www.citicards.com Open in urlscan Pro
23.212.222.131 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://l.loyalty.ms.aa.com/rts/go2.aspx?h=4062120&tp=i-1NGB-GT-sAQ-Ky7ypV-1w-1V3Pb-1c-Ky6lJe-l9Z6aqHq2s-Wp2Zm&pi=KgtzSjNmmG...
Effective URL:
https://www.citicards.com/cards/credit/application/flow.action?app=UNSOL&ID=3001&HKOP=2de94b05869e4857c38ba3a5df71418d5ccb...
Submission: On October 17 via manual (October 17th 2023, 10:13:40 pm UTC) from US — Scanned from DE

Summary HTTP 234 Redirects Links 20 Behaviour Indicators

Summary

This website contacted 47 IPs in 4 countries across 33 domains to perform 234 HTTP transactions. The main IP is 23.212.222.131, located in Frankfurt am Main, Germany and belongs to AKAMAI-AS, US. The main domain is www.citicards.com. The Cisco Umbrella rank of the primary domain is 290129.
TLS certificate: Issued by DigiCert SHA2 Extended Validation Ser... on November 30th 2022. Valid for: a year.

This is the only time www.citicards.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1 1	173.213.4.54 173.213.4.54	53316 (ASN-CHEET...) (ASN-CHEETA-MAIL)
22	23.212.222.131 23.212.222.131	16625 (AKAMAI-AS) (AKAMAI-AS)
33	2600:9000:206... 2600:9000:206f:5200:2:8f43:5780:93a1	16509 (AMAZON-02) (AMAZON-02)
10	3.124.173.63 3.124.173.63	16509 (AMAZON-02) (AMAZON-02)
1 3	34.251.64.143 34.251.64.143	16509 (AMAZON-02) (AMAZON-02)
1	34.254.109.178 34.254.109.178	16509 (AMAZON-02) (AMAZON-02)
2	63.140.62.164 63.140.62.164	16509 (AMAZON-02) (AMAZON-02)
1 1	63.33.173.25 63.33.173.25	16509 (AMAZON-02) (AMAZON-02)
1	184.31.87.130 184.31.87.130	16625 (AKAMAI-AS) (AKAMAI-AS)
6	2a00:1450:400... 2a00:1450:4001:80f::200a	15169 (GOOGLE) (GOOGLE)
16	91.235.132.220 91.235.132.220	30286 (THM) (THM)
1	66.235.152.115 66.235.152.115	15224 (OMNITURE) (OMNITURE)
2	2600:9000:212... 2600:9000:2127:8800:1:76cf:fe80:93a1	16509 (AMAZON-02) (AMAZON-02)
16	2a00:1450:400... 2a00:1450:4001:806::2008	15169 (GOOGLE) (GOOGLE)
2	2606:4700::68... 2606:4700::6812:180d	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	54.217.181.83 54.217.181.83	16509 (AMAZON-02) (AMAZON-02)
2	2600:9000:212... 2600:9000:2127:f400:a:6cdf:4440:93a1	16509 (AMAZON-02) (AMAZON-02)
2	2600:9000:212... 2600:9000:2127:9400:1e:54f1:26c0:93a1	16509 (AMAZON-02) (AMAZON-02)
2	2600:9000:212... 2600:9000:2127:8600:13:ab57:d440:93a1	16509 (AMAZON-02) (AMAZON-02)
2	65.9.95.44 65.9.95.44	16509 (AMAZON-02) (AMAZON-02)
4	193.0.160.131 193.0.160.131	54312 (ROCKETFUEL) (ROCKETFUEL)
2	2a00:1450:400... 2a00:1450:4001:830::2003	15169 (GOOGLE) (GOOGLE)
2	18.66.122.57 18.66.122.57	16509 (AMAZON-02) (AMAZON-02)
2	52.2.158.49 52.2.158.49	14618 (AMAZON-AES) (AMAZON-AES)
1	3.210.211.38 3.210.211.38	14618 (AMAZON-AES) (AMAZON-AES)
8	104.17.208.240 104.17.208.240	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	35.190.60.146 35.190.60.146	15169 (GOOGLE) (GOOGLE)
10	2620:1ec:c11:... 2620:1ec:c11::200	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1	2600:9000:212... 2600:9000:2127:2200:1d:bf0a:0:93a1	16509 (AMAZON-02) (AMAZON-02)
1	65.9.99.119 65.9.99.119	16509 (AMAZON-02) (AMAZON-02)
1 2	209.54.182.161 209.54.182.161	16509 (AMAZON-02) (AMAZON-02)
3	3.224.91.217 3.224.91.217	14618 (AMAZON-AES) (AMAZON-AES)
2 5	142.250.186.38 142.250.186.38	15169 (GOOGLE) (GOOGLE)
2	23.212.202.173 23.212.202.173	16625 (AKAMAI-AS) (AKAMAI-AS)
1	35.190.22.40 35.190.22.40	15169 (GOOGLE) (GOOGLE)
2	91.235.132.130 91.235.132.130	30286 (THM) (THM)
1	91.235.134.131 91.235.134.131	30286 (THM) (THM)
1	35.71.131.137 35.71.131.137	16509 (AMAZON-02) (AMAZON-02)
4	34.232.37.73 34.232.37.73	14618 (AMAZON-AES) (AMAZON-AES)
2	13.32.99.105 13.32.99.105	16509 (AMAZON-02) (AMAZON-02)
10	2a00:1450:400... 2a00:1450:4001:830::2002	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:82a::2002	15169 (GOOGLE) (GOOGLE)
10	2a00:1450:400... 2a00:1450:4001:828::2004	15169 (GOOGLE) (GOOGLE)
10	2a00:1450:400... 2a00:1450:4001:827::2003	15169 (GOOGLE) (GOOGLE)
1 2	2a00:1450:400... 2a00:1450:4001:80b::2002	15169 (GOOGLE) (GOOGLE)
3	104.17.209.240 104.17.209.240	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	212.82.100.181 212.82.100.181	34010 (YAHOO-IRD) (YAHOO-IRD)
1	184.30.20.101 184.30.20.101	16625 (AKAMAI-AS) (AKAMAI-AS)
234	47

1 173.213.4.54 (United States) 1 redirects

ASN53316 (ASN-CHEETA-MAIL, US)

l.loyalty.ms.aa.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

22 23.212.222.131 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a23-212-222-131.deploy.static.akamaitechnologies.com

www.citicards.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

33 2600:9000:206f:5200:2:8f43:5780:93a1 (United States)

ASN16509 (AMAZON-02, US)

nexus.ensighten.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

10 3.124.173.63 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-3-124-173-63.eu-central-1.compute.amazonaws.com

tagmanager1.citicards.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
data.privacy.ensighten.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 34.251.64.143 (Dublin, Ireland) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-34-251-64-143.eu-west-1.compute.amazonaws.com

dpm.demdex.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 34.254.109.178 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-34-254-109-178.eu-west-1.compute.amazonaws.com

citi.demdex.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 63.140.62.164 (United States)

ASN16509 (AMAZON-02, US)
PTR: ip-63-140-62-164.data.adobedc.net

metrics1.citi.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 63.33.173.25 (Dublin, Ireland) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-63-33-173-25.eu-west-1.compute.amazonaws.com

cm.everesttech.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 184.31.87.130 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a184-31-87-130.deploy.static.akamaitechnologies.com

online.citi.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 2a00:1450:4001:80f::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

maps.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

16 91.235.132.220 (United States)

ASN30286 (THM, US)

content22.accountonline.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 66.235.152.115 (United States)

ASN15224 (OMNITURE, US)
PTR: ip-66-235-152-115.data.adobedc.net

citicorpcreditservic.tt.omtrdc.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2600:9000:2127:8800:1:76cf:fe80:93a1 (United States)

ASN16509 (AMAZON-02, US)

c1.rfihub.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

16 2a00:1450:4001:806::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:4700::6812:180d (United States)

ASN13335 (CLOUDFLARENET, US)

cdn.gbqofs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 54.217.181.83 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-54-217-181-83.eu-west-1.compute.amazonaws.com

mboxedge37.tt.omtrdc.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2600:9000:2127:f400:a:6cdf:4440:93a1 (United States)

ASN16509 (AMAZON-02, US)

1.a79ab95c1589a13f8a4cab612bc71f9f7.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2600:9000:2127:9400:1e:54f1:26c0:93a1 (United States)

ASN16509 (AMAZON-02, US)

1.b406929acabac9b095f124c81bdfcf57f.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2600:9000:2127:8600:13:ab57:d440:93a1 (United States)

ASN16509 (AMAZON-02, US)

1.c81358859121583b7adf2ace89cb39f44.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 65.9.95.44 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-65-9-95-44.prg50.r.cloudfront.net

live.rezync.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 193.0.160.131 (United States)

ASN54312 (ROCKETFUEL, US)

20766699p.rfihub.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
a.rfihub.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
p.rfihub.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
s.rfihub.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:830::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

maps.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 18.66.122.57 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-18-66-122-57.fra60.r.cloudfront.net

cdn.boomtrain.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 52.2.158.49 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-52-2-158-49.compute-1.amazonaws.com

people.api.boomtrain.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 3.210.211.38 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-3-210-211-38.compute-1.amazonaws.com

events.api.boomtrain.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 104.17.208.240 (None, )

ASN13335 (CLOUDFLARENET, US)

zn3vi8kkuds0jjrfc-citifeedback.siteintercept.qualtrics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
siteintercept.qualtrics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 35.190.60.146 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 146.60.190.35.bc.googleusercontent.com

sr.rlcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

10 2620:1ec:c11::200 (United States)

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

bat.bing.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:2127:2200:1d:bf0a:0:93a1 (United States)

ASN16509 (AMAZON-02, US)

c.tvpixel.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 65.9.99.119 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-65-9-99-119.prg50.r.cloudfront.net

js.adsrvr.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 209.54.182.161 (Ashburn, United States) 1 redirects

ASN16509 (AMAZON-02, US)

s.amazon-adsystem.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 3.224.91.217 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-3-224-91-217.compute-1.amazonaws.com

prod.report.nacustomerexperience.citi.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 142.250.186.38 (United States) 2 redirects

ASN15169 (GOOGLE, US)
PTR: fra24s04-in-f6.1e100.net

6260004.fls.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 23.212.202.173 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a23-212-202-173.deploy.static.akamaitechnologies.com

servedby.flashtalking.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 35.190.22.40 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 40.22.190.35.bc.googleusercontent.com

citi.bridgetrack.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 91.235.132.130 (United States)

ASN30286 (THM, US)
PTR: h.online-metrix.net

h.online-metrix.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 91.235.134.131 (United States)

ASN30286 (THM, US)

89oebq5kfrnwu4b4b2kgnva3uss5n4odddy4rnlna16891807d617b66am1.e.aa.online-metrix.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 35.71.131.137 (United States)

ASN16509 (AMAZON-02, US)
PTR: a6370ebea231e0c9a.awsglobalaccelerator.com

insight.adsrvr.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 34.232.37.73 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-34-232-37-73.compute-1.amazonaws.com

p.tvpixel.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 13.32.99.105 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-32-99-105.fra60.r.cloudfront.net

sb.scorecardresearch.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

10 2a00:1450:4001:830::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:82a::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

adservice.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

10 2a00:1450:4001:828::2004 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

10 2a00:1450:4001:827::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:80b::2002 (Frankfurt am Main, Germany) 1 redirects

ASN15169 (GOOGLE, US)

adservice.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 104.17.209.240 (None, )

ASN13335 (CLOUDFLARENET, US)

siteintercept.qualtrics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 212.82.100.181 (Dublin, Ireland)

ASN34010 (YAHOO-IRD, GB)
PTR: spdc.pbp.vip.ir2.yahoo.com

sp.analytics.yahoo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 184.30.20.101 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a184-30-20-101.deploy.static.akamaitechnologies.com

iad1.qualtrics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
42	ensighten.com nexus.ensighten.com — Cisco Umbrella Rank: 3727 data.privacy.ensighten.com — Cisco Umbrella Rank: 9516	254 KB
23	citicards.com www.citicards.com — Cisco Umbrella Rank: 290129 tagmanager1.citicards.com — Cisco Umbrella Rank: 971528	981 KB
16	googletagmanager.com www.googletagmanager.com — Cisco Umbrella Rank: 56	998 KB
16	accountonline.com content22.accountonline.com — Cisco Umbrella Rank: 987034	134 KB
15	doubleclick.net 2 redirects 6260004.fls.doubleclick.net — Cisco Umbrella Rank: 69127 googleads.g.doubleclick.net — Cisco Umbrella Rank: 45	18 KB
12	google.de 1 redirects www.google.de — Cisco Umbrella Rank: 6147 adservice.google.de — Cisco Umbrella Rank: 13042	2 KB
12	google.com adservice.google.com — Cisco Umbrella Rank: 118 www.google.com — Cisco Umbrella Rank: 2	3 KB
12	qualtrics.com zn3vi8kkuds0jjrfc-citifeedback.siteintercept.qualtrics.com — Cisco Umbrella Rank: 32983 siteintercept.qualtrics.com — Cisco Umbrella Rank: 1100 iad1.qualtrics.com — Cisco Umbrella Rank: 10792	96 KB
10	bing.com bat.bing.com — Cisco Umbrella Rank: 427	31 KB
6	googleapis.com maps.googleapis.com — Cisco Umbrella Rank: 418	209 KB
6	citi.com metrics1.citi.com — Cisco Umbrella Rank: 24632 online.citi.com — Cisco Umbrella Rank: 21293 prod.report.nacustomerexperience.citi.com — Cisco Umbrella Rank: 21098	25 KB
5	tvpixel.com c.tvpixel.com — Cisco Umbrella Rank: 10819 p.tvpixel.com — Cisco Umbrella Rank: 2829	32 KB
5	boomtrain.com cdn.boomtrain.com — Cisco Umbrella Rank: 5993 people.api.boomtrain.com — Cisco Umbrella Rank: 6425 events.api.boomtrain.com — Cisco Umbrella Rank: 9429	61 KB
4	rfihub.com 20766699p.rfihub.com — Cisco Umbrella Rank: 146818 a.rfihub.com — Cisco Umbrella Rank: 3681 p.rfihub.com — Cisco Umbrella Rank: 1000 s.rfihub.com — Cisco Umbrella Rank: 60402	2 KB
4	demdex.net 1 redirects dpm.demdex.net — Cisco Umbrella Rank: 242 citi.demdex.net — Cisco Umbrella Rank: 40727	6 KB
3	online-metrix.net h.online-metrix.net — Cisco Umbrella Rank: 3097 89oebq5kfrnwu4b4b2kgnva3uss5n4odddy4rnlna16891807d617b66am1.e.aa.online-metrix.net	16 KB
2	scorecardresearch.com sb.scorecardresearch.com — Cisco Umbrella Rank: 179	597 B
2	flashtalking.com servedby.flashtalking.com — Cisco Umbrella Rank: 1143	685 B
2	amazon-adsystem.com 1 redirects s.amazon-adsystem.com — Cisco Umbrella Rank: 328	763 B
2	adsrvr.org js.adsrvr.org — Cisco Umbrella Rank: 1808 insight.adsrvr.org — Cisco Umbrella Rank: 665	3 KB
2	gstatic.com maps.gstatic.com	5 KB
2	rezync.com live.rezync.com — Cisco Umbrella Rank: 2003	8 KB
2	c81358859121583b7adf2ace89cb39f44.com 1.c81358859121583b7adf2ace89cb39f44.com — Cisco Umbrella Rank: 23922	4 KB
2	b406929acabac9b095f124c81bdfcf57f.com 1.b406929acabac9b095f124c81bdfcf57f.com — Cisco Umbrella Rank: 23899	4 KB
2	a79ab95c1589a13f8a4cab612bc71f9f7.com 1.a79ab95c1589a13f8a4cab612bc71f9f7.com — Cisco Umbrella Rank: 23928	4 KB
2	gbqofs.com cdn.gbqofs.com — Cisco Umbrella Rank: 8435	296 KB
2	rfihub.net c1.rfihub.net — Cisco Umbrella Rank: 6238	12 KB
2	omtrdc.net citicorpcreditservic.tt.omtrdc.net — Cisco Umbrella Rank: 33612 mboxedge37.tt.omtrdc.net — Cisco Umbrella Rank: 17590	2 KB
1	yahoo.com sp.analytics.yahoo.com — Cisco Umbrella Rank: 1448	632 B
1	bridgetrack.com citi.bridgetrack.com — Cisco Umbrella Rank: 124523	698 B
1	rlcdn.com sr.rlcdn.com — Cisco Umbrella Rank: 21226	98 B
1	everesttech.net 1 redirects cm.everesttech.net — Cisco Umbrella Rank: 1318	517 B
1	aa.com 1 redirects l.loyalty.ms.aa.com — Cisco Umbrella Rank: 197819	516 B
234	33

	Domain	Requested by
33	nexus.ensighten.com	www.citicards.com nexus.ensighten.com
22	www.citicards.com	www.citicards.com
16	www.googletagmanager.com	nexus.ensighten.com
16	content22.accountonline.com	nexus.ensighten.com content22.accountonline.com
10	www.google.de
10	www.google.com
10	googleads.g.doubleclick.net	nexus.ensighten.com
10	siteintercept.qualtrics.com	nexus.ensighten.com www.citicards.com
10	bat.bing.com	nexus.ensighten.com www.citicards.com
9	data.privacy.ensighten.com	www.citicards.com
6	maps.googleapis.com	nexus.ensighten.com www.citicards.com
5	6260004.fls.doubleclick.net	2 redirects www.googletagmanager.com adservice.google.com
4	p.tvpixel.com	www.citicards.com
3	prod.report.nacustomerexperience.citi.com	www.citicards.com cdn.gbqofs.com
3	dpm.demdex.net	1 redirects www.citicards.com
2	adservice.google.de	1 redirects adservice.google.com
2	adservice.google.com	6260004.fls.doubleclick.net
2	sb.scorecardresearch.com
2	h.online-metrix.net	content22.accountonline.com
2	servedby.flashtalking.com	6260004.fls.doubleclick.net
2	s.amazon-adsystem.com	1 redirects
2	people.api.boomtrain.com	www.citicards.com
2	cdn.boomtrain.com	nexus.ensighten.com
2	maps.gstatic.com	www.citicards.com
2	live.rezync.com	nexus.ensighten.com
2	1.c81358859121583b7adf2ace89cb39f44.com	nexus.ensighten.com 1.c81358859121583b7adf2ace89cb39f44.com
2	1.b406929acabac9b095f124c81bdfcf57f.com	nexus.ensighten.com 1.b406929acabac9b095f124c81bdfcf57f.com
2	1.a79ab95c1589a13f8a4cab612bc71f9f7.com	nexus.ensighten.com 1.a79ab95c1589a13f8a4cab612bc71f9f7.com
2	cdn.gbqofs.com	nexus.ensighten.com cdn.gbqofs.com
2	c1.rfihub.net	nexus.ensighten.com
2	metrics1.citi.com	www.citicards.com
1	iad1.qualtrics.com
1	sp.analytics.yahoo.com	6260004.fls.doubleclick.net
1	insight.adsrvr.org	nexus.ensighten.com
1	89oebq5kfrnwu4b4b2kgnva3uss5n4odddy4rnlna16891807d617b66am1.e.aa.online-metrix.net
1	citi.bridgetrack.com	nexus.ensighten.com
1	s.rfihub.com
1	js.adsrvr.org	nexus.ensighten.com
1	c.tvpixel.com	nexus.ensighten.com
1	sr.rlcdn.com	nexus.ensighten.com
1	p.rfihub.com	nexus.ensighten.com
1	zn3vi8kkuds0jjrfc-citifeedback.siteintercept.qualtrics.com	nexus.ensighten.com
1	events.api.boomtrain.com	www.citicards.com
1	a.rfihub.com	nexus.ensighten.com
1	20766699p.rfihub.com	nexus.ensighten.com
1	mboxedge37.tt.omtrdc.net	www.citicards.com
1	citicorpcreditservic.tt.omtrdc.net	www.citicards.com
1	online.citi.com	nexus.ensighten.com
1	cm.everesttech.net	1 redirects
1	citi.demdex.net	nexus.ensighten.com
1	tagmanager1.citicards.com	www.citicards.com
1	l.loyalty.ms.aa.com	1 redirects
234	52

This site contains links to these domains. Also see Links.

