com; report-uri https://csp-reporter-ui3464xpjq-uc.a.run.app/api/csp-report/?env=prod
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://banking.citi.com/cbol/OM/checking/tiered/featured-offers/default.htm?BT_TX=1&ProspectID=326D0D64EAD743E4BE6193A917A2C7ED
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Tue, 05 Dec 2023 04:52:15 GMT
content-encoding: gzip
via: 1.1 google
content-security-policy: frame-ancestors https://*.citi.com https://*.bridgetrack.com; report-uri https://csp-reporter-ui3464xpjq-uc.a.run.app/api/csp-report/?env=prod
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1597
x-xss-protection: 1; mode=block
referrer-policy: strict-origin-when-cross-origin
last-modified: Tue, 15 Aug 2023 16:49:43 GMT
etag: "80ad667d98cfd91:0"
vary: Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: *
accept-ranges: bytes

GET
H2 200 /
citi.bridgetrack.com/track/ 43 B
395 B 145ms
144ms Image
image/gif 35.190.22.40
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://citi.bridgetrack.com/track/?id=66441&r=69169633.14000292
Requested by: Host: banking.citi.com
URL: https://banking.citi.com/cbol/OM/checking/tiered/featured-offers/default.htm?BT_TX=1&ProspectID=326D0D64EAD743E4BE6193A917A2C7ED
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.190.22.40 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 40.22.190.35.bc.googleusercontent.com
Software: /
Resource Hash: 63b98a0c8568c08fd01a6946a147bca65eff26c8085f1ccb5330aafe0f0dcd15

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://banking.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 05 Dec 2023 04:52:15 GMT
via: 1.1 google
content-type: image/GIF
p3p: CP="NON DSP COR DEVa PSAa IVAo CONo OUR IND UNI PUR NAV DEM LOC", policyref="http://citi.bridgetrack.com/w3c/p3p.xml"
cache-control: private
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 43
expires: Mon, 04 Dec 2023 04:52:15 GMT

GET
BLOB 200
OK f3f39a15-4c50-4667-94e9-b81e9ea1baef
https://banking.citi.com/ 241 B
0 Other
text/javascript

General

Check archive.org

Show headers Download Go to

Full URL: blob:https://banking.citi.com/f3f39a15-4c50-4667-94e9-b81e9ea1baef
Requested by: Host: banking.citi.com
URL: https://banking.citi.com/cbol/OM/checking/tiered/featured-offers/default.htm?BT_TX=1&ProspectID=326D0D64EAD743E4BE6193A917A2C7ED
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: aefdf31931594229896ca362daf058be2dc6d0fa7ee98e08cb0825440b9005d5

Request headers

accept-language: nl-NL,nl;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

Content-Length: 241
Content-Type: text/javascript

GET
H2 200 / Show response
zn3vi8kkuds0jjrfc-citifeedback.siteintercept.qualtrics.com/SIE/ 8 KB
4 KB 131ms
44ms Script
application/javascript 104.17.209.240
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://zn3vi8kkuds0jjrfc-citifeedback.siteintercept.qualtrics.com/SIE/?Q_ZID=ZN_3VI8kkudS0JJRFc

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.17.209.240 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

ce32dd1231d465647b5a685e477c831e488c6cd282820e61194554aa45c59fc0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://banking.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Tue, 05 Dec 2023 04:52:15 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: br
age: 11561
cf-polished: origSize=9155
content-security-policy-report-only: frame-ancestors 'self' *.qualtrics.com *.my.salesforce.com *.visualforce.com *.visual.force.com *.lightning.force.com; report-uri https://sjc1.qualtrics.com/csp-report
edge-control: max-age=604800
referrer-policy: strict-origin-when-cross-origin
cf-bgj: minify
server: cloudflare
etag: W/"23c3-uVmbGx7Himr1wLDE3lrlHPjowCA"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=3600, s-maxage=604800
permissions-policy: camera=(), geolocation=(), microphone=()
cf-ray: 8309adbeedcc66f9-AMS
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept
timing-allow-origin: *

GET
H2

200

activityi;dc_pre=CK_xi_2_94IDFcXIOwIdg8APkQ;src=6269322;type=bankp00;cat=proje00b;ord=1;num=6451680302062;auiddc=976096460.1701751935;gtm=45fe3bt0;gcd=11l1l1l1l1;dma_cps=sypham;dma=1;uaa=;uab=;uafv... Show response
6269322.fls.doubleclick.net/ Frame C393
Redirect Chain

https://6269322.fls.doubleclick.net/activityi;src=6269322;type=bankp00;cat=proje00b;ord=1;num=6451680302062;auiddc=976096460.1701751935;gtm=45fe3bt0;gcd=11l1l1l1l1;dma_cps=sypham;dma=1;uaa=;uab=;ua...
https://6269322.fls.doubleclick.net/activityi;dc_pre=CK_xi_2_94IDFcXIOwIdg8APkQ;src=6269322;type=bankp00;cat=proje00b;ord=1;num=6451680302062;auiddc=976096460.1701751935;gtm=45fe3bt0;gcd=11l1l1l1l1...

702 B
590 B

105ms
104ms

Document
text/html

216.58.206.38
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://6269322.fls.doubleclick.net/activityi;dc_pre=CK_xi_2_94IDFcXIOwIdg8APkQ;src=6269322;type=bankp00;cat=proje00b;ord=1;num=6451680302062;auiddc=976096460.1701751935;gtm=45fe3bt0;gcd=11l1l1l1l1;dma_cps=sypham;dma=1;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;epver=2;~oref=https%3A%2F%2Fbanking.citi.com%2Fcbol%2FOM%2Fchecking%2Ftiered%2Ffeatured-offers%2Fdefault.htm%3FBT_TX%3D1%26ProspectID%3D326D0D64EAD743E4BE6193A917A2C7ED?

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=DC-6269322&l=dataLayer&cx=c

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

216.58.206.38 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

mil07s07-in-f6.1e100.net

Software

cafe /

Resource Hash

c5cdf83b32686400fb191131091e1ab290cba205ad81cbbd952d7e9d4e83dd8b

Security Headers

Name	Value
Strict-Transport-Security	max-age=21600
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://banking.citi.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
accept-language: nl-NL,nl;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, must-revalidate
content-encoding: br
content-length: 414
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Tue, 05 Dec 2023 04:52:16 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
pragma: no-cache
server: cafe
strict-transport-security: max-age=21600
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

Redirect headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, must-revalidate
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Tue, 05 Dec 2023 04:52:15 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
follow-only-when-prerender-shown: 1
location: https://6269322.fls.doubleclick.net/activityi;dc_pre=CK_xi_2_94IDFcXIOwIdg8APkQ;src=6269322;type=bankp00;cat=proje00b;ord=1;num=6451680302062;auiddc=976096460.1701751935;gtm=45fe3bt0;gcd=11l1l1l1l1;dma_cps=sypham;dma=1;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;epver=2;~oref=https%3A%2F%2Fbanking.citi.com%2Fcbol%2FOM%2Fchecking%2Ftiered%2Ffeatured-offers%2Fdefault.htm%3FBT_TX%3D1%26ProspectID%3D326D0D64EAD743E4BE6193A917A2C7ED?
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
pragma: no-cache
server: cafe
strict-transport-security: max-age=21600
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 ytc.js Show response
s.yimg.com/wi/ 18 KB
7 KB 155ms
51ms Script
application/javascript 2a00:1288:80:807::2
YAHOO-DEB

General

Check archive.org

Show headers Download Go to

Full URL

https://s.yimg.com/wi/ytc.js

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1288:80:807::2 , United Kingdom, ASN203220 (YAHOO-DEB, GB),

Reverse DNS

Software

ATS /

Resource Hash

480b06b23e574b4bf386fde1a91145a4171f97aeb5ee800e4be1850f29b1ad91

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://banking.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Tue, 05 Dec 2023 04:48:22 GMT
x-amz-version-id: xC6OTTJGIjCqkMTkbrZpmtbXHK5oaZhW
content-encoding: gzip
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
x-amz-request-id: 2D28X5V9NV7BZ2GE
age: 234
x-amz-server-side-encryption: AES256
x-amz-id-2: aMxB2sHDiiKl3+s97gsZ+Rv9tRkhYOnoAXt+VdYpxIaOu6CvCa2cyoX/DOKj4/QhtZsiY8F0jPqvl+OHAvtRRQ==
x-xss-protection: 1; mode=block
referrer-policy: no-referrer-when-downgrade
x-amz-expiration: expiry-date="Wed, 31 Jul 2024 00:00:00 GMT", rule-id="oath-standard-lifecycle"
last-modified: Mon, 26 Jun 2023 09:26:35 GMT
server: ATS
etag: "5c6ed25dce803fd84288922b8928409e-df"
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
vary: Origin, Accept-Encoding
content-type: application/javascript
cache-control: public,max-age=3600
accept-ranges: bytes

GET
H3 200 destination Show response
www.googletagmanager.com/gtag/ 206 KB
74 KB 61ms
61ms Script
application/javascript 2a00:1450:4001:80f::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/destination?id=AW-658128868&l=dataLayer&cx=c

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

d204634f1202714e9ab0047fc768df6aaa8565fa02b3e07c8d6dde72c8195031

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://banking.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Tue, 05 Dec 2023 04:52:15 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 75474
x-xss-protection: 0
last-modified: Tue, 05 Dec 2023 03:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Tue, 05 Dec 2023 04:52:15 GMT

GET
H2 200 bat.js Show response
bat.bing.com/ 45 KB
13 KB 115ms
53ms Script
application/javascript 2620:1ec:c11::200
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://bat.bing.com/bat.js

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

5e319852607809336b2534ffeb96f6933f26994dd040f535302c84f59cc0a214

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://banking.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
content-encoding: gzip
date: Tue, 05 Dec 2023 04:52:15 GMT
last-modified: Fri, 10 Nov 2023 20:09:55 GMT
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 4ABF034BEF4A46BCAA8B23AF4C88827E Ref B: BRU30EDGE0919 Ref C: 2023-12-05T04:52:15Z
etag: "80abcdf1114da1:0"
vary: Accept-Encoding
x-cache: CONFIG_NOCACHE
content-type: application/javascript
cache-control: private,max-age=1800
accept-ranges: bytes
content-length: 13175

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 199 KB
72 KB 46ms
46ms Script
application/javascript 2a00:1450:4001:80f::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-916451471

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

2c176a7cf68f36b496c6fc2bb834e1a19a30ef47c4b03c3dc275a5c8d478618a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://banking.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Tue, 05 Dec 2023 04:52:15 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 74090
x-xss-protection: 0
last-modified: Tue, 05 Dec 2023 03:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Tue, 05 Dec 2023 04:52:15 GMT

GET
H2 451 425466.html Show response
sr.rlcdn.com/ Frame BB63 0
98 B 200ms
127ms Document
text/plain 35.244.154.8
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://sr.rlcdn.com/425466.html?es=80676&u=da39a3ee5e6b4b0d3255bfef95601890afd80709
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.154.8 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 8.154.244.35.bc.googleusercontent.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://banking.citi.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
accept-language: nl-NL,nl;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
date: Tue, 05 Dec 2023 04:52:15 GMT
via: 1.1 google

GET
H2 200 dpm_pixel_min.js Show response
c.tvpixel.com/js/current/ 103 KB
32 KB 154ms
39ms Script
application/javascript 2600:9000:224a:e000:1d:bf0a:0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c.tvpixel.com/js/current/dpm_pixel_min.js?aid=citi-d4f85824-1351-4554-91ff-fdb56f962c5c&comscore=true
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:224a:e000:1d:bf0a:0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 61d8137d275f12306e177bc726c2b3e072f9efa4743a0ace6ecbcf7a0932fd07

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://banking.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

x-amz-version-id: oMk5SFqHXboEDRm2.vDWImtx_4ARYxEl
content-encoding: gzip
via: 1.1 6ee47dd27ca379a812104b559e9a5a22.cloudfront.net (CloudFront)
date: Tue, 05 Dec 2023 03:50:24 GMT
last-modified: Thu, 16 Sep 2021 18:14:59 GMT
server: AmazonS3
x-amz-cf-pop: DUS51-P1
age: 11018
etag: W/"08e770c8a17bf087d50cec01af0892c2"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
x-amz-cf-id: 0XuBycAPOVId5_6-_gwJg-OOw90kpHT2vJTuzF2DQZ8D0dwhLYP-ew==

GET
H2 200 sync Show response
live.rezync.com/ 665 B
1 KB 392ms
322ms Script
text/javascript 13.32.27.28
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://live.rezync.com/sync?c=16b6410431b6374e780104abb0443ca8&p=7e32322de398f7a80f6da0ee1cec9a9b&k=citibank-pixel-6667&custom1={_dl.event}&custom2={_dl.evarPageName}&custom3={_dl.pid}&custom4={_dl.CUUID}&custom5={_dl.products[0].product_details}&custom6={_dl.prospect_id}&zmpID=citibank&cache_buster=1701751935732&PageUrl={_dl.url}&page_referrer=
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.32.27.28 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-32-27-28.fra56.r.cloudfront.net
Software: lighttpd/1.4.69 /
Resource Hash: 5b8ea63c50ee4dd1cbe92ec4b0c54ccc181f0dcc337227303a791421ef67866d

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://banking.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Tue, 05 Dec 2023 04:52:16 GMT
via: 1.1 fdc45b521af7652438141328494a79d2.cloudfront.net (CloudFront)
server: lighttpd/1.4.69
x-amz-cf-pop: FRA56-C2
vary: Cookie
x-cache: Miss from cloudfront
content-type: text/javascript
accept-ranges: bytes
content-length: 665
x-amz-cf-id: 9avFiBSzjexCu3Z94yE66riedsNlha1fxwb2HmVhmmK2lYFS5bXCYQ==

GET
H/1.1

200
OK

iu3
s.amazon-adsystem.com/
Redirect Chain

https://s.amazon-adsystem.com/iu3?pid=c3702eea-109e-48b0-9ef4-c856bdd405e2&event=PageView
https://s.amazon-adsystem.com/iu3?pid=c3702eea-109e-48b0-9ef4-c856bdd405e2&event=PageView&dcc=t

0
0

138ms
138ms

Image
text/html

52.46.130.91
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s.amazon-adsystem.com/iu3?pid=c3702eea-109e-48b0-9ef4-c856bdd405e2&event=PageView&dcc=t
Protocol: HTTP/1.1
Server: 52.46.130.91 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://banking.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

Redirect headers

Pragma: no-cache
Date: Tue, 05 Dec 2023 04:52:16 GMT
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Server: Server
x-amz-rid: CEG4H9D7ZG5Y2NXP4XVT
Vary: Content-Type,Accept-Encoding,User-Agent
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
Location: https://s.amazon-adsystem.com/iu3?pid=c3702eea-109e-48b0-9ef4-c856bdd405e2&event=PageView&dcc=t
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 0
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H3 204 e.gif
nexus.ensighten.com/error/ 0
218 B 34ms
34ms Image
text/plain 2600:9000:206f:b400:2:8f43:5780:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://nexus.ensighten.com/error/e.gif?msg=Cannot%20read%20properties%20of%20undefined%20(reading%20%27join%27)&lnn=-1&fn=&cid=1129&client=citi&publishPath=na_prod&rid=2836703&did=578343&errorName=TypeError
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2600:9000:206f:b400:2:8f43:5780:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: CloudFront /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://banking.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 05:41:29 GMT
via: 1.1 cc763905c39a59494c951c09271b0422.cloudfront.net (CloudFront)
server: CloudFront
age: 83446
x-amz-cf-pop: FRA56-C1
x-cache: Hit from cloudfront
cache-control: no-cache, no-store
alt-svc: h3=":443"; ma=86400
x-amz-cf-id: dlYc__aYo7Mc2JKJfu1OZ61YCQ2pkRZ4yjOWus--IDVGEqkBsG4Yog==

GET
H3 204 e.gif
nexus.ensighten.com/error/ 0
217 B 35ms
35ms Image
text/plain 2600:9000:206f:b400:2:8f43:5780:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://nexus.ensighten.com/error/e.gif?msg=Cannot%20read%20properties%20of%20null%20(reading%20%27length%27)&lnn=-1&fn=&cid=1129&client=citi&publishPath=na_prod&rid=2836703&did=578343&errorName=TypeError
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2600:9000:206f:b400:2:8f43:5780:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: CloudFront /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://banking.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 05:41:29 GMT
via: 1.1 cc763905c39a59494c951c09271b0422.cloudfront.net (CloudFront)
server: CloudFront
age: 83446
x-amz-cf-pop: FRA56-C1
x-cache: Hit from cloudfront
cache-control: no-cache, no-store
alt-svc: h3=":443"; ma=86400
x-amz-cf-id: 8385obfcv0TMpaUQ07rIf9xEGCTuN5eUW5Z0t-0E4yI9Rgr7DWUiLA==

GET
H3 204 e.gif
nexus.ensighten.com/error/ 0
217 B 36ms
36ms Image
text/plain 2600:9000:206f:b400:2:8f43:5780:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://nexus.ensighten.com/error/e.gif?msg=%24%20is%20not%20defined&lnn=-1&fn=&cid=1129&client=citi&publishPath=na_prod&rid=2680754&did=572750&errorName=ReferenceError
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2600:9000:206f:b400:2:8f43:5780:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: CloudFront /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://banking.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Mon, 04 Dec 2023 05:41:29 GMT
via: 1.1 cc763905c39a59494c951c09271b0422.cloudfront.net (CloudFront)
server: CloudFront
age: 83446
x-amz-cf-pop: FRA56-C1
x-cache: Hit from cloudfront
cache-control: no-cache, no-store
alt-svc: h3=":443"; ma=86400
x-amz-cf-id: _Xx9UZT1-Z2kcW0gtgQHp3IYDrzWeacDBjjtla3rZ-kBfm_pf4o7cQ==

GET
H/1.1 200
OK cls_report Show response
prod.report.nacustomerexperience.citi.com/glassbox/reporting/798b2f12-9162-4a94-91ee-805d883ca266/ 12 KB
3 KB 489ms
113ms XHR
application/json 54.211.113.206
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://prod.report.nacustomerexperience.citi.com/glassbox/reporting/798b2f12-9162-4a94-91ee-805d883ca266/cls_report?_cls_s=dac6ad05-03d9-4c41-aa63-eb8e21a11b60%3A0&_cls_v=5c7b16d4-b317-472c-9c6d-4f36f2b886cc&pv=2&f_cls_s=true

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

54.211.113.206 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-54-211-113-206.compute-1.amazonaws.com

Software

GlassBox Cligate /

Resource Hash

1025b7f7889c3d1361b67221c688db535ead278d485665f1c87ecd13f78dd085

Security Headers

Name	Value
Content-Security-Policy	default-src 'self';
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://banking.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

Date: Tue, 05 Dec 2023 04:52:16 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains
content-encoding: gzip
Content-Security-Policy: default-src 'self';
X-Content-Type-Options: nosniff
Connection: keep-alive
Content-Length: 2161
X-XSS-Protection: 1; mode=block
Referrer-Policy: strict-origin-when-cross-origin
Server: GlassBox Cligate
X-Frame-Options: SAMEORIGIN
vary: origin
Content-Type: application/json
access-control-allow-origin: https://banking.citi.com
access-control-allow-credentials: true
GB-Server: g5045
X-Robots-Tag: noindex

GET
BLOB 200
OK 3872ad5b-3f8c-4979-b5fc-0688e47cb664
https://banking.citi.com/ 75 B
0 Other
application/javascript

General

Check archive.org

Show headers Download Go to

Full URL: blob:https://banking.citi.com/3872ad5b-3f8c-4979-b5fc-0688e47cb664
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 4caed94f9975debb1a1ee2ff2e68395802a18a4cf3f3be7ae057f1b97b2c87ff

Request headers

accept-language: nl-NL,nl;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

Content-Length: 75
Content-Type: application/javascript

GET
H2 200 s91712323487499
metrics1.citi.com/b/ss/citiuscombprod,citicitiuscombprodtest/1/JS-2.23.0/ 43 B
442 B 43ms
42ms Image
image/gif 63.140.62.164
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://metrics1.citi.com/b/ss/citiuscombprod,citicitiuscombprodtest/1/JS-2.23.0/s91712323487499?AQB=1&ndh=1&pf=1&t=5%2F11%2F2023%205%3A52%3A15%202%20-60&sdid=2DA1CE01D3E58C3D-17D9F5F2A481C76D&mid=49306057246851361484453144149901745241&aamlh=6&ce=UTF-8&g=https%3A%2F%2Fbanking.citi.com%2Fcbol%2FOM%2Fchecking%2Ftiered%2Ffeatured-offers%2Fdefault.htm%3FBT_TX%3D1%26ProspectID%3D326D0D64EAD743E4BE6193A917A2C7ED&c.&action_type=page%20view&evarPageName_0=us&evarPageName_1=web&evarPageName_2=public&evarPageName_3=microsite&evarPageName_4=Checking&evarPageName_5=mpp%3Azip%20code%20selector&site_hierarchy_0=us&site_hierarchy_1=web&site_hierarchy_2=public&site_hierarchy_3=microsite&site_hierarchy_4=checking&form_type=razorfish%3A153789%3ACBNA_2023_Reimagine_Checking_Tiered%3A2023Q3&lead_type=bank%7Cmpp&site_name=US&login_status=uknown&domain=banking.citi.com&prospect_id=326D0D64EAD743E4BE6193A917A2C7ED&url=https%3A%2F%2Fbanking.citi.com%2Fcbol%2FOM%2Fchecking%2Ftiered%2Ffeatured-offers%2Fdefault.htm%3FBT_TX%3D1%26ProspectID%3D326D0D64EAD743E4BE6193A917A2C7ED&guid=b604c7ca-0963-43a0-955e-aca8a01592e2&evarpagename=us%7Cweb%7Cpublic%7Cmicrosite%7Cchecking%7Cmpp%3Azip%20code%20selector&app_hierarchy=public%7Cmicrosite%7Cchecking%7Cmpp%3Azip%20code%20selector&page_type=overlay&test_id=199_05%20a%20Checking%20-%20MPP%20-%20Zip%20Code%20Selector&plat=browser&.c&cc=USD&aamb=RKhpRz8krg2tLO6pguXWp5olkAcUniQYPHaMWWgdJ3xzPWQmdj0y&c7=11%3A52%20PM%7CMonday&v7=11%3A52%20PM%7CMonday&v11=New&c65=Sapient_cbol_2023_Reimagine_Checking_Tiered&v85=b604c7ca-0963-43a0-955e-aca8a01592e2&s=1600x1200&c=24&j=1.6&v=N&k=Y&bw=1600&bh=1200&mcorgid=61834D9B5228A7430A490D45%40AdobeOrg&AQE=1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