Domain
www.aa.com
www.citi.com
www.grubhub.com
www.seamless.com
online.citi.com
online.citibank.com
sealinfo.verisign.com

Subject Issuer	Validity	Valid
www.accountonline.com DigiCert SHA2 Extended Validation Server CA	`2022-11-30` - `2023-12-14`	a year	crt.sh
nexus.ensighten.com Amazon RSA 2048 M02	`2023-09-29` - `2024-10-27`	a year	crt.sh
tagmanager1.citi.com DigiCert EV RSA CA G2	`2023-08-21` - `2024-09-20`	a year	crt.sh
*.demdex.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2023-09-26` - `2024-10-26`	a year	crt.sh
metrics1.citi.com DigiCert EV RSA CA G2	`2023-07-10` - `2024-08-09`	a year	crt.sh
*.privacy.ensighten.com DigiCert TLS RSA SHA256 2020 CA1	`2023-02-03` - `2024-02-16`	a year	crt.sh
online.citibank.com DigiCert SHA2 Extended Validation Server CA	`2023-04-28` - `2024-05-15`	a year	crt.sh
upload.video.google.com GTS CA 1C3	`2023-09-18` - `2023-12-11`	3 months	crt.sh
content22.accountonline.com DigiCert EV RSA CA G2	`2023-07-18` - `2024-08-07`	a year	crt.sh
*.tt.omtrdc.net DigiCert TLS RSA SHA256 2020 CA1	`2023-08-22` - `2024-09-21`	a year	crt.sh
*.rfihub.net Amazon RSA 2048 M01	`2023-02-24` - `2023-12-29`	10 months	crt.sh
*.google-analytics.com GTS CA 1C3	`2023-09-18` - `2023-12-11`	3 months	crt.sh
gbqofs.com Cloudflare Inc ECC CA-3	`2023-10-12` - `2024-10-11`	a year	crt.sh
*.a79ab95c1589a13f8a4cab612bc71f9f7.com Sectigo RSA Domain Validation Secure Server CA	`2023-03-26` - `2024-04-04`	a year	crt.sh
*.b406929acabac9b095f124c81bdfcf57f.com Sectigo RSA Domain Validation Secure Server CA	`2023-04-02` - `2024-04-07`	a year	crt.sh
*.c81358859121583b7adf2ace89cb39f44.com Sectigo RSA Domain Validation Secure Server CA	`2023-04-02` - `2024-04-07`	a year	crt.sh
*.rezync.com Amazon RSA 2048 M02	`2023-02-22` - `2023-12-23`	10 months	crt.sh
*.rfihub.com Sectigo RSA Domain Validation Secure Server CA	`2023-04-27` - `2024-04-27`	a year	crt.sh
*.gstatic.com GTS CA 1C3	`2023-09-18` - `2023-12-11`	3 months	crt.sh
*.boomtrain.com Amazon RSA 2048 M02	`2023-02-09` - `2024-03-09`	a year	crt.sh
*.api.boomtrain.com Amazon RSA 2048 M03	`2023-09-16` - `2024-10-14`	a year	crt.sh
*.qualtrics.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2023-03-27` - `2024-03-26`	a year	crt.sh
*.rlcdn.com Sectigo RSA Domain Validation Secure Server CA	`2023-02-02` - `2024-03-03`	a year	crt.sh
www.bing.com Microsoft Azure TLS Issuing CA 05	`2023-07-26` - `2024-01-22`	6 months	crt.sh
*.tvpixel.com Amazon RSA 2048 M01	`2023-02-21` - `2024-01-13`	a year	crt.sh
*.adsrvr.org GlobalSign GCC R3 DV TLS CA 2020	`2023-04-12` - `2024-05-13`	a year	crt.sh
prod.report.nacustomerexperience.citi.com DigiCert EV RSA CA G2	`2023-05-19` - `2024-05-22`	a year	crt.sh
*.doubleclick.net GTS CA 1C3	`2023-09-18` - `2023-12-11`	3 months	crt.sh
servedby.flashtalking.com DigiCert TLS RSA SHA256 2020 CA1	`2023-09-14` - `2024-09-14`	a year	crt.sh
citi.bridgetrack.com Thawte EV RSA CA G2	`2023-03-20` - `2024-04-19`	a year	crt.sh
h.online-metrix.net Trustwave Organization Validation SHA256 CA, Level 1	`2023-01-09` - `2024-01-23`	a year	crt.sh
*.e.aa.online-metrix.net Trustwave Organization Validation SHA256 CA, Level 1	`2023-06-14` - `2024-07-01`	a year	crt.sh
*.scorecardresearch.com Sectigo RSA Domain Validation Secure Server CA	`2022-12-15` - `2023-12-28`	a year	crt.sh
*.g.doubleclick.net GTS CA 1C3	`2023-09-18` - `2023-12-11`	3 months	crt.sh
*.google.com GTS CA 1C3	`2023-09-18` - `2023-12-11`	3 months	crt.sh
www.google.com GTS CA 1C3	`2023-09-18` - `2023-12-11`	3 months	crt.sh
www.google.de GTS CA 1C3	`2023-09-18` - `2023-12-11`	3 months	crt.sh
*.google.de GTS CA 1C3	`2023-09-18` - `2023-12-11`	3 months	crt.sh
real.sp.analytics.yahoo.com DigiCert SHA2 High Assurance Server CA	`2023-05-30` - `2023-11-22`	6 months	crt.sh

This page contains 19 frames:

Primary Page: https://www.citicards.com/cards/credit/application/flow.action?app=UNSOL&ID=3001&HKOP=2de94b05869e4857c38ba3a5df71418d5ccbea5e43605c020c419744dbe79b6c
Frame ID: CF5BA77E93A03424DF6B969C4130FD99
Requests: 176 HTTP requests in this frame

Frame: https://citi.demdex.net/dest5.html?d_nsid=0
Frame ID: 861DBCCA0AABFD7E8456B84C8E5200B0
Requests: 1 HTTP requests in this frame

Frame: https://1.a79ab95c1589a13f8a4cab612bc71f9f7.com/scripts/prod/crossdomain.html
Frame ID: AB07A729E55BF24BD4BD0BB04248BC8A
Requests: 2 HTTP requests in this frame

Frame: https://1.b406929acabac9b095f124c81bdfcf57f.com/scripts/prod/crossdomain.html
Frame ID: 33B154AA0A07CBA0EF764214E6C3C79C
Requests: 2 HTTP requests in this frame

Frame: https://1.c81358859121583b7adf2ace89cb39f44.com/scripts/prod/crossdomain.html
Frame ID: 813F5391DFD522DB260E686F4A608072
Requests: 2 HTTP requests in this frame

Frame: https://20766699p.rfihub.com/ca.html?ver=9&ra=1822&rb=648&ca=20766699&_o=17169175&_t=citibankonlineconsumercardenterinformation&_rev=1&_pcode=1&_orderid=1&ssv_cuuid=&ssv_package=null&ssv_prodlist=null&ssv_pagename=citibankonlineconsumercardenterinformation&pe=https%3A%2F%2Fwww.citicards.com%2Fcards%2Fcredit%2Fapplication%2Fflow.action%3Fapp%3DUNSOL%26ID%3D3001%26HKOP%3D2de94b05869e4857c38ba3a5df71418d5ccbea5e43605c020c419744dbe79b6c&pf=&ra=21338333050480518
Frame ID: D801F49C52DF35F097AF236BBCEBA6DF
Requests: 1 HTTP requests in this frame

Frame: https://p.rfihub.com/ca.html?ver=9&ra=1929&rb=648&ca=&_o=17169175&_t=&pe=https%3A%2F%2Fwww.citicards.com%2Fcards%2Fcredit%2Fapplication%2Fflow.action%3Fapp%3DUNSOL%26ID%3D3001%26HKOP%3D2de94b05869e4857c38ba3a5df71418d5ccbea5e43605c020c419744dbe79b6c&pf=&ra=5065256972997101
Frame ID: E01772E173468876B6BE6A3F414F2D1B
Requests: 1 HTTP requests in this frame

Frame: https://sr.rlcdn.com/425466.html?es=80676&u=da39a3ee5e6b4b0d3255bfef95601890afd80709
Frame ID: 00C66A636C55EB5C290E08F35A3E7A7F
Requests: 1 HTTP requests in this frame

Frame: https://content22.accountonline.com/fp/check.js;CIS3SID=1E9AE98D00C7721239A87FB1F61DDD37?org_id=89oebq5k&session_id=d73badfb6291512b9f1d43ffd18e1f8f2519636970c27cb58dfddf5166d9b69a&nonce=a16891807d617b66&pageid=1&jb=353b24246a736d773f55616e646f75712e68736f3d556b6c646f7f732530383332266a7b60773f4b6a726d6f672468736a3d4168726d6d6527303039333a
Frame ID: A63DAC55C3458DBAE4D8F4B3F8DF212A
Requests: 33 HTTP requests in this frame

Frame: https://6260004.fls.doubleclick.net/activityi;dc_pre=CNn7zauN_oEDFdPIOwIdyLsO-A;src=6260004;type=appli0;cat=appli0;qty=1;cost=1;ord=2879853513319.5435;auiddc=583581942.1697580813;u1=093;u3=null;u4=jJRSACQ_AboutYou_AA;u12=https%3A%2F%2Fwww.citicards.com%2Fcards%2Fcredit%2Fapplication%2Fflow.action%3Fapp%3DUNSOL%26ID%3D3001%26HKOP%3D2de94b05869e4857c38ba3a5df71418d5ccbea5e43605c020c419744dbe79b6c;u11=;gtm=45fe3ag0;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;epver=2;~oref=https%3A%2F%2Fwww.citicards.com%2Fcards%2Fcredit%2Fapplication%2Fflow.action%3Fapp%3DUNSOL%26ID%3D3001%26HKOP%3D2de94b05869e4857c38ba3a5df71418d5ccbea5e43605c020c419744dbe79b6c
Frame ID: 5890D4A73518B522FE3546392A1554FB
Requests: 1 HTTP requests in this frame

Frame: https://6260004.fls.doubleclick.net/activityi;dc_pre=CO34zauN_oEDFQ6Tmwod-7sB4w;src=6260004;type=appli0;cat=aaadv000;qty=1;cost=1995.27;ord=1746401848952.357;auiddc=583581942.1697580813;u1=093;u3=null;u4=jJRSACQ_AboutYou_AA;u11=;gtm=45fe3ag0;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;epver=2;~oref=https%3A%2F%2Fwww.citicards.com%2Fcards%2Fcredit%2Fapplication%2Fflow.action%3Fapp%3DUNSOL%26ID%3D3001%26HKOP%3D2de94b05869e4857c38ba3a5df71418d5ccbea5e43605c020c419744dbe79b6c
Frame ID: 0928682A8DF68BC3E7F2D70603FAE1F0
Requests: 1 HTTP requests in this frame

Frame: https://content22.accountonline.com/fp/ls_fp.html;CIS3SID=1E9AE98D00C7721239A87FB1F61DDD37?org_id=89oebq5k&session_id=d73badfb6291512b9f1d43ffd18e1f8f2519636970c27cb58dfddf5166d9b69a&nonce=a16891807d617b66&pageid=1
Frame ID: 72236439710E81ADD5E7F52977F257B6
Requests: 2 HTTP requests in this frame

Frame: https://h.online-metrix.net/fp/sid_fp.html;CIS3SID=1E9AE98D00C7721239A87FB1F61DDD37?org_id=89oebq5k&session_id=d73badfb6291512b9f1d43ffd18e1f8f2519636970c27cb58dfddf5166d9b69a&nonce=a16891807d617b66&pageid=1
Frame ID: F027E61D7AE4255B026AEAE106E24F35
Requests: 2 HTTP requests in this frame

Frame: https://content22.accountonline.com/fp/top_fp.html;CIS3SID=1E9AE98D00C7721239A87FB1F61DDD37?org_id=89oebq5k&session_id=d73badfb6291512b9f1d43ffd18e1f8f2519636970c27cb58dfddf5166d9b69a&nonce=a16891807d617b66&pageid=1
Frame ID: 7B342164B695952F4B2DBFF4CD632D5D
Requests: 1 HTTP requests in this frame

Frame: https://insight.adsrvr.org/track/up?adv=1jw5cvl&ref=https%3A%2F%2Fwww.citicards.com%2Fcards%2Fcredit%2Fapplication%2Fflow.action%3Fapp%3DUNSOL%26ID%3D3001%26HKOP%3D2de94b05869e4857c38ba3a5df71418d5ccbea5e43605c020c419744dbe79b6c&upid=hqgowpz&upv=1.1.0&id=ttdUniversalPixelTag1697580814726&td1=jJRSACQ_AboutYou_AA&td2=093
Frame ID: 7590BEAF76420A0F1651F1EBF778A5A0
Requests: 1 HTTP requests in this frame

Frame: https://adservice.google.com/ddm/fls/i/dc_pre=CNn7zauN_oEDFdPIOwIdyLsO-A;src=6260004;type=appli0;cat=appli0;qty=1;cost=1;ord=2879853513319.5435;auiddc=583581942.1697580813;u1=093;u3=null;u4=jJRSACQ_AboutYou_AA;u12=https%3A%2F%2Fwww.citicards.com%2Fcards%2Fcredit%2Fapplication%2Fflow.action%3Fapp%3DUNSOL%26ID%3D3001%26HKOP%3D2de94b05869e4857c38ba3a5df71418d5ccbea5e43605c020c419744dbe79b6c;u11=;gtm=45fe3ag0;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;epver=2;~oref=https%3A%2F%2Fwww.citicards.com%2Fcards%2Fcredit%2Fapplication%2Fflow.action%3Fapp%3DUNSOL%26ID%3D3001%26HKOP%3D2de94b05869e4857c38ba3a5df71418d5ccbea5e43605c020c419744dbe79b6c
Frame ID: F3C33F117777CF38DCC6D7ED349BD95B
Requests: 1 HTTP requests in this frame

Frame: https://adservice.google.com/ddm/fls/i/dc_pre=CO34zauN_oEDFQ6Tmwod-7sB4w;src=6260004;type=appli0;cat=aaadv000;qty=1;cost=1995.27;ord=1746401848952.357;auiddc=583581942.1697580813;u1=093;u3=null;u4=jJRSACQ_AboutYou_AA;u11=;gtm=45fe3ag0;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;epver=2;~oref=https%3A%2F%2Fwww.citicards.com%2Fcards%2Fcredit%2Fapplication%2Fflow.action%3Fapp%3DUNSOL%26ID%3D3001%26HKOP%3D2de94b05869e4857c38ba3a5df71418d5ccbea5e43605c020c419744dbe79b6c
Frame ID: F8AC733300FA63275ED90330411BAFD2
Requests: 1 HTTP requests in this frame

Frame: https://6260004.fls.doubleclick.net/ddm/fls/r/dc_pre=CO34zauN_oEDFQ6Tmwod-7sB4w;src=6260004;type=appli0;cat=aaadv000;qty=1;cost=1995.27;ord=1746401848952.357;auiddc=583581942.1697580813;u1=093;u3=null;u4=jJRSACQ_AboutYou_AA;u11=;gtm=45fe3ag0;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;epver=2;~oref=https%3A%2F%2Fwww.citicards.com%2Fcards%2Fcredit%2Fapplication%2Fflow.action%3Fapp%3DUNSOL%26ID%3D3001%26HKOP%3D2de94b05869e4857c38ba3a5df71418d5ccbea5e43605c020c419744dbe79b6c
Frame ID: 1BF25E90C8680769CD510EE1FF91DCD7
Requests: 3 HTTP requests in this frame

Frame: https://adservice.google.de/ddm/fls/i/dc_pre=CNn7zauN_oEDFdPIOwIdyLsO-A;src=6260004;type=appli0;cat=appli0;qty=1;cost=1;ord=2879853513319.5435;auiddc=583581942.1697580813;u1=093;u3=null;u4=jJRSACQ_AboutYou_AA;u12=https%3A%2F%2Fwww.citicards.com%2Fcards%2Fcredit%2Fapplication%2Fflow.action%3Fapp%3DUNSOL%26ID%3D3001%26HKOP%3D2de94b05869e4857c38ba3a5df71418d5ccbea5e43605c020c419744dbe79b6c;u11=;gtm=45fe3ag0;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;epver=2;~oref=https%3A%2F%2Fwww.citicards.com%2Fcards%2Fcredit%2Fapplication%2Fflow.action%3Fapp%3DUNSOL%26ID%3D3001%26HKOP%3D2de94b05869e4857c38ba3a5df71418d5ccbea5e43605c020c419744dbe79b6c
Frame ID: A51AAC7C107B5CE9D3A730E744B47A58
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Citi Online Consumer Card - Enter InformationUDAP T&C

Page URL History Show full URLs

https://l.loyalty.ms.aa.com/rts/go2.aspx?h=4062120&tp=i-1NGB-GT-sAQ-Ky7ypV-1w-1V3Pb-1c-Ky6lJe-l9Z6aqHq2s... HTTP 302
https://www.citicards.com/cards/credit/application/flow.action?app=UNSOL&ID=3001&HKOP=2de94b05869e4857... Page URL

Detected technologies

Google Maps (Maps) Expand

Overall confidence: 100%
Detected patterns

//maps\.google(?:apis)?\.com/maps/api/js

Bootstrap (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js

Akamai Bot Manager (Security) Expand

Overall confidence: 100%
Detected patterns

Ensighten (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

//nexus\.ensighten\.com/

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/gtag/js

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery[.-]([\d.]*\d)[^/]*\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

234
Requests

90 %
HTTPS

33 %
IPv6

33
Domains

52
Subdomains

47
IPs

4
Countries

3208 kB
Transfer

10649 kB
Size

59
Cookies

20 Outgoing links

These are links going to different origins than the main page.

URL: https://www.aa.com/privacy
Title: https://www.aa.com/privacy

Search URL Search Domain Scan URL

URL: https://www.aa.com/homePage.do
Title: https://www.aa.com/

Search URL Search Domain Scan URL

URL: https://www.citi.com/affiliatesproducts
Title: https://www.citi.com/affiliatesproducts

Search URL Search Domain Scan URL

URL: https://www.aa.com/hotels
Title: aa.com/hotels

Search URL Search Domain Scan URL

URL: https://www.aa.com/cars
Title: https://www.aa.com/cars

Search URL Search Domain Scan URL

URL: https://www.aa.com/newaadvantage
Title: https://www.aa.com/newaadvantage

Search URL Search Domain Scan URL

URL: https://www.grubhub.com/
Title: https://www.grubhub.com.

Search URL Search Domain Scan URL

URL: https://www.seamless.com/
Title: https://www.seamless.com

Search URL Search Domain Scan URL

URL: https://www.aa.com/admiralsclub
Title: aa.com/admiralsclub

Search URL Search Domain Scan URL

URL: https://www.aa.com/baggage
Title: aa.com/baggage

Search URL Search Domain Scan URL

URL: http://www.aa.com/AAdvantage
Title: aa.com/aadvantage

Search URL Search Domain Scan URL

URL: https://www.citi.com/CRD/PDF/CMA/cardAgreement/CMA_PID093.pdf
Title: Cardmember Agreement (PDF)

Search URL Search Domain Scan URL

URL: https://www.citi.com/credit-cards/creditcards/CitiHome.do
Title: Citicards.com

Search URL Search Domain Scan URL

URL: https://online.citi.com/US/JRS/portal/template.do?ID=TermsDisclaimer
Title: Terms & Conditions

Search URL Search Domain Scan URL

URL: https://online.citibank.com/US/JRS/portal/template.do?ID=Privacy
Title: Privacy

Search URL Search Domain Scan URL

URL: https://online.citibank.com/JRS/portal/template.do?ID=Privacy#notice-at-collection
Title: Notice At Collection

Search URL Search Domain Scan URL

URL: https://online.citi.com/US/ag/dataprivacyhub/home
Title: Do Not Sell or Share My Personal Information

Search URL Search Domain Scan URL

URL: https://sealinfo.verisign.com/splash?form_file=fdf/splash.fdf&dn=www.citicards.com

Search URL Search Domain Scan URL

URL: https://online.citi.com/JRS/portal/template.do?ID=Privacy#ad-info-external-use
Title: AdChoices

Search URL Search Domain Scan URL

URL: https://online.citi.com/US/JRS/portal/template.do?ID=Privacy#info-manage
Title: Privacy Policy

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://l.loyalty.ms.aa.com/rts/go2.aspx?h=4062120&tp=i-1NGB-GT-sAQ-Ky7ypV-1w-1V3Pb-1c-Ky6lJe-l9Z6aqHq2s-Wp2Zm&pi=KgtzSjNmmGEsatE37G9gsQGqc9rJe0Dxr5hXdQIaREDCZTl-q-2HnAilNCKuEZ5O HTTP 302
https://www.citicards.com/cards/credit/application/flow.action?app=UNSOL&ID=3001&HKOP=2de94b05869e4857c38ba3a5df71418d5ccbea5e43605c020c419744dbe79b6c Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 10

https://dpm.demdex.net/id?d_visid_ver=4.4.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=61834D9B5228A7430A490D45%40AdobeOrg&d_nsid=0&ts=1697580812358 HTTP 302
https://dpm.demdex.net/id/rd?d_visid_ver=4.4.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=61834D9B5228A7430A490D45%40AdobeOrg&d_nsid=0&ts=1697580812358

Request Chain 51

https://cm.everesttech.net/cm/dd?d_uuid=76150096283887386614252401464242713106 HTTP 302
https://dpm.demdex.net/ibs:dpid=411&dpuuid=ZS8HDAAAAFddJQOJ

Request Chain 105

https://s.amazon-adsystem.com/iu3?pid=c3702eea-109e-48b0-9ef4-c856bdd405e2&event=PageView HTTP 302
https://s.amazon-adsystem.com/iu3?pid=c3702eea-109e-48b0-9ef4-c856bdd405e2&event=PageView&dcc=t

Request Chain 112

https://6260004.fls.doubleclick.net/activityi;src=6260004;type=appli0;cat=appli0;qty=1;cost=1;ord=2879853513319.5435;auiddc=583581942.1697580813;u1=093;u3=null;u4=jJRSACQ_AboutYou_AA;u12=https%3A%2F%2Fwww.citicards.com%2Fcards%2Fcredit%2Fapplication%2Fflow.action%3Fapp%3DUNSOL%26ID%3D3001%26HKOP%3D2de94b05869e4857c38ba3a5df71418d5ccbea5e43605c020c419744dbe79b6c;u11=;gtm=45fe3ag0;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;epver=2;~oref=https%3A%2F%2Fwww.citicards.com%2Fcards%2Fcredit%2Fapplication%2Fflow.action%3Fapp%3DUNSOL%26ID%3D3001%26HKOP%3D2de94b05869e4857c38ba3a5df71418d5ccbea5e43605c020c419744dbe79b6c HTTP 302
https://6260004.fls.doubleclick.net/activityi;dc_pre=CNn7zauN_oEDFdPIOwIdyLsO-A;src=6260004;type=appli0;cat=appli0;qty=1;cost=1;ord=2879853513319.5435;auiddc=583581942.1697580813;u1=093;u3=null;u4=jJRSACQ_AboutYou_AA;u12=https%3A%2F%2Fwww.citicards.com%2Fcards%2Fcredit%2Fapplication%2Fflow.action%3Fapp%3DUNSOL%26ID%3D3001%26HKOP%3D2de94b05869e4857c38ba3a5df71418d5ccbea5e43605c020c419744dbe79b6c;u11=;gtm=45fe3ag0;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;epver=2;~oref=https%3A%2F%2Fwww.citicards.com%2Fcards%2Fcredit%2Fapplication%2Fflow.action%3Fapp%3DUNSOL%26ID%3D3001%26HKOP%3D2de94b05869e4857c38ba3a5df71418d5ccbea5e43605c020c419744dbe79b6c

Request Chain 113

https://6260004.fls.doubleclick.net/activityi;src=6260004;type=appli0;cat=aaadv000;qty=1;cost=1995.27;ord=1746401848952.357;auiddc=583581942.1697580813;u1=093;u3=null;u4=jJRSACQ_AboutYou_AA;u11=;gtm=45fe3ag0;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;epver=2;~oref=https%3A%2F%2Fwww.citicards.com%2Fcards%2Fcredit%2Fapplication%2Fflow.action%3Fapp%3DUNSOL%26ID%3D3001%26HKOP%3D2de94b05869e4857c38ba3a5df71418d5ccbea5e43605c020c419744dbe79b6c HTTP 302
https://6260004.fls.doubleclick.net/activityi;dc_pre=CO34zauN_oEDFQ6Tmwod-7sB4w;src=6260004;type=appli0;cat=aaadv000;qty=1;cost=1995.27;ord=1746401848952.357;auiddc=583581942.1697580813;u1=093;u3=null;u4=jJRSACQ_AboutYou_AA;u11=;gtm=45fe3ag0;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;epver=2;~oref=https%3A%2F%2Fwww.citicards.com%2Fcards%2Fcredit%2Fapplication%2Fflow.action%3Fapp%3DUNSOL%26ID%3D3001%26HKOP%3D2de94b05869e4857c38ba3a5df71418d5ccbea5e43605c020c419744dbe79b6c

Request Chain 191

https://adservice.google.de/ddm/fls/i/dc_pre=CO34zauN_oEDFQ6Tmwod-7sB4w;src=6260004;type=appli0;cat=aaadv000;qty=1;cost=1995.27;ord=1746401848952.357;auiddc=583581942.1697580813;u1=093;u3=null;u4=jJRSACQ_AboutYou_AA;u11=;gtm=45fe3ag0;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;epver=2;~oref=https%3A%2F%2Fwww.citicards.com%2Fcards%2Fcredit%2Fapplication%2Fflow.action%3Fapp%3DUNSOL%26ID%3D3001%26HKOP%3D2de94b05869e4857c38ba3a5df71418d5ccbea5e43605c020c419744dbe79b6c HTTP 302
https://6260004.fls.doubleclick.net/ddm/fls/r/dc_pre=CO34zauN_oEDFQ6Tmwod-7sB4w;src=6260004;type=appli0;cat=aaadv000;qty=1;cost=1995.27;ord=1746401848952.357;auiddc=583581942.1697580813;u1=093;u3=null;u4=jJRSACQ_AboutYou_AA;u11=;gtm=45fe3ag0;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;epver=2;~oref=https%3A%2F%2Fwww.citicards.com%2Fcards%2Fcredit%2Fapplication%2Fflow.action%3Fapp%3DUNSOL%26ID%3D3001%26HKOP%3D2de94b05869e4857c38ba3a5df71418d5ccbea5e43605c020c419744dbe79b6c

234 HTTP transactions
1 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1

200
OK

Primary Request flow.action Show response
www.citicards.com/cards/credit/application/
Redirect Chain

https://l.loyalty.ms.aa.com/rts/go2.aspx?h=4062120&tp=i-1NGB-GT-sAQ-Ky7ypV-1w-1V3Pb-1c-Ky6lJe-l9Z6aqHq2s-Wp2Zm&pi=KgtzSjNmmGEsatE37G9gsQGqc9rJe0Dxr5hXdQIaREDCZTl-q-2HnAilNCKuEZ5O
https://www.citicards.com/cards/credit/application/flow.action?app=UNSOL&ID=3001&HKOP=2de94b05869e4857c38ba3a5df71418d5ccbea5e43605c020c419744dbe79b6c

118 KB
30 KB

1967ms
1881ms

Document
text/html

23.212.222.131
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://www.citicards.com/cards/credit/application/flow.action?app=UNSOL&ID=3001&HKOP=2de94b05869e4857c38ba3a5df71418d5ccbea5e43605c020c419744dbe79b6c

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

23.212.222.131 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-212-222-131.deploy.static.akamaitechnologies.com

Software

Resource Hash

22ce6e30bfd054773e788600dac65c5b948152e36447d41503c347488cc187b4

Security Headers

Name	Value
Content-Security-Policy	Frame-Ancestors 'self' https://sit01.disputes.citi.com https://disputes.citi.com
X-Frame-Options	Allow-From https://sit01.disputes.citi.com https://disputes.citi.com

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Cache-Control: no-cache, no-store, must-revalidate
Connection: keep-alive
Content-Encoding: gzip
Content-Language: de-DE
Content-Length: 29307
Content-Security-Policy: Frame-Ancestors 'self' https://sit01.disputes.citi.com https://disputes.citi.com
Content-Type: text/html; charset=ISO-8859-1
Date: Tue, 17 Oct 2023 22:13:29 GMT
Expires: 0
Pragma: no-cache
Vary: Accept-Encoding
X-Akamai-CITISITE: SWDC
X-Akamai-Transformed: 9 - 0 pmb=mTOE,1
X-DEBUG-TIER2: 1ba7c861-104.123.69.87-1697580809-AUTH1-SHPIP4.79.61.108-TCIP178.162.209.141
X-DEBUG-TIER2-PARENT: 11c10904-23.47.59.243-1697580809-AUTH1-SHPIP104.123.69.87-TCIP178.162.209.141
X-Frame-Options: Allow-From https://sit01.disputes.citi.com https://disputes.citi.com
X-Ion-Hop: Prod
X-UA-Compatible: IE=Edge IE=Edge

Redirect headers

Cache-Control: private
Content-Type: text/html; charset=utf-8
Date: Tue, 17 Oct 2023 22:13:27 GMT
Location: https://www.citicards.com/cards/credit/application/flow.action?app=UNSOL&ID=3001&HKOP=2de94b05869e4857c38ba3a5df71418d5ccbea5e43605c020c419744dbe79b6c
Server
Transfer-Encoding: chunked
X-Powered-By

GET
H/1.1 200
OK 6c8322c7341eac98645c10e3d1d3c7ae.js Show response
www.citicards.com/assets/scripts/global/ 1 KB
1 KB 183ms
181ms Script
application/javascript 23.212.222.131
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://www.citicards.com/assets/scripts/global/6c8322c7341eac98645c10e3d1d3c7ae.js
Requested by: Host: www.citicards.com
URL: https://www.citicards.com/cards/credit/application/flow.action?app=UNSOL&ID=3001&HKOP=2de94b05869e4857c38ba3a5df71418d5ccbea5e43605c020c419744dbe79b6c
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.212.222.131 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-212-222-131.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 7881b3a35e6712f776a28e3ca51c2805be477b9935e1289774a7aaf187d2eec0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.citicards.com/cards/credit/application/flow.action?app=UNSOL&ID=3001&HKOP=2de94b05869e4857c38ba3a5df71418d5ccbea5e43605c020c419744dbe79b6c
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 17 Oct 2023 22:13:30 GMT
Content-Encoding: gzip
Vary: Accept-Encoding
Content-Type: application/javascript; charset=UTF-8
X-Ion-Hop: Prod
Cache-Control: no-cache, no-store, must-revalidate
Connection: keep-alive
Content-Length: 736
Expires: 0

GET
H/1.1 200
OK newWelcome.min.css
www.citicards.com/cards/wv/welcome/css/ 291 KB
46 KB 51ms
31ms Stylesheet
text/css 23.212.222.131
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://www.citicards.com/cards/wv/welcome/css/newWelcome.min.css
Requested by: Host: www.citicards.com
URL: https://www.citicards.com/cards/credit/application/flow.action?app=UNSOL&ID=3001&HKOP=2de94b05869e4857c38ba3a5df71418d5ccbea5e43605c020c419744dbe79b6c
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.212.222.131 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-212-222-131.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 22ad331165b712e3d879b32dcf10ce25a5b65bf6860eb7a5c3cf0b7d35e0ad7d

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.citicards.com/cards/credit/application/flow.action?app=UNSOL&ID=3001&HKOP=2de94b05869e4857c38ba3a5df71418d5ccbea5e43605c020c419744dbe79b6c
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

Date: Tue, 17 Oct 2023 22:13:29 GMT
Content-Encoding: gzip
X-DataStream-Origin-MEX-Latency: 499
Last-Modified: Thu, 21 Oct 2021 14:38:18 GMT
X-DataStream-MidMile-RTT: 0
X-Akamai-CITISITE: SWDC
Vary: Accept-Encoding
Content-Type: text/css
Cache-Control: max-age=21600
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 46581
X-DataStream-Cache-Status: 3
Expires: Wed, 18 Oct 2023 04:13:29 GMT

GET
H/1.1 200
OK jquery-1.12.4.min.js Show response
www.citicards.com/cards/wv/welcome/js/ 95 KB
33 KB 50ms
29ms Script
application/x-javascript 23.212.222.131
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://www.citicards.com/cards/wv/welcome/js/jquery-1.12.4.min.js
Requested by: Host: www.citicards.com
URL: https://www.citicards.com/cards/credit/application/flow.action?app=UNSOL&ID=3001&HKOP=2de94b05869e4857c38ba3a5df71418d5ccbea5e43605c020c419744dbe79b6c
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.212.222.131 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-212-222-131.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 27d92130c0321dad5a03760fd5ac98a3d04ed4c94d88418fe6d50da1f7fc5cbe