63.140.62.164 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ip-63-140-62-164.data.adobedc.net

Software

jag /

Resource Hash

a1ecbaed793a1f564c49c671f2dd0ce36f858534ef6d26b55783a06b884cc506

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://banking.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 05 Dec 2023 04:52:15 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
last-modified: Wed, 06 Dec 2023 04:52:15 GMT
server: jag
etag: 3654484454548176896-4617878417494457770
vary: *
p3p: CP="This is not a P3P policy"
access-control-allow-origin: *
content-type: image/gif;charset=utf-8
cache-control: no-cache, no-store, max-age=0, no-transform, private
content-length: 43
x-xss-protection: 1; mode=block
expires: Mon, 04 Dec 2023 04:52:15 GMT

GET
H2 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/916451471/ 3 KB
2 KB 185ms
59ms Script
text/javascript 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/916451471/?random=1701751935853&cv=11&fst=1701751935853&bg=ffffff&guid=ON&async=1&gtm=45be3bt0v867929579&gcd=11l1l1l1l1&dma_cps=sypham&dma=1&u_w=1600&u_h=1200&url=https%3A%2F%2Fbanking.citi.com%2Fcbol%2FOM%2Fchecking%2Ftiered%2Ffeatured-offers%2Fdefault.htm%3FBT_TX%3D1%26ProspectID%3D326D0D64EAD743E4BE6193A917A2C7ED&hn=www.googleadservices.com&frm=0&tiba=Unlock%20up%20to%20%242%2C000%20with%20a%20Citi%C2%AE%20checking%20account%20%7C%20Citi.com&auid=976096460.1701751935&uamb=0&uaw=0&data=event%3Dgtag.config&rfmt=3&fmt=4

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b3e713e2e45197895781a1d7b7070af82a85a62e9859c16d894d8a6927a2b9d1

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://banking.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 05 Dec 2023 04:52:16 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1390
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 199 KB
72 KB 49ms
49ms Script
application/javascript 2a00:1450:4001:80f::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-960621875&l=dataLayer&cx=c

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

22a41256615a192adc91d7a231a750197d72fef5ce2003fc2a54b9f81dc40f5b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://banking.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Tue, 05 Dec 2023 04:52:15 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 74039
x-xss-protection: 0
last-modified: Tue, 05 Dec 2023 03:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Tue, 05 Dec 2023 04:52:15 GMT

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 149 KB
57 KB 51ms
51ms Script
application/javascript 2a00:1450:4001:80f::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-644574043&l=dataLayer&cx=c

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

e42d8705d0826f11ce9ddc01c962571a0909a1587d02ed86939293961049efbe

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://banking.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Tue, 05 Dec 2023 04:52:15 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 58030
x-xss-protection: 0
last-modified: Tue, 05 Dec 2023 03:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Tue, 05 Dec 2023 04:52:15 GMT

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 149 KB
57 KB 54ms
54ms Script
application/javascript 2a00:1450:4001:80f::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-975701947&l=dataLayer&cx=c

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

6e12178f2fb79ce2e9f1a4004f376199e56632ee2b1b570585e4b6c817748ce1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://banking.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Tue, 05 Dec 2023 04:52:15 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 57967
x-xss-protection: 0
last-modified: Tue, 05 Dec 2023 03:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Tue, 05 Dec 2023 04:52:15 GMT

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 212 KB
76 KB 84ms
84ms Script
application/javascript 2a00:1450:4001:80f::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-830907969&l=dataLayer&cx=c

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

ebfdcb078dfcdcad970d32d36606389eada3ed16482f02109aa12273c2a5897f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://banking.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Tue, 05 Dec 2023 04:52:15 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 77491
x-xss-protection: 0
last-modified: Tue, 05 Dec 2023 03:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Tue, 05 Dec 2023 04:52:15 GMT

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 194 KB
71 KB 63ms
63ms Script
application/javascript 2a00:1450:4001:80f::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-695231162&l=dataLayer&cx=c

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

56bf7bd2eb8fb0ca776ec3ccb50bf4d63ccf833698521e0eb7d720423e1a49a0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://banking.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Tue, 05 Dec 2023 04:52:15 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 72471
x-xss-protection: 0
last-modified: Tue, 05 Dec 2023 03:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Tue, 05 Dec 2023 04:52:15 GMT

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 202 KB
73 KB 77ms
77ms Script
application/javascript 2a00:1450:4001:80f::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-819500023&l=dataLayer&cx=c

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

d52fa90fa188a7de8cbe7fe05e4382cccbd1b61d3ba6177a89e01fba893d476c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://banking.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Tue, 05 Dec 2023 04:52:15 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 74524
x-xss-protection: 0
last-modified: Tue, 05 Dec 2023 03:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Tue, 05 Dec 2023 04:52:15 GMT

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 155 KB
59 KB 55ms
55ms Script
application/javascript 2a00:1450:4001:80f::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-959299794&l=dataLayer&cx=c

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

34d1d3196a96d95cd4d1e402af0fdce276c566e4eeec020e4c62a33357980f00

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://banking.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Tue, 05 Dec 2023 04:52:15 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 60228
x-xss-protection: 0
last-modified: Tue, 05 Dec 2023 03:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Tue, 05 Dec 2023 04:52:15 GMT

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 199 KB
72 KB 42ms
42ms Script
application/javascript 2a00:1450:4001:80f::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-10955006959&l=dataLayer&cx=c

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

b8b78e468027b3f3335382828b1669f32207d5ad04dd1478573296d0cdcb7433

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://banking.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Tue, 05 Dec 2023 04:52:15 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 74084
x-xss-protection: 0
last-modified: Tue, 05 Dec 2023 03:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Tue, 05 Dec 2023 04:52:15 GMT

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 232 KB
80 KB 90ms
90ms Script
application/javascript 2a00:1450:4001:80f::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-11172302925&l=dataLayer&cx=c

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

0f195fc4ecf324d1f9f5685c7584951eb48e204add8618bcb5a2055c7b9c1544

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://banking.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Tue, 05 Dec 2023 04:52:15 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 81992
x-xss-protection: 0
last-modified: Tue, 05 Dec 2023 03:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Tue, 05 Dec 2023 04:52:15 GMT

GET
H2 204 5695784.js Show response
bat.bing.com/p/action/ 0
119 B 123ms
123ms Script
text/plain 2620:1ec:c11::200
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://bat.bing.com/p/action/5695784.js

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://banking.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: private,max-age=1800
date: Tue, 05 Dec 2023 04:52:15 GMT
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 214843F1E72C4CE89C2CE748634BA9D1 Ref B: BRU30EDGE0919 Ref C: 2023-12-05T04:52:15Z
x-cache: CONFIG_NOCACHE

GET
H2 204 0
bat.bing.com/action/ 0
286 B 51ms
51ms Image
text/plain 2620:1ec:c11::200
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://bat.bing.com/action/0?ti=5695784&Ver=2&mid=8b42b2fd-1b4a-4f4b-a88a-ac4145595863&sid=0fd67570932a11eebbe0f3e3705f247d&vid=0fd69d50932a11eea4fccfbe3532343f&vids=1&msclkid=N&pi=1200101525&lg=en-US&sw=1600&sh=1200&sc=24&tl=Unlock%20up%20to%20%242,000%20with%20a%20Citi%C2%AE%20checking%20account%20%7C%20Citi.com&p=https%3A%2F%2Fbanking.citi.com%2Fcbol%2FOM%2Fchecking%2Ftiered%2Ffeatured-offers%2Fdefault.htm%3FBT_TX%3D1%26ProspectID%3D326D0D64EAD743E4BE6193A917A2C7ED&r=&lt=2972&evt=pageLoad&sv=1&rn=802694

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://banking.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Tue, 05 Dec 2023 04:52:15 GMT
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 6ED9C7CB1ACE48838EB2B09D6D0B9A52 Ref B: BRU30EDGE0919 Ref C: 2023-12-05T04:52:15Z
x-cache: CONFIG_NOCACHE
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 / Show response
www.googleadservices.com/pagead/conversion/658128868/ 3 KB
2 KB 209ms
81ms Script
text/javascript 142.250.186.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googleadservices.com/pagead/conversion/658128868/?random=1701751935876&cv=11&fst=1701751935876&bg=ffffff&guid=ON&async=1&gtm=45be3bt0v9138128184&gcd=11l1l1l1l1&dma_cps=sypham&dma=1&u_w=1600&u_h=1200&url=https%3A%2F%2Fbanking.citi.com%2Fcbol%2FOM%2Fchecking%2Ftiered%2Ffeatured-offers%2Fdefault.htm%3FBT_TX%3D1%26ProspectID%3D326D0D64EAD743E4BE6193A917A2C7ED&label=JUEtCL3Qv8oBEOT_6LkC&hn=www.googleadservices.com&frm=0&tiba=Unlock%20up%20to%20%242%2C000%20with%20a%20Citi%C2%AE%20checking%20account%20%7C%20Citi.com&gtm_ee=1&auid=976096460.1701751935&uamb=0&uaw=0&data=event%3Dconversion&rfmt=3&fmt=4

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s06-in-f2.1e100.net

Software

cafe /

Resource Hash

4987ecf16cd918045e99795b6610cda200dcb61f4cb0d03957952b12843767df

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://banking.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 05 Dec 2023 04:52:16 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1696
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 12.20b1d36d36c1dfbe70fa.chunk.js Show response
siteintercept.qualtrics.com/dxjsmodule/ 70 KB
21 KB 52ms
51ms Script
application/javascript 104.17.209.240
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://siteintercept.qualtrics.com/dxjsmodule/12.20b1d36d36c1dfbe70fa.chunk.js?Q_CLIENTVERSION=1.103.0&Q_CLIENTTYPE=web&Q_BRANDID=banking.citi.com

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.17.209.240 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

c5b5c93f6affe076aa846f63596819be1a4b6ca73e58baf41f4b01db979fdb4f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://banking.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Tue, 05 Dec 2023 04:52:15 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: br
age: 10508
cf-polished: origSize=72939
content-security-policy-report-only: frame-ancestors 'self' *.qualtrics.com *.my.salesforce.com *.visualforce.com *.visual.force.com *.lightning.force.com; report-uri https://sjc1.qualtrics.com/csp-report
edge-control: max-age=604800
referrer-policy: strict-origin-when-cross-origin
last-modified: Wed, 08 Nov 2023 02:23:30 GMT
cf-bgj: minify
server: cloudflare
etag: W/"11ceb-18bacbdecd0"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=604800, s-maxage=604800
permissions-policy: camera=(), geolocation=(), microphone=()
cf-ray: 8309adbf6e2066f9-AMS
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept
timing-allow-origin: *

OPTIONS
H2 200 tp2
p.tvpixel.com/com.snowplowanalytics.snowplow/ Frame 0
0 343ms
110ms Preflight 52.44.233.116
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://p.tvpixel.com/com.snowplowanalytics.snowplow/tp2
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.44.233.116 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-44-233-116.compute-1.amazonaws.com
Software: nginx /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://banking.citi.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Content-Type, SP-Anonymous
access-control-allow-origin: https://banking.citi.com
access-control-max-age: 600
content-length: 0
date: Tue, 05 Dec 2023 04:52:16 GMT
server: nginx

POST
H2 200 tp2 Show response
p.tvpixel.com/com.snowplowanalytics.snowplow/ 2 B
328 B 328ms
109ms XHR
text/plain 52.44.233.116
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://p.tvpixel.com/com.snowplowanalytics.snowplow/tp2
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.44.233.116 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-44-233-116.compute-1.amazonaws.com
Software: nginx /
Resource Hash: 2689367b205c16ce32ed4200942b8b8b1e262dfc70d9bc9fbc77c49699a4f1df

Request headers

Referer: https://banking.citi.com/
accept-language: nl-NL,nl;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
Content-Type: application/json; charset=UTF-8

Response headers

access-control-allow-origin: https://banking.citi.com
date: Tue, 05 Dec 2023 04:52:16 GMT
access-control-allow-credentials: true
content-type: text/plain; charset=UTF-8
server: nginx
content-length: 2
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR NID PSA OUR IND COM NAV STA"

GET
H2

200

p2
sb.scorecardresearch.com/
Redirect Chain

https://sb.scorecardresearch.com/p?c1=2&c2=34402982&ns_type=hidden&ns_event=page_view&c6=citi-d4f85824-1351-4554-91ff-fdb56f962c5c&c7=https%3A%2F%2Fbanking.citi.com%2Fcbol%2FOM%2Fchecking%2Ftiered%...
https://sb.scorecardresearch.com/p2?c1=2&c2=34402982&ns_type=hidden&ns_event=page_view&c6=citi-d4f85824-1351-4554-91ff-fdb56f962c5c&c7=https%3A%2F%2Fbanking.citi.com%2Fcbol%2FOM%2Fchecking%2Ftiered...

43 B
298 B

39ms
39ms

Image
image/gif

108.157.4.15
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sb.scorecardresearch.com/p2?c1=2&c2=34402982&ns_type=hidden&ns_event=page_view&c6=citi-d4f85824-1351-4554-91ff-fdb56f962c5c&c7=https%3A%2F%2Fbanking.citi.com%2Fcbol%2FOM%2Fchecking%2Ftiered%2Ffeatured-offers%2Fdefault.htm%3FBT_TX%3D1%26ProspectID%3D326D0D64EAD743E4BE6193A917A2C7ED&c8=Unlock%20up%20to%20%242%2C000%20with%20a%20Citi%C2%AE%20checking%20account%20%7C%20Citi.com&c9=&rn=1701751935892
Protocol: H2
Server: 108.157.4.15 , Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: server-108-157-4-15.dus51.r.cloudfront.net
Software: /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://banking.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Tue, 05 Dec 2023 04:52:16 GMT
via: 1.1 268679e7d17267a1a7a03722822fb800.cloudfront.net (CloudFront)
accept-ch: UA, Platform, Arch, Model, Mobile
x-amz-cf-pop: DUS51-P2
x-cache: Miss from cloudfront
content-type: image/gif
content-length: 43
x-amz-cf-id: SEGcC40GX6_aRjMY2mUQlmAGA7wWGQqjxfdnBHrLbBz6rZcWfpe03Q==

Redirect headers

date: Tue, 05 Dec 2023 04:52:16 GMT
via: 1.1 268679e7d17267a1a7a03722822fb800.cloudfront.net (CloudFront)
accept-ch: UA, Platform, Arch, Model, Mobile
x-amz-cf-pop: DUS51-P2
x-cache: Miss from cloudfront
location: /p2?c1=2&c2=34402982&ns_type=hidden&ns_event=page_view&c6=citi-d4f85824-1351-4554-91ff-fdb56f962c5c&c7=https%3A%2F%2Fbanking.citi.com%2Fcbol%2FOM%2Fchecking%2Ftiered%2Ffeatured-offers%2Fdefault.htm%3FBT_TX%3D1%26ProspectID%3D326D0D64EAD743E4BE6193A917A2C7ED&c8=Unlock%20up%20to%20%242%2C000%20with%20a%20Citi%C2%AE%20checking%20account%20%7C%20Citi.com&c9=&rn=1701751935892
content-length: 0
x-amz-cf-id: 5SRXI-nbrBqU6AvEqc56XxO0wgG0of0_qhGX9uaeApsu8Qj52RBiNw==

GET
H2 200 436528.json Show response
s.yimg.com/wi/config/ 2 B
253 B 192ms
129ms XHR
application/json 2a00:1288:80:807::2
YAHOO-DEB

General

Check archive.org

Show headers Download Go to

Full URL

https://s.yimg.com/wi/config/436528.json

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1288:80:807::2 , United Kingdom, ASN203220 (YAHOO-DEB, GB),

Reverse DNS

Software

ATS /

Resource Hash

44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://banking.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Tue, 05 Dec 2023 04:52:15 GMT
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=31536000
x-amz-request-id: NQ9EMG2QK5JD9W5K
age: 1
content-length: 22
x-amz-id-2: dKFOBpfjdrLno7h/BwyILpo/jD3mWVOCoXDmV+on5Ecu4V6TvncxO5vDQswkM8ZBCz9S2faXX04=
x-xss-protection: 1; mode=block
referrer-policy: no-referrer-when-downgrade
server: ATS
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
vary: Origin, Access-Control-Request-Headers, Access-Control-Request-Method, Accept-Encoding
access-control-allow-methods: GET
content-type: application/json
access-control-allow-origin: *
cache-control: public,max-age=3600

GET
H2 200 10200295.json Show response
s.yimg.com/wi/config/ 2 B
450 B 98ms
35ms XHR
application/json 2a00:1288:80:807::2
YAHOO-DEB

General

Check archive.org

Show headers Download Go to

Full URL

https://s.yimg.com/wi/config/10200295.json

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1288:80:807::2 , United Kingdom, ASN203220 (YAHOO-DEB, GB),

Reverse DNS

Software

ATS /

Resource Hash

44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://banking.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Tue, 05 Dec 2023 04:11:11 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
x-amz-request-id: ZCCQYVGQ2NTTV46C
age: 2466
content-length: 2
x-amz-id-2: TPO2fcpWwsf3lzNnO1rSXdBWysWMx5bpfBSgvjjB+crhmDEAxB80nrSATPyml5FbnVJTz4L3UQE=
x-xss-protection: 1; mode=block
referrer-policy: no-referrer-when-downgrade
server: ATS
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
vary: Origin, Access-Control-Request-Headers, Access-Control-Request-Method
access-control-allow-methods: GET
content-type: application/json
access-control-allow-origin: *
cache-control: public,max-age=3600

POST
H2 200 Targeting.php Show response
siteintercept.qualtrics.com/WRSiteInterceptEngine/ 10 KB
2 KB 60ms
60ms XHR
application/json 104.17.209.240
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://siteintercept.qualtrics.com/WRSiteInterceptEngine/Targeting.php?Q_ZoneID=ZN_3VI8kkudS0JJRFc&Q_CLIENTVERSION=1.103.0&Q_CLIENTTYPE=web

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.17.209.240 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

87ea9fb616cb6b6b40cde9afd9abf250e1262de2e00056441da5501ad97999e3

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://banking.citi.com/
accept-language: nl-NL,nl;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
Content-type: application/x-www-form-urlencoded

Response headers

date: Tue, 05 Dec 2023 04:52:15 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
content-encoding: br
content-security-policy-report-only: frame-ancestors 'self' *.qualtrics.com *.my.salesforce.com *.visualforce.com *.visual.force.com *.lightning.force.com; report-uri https://sjc1.qualtrics.com/csp-report
referrer-policy: strict-origin-when-cross-origin
server: cloudflare
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: https://banking.citi.com
cache-control: no-store, no-cache, must-revalidate, max-age=0
access-control-allow-credentials: true
permissions-policy: camera=(), geolocation=(), microphone=()
trace-id: 25fbf43a1778b7c6
cf-ray: 8309adbfce6966f9-AMS
timing-allow-origin: *

GET
H2 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/10955006959/ 3 KB
2 KB 59ms
59ms Script
text/javascript 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/10955006959/?random=1701751935980&cv=11&fst=1701751935980&bg=ffffff&guid=ON&async=1&gtm=45be3bt0v891068819&gcd=11l1l1l1l1&dma_cps=sypham&dma=1&u_w=1600&u_h=1200&url=https%3A%2F%2Fbanking.citi.com%2Fcbol%2FOM%2Fchecking%2Ftiered%2Ffeatured-offers%2Fdefault.htm%3FBT_TX%3D1%26ProspectID%3D326D0D64EAD743E4BE6193A917A2C7ED&hn=www.googleadservices.com&frm=0&tiba=Unlock%20up%20to%20%242%2C000%20with%20a%20Citi%C2%AE%20checking%20account%20%7C%20Citi.com&auid=976096460.1701751935&uamb=0&uaw=0&data=event%3Dgtag.config&rfmt=3&fmt=4

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

48c605f5c60c0e68e4fa3e6f8701d16e39f44afa1b4c77efff2d605fa9dd1fa8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://banking.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 05 Dec 2023 04:52:16 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1391
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/975701947/ 3 KB
2 KB 48ms
48ms Script
text/javascript 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/975701947/?random=1701751935994&cv=11&fst=1701751935994&bg=ffffff&guid=ON&async=1&gtm=45be3bt0v890809048&gcd=11l1l1l1l1&dma_cps=sypham&dma=1&u_w=1600&u_h=1200&url=https%3A%2F%2Fbanking.citi.com%2Fcbol%2FOM%2Fchecking%2Ftiered%2Ffeatured-offers%2Fdefault.htm%3FBT_TX%3D1%26ProspectID%3D326D0D64EAD743E4BE6193A917A2C7ED&hn=www.googleadservices.com&frm=0&tiba=Unlock%20up%20to%20%242%2C000%20with%20a%20Citi%C2%AE%20checking%20account%20%7C%20Citi.com&auid=976096460.1701751935&uamb=0&uaw=0&data=event%3Dgtag.config&rfmt=3&fmt=4

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

f7528d7c7d1441840df28f129e1287fe9d0b77cb5d88142d542dfb4e3eef127e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://banking.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 05 Dec 2023 04:52:16 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1388
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/695231162/ 3 KB
2 KB 47ms
47ms Script
text/javascript 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/695231162/?random=1701751936006&cv=11&fst=1701751936006&bg=ffffff&guid=ON&async=1&gtm=45be3bt0&gcd=11l1l1l1l1&dma_cps=sypham&dma=1&u_w=1600&u_h=1200&url=https%3A%2F%2Fbanking.citi.com%2Fcbol%2FOM%2Fchecking%2Ftiered%2Ffeatured-offers%2Fdefault.htm%3FBT_TX%3D1%26ProspectID%3D326D0D64EAD743E4BE6193A917A2C7ED&hn=www.googleadservices.com&frm=0&tiba=Unlock%20up%20to%20%242%2C000%20with%20a%20Citi%C2%AE%20checking%20account%20%7C%20Citi.com&auid=976096460.1701751935&uamb=0&uaw=0&data=event%3Dgtag.config&rfmt=3&fmt=4

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

d0ea23f1c00c774703b3c7cdef1bf1479dc440c9d159e82ce5e0e9db4ea4f118

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://banking.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 05 Dec 2023 04:52:16 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1380
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/960621875/ 3 KB
2 KB 43ms
43ms Script
text/javascript 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/960621875/?random=1701751936018&cv=11&fst=1701751936018&bg=ffffff&guid=ON&async=1&gtm=45be3bt0&gcd=11l1l1l1l1&dma_cps=sypham&dma=1&u_w=1600&u_h=1200&url=https%3A%2F%2Fbanking.citi.com%2Fcbol%2FOM%2Fchecking%2Ftiered%2Ffeatured-offers%2Fdefault.htm%3FBT_TX%3D1%26ProspectID%3D326D0D64EAD743E4BE6193A917A2C7ED&hn=www.googleadservices.com&frm=0&tiba=Unlock%20up%20to%20%242%2C000%20with%20a%20Citi%C2%AE%20checking%20account%20%7C%20Citi.com&auid=976096460.1701751935&uamb=0&uaw=0&data=event%3Dgtag.config&rfmt=3&fmt=4

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

af8dcdef8bacb21a6914a3326dc1c07365798a1e81a8c4e4cd3972e26e0a703a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://banking.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 05 Dec 2023 04:52:16 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1379
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/644574043/ 3 KB
2 KB 59ms
59ms Script
text/javascript 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/644574043/?random=1701751936028&cv=11&fst=1701751936028&bg=ffffff&guid=ON&async=1&gtm=45be3bt0v896983788&gcd=11l1l1l1l1&dma_cps=sypham&dma=1&u_w=1600&u_h=1200&url=https%3A%2F%2Fbanking.citi.com%2Fcbol%2FOM%2Fchecking%2Ftiered%2Ffeatured-offers%2Fdefault.htm%3FBT_TX%3D1%26ProspectID%3D326D0D64EAD743E4BE6193A917A2C7ED&hn=www.googleadservices.com&frm=0&tiba=Unlock%20up%20to%20%242%2C000%20with%20a%20Citi%C2%AE%20checking%20account%20%7C%20Citi.com&auid=976096460.1701751935&uamb=0&uaw=0&data=event%3Dgtag.config&rfmt=3&fmt=4

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ddc347ed0d0520a5a7677b33a56c651212c58906f69bb38b92d2c7f6bbb15089

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://banking.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 05 Dec 2023 04:52:16 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1386
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/830907969/ 3 KB
2 KB 44ms
44ms Script
text/javascript 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/830907969/?random=1701751936041&cv=11&fst=1701751936041&bg=ffffff&guid=ON&async=1&gtm=45be3bt0v9103109856&gcd=11l1l1l1l1&dma_cps=sypham&dma=1&u_w=1600&u_h=1200&url=https%3A%2F%2Fbanking.citi.com%2Fcbol%2FOM%2Fchecking%2Ftiered%2Ffeatured-offers%2Fdefault.htm%3FBT_TX%3D1%26ProspectID%3D326D0D64EAD743E4BE6193A917A2C7ED&hn=www.googleadservices.com&frm=0&tiba=Unlock%20up%20to%20%242%2C000%20with%20a%20Citi%C2%AE%20checking%20account%20%7C%20Citi.com&auid=976096460.1701751935&uamb=0&uaw=0&data=event%3Dgtag.config&rfmt=3&fmt=4

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

35df360bec33fe8228bd3d245bcb20105181da8f54e5386bbe60223d82af2f40

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://banking.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 05 Dec 2023 04:52:16 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1407
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 CoreModule.js Show response
siteintercept.qualtrics.com/dxjsmodule/ 99 KB
31 KB 103ms
103ms Script
application/javascript 104.17.209.240
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://siteintercept.qualtrics.com/dxjsmodule/CoreModule.js?Q_CLIENTVERSION=1.103.0&Q_CLIENTTYPE=web&Q_BRANDID=citifeedback

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.17.209.240 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

2ca3b492e58624d30201bfe06213e6a513c37f56ba433d9bae00e5513d5576b3

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://banking.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Tue, 05 Dec 2023 04:52:16 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: br
age: 10509
cf-polished: origSize=102574
content-security-policy-report-only: frame-ancestors 'self' *.qualtrics.com *.my.salesforce.com *.visualforce.com *.visual.force.com *.lightning.force.com; report-uri https://sjc1.qualtrics.com/csp-report
edge-control: max-age=604800
referrer-policy: strict-origin-when-cross-origin
last-modified: Wed, 08 Nov 2023 02:23:30 GMT
cf-bgj: minify
server: cloudflare
etag: W/"190ae-18bacbdecd0"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=604800, s-maxage=604800
permissions-policy: camera=(), geolocation=(), microphone=()
cf-ray: 8309adc06ed566f9-AMS
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept
timing-allow-origin: *

GET
H2 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/959299794/ 3 KB
2 KB 46ms
45ms Script
text/javascript 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/959299794/?random=1701751936068&cv=11&fst=1701751936068&bg=ffffff&guid=ON&async=1&gtm=45be3bt0v868557816&gcd=11l1l1l1l1&dma_cps=sypham&dma=1&u_w=1600&u_h=1200&url=https%3A%2F%2Fbanking.citi.com%2Fcbol%2FOM%2Fchecking%2Ftiered%2Ffeatured-offers%2Fdefault.htm%3FBT_TX%3D1%26ProspectID%3D326D0D64EAD743E4BE6193A917A2C7ED&hn=www.googleadservices.com&frm=0&tiba=Unlock%20up%20to%20%242%2C000%20with%20a%20Citi%C2%AE%20checking%20account%20%7C%20Citi.com&auid=976096460.1701751935&uamb=0&uaw=0&data=event%3Dgtag.config&rfmt=3&fmt=4

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

b33625168379e4a8ab687d196077f3b3a9758025b78a8837a4c84629b1505a5c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://banking.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 05 Dec 2023 04:52:16 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1408
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/819500023/ 3 KB
2 KB 47ms
47ms Script
text/javascript 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/819500023/?random=1701751936080&cv=11&fst=1701751936080&bg=ffffff&guid=ON&async=1&gtm=45be3bt0v9103212889&gcd=11l1l1l1l1&dma_cps=sypham&dma=1&u_w=1600&u_h=1200&url=https%3A%2F%2Fbanking.citi.com%2Fcbol%2FOM%2Fchecking%2Ftiered%2Ffeatured-offers%2Fdefault.htm%3FBT_TX%3D1%26ProspectID%3D326D0D64EAD743E4BE6193A917A2C7ED&hn=www.googleadservices.com&frm=0&tiba=Unlock%20up%20to%20%242%2C000%20with%20a%20Citi%C2%AE%20checking%20account%20%7C%20Citi.com&auid=976096460.1701751935&uamb=0&uaw=0&data=event%3Dgtag.config&rfmt=3&fmt=4

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

02bffcdbf0887461cf5ad4f36604e2d21c6a7e0ee9e5a3f883c19b253d34f8ce

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://banking.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 05 Dec 2023 04:52:16 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1405
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/11172302925/ 3 KB
1 KB 44ms
44ms Script
text/javascript 2a00:1450:4001:827::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/11172302925/?random=1701751936098&cv=11&fst=1701751936098&bg=ffffff&guid=ON&async=1&gtm=45be3bt0v9136005172&gcd=11l1l1l1l1&dma_cps=sypham&dma=1&u_w=1600&u_h=1200&url=https%3A%2F%2Fbanking.citi.com%2Fcbol%2FOM%2Fchecking%2Ftiered%2Ffeatured-offers%2Fdefault.htm%3FBT_TX%3D1%26ProspectID%3D326D0D64EAD743E4BE6193A917A2C7ED&hn=www.googleadservices.com&frm=0&tiba=Unlock%20up%20to%20%242%2C000%20with%20a%20Citi%C2%AE%20checking%20account%20%7C%20Citi.com&auid=976096460.1701751935&uamb=0&uaw=0&data=event%3Dgtag.config&rfmt=3&fmt=4

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

6417365c357e7f81e4db788411b12202615cdcb72bb900801037c2cae48417c8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://banking.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 05 Dec 2023 04:52:16 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1410
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 a
www.googletagmanager.com/ 0
11 B 115ms
115ms Image
text/html 2a00:1450:4001:80f::2008
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.googletagmanager.com/a?v=3&t=l&pid=874229774&rv=3bt0&u=AAAAAAAAAAAAACA&h=Ag&gtm=45be3bt0v868557816&ccid=68557816&cid=AW-959299794&l=AW-959299794.L2324.S9.B8.E44.I2225.EC8.TC1.HTC0~gtm.init.S0.V0.E43~gtm.js.S0.V0.TS5rep.TI1.TE0~gtm.dom.S0.V0.E42~*.S0.V0.E42~*.S0.V0.E41~gtm.load.S0.V0.E41~*~gtm.init_consent.S0.V0.E43~AWCT971

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://banking.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Tue, 05 Dec 2023 04:52:16 GMT
server: Google Tag Manager
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
content-type: text/html

GET
H2 200 /
www.google.com/pagead/1p-user-list/916451471/ 42 B
108 B 122ms
47ms Image
image/gif 2a00:1450:4001:81c::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/916451471/?random=1701751935853&cv=11&fst=1701748800000&bg=ffffff&guid=ON&async=1&gtm=45be3bt0v867929579&u_w=1600&u_h=1200&url=https%3A%2F%2Fbanking.citi.com%2Fcbol%2FOM%2Fchecking%2Ftiered%2Ffeatured-offers%2Fdefault.htm%3FBT_TX%3D1%26ProspectID%3D326D0D64EAD743E4BE6193A917A2C7ED&frm=0&tiba=Unlock%20up%20to%20%242%2C000%20with%20a%20Citi%C2%AE%20checking%20account%20%7C%20Citi.com&data=event%3Dgtag.config&fmt=3&is_vtc=1&cid=CAQSGwDICaaNC2x3MFfwLT1jpJXogFqmMOJvsY7kNA&random=1001192876&rmt_tld=0&ipr=y

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81c::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://banking.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 05 Dec 2023 04:52:16 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.nl/pagead/1p-user-list/916451471/ 42 B
108 B 124ms
49ms Image
image/gif 2a00:1450:4001:828::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.nl/pagead/1p-user-list/916451471/?random=1701751935853&cv=11&fst=1701748800000&bg=ffffff&guid=ON&async=1&gtm=45be3bt0v867929579&u_w=1600&u_h=1200&url=https%3A%2F%2Fbanking.citi.com%2Fcbol%2FOM%2Fchecking%2Ftiered%2Ffeatured-offers%2Fdefault.htm%3FBT_TX%3D1%26ProspectID%3D326D0D64EAD743E4BE6193A917A2C7ED&frm=0&tiba=Unlock%20up%20to%20%242%2C000%20with%20a%20Citi%C2%AE%20checking%20account%20%7C%20Citi.com&data=event%3Dgtag.config&fmt=3&is_vtc=1&cid=CAQSGwDICaaNC2x3MFfwLT1jpJXogFqmMOJvsY7kNA&random=1001192876&rmt_tld=1&ipr=y

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://banking.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 05 Dec 2023 04:52:16 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.com/pagead/1p-user-list/10955006959/ 42 B
455 B 120ms
45ms Image
image/gif 2a00:1450:4001:81c::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/10955006959/?random=1701751935980&cv=11&fst=1701748800000&bg=ffffff&guid=ON&async=1&gtm=45be3bt0v891068819&u_w=1600&u_h=1200&url=https%3A%2F%2Fbanking.citi.com%2Fcbol%2FOM%2Fchecking%2Ftiered%2Ffeatured-offers%2Fdefault.htm%3FBT_TX%3D1%26ProspectID%3D326D0D64EAD743E4BE6193A917A2C7ED&frm=0&tiba=Unlock%20up%20to%20%242%2C000%20with%20a%20Citi%C2%AE%20checking%20account%20%7C%20Citi.com&data=event%3Dgtag.config&fmt=3&is_vtc=1&cid=CAQSGwDICaaNYMnt58pAW1oEJkkWtDTVhrdAVONNag&random=2697541977&rmt_tld=0&ipr=y

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81c::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://banking.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 05 Dec 2023 04:52:16 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.nl/pagead/1p-user-list/10955006959/ 42 B
108 B 123ms
49ms Image
image/gif 2a00:1450:4001:828::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.nl/pagead/1p-user-list/10955006959/?random=1701751935980&cv=11&fst=1701748800000&bg=ffffff&guid=ON&async=1&gtm=45be3bt0v891068819&u_w=1600&u_h=1200&url=https%3A%2F%2Fbanking.citi.com%2Fcbol%2FOM%2Fchecking%2Ftiered%2Ffeatured-offers%2Fdefault.htm%3FBT_TX%3D1%26ProspectID%3D326D0D64EAD743E4BE6193A917A2C7ED&frm=0&tiba=Unlock%20up%20to%20%242%2C000%20with%20a%20Citi%C2%AE%20checking%20account%20%7C%20Citi.com&data=event%3Dgtag.config&fmt=3&is_vtc=1&cid=CAQSGwDICaaNYMnt58pAW1oEJkkWtDTVhrdAVONNag&random=2697541977&rmt_tld=1&ipr=y

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://banking.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 05 Dec 2023 04:52:16 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.com/pagead/1p-user-list/975701947/ 42 B
108 B 124ms
51ms Image
image/gif 2a00:1450:4001:81c::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/975701947/?random=1701751935994&cv=11&fst=1701748800000&bg=ffffff&guid=ON&async=1&gtm=45be3bt0v890809048&u_w=1600&u_h=1200&url=https%3A%2F%2Fbanking.citi.com%2Fcbol%2FOM%2Fchecking%2Ftiered%2Ffeatured-offers%2Fdefault.htm%3FBT_TX%3D1%26ProspectID%3D326D0D64EAD743E4BE6193A917A2C7ED&frm=0&tiba=Unlock%20up%20to%20%242%2C000%20with%20a%20Citi%C2%AE%20checking%20account%20%7C%20Citi.com&data=event%3Dgtag.config&fmt=3&is_vtc=1&cid=CAQSGwDICaaNNQ2qwBCMh31GEw5m9EgnHfcr9W3ZHg&random=1352007132&rmt_tld=0&ipr=y

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81c::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://banking.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 05 Dec 2023 04:52:16 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.nl/pagead/1p-user-list/975701947/ 42 B
108 B 122ms
48ms Image
image/gif 2a00:1450:4001:828::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.nl/pagead/1p-user-list/975701947/?random=1701751935994&cv=11&fst=1701748800000&bg=ffffff&guid=ON&async=1&gtm=45be3bt0v890809048&u_w=1600&u_h=1200&url=https%3A%2F%2Fbanking.citi.com%2Fcbol%2FOM%2Fchecking%2Ftiered%2Ffeatured-offers%2Fdefault.htm%3FBT_TX%3D1%26ProspectID%3D326D0D64EAD743E4BE6193A917A2C7ED&frm=0&tiba=Unlock%20up%20to%20%242%2C000%20with%20a%20Citi%C2%AE%20checking%20account%20%7C%20Citi.com&data=event%3Dgtag.config&fmt=3&is_vtc=1&cid=CAQSGwDICaaNNQ2qwBCMh31GEw5m9EgnHfcr9W3ZHg&random=1352007132&rmt_tld=1&ipr=y

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://banking.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 05 Dec 2023 04:52:16 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 dc_pre=CK_xi_2_94IDFcXIOwIdg8APkQ;src=6269322;type=bankp00;cat=proje00b;ord=1;num=6451680302062;auiddc=976096460.1701751935;gtm=45fe3bt0;gcd=11l1l1l1l1;dma_cps=sypham;dma=1;uaa=;uab=;uafvl=;uamb=0;... Show response
adservice.google.com/ddm/fls/i/ Frame 0677 701 B
788 B 160ms
69ms Document
text/html 2a00:1450:4001:81c::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/ddm/fls/i/dc_pre=CK_xi_2_94IDFcXIOwIdg8APkQ;src=6269322;type=bankp00;cat=proje00b;ord=1;num=6451680302062;auiddc=976096460.1701751935;gtm=45fe3bt0;gcd=11l1l1l1l1;dma_cps=sypham;dma=1;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;epver=2;~oref=https%3A%2F%2Fbanking.citi.com%2Fcbol%2FOM%2Fchecking%2Ftiered%2Ffeatured-offers%2Fdefault.htm%3FBT_TX%3D1%26ProspectID%3D326D0D64EAD743E4BE6193A917A2C7ED

Requested by

Host: 6269322.fls.doubleclick.net
URL: https://6269322.fls.doubleclick.net/activityi;dc_pre=CK_xi_2_94IDFcXIOwIdg8APkQ;src=6269322;type=bankp00;cat=proje00b;ord=1;num=6451680302062;auiddc=976096460.1701751935;gtm=45fe3bt0;gcd=11l1l1l1l1;dma_cps=sypham;dma=1;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;epver=2;~oref=https%3A%2F%2Fbanking.citi.com%2Fcbol%2FOM%2Fchecking%2Ftiered%2Ffeatured-offers%2Fdefault.htm%3FBT_TX%3D1%26ProspectID%3D326D0D64EAD743E4BE6193A917A2C7ED?

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81c::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

a309840eef4d323a84a5048e7ff771d15a98ff1d1891fadf7ddc54a35e5860d4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://6269322.fls.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
accept-language: nl-NL,nl;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, must-revalidate
content-encoding: br
content-length: 413
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Tue, 05 Dec 2023 04:52:16 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
pragma: no-cache
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 /
www.google.com/pagead/1p-user-list/695231162/ 42 B
108 B 118ms
46ms Image
image/gif 2a00:1450:4001:81c::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/695231162/?random=1701751936006&cv=11&fst=1701748800000&bg=ffffff&guid=ON&async=1&gtm=45be3bt0&u_w=1600&u_h=1200&url=https%3A%2F%2Fbanking.citi.com%2Fcbol%2FOM%2Fchecking%2Ftiered%2Ffeatured-offers%2Fdefault.htm%3FBT_TX%3D1%26ProspectID%3D326D0D64EAD743E4BE6193A917A2C7ED&frm=0&tiba=Unlock%20up%20to%20%242%2C000%20with%20a%20Citi%C2%AE%20checking%20account%20%7C%20Citi.com&data=event%3Dgtag.config&fmt=3&is_vtc=1&cid=CAQSGwDICaaNp7vYWDtm9WLyVoO-6B7vQwyk4gxtxw&random=1132494225&rmt_tld=0&ipr=y

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81c::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://banking.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 05 Dec 2023 04:52:16 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.nl/pagead/1p-user-list/695231162/ 42 B
455 B 114ms
48ms Image
image/gif 2a00:1450:4001:828::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.nl/pagead/1p-user-list/695231162/?random=1701751936006&cv=11&fst=1701748800000&bg=ffffff&guid=ON&async=1&gtm=45be3bt0&u_w=1600&u_h=1200&url=https%3A%2F%2Fbanking.citi.com%2Fcbol%2FOM%2Fchecking%2Ftiered%2Ffeatured-offers%2Fdefault.htm%3FBT_TX%3D1%26ProspectID%3D326D0D64EAD743E4BE6193A917A2C7ED&frm=0&tiba=Unlock%20up%20to%20%242%2C000%20with%20a%20Citi%C2%AE%20checking%20account%20%7C%20Citi.com&data=event%3Dgtag.config&fmt=3&is_vtc=1&cid=CAQSGwDICaaNp7vYWDtm9WLyVoO-6B7vQwyk4gxtxw&random=1132494225&rmt_tld=1&ipr=y

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://banking.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 05 Dec 2023 04:52:16 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.com/pagead/1p-user-list/960621875/ 42 B
108 B 77ms
47ms Image
image/gif 2a00:1450:4001:81c::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/960621875/?random=1701751936018&cv=11&fst=1701748800000&bg=ffffff&guid=ON&async=1&gtm=45be3bt0&u_w=1600&u_h=1200&url=https%3A%2F%2Fbanking.citi.com%2Fcbol%2FOM%2Fchecking%2Ftiered%2Ffeatured-offers%2Fdefault.htm%3FBT_TX%3D1%26ProspectID%3D326D0D64EAD743E4BE6193A917A2C7ED&frm=0&tiba=Unlock%20up%20to%20%242%2C000%20with%20a%20Citi%C2%AE%20checking%20account%20%7C%20Citi.com&data=event%3Dgtag.config&fmt=3&is_vtc=1&cid=CAQSGwDICaaN7prCswut-bI4FESE8ED_58YwZ6tiyw&random=2989079871&rmt_tld=0&ipr=y

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81c::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://banking.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 05 Dec 2023 04:52:16 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.nl/pagead/1p-user-list/960621875/ 42 B
108 B 46ms
44ms Image
image/gif 2a00:1450:4001:828::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.nl/pagead/1p-user-list/960621875/?random=1701751936018&cv=11&fst=1701748800000&bg=ffffff&guid=ON&async=1&gtm=45be3bt0&u_w=1600&u_h=1200&url=https%3A%2F%2Fbanking.citi.com%2Fcbol%2FOM%2Fchecking%2Ftiered%2Ffeatured-offers%2Fdefault.htm%3FBT_TX%3D1%26ProspectID%3D326D0D64EAD743E4BE6193A917A2C7ED&frm=0&tiba=Unlock%20up%20to%20%242%2C000%20with%20a%20Citi%C2%AE%20checking%20account%20%7C%20Citi.com&data=event%3Dgtag.config&fmt=3&is_vtc=1&cid=CAQSGwDICaaN7prCswut-bI4FESE8ED_58YwZ6tiyw&random=2989079871&rmt_tld=1&ipr=y

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://banking.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 05 Dec 2023 04:52:16 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

/
www.google.nl/pagead/1p-conversion/658128868/
Redirect Chain

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/658128868/?random=1984316251&cv=11&fst=1701751935876&bg=ffffff&guid=ON&async=1&gtm=45be3bt0v9138128184&gcd=11l1l1l1l1&dma_cps=sypham...
https://www.google.com/pagead/1p-conversion/658128868/?random=1984316251&cv=11&fst=1701751935876&bg=ffffff&guid=ON&async=1&gtm=45be3bt0v9138128184&gcd=11l1l1l1l1&dma_cps=sypham&dma=1&u_w=1600&u_h=1...
https://www.google.nl/pagead/1p-conversion/658128868/?random=1984316251&cv=11&fst=1701751935876&bg=ffffff&guid=ON&async=1&gtm=45be3bt0v9138128184&gcd=11l1l1l1l1&dma_cps=sypham&dma=1&u_w=1600&u_h=12...