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.citicards.com/cards/credit/application/flow.action?app=UNSOL&ID=3001&HKOP=2de94b05869e4857c38ba3a5df71418d5ccbea5e43605c020c419744dbe79b6c
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

Date: Tue, 17 Oct 2023 22:13:29 GMT
Content-Encoding: gzip
Last-Modified: Tue, 22 May 2018 15:55:25 GMT
X-Akamai-CITISITE: SWDC
Vary: Accept-Encoding
Content-Type: application/x-javascript
Cache-Control: max-age=21600
Connection: keep-alive
Accept-Ranges: bytes
X-DataStream-Cache-Status: 1
Content-Length: 33706
Expires: Wed, 18 Oct 2023 04:13:29 GMT

GET
H2 200 Bootstrap.js Show response
nexus.ensighten.com/citi/na_prod/ 615 KB
143 KB 72ms
25ms Script
application/javascript 2600:9000:206f:5200:2:8f43:5780:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Requested by: Host: www.citicards.com
URL: https://www.citicards.com/cards/credit/application/flow.action?app=UNSOL&ID=3001&HKOP=2de94b05869e4857c38ba3a5df71418d5ccbea5e43605c020c419744dbe79b6c
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:206f:5200:2:8f43:5780:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: CloudFront /
Resource Hash: e9ae7d44bbc0dc049ed8b51aea98eda276648335d680747e3ba6cae32c3c5f26

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.citicards.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Tue, 17 Oct 2023 20:10:51 GMT
x-amz-version-id: CRWf9OvEV69zn0S3q_VcfXYSoike9MUQ
content-encoding: br
via: 1.1 4162b603e4967e54c2386fa354705d6e.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-C1
age: 7359
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
alt-svc: h3=":443"; ma=86400
last-modified: Tue, 17 Oct 2023 20:10:28 GMT
server: CloudFront
etag: W/"701b12d257f9d0bfe648920eb26b4720"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
cache-control: max-age=300
x-amz-cf-id: bP69FrsmHKJd1bIqZkXRX_nNyWaOtKIhxjTfAmsqqJlMX6NMPPNtYA==

GET
H/1.1 200
OK bcsid.js Show response
www.citicards.com/cards/wv/welcome/js/ 871 B
792 B 96ms
75ms Script
application/x-javascript 23.212.222.131
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://www.citicards.com/cards/wv/welcome/js/bcsid.js
Requested by: Host: www.citicards.com
URL: https://www.citicards.com/cards/credit/application/flow.action?app=UNSOL&ID=3001&HKOP=2de94b05869e4857c38ba3a5df71418d5ccbea5e43605c020c419744dbe79b6c
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.212.222.131 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-212-222-131.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 186dbee7c80a42c87f0a4a72dc375c9ffd0eda173c48cb2c09937a5247053ffc

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.citicards.com/cards/credit/application/flow.action?app=UNSOL&ID=3001&HKOP=2de94b05869e4857c38ba3a5df71418d5ccbea5e43605c020c419744dbe79b6c
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

Date: Tue, 17 Oct 2023 22:13:30 GMT
Content-Encoding: gzip
Last-Modified: Mon, 26 Aug 2019 18:26:46 GMT
X-Akamai-CITISITE: SWDC
Vary: Accept-Encoding
Content-Type: application/x-javascript
Cache-Control: max-age=21600
Connection: keep-alive
Accept-Ranges: bytes
X-DataStream-Cache-Status: 1
Content-Length: 411
Expires: Wed, 18 Oct 2023 04:13:30 GMT

GET
H/1.1 200
OK chainsaw.js Show response
www.citicards.com/cards/wv/welcome/js/ 698 KB
141 KB 47ms
27ms Script
application/x-javascript 23.212.222.131
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://www.citicards.com/cards/wv/welcome/js/chainsaw.js
Requested by: Host: www.citicards.com
URL: https://www.citicards.com/cards/credit/application/flow.action?app=UNSOL&ID=3001&HKOP=2de94b05869e4857c38ba3a5df71418d5ccbea5e43605c020c419744dbe79b6c
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.212.222.131 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-212-222-131.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 7a475c7e8d1e4a08ddbe9bd36baadedd8c28d9cfcaa958f1e9af84fba8cb1829

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.citicards.com/cards/credit/application/flow.action?app=UNSOL&ID=3001&HKOP=2de94b05869e4857c38ba3a5df71418d5ccbea5e43605c020c419744dbe79b6c
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

Date: Tue, 17 Oct 2023 22:13:29 GMT
Content-Encoding: gzip
Last-Modified: Wed, 29 Jul 2020 09:24:34 GMT
X-Akamai-CITISITE: SWDC
Vary: Accept-Encoding
Content-Type: application/x-javascript
Cache-Control: max-age=21600
Connection: keep-alive
Accept-Ranges: bytes
X-DataStream-Cache-Status: 1
Content-Length: 144200
Expires: Wed, 18 Oct 2023 04:13:29 GMT

GET
H/1.1 200
OK 6c8322c7341eac98645c10e3d1d3c7ae.js Show response
www.citicards.com/assets/scripts/global/ 321 KB
189 KB 823ms
821ms Script
application/javascript 23.212.222.131
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://www.citicards.com/assets/scripts/global/6c8322c7341eac98645c10e3d1d3c7ae.js?seed=AAAjpz-LAQAAFC_bMRxQoajWvZoUseb7-9M_13CDQMMWDa5kNV3LRXPZ6k5d&X-soz9htCz--z=q
Requested by: Host: www.citicards.com
URL: https://www.citicards.com/cards/credit/application/flow.action?app=UNSOL&ID=3001&HKOP=2de94b05869e4857c38ba3a5df71418d5ccbea5e43605c020c419744dbe79b6c
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.212.222.131 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-212-222-131.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 9cd73467ec59bd56d50e838b1a3060d274d35bc66a680e530c7aa2d4197dd9cc

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.citicards.com/cards/credit/application/flow.action?app=UNSOL&ID=3001&HKOP=2de94b05869e4857c38ba3a5df71418d5ccbea5e43605c020c419744dbe79b6c
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

Date: Tue, 17 Oct 2023 22:13:30 GMT
Content-Encoding: gzip
Vary: Accept-Encoding
Transfer-Encoding: chunked
Content-Type: application/javascript; charset=UTF-8
X-Ion-Hop: Prod
Cache-Control: public, max-age=3600, immutable
Connection: keep-alive, Transfer-Encoding

GET
H/1.1 200
OK newWelcome.min.js Show response
www.citicards.com/cards/wv/welcome/js/ 835 KB
212 KB 98ms
37ms Script
application/x-javascript 23.212.222.131
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://www.citicards.com/cards/wv/welcome/js/newWelcome.min.js
Requested by: Host: www.citicards.com
URL: https://www.citicards.com/cards/credit/application/flow.action?app=UNSOL&ID=3001&HKOP=2de94b05869e4857c38ba3a5df71418d5ccbea5e43605c020c419744dbe79b6c
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.212.222.131 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-212-222-131.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: d2635be4e400a98a722fed17ebdaa956188a3819c34eed93c46248ac1f47430d

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.citicards.com/cards/credit/application/flow.action?app=UNSOL&ID=3001&HKOP=2de94b05869e4857c38ba3a5df71418d5ccbea5e43605c020c419744dbe79b6c
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

Date: Tue, 17 Oct 2023 22:13:30 GMT
Content-Encoding: gzip
X-DataStream-Origin-MEX-Latency: 519
Last-Modified: Fri, 09 Dec 2022 06:36:58 GMT
X-DataStream-MidMile-RTT: 0
X-Akamai-CITISITE: GTDC
Vary: Accept-Encoding
Content-Type: application/x-javascript
Cache-Control: max-age=21600
Connection: keep-alive
Accept-Ranges: bytes
X-DataStream-Cache-Status: 3
Content-Length: 216787
Expires: Wed, 18 Oct 2023 04:13:30 GMT

GET
H/1.1 200
OK 6c8322c7341eac98645c10e3d1d3c7ae.js Show response
www.citicards.com/assets/scripts/global/ 321 KB
189 KB 467ms
467ms Script
application/javascript 23.212.222.131
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://www.citicards.com/assets/scripts/global/6c8322c7341eac98645c10e3d1d3c7ae.js?seed=AAAjpz-LAQAAFC_bMRxQoajWvZoUseb7-9M_13CDQMMWDa5kNV3LRXPZ6k5d&X-soz9htCz--z=q
Requested by: Host: www.citicards.com
URL: https://www.citicards.com/assets/scripts/global/6c8322c7341eac98645c10e3d1d3c7ae.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.212.222.131 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-212-222-131.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 9cd73467ec59bd56d50e838b1a3060d274d35bc66a680e530c7aa2d4197dd9cc

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.citicards.com/cards/credit/application/flow.action?app=UNSOL&ID=3001&HKOP=2de94b05869e4857c38ba3a5df71418d5ccbea5e43605c020c419744dbe79b6c
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

Date: Tue, 17 Oct 2023 22:13:31 GMT
Content-Encoding: gzip
Vary: Accept-Encoding
Transfer-Encoding: chunked
Content-Type: application/javascript; charset=UTF-8
X-Ion-Hop: Prod
Cache-Control: public, max-age=3600, immutable
Connection: keep-alive, Transfer-Encoding

GET
H2 200 70267aa8a52cdad6690667dc221be6055d44b1020fce61d0db3766b065bdaab1 Show response
tagmanager1.citicards.com/one/v1/profiles/ 685 B
721 B 133ms
46ms XHR
application/json 3.124.173.63
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tagmanager1.citicards.com/one/v1/profiles/70267aa8a52cdad6690667dc221be6055d44b1020fce61d0db3766b065bdaab1
Requested by: Host: www.citicards.com
URL: https://www.citicards.com/assets/scripts/global/6c8322c7341eac98645c10e3d1d3c7ae.js?seed=AAAjpz-LAQAAFC_bMRxQoajWvZoUseb7-9M_13CDQMMWDa5kNV3LRXPZ6k5d&X-soz9htCz--z=q
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 3.124.173.63 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-124-173-63.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: 1d5febe7550e44775ba5e28b75501a4e08358d1c3df20324cae03ec31c0b70b9

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.citicards.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Tue, 17 Oct 2023 22:13:32 GMT
content-encoding: gzip
server: nginx
x-ens-one-is-anonymous: true
vary: Accept-Encoding
access-control-allow-methods: GET, POST, PUT, DELETE, OPTIONS
content-type: application/json
access-control-allow-origin: *
access-control-expose-headers: *
access-control-allow-headers: *
x-ens-one-ttl: 1704912271
apigw-requestid: M94J9gylFiAEPxA=

GET
H/1.1

200
OK

rd Show response
dpm.demdex.net/id/
Redirect Chain

https://dpm.demdex.net/id?d_visid_ver=4.4.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=61834D9B5228A7430A490D45%40AdobeOrg&d_nsid=0&ts=1697580812358
https://dpm.demdex.net/id/rd?d_visid_ver=4.4.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=61834D9B5228A7430A490D45%40AdobeOrg&d_nsid=0&ts=1697580812358

363 B
1 KB

35ms
35ms

XHR
application/json

34.251.64.143
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://dpm.demdex.net/id/rd?d_visid_ver=4.4.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=61834D9B5228A7430A490D45%40AdobeOrg&d_nsid=0&ts=1697580812358

Requested by

Host: www.citicards.com
URL: https://www.citicards.com/cards/credit/application/flow.action?app=UNSOL&ID=3001&HKOP=2de94b05869e4857c38ba3a5df71418d5ccbea5e43605c020c419744dbe79b6c

Protocol

HTTP/1.1

Server

34.251.64.143 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-34-251-64-143.eu-west-1.compute.amazonaws.com

Software

Resource Hash

fd2ea6b3edb33fc45b5b8aec9e5d20779cf575e1232271c8c0178a7802c94605

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.citicards.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

DCS: dcs-prod-irl1-1-v052-07b4b7e0e.edge-irl1.demdex.com 2 ms
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
content-encoding: gzip
X-TID: PoagVSvDSRE=
Vary: Origin
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Access-Control-Allow-Origin: https://www.citicards.com
Content-Type: application/json;charset=utf-8
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 307
Expires: Thu, 01 Jan 1970 00:00:00 UTC

Redirect headers

DCS: dcs-prod-irl1-2-v052-0c510f33d.edge-irl1.demdex.com 1 ms
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-TID: OjZ9u2Y7RII=
Vary: Origin
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Access-Control-Allow-Origin: https://www.citicards.com
Location: https://dpm.demdex.net/id/rd?d_visid_ver=4.4.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=61834D9B5228A7430A490D45%40AdobeOrg&d_nsid=0&ts=1697580812358
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 0
Expires: Thu, 01 Jan 1970 00:00:00 UTC

GET
H2 200 serverComponent.php Show response
nexus.ensighten.com/citi/na_prod/ 5 KB
2 KB 29ms
29ms Script
text/javascript 2600:9000:206f:5200:2:8f43:5780:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://nexus.ensighten.com/citi/na_prod/serverComponent.php?namespace=Bootstrapper&staticJsPath=nexus.ensighten.com/citi/na_prod/code/&publishedOn=Tue%20Oct%2017%2020:10:24%20GMT%202023&ClientID=1129&PageID=https%3A%2F%2Fwww.citicards.com%2Fcards%2Fcredit%2Fapplication%2Fflow.action%3Fapp%3DUNSOL%26ID%3D3001%26HKOP%3D2de94b05869e4857c38ba3a5df71418d5ccbea5e43605c020c419744dbe79b6c
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:206f:5200:2:8f43:5780:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: CloudFront /
Resource Hash: 326886cab3a3fb74b0801184b8484bd827d756b013295756d33a51e5606212cb

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.citicards.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Tue, 17 Oct 2023 22:13:32 GMT
content-encoding: gzip
via: 1.1 4162b603e4967e54c2386fa354705d6e.cloudfront.net (CloudFront)
server: CloudFront
x-amz-cf-pop: FRA56-C1
vary: Accept-Encoding
x-cache: Miss from cloudfront
content-type: text/javascript
cache-control: no-cache, no-store
alt-svc: h3=":443"; ma=86400
x-amz-cf-id: RFiu3MGQfUv0kwtT3vhSUTKr7ofsFofnn0wLOnBUrEUPihU4tpoNxg==
expires: Tue, 17 Oct 2023 22:13:31 GMT

GET
H/1.1 200
OK aadvantage.png
www.citicards.com/cards/wv/welcome/img/NewBanner/image/cobranded/desktop/ 5 KB
5 KB 842ms
842ms Image
image/png 23.212.222.131
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.citicards.com/cards/wv/welcome/img/NewBanner/image/cobranded/desktop/aadvantage.png
Requested by: Host: www.citicards.com
URL: https://www.citicards.com/cards/wv/welcome/css/newWelcome.min.css
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.212.222.131 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-212-222-131.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 4a652b0fa582775153c5a8c892917c12c090729e16c523ba812cc67f7a1b80f4

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.citicards.com/cards/wv/welcome/css/newWelcome.min.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

Date: Tue, 17 Oct 2023 22:13:33 GMT
Last-Modified: Thu, 16 Feb 2023 16:47:42 GMT
Connection: keep-alive
Accept-Ranges: bytes
X-Akamai-CITISITE: GTDC
Content-Length: 5220
Content-Type: image/png

GET
H/1.1 200
OK citi_app_sprite-blue.svg
www.citicards.com/cards/wv/welcome/img/NewBanner/ 4 KB
2 KB 161ms
160ms Image
image/svg+xml 23.212.222.131
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.citicards.com/cards/wv/welcome/img/NewBanner/citi_app_sprite-blue.svg
Requested by: Host: www.citicards.com
URL: https://www.citicards.com/cards/wv/welcome/css/newWelcome.min.css
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.212.222.131 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-212-222-131.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 2cd8c98a7ba7914c78ad67f963d95201ca25a3b3e925b82eb5e298169c63a1c3

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.citicards.com/cards/wv/welcome/css/newWelcome.min.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

Date: Tue, 17 Oct 2023 22:13:32 GMT
Content-Encoding: gzip
Last-Modified: Fri, 18 Sep 2020 09:13:36 GMT
X-Akamai-CITISITE: SWDC
Vary: Accept-Encoding
Content-Type: image/svg+xml
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 1906

GET
H/1.1 200
OK CA_Aadvantage_Executive_MasterCard.png
www.citicards.com/cards/wv/welcome/img/CardArt/large/ 48 KB
49 KB 364ms
364ms Image
image/png 23.212.222.131
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.citicards.com/cards/wv/welcome/img/CardArt/large/CA_Aadvantage_Executive_MasterCard.png
Requested by: Host: www.citicards.com
URL: https://www.citicards.com/cards/wv/welcome/css/newWelcome.min.css
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.212.222.131 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-212-222-131.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: f23d41bca3d2e7269e285a3683607f31a08061d35e0bed47f44f80e0360b061d

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.citicards.com/cards/wv/welcome/css/newWelcome.min.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

Date: Tue, 17 Oct 2023 22:13:32 GMT
Last-Modified: Thu, 16 Feb 2023 21:40:35 GMT
Connection: keep-alive
Accept-Ranges: bytes
X-Akamai-CITISITE: GTDC
Content-Length: 49490
Content-Type: image/png

GET
H/1.1 404
Not Found Interstate-ExtraLight.woff
www.citicards.com/cards/wv/welcome/css/fonts/interstate/ 0
0 962ms
962ms Font
text/html 23.212.222.131
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://www.citicards.com/cards/wv/welcome/css/fonts/interstate/Interstate-ExtraLight.woff
Requested by: Host: www.citicards.com
URL: https://www.citicards.com/cards/wv/welcome/css/newWelcome.min.css
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.212.222.131 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-212-222-131.deploy.static.akamaitechnologies.com
Software: /
Resource Hash