42 B
108 B

51ms
50ms

Image
image/gif

2a00:1450:4001:828::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.nl/pagead/1p-conversion/658128868/?random=1984316251&cv=11&fst=1701751935876&bg=ffffff&guid=ON&async=1&gtm=45be3bt0v9138128184&gcd=11l1l1l1l1&dma_cps=sypham&dma=1&u_w=1600&u_h=1200&url=https%3A%2F%2Fbanking.citi.com%2Fcbol%2FOM%2Fchecking%2Ftiered%2Ffeatured-offers%2Fdefault.htm%3FBT_TX%3D1%26ProspectID%3D326D0D64EAD743E4BE6193A917A2C7ED&label=JUEtCL3Qv8oBEOT_6LkC&hn=www.googleadservices.com&frm=0&tiba=Unlock%20up%20to%20%242%2C000%20with%20a%20Citi%C2%AE%20checking%20account%20%7C%20Citi.com&gtm_ee=1&auid=976096460.1701751935&uamb=0&uaw=0&data=event%3Dconversion&fmt=3&ct_cookie_present=false&sscte=1&crd=&pscrd=EkxDaEFJZ0k2MnF3WVEyWXZWbUlpWl9mRm5FaVVBZkloUHNvVnI4WWNJQ25QaUt3Wm10MktGZmNBTWxHY3NPWlNjN1c1UjBfQVhROEZuGldDaEFJZ0k2MnF3WVFwdGZCLUxMLWhkbHdFaTBBSDVqUHFfVXNtMThaRFhYTDU0RjNRYnhLYURvR1RxRTVkSzR0ODJ4bUFMcTFTeC12bHMzalhfUGNTQ1UiEwjHxJL9v_eCAxVKCeAKHV-uB9c&is_vtc=1&ocp_id=gKxuZceEAsqSgAff3J64DQ&cid=CAQSKQDICaaNqnxL7zmYSIIKS5nMzV9iKD4BUXSdTTXv1MFV5bdnLUUNT5E5&random=4018001958&ipr=y

Protocol

Server

2a00:1450:4001:828::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://banking.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 05 Dec 2023 04:52:16 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Tue, 05 Dec 2023 04:52:16 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
location: https://www.google.nl/pagead/1p-conversion/658128868/?random=1984316251&cv=11&fst=1701751935876&bg=ffffff&guid=ON&async=1&gtm=45be3bt0v9138128184&gcd=11l1l1l1l1&dma_cps=sypham&dma=1&u_w=1600&u_h=1200&url=https%3A%2F%2Fbanking.citi.com%2Fcbol%2FOM%2Fchecking%2Ftiered%2Ffeatured-offers%2Fdefault.htm%3FBT_TX%3D1%26ProspectID%3D326D0D64EAD743E4BE6193A917A2C7ED&label=JUEtCL3Qv8oBEOT_6LkC&hn=www.googleadservices.com&frm=0&tiba=Unlock%20up%20to%20%242%2C000%20with%20a%20Citi%C2%AE%20checking%20account%20%7C%20Citi.com&gtm_ee=1&auid=976096460.1701751935&uamb=0&uaw=0&data=event%3Dconversion&fmt=3&ct_cookie_present=false&sscte=1&crd=&pscrd=EkxDaEFJZ0k2MnF3WVEyWXZWbUlpWl9mRm5FaVVBZkloUHNvVnI4WWNJQ25QaUt3Wm10MktGZmNBTWxHY3NPWlNjN1c1UjBfQVhROEZuGldDaEFJZ0k2MnF3WVFwdGZCLUxMLWhkbHdFaTBBSDVqUHFfVXNtMThaRFhYTDU0RjNRYnhLYURvR1RxRTVkSzR0ODJ4bUFMcTFTeC12bHMzalhfUGNTQ1UiEwjHxJL9v_eCAxVKCeAKHV-uB9c&is_vtc=1&ocp_id=gKxuZceEAsqSgAff3J64DQ&cid=CAQSKQDICaaNqnxL7zmYSIIKS5nMzV9iKD4BUXSdTTXv1MFV5bdnLUUNT5E5&random=4018001958&ipr=y
content-type: image/gif
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.com/pagead/1p-user-list/644574043/ 42 B
108 B 47ms
45ms Image
image/gif 2a00:1450:4001:81c::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/644574043/?random=1701751936028&cv=11&fst=1701748800000&bg=ffffff&guid=ON&async=1&gtm=45be3bt0v896983788&u_w=1600&u_h=1200&url=https%3A%2F%2Fbanking.citi.com%2Fcbol%2FOM%2Fchecking%2Ftiered%2Ffeatured-offers%2Fdefault.htm%3FBT_TX%3D1%26ProspectID%3D326D0D64EAD743E4BE6193A917A2C7ED&frm=0&tiba=Unlock%20up%20to%20%242%2C000%20with%20a%20Citi%C2%AE%20checking%20account%20%7C%20Citi.com&data=event%3Dgtag.config&fmt=3&is_vtc=1&cid=CAQSGwDICaaNQAV1NiIUsNKlBOgy9sTt2IoMdxZZEA&random=3350759600&rmt_tld=0&ipr=y

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81c::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://banking.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 05 Dec 2023 04:52:16 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.nl/pagead/1p-user-list/644574043/ 42 B
108 B 49ms
47ms Image
image/gif 2a00:1450:4001:828::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.nl/pagead/1p-user-list/644574043/?random=1701751936028&cv=11&fst=1701748800000&bg=ffffff&guid=ON&async=1&gtm=45be3bt0v896983788&u_w=1600&u_h=1200&url=https%3A%2F%2Fbanking.citi.com%2Fcbol%2FOM%2Fchecking%2Ftiered%2Ffeatured-offers%2Fdefault.htm%3FBT_TX%3D1%26ProspectID%3D326D0D64EAD743E4BE6193A917A2C7ED&frm=0&tiba=Unlock%20up%20to%20%242%2C000%20with%20a%20Citi%C2%AE%20checking%20account%20%7C%20Citi.com&data=event%3Dgtag.config&fmt=3&is_vtc=1&cid=CAQSGwDICaaNQAV1NiIUsNKlBOgy9sTt2IoMdxZZEA&random=3350759600&rmt_tld=1&ipr=y

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://banking.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 05 Dec 2023 04:52:16 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.com/pagead/1p-user-list/830907969/ 42 B
108 B 45ms
44ms Image
image/gif 2a00:1450:4001:81c::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/830907969/?random=1701751936041&cv=11&fst=1701748800000&bg=ffffff&guid=ON&async=1&gtm=45be3bt0v9103109856&u_w=1600&u_h=1200&url=https%3A%2F%2Fbanking.citi.com%2Fcbol%2FOM%2Fchecking%2Ftiered%2Ffeatured-offers%2Fdefault.htm%3FBT_TX%3D1%26ProspectID%3D326D0D64EAD743E4BE6193A917A2C7ED&frm=0&tiba=Unlock%20up%20to%20%242%2C000%20with%20a%20Citi%C2%AE%20checking%20account%20%7C%20Citi.com&data=event%3Dgtag.config&fmt=3&is_vtc=1&cid=CAQSKQDICaaN-buzxn-N20vKpVM85tTuOe61Qq4qgElmgSHE5L89_jaxT-fM&random=1457564295&rmt_tld=0&ipr=y

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81c::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://banking.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 05 Dec 2023 04:52:16 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.nl/pagead/1p-user-list/830907969/ 42 B
108 B 50ms
48ms Image
image/gif 2a00:1450:4001:828::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.nl/pagead/1p-user-list/830907969/?random=1701751936041&cv=11&fst=1701748800000&bg=ffffff&guid=ON&async=1&gtm=45be3bt0v9103109856&u_w=1600&u_h=1200&url=https%3A%2F%2Fbanking.citi.com%2Fcbol%2FOM%2Fchecking%2Ftiered%2Ffeatured-offers%2Fdefault.htm%3FBT_TX%3D1%26ProspectID%3D326D0D64EAD743E4BE6193A917A2C7ED&frm=0&tiba=Unlock%20up%20to%20%242%2C000%20with%20a%20Citi%C2%AE%20checking%20account%20%7C%20Citi.com&data=event%3Dgtag.config&fmt=3&is_vtc=1&cid=CAQSKQDICaaN-buzxn-N20vKpVM85tTuOe61Qq4qgElmgSHE5L89_jaxT-fM&random=1457564295&rmt_tld=1&ipr=y

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://banking.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 05 Dec 2023 04:52:16 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.com/pagead/1p-user-list/959299794/ 42 B
108 B 44ms
43ms Image
image/gif 2a00:1450:4001:81c::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/959299794/?random=1701751936068&cv=11&fst=1701748800000&bg=ffffff&guid=ON&async=1&gtm=45be3bt0v868557816&u_w=1600&u_h=1200&url=https%3A%2F%2Fbanking.citi.com%2Fcbol%2FOM%2Fchecking%2Ftiered%2Ffeatured-offers%2Fdefault.htm%3FBT_TX%3D1%26ProspectID%3D326D0D64EAD743E4BE6193A917A2C7ED&frm=0&tiba=Unlock%20up%20to%20%242%2C000%20with%20a%20Citi%C2%AE%20checking%20account%20%7C%20Citi.com&data=event%3Dgtag.config&fmt=3&is_vtc=1&cid=CAQSKQDICaaNlJT15-LP3AjG4TpMyGBO7wtIXhw33fPrCS4WHTHj6L4bGlBU&random=644209523&rmt_tld=0&ipr=y

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81c::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://banking.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 05 Dec 2023 04:52:16 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.nl/pagead/1p-user-list/959299794/ 42 B
108 B 46ms
45ms Image
image/gif 2a00:1450:4001:828::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.nl/pagead/1p-user-list/959299794/?random=1701751936068&cv=11&fst=1701748800000&bg=ffffff&guid=ON&async=1&gtm=45be3bt0v868557816&u_w=1600&u_h=1200&url=https%3A%2F%2Fbanking.citi.com%2Fcbol%2FOM%2Fchecking%2Ftiered%2Ffeatured-offers%2Fdefault.htm%3FBT_TX%3D1%26ProspectID%3D326D0D64EAD743E4BE6193A917A2C7ED&frm=0&tiba=Unlock%20up%20to%20%242%2C000%20with%20a%20Citi%C2%AE%20checking%20account%20%7C%20Citi.com&data=event%3Dgtag.config&fmt=3&is_vtc=1&cid=CAQSKQDICaaNlJT15-LP3AjG4TpMyGBO7wtIXhw33fPrCS4WHTHj6L4bGlBU&random=644209523&rmt_tld=1&ipr=y

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://banking.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 05 Dec 2023 04:52:16 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 sp.pl
sp.analytics.yahoo.com/ 43 B
245 B 172ms
56ms Image
image/gif 212.82.100.181
YAHOO-IRD

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://sp.analytics.yahoo.com/sp.pl?a=10000&d=Tue%2C%2005%20Dec%202023%2004%3A52%3A16%20GMT&n=-1&b=Unlock%20up%20to%20%242%2C000%20with%20a%20Citi%C2%AE%20checking%20account%20%7C%20Citi.com&.yp=436528&f=https%3A%2F%2Fbanking.citi.com%2Fcbol%2FOM%2Fchecking%2Ftiered%2Ffeatured-offers%2Fdefault.htm%3FBT_TX%3D1%26ProspectID%3D326D0D64EAD743E4BE6193A917A2C7ED&enc=UTF-8&yv=1.15.1&tagmgr=gtm%2Censighten

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

212.82.100.181 Dublin, Ireland, ASN34010 (YAHOO-IRD, GB),

Reverse DNS

spdc.pbp.vip.ir2.yahoo.com

Software

ATS /

Resource Hash

0e4b1e428a2198ef747010c094101c257b568a97cdcc0f31ed5e9868cc835b39

Security Headers

Name	Value
Content-Security-Policy	sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://banking.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 05 Dec 2023 04:52:16 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
server: ATS
content-security-policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-frame-options: DENY
content-type: image/gif
cache-control: no-cache, private, must-revalidate
accept-ranges: bytes
content-length: 43
expires: Tue, 05 Dec 2023 04:52:16 GMT

GET
H2 200 sp.pl
sp.analytics.yahoo.com/ 43 B
631 B 159ms
53ms Image
image/gif 212.82.100.181
YAHOO-IRD

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://sp.analytics.yahoo.com/sp.pl?a=10000&b=Unlock%20up%20to%20%242%2C000%20with%20a%20Citi%C2%AE%20checking%20account%20%7C%20Citi.com&.yp=10200295&f=https%3A%2F%2Fbanking.citi.com%2Fcbol%2FOM%2Fchecking%2Ftiered%2Ffeatured-offers%2Fdefault.htm%3FBT_TX%3D1%26ProspectID%3D326D0D64EAD743E4BE6193A917A2C7ED&enc=UTF-8&yv=1.15.1&tagmgr=gtm%2Censighten

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

212.82.100.181 Dublin, Ireland, ASN34010 (YAHOO-IRD, GB),

Reverse DNS

spdc.pbp.vip.ir2.yahoo.com

Software

ATS /

Resource Hash

0e4b1e428a2198ef747010c094101c257b568a97cdcc0f31ed5e9868cc835b39

Security Headers

Name	Value
Content-Security-Policy	sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://banking.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 05 Dec 2023 04:52:16 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
server: ATS
content-security-policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-frame-options: DENY
content-type: image/gif
cache-control: no-cache, private, must-revalidate
accept-ranges: bytes
content-length: 43
expires: Tue, 05 Dec 2023 04:52:16 GMT

GET
H/1.1 200
OK p13n.min.js Show response
cdn.boomtrain.com/p13n/citibank/ 93 KB
30 KB 133ms
35ms Script
application/javascript 18.173.233.115
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.boomtrain.com/p13n/citibank/p13n.min.js
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 18.173.233.115 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-173-233-115.dus51.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: e7197436f61ab4ed82036cc8a9d11084bc3125921bf0e74fe95370b8f0bc1b42

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://banking.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

x-amz-version-id: WDInTamZBtfgMffg23t45zcNzAyZlVig
Content-Encoding: gzip
Via: 1.1 0ff344318780e69ac3266c8bf539c810.cloudfront.net (CloudFront)
Date: Tue, 05 Dec 2023 04:10:27 GMT
X-Amz-Cf-Pop: DUS51-P3
Age: 3285
x-amz-server-side-encryption: AES256
Transfer-Encoding: chunked
X-Cache: Hit from cloudfront
Connection: keep-alive
Last-Modified: Mon, 04 Dec 2023 02:35:21 GMT
Server: AmazonS3
ETag: W/"dfa5f2f08b4c648d50820fc41af6479a"
Vary: Accept-Encoding
Content-Type: application/javascript
Cache-Control: public, max-age=3600
X-Amz-Cf-Id: lulSjLJj_XMFTYkl1TjAjuToWjrcTRMOziib_sXHUT8diechYv1HnQ==

GET
H2 200 /
www.google.com/pagead/1p-user-list/819500023/ 42 B
108 B 46ms
45ms Image
image/gif 2a00:1450:4001:81c::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/819500023/?random=1701751936080&cv=11&fst=1701748800000&bg=ffffff&guid=ON&async=1&gtm=45be3bt0v9103212889&u_w=1600&u_h=1200&url=https%3A%2F%2Fbanking.citi.com%2Fcbol%2FOM%2Fchecking%2Ftiered%2Ffeatured-offers%2Fdefault.htm%3FBT_TX%3D1%26ProspectID%3D326D0D64EAD743E4BE6193A917A2C7ED&frm=0&tiba=Unlock%20up%20to%20%242%2C000%20with%20a%20Citi%C2%AE%20checking%20account%20%7C%20Citi.com&data=event%3Dgtag.config&fmt=3&is_vtc=1&cid=CAQSKQDICaaN3jHLWtMvf7i4_A769Xy-6RCkeEE4vYnwq2dJr7QW-gHHsKzv&random=155098413&rmt_tld=0&ipr=y

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81c::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://banking.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 05 Dec 2023 04:52:16 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.nl/pagead/1p-user-list/819500023/ 42 B
108 B 47ms
46ms Image
image/gif 2a00:1450:4001:828::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.nl/pagead/1p-user-list/819500023/?random=1701751936080&cv=11&fst=1701748800000&bg=ffffff&guid=ON&async=1&gtm=45be3bt0v9103212889&u_w=1600&u_h=1200&url=https%3A%2F%2Fbanking.citi.com%2Fcbol%2FOM%2Fchecking%2Ftiered%2Ffeatured-offers%2Fdefault.htm%3FBT_TX%3D1%26ProspectID%3D326D0D64EAD743E4BE6193A917A2C7ED&frm=0&tiba=Unlock%20up%20to%20%242%2C000%20with%20a%20Citi%C2%AE%20checking%20account%20%7C%20Citi.com&data=event%3Dgtag.config&fmt=3&is_vtc=1&cid=CAQSKQDICaaN3jHLWtMvf7i4_A769Xy-6RCkeEE4vYnwq2dJr7QW-gHHsKzv&random=155098413&rmt_tld=1&ipr=y

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://banking.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 05 Dec 2023 04:52:16 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.com/pagead/1p-user-list/11172302925/ 42 B
108 B 46ms
46ms Image
image/gif 2a00:1450:4001:81c::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/11172302925/?random=1701751936098&cv=11&fst=1701748800000&bg=ffffff&guid=ON&async=1&gtm=45be3bt0v9136005172&u_w=1600&u_h=1200&url=https%3A%2F%2Fbanking.citi.com%2Fcbol%2FOM%2Fchecking%2Ftiered%2Ffeatured-offers%2Fdefault.htm%3FBT_TX%3D1%26ProspectID%3D326D0D64EAD743E4BE6193A917A2C7ED&frm=0&tiba=Unlock%20up%20to%20%242%2C000%20with%20a%20Citi%C2%AE%20checking%20account%20%7C%20Citi.com&data=event%3Dgtag.config&fmt=3&is_vtc=1&cid=CAQSKQDICaaNtmV6PpxoXG5f47hvhBDpn4GALUMdX9eJ6P348JLijNfcjpJl&random=1092959545&rmt_tld=0&ipr=y

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81c::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://banking.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 05 Dec 2023 04:52:16 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.nl/pagead/1p-user-list/11172302925/ 42 B
108 B 48ms
47ms Image
image/gif 2a00:1450:4001:828::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.nl/pagead/1p-user-list/11172302925/?random=1701751936098&cv=11&fst=1701748800000&bg=ffffff&guid=ON&async=1&gtm=45be3bt0v9136005172&u_w=1600&u_h=1200&url=https%3A%2F%2Fbanking.citi.com%2Fcbol%2FOM%2Fchecking%2Ftiered%2Ffeatured-offers%2Fdefault.htm%3FBT_TX%3D1%26ProspectID%3D326D0D64EAD743E4BE6193A917A2C7ED&frm=0&tiba=Unlock%20up%20to%20%242%2C000%20with%20a%20Citi%C2%AE%20checking%20account%20%7C%20Citi.com&data=event%3Dgtag.config&fmt=3&is_vtc=1&cid=CAQSKQDICaaNtmV6PpxoXG5f47hvhBDpn4GALUMdX9eJ6P348JLijNfcjpJl&random=1092959545&rmt_tld=1&ipr=y

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://banking.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 05 Dec 2023 04:52:16 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 7.61eadfb61701cbba3995.chunk.js Show response
siteintercept.qualtrics.com/dxjsmodule/ 2 KB
1 KB 48ms
47ms Script
application/javascript 104.17.209.240
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://siteintercept.qualtrics.com/dxjsmodule/7.61eadfb61701cbba3995.chunk.js?Q_CLIENTVERSION=1.103.0&Q_CLIENTTYPE=web&Q_BRANDID=citifeedback

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.17.209.240 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

d33eafe7c71aa27415b3fe0254b6e1c4be7cfccdb32fec684bf876f52b291cbe

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://banking.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Tue, 05 Dec 2023 04:52:16 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: br
age: 7972
cf-polished: origSize=2904
content-security-policy-report-only: frame-ancestors 'self' *.qualtrics.com *.my.salesforce.com *.visualforce.com *.visual.force.com *.lightning.force.com; report-uri https://sjc1.qualtrics.com/csp-report
edge-control: max-age=604800
referrer-policy: strict-origin-when-cross-origin
last-modified: Wed, 08 Nov 2023 02:23:30 GMT
cf-bgj: minify
server: cloudflare
etag: W/"b58-18bacbdecd0"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=604800, s-maxage=604800
permissions-policy: camera=(), geolocation=(), microphone=()
cf-ray: 8309adc19f8f66f9-AMS
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept
timing-allow-origin: *

GET
H2 200 1.b6ed8c4fe4b3f457815a.chunk.js Show response
siteintercept.qualtrics.com/dxjsmodule/ 28 KB
7 KB 43ms
43ms Script
application/javascript 104.17.209.240
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://siteintercept.qualtrics.com/dxjsmodule/1.b6ed8c4fe4b3f457815a.chunk.js?Q_CLIENTVERSION=1.103.0&Q_CLIENTTYPE=web&Q_BRANDID=citifeedback

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.17.209.240 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

d420011478b9237ee35799a2ad0c8ec8dd01cb9d5cfc7295fdb48556c240c7b0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://banking.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Tue, 05 Dec 2023 04:52:16 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: br
age: 10508
cf-polished: origSize=29402
content-security-policy-report-only: frame-ancestors 'self' *.qualtrics.com *.my.salesforce.com *.visualforce.com *.visual.force.com *.lightning.force.com; report-uri https://sjc1.qualtrics.com/csp-report
edge-control: max-age=604800
referrer-policy: strict-origin-when-cross-origin
last-modified: Wed, 08 Nov 2023 02:23:30 GMT
cf-bgj: minify
server: cloudflare
etag: W/"72da-18bacbdecd0"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=604800, s-maxage=604800
permissions-policy: camera=(), geolocation=(), microphone=()
cf-ray: 8309adc19f9066f9-AMS
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept
timing-allow-origin: *

GET
H2 200 FeedbackButtonModule.js Show response
siteintercept.qualtrics.com/dxjsmodule/ 63 KB
23 KB 49ms
48ms Script
application/javascript 104.17.209.240
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://siteintercept.qualtrics.com/dxjsmodule/FeedbackButtonModule.js?Q_CLIENTVERSION=1.103.0&Q_CLIENTTYPE=web&Q_BRANDID=citifeedback

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.17.209.240 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

1eaa61116a44b60d15c87e58db63270223e677db1d546e128906d77d11c8a572

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://banking.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Tue, 05 Dec 2023 04:52:16 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: br
age: 10508
cf-polished: origSize=65278
content-security-policy-report-only: frame-ancestors 'self' *.qualtrics.com *.my.salesforce.com *.visualforce.com *.visual.force.com *.lightning.force.com; report-uri https://sjc1.qualtrics.com/csp-report
edge-control: max-age=604800
referrer-policy: strict-origin-when-cross-origin
last-modified: Wed, 08 Nov 2023 02:23:30 GMT
cf-bgj: minify
server: cloudflare
etag: W/"fefe-18bacbdecd0"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=604800, s-maxage=604800
permissions-policy: camera=(), geolocation=(), microphone=()
cf-ray: 8309adc19f9166f9-AMS
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept
timing-allow-origin: *

GET
H2 200 Asset.php Show response
siteintercept.qualtrics.com/WRSiteInterceptEngine/ 10 KB
1 KB 95ms
39ms XHR
application/json 104.17.208.240
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://siteintercept.qualtrics.com/WRSiteInterceptEngine/Asset.php?Module=SI_0AioryRkl8bxHM2&Version=25&Q_ORIGIN=https://banking.citi.com&Q_CLIENTVERSION=1.103.0&Q_CLIENTTYPE=web

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.17.208.240 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

4b99a4e92de3333bf62e8c2766dc1a880f1c19308c1591d2516974f6369b721a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://banking.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

servershortname
date: Tue, 05 Dec 2023 04:52:16 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: br
age: 133980
content-security-policy-report-only: frame-ancestors 'self' *.qualtrics.com *.my.salesforce.com *.visualforce.com *.visual.force.com *.lightning.force.com; report-uri https://sjc1.qualtrics.com/csp-report
p3p: CP="CAO DSP COR CURa ADMa DEVa OUR IND PHY ONL UNI COM NAV INT DEM PRE"
edge-control: max-age=604800
referrer-policy: strict-origin-when-cross-origin
last-modified: Sun, 03 Dec 2023 15:39:16 GMT
server: cloudflare
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: *
cache-control: public, max-age=604800, s-maxage=604800, max-age=315360000
access-control-allow-credentials: false
permissions-policy: camera=(), geolocation=(), microphone=()
cf-ray: 8309adc17de50b64-AMS
expires: Wed, 30 Nov 2033 15:39:16 GMT

GET
H2 200 Asset.php Show response
siteintercept.qualtrics.com/WRSiteInterceptEngine/ 2 KB
1 KB 94ms
39ms XHR
application/json 104.17.208.240
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://siteintercept.qualtrics.com/WRSiteInterceptEngine/Asset.php?Module=CR_6sPqDX4wKQujPO6&Version=9&Q_InterceptID=SI_0AioryRkl8bxHM2&Q_ORIGIN=https://banking.citi.com&Q_CLIENTVERSION=1.103.0&Q_CLIENTTYPE=web

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.17.208.240 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

566095a5f65029a8730735e82ff6cf43336a92723d96484db740011b88467aa1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://banking.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

servershortname
date: Tue, 05 Dec 2023 04:52:16 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: br
age: 133980
content-security-policy-report-only: frame-ancestors 'self' *.qualtrics.com *.my.salesforce.com *.visualforce.com *.visual.force.com *.lightning.force.com; report-uri https://sjc1.qualtrics.com/csp-report
p3p: CP="CAO DSP COR CURa ADMa DEVa OUR IND PHY ONL UNI COM NAV INT DEM PRE"
edge-control: max-age=604800
referrer-policy: strict-origin-when-cross-origin
last-modified: Sun, 03 Dec 2023 15:39:16 GMT
server: cloudflare
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: *
cache-control: public, max-age=604800, s-maxage=604800, max-age=315360000
access-control-allow-credentials: false
permissions-policy: camera=(), geolocation=(), microphone=()
cf-ray: 8309adc17de60b64-AMS
expires: Wed, 30 Nov 2033 15:39:16 GMT

GET
H3

200

dc_pre=CK_xi_2_94IDFcXIOwIdg8APkQ;src=6269322;type=bankp00;cat=proje00b;ord=1;num=6451680302062;auiddc=976096460.1701751935;gtm=45fe3bt0;gcd=11l1l1l1l1;dma_cps=sypham;dma=1;uaa=;uab=;uafvl=;uamb=0;... Show response
6269322.fls.doubleclick.net/ddm/fls/r/ Frame 9065
Redirect Chain

https://adservice.google.nl/ddm/fls/i/dc_pre=CK_xi_2_94IDFcXIOwIdg8APkQ;src=6269322;type=bankp00;cat=proje00b;ord=1;num=6451680302062;auiddc=976096460.1701751935;gtm=45fe3bt0;gcd=11l1l1l1l1;dma_cps...
https://6269322.fls.doubleclick.net/ddm/fls/r/dc_pre=CK_xi_2_94IDFcXIOwIdg8APkQ;src=6269322;type=bankp00;cat=proje00b;ord=1;num=6451680302062;auiddc=976096460.1701751935;gtm=45fe3bt0;gcd=11l1l1l1l1...

872 B
374 B

70ms
70ms

Document
text/html

216.58.206.38
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://6269322.fls.doubleclick.net/ddm/fls/r/dc_pre=CK_xi_2_94IDFcXIOwIdg8APkQ;src=6269322;type=bankp00;cat=proje00b;ord=1;num=6451680302062;auiddc=976096460.1701751935;gtm=45fe3bt0;gcd=11l1l1l1l1;dma_cps=sypham;dma=1;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;epver=2;~oref=https%3A%2F%2Fbanking.citi.com%2Fcbol%2FOM%2Fchecking%2Ftiered%2Ffeatured-offers%2Fdefault.htm%3FBT_TX%3D1%26ProspectID%3D326D0D64EAD743E4BE6193A917A2C7ED

Requested by

Host: adservice.google.com
URL: https://adservice.google.com/ddm/fls/i/dc_pre=CK_xi_2_94IDFcXIOwIdg8APkQ;src=6269322;type=bankp00;cat=proje00b;ord=1;num=6451680302062;auiddc=976096460.1701751935;gtm=45fe3bt0;gcd=11l1l1l1l1;dma_cps=sypham;dma=1;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;epver=2;~oref=https%3A%2F%2Fbanking.citi.com%2Fcbol%2FOM%2Fchecking%2Ftiered%2Ffeatured-offers%2Fdefault.htm%3FBT_TX%3D1%26ProspectID%3D326D0D64EAD743E4BE6193A917A2C7ED

Protocol

Security

QUIC, , AES_128_GCM

Server

216.58.206.38 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

mil07s07-in-f6.1e100.net

Software

cafe /

Resource Hash

f9e007219be87251c82a5e3d8b5b4cf0c7380fd6c020a8d6c884770ae1f70c51

Security Headers

Name	Value
Strict-Transport-Security	max-age=21600
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://adservice.google.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
accept-language: nl-NL,nl;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=0
content-encoding: br
content-length: 351
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Tue, 05 Dec 2023 04:52:16 GMT
expires: Tue, 05 Dec 2023 04:52:16 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
strict-transport-security: max-age=21600
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

Redirect headers

alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, must-revalidate
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Tue, 05 Dec 2023 04:52:16 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
location: https://6269322.fls.doubleclick.net/ddm/fls/r/dc_pre=CK_xi_2_94IDFcXIOwIdg8APkQ;src=6269322;type=bankp00;cat=proje00b;ord=1;num=6451680302062;auiddc=976096460.1701751935;gtm=45fe3bt0;gcd=11l1l1l1l1;dma_cps=sypham;dma=1;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;epver=2;~oref=https%3A%2F%2Fbanking.citi.com%2Fcbol%2FOM%2Fchecking%2Ftiered%2Ffeatured-offers%2Fdefault.htm%3FBT_TX%3D1%26ProspectID%3D326D0D64EAD743E4BE6193A917A2C7ED
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
pragma: no-cache
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 Graphic.php
iad1.qualtrics.com/WRQualtricsSiteIntercept/ 2 KB
3 KB 184ms
65ms Image
image/png 184.30.20.101
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://iad1.qualtrics.com/WRQualtricsSiteIntercept/Graphic.php?IM=IM_2ghDuHHjeSOirNc

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

184.30.20.101 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a184-30-20-101.deploy.static.akamaitechnologies.com

Software

Resource Hash

25f4eeb23f67fe1d74534ed37230ecd54ab4f57524276970dcbeaaf3b0fc64f9

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://banking.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Tue, 05 Dec 2023 04:52:16 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
content-security-policy-report-only: frame-ancestors 'self' *.qualtrics.com *.my.salesforce.com *.visualforce.com *.visual.force.com *.lightning.force.com; report-uri https://sjc1.qualtrics.com/csp-report
content-disposition: inline; filename=feedback.png
content-length: 2196
x-request-id: f6bb3151-39d6-4169-bc19-8494a8ce2587
referrer-policy: strict-origin-when-cross-origin
etag: "e6ed675f115fb1568bb1aabc00aa3f30"
content-type: image/png
access-control-allow-origin: *
x-transaction-id: cb51ea6c-d510-4cf8-8711-d543c0c671bf
cache-control: public, max-age=19
permissions-policy: camera=(), geolocation=(), microphone=()
x-robots-tag: noindex
expires: Tue, 05 Dec 2023 04:52:35 GMT

GET
H/1.1 200
OK resolve Show response
people.api.boomtrain.com/identify/ 142 B
457 B 482ms
140ms XHR
application/json 52.45.23.69
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://people.api.boomtrain.com/identify/resolve?data=eyJjb29raWUiOnsiYnNpbiI6IiJ9LCJxdWVyeXN0cmluZyI6e30sImV4dGVybmFsX2lkcyI6eyJ6eW5jIjoiODgzNGE3ZTMtNWE4OC00MTQ5LTlhZGEtZDE2NDE1M2UwMWQ4OjE3MDE3NTE5MzYuMDM0MzA5In19&site_id=citibank
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.45.23.69 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-45-23-69.compute-1.amazonaws.com
Software: nginx /
Resource Hash: a01200eae7a185d27438003fb891d9585db8842a75e4a1d1756e12002d253444

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://banking.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

Date: Tue, 05 Dec 2023 04:52:16 GMT
Server: nginx
Access-Control-Allow-Methods: GET,PUT,POST,DELETE
Content-Type: application/json
Access-Control-Allow-Origin: *
Connection: keep-alive
Access-Control-Allow-Headers: X-Requested-With,Content-Type,Authorization,x-app-id
Content-Length: 142

POST
H2 200 / Show response
siteintercept.qualtrics.com/WRSiteInterceptEngine/ 45 B
217 B 134ms
133ms XHR
text/plain 104.17.208.240
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://siteintercept.qualtrics.com/WRSiteInterceptEngine/?Q_Impress=1&Q_CID=CR_6sPqDX4wKQujPO6&Q_SIID=SI_0AioryRkl8bxHM2&Q_ASID=AS_07210024&Q_CLIENTVERSION=1.103.0&Q_CLIENTTYPE=web&r=1701751936492

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.17.208.240 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f47f21063dfdcbdeffed3d97689b45efae7a52401cd7fc5b8d07c42d2f232ab9

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://banking.citi.com/
accept-language: nl-NL,nl;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
Content-type: application/x-www-form-urlencoded

Response headers

date: Tue, 05 Dec 2023 04:52:16 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-encoding: br
cf-cache-status: DYNAMIC
x-content-type-options: nosniff
content-security-policy-report-only: frame-ancestors 'self' *.qualtrics.com *.my.salesforce.com *.visualforce.com *.visual.force.com *.lightning.force.com; report-uri https://sjc1.qualtrics.com/csp-report
referrer-policy: strict-origin-when-cross-origin
server: cloudflare
vary: Accept-Encoding
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://banking.citi.com
cache-control: no-store, no-cache, must-revalidate, max-age=0
access-control-allow-credentials: true
permissions-policy: camera=(), geolocation=(), microphone=()
trace-id: bc14b22d385fd5b1
cf-ray: 8309adc32ef50b64-AMS

GET
H2 200 wr-dialog-close-btn-white.png
siteintercept.qualtrics.com/WRQualtricsShared/Graphics/siteintercept/ 254 B
526 B 42ms
42ms Image
image/png 104.17.209.240
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://siteintercept.qualtrics.com/WRQualtricsShared/Graphics/siteintercept/wr-dialog-close-btn-white.png

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.17.209.240 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

cd5496f75a7c1029bc681f639794b83f034d5ecd884e8514ae12b13eee9eec70

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://banking.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

expires: Thu, 10 Nov 2033 06:31:37 GMT
date: Tue, 05 Dec 2023 04:52:16 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
age: 1894839
cf-polished: origSize=759
content-security-policy-report-only: frame-ancestors 'self' *.qualtrics.com *.my.salesforce.com *.visualforce.com *.visual.force.com *.lightning.force.com; report-uri https://sjc1.qualtrics.com/csp-report
p3p: CP="CAO DSP COR CURa ADMa DEVa OUR IND PHY ONL UNI COM NAV INT DEM PRE"
content-length: 254
referrer-policy: strict-origin-when-cross-origin
last-modified: Mon, 06 Nov 2023 19:06:31 GMT
cf-bgj: imgq:85,h2pri
server: cloudflare
vary: Accept-Encoding
content-type: image/png
cache-control: max-age=315360000, public
permissions-policy: camera=(), geolocation=(), microphone=()
accept-ranges: bytes
cf-ray: 8309adc328c566f9-AMS
trace-id: 78350a494b7da43f
servershortname

GET
H2 200 conversion.js Show response
www.googleadservices.com/pagead/ Frame 9065 50 KB
19 KB 74ms
73ms Script
text/javascript 142.250.186.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googleadservices.com/pagead/conversion.js

Requested by

Host: 6269322.fls.doubleclick.net
URL: https://6269322.fls.doubleclick.net/ddm/fls/r/dc_pre=CK_xi_2_94IDFcXIOwIdg8APkQ;src=6269322;type=bankp00;cat=proje00b;ord=1;num=6451680302062;auiddc=976096460.1701751935;gtm=45fe3bt0;gcd=11l1l1l1l1;dma_cps=sypham;dma=1;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;epver=2;~oref=https%3A%2F%2Fbanking.citi.com%2Fcbol%2FOM%2Fchecking%2Ftiered%2Ffeatured-offers%2Fdefault.htm%3FBT_TX%3D1%26ProspectID%3D326D0D64EAD743E4BE6193A917A2C7ED

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s06-in-f2.1e100.net

Software

cafe /

Resource Hash

5b67576b5fd64ab752f6398646ab89ce082c5b680936553840eed2f65a27ded8

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://6269322.fls.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Tue, 05 Dec 2023 04:52:16 GMT
content-encoding: br
x-content-type-options: nosniff
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 18830
x-xss-protection: 0
server: cafe
etag: 6029415071406068945
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=3600
timing-allow-origin: *
expires: Tue, 05 Dec 2023 04:52:16 GMT

GET
H3 200 / Show response
www.googleadservices.com/pagead/conversion/857721185/ Frame 9065 3 KB
2 KB 44ms
44ms Script
text/javascript 142.250.186.98
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googleadservices.com/pagead/conversion/857721185/?random=1701751936636&cv=9&fst=1701751936636&num=1&npa=1&label=1foCCOHD6eoYEOGS_5gD&guid=ON&resp=GooglemKTybQhCsO&eid=375603260%2C466465925%2C512247839&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=3&u_nmime=4&sendb=1&ig=1&frm=2&url=https%3A%2F%2F6269322.fls.doubleclick.net%2Fddm%2Ffls%2Fr%2Fdc_pre%3DCK_xi_2_94IDFcXIOwIdg8APkQ%3Bsrc%3D6269322%3Btype%3Dbankp00%3Bcat%3Dproje00b%3Bord%3D1%3Bnum%3D6451680302062%3Bauiddc%3D976096460.1701751935%3Bgtm%3D45fe3bt0%3Bgcd%3D11l1l1l1l1%3Bdma_cps%3Dsypham%3Bdma%3D1%3Buaa%3D%3Buab%3D%3Buafvl%3D%3Buamb%3D0%3Buam%3D%3Buap%3D%3Buapv%3D%3Buaw%3D0%3Bepver%3D2%3B~oref%3Dhttps%253A%252F%252Fbanking.citi.com%252Fcbol%252FOM%252Fchecking%252Ftiered%252Ffeatured-offers%252Fdefault.htm%253FBT_TX%253D1%2526ProspectID%253D326D0D64EAD743E4BE6193A917A2C7ED&ref=https%3A%2F%2Fadservice.google.com%2F&top=https%3A%2F%2Fbanking.citi.com%2F&hn=www.googleadservices.com&rfmt=3&fmt=4

Requested by

Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/conversion.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.98 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s06-in-f2.1e100.net

Software

cafe /

Resource Hash

9a94f6a73911aa86d33b5652d5ae0225583fc5081361f08e3c2acee30ecb9ebe

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://6269322.fls.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 05 Dec 2023 04:52:16 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1701
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3

200

/
www.google.nl/pagead/1p-conversion/857721185/ Frame 9065
Redirect Chain

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/857721185/?random=692069601&cv=9&fst=1701751936636&num=1&npa=1&label=1foCCOHD6eoYEOGS_5gD&guid=ON&resp=GooglemKTybQhCsO&eid=37560326...
https://www.google.com/pagead/1p-conversion/857721185/?random=692069601&cv=9&fst=1701751936636&num=1&npa=1&label=1foCCOHD6eoYEOGS_5gD&guid=ON&resp=GooglemKTybQhCsO&eid=375603260%2C466465925%2C51224...
https://www.google.nl/pagead/1p-conversion/857721185/?random=692069601&cv=9&fst=1701751936636&num=1&npa=1&label=1foCCOHD6eoYEOGS_5gD&guid=ON&resp=GooglemKTybQhCsO&eid=375603260%2C466465925%2C512247...

42 B
64 B

74ms
74ms

Image
image/gif

2a00:1450:4001:828::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.nl/pagead/1p-conversion/857721185/?random=692069601&cv=9&fst=1701751936636&num=1&npa=1&label=1foCCOHD6eoYEOGS_5gD&guid=ON&resp=GooglemKTybQhCsO&eid=375603260%2C466465925%2C512247839&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=3&u_nmime=4&sendb=1&ig=1&frm=2&url=https%3A%2F%2F6269322.fls.doubleclick.net%2Fddm%2Ffls%2Fr%2Fdc_pre%3DCK_xi_2_94IDFcXIOwIdg8APkQ%3Bsrc%3D6269322%3Btype%3Dbankp00%3Bcat%3Dproje00b%3Bord%3D1%3Bnum%3D6451680302062%3Bauiddc%3D976096460.1701751935%3Bgtm%3D45fe3bt0%3Bgcd%3D11l1l1l1l1%3Bdma_cps%3Dsypham%3Bdma%3D1%3Buaa%3D%3Buab%3D%3Buafvl%3D%3Buamb%3D0%3Buam%3D%3Buap%3D%3Buapv%3D%3Buaw%3D0%3Bepver%3D2%3B~oref%3Dhttps%253A%252F%252Fbanking.citi.com%252Fcbol%252FOM%252Fchecking%252Ftiered%252Ffeatured-offers%252Fdefault.htm%253FBT_TX%253D1%2526ProspectID%253D326D0D64EAD743E4BE6193A917A2C7ED&ref=https%3A%2F%2Fadservice.google.com%2F&top=https%3A%2F%2Fbanking.citi.com%2F&hn=www.googleadservices.com&fmt=3&ct_cookie_present=false&sscte=1&crd=&pscrd=IhMI7aW5_b_3ggMV_NkRCB2xtAPF&is_vtc=1&ocp_id=gKxuZe3lKPyzx_APsemOqAw&cid=CAQSKQDICaaN-K4265GwSYVZcmU63ol3uI1cWdMfGX56eMlFlurNOdntutiJ&random=2372630858&resp=GooglemKTybQhCsO&ipr=y

Requested by

Protocol

Server

2a00:1450:4001:828::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://6269322.fls.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 05 Dec 2023 04:52:16 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Tue, 05 Dec 2023 04:52:16 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
location: https://www.google.nl/pagead/1p-conversion/857721185/?random=692069601&cv=9&fst=1701751936636&num=1&npa=1&label=1foCCOHD6eoYEOGS_5gD&guid=ON&resp=GooglemKTybQhCsO&eid=375603260%2C466465925%2C512247839&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=60&u_java=false&u_nplug=3&u_nmime=4&sendb=1&ig=1&frm=2&url=https%3A%2F%2F6269322.fls.doubleclick.net%2Fddm%2Ffls%2Fr%2Fdc_pre%3DCK_xi_2_94IDFcXIOwIdg8APkQ%3Bsrc%3D6269322%3Btype%3Dbankp00%3Bcat%3Dproje00b%3Bord%3D1%3Bnum%3D6451680302062%3Bauiddc%3D976096460.1701751935%3Bgtm%3D45fe3bt0%3Bgcd%3D11l1l1l1l1%3Bdma_cps%3Dsypham%3Bdma%3D1%3Buaa%3D%3Buab%3D%3Buafvl%3D%3Buamb%3D0%3Buam%3D%3Buap%3D%3Buapv%3D%3Buaw%3D0%3Bepver%3D2%3B~oref%3Dhttps%253A%252F%252Fbanking.citi.com%252Fcbol%252FOM%252Fchecking%252Ftiered%252Ffeatured-offers%252Fdefault.htm%253FBT_TX%253D1%2526ProspectID%253D326D0D64EAD743E4BE6193A917A2C7ED&ref=https%3A%2F%2Fadservice.google.com%2F&top=https%3A%2F%2Fbanking.citi.com%2F&hn=www.googleadservices.com&fmt=3&ct_cookie_present=false&sscte=1&crd=&pscrd=IhMI7aW5_b_3ggMV_NkRCB2xtAPF&is_vtc=1&ocp_id=gKxuZe3lKPyzx_APsemOqAw&cid=CAQSKQDICaaN-K4265GwSYVZcmU63ol3uI1cWdMfGX56eMlFlurNOdntutiJ&random=2372630858&resp=GooglemKTybQhCsO&ipr=y
content-type: image/gif
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 200 track Show response
events.api.boomtrain.com/event/ 2 B
209 B 357ms
122ms XHR
text/plain 34.193.174.103
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://events.api.boomtrain.com/event/track
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.193.174.103 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-193-174-103.compute-1.amazonaws.com
Software: nginx /
Resource Hash: 565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3