Request headers

Referer: https://www.citicards.com/cards/wv/welcome/css/newWelcome.min.css
Origin: https://www.citicards.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

Date: Tue, 17 Oct 2023 22:13:33 GMT
Content-Encoding: gzip
Last-Modified: Sat, 26 Jun 2021 04:23:51 GMT
X-Akamai-CITISITE: SWDC
Vary: Accept-Encoding
Content-Type: text/html
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 1532

GET
BLOB 200
OK e18b0fff-6ed6-42ee-8d9d-ffa46aebbf3a
https://www.citicards.com/ 168 KB
0 Other
text/plain

General

Check archive.org

Show headers Download Go to

Full URL: blob:https://www.citicards.com/e18b0fff-6ed6-42ee-8d9d-ffa46aebbf3a
Requested by: Host: www.citicards.com
URL: https://www.citicards.com/cards/credit/application/flow.action?app=UNSOL&ID=3001&HKOP=2de94b05869e4857c38ba3a5df71418d5ccbea5e43605c020c419744dbe79b6c
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: bfee92627d3ee6ef32f79d53989ba3e960cd5edfafd764f8089e1ad18c18327f

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

Content-Length: 171648
Content-Type

GET
H/1.1 200
OK selectDropDown.png
www.citicards.com/cards/wv/welcome/css/images/ 217 B
466 B 34ms
33ms Image
image/png 23.212.222.131
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.citicards.com/cards/wv/welcome/css/images/selectDropDown.png
Requested by: Host: www.citicards.com
URL: https://www.citicards.com/cards/wv/welcome/css/newWelcome.min.css
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.212.222.131 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-212-222-131.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 2192c61e7cee34b3baa6dda1e2085472eb25c7fac5d558f5e433dd6d8f4f715c

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.citicards.com/cards/wv/welcome/css/newWelcome.min.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

Date: Tue, 17 Oct 2023 22:13:32 GMT
Last-Modified: Wed, 05 Oct 2016 16:52:26 GMT
X-Akamai-CITISITE: GTDC
Content-Type: image/png
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 217
X-DataStream-Cache-Status: 1

GET
H/1.1 200
OK icons@1x.png
www.citicards.com/cards/wv/welcome/css/images/ 10 KB
10 KB 29ms
29ms Image
image/png 23.212.222.131
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.citicards.com/cards/wv/welcome/css/images/icons@1x.png
Requested by: Host: www.citicards.com
URL: https://www.citicards.com/cards/wv/welcome/css/newWelcome.min.css
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.212.222.131 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-212-222-131.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 6e8aa099376459830d295cba8264ffadb98343db5539af204925bf6932a0ed45

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.citicards.com/cards/wv/welcome/css/newWelcome.min.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

Date: Tue, 17 Oct 2023 22:13:32 GMT
Last-Modified: Wed, 05 Oct 2016 16:52:26 GMT
X-Akamai-CITISITE: SWDC
Content-Type: image/png
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 9761
X-DataStream-Cache-Status: 1

GET
H3 200 c4672d80f0441a067c634981e1aa57f8.js Show response
nexus.ensighten.com/citi/na_prod/code/ 1 KB
810 B 16ms
16ms Script
application/javascript 2600:9000:206f:5200:2:8f43:5780:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://nexus.ensighten.com/citi/na_prod/code/c4672d80f0441a067c634981e1aa57f8.js?conditionId0=3381696
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2600:9000:206f:5200:2:8f43:5780:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: CloudFront /
Resource Hash: a3ea0132cb5e6f30bc1e74ddf7d499673476cfcd4f67ce7a89d14dce60ba6712

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.citicards.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Tue, 28 Mar 2023 11:50:48 GMT
x-amz-version-id: MS3Xfu2po1jrvX6TQQinVdszJyqjZMz4
content-encoding: gzip
via: 1.1 4874e0c922f34c928345f4c183ea11b4.cloudfront.net (CloudFront)
age: 17576565
x-amz-cf-pop: FRA56-C1
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
alt-svc: h3=":443"; ma=86400
last-modified: Tue, 20 Jul 2021 20:01:12 GMT
server: CloudFront
etag: W/"5bbd7539bd7ec3c2b7f0d7d76c628a01"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
cache-control: max-age=315360000
x-amz-cf-id: 0Q57XetH5dk3d-xxmk5uFw6WCvQaM-qHq8_FGHV8v_f8B0GFZMXY-A==

GET
H3 200 154c0b78f0ec5bcdad3789b29cb96eb1.js Show response
nexus.ensighten.com/citi/na_prod/code/ 22 KB
3 KB 18ms
17ms Script
application/javascript 2600:9000:206f:5200:2:8f43:5780:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://nexus.ensighten.com/citi/na_prod/code/154c0b78f0ec5bcdad3789b29cb96eb1.js?conditionId0=4905576&conditionId1=4905577&conditionId2=4905574&conditionId3=4905575
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2600:9000:206f:5200:2:8f43:5780:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: CloudFront /
Resource Hash: 5548648d480fb045965c062b862a42141fc9bdfd09951d1df36790f6f468bb27

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.citicards.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Tue, 19 Sep 2023 17:41:22 GMT
x-amz-version-id: XUHkRQYu5Ry65Bi5yq4uVYD7d5nmS5Fv
content-encoding: gzip
via: 1.1 4874e0c922f34c928345f4c183ea11b4.cloudfront.net (CloudFront)
age: 2435530
x-amz-cf-pop: FRA56-C1
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
alt-svc: h3=":443"; ma=86400
last-modified: Tue, 19 Sep 2023 17:26:28 GMT
server: CloudFront
etag: W/"dae973cec182c00d934a58ff2e2e6aba"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
cache-control: max-age=315360000
x-amz-cf-id: znCHXSclHD9yyANOgyCrGm955MweMS-YIkz8KPtLnW2bHyPg_q5bFg==

GET
H3 200 2a6dea2b6c851a94f31ae37ce71c81ba.js Show response
nexus.ensighten.com/citi/na_prod/code/ 6 KB
2 KB 18ms
18ms Script
application/javascript 2600:9000:206f:5200:2:8f43:5780:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://nexus.ensighten.com/citi/na_prod/code/2a6dea2b6c851a94f31ae37ce71c81ba.js?conditionId0=475817
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2600:9000:206f:5200:2:8f43:5780:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: CloudFront /
Resource Hash: 815711bcd35e9fc1c6e20eaebbc2e2e63fc7175a001b02fb5d2c0e448c56ddff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.citicards.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 01 May 2023 19:22:54 GMT
x-amz-version-id: o4C1JTs7X6wFpag0HxT60DWB7NCHFhwy
content-encoding: br
via: 1.1 4874e0c922f34c928345f4c183ea11b4.cloudfront.net (CloudFront)
age: 14611839
x-amz-cf-pop: FRA56-C1
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: PENDING
alt-svc: h3=":443"; ma=86400
last-modified: Mon, 01 May 2023 19:21:07 GMT
server: CloudFront
etag: W/"f2617de038330f83f4ebf7e325a20dae"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
cache-control: max-age=315360000
x-amz-cf-id: m81fVWReWz0acNnmqxU_CmcyjsKqSE30ealsUOawchzfFM7PaI9bcA==

GET
H3 200 7c8ae1f9c206930028672949c6703f6d.js Show response
nexus.ensighten.com/citi/na_prod/code/ 2 KB
2 KB 9ms
9ms Script
application/javascript 2600:9000:206f:5200:2:8f43:5780:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://nexus.ensighten.com/citi/na_prod/code/7c8ae1f9c206930028672949c6703f6d.js?conditionId0=4849963
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2600:9000:206f:5200:2:8f43:5780:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: CloudFront /
Resource Hash: 9a74546a8f511f31b5252f115d2db7aa69370ca5eeaf6828f60abb197f35a169

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.citicards.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Tue, 11 Apr 2023 04:30:09 GMT
x-amz-version-id: fn0OQIG24n9jjHSfN2OozphT08M6eW_x
content-encoding: gzip
via: 1.1 4874e0c922f34c928345f4c183ea11b4.cloudfront.net (CloudFront)
age: 16393404
x-amz-cf-pop: FRA56-C1
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
alt-svc: h3=":443"; ma=86400
last-modified: Tue, 18 Oct 2022 17:52:59 GMT
server: CloudFront
etag: W/"7df0440e45009010a99db868682aafb3"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
cache-control: max-age=315360000
x-amz-cf-id: rc9ZVD6EcL1LM_IRP1zGv5c8mAAjeqnHzRhEjg5gvO7rWPRt_ExemA==

GET
H3 200 7c11c9670fcf23b55bf40bd2dcad5dfe.js Show response
nexus.ensighten.com/citi/na_prod/code/ 18 KB
2 KB 12ms
11ms Script
application/javascript 2600:9000:206f:5200:2:8f43:5780:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://nexus.ensighten.com/citi/na_prod/code/7c11c9670fcf23b55bf40bd2dcad5dfe.js?conditionId0=4877288&conditionId1=4877289&conditionId2=3834893&conditionId3=3811922&conditionId4=3834882&conditionId5=4877298&conditionId6=4877299&conditionId7=4877264&conditionId8=3834884
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2600:9000:206f:5200:2:8f43:5780:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: CloudFront /
Resource Hash: 84a4d7b944f72d47afc7d5cae2f91ac4cf0751aeae9e419a26dce4fd9a44cd93

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.citicards.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Sun, 13 Aug 2023 23:18:17 GMT
x-amz-version-id: LEuSSHuIDFwHjzFxp4d7SgiXs3iMjC.2
content-encoding: br
via: 1.1 4874e0c922f34c928345f4c183ea11b4.cloudfront.net (CloudFront)
age: 5612116
x-amz-cf-pop: FRA56-C1
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
alt-svc: h3=":443"; ma=86400
last-modified: Wed, 05 Apr 2023 13:55:27 GMT
server: CloudFront
etag: W/"1e7a3d2423c75157e5523953c623d6d1"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
cache-control: max-age=315360000
x-amz-cf-id: 2RF3pG0x1JNdbY7Eg2p0StUtrn1aYOwz7tA22G-zHk-HUqsQ4XsZHA==

GET
H3 200 e0928249c240810ce2f036c0f337e14d.js Show response
nexus.ensighten.com/citi/na_prod/code/ 11 KB
3 KB 12ms
11ms Script
application/javascript 2600:9000:206f:5200:2:8f43:5780:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://nexus.ensighten.com/citi/na_prod/code/e0928249c240810ce2f036c0f337e14d.js?conditionId0=455825
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2600:9000:206f:5200:2:8f43:5780:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: CloudFront /
Resource Hash: c6227150aefd71e74fd9371e5d7e7022e98f403c056b766036380fbf276757f3

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.citicards.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Tue, 19 Sep 2023 17:34:56 GMT
x-amz-version-id: hd3Pfs_VCgV8jdU5647UCHKNIiNpGIci
content-encoding: br
via: 1.1 4874e0c922f34c928345f4c183ea11b4.cloudfront.net (CloudFront)
age: 2435917
x-amz-cf-pop: FRA56-C1
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
alt-svc: h3=":443"; ma=86400
last-modified: Tue, 19 Sep 2023 17:26:28 GMT
server: CloudFront
etag: W/"a9cdba6f93ebd99df2d65c47a5521b07"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
cache-control: max-age=315360000
x-amz-cf-id: ixrv7R4kzM4pOQjf1iS7b0BdcxBL0eTVMe5d_KAT2FRZJZUx3BywRw==

GET
H3 200 b3505aaf2371df3a7b502ecf47401ca9.js Show response
nexus.ensighten.com/citi/na_prod/code/ 15 KB
5 KB 12ms
12ms Script
application/javascript 2600:9000:206f:5200:2:8f43:5780:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://nexus.ensighten.com/citi/na_prod/code/b3505aaf2371df3a7b502ecf47401ca9.js?conditionId0=462132
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2600:9000:206f:5200:2:8f43:5780:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: CloudFront /
Resource Hash: b9b5b5f5ebe95b7331b0a728519be48436079a97cb1e22c8c1f543e0eb8fb06b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.citicards.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Tue, 16 May 2023 16:16:37 GMT
x-amz-version-id: nNgK29iXYkoZOr0ZrwsABzVGNV0Vnsqz
content-encoding: gzip
via: 1.1 4874e0c922f34c928345f4c183ea11b4.cloudfront.net (CloudFront)
age: 13327016
x-amz-cf-pop: FRA56-C1
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
alt-svc: h3=":443"; ma=86400
last-modified: Tue, 16 May 2023 16:05:00 GMT
server: CloudFront
etag: W/"797ef42c0c282523438dd5406bb091b4"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
cache-control: max-age=315360000
x-amz-cf-id: 3pUJj3gpLSQ2M35ELnIYO3oGXaH30wCThkclBks45C4pmDL39ybqpw==

GET
H3 200 38dd805c3d57d2ca38d122b90fe36a90.js Show response
nexus.ensighten.com/citi/na_prod/code/ 6 KB
2 KB 13ms
13ms Script
application/javascript 2600:9000:206f:5200:2:8f43:5780:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://nexus.ensighten.com/citi/na_prod/code/38dd805c3d57d2ca38d122b90fe36a90.js?conditionId0=475830
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2600:9000:206f:5200:2:8f43:5780:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: CloudFront /
Resource Hash: 1486a9aed14d5db38b722ecc929872d080793c5c3f65b5f188f36db108b8a7da

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.citicards.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Wed, 09 Aug 2023 14:00:58 GMT
x-amz-version-id: F4ZpqUanZdFLOIwllR1vz4SLMDVrKdGl
content-encoding: gzip
via: 1.1 4874e0c922f34c928345f4c183ea11b4.cloudfront.net (CloudFront)
age: 5991155
x-amz-cf-pop: FRA56-C1
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
alt-svc: h3=":443"; ma=86400
last-modified: Mon, 01 May 2023 19:21:07 GMT
server: CloudFront
etag: W/"b99799f44fd041973a163b7666d94ed5"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
cache-control: max-age=315360000
x-amz-cf-id: jmggyFL69bUQra_OIbb26D0Z3hGjO3lyHYVBldrHUt9BTIU924TEHg==

GET
H3 200 f0db1cf4496c8b42c5a1b2fa40b4f157.js Show response
nexus.ensighten.com/citi/na_prod/code/ 5 KB
2 KB 12ms
12ms Script
application/javascript 2600:9000:206f:5200:2:8f43:5780:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://nexus.ensighten.com/citi/na_prod/code/f0db1cf4496c8b42c5a1b2fa40b4f157.js?conditionId0=4897099
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2600:9000:206f:5200:2:8f43:5780:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: CloudFront /
Resource Hash: 13a59cfac1785dd94d0005457ed1e12cf77fee65b975fe6fd91af77b7ac6cd77

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.citicards.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Wed, 02 Aug 2023 16:15:54 GMT
x-amz-version-id: _NJEt9Au7TfYHRltPN9x_4PZSTxTzbkJ
content-encoding: gzip
via: 1.1 4874e0c922f34c928345f4c183ea11b4.cloudfront.net (CloudFront)
age: 6587859
x-amz-cf-pop: FRA56-C1
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
alt-svc: h3=":443"; ma=86400
last-modified: Wed, 02 Aug 2023 16:06:47 GMT
server: CloudFront
etag: W/"f21df27f4d3e67ca5151a737dacd6837"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
cache-control: max-age=315360000
x-amz-cf-id: ojqxhBaESLPLpo7jEOquOjA_oymeADAIQXS1vpOaPFyhJ0GbbLT8OQ==

GET
H3 200 f7703ba75034eab2c1c00bad055fab28.js Show response
nexus.ensighten.com/citi/na_prod/code/ 9 KB
1 KB 18ms
18ms Script
application/javascript 2600:9000:206f:5200:2:8f43:5780:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://nexus.ensighten.com/citi/na_prod/code/f7703ba75034eab2c1c00bad055fab28.js?conditionId0=4882778&conditionId1=4882777&conditionId2=1107477&conditionId3=1107478&conditionId4=1020470&conditionId5=1020469&conditionId6=1020468&conditionId7=1020467
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2600:9000:206f:5200:2:8f43:5780:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: CloudFront /
Resource Hash: f86a1d93a04fa97faf2232a6dfdb05cbc2a6074eeb3812a24a1d2b28c21a9967

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.citicards.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 27 Mar 2023 05:33:40 GMT
x-amz-version-id: YMt_YlCSchbc2Va_AejXpMux8JQmxhc9
content-encoding: br
via: 1.1 4874e0c922f34c928345f4c183ea11b4.cloudfront.net (CloudFront)
age: 17685593
x-amz-cf-pop: FRA56-C1
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
alt-svc: h3=":443"; ma=86400
last-modified: Tue, 20 Jul 2021 20:01:13 GMT
server: CloudFront
etag: W/"cdaa580da09264bfb47218afbfe279cf"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
cache-control: max-age=315360000
x-amz-cf-id: MuDwDcyph5nk97pcn1bCfxbqWr9qQ0D6AiQT_A_d7aKC9WsicBb9kw==

GET
H3 200 c65a3609e1beed72955b88afac8cd31d.js Show response
nexus.ensighten.com/citi/na_prod/code/ 2 KB
1 KB 13ms
13ms Script
application/javascript 2600:9000:206f:5200:2:8f43:5780:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://nexus.ensighten.com/citi/na_prod/code/c65a3609e1beed72955b88afac8cd31d.js?conditionId0=480881
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2600:9000:206f:5200:2:8f43:5780:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: CloudFront /
Resource Hash: 686eb5d7c927dd741ef72adda5c719b478d36f1e29520ee16d5121854c174b10

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.citicards.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Sun, 08 Oct 2023 08:14:56 GMT
x-amz-version-id: wXRQEmBG4QJsg2TZDdHUFOaVLJIZHKhf
content-encoding: br
via: 1.1 4874e0c922f34c928345f4c183ea11b4.cloudfront.net (CloudFront)
age: 827917
x-amz-cf-pop: FRA56-C1
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
alt-svc: h3=":443"; ma=86400
last-modified: Thu, 15 Dec 2022 04:55:25 GMT
server: CloudFront
etag: W/"e9bda8e342fda2a02ffa59c9064942d8"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
cache-control: max-age=315360000
x-amz-cf-id: WqiCa2V5XQRuX6fRL3oWmBzed3RsAHrN6xtg5c2PG0wMvE4QF8fVqw==

GET
H3 200 01af778b9dd93145b3e1400485968163.js Show response
nexus.ensighten.com/citi/na_prod/code/ 458 B
878 B 22ms
22ms Script
application/javascript 2600:9000:206f:5200:2:8f43:5780:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://nexus.ensighten.com/citi/na_prod/code/01af778b9dd93145b3e1400485968163.js?conditionId0=4865244
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2600:9000:206f:5200:2:8f43:5780:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: CloudFront /
Resource Hash: dc1904a557b3b1f7d001adb461950fa564369fd7f0929e270a44c784f8ce7816

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.citicards.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Fri, 07 Apr 2023 12:27:57 GMT
x-amz-version-id: tC.9fC5Xg68KrLhTZdD1k59iatPnPRjr
via: 1.1 4874e0c922f34c928345f4c183ea11b4.cloudfront.net (CloudFront)
age: 16710336
x-amz-cf-pop: FRA56-C1
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
alt-svc: h3=":443"; ma=86400
content-length: 458
last-modified: Tue, 20 Jul 2021 20:01:07 GMT
server: CloudFront
etag: "29438dfb0f2d2209063c90d3b8f18b5e"
content-type: application/javascript; charset=utf-8
cache-control: max-age=315360000
accept-ranges: bytes
x-amz-cf-id: Dvzx1Qmc5X-D4Py9pWG3_5TKKr19DwbKCdVRy4fElJM-QiMj38SMrQ==

GET
H3 200 8def02dd8a3b6db13bd63519e5d87107.js Show response
nexus.ensighten.com/citi/na_prod/code/ 9 KB
2 KB 17ms
17ms Script
application/javascript 2600:9000:206f:5200:2:8f43:5780:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://nexus.ensighten.com/citi/na_prod/code/8def02dd8a3b6db13bd63519e5d87107.js?conditionId0=4841049&conditionId1=4841043&conditionId2=4841044&conditionId3=4841046
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2600:9000:206f:5200:2:8f43:5780:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: CloudFront /
Resource Hash: 9cae06504ac6c7b45130682051604184176eb69a6ac6b8df8012c9e93d727c6f

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.citicards.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Wed, 05 Apr 2023 14:04:25 GMT
x-amz-version-id: tuz3wQWRvz2tuFpZ3YUirB3_UQolaww1
content-encoding: br
via: 1.1 4874e0c922f34c928345f4c183ea11b4.cloudfront.net (CloudFront)
age: 16877348
x-amz-cf-pop: FRA56-C1
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
alt-svc: h3=":443"; ma=86400
last-modified: Wed, 05 Apr 2023 13:55:27 GMT
server: CloudFront
etag: W/"d4a1e34b06f3bf2b61d63ba7dcde64d5"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
cache-control: max-age=315360000
x-amz-cf-id: LOyJ5bDGj1ScYTCvQmV8X3G8PeFPU3k7Wuf1ziZsSAMdxkisYxbNyg==

GET
H3 200 ed1402be273b009ede9d5b85a1a57eb1.js Show response
nexus.ensighten.com/citi/na_prod/code/ 5 KB
2 KB 18ms
18ms Script
application/javascript 2600:9000:206f:5200:2:8f43:5780:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://nexus.ensighten.com/citi/na_prod/code/ed1402be273b009ede9d5b85a1a57eb1.js?conditionId0=455826
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2600:9000:206f:5200:2:8f43:5780:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: CloudFront /
Resource Hash: c0d74e213f200a34ebdee4be1dc1ba5ec9f08090a0de5db6fdd20f20e9012e96

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.citicards.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Sun, 26 Mar 2023 00:24:28 GMT
x-amz-version-id: D8Nb7mq2.QOrVbqVWMigmh_40iwhcaI8
content-encoding: gzip
via: 1.1 4874e0c922f34c928345f4c183ea11b4.cloudfront.net (CloudFront)
age: 17790545
x-amz-cf-pop: FRA56-C1
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
alt-svc: h3=":443"; ma=86400
last-modified: Tue, 26 Apr 2022 17:54:58 GMT
server: CloudFront
etag: W/"3f4ddceaccf28d9c2fe467dff3a7d431"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
cache-control: max-age=315360000
x-amz-cf-id: a45cE85YZzK0lxBPutrDRsVwKwA1lNJqeMER2ia6G7k42a5vYnuO1g==

GET
H3 200 a57ebd078211b168099968ee097aa992.js Show response
nexus.ensighten.com/citi/na_prod/code/ 430 KB
48 KB 15ms
14ms Script
application/javascript 2600:9000:206f:5200:2:8f43:5780:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://nexus.ensighten.com/citi/na_prod/code/a57ebd078211b168099968ee097aa992.js?conditionId0=421908
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2600:9000:206f:5200:2:8f43:5780:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: CloudFront /
Resource Hash: 9316cfe82231e58622ce9789f58a4d41b83a59cd9428b78bd57d24cb798c6868

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.citicards.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Tue, 17 Oct 2023 20:10:32 GMT
x-amz-version-id: 3mY.BhmAzSKoKYDnqkmUC2jsuZCZabgr
content-encoding: br
via: 1.1 4874e0c922f34c928345f4c183ea11b4.cloudfront.net (CloudFront)
age: 7381
x-amz-cf-pop: FRA56-C1
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: PENDING
alt-svc: h3=":443"; ma=86400
last-modified: Tue, 17 Oct 2023 20:10:28 GMT
server: CloudFront
etag: W/"fafca08cb44200454833d03b702b3e48"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
cache-control: max-age=315360000
x-amz-cf-id: K20mipEtKI-kz8LnF7oqiPr50ECqalhuKUarOu-Ww_vxRgRoo8IndQ==

GET
H3 200 93bd1173e004c5f14c8c312774a177d6.js Show response
nexus.ensighten.com/citi/na_prod/code/ 1 KB
1 KB 19ms
18ms Script
application/javascript 2600:9000:206f:5200:2:8f43:5780:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://nexus.ensighten.com/citi/na_prod/code/93bd1173e004c5f14c8c312774a177d6.js?conditionId0=4936631
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2600:9000:206f:5200:2:8f43:5780:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: CloudFront /
Resource Hash: 07f6baeb3a16d7474a408bd4f6ae6bfe8c2538c41ba342f2431ddc64264b4fcf

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.citicards.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 03 Apr 2023 08:29:34 GMT
x-amz-version-id: nLZ6xTlu1iMFXeMTTYN4VPX3Tv1cDtk4
content-encoding: gzip
via: 1.1 4874e0c922f34c928345f4c183ea11b4.cloudfront.net (CloudFront)
age: 17070239
x-amz-cf-pop: FRA56-C1
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
alt-svc: h3=":443"; ma=86400
last-modified: Tue, 04 Oct 2022 17:38:26 GMT
server: CloudFront
etag: W/"1a018458600589c4b560bd7be94993f2"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
cache-control: max-age=315360000
x-amz-cf-id: pn9mV-8i2Z17Y05PXJNypn6CYoih0XgK0lUxgFu1gS6pZ4UkOFEspA==

GET
H3 200 c84bfae799c0b57bca195a4cf6587c71.js Show response
nexus.ensighten.com/citi/na_prod/code/ 11 KB
2 KB 20ms
20ms Script
application/javascript 2600:9000:206f:5200:2:8f43:5780:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://nexus.ensighten.com/citi/na_prod/code/c84bfae799c0b57bca195a4cf6587c71.js?conditionId0=482202&conditionId1=4916548
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2600:9000:206f:5200:2:8f43:5780:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: CloudFront /
Resource Hash: e93ef9435bd70e93fecb217810f4d755f9835e356758aab3b03ba77631ba7007

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.citicards.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Thu, 14 Sep 2023 01:45:29 GMT
x-amz-version-id: TG9jrdmaRLUigiwNd82fu.QxQjCNaqas
content-encoding: gzip
via: 1.1 4874e0c922f34c928345f4c183ea11b4.cloudfront.net (CloudFront)
age: 2924884
x-amz-cf-pop: FRA56-C1
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
alt-svc: h3=":443"; ma=86400
last-modified: Mon, 01 May 2023 19:21:07 GMT
server: CloudFront
etag: W/"4266c382d1792149a0f08ab7397808ba"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
cache-control: max-age=315360000
x-amz-cf-id: kChOTk27GpVaqaKI_GyMSM_tUu6a-cmkITAzLnQjGNzUozoxF1_7ew==

GET
H3 200 a9607bbeb2e6e06c07801d4745900799.js Show response
nexus.ensighten.com/citi/na_prod/code/ 23 KB
5 KB 23ms
23ms Script
application/javascript 2600:9000:206f:5200:2:8f43:5780:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://nexus.ensighten.com/citi/na_prod/code/a9607bbeb2e6e06c07801d4745900799.js?conditionId0=486757
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2600:9000:206f:5200:2:8f43:5780:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: CloudFront /
Resource Hash: 3556b4fa28a41290454dc84939dae439fcf5bda8a1eac70efdf2647bf041d43d

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.citicards.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Tue, 19 Sep 2023 17:48:34 GMT
x-amz-version-id: TUtp2N9e.3Mq3kFsEinWRYvNz9Zemh3C
content-encoding: gzip
via: 1.1 4874e0c922f34c928345f4c183ea11b4.cloudfront.net (CloudFront)
age: 2435099
x-amz-cf-pop: FRA56-C1
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
alt-svc: h3=":443"; ma=86400
last-modified: Tue, 19 Sep 2023 17:48:03 GMT
server: CloudFront
etag: W/"e4e9e801aca9bba5a66c95552720097c"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
cache-control: max-age=315360000
x-amz-cf-id: ydRjmxggQkIn7a9Bup15qeLvML1i_KshZNFkO5rCTB6MX9DjkwOQfg==

GET
H3 200 d997882df0e32a80fe28788646916b9d.js Show response
nexus.ensighten.com/citi/na_prod/code/ 3 KB
1 KB 21ms
20ms Script
application/javascript 2600:9000:206f:5200:2:8f43:5780:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://nexus.ensighten.com/citi/na_prod/code/d997882df0e32a80fe28788646916b9d.js?conditionId0=406476
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2600:9000:206f:5200:2:8f43:5780:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: CloudFront /
Resource Hash: 931b268362de44bae26ba2eedbaa2fb3989d722b4dcc3640a245832dd62af348

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.citicards.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 24 Jul 2023 15:02:15 GMT
x-amz-version-id: UevIu8RaVcGmfq8whfRCjho6tK6njoFG
content-encoding: br
via: 1.1 4874e0c922f34c928345f4c183ea11b4.cloudfront.net (CloudFront)
age: 7369878
x-amz-cf-pop: FRA56-C1
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
alt-svc: h3=":443"; ma=86400
last-modified: Mon, 01 May 2023 19:21:07 GMT
server: CloudFront
etag: W/"c347319070118b5c9c52559fb8408256"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
cache-control: max-age=315360000
x-amz-cf-id: qQBYIIClPfs9AnulO-2NwqnXFcMp6tiPe3BSdQe-BnkjVyTveP35ow==

GET
H3 200 a8611a80011ea1c4eb3e73e3997545c4.js Show response
nexus.ensighten.com/citi/na_prod/code/ 12 KB
2 KB 21ms
21ms Script
application/javascript 2600:9000:206f:5200:2:8f43:5780:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://nexus.ensighten.com/citi/na_prod/code/a8611a80011ea1c4eb3e73e3997545c4.js?conditionId0=4876315&conditionId1=4876313&conditionId2=4876316&conditionId3=4903730
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2600:9000:206f:5200:2:8f43:5780:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: CloudFront /
Resource Hash: 1a5121904c4ec7014f2ceba1cdc7c1d3cab284c975cc72f84d15cd7f8af7b84a

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.citicards.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Tue, 19 Sep 2023 17:34:56 GMT
x-amz-version-id: SciWOfBaiN.vtpgZ8lWdhLx4H5c.551z
content-encoding: br
via: 1.1 4874e0c922f34c928345f4c183ea11b4.cloudfront.net (CloudFront)
age: 2435917
x-amz-cf-pop: FRA56-C1
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
alt-svc: h3=":443"; ma=86400
last-modified: Tue, 19 Sep 2023 17:26:28 GMT
server: CloudFront
etag: W/"3c1388fd8c530225e7275aa071fddd32"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
cache-control: max-age=315360000
x-amz-cf-id: jhyvEqTqF7MtNSu_2wIICLnvIl9xaUi1Qhad9una0dvcapTXUyneGA==

GET
H3 200 f120449dcdb84c3b6d0f58c8b98ad8a3.js Show response
nexus.ensighten.com/citi/na_prod/code/ 24 KB
7 KB 20ms
20ms Script
application/javascript 2600:9000:206f:5200:2:8f43:5780:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://nexus.ensighten.com/citi/na_prod/code/f120449dcdb84c3b6d0f58c8b98ad8a3.js?conditionId0=467299
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2600:9000:206f:5200:2:8f43:5780:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: CloudFront /
Resource Hash: bf39c7a23da56a09d7fba494ab7a46604dc02a19fabfaf8d4c3ab6629aad0692

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.citicards.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Tue, 19 Sep 2023 17:49:53 GMT
x-amz-version-id: nWKpv6NjQeNKdUj5cLa_yhYRraA7P2n3
content-encoding: gzip
via: 1.1 4874e0c922f34c928345f4c183ea11b4.cloudfront.net (CloudFront)
age: 2435020
x-amz-cf-pop: FRA56-C1
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
alt-svc: h3=":443"; ma=86400
last-modified: Tue, 19 Sep 2023 17:48:03 GMT
server: CloudFront
etag: W/"79a1f615128893a73faf5e48cfd01107"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
cache-control: max-age=315360000
x-amz-cf-id: 7W55vY7K2z38QE2mIeCHt9_HZYTydaUY2M6GpO0qUcWbqh1pQo7yxg==

GET
H3 200 315a9e7aa40a670df12a4e558bc631a9.js Show response
nexus.ensighten.com/citi/na_prod/code/ 3 KB
2 KB 22ms
21ms Script
application/javascript 2600:9000:206f:5200:2:8f43:5780:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://nexus.ensighten.com/citi/na_prod/code/315a9e7aa40a670df12a4e558bc631a9.js?conditionId0=4876314
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2600:9000:206f:5200:2:8f43:5780:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: CloudFront /
Resource Hash: 6121c34648c249cd479d04ed1ceef908485bd13c4fad3279645a422baec4f00a

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.citicards.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Sun, 13 Aug 2023 15:29:53 GMT
x-amz-version-id: auISUFGNgUmX0TU2fb6byAzRLpeHDYoK
content-encoding: gzip
via: 1.1 4874e0c922f34c928345f4c183ea11b4.cloudfront.net (CloudFront)
age: 5640220
x-amz-cf-pop: FRA56-C1
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
alt-svc: h3=":443"; ma=86400
last-modified: Tue, 25 Apr 2023 18:40:56 GMT
server: CloudFront
etag: W/"b2bd52f3f4cfe98b36074248e3322d04"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
cache-control: max-age=315360000
x-amz-cf-id: jAFf40SCyb5GjXhlBZ5m-Slyb-co9Ux8VvhdglhjURU_Oj-X10pvcQ==

GET
H3 200 6a7c0145ffab08f149ce0eafac0d1f9d.js Show response
nexus.ensighten.com/citi/na_prod/code/ 19 KB
2 KB 22ms
22ms Script
application/javascript 2600:9000:206f:5200:2:8f43:5780:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://nexus.ensighten.com/citi/na_prod/code/6a7c0145ffab08f149ce0eafac0d1f9d.js?conditionId0=1407237&conditionId1=1407332&conditionId2=1407236&conditionId3=1407239&conditionId4=1407329&conditionId5=1407234&conditionId6=1407330&conditionId7=1407327&conditionId8=1407320
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2600:9000:206f:5200:2:8f43:5780:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: CloudFront /
Resource Hash: 6bbbb8d1dba813c63e9f73954b5366dd9e340f164b4e9338b31bd9f457877bad

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.citicards.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Tue, 19 Sep 2023 17:34:56 GMT
x-amz-version-id: i29kYG7.7zFEgC9R6OgFpOyWlLl4ARo0
content-encoding: br
via: 1.1 4874e0c922f34c928345f4c183ea11b4.cloudfront.net (CloudFront)
age: 2435917
x-amz-cf-pop: FRA56-C1
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
alt-svc: h3=":443"; ma=86400
last-modified: Tue, 19 Sep 2023 17:26:28 GMT
server: CloudFront
etag: W/"49afbd0007e51113d51225823d42c69f"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
cache-control: max-age=315360000
x-amz-cf-id: WAXZ9kR8C_IkkDnLxtWrlrdUcsNY7wN9Z3FY1oVBNGfWHDbxDj3cSA==

GET
H3 200 fab44b129f571db9a05f63a715aec788.js Show response
nexus.ensighten.com/citi/na_prod/code/ 6 KB
2 KB 20ms
20ms Script
application/javascript 2600:9000:206f:5200:2:8f43:5780:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://nexus.ensighten.com/citi/na_prod/code/fab44b129f571db9a05f63a715aec788.js?conditionId0=458636
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2600:9000:206f:5200:2:8f43:5780:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: CloudFront /
Resource Hash: e62ab53cdd0da4275a539b12b7e8c720040b2ce44f8173ef27fa207778da2769