Request headers

Referer: https://banking.citi.com/
accept-language: nl-NL,nl;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: *
date: Tue, 05 Dec 2023 04:52:17 GMT
server: nginx
access-control-allow-headers: X-Requested-With, Content-Type, Authorization, x-app-id
content-length: 2
access-control-allow-methods: GET, PUT, POST, DELETE
content-type: text/plain

GET
H2 204 r.rnc
data.privacy.ensighten.com/privacy/v1/b/ 0
106 B 34ms
34ms Image
text/plain 3.124.119.57
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://data.privacy.ensighten.com/privacy/v1/b/r.rnc?n=1&c=1129&i=6ot4yv&p=na_prod&s=15793&d=8HB7InZlcnNpb24iOiIxLjAuMCIsImdhdGV3YXkiOiIyLjMuNjExIiwiY2xpZW50SWQiOjExMjksInB1Ymxpc2hQYXRoIjoibmFfcHJvZCIsImluc3RhbmNlSWQiOiI2b3Q0eXYiLCJwYWNrZXQiOjEsIm1vZGUiOiJlbmZvcmNlWgDwCG9va2llcyI6eyJCQU5ORVJfTE9BREVEkQDyJyJ9LCJlbnZpcm9ubWVudCI6IkNCT0wgUHJpdmFjeSIsInJlcXVlc3RzIjpbeyJkZXN0aW5hdM4A8BZodHRwczovL2JhbmtpbmcuY2l0aS5jb20vY2JvbC9PTS9jaGVjGgDwRi90aWVyZWQvZmVhdHVyZWQtb2ZmZXJzL2pzL21haW4uNmNjNWUyZDkwYzk1ODRjYWY3NjEuYnVuZGxlLmpzIiwidHlwZSI6InNjcmlwdCIsInN0YXLtAMA3MDE3NTE5MzUwMDHIAAA9AQYUAPEBMzAsInNvdXJjZSI6Im11dLgAsU9ic2VydmVyQ0wiSAChdHVzIjoibG9hZO0AQGFzb27sANRdLCJkYXRhUGF0dGVyEgCybGlzdCI6W10sImlqAM8yNTk3NDYyNzgzfSweAQXyAG5leHVzLmVuc2lnaHRlbiEBUml0aS9u0wETL5AA8BZvbXBvbmVudC5waHA_bmFtZXNwYWNlPUJvb3RzdHJhcHBlciZzxAAwY0pzFQIfPVkADmNjb2RlLyZIAvAEZWRPbj1UdWUlMjBOb3YlMjAyOAUA0DM6NDc6NDklMjBHTVQRAFIwMjMmQ4sCIEQ9igKBJlBhZ2VJRD3uAZwlM0ElMkYlMkb0ATAlMkb2AVAlMkZPTQwAA_oBMiUyRvwBOyUyRv4B_zwlMkZkZWZhdWx0Lmh0bSUzRkJUX1RYJTNEMSUyNlByb3NwZWN0SUQlM0QzMjZEMEQ2NEVBRDc0M0U0QkU2MTkzQTkxN0EyQzdFRCIhAg9ONDk5OSECJzYzIQLPaW5zZXJ0QmVmb3JlGwIwrzMyMDUwOTQ2NjcbAv-NTzUwMDAbAgwPPARCBSECHzghAgeGbWV0cmljczFbBfZwaWQ_ZF92aXNpZF92ZXI9NC40LjAmZF9maWVsZGdyb3VwPUEmbWNvcmdpZD02MTgzNEQ5QjUyMjhBNzQzMEE0OTBENDUlNDBBZG9iZU9yZyZtaWQ9NDkzMDYwNTcyNDY4NTEzNjE0ODQ0NTMxNDQxNDk5MDE3NDUyNDEmdHM9MV0FNTg0IncDMnhocjIDGnKVBS44NFkBABQABZUFslhIUl9NQU5BR0VSQQACjgVvYWxsb3dlkQUiUDgzOTk1HwQPVQH_XQ-NBhPwGjdjOGFlMWY5YzIwNjkzMDAyODY3Mjk0OWM2NzAzZjZkLmpzP2NvbmRpYgi2SWQwPTQ4NDk5NjNrAh9zAwgHLjYybgIvOTbiBUevMTc4MTg2OTQ4MmwCBw8XAXEfMxcBDA_eBEIFHQEPGgkpAcEI_xA5MzkzNWE0MDk2NTE2NDQ3MTcyZDlkM2YxZDIzNzEwNAIAXzMzMDcyMwITDzYKAC85NzMCR68wNTA0NzU5NTE0MwItDxYBSg8yAgEIFgEPMgJCBRwBHzYcAS3_EGM2NWEzNjA5ZTFiZWVkNzI5NTViODhhZmFjOGNkMzEyAgBAODA4OIQND2gMDw9lBAIfODICSI80OTY5MzkwNyYICA9lBBMPFgFKDzICAQgWAQ8yAkMEHAEfOTICLf4ROGRmMzU0MDI3YmY1ODQ1NTUzMzllN2FiNGUzYTc0ZjeYBl85NTM3MjMCKB85MwJHnzIzMzc3NjY5MXsFLg8XAUsPNAIBCBcBDzQCQgUdAQ-CBS7_EGYwZGIxY2Y0NDk2YzhiNDJjNWExYjJmYTQwYjRmMTU0AgBvODk3MDk5mQYTDswIEDGnDAU6Cw-uDjq_Njk5Njg0MTM4MDZ9BS4PFwFLDjQCChcBDzQCQAcdAQ_LDykBzAj-EWYxMjA0NDlkY2RiODRjM2I2ZDBmNThjOGI5OGFkOGEzaAQAIAsPMwIoHzFnBEiPNzgwMTA0Nzf_Ci4PFgFKDzICAQgWAQ8yAkA0NzAyHAEPgwUuMDUwMeMU_wkyOTA4M2Q2OTViNDMzZDQwZTQzZGNmNGTMCABQOTUxMzBlFg_NCBAPHQEBFzIzAg8dAUKvMDU2MDQzNDA5MLcHLVBlNmI5ZlAO_QgyMGVmY2M5ZWE4ZTdlNjA0Yjg5N2M4Y08DfzMwMTMzMzeDBRMPHQEBCDEUDx0BQ482NzY5NDM2OGwELv0RNzM0OWZjYjg1MmRjMDY0YTc4ZWY1NWUxMzJiNzI0NDEdAW80OTA2MzfUCBQPHQFirzMxMTU4Nzg5NDU6Ai3wAmE5NjA3YmJlYjJlNmUwNmMwsQO-ZDQ3NDU5MDA3OTkdAU84Njc1OQIUD7wHARc0VgMPvAc6vzcwMjg4NjQ1NzQ40wguDxYBSg8yAgEIFgEPTwNCBRwBDzICLv8QMWJlMDdhYWYyYzZlOWMwMzAwYzNlOTA3ZTMwNGJiOe8JAF8yMTkwOGsEEw8yAgAYND8NDzICPJ8wNTU0NzI0MzllBC4PFgFKDzICAAkWAQ8yAkIFHAEPcQ8IAekcsGRlbWRleC5uZXQvFx0QNcYav2w_ZF9uc2lkPTAjLxsLBhcCU2lmcmFtcRoMPxcPFwIAGDaIEQAVHGBuZENoaWwsFwAdHA_NHCmPMzc4NTA1ODY4DgkP-gBVHTa0FBkx-gAP-wFCBQEBDxcDCAz4HA_sHhlANDc2LlEQ_wE3ZjhjMTBmYjdjZmU0YmQw6x4cANceImVugR4AHApYOTM1MTYuBA8dAUOPNDE1MjY5MTLvCwgPHQEp_wk3NzUuMzk2NGQ2MjJmNTY4ZjJiMWRiNTkdATAfN9MKT1A0MDcwMvAdD5kIBw8dASn_BzQuMjJjM2MwNTY0MzY5OWM5NjI4MWIbATEIIBkPOAJDfzE5MDY2MzJsBgkPGwEp_wk1MzMuMmM1ZmYwYjlkOTY2NmE4ODkzNWMdARwAciMMVQMAMyAFcREPbAU7MDE5NAwSLzAyBA0IDxYBcA9rBAEJFgEPMwJCBR0BHzFOAweRYzEucmZpaHVigQefanMvdGMubWluLyQUATUSC-8BLzI1FxBPjzE3MDcxMjQ1YQYIAGIHoGNvcnBjcmVkaXQcJMFpYy50dC5vbXRyZGPuAPICcmVzdC92MS9kZWxpdmVyeT87Jh89OwABQCZzZXN9JvMVSWQ9ODkzMTk1NmU2NmUyNDA4MTk4ODAyNmQxMDg2YWM1ZTEmqCZnPTIuMTAuQRsP3x8ELjI1pgcBFAAFNAMP3x8-nzM0OTEwMjkwMs8LCA8GAQEPQQH_HJVkbi5nYnFvZnOsJkAtbmEtfyj_AC9wL2RldGVjdG9yLWRvbXIDGg7OCy8yOKEnTp8xNTUxMDM0NTFoBQjxBXd3dy5nb29nbGV0YWdtYW5hZ2Vy-gD3BWd0YWcvanM_aWQ9REMtNjI2MDAw9iIPiyAHHzGOKAAoNDK6Cw84BUKPMDI3MDY2ODU8EgkPVQYq_wYxLmEzMTgzMTk5MjE5ZTdkMzM3NDJqBxwQMUAGC3sFLzQzvwpOnzE1MjUzNDQxM3sFCJQyMDc2NjY5OXBbBgHMKhJh2Q0AbiX0BTkmcmE9MTY1OCZyYj02NDgmY2E9NQDwBCZfbz0xNzE2OTE3NSZfdD1zYXDQKwAVKdQyMDIzcmVpbWFnaW5lFCsCFymgJl9yZXY9MSZfcCAYAAkA8QVvcmRlcmlkPTEmc3N2X2N1dWlkPQsAwnBhY2thZ2U9bnVsbBEAMHJvZJIqBxIAMGFnZToqD30AFS9wZdYpiEAmcGY9cAH3ADczOTIzNDQyMTI4MTI3M1IRDzsPBy4yNO4pKDQ0gQMPUhE8nzIzMzA2NjI0N2gECAQqAg9fAv-xHjUyKgpfAg_gBUIFZQIPGAsID-AFKf8IMjc4LjAwNjc2NDVlODA2ZWFkNjA4MWRoDhwP4QUBEDUrCgUXCg8dAUKfMTY4MDU5MTQ3DSIID-oHF3A5MzIyJmw9AzCmTGF5ZXImY3g9Y7UTD_sHBy40MhULKDU43wYPegQ8nzMwNDMyNjY4NmscCA_4AFIdN7MTCvgAD_YBQgX-AA_8GAgP_gAWXzU2NzEw9gEkDv4ANzYwOfQZD_4AQp8xMzU1NjIyNzkPDQgP_gAWXzY4ODU4_gA3LzM1_gBNfzA4NjE4NzkrHQoP_gAVXzQxNTgx8gMlD_wBAB80WBNOnzA3OTMxMjI0N9EKCA8NBiYArAqgZXMvaGVhZGVyLVIPcC1sb2dvLWzENDAuNmXKJPYDODUxODk3OTgxNDE2MTAuc3ZnIAUgaW0NAA2mNS41NdIYKDY4lwkPJwNCEDMRFD82MzN2KwkPKwEtcnppcC1zZWwbDwAsAf8FLjBkYzQ5OGUwZjVhZjUzNWIzMjUmARUOQwYvNzFNBFB_MTk2OTUwMPkaCAAEEPYNLnJlcG9ydC5uYWN1c3RvbWVyZXhwZXJpZW5jZagykmdsYXNzYm94Ly4A8h5pbmcvNzk4YjJmMTItOTE2Mi00YTk0LTkxZWUtODA1ZDg4M2NhMjY2L2Nsc18zACA_XwwA8RxzPWRhYzZhZDA1LTAzZDktNGM0MS1hYTYzLWViOGUyMWExMWI2MCUzQTAmMADxHnY9NWM3YjE2ZDQtYjMxNy00NzJjLTljNmQtNGYzNmYyYjg4NmNjJnB2PTImZjIAUHM9dHJ1gRsDMCMP7hIELjc0wRABFAAF1wgP7hI-jzEzOTkzMTQ0YiUJD5IB_4APcwYRIEFXBQNPNDUxNHAjEz03MjheCR84vjhKjzc2MTM0NzY5TgssD-kAHh4zuQ8K6QAPIgZDwDc2MTM0NzcxMH1dfQ
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 3.124.119.57 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-124-119-57.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://banking.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Tue, 05 Dec 2023 04:52:17 GMT
cache-control: no-cache, no-store
server: nginx
expires: Tue, 05 Dec 2023 04:52:16 GMT

GET
H2 204 r.rnc
data.privacy.ensighten.com/privacy/v1/b/ 0
106 B 35ms
34ms Image
text/plain 3.124.119.57
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://data.privacy.ensighten.com/privacy/v1/b/r.rnc?n=2&c=1129&i=6ot4yv&p=na_prod&s=15702&d=8HB7InZlcnNpb24iOiIxLjAuMCIsImdhdGV3YXkiOiIyLjMuNjExIiwiY2xpZW50SWQiOjExMjksInB1Ymxpc2hQYXRoIjoibmFfcHJvZCIsImluc3RhbmNlSWQiOiI2b3Q0eXYiLCJwYWNrZXQiOjEsIm1vZGUiOiJlbmZvcmNlWgDwCG9va2llcyI6eyJCQU5ORVJfTE9BREVEkQDyJyJ9LCJlbnZpcm9ubWVudCI6IkNCT0wgUHJpdmFjeSIsInJlcXVlc3RzIjpbeyJkZXN0aW5hdM4A8AhodHRwczovL2JhdC5iaW5nLmNvbS9hYx4A8P8PLzA_dGk9NTY5NTc4NCZWZXI9MiZtaWQ9OGI0MmIyZmQtMWI0YS00ZjRiLWE4OGEtYWM0MTQ1NTk1ODYzJnNpZD0wZmQ2NzU3MDkzMmExMWVlYmJlMGYzZTM3MDVmMjQ3ZCZ2aWQ9MGZkNjlkNTA5MzJhMTFlZWE0ZmNjZmJlMzUzMjM0M2Ymdmlkcz0xJm1zY2xraWQ9TiZwaT0xMjAwMTAxNTI1JmxnPWVuLVVTJnN3PTE2MDAmc2g9MTIwMCZzYz0yNCZ0bD1VbmxvY2slMjB1cCUyMHRvJTIwJTI0MiwwMDAlMjB3aXRoJTIwYSUyMENpdGklQzIlQUUlMjBjaGVja2luZyUyMGFjY291bnQlMjAlN0MlMjBDaXRpKAExJnA9PwHAJTNBJTJGJTJGYmFuMwAjLmMhAMAlMkZjYm9sJTJGT00MAAVTAP2kRnRpZXJlZCUyRmZlYXR1cmVkLW9mZmVycyUyRmRlZmF1bHQuaHRtJTNGQlRfVFglM0QxJTI2UHJvc3BlY3RJRCUzRDMyNkQwRDY0RUFENzQzRTRCRTYxOTNBOTE3QTJDN0VEJnI9Jmx0PTI5NzImZXZ0PXBhZ2VMb2FkJnN2PTEmcm49ODAyNjk0IiwidHlwZSI6ImltZyIsInN0YXJ0IjoxNzAxNzUxOTM1ODY5LCJlbmQUAPIQc291cmNlIjoiSFRNTEltYWdlX1NFVEFUVFJJQlVURUwA0XR1cyI6ImFsbG93ZWSKAkBhc29uiQLUXSwiZGF0YVBhdHRlchIAsGxpc3QiOltdLCJpRAPvNzAxMzk5NzgzODUyfSy7AhIAyAI1anMi1gBic2NyaXB0jQAK2QAwNzI4NwMDaAAH7QAF2QDCaW5zZXJ0QmVmb3JlQgACzwA_bG9hzAAinzU5ODU3ODc5MMwAPx8zpQENMW11dPMDr09ic2VydmVyQ0zSADc_ODAx0gAH8AV3d3cuZ29vZ2xldGFnbWFuYWdlcj0DZy9ndGFnL40E8AQ_aWQ9QVctNjU4MTI4ODY4Jmw9IQKvTGF5ZXImY3g9Y9UBEx431QFPODMsItUBRUAzNTQ0IwUvNjQDAXYPDAIBCQMBDwwCQgQJAS83NgkBB_ADem4zdmk4a2t1ZHMwampyZmMtKgXxEWZlZWRiYWNrLnNpdGVpbnRlcmNlcHQucXVhbHRyaWNzLgLxAlNJRS8_UV9aSUQ9Wk5fM1ZJRwBvUzBKSlJGGgITHzEjAwAnODUaAqBhcHBlbmRDaGls3gM_c3Rh7gMqjzA2MDg5ODY1EAGGDycCAggQAQ8nAkIEFwEfOScCCJFwLnR2cGl4ZWz6AfADY29tLnNub3dwbG93YW5hbHl0FAIEEgBGL3RwMhkEMnhoctcECusFLzg5_AEAABQABRYEslhIUl9NQU5BR0VSQQAC_AEPuQYlvzY5OTg0MDE3MTUz7QUID-gAPj05MDD-BAEUAA_oAFAPAwYIGWPQAfEAanMvY3VycmVudC9kcG1f6QHAX21pbi5qcz9haWQ9EwTwIy1kNGY4NTgyNC0xMzUxLTQ1NTQtOTFmZi1mZGI1NmY5NjJjNWMmY29tc2NvcmU9dHJ1oQcDyQgP8wcJDggCCiABD_MHPK8zMDc3MjA0NDU5FQUHDx4Bdw8SBAAKHgEPEgRCBCQBHzYkAQgA1gkPngz__xg3OTIx1gcMtAIYQeAFQGVycm8yBi9yZZcMP1JzLnlpbVAP_wZ3aS9jb25maWcvNDM2NTI4Lmpzb262Bg4QOUIQGmV6DQEUABRzeg0PtgY_jzk2NjkyOTAxzgUID9gALx8zpgYAABQAD9gAUA9HDggP2AACjzEwMjAwMjk1sgEUAMYADLIBABQAD9oARc83MDE0NjUwMTY5MjViBgcP2gDVT3l0Yy78DycZOakBDwkIPJ8yNTA3NjQyNDgnDggKpwEPzQAYD7gHAQnNAAwEBQ_9DzIE0wAfOXoCFg_TABgeMscPD6ABUx8zRwMIcXIucmxjZG6WDGA0MjU0NjalE_YmbD9lcz04MDY3NiZ1PWRhMzlhM2VlNWU2YjRiMGQzMjU1YmZlZjk1NjAxODkwYWZkODA3MDn9BVBpZnJhbb4KHHN6Ex83AAYBGDOiDQ-yDjufMTQ2NzI5MDcxBAF5D9wCAggEAQ_cAkIECwEfMgsBCQ-uEAh0V1JTaXRlScwQ0EVuZ2luZS9UYXJnZXRlFzBwaHDNED9vbmXQEAL1CSZRX0NMSUVOVFZFUlNJT049MS4xMDMuMBgAhlRZUEU9d2ViRwIP-g4EPjk0NBIOABQAD5IGSX83Nzg3NzMw6wQJDzwBkx81PAEACHwCD4AJPADOBwM8AQ9UBQkPPAEI8BlkeGpzbW9kdWxlLzEyLjIwYjFkMzZkMzZjMWRmYmU3MGZhLmNodW5rbA8PZAIVvCZRX0JSQU5ESUQ94BgGfwIPdA8HEDhkEwwUCRg0RgEPwgNCnzIzMTM5NTc5OcIDCA-bFgsjanOSFr8xMDk1NTAwNjk1OZQWIj44NjJIAic4N6QMD20IPX8wMDQzNDE2mgcJD_wAVh8z_AAMD_4BQwQCAQ9mFAgPAgEUEDnCHE8xOTQ3_AEkHjEAAQl6FA_8ATyvMzg5NTAzNjM4OMkIBw_6AFQP-gEACfoAD_oBQgQAAQ9lGwkPAAEUnzY5NTIzMTE2MvoBJA32Az82MDGKGkiPMjQ2NjUxMzQKDgkP-gBUDfoBC_oAD_oBQgUAAQ_0AzCPNjA2MjE4NzX6ASQN4BBPNjAyNPAFRyAwOHYhPzU3NXIJCA_6ARQfOfoALA_6AQAJ-gAP-gFCBQABHzf0BC6fNjQ0NTc0MDQz-gEkDe4FPzYwM_oBSJ8xNjQ2NDQ4OTRmGggP-gEUD_oALQ_6AQAJ-gAP-gFCBQABD9gTCA8AARSPODMwOTA3OTbkCSUP-gEALzUy9ANFvzY5OTY5NzUzMTgy-gBvD_oBAAn6AA_6AUAHAAEP9AQICTYaFHDWJgCuIT83ODQqFBQtODaKEik2MN8AD4URO58yODc4MjkzMzHYAE4NCx0L2AAPtwFAJTcw3wAPpQcwjzU5Mjk5Nzk0qwUkD58JAB83nwlInzE2NzIyODE2OeccCA-rBBQfOfoALA-xAwAJ-gAP-gFCAwABLzcwqwYvjzgxOTUwMDAypQclD_oBAC84NqsFRa83MDEyNDAxODA0xCgJD_oBFA_6AC0P-gEACfoAD_oBQwQAAQ-LETCAMTE3MjMwMjn5Kw8fKCAuODYCATcxMDj8AQ8CAUKfMzg4MDAyNjM1_AIIAiQp8AdhZHMuZy5kb3VibGVjbGljay5uZXQvvCvzAmFkL3ZpZXd0aHJvdWdoY29uki73BC85MTY0NTE0NzEvP3JhbmRvbT29K8s1MyZjdj0xMSZmc3QYAEFiZz1mAQDwFCZndWlkPU9OJmFzeW5jPTEmZ3RtPTQ1YmUzYnQwdjg2NzkyShODJmdjZD0xMWwCAPAAJmRtYV9jcHM9c3lwaGFtDwBiPTEmdV93hi0ydV9ohy0_dXJsJi2JNmhuPXwDIGFkHSsxaWNldCjfJmZybT0wJnRpYmE9VUQuA08lMkMwRi4uEGF_AaY5NzYwOTY0NjAuvgHgJnVhbWI9MCZ1YXc9MCYNK5A9ZXZlbnQlM0Q9KxIuVCCAJnJmbXQ9MyYGAAfPLQ-SFQgeNqAOKDExkhUP0wg7nzA1NDE5Njc3OPoGCA_-Av__Ww8DBgAJ_gIPAwZCBAUDHzmwDQgPBQMmB6IYDwUGAD85ODAFBgIAGAAPBQYVjzkxMDY4ODE5BQb_txA5gRoKlxs4NjExBgsPBwNCjzI5NjY0OTI4DAZDBKsZDwUDAS85NAUDAz85NCYFAxZ_MDgwOTA0OAUD_7gAkBoPBQNgAAwkTzc5MzIRCUEFthoOBQNPNjAwNgUDAQEYAA8FAxMP-wL_tj42MDEGET8xMTcKD0vwADY5OTY3MDU1NjU5Mn1dfQ
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 3.124.119.57 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-124-119-57.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://banking.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Tue, 05 Dec 2023 04:52:17 GMT
cache-control: no-cache, no-store
server: nginx
expires: Tue, 05 Dec 2023 04:52:16 GMT

GET
H2 204 r.rnc
data.privacy.ensighten.com/privacy/v1/b/ 0
106 B 34ms
34ms Image
text/plain 3.124.119.57
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://data.privacy.ensighten.com/privacy/v1/b/r.rnc?n=3&c=1129&i=6ot4yv&p=na_prod&s=16481&d=8HB7InZlcnNpb24iOiIxLjAuMCIsImdhdGV3YXkiOiIyLjMuNjExIiwiY2xpZW50SWQiOjExMjksInB1Ymxpc2hQYXRoIjoibmFfcHJvZCIsImluc3RhbmNlSWQiOiI2b3Q0eXYiLCJwYWNrZXQiOjEsIm1vZGUiOiJlbmZvcmNlWgDwCG9va2llcyI6eyJCQU5ORVJfTE9BREVEkQDyJyJ9LCJlbnZpcm9ubWVudCI6IkNCT0wgUHJpdmFjeSIsInJlcXVlc3RzIjpbeyJkZXN0aW5hdM4A8ypodHRwczovL2dvb2dsZWFkcy5nLmRvdWJsZWNsaWNrLm5ldC9wYWdlYWQvdmlld3Rocm91Z2hjb24RAfsbLzk2MDYyMTg3NS8_cmFuZG9tPTE3MDE3NTE5MzYwMTgmY3Y9MTEmZnN0GABBYmc9ZgEA8xYmZ3VpZD1PTiZhc3luYz0xJmd0bT00NWJlM2J0MCZnY2Q9MTFsAgDwACZkbWFfY3BzPXN5cGhhbQ8A8AM9MSZ1X3c9MTYwMCZ1X2g9MTIJADFybD3aAPAWJTNBJTJGJTJGYmFua2luZy5jaXRpLmNvbSUyRmNib2wlMkZPTQwAMGhlYyAA9V4lMkZ0aWVyZWQlMkZmZWF0dXJlZC1vZmZlcnMlMkZkZWZhdWx0Lmh0bSUzRkJUX1RYJTNEMSUyNlByb3NwZWN0SUQlM0QzMjZEMEQ2NEVBRDc0M0U0QkU2MTkzQTkxN0EyQzdFRCZobj13d3cudAFwZXJ2aWNlc5gA9TYmZnJtPTAmdGliYT1VbmxvY2slMjB1cCUyMHRvJTIwJTI0MiUyQzAwMCUyMHdpdGglMjBhJTIwQ2l0aSVDMiVBRSUyMGPNAIAwYWNjb3VudDoAIzdDKAABZwAQYXUBpTk3NjA5NjQ2MC60AfAgNSZ1YW1iPTAmdWF3PTAmZGF0YT1ldmVudCUzRGd0YWcuY29uZmlnJnJmbXQ9MyYGAPAJNCIsInR5cGUiOiJzY3JpcHQiLCJzdGFyygIGCwIgMjSlAgAaAwUUAKAxMTcsInNvdXJjPAAxbXV0lQKiT2JzZXJ2ZXJDTEgAoXR1cyI6ImxvYWTKAkBhc29uyQIwXSwinQBkUGF0dGVyEgCzbGlzdCI6W10sImlqAL84OTM2NDk3MzF9LPsCBQ-LAQUE-AIH7QKeNjU4MTI4ODY47QJPNTg3Nu0CAQEYAA_tAhNAdjkxM2AAPzE4NPgCw_8LbGFiZWw9SlVFdENMM1F2OG9CRU9UXzZMa0MTA3GfZ3RtX2VlPTEmHAMhBiUCDxsDHU81ODgyGwMAFzgbA6BhcHBlbmRDaGlsBAM_c3RhFAMqrzA4NzI3MDMzMTYUA___ix8zFAMMDy8GQgUbAx83GwMHBbYHDyoJHZ42NDQ1NzQwNDM9Bj82MDIqCQQ_MjgmPQYUnzg5Njk4Mzc4ODwGwx9oNAngHzM0CQEIGQYPBQNCrzExOTk3MTgxNTIFA0CfODMwOTA3OTY5BQMBLzQxQgkBTzYwNDEFAxWvOTEwMzEwOTg1NgYD_7gvNTELBgwPHwk7rzIxODQ3MDQ2OTX_Av__dg8eDA0PBQZCBQYDDyUMCA8KCSafOTU5Mjk5Nzk0BQYBHzYKCQQfNgoJF382ODU1NzgxBAb_uR83DwwAJzIwIw8PBQNCnzE4MjIzMDM5Nw8MCLBsaXZlLnJlenluY1kTEC_FFPA6P2M9MTZiNjQxMDQzMWI2Mzc0ZTc4MDEwNGFiYjA0NDNjYTgmcD03ZTMyMzIyZGUzOThmN2E4MGY2ZGEwZWUxY2VjOWE5YiZrPa4UALoU8QotcGl4ZWwtNjY2NyZjdXN0b20xPXtfZGwumxMTfRQAFDIUAKRhclBhZ2VOYW1lGwASMxsANHBpZBIAEjQSAFRDVVVJRBQAEjUUAAClFoN1Y3RzWzBdLgwAhF9kZXRhaWxzKgAVNioAAfcUEF9YAGR6bXBJRD2zANYmY2FjaGVfYnVzdGVy_BVQNTczMiaeADJVcmxEAFB1cmx9JmMWr19yZWZlcnJlcj1RFBAASAAOFwgYMlEUDxcIO68xMDAxODk3NzIwFwgHDwwC_2gfOQwCDA8fBEMEEwIPHwQIDyQHJo84MTk1MDAwMi4QAi84MCkNAy84MCkNGRAyzBYfOSkN_7guODYGAwBDEA9jGUufMjQ3NDM2MzczGQUIDwYDJq8xMTE3MjMwMjkyYBwCHzksCgQfOSwKFq85MTM2MDA1MTcyCAP_tz4xMDgIAy81NC0KTa8wNDEyMTA2MzU0IQgH8QdzaXRlaW50ZXJjZXB0LnF1YWx0cmlj-R3xAi9keGpzbW9kdWxlL0NvcmVNCwD0DS5qcz9RX0NMSUVOVFZFUlNJT049MS4xMDMuMCYYAPMBVFlQRT13ZWImUV9CUkFORIUJj2ZlZWRiYWNrTQkQPzYwNWALABg2MwEPTQk8EDk0IC8zOIMaCQ8sAYcPlhUACSwBD20IQwQzAQ9tCAgPMwEJdFdSU2l0ZUl9AvICRW5naW5lL0Fzc2V0LnBocD9wAvIGPVNJXzBBaW9yeVJrbDhieEhNMiZW-yLCPTI1JlFfT1JJR0lOXSEwOi8vnQwIVyEFlQIPrQINBpYCT3hociIxIAA-MTY3xgMAFAAFzgayWEhSX01BTkFHRVJBAAIWHWBhbGxvd2UpHS9yZS0gG58zMDk1MTg5NDH5FggPYwH_lPUDQ1JfNnNQcURYNHdLUXVqUE82xgJFOSZRXwYDL0lE8QIBD-YCzI84MTcwMDc0MOAWCA_mAjAPgwH_SgcrCPABMS5iNmVkOGM0ZmU0YjNmNPgUjzVhLmNodW5rPQhUD6oFATcyODlwCQ89CDsSMK0mHzc9CDAPPgFyDq4KCj4BD08IQgVFAQ9PCCQHgwKgNy42MWVhZGZiNpkBj2NiYmEzOTk1gwJcDvsOPzI5MYMCR485MTEwNDI5MB4ZCA9EBQkPPgF9D4MCAAk-AQ-DAkMERQEfODENLhNG7AxiQnV0dG9uywoP_gRoLzMwOw1HjzM1Mzk5NDg5bxEJD3sCFA82AWoOcwIKNgEPcwJCBT0BDw8sCPEFcGVvcGxlLmFwaS5ib29tdHJhaW7aGfACaWRlbnRpZnkvcmVzb2x2ZT-ALPWaPWV5SmpiMjlyYVdVaU9uc2lZbk5wYmlJNklpSjlMQ0p4ZFdWeWVYTjBjbWx1WnlJNmUzMHNJbVY0ZEdWeWJtRnNYMmxrY3lJNmV5SjZlVzVqSWpvaU9EZ3pOR0UzWlRNdE5XRTRPQzAwTVRRNUxUbGhaR0V0WkRFMk5ERTFNMlV3TVdRNE9qRTNNREUzTlRFNU16WXVNRE0wTXpBNUluMTkmc2l0ZV9pZJkZD3oNDj0zOTB6DQEUAA96DUiPMjE2NDU5NTA8EQgPmAH_hjtjZG4pA1RwMTNuLwgcEC8OAHYubWluLmpzewIPKTAHLjEyywcKfgLIaW5zZXJ0QmVmb3Jl-Q8PIzAkIDMw0S8_Mzc0EA0ID-QAPg7cEArkAA_-BEME6gAPtggJgHAuYW5hbHl0lxRReWFob2_8BP8Ac3AucGw_YT0xMDAwMCZimzJK4i55cD0xMDIwMDI5NSZmaxIPyDODwGVuYz1VVEYtOCZ5dpcV9gs1LjEmdGFnbWdyPWd0bSUyQ2Vuc2lnaHRlbvoCMmltZ7UCCiAzPzEyNXUFAA9FDUevMzMyMTU4Mjc5M30JCA8MAv9nDwMFAQgMAg8fBEMEEwIPhQcIH3MTAhFwZD1UdWUlMnA2_xowNSUyMERlYyUyMDIwMjMlMjAwNCUzQTUyJTNBMTYlMjBHTVQmbj0tMVQEUG80MzY1MjhSBOo_NDAyFA9GrzEyMzQyOTI2MDlSBCwPPwL_dg6FBAo_Ag-FBEIERgIfMU4gCA_fDgkP5xoDwD9RX0ltcHJlc3M9MaMaTklEPUMjGE9RX1NJEhgF8AFBU0lEPUFTXzA3MjEwMDI0RgAPlh0TB_0mRjY0OTIKCA_5GgQuNDnxKwEUAA9_DUefMTg4ODExNTc0GQoJD7seCA91AbEOAR83NDkzLQUPbhw-0DE4ODgxMTU3NDd9XX0
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 3.124.119.57 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-124-119-57.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://banking.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Tue, 05 Dec 2023 04:52:17 GMT
cache-control: no-cache, no-store
server: nginx
expires: Tue, 05 Dec 2023 04:52:16 GMT

GET
H/1.1 200
OK pstats.html Show response
a.rfihub.com/ Frame 2260 26 B
572 B 111ms
27ms Document
text/html 193.0.160.131
ROCKETFUEL

General

Check archive.org

Show headers Download Go to

Full URL: https://a.rfihub.com/pstats.html?rb=648&ca=20766699&ri=e1b1c6846914e46e0b4bbbd9daf0b596&stats=%7B%7D&ra=5887269487514346
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 193.0.160.131 , United States, ASN54312 (ROCKETFUEL, US),
Reverse DNS
Software: Jetty(9.4.51.v20230217) /
Resource Hash: f70b370debd085dd9e9fb6495c796cdccf41c44574cc185dbe124f3ea8237623

Request headers

Referer: https://banking.citi.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36
accept-language: nl-NL,nl;q=0.9

Response headers

Content-Length: 26
Content-Type: text/html;charset=iso-8859-1
Date: Tue, 05 Dec 2023 04:52:18 GMT
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Server: Jetty(9.4.51.v20230217)

GET
H2 204 r.rnc
data.privacy.ensighten.com/privacy/v1/b/ 0
106 B 32ms
32ms Image
text/plain 3.124.119.57
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://data.privacy.ensighten.com/privacy/v1/b/r.rnc?n=4&c=1129&i=6ot4yv&p=na_prod&s=768&d=8HB7InZlcnNpb24iOiIxLjAuMCIsImdhdGV3YXkiOiIyLjMuNjExIiwiY2xpZW50SWQiOjExMjksInB1Ymxpc2hQYXRoIjoibmFfcHJvZCIsImluc3RhbmNlSWQiOiI2b3Q0eXYiLCJwYWNrZXQiOjEsIm1vZGUiOiJlbmZvcmNlWgDwCG9va2llcyI6eyJCQU5ORVJfTE9BREVEkQDyJyJ9LCJlbnZpcm9ubWVudCI6IkNCT0wgUHJpdmFjeSIsInJlcXVlc3RzIjpbeyJkZXN0aW5hdM4A9BhodHRwczovL3NpdGVpbnRlcmNlcHQucXVhbHRyaWNzLmNvbS9XUlEQAPoAU2hhcmVkL0dyYXBoaWNzNwDwGy93ci1kaWFsb2ctY2xvc2UtYnRuLXdoaXRlLnBuZyIsInR5cGUiOiJpbQ0AQHN0YXLtAMA3MDE3NTE5MzY0OTLIAAA9AQUUAKA1MzcsInNvdXJjOQDwC2FwcGVuZENoaWxkIiwic3RhdHVzIjoibG9hEABgcmVhc29u5QDUXSwiZGF0YVBhdHRlchIAsGxpc3QiOltdLCJpYwDvNjk5NjQyMDM0NzYyfSwXAYofMxcBDDFtdXTPAa9PYnNlcnZlckNMHgExwDY0MjAzNDc2M31dfQ
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 3.124.119.57 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-124-119-57.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://banking.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Tue, 05 Dec 2023 04:52:19 GMT
cache-control: no-cache, no-store
server: nginx
expires: Tue, 05 Dec 2023 04:52:18 GMT

GET
H2 204 r.rnc
data.privacy.ensighten.com/privacy/v1/b/ 0
106 B 32ms
32ms Image
text/plain 3.124.119.57
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://data.privacy.ensighten.com/privacy/v1/b/r.rnc?n=5&c=1129&i=6ot4yv&p=na_prod&s=1825&d=8HB7InZlcnNpb24iOiIxLjAuMCIsImdhdGV3YXkiOiIyLjMuNjExIiwiY2xpZW50SWQiOjExMjksInB1Ymxpc2hQYXRoIjoibmFfcHJvZCIsImluc3RhbmNlSWQiOiI2b3Q0eXYiLCJwYWNrZXQiOjQsIm1vZGUiOiJlbmZvcmNlWgDwCG9va2llcyI6eyJCQU5ORVJfTE9BREVEkQDyJyJ9LCJlbnZpcm9ubWVudCI6IkNCT0wgUHJpdmFjeSIsInJlcXVlc3RzIjpbeyJkZXN0aW5hdM4A8yNodHRwczovLzYyNjkzMjIuZmxzLmRvdWJsZWNsaWNrLm5ldC9hY3Rpdml0eWk7c3JjPSoA81Q7dHlwZT1iYW5rcDAwO2NhdD1wcm9qZTAwYjtvcmQ9MTtudW09NjQ1MTY4MDMwMjA2MjthdWlkZGM9OTc2MDk2NDYwLjE3MDE3NTE5MzU7Z3RtPTQ1ZmUzYnQwO2djZD0xMWwCAPAAO2RtYV9jcHM9c3lwaGFtDwCwPTE7dWFhPTt1YWIFADBmdmwHAIBtYj0wO3VhbQwAEXAFABB2BgDxA3c9MDtlcHZlcj0yO35vcmVmPfUAkCUzQSUyRiUyRsQA8AlpbmcuY2l0aS5jb20lMkZjYm9sJTJGT00MAPeKaGVja2luZyUyRnRpZXJlZCUyRmZlYXR1cmVkLW9mZmVycyUyRmRlZmF1bHQuaHRtJTNGQlRfVFglM0QxJTI2UHJvc3BlY3RJRCUzRDMyNkQwRDY0RUFENzQzRTRCRTYxOTNBOTE3QTJDN0VEPyIsInR5cGUiOiJpZnJhbWUiLCJzdGFydCI6MTcwMTc1MTkzNTczOSwiZW5kFACwNjg2Mywic291cmM8ADFtdXThAZJPYnNlcnZlckFHAKF0dXMiOiJsb2FkFQJAYXNvbhQC1F0sImRhdGFQYXR0ZXISALBsaXN0IjpbXSwiac8C7zcwMTQxMTg4NzY5NH0sRgIF8AVldmVudHMuYXBpLmJvb210cmFpblMBES8ZAGYvdHJhY2viADJ4aHKYAAnfAEA2ODc10AIDdgAB8wACFAAF3wCyWEhSX01BTkFHRVJBAALZAG9hbGxvd2XcACKfNjgxMzQ1MDAw3ADjgWEucmZpaHVirAFgcHN0YXRzygLxKmw_cmI9NjQ4JmNhPTIwNzY2Njk5JnJpPWUxYjFjNjg0NjkxNGU0NmUwYjRiYmJkOWRhZjBiNTk2JkIA9gw9JTdCJTdEJnJhPTU4ODcyNjk0ODc1MTQzNDYEAg_mAgY9ODQ05gJHODU2NeYCyGluc2VydEJlZm9yZQgCD-ECJZ85NzA3OTUzMDYFAgcPKQGCLDUwMAMLKQEMDwQvQ0wvATHAOTcwNzk1MzA3fV19
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 3.124.119.57 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-124-119-57.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://banking.citi.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.199 Safari/537.36

Response headers

date: Tue, 05 Dec 2023 04:52:19 GMT
cache-control: no-cache, no-store
server: nginx
expires: Tue, 05 Dec 2023 04:52:18 GMT