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.citicards.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Tue, 25 Apr 2023 18:44:55 GMT
x-amz-version-id: 29pIpvJJqYm6LTkEs2.qc9n1obYQWFzr
content-encoding: br
via: 1.1 4874e0c922f34c928345f4c183ea11b4.cloudfront.net (CloudFront)
age: 15132518
x-amz-cf-pop: FRA56-C1
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: PENDING
alt-svc: h3=":443"; ma=86400
last-modified: Tue, 25 Apr 2023 18:40:56 GMT
server: CloudFront
etag: W/"eca92caed2abc7bc063ceb4e84e0cf38"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
cache-control: max-age=315360000
x-amz-cf-id: ZHg2nDNYLcu7EMR_X9CHLmUuBgh0zG9vuG3odWQeFDE1U10nbtmUtw==

GET
H3 200 501175129083d695b433d40e43dcf4dd.js Show response
nexus.ensighten.com/citi/na_prod/code/ 1 KB
972 B 20ms
20ms Script
application/javascript 2600:9000:206f:5200:2:8f43:5780:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://nexus.ensighten.com/citi/na_prod/code/501175129083d695b433d40e43dcf4dd.js?conditionId0=4951300
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2600:9000:206f:5200:2:8f43:5780:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: CloudFront /
Resource Hash: 7337d0aa06e2a7d2555a60936c9243f8f93c24dcd64e064d0181e6790294607b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.citicards.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Tue, 25 Jul 2023 19:28:04 GMT
x-amz-version-id: LXNmF0WWctVwrG36aJ.jkMTI8bp3KIhL
content-encoding: br
via: 1.1 4874e0c922f34c928345f4c183ea11b4.cloudfront.net (CloudFront)
age: 7267529
x-amz-cf-pop: FRA56-C1
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: PENDING
alt-svc: h3=":443"; ma=86400
last-modified: Tue, 25 Jul 2023 19:27:55 GMT
server: CloudFront
etag: W/"4355ffb7776a87cb3f6308e895da7ddd"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
cache-control: max-age=315360000
x-amz-cf-id: rYzx4QDGlgZb_iGwmlq_bFYSiBHaFEC0qAU3uxYSyDBP6XOvIhVtHA==

GET
H3 200 e6b9fe1f920efcc9ea8e7e604b897c8c.js Show response
nexus.ensighten.com/citi/na_prod/code/ 321 B
737 B 23ms
23ms Script
application/javascript 2600:9000:206f:5200:2:8f43:5780:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://nexus.ensighten.com/citi/na_prod/code/e6b9fe1f920efcc9ea8e7e604b897c8c.js?conditionId0=3013337
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2600:9000:206f:5200:2:8f43:5780:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: CloudFront /
Resource Hash: 1c34a537ea8a62cb24c782a11aaf49c1cbd671e5d264d81c6732e2338e05d2af

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.citicards.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Tue, 10 Oct 2023 18:47:03 GMT
x-amz-version-id: vaBGtucfcpfHvM_CMxnO.fJKgerOHEtE
via: 1.1 4874e0c922f34c928345f4c183ea11b4.cloudfront.net (CloudFront)
age: 617190
x-amz-cf-pop: FRA56-C1
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
alt-svc: h3=":443"; ma=86400
content-length: 321
last-modified: Thu, 03 Aug 2023 21:05:53 GMT
server: CloudFront
etag: "31ca559990bbe8a9a1b2319b45c0f49b"
content-type: application/javascript; charset=utf-8
cache-control: max-age=315360000
accept-ranges: bytes
x-amz-cf-id: IaOtj12BWqoNlqzzOktPXPVEe0LEWuI-9A1cD9aiJuCY6XGnvygykw==

GET
H3 200 69ed6737f81b72d2598e9bf18025e421.js Show response
nexus.ensighten.com/citi/na_prod/code/ 2 KB
1 KB 23ms
23ms Script
application/javascript 2600:9000:206f:5200:2:8f43:5780:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://nexus.ensighten.com/citi/na_prod/code/69ed6737f81b72d2598e9bf18025e421.js?conditionId0=454787
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2600:9000:206f:5200:2:8f43:5780:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: CloudFront /
Resource Hash: 5859379607421976dccddd67c3bb7e8c7159d28bf1ff3eb9553a52ca3300117b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.citicards.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Mon, 01 May 2023 19:22:56 GMT
x-amz-version-id: 71wamSEf3OhQ0q6nNYk0bDe3jeNQFNc7
content-encoding: br
via: 1.1 4874e0c922f34c928345f4c183ea11b4.cloudfront.net (CloudFront)
age: 14611837
x-amz-cf-pop: FRA56-C1
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: PENDING
alt-svc: h3=":443"; ma=86400
last-modified: Mon, 01 May 2023 19:21:07 GMT
server: CloudFront
etag: W/"3a5717f0f8c11166ab88cd751f8fde5f"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
cache-control: max-age=315360000
x-amz-cf-id: 4Fqr6Wt6aNDyvnjMd8s0FYQ4_DJH4tbdSJc5a8XBKvyzVrmWF4dcAg==

GET
H3 200 0b0875d0bc07c1e18a56023523b2283c.js Show response
nexus.ensighten.com/citi/na_prod/code/ 70 KB
3 KB 24ms
23ms Script
application/javascript 2600:9000:206f:5200:2:8f43:5780:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://nexus.ensighten.com/citi/na_prod/code/0b0875d0bc07c1e18a56023523b2283c.js?conditionId0=486679&conditionId1=486678&conditionId2=486677&conditionId3=486612&conditionId4=486622&conditionId5=486621&conditionId6=486620&conditionId7=486682&conditionId8=486681&conditionId9=486680&conditionId10=486695&conditionId11=486694&conditionId12=486691&conditionId13=486627&conditionId14=486626&conditionId15=486690&conditionId16=486624&conditionId17=486703&conditionId18=486701&conditionId19=486700&conditionId20=486699&conditionId21=486697&conditionId22=486696&conditionId23=486707&conditionId24=486706&conditionId25=486705&conditionId26=486704&conditionId27=486712
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2600:9000:206f:5200:2:8f43:5780:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: CloudFront /
Resource Hash: 0dc7d9b25888b998417847cf1f6fbb25aa87d566ad11fda81e001b70127049de

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.citicards.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Tue, 19 Sep 2023 17:35:17 GMT
x-amz-version-id: 5f4vrSZ3Xkuc_Vi9usQMk4QhWxc_ayCf
content-encoding: br
via: 1.1 4874e0c922f34c928345f4c183ea11b4.cloudfront.net (CloudFront)
age: 2435896
x-amz-cf-pop: FRA56-C1
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
alt-svc: h3=":443"; ma=86400
last-modified: Tue, 19 Sep 2023 17:26:28 GMT
server: CloudFront
etag: W/"925d8eaf62ed5b93a38ddb4113d7311b"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
cache-control: max-age=315360000
x-amz-cf-id: r_02Lgzc9q0XuArAKPer5PTjjhU0IxEtcTMS-Jis1NVofQuxu4AHiw==

GET
H3 200 f79ae745264b43f3faaab87bf3cdb75b.js Show response
nexus.ensighten.com/citi/na_prod/code/ 3 KB
1 KB 23ms
23ms Script
application/javascript 2600:9000:206f:5200:2:8f43:5780:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://nexus.ensighten.com/citi/na_prod/code/f79ae745264b43f3faaab87bf3cdb75b.js?conditionId0=455897
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2600:9000:206f:5200:2:8f43:5780:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: CloudFront /
Resource Hash: 40cefd284724286ec23670e16cc7b354c2cee0527edda1ae49eea62b8301bff4

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.citicards.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Wed, 27 Sep 2023 04:00:41 GMT
x-amz-version-id: 8CcfzS7DteGxKg7ZkR_HfOT6Gn8m3nM1
content-encoding: br
via: 1.1 4874e0c922f34c928345f4c183ea11b4.cloudfront.net (CloudFront)
age: 1793572
x-amz-cf-pop: FRA56-C1
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
x-amz-replication-status: COMPLETED
alt-svc: h3=":443"; ma=86400
last-modified: Tue, 21 Mar 2023 17:54:28 GMT
server: CloudFront
etag: W/"e2e34f527a64b278bef126c9ab6f0955"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
cache-control: max-age=315360000
x-amz-cf-id: jFynTX6M_vWTXmQ3uMKEBUXGJP2FSgqSzSKlottVmHqd0OvuZQWpbw==

GET
H/1.1 200
OK citi_app_sprite.svg
www.citicards.com/cards/wv/welcome/img/ 4 KB
2 KB 156ms
150ms Image
image/svg+xml 23.212.222.131
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.citicards.com/cards/wv/welcome/img/citi_app_sprite.svg
Requested by: Host: www.citicards.com
URL: https://www.citicards.com/cards/wv/welcome/css/newWelcome.min.css
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.212.222.131 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-212-222-131.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: fa2d499915cc9d27d3ed17f446d25a0fe5068ef7623e03f7ff274ca5cc20650b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.citicards.com/cards/wv/welcome/css/newWelcome.min.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

Date: Tue, 17 Oct 2023 22:13:32 GMT
Content-Encoding: gzip
Last-Modified: Mon, 19 Sep 2016 21:17:18 GMT
X-Akamai-CITISITE: GTDC
Vary: Accept-Encoding
Content-Type: image/svg+xml
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 1904

GET
H/1.1 200
OK dest5.html Show response
citi.demdex.net/ Frame 861D 7 KB
3 KB 167ms
32ms Document
text/html 34.254.109.178
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://citi.demdex.net/dest5.html?d_nsid=0

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

34.254.109.178 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-34-254-109-178.eu-west-1.compute.amazonaws.com

Software

Resource Hash

7bea17a80a61ed0f54248b4ffc4c718f7c8ff2619742577a73591d62ce074da8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://www.citicards.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Accept-Ranges: bytes
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection: keep-alive
Content-Type: text/html;charset=UTF-8
DCS: dcscanary-prod-irl1-1-v065-0e7de41d2.edge-irl1.demdex.com 0 ms
Expires: Thu, 01 Jan 1970 00:00:00 UTC
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-TID: oKKz+d2HTFQ=
content-encoding: gzip
date: Tue, 17 Oct 2023 22:13:32 GMT
last-modified: Mon, 9 Oct 2023 08:31:34 GMT
transfer-encoding: chunked
vary: accept-encoding

GET
H2 200 id Show response
metrics1.citi.com/ 48 B
462 B 86ms
22ms XHR
application/x-javascript 63.140.62.164
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://metrics1.citi.com/id?d_visid_ver=4.4.0&d_fieldgroup=A&mcorgid=61834D9B5228A7430A490D45%40AdobeOrg&mid=69215849224077639103647927382042708913&ts=1697580812651

Requested by

Host: www.citicards.com
URL: https://www.citicards.com/assets/scripts/global/6c8322c7341eac98645c10e3d1d3c7ae.js?seed=AAAjpz-LAQAAFC_bMRxQoajWvZoUseb7-9M_13CDQMMWDa5kNV3LRXPZ6k5d&X-soz9htCz--z=q

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

63.140.62.164 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ip-63-140-62-164.data.adobedc.net

Software

jag /

Resource Hash

13aeb21aad8ff255db3a2b8545cf1d271b30d049fd496f0276e2a8482a3bf40e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.citicards.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

date: Tue, 17 Oct 2023 22:13:32 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
server: jag
vary: Origin
content-type: application/x-javascript;charset=utf-8
access-control-allow-origin: https://www.citicards.com
p3p: CP="This is not a P3P policy"
cache-control: no-cache, no-store, max-age=0, no-transform, private
access-control-allow-credentials: true
content-length: 48
x-xss-protection: 1; mode=block

GET
H/1.1

200
OK

ibs:dpid=411&dpuuid=ZS8HDAAAAFddJQOJ
dpm.demdex.net/
Redirect Chain

https://cm.everesttech.net/cm/dd?d_uuid=76150096283887386614252401464242713106
https://dpm.demdex.net/ibs:dpid=411&dpuuid=ZS8HDAAAAFddJQOJ

42 B
942 B

35ms
35ms

Image
image/gif

34.251.64.143
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dpm.demdex.net/ibs:dpid=411&dpuuid=ZS8HDAAAAFddJQOJ

Requested by

Host: www.citicards.com
URL: https://www.citicards.com/cards/credit/application/flow.action?app=UNSOL&ID=3001&HKOP=2de94b05869e4857c38ba3a5df71418d5ccbea5e43605c020c419744dbe79b6c

Protocol

HTTP/1.1

Server

34.251.64.143 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-34-251-64-143.eu-west-1.compute.amazonaws.com

Software

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.citicards.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

DCS: dcs-prod-irl1-2-v052-090d39cdd.edge-irl1.demdex.com 2 ms
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
content-encoding: gzip
X-Content-Type-Options: nosniff
X-TID: Y5cyoulfQVI=
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Content-Type: image/gif
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection: keep-alive
Content-Length: 59
Expires: Thu, 01 Jan 1970 00:00:00 UTC

Redirect headers

Location: https://dpm.demdex.net/ibs:dpid=411&dpuuid=ZS8HDAAAAFddJQOJ
Date: Tue, 17 Oct 2023 22:13:32 GMT
Cache-Control: no-cache
Server: AMO-cookiemap/1.1
Connection: keep-alive
Content-Length: 0
P3P: CP="NOI NID DEVa PSAa PSDa OUR IND PUR COM NAV INT DEM"

GET
H2 204 r.rnc
data.privacy.ensighten.com/privacy/v1/b/ 0
107 B 57ms
8ms Image
text/plain 3.124.173.63
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://data.privacy.ensighten.com/privacy/v1/b/r.rnc?n=0&c=1129&i=5gxb4r&p=na_prod&s=354&d=8HB7InZlcnNpb24iOiIxLjAuMCIsImdhdGV3YXkiOiIyLjMuNjExIiwiY2xpZW50SWQiOjExMjksInB1Ymxpc2hQYXRoIjoibmFfcHJvZCIsImluc3RhbmNlSWQiOiI1Z3hiNHIiLCJwYWNrZXQiOjAsIm1vZGUiOiJlbmZvcmNlWgDwCG9va2llcyI6eyJCQU5ORVJfTE9BREVEkQDyJyJ9LCJlbnZpcm9ubWVudCI6IkNCT0wgUHJpdmFjeSIsInJlcXVlc3RzIjpbeyJkZXN0aW5hdM4A8BkiLCJ0eXBlIjoiYmlsbGluZyIsInN0YXJ0IjoxNjk3NTgwODEyNjk3YgDAZCI6LTEsInNvdXJjMgACKwBhdHVzIjoiZgBAYXNvbmUA1F0sImRhdGFQYXR0ZXISALBsaXN0IjpbXSwiaSAB8AA2OTc1ODA4MTI2OTd9XX0
Requested by: Host: www.citicards.com
URL: https://www.citicards.com/cards/credit/application/flow.action?app=UNSOL&ID=3001&HKOP=2de94b05869e4857c38ba3a5df71418d5ccbea5e43605c020c419744dbe79b6c
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 3.124.173.63 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-124-173-63.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.citicards.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Tue, 17 Oct 2023 22:13:32 GMT
cache-control: no-cache, no-store
server: nginx
expires: Tue, 17 Oct 2023 22:13:31 GMT

GET
H2 204 r.rnc
data.privacy.ensighten.com/privacy/v1/c/ 0
106 B 50ms
9ms Image
text/plain 3.124.173.63
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://data.privacy.ensighten.com/privacy/v1/c/r.rnc?n=0&c=1129&i=8mlzzv&p=na_prod&s=381&d=9Cd7InZlcnNpb24iOiIxLjAuMCIsImdhdGV3YXkiOiIyLjMuNjExIiwiY2xpZW50SWQiOjExMjkQAPAaTmFtZSI6ImNpdGkiLCJwdWJsaXNoUGF0aCI6Im5hX3Byb2QiLCJtb2QmAJBibGFja2xpc3RPAPAfb29raWVzIjp7IkNJVElfRU5TSUdIVEVOX1BSSVZBQ1lfQkFOTkVSX0xPQURFRJ0A8Q8ifSwiZHQiOjE2OTc1ODA4MTI3MDUsInNldHRpbmdLAPEqbW9kYWwiOiJlbnRlcnByaXNlIiwiZW52aXJvbm1lbnQiOiJDQk9MIFByaXZhY3kiLCJkZWZhdWx0PgD0CFBlcmZvcm1hbmNlLUFuYWx5dGljcyBDqgD5CDEsIkVzc2VudGlhbC1GdW5jdGlvbmFsIQDwAkFkdmVydGlzaW5nLVRhcmdlmwAHIgDwAH19LCJldmVudHMiOltdfQ
Requested by: Host: www.citicards.com
URL: https://www.citicards.com/cards/credit/application/flow.action?app=UNSOL&ID=3001&HKOP=2de94b05869e4857c38ba3a5df71418d5ccbea5e43605c020c419744dbe79b6c
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 3.124.173.63 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-124-173-63.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.citicards.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Tue, 17 Oct 2023 22:13:32 GMT
cache-control: no-cache, no-store
server: nginx
expires: Tue, 17 Oct 2023 22:13:31 GMT

GET
H2 200 tagging.js Show response
online.citi.com/CBOL/taggingTransformation/ 79 KB
15 KB 97ms
41ms Script
application/x-javascript 184.31.87.130
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://online.citi.com/CBOL/taggingTransformation/tagging.js

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

184.31.87.130 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a184-31-87-130.deploy.static.akamaitechnologies.com