Verdicts & Comments Add Verdict or Comment

95 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

59 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
prod.report.nacustomerexperience.citi.com/glassbox/reporting/798b2f12-9162-4a94-91ee-805d883ca266	1969-12-31 23:59:59	Name: _cls_cfgver Value: 3b3e973b
prod.report.nacustomerexperience.citi.com/glassbox/reporting/798b2f12-9162-4a94-91ee-805d883ca266	1969-12-31 23:59:59	Name: _cls_s Value: dac6ad05-03d9-4c41-aa63-eb8e21a11b60:0
prod.report.nacustomerexperience.citi.com/glassbox/reporting/798b2f12-9162-4a94-91ee-805d883ca266	1969-12-31 23:59:59	Name: _cls_v Value: 5c7b16d4-b317-472c-9c6d-4f36f2b886cc
banking.citi.com/	1969-12-31 23:59:59	Name: CitiBTSES Value: SID=AEF79087E0D34FC781D501880A10A67B
.citi.bridgetrack.com/	1970-01-21 01:20:55	Name: ATC1 Value: 32896\|aCEyu.B.iABgf.B.B2E.SEXo.KML.li9.0.EB.C.E
.citi.bridgetrack.com/	1970-01-21 01:19:30	Name: CitiBT Value: GUID=543BD5F3FE224973899C83C6DBC94B23
.citi.bridgetrack.com/	1969-12-31 23:59:59	Name: CitiBTSES Value: SID=7832E285E3DB42E595A83F3CF4876475
.citi.com/	1970-01-20 16:42:39	Name: ensighten_conentSync_timestamp Value: 1
.demdex.net/	1970-01-20 21:01:43	Name: demdex Value: 56065922481724643113778279548108056058
.citi.com/	1970-01-21 01:28:07	Name: CITI_ENSIGHTEN_PRIVACY_BANNER_LOADED Value: 1
.citi.com/	1969-12-31 23:59:59	Name: CITI_ENSIGHTEN_CC_SYNC Value: 0
.citi.com/	1969-12-31 23:59:59	Name: at_check Value: true
.citi.com/	1969-12-31 23:59:59	Name: AMCVS_61834D9B5228A7430A490D45%40AdobeOrg Value: 1
.citi.com/	1969-12-31 23:59:59	Name: _ce.irv Value: new
.citi.com/	1969-12-31 23:59:59	Name: cebs Value: 1
banking.citi.com/	1970-01-20 16:42:33	Name: 7018 Value:
banking.citi.com/	1970-01-20 16:42:33	Name: 7830 Value: error
banking.citi.com/	1970-01-20 18:52:07	Name: 64072 Value:
.citi.com/	1970-01-20 16:43:58	Name: _ce.clock_event Value: 1
.citi.com/	1970-01-21 02:18:31	Name: s_ecid Value: MCMID%7C49306057246851361484453144149901745241
.citi.com/	1970-01-21 02:18:31	Name: _cls_v Value: 5c7b16d4-b317-472c-9c6d-4f36f2b886cc
.citi.com/	1969-12-31 23:59:59	Name: _cls_s Value: dac6ad05-03d9-4c41-aa63-eb8e21a11b60:0
.everesttech.net/	1970-01-21 01:28:07	Name: everest_g_v2 Value: g_surferid~ZW6sfwAAAB7hBAN-
.dpm.demdex.net/	1970-01-20 21:01:43	Name: dpm Value: 56065922481724643113778279548108056058
.citi.com/	1970-01-21 02:18:31	Name: AMCV_61834D9B5228A7430A490D45%40AdobeOrg Value: 1585540135%7CMCIDTS%7C19697%7CMCMID%7C49306057246851361484453144149901745241%7CMCAAMLH-1702356735%7C6%7CMCAAMB-1702356735%7CRKhpRz8krg2tLO6pguXWp5olkAcUniQYPHaMWWgdJ3xzPWQmdj0y%7CMCOPTOUT-1701759135s%7CNONE%7CMCAID%7CNONE%7CMCSYNCSOP%7C411-19704%7CvVersion%7C4.4.0
.citi.com/	1970-01-20 18:52:07	Name: _gcl_au Value: 1.1.976096460.1701751935
.citicorpcreditservic.tt.omtrdc.net/	1970-01-20 16:42:33	Name: citicorpcreditservic!mboxSession Value: 8931956e66e24081988026d1086ac5e1
.citicorpcreditservic.tt.omtrdc.net/	1970-01-21 02:18:31	Name: citicorpcreditservic!mboxPC Value: 8931956e66e24081988026d1086ac5e1.37_0
.citi.com/	1970-01-21 02:18:31	Name: mbox Value: session#8931956e66e24081988026d1086ac5e1#1701753796\|PC#8931956e66e24081988026d1086ac5e1.37_0#1764996736
.citi.com/	1970-01-20 16:42:33	Name: mboxEdgeCluster Value: 37
.rfihub.com/	1970-01-21 02:04:07	Name: rud Value: H4sIAAAAAAAA_-MSNjU0MTG1sDA1MrcwN7YwNjQ3MRDiM9T1rjR0rvIxiMw0TPYBAE44u40lAAAA
.rfihub.com/	1969-12-31 23:59:59	Name: ruds Value: H4sIAAAAAAAA_-MSNjU0MTG1sDA1MrcwN7YwNjQ3MRDiM9T1rjR0rvIxiMw0TPYBAE44u40lAAAA
.citi.com/	1970-01-20 16:43:58	Name: _ce.clock_data Value: 204%2C31.204.152.220%2C1%2C9d9fcb00733e98b40e93b73c4ea99695
.citi.com/	1969-12-31 23:59:59	Name: cebsp_ Value: 1
.citi.com/	1970-01-21 01:28:07	Name: _ce.s Value: v~336e7794804c2a6e08097fd1a494f34410ab747c~lcw~1701751935569~lva~1701751935091~vpv~0~v11.fhb~1701751935566~v11.lhb~1701751935567~v11.cs~340498~v11.s~0fa8bc10-932a-11ee-bcf3-9dc3a9b1b6e5~lcw~1701751935570
.citi.bridgetrack.com/	1970-01-21 01:19:30	Name: CitiBT%5F1 Value: GUID=543BD5F3FE224973899C83C6DBC94B23&SID=326D0D64EAD743E4BE6193A917A2C7ED
.citi.com/	1970-01-20 17:25:43	Name: s_nr Value: 1701751935833-New
.citi.com/	1970-01-20 16:42:33	Name: gpv_pn Value: public%7Cmicrosite%7Cchecking%7Cmpp%3Azip%20code%20selector
.citi.com/	1969-12-31 23:59:59	Name: s_cc Value: true
.citi.com/	1970-01-20 16:43:58	Name: _uetsid Value: 0fd67570932a11eebbe0f3e3705f247d
.citi.com/	1970-01-21 02:04:07	Name: _uetvid Value: 0fd69d50932a11eea4fccfbe3532343f
.citi.com/	1970-01-20 16:42:33	Name: _dpm_ses.d03c Value: *
.citi.com/	1970-01-21 01:28:07	Name: _dpm_id.d03c Value: 2b56544b-4e22-40c2-b933-aa588141a51a.1701751936.1.1701751936.1701751936.eb2624d9-e82d-4c2d-a273-2a254fd5996f
.bing.com/	1970-01-21 02:04:07	Name: MUID Value: 11261E532478623B325C0D8D25306382
.scorecardresearch.com/	1970-01-21 02:18:31	Name: UID Value: 1445cb128bbfbee6a3eec561701751935
.rezync.com/	1970-01-20 21:01:43	Name: zync-uuid Value: 8834a7e3-5a88-4149-9ada-d164153e01d8:1701751936.034309
live.rezync.com/	1970-01-20 21:01:43	Name: sd-session-id Value: .eJwFwTEOgCAMAMC_dBZD0wKFz5gmdGAQDeBk_Lt3Lxy3jVO79QVljcc2mDZnu_rRKhQQIdZk5IKKOEbOLmtVVzEyBjKPVQomjylgprh7YvIZvh_q2BkN.ZW6sgA.szsT5IGyvlho5EH7VoztkbfXkCs
.doubleclick.net/	1970-01-21 02:04:07	Name: IDE Value: AHWqTUlNVyCg6THvU5JnmCSB3OIRQ6WEiVSlJrAQhyxrZPEWGbwADBYQnHtzxbyi
.amazon-adsystem.com/	1970-01-20 21:43:29	Name: ad-id Value: A8IBDA3Py0S3v9QJki6qv9U
.amazon-adsystem.com/	1970-01-21 02:18:31	Name: ad-privacy Value: 0
prod.report.nacustomerexperience.citi.com/	1970-01-20 16:52:36	Name: AWSALB Value: 1XwZwZePUXBtJ1ARwrwlx1UwC8IC33/X8vDTqU6wdjhRm0GnJKRV0Q3Pby+UQWunes0DXpH3I81RS61eApLnyRuMikKvXxDrkFJHaKpYfm5YY6F+jFcsRTkuqHK0
prod.report.nacustomerexperience.citi.com/	1970-01-20 16:52:36	Name: AWSALBCORS Value: 1XwZwZePUXBtJ1ARwrwlx1UwC8IC33/X8vDTqU6wdjhRm0GnJKRV0Q3Pby+UQWunes0DXpH3I81RS61eApLnyRuMikKvXxDrkFJHaKpYfm5YY6F+jFcsRTkuqHK0
prod.report.nacustomerexperience.citi.com/	1969-12-31 23:59:59	Name: ROUTEID Value: .cligate1
.citi.com/	1969-12-31 23:59:59	Name: cls_e Value: dac6ad05-03d9-4c41-aa63-eb8e21a11b60:15792720388449
.citi.com/	1970-01-21 01:28:07	Name: btIdentify Value: 9f2b0653-e3de-418b-eb13-28917c93af8f
.citi.com/	1970-01-20 16:42:35	Name: _bts Value: b3044a50-2530-4a0d-def8-a6e99cf9d5f7
.yahoo.com/	1970-01-21 01:28:29	Name: A3 Value: d=AQABBICsbmUCEGqNdPITVmXrOFKiTrdI7XcFEgEBAQH-b2V4Ze2PzSMA_eMAAA&S=AQAAAi3Z0c8HNfq1nYFMGiw7aUk
.tvpixel.com/	1970-01-21 01:28:07	Name: sp Value: be3ef196-557c-4a3c-a978-4f483e829cff
.citi.com/	1970-01-21 01:28:07	Name: _bti Value: %7B%22app_id%22%3A%22citibank%22%2C%22bsin%22%3A%22Ye3biBJRo1dcpL28jw0bPSlgI8knZ7NySjha9Y6zUBis6GSC6oxJBHNYx6o0mMoBnRu9WeBzs16ihUzMtTaw%2FQ%3D%3D%22%2C%22is_identified%22%3Afalse%7D

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://sr.rlcdn.com/425466.html?es=80676&u=da39a3ee5e6b4b0d3255bfef95601890afd80709 Message: Failed to load resource: the server responded with a status of 451 ()

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.bridgetrack.com; report-uri https://csp-reporter-ui3464xpjq-uc.a.run.app/api/csp-report/?env=prod
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

20766699p.rfihub.com
6269322.fls.doubleclick.net
a.rfihub.com
adservice.google.com
adservice.google.nl
assets-tracking.crazyegg.com
banking.citi.com
bat.bing.com
c.tvpixel.com
c1.rfihub.net
cdn.boomtrain.com
cdn.digitalmarketing.citibankonline.com
cdn.gbqofs.com
citi.bridgetrack.com
citi.demdex.net
citicorpcreditservic.tt.omtrdc.net
cm.everesttech.net
data.privacy.ensighten.com
dpm.demdex.net
events.api.boomtrain.com
googleads.g.doubleclick.net
iad1.qualtrics.com
live.rezync.com
metrics1.citi.com
nexus.ensighten.com
p.tvpixel.com
pagestates-tracking.crazyegg.com
people.api.boomtrain.com
prod.report.nacustomerexperience.citi.com
s.amazon-adsystem.com
s.yimg.com
sb.scorecardresearch.com
script.crazyegg.com
siteintercept.qualtrics.com
sp.analytics.yahoo.com
sr.rlcdn.com
tagmanager1.citi.com
tracking.crazyegg.com
www.google.com
www.google.nl
www.googleadservices.com
www.googletagmanager.com
zn3vi8kkuds0jjrfc-citifeedback.siteintercept.qualtrics.com
104.17.208.240
104.17.209.240
108.157.4.15
13.32.27.28
142.250.186.98
18.173.233.115
18.66.122.45
18.66.248.26
184.30.20.101
193.0.160.131
212.82.100.181
216.58.206.38
2600:9000:206f:b400:2:8f43:5780:93a1
2600:9000:224a:e000:1d:bf0a:0:93a1
2600:9000:224a:fa00:1:76cf:fe80:93a1
2606:4700::6812:190d
2606:4700::6813:9308
2620:1ec:c11::200
2a00:1288:80:807::2
2a00:1450:4001:80e::2002
2a00:1450:4001:80f::2008
2a00:1450:4001:81c::2002
2a00:1450:4001:81c::2004
2a00:1450:4001:827::2002
2a00:1450:4001:828::2003
3.124.119.57
34.107.138.236
34.193.174.103
35.190.22.40
35.244.154.8
52.44.233.116
52.45.23.69
52.46.130.91
54.154.232.97
54.211.113.206
54.73.141.201
54.78.218.204
63.140.62.164
66.235.152.143
01db6a0b9a01883cbc70ba6ee0b89735218c97c07da12d3b0981d82c49f4bac1
029845ac0901bb43ebb6ee160ae25611973a4cd43cad886903fdd19223e6a977
02bffcdbf0887461cf5ad4f36604e2d21c6a7e0ee9e5a3f883c19b253d34f8ce
0536ba1b7856fc8a2c3fecf43e40377f3e30a3a158084069c4aeb338dd0b9ffe
092bd28b116c31f67e5c6c6d1aa38082b807c60381d725c6cd53e9b16a3286f7
0a40bd4fb31d93b2a831a50eb0f96a73131ea5672b61afa7d21eebb15e88925f
0a747978746092df6f18fe90ef23b9896959f6a9bb0b58cbab2cbc851793e023
0e4b1e428a2198ef747010c094101c257b568a97cdcc0f31ed5e9868cc835b39
0f195fc4ecf324d1f9f5685c7584951eb48e204add8618bcb5a2055c7b9c1544
1025b7f7889c3d1361b67221c688db535ead278d485665f1c87ecd13f78dd085
1027db0787a02f914a07fd6a751d45a230207c2d0cb3e5612abe78fd42ad7086
13a59cfac1785dd94d0005457ed1e12cf77fee65b975fe6fd91af77b7ac6cd77
19e780399a96b6e832b3da1a97adf6949a62ed9fdee5b8450ae32627068ce041
1c34a537ea8a62cb24c782a11aaf49c1cbd671e5d264d81c6732e2338e05d2af
1eaa61116a44b60d15c87e58db63270223e677db1d546e128906d77d11c8a572
22a41256615a192adc91d7a231a750197d72fef5ce2003fc2a54b9f81dc40f5b
25f4eeb23f67fe1d74534ed37230ecd54ab4f57524276970dcbeaaf3b0fc64f9
2689367b205c16ce32ed4200942b8b8b1e262dfc70d9bc9fbc77c49699a4f1df
270582fd72e8c2ee580f267aa9d0fcd5424922670026acae16b41bfe55c44fe7
28ced8a7cb30e6f747ad8116dcd11d3dbf5848c2d49a9babbd7d8c94e0a29cf7
2c176a7cf68f36b496c6fc2bb834e1a19a30ef47c4b03c3dc275a5c8d478618a
2ca3b492e58624d30201bfe06213e6a513c37f56ba433d9bae00e5513d5576b3
306ad7d7f5fd01c56a1f8854b938feeaf79dc278e2e215440565b5034aa32762
31e24b0971fc0ec71781beed9a616ad1348a72b2a3b9c46cb519afc116f2e880
34d1d3196a96d95cd4d1e402af0fdce276c566e4eeec020e4c62a33357980f00
3556b4fa28a41290454dc84939dae439fcf5bda8a1eac70efdf2647bf041d43d
35df360bec33fe8228bd3d245bcb20105181da8f54e5386bbe60223d82af2f40
3a5b60b35698e14383aa5c5108107f9c2b24702c93588ca4d4197240c19a619f
3ccce4810438a0542e2ce9572c0ce8a8ceae9f88f40f05e1ecb32b1562b04278
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
447d8197a2aeea20545bf2cadaa5b675f99c94546058969ca8e0c7302811ee08
480b06b23e574b4bf386fde1a91145a4171f97aeb5ee800e4be1850f29b1ad91
48c605f5c60c0e68e4fa3e6f8701d16e39f44afa1b4c77efff2d605fa9dd1fa8
4987ecf16cd918045e99795b6610cda200dcb61f4cb0d03957952b12843767df
4b99a4e92de3333bf62e8c2766dc1a880f1c19308c1591d2516974f6369b721a
4c0b89ba14ab0e3f25c0da34eaf0d29dd70410e50bfc7154c9d0a280b9fa5b0c
4caed94f9975debb1a1ee2ff2e68395802a18a4cf3f3be7ae057f1b97b2c87ff
53b6b39640495b98726ecd077a0404135f6eb35ac18da1fcce586dc4400c43df
56500ab0cde6f2d4378a2b105d7f48f729f23b0b5186c2ae3fc80ab57b1e43b6
565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3
566095a5f65029a8730735e82ff6cf43336a92723d96484db740011b88467aa1
56bf7bd2eb8fb0ca776ec3ccb50bf4d63ccf833698521e0eb7d720423e1a49a0
5b67576b5fd64ab752f6398646ab89ce082c5b680936553840eed2f65a27ded8
5b8ea63c50ee4dd1cbe92ec4b0c54ccc181f0dcc337227303a791421ef67866d
5cb0744a6ae142c18ccd21be428b918a44e556af99a328c40cb06ba5123e797c
5e319852607809336b2534ffeb96f6933f26994dd040f535302c84f59cc0a214
61d8137d275f12306e177bc726c2b3e072f9efa4743a0ace6ecbcf7a0932fd07
63b98a0c8568c08fd01a6946a147bca65eff26c8085f1ccb5330aafe0f0dcd15
6417365c357e7f81e4db788411b12202615cdcb72bb900801037c2cae48417c8
6441565da997dbdbdf1d5ed8b26561e457f4bdbea97d5f53d03c727b7fe278c3
686eb5d7c927dd741ef72adda5c719b478d36f1e29520ee16d5121854c174b10
6896c70fd430a1ffe69dc778926e1866ca52a12bd341170522ad6278aafd7bcf
6b00314574d978730478a30416dc243901188049309459daa1a0250fd1508752
6b2072bf88cef02065acb1e2fb1efcf0132d0b0905e279e8da291d9ecf84f4b6
6dd5a078b24c5d9d87ca287fbe4992f0fd457fb7c700ed43cbb94cfddb3fd1a5
6e12178f2fb79ce2e9f1a4004f376199e56632ee2b1b570585e4b6c817748ce1
6f167fb91dda50241e3efeb657237e636519103b823204f7f127701bf20c8ecf
7337d0aa06e2a7d2555a60936c9243f8f93c24dcd64e064d0181e6790294607b
779baa9baef660e39a495e550aa4fc9d42b9570b2b693b6df8f8bbbbcc073b34
7bea17a80a61ed0f54248b4ffc4c718f7c8ff2619742577a73591d62ce074da8
7ef97b12890fc6fee67f869c6e1f74b6719de7d66ac0d649c8d7386a80b4c30f
830e67bda2532cd5880ee86e3b33e69721082f8458bb0df0cd4edbb1577fd375
86551808dbfbf8bc9b23ab3d0725794c2e1f2b4265c96715f2945638160edc2b
87ea9fb616cb6b6b40cde9afd9abf250e1262de2e00056441da5501ad97999e3
8bfedcf685390380481b15318e5d593da7ad43c2ebcb24e4772ff40af8951041
951e71b9c55c57d430c507899d10d5ee1b6479e4d5ad826d6d5f18382008d934
96d2de06ab91b481fa1410e1f4e245a86d60b496c32145dc8dcb059d3ca34523
9a74546a8f511f31b5252f115d2db7aa69370ca5eeaf6828f60abb197f35a169
9a94f6a73911aa86d33b5652d5ae0225583fc5081361f08e3c2acee30ecb9ebe
a01200eae7a185d27438003fb891d9585db8842a75e4a1d1756e12002d253444
a1ecbaed793a1f564c49c671f2dd0ce36f858534ef6d26b55783a06b884cc506
a309840eef4d323a84a5048e7ff771d15a98ff1d1891fadf7ddc54a35e5860d4
aefdf31931594229896ca362daf058be2dc6d0fa7ee98e08cb0825440b9005d5
af8dcdef8bacb21a6914a3326dc1c07365798a1e81a8c4e4cd3972e26e0a703a
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
b2002babc6cf4478331df036ca8f920767650f26ffea5e00530c15c1984b3ad6
b33625168379e4a8ab687d196077f3b3a9758025b78a8837a4c84629b1505a5c
b3e713e2e45197895781a1d7b7070af82a85a62e9859c16d894d8a6927a2b9d1
b771e95f0fb29e75e07f4b1758dfbc37d7537de1ff740a5e9ce4729d32c2a361
b8b78e468027b3f3335382828b1669f32207d5ad04dd1478573296d0cdcb7433
b9019a5dd9f4d4fcc56120fed94484b648f0088feafcc09e3a43650908185d06
bac45e872102a5a0b7fc497f803585d15e36dce152cb94dd78d353dcd4fc7b6a
bf39c7a23da56a09d7fba494ab7a46604dc02a19fabfaf8d4c3ab6629aad0692
c5b5c93f6affe076aa846f63596819be1a4b6ca73e58baf41f4b01db979fdb4f
c5cdf83b32686400fb191131091e1ab290cba205ad81cbbd952d7e9d4e83dd8b
ccd3fac575dcd761bba85736d31f2f87805852ef256efec11464f502b247bd6c
cd5496f75a7c1029bc681f639794b83f034d5ecd884e8514ae12b13eee9eec70
ce32dd1231d465647b5a685e477c831e488c6cd282820e61194554aa45c59fc0
d0ea23f1c00c774703b3c7cdef1bf1479dc440c9d159e82ce5e0e9db4ea4f118
d204634f1202714e9ab0047fc768df6aaa8565fa02b3e07c8d6dde72c8195031
d33eafe7c71aa27415b3fe0254b6e1c4be7cfccdb32fec684bf876f52b291cbe
d420011478b9237ee35799a2ad0c8ec8dd01cb9d5cfc7295fdb48556c240c7b0
d52fa90fa188a7de8cbe7fe05e4382cccbd1b61d3ba6177a89e01fba893d476c
d6675bd276a925d98414b84f6c2c77569fa633c057380150085eedde513d97e2
ddc347ed0d0520a5a7677b33a56c651212c58906f69bb38b92d2c7f6bbb15089
de1f9e444c9c25e3eb076b88114e60e86fd4aed3ccaff18f4a19b86487aece6d
deed8329f425061be91d6c3ac2fb6b0b2a13b678221438461b6acb31df12dda4
e18c255ce0e35cbf2fbdc9c9cb584d8259462d3dd3592e8cab6b74f41b55bcbf
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e42d8705d0826f11ce9ddc01c962571a0909a1587d02ed86939293961049efbe
e440ce0ab1e98a2b30997ffb70df88164f80f93f4b294c0d9981acbc3844c0e2
e7197436f61ab4ed82036cc8a9d11084bc3125921bf0e74fe95370b8f0bc1b42
e7b44c86b050fca766a96ddac2d0932af0126da6f2305280342d909168dcce6b
e851e33486150e2f6e2d01db6010b1a3203d75793c78d1e5560f776f17364bb1
ea9362709bbb4d2ac09a1b684fa0276e535b8b2a2809e27ad46c3def2dae1850
ebfdcb078dfcdcad970d32d36606389eada3ed16482f02109aa12273c2a5897f
edb78348ee4e5e7858bc4ee87b7a2b3e5039582d8323621747f51dfd8bc10e4a
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f071110e088267097a0946520a2a08bd589f971f3ce4cb989feda1415026ac49
f13b5f95cd9caa7d12f485a799d69087b7aa611b7605f8f7319b75925484a7bd
f2667114758b49aeb3fe623efe7be3272d67a65f8ed36ec5d0afd2ee6886fb50
f47f21063dfdcbdeffed3d97689b45efae7a52401cd7fc5b8d07c42d2f232ab9
f70b370debd085dd9e9fb6495c796cdccf41c44574cc185dbe124f3ea8237623
f7528d7c7d1441840df28f129e1287fe9d0b77cb5d88142d542dfb4e3eef127e
f96f8cde87decef4958dbba76e0a919946c252fbf64bdf69f2ca0b693869e7e7
f9e007219be87251c82a5e3d8b5b4cf0c7380fd6c020a8d6c884770ae1f70c51
ffdddbc1752a639a78297dde0a53e611a93912ef3d2ab813cce57a88350e21ed

banking.citi.com Open in urlscan Pro 35.190.22.40 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

157 Requests

94 %HTTPS

33 %IPv6

26 Domains

43 Subdomains

38 IPs

5 Countries

2231 kBTransfer

6497 kBSize

59 Cookies

22 Outgoing links

Page URL History

Redirected requests

157 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

banking.citi.com Open in urlscan Pro
35.190.22.40 Public Scan

Screenshot
Live screenshot

Full Image

157
Requests

94 %
HTTPS

33 %
IPv6

26
Domains

43
Subdomains

38
IPs

5
Countries

2231 kB
Transfer

6497 kB
Size

59
Cookies

157 HTTP transactions
0 data transactions