Software

Resource Hash

4c680597a16bbd662d9722ba3d2183a3b9c753afcb73025b94763908b588d1b0

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.citicards.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

expires: Wed, 18 Oct 2023 04:13:32 GMT
strict-transport-security: max-age=300
content-encoding: gzip
date: Tue, 17 Oct 2023 22:13:32 GMT
last-modified: Mon, 18 Sep 2023 21:14:58 GMT
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-akamai-citisite: GTDC
vary: Accept-Encoding
content-type: application/x-javascript
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
cache-control: max-age=21600
content-length: 14982
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net

GET
H2 200 js Show response
maps.googleapis.com/maps/api/ 191 KB
64 KB 105ms
59ms Script
text/javascript 2a00:1450:4001:80f::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://maps.googleapis.com/maps/api/js?key=AIzaSyCO_0VNhKn4OjlJ_p5rQ5uLKe4h7WAyY0c&libraries=places&language=gb

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

scaffolding on HTTPServer2 /

Resource Hash

2bfcc40557a1d63c2c5486c1cd7ab18fd1ad1a4cab88684606bae9288ac16459

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.citicards.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Tue, 17 Oct 2023 22:13:32 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: scaffolding on HTTPServer2
vary: Accept-Language, Origin, X-Origin, Referer
x-frame-options: SAMEORIGIN
content-type: text/javascript; charset=UTF-8
cache-control: public, max-age=1800
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 65587
x-xss-protection: 0

GET
H/1.1 200
OK tags.js Show response
content22.accountonline.com/fp/ 95 KB
13 KB 83ms
16ms Script
text/javascript 91.235.132.220
THM

General

Check archive.org

Show headers Download Go to

Full URL

https://content22.accountonline.com/fp/tags.js?org_id=89oebq5k&session_id=d73badfb6291512b9f1d43ffd18e1f8f2519636970c27cb58dfddf5166d9b69a&allow_reprofile=1

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

91.235.132.220 , United States, ASN30286 (THM, US),

Reverse DNS

Software

Apache /

Resource Hash

41bd89f24edd2547aa2764e91d6e42401cf5ff1e4c381ab7d5e444668047c296

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.citicards.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

Date: Tue, 17 Oct 2023 22:13:32 GMT
Strict-Transport-Security: max-age=31536000
X-Content-Type-Options: nosniff
Content-Encoding: gzip
Transfer-Encoding: chunked
P3P: CP=IVAa PSAa
Connection: Keep-Alive, Keep-Alive
X-XSS-Protection: 1; mode=block
Pragma: no-cache
Server: Apache
Vary: Accept-Encoding
Content-Type: text/javascript;charset=UTF-8
Cache-Control: no-cache, no-store, must-revalidate
X-Robots-Tag: noindex, nofollow
Keep-Alive: timeout=2, max=100
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H/1.1 200
OK flow.action Show response
www.citicards.com/cards/credit/displayterms/ 84 KB
18 KB 960ms
960ms XHR
text/html 23.212.222.131
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://www.citicards.com/cards/credit/displayterms/flow.action?HKOP=2de94b05869e4857c38ba3a5df71418d5ccbea5e43605c020c419744dbe79b6c&app=UNSOL&embedTNC=Y&JFP_TOKEN=BWJVO4FN

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

23.212.222.131 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-212-222-131.deploy.static.akamaitechnologies.com

Software

Resource Hash

f37b123c1b20f224d0e15060735b6d39e680331391bbf46ce1f17c5c3d55410e

Security Headers

Name	Value
Content-Security-Policy	Frame-Ancestors 'self' https://sit01.disputes.citi.com https://disputes.citi.com
X-Frame-Options	Allow-From https://sit01.disputes.citi.com https://disputes.citi.com

Request headers

Accept: text/html, */*; q=0.01
Referer: https://www.citicards.com/cards/credit/application/flow.action?app=UNSOL&ID=3001&HKOP=2de94b05869e4857c38ba3a5df71418d5ccbea5e43605c020c419744dbe79b6c
X-Requested-With: XMLHttpRequest
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

X-UA-Compatible: IE=Edge
Pragma: no-cache, no-store, must-revalidate, max-age=0, proxy-revalidate
Content-Security-Policy: Frame-Ancestors 'self' https://sit01.disputes.citi.com https://disputes.citi.com
Content-Encoding: gzip
Date: Tue, 17 Oct 2023 22:13:33 GMT
X-Akamai-CITISITE: GTDC
X-Frame-Options: Allow-From https://sit01.disputes.citi.com https://disputes.citi.com
Vary: Accept-Encoding
Content-Type: text/html;charset=ISO-8859-1
Content-Language: de-DE
Cache-Control: no-cache, private, no-store, max-stale=0, must-revalidate, max-age=0, proxy-revalidate, s-max-age=0
Connection: keep-alive
Content-Length: 17504
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H/1.1 404
Not Found Interstate-Light.woff
www.citicards.com/cards/wv/welcome/css/fonts/interstate/ 0
0 777ms
776ms Font
text/html 23.212.222.131
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://www.citicards.com/cards/wv/welcome/css/fonts/interstate/Interstate-Light.woff
Requested by: Host: www.citicards.com
URL: https://www.citicards.com/cards/wv/welcome/css/newWelcome.min.css
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.212.222.131 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-212-222-131.deploy.static.akamaitechnologies.com
Software: /
Resource Hash

Request headers

Referer: https://www.citicards.com/cards/wv/welcome/css/newWelcome.min.css
Origin: https://www.citicards.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

Date: Tue, 17 Oct 2023 22:13:33 GMT
Content-Encoding: gzip
Last-Modified: Sat, 26 Jun 2021 04:23:51 GMT
X-Akamai-CITISITE: SWDC
Vary: Accept-Encoding
Content-Type: text/html
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 1532

POST
H2 200 delivery Show response
citicorpcreditservic.tt.omtrdc.net/rest/v1/ 363 B
1 KB 139ms
46ms XHR
application/json 66.235.152.115
OMNITURE

General

Check archive.org

Show headers Download Go to

Full URL

https://citicorpcreditservic.tt.omtrdc.net/rest/v1/delivery?client=citicorpcreditservic&sessionId=8e2f973c439f4aabadc68ae86d34d01a&version=2.10.2

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

66.235.152.115 , United States, ASN15224 (OMNITURE, US),

Reverse DNS

ip-66-235-152-115.data.adobedc.net

Software

jag /

Resource Hash

85df0b6b78a2ab418938a2078c18e64cdb2bb3e5551d6ab5aa296207e669fe58

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.citicards.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36
Content-Type: text/plain

Response headers

date: Tue, 17 Oct 2023 22:13:32 GMT
content-encoding: gzip
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains
p3p: CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
x-xss-protection: 1; mode=block
x-request-id: ff447c07-49f4-4019-a013-76e2efd88c9b
referrer-policy: strict-origin-when-cross-origin
accept-ch: Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version-List
server: jag
vary: origin,access-control-request-method,access-control-request-headers,accept-encoding
content-type: application/json;charset=UTF-8
access-control-allow-origin: https://www.citicards.com
cache-control: no-cache, no-store, max-age=0, no-transform, private
access-control-allow-credentials: true
timing-allow-origin: *

GET
H3 204 perf.rnc
nexus.ensighten.com/citi/na_prod/ 0
218 B 10ms
9ms Image
text/plain 2600:9000:206f:5200:2:8f43:5780:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://nexus.ensighten.com/citi/na_prod/perf.rnc?cid=1129&ns=1697580807197&ce=863&cs=841&dc=0&dclee=5609&dcles=5497&di=5496&dl=2747&dle=841&dls=841&fs=777&lee=0&les=0&rede=0&reds=0&reqs=863&resps=2744&respe=2751&scs=847&ues=0&uee=0
Requested by: Host: www.citicards.com
URL: https://www.citicards.com/cards/credit/application/flow.action?app=UNSOL&ID=3001&HKOP=2de94b05869e4857c38ba3a5df71418d5ccbea5e43605c020c419744dbe79b6c
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2600:9000:206f:5200:2:8f43:5780:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: CloudFront /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.citicards.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Tue, 17 Oct 2023 09:37:05 GMT
via: 1.1 4874e0c922f34c928345f4c183ea11b4.cloudfront.net (CloudFront)
server: CloudFront
age: 45387
x-amz-cf-pop: FRA56-C1
x-cache: Hit from cloudfront
cache-control: no-cache, no-store
alt-svc: h3=":443"; ma=86400
x-amz-cf-id: NTDPhaKz08Mxti0xfs8eGYKxxTRJAdjksCD5sfqCw1MWqtxxSx-EHA==

GET
H2 200 tc.min.js Show response
c1.rfihub.net/js/ 19 KB
6 KB 148ms
40ms Script
application/x-javascript 2600:9000:2127:8800:1:76cf:fe80:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c1.rfihub.net/js/tc.min.js
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2127:8800:1:76cf:fe80:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: Jetty(9.4.51.v20230217) /
Resource Hash: 7ef97b12890fc6fee67f869c6e1f74b6719de7d66ac0d649c8d7386a80b4c30f

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.citicards.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Tue, 17 Oct 2023 21:36:57 GMT
content-encoding: br
via: 1.1 017ac0aeeb057314a9b1c06f8b97ba34.cloudfront.net (CloudFront)
last-modified: Tue, 17 Oct 2023 11:27:10 GMT
server: Jetty(9.4.51.v20230217)
x-amz-cf-pop: PRG50-C1
age: 2911
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/x-javascript
p3p: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
cache-control: public, max-age=3600
x-amz-cf-id: GArIoUwzrMC0KRD590V8od95wHIia2-nKELZQ9EAVuCx1bojobSQUA==
expires: Tue, 17 Oct 2023 22:25:02 GMT

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 184 KB
68 KB 68ms
28ms Script
application/javascript 2a00:1450:4001:806::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=DC-6260004

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:806::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

36b1684424f00acbb8059de654a1d7b870f37b1366438665a1c17d593ac7443f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.citicards.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Tue, 17 Oct 2023 22:13:32 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 68859
x-xss-protection: 0
last-modified: Tue, 17 Oct 2023 21:30:05 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Tue, 17 Oct 2023 22:13:32 GMT

GET
H2 200 detector-dom.min.js Show response
cdn.gbqofs.com/citi-na-prod/p/ 493 KB
148 KB 53ms
16ms Script
application/javascript 2606:4700::6812:180d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.gbqofs.com/citi-na-prod/p/detector-dom.min.js
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:180d , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e16a0447e9449900c27d97ad6a1efd08eb5b4e8f5759b28dd8d18b812e775f7b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.citicards.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Tue, 17 Oct 2023 22:13:32 GMT
x-amz-version-id: gJNvpqMBavlJHTsZPC_lWgUkR6wekRwD
content-encoding: gzip
cf-cache-status: HIT
via: 1.1 eeb2f3ca588ea4437f4b97ed276a6664.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-P4
age: 2008
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
last-modified: Tue, 26 Sep 2023 12:58:18 GMT
server: cloudflare
etag: W/"f92adf7cf74fc9c8e8ca16c6ff14db5b"
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=14400
cf-ray: 817be3b11adc9250-FRA
x-amz-cf-id: nWjhIA9yl5NJvpLDz3utq7T6S8PaCcL3Wz7f6cZpXEniPUBzdN0s0Q==
expires: Wed, 18 Oct 2023 02:13:32 GMT

GET
H3 200 gen_204 Show response
maps.googleapis.com/maps/api/mapsjs/ 3 B
45 B 57ms
25ms XHR
application/json 2a00:1450:4001:80f::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://maps.googleapis.com/maps/api/mapsjs/gen_204?csp_test=true

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:80f::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

scaffolding on HTTPServer2 /

Resource Hash

ca3d163bab055381827226140568f3bef7eaac187cebd76878e0b63e9e442356

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.citicards.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Tue, 17 Oct 2023 22:13:33 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: scaffolding on HTTPServer2
vary: Origin, X-Origin, Referer
x-frame-options: SAMEORIGIN
content-type: application/json; charset=UTF-8
access-control-allow-origin: https://www.citicards.com
access-control-expose-headers: vary,vary,vary,content-encoding,date,server,content-length
cache-control: private
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 23
x-xss-protection: 0

GET
H2 200 common.js Show response
maps.googleapis.com/maps-api-v3/api/js/54/10/intl/de_ALL/ 254 KB
56 KB 29ms
27ms Script
text/javascript 2a00:1450:4001:80f::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://maps.googleapis.com/maps-api-v3/api/js/54/10/intl/de_ALL/common.js

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f83d1d4a5d84bc8e4c7e21673e4ecfc55998658333b68687bd429c1df7250723

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.citicards.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Tue, 17 Oct 2023 16:45:41 GMT
content-encoding: br
x-content-type-options: nosniff
age: 19672
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/maps-api-js
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 57373
x-xss-protection: 0
last-modified: Mon, 16 Oct 2023 16:54:59 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="maps-api-js"
vary: Accept-Encoding, Origin
report-to: {"group":"maps-api-js","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/maps-api-js"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Wed, 16 Oct 2024 16:45:41 GMT

GET
H2 200 util.js Show response
maps.googleapis.com/maps-api-v3/api/js/54/10/intl/de_ALL/ 154 KB
49 KB 35ms
34ms Script
text/javascript 2a00:1450:4001:80f::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://maps.googleapis.com/maps-api-v3/api/js/54/10/intl/de_ALL/util.js

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

7ae7ff4e02c7bfeb84de787c23509da824b3fde99f2714bb90b9f2d3f87c7d72

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.citicards.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Tue, 17 Oct 2023 16:45:41 GMT
content-encoding: br
x-content-type-options: nosniff
age: 19672
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/maps-api-js
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 49894
x-xss-protection: 0
last-modified: Mon, 16 Oct 2023 16:54:59 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="maps-api-js"
vary: Accept-Encoding, Origin
report-to: {"group":"maps-api-js","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/maps-api-js"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Wed, 16 Oct 2024 16:45:41 GMT

GET
H2 200 controls.js Show response
maps.googleapis.com/maps-api-v3/api/js/54/10/intl/de_ALL/ 88 KB
24 KB 78ms
77ms Script
text/javascript 2a00:1450:4001:80f::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://maps.googleapis.com/maps-api-v3/api/js/54/10/intl/de_ALL/controls.js

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ea8cfa086b29feae594f7dfaa9f1cc35ce10c4f6b8c38a340aaa95b7741ff142

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.citicards.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Tue, 17 Oct 2023 16:45:42 GMT
content-encoding: br
x-content-type-options: nosniff
age: 19671
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/maps-api-js
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 24076
x-xss-protection: 0
last-modified: Mon, 16 Oct 2023 16:54:59 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="maps-api-js"
vary: Accept-Encoding, Origin
report-to: {"group":"maps-api-js","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/maps-api-js"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Wed, 16 Oct 2024 16:45:42 GMT

GET
H2 200 places_impl.js Show response
maps.googleapis.com/maps-api-v3/api/js/54/10/intl/de_ALL/ 48 KB
16 KB 94ms
93ms Script
text/javascript 2a00:1450:4001:80f::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://maps.googleapis.com/maps-api-v3/api/js/54/10/intl/de_ALL/places_impl.js

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

15a4cb39ab2b7781594d5e971542db2c4a6999908d84b71da8de1fd16416ab66

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.citicards.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Tue, 17 Oct 2023 16:45:43 GMT
content-encoding: br
x-content-type-options: nosniff
age: 19670
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/maps-api-js
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 16351
x-xss-protection: 0
last-modified: Mon, 16 Oct 2023 16:54:59 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="maps-api-js"
vary: Accept-Encoding, Origin
report-to: {"group":"maps-api-js","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/maps-api-js"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Wed, 16 Oct 2024 16:45:43 GMT

POST
H2 200 delivery Show response
mboxedge37.tt.omtrdc.net/rest/v1/ 405 B
1 KB 182ms
39ms XHR
application/json 54.217.181.83
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://mboxedge37.tt.omtrdc.net/rest/v1/delivery?client=citicorpcreditservic&sessionId=8e2f973c439f4aabadc68ae86d34d01a&version=2.10.2

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

54.217.181.83 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-54-217-181-83.eu-west-1.compute.amazonaws.com

Software

adobe /

Resource Hash

727ce54fb45496290a9fc1d62ca1e82ad68badf85ce5bd6939fd8bd5eda2ac62

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.citicards.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36
Content-Type: text/plain

Response headers

date: Tue, 17 Oct 2023 22:13:33 GMT
content-encoding: gzip
referrer-policy: strict-origin-when-cross-origin
strict-transport-security: max-age=31536000; includeSubDomains
accept-ch: Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version-List
server: adobe
x-content-type-options: nosniff
vary: origin,access-control-request-method,access-control-request-headers,accept-encoding
p3p: CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
access-control-allow-origin: https://www.citicards.com
content-type: application/json;charset=UTF-8
access-control-allow-credentials: true
timing-allow-origin: *
x-xss-protection: 1; mode=block
x-request-id: 924cab34d9bcf56be2d0aad4a6fbf75e

GET
H2 200 crossdomain.html Show response
1.a79ab95c1589a13f8a4cab612bc71f9f7.com/scripts/prod/ Frame AB07 221 B
556 B 99ms
21ms Document
text/html 2600:9000:2127:f400:a:6cdf:4440:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://1.a79ab95c1589a13f8a4cab612bc71f9f7.com/scripts/prod/crossdomain.html
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2127:f400:a:6cdf:4440:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 0a23512ea579554af1f2614d6dea6120d38660028fc7624c71a978478fae0eb6

Request headers

Referer: https://www.citicards.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 14478
content-length: 221
content-type: text/html
date: Tue, 17 Oct 2023 18:12:16 GMT
etag: "21e34cf6a03f570df49e212018a567d0"
last-modified: Tue, 13 Oct 2020 12:04:25 GMT
server: AmazonS3
via: 1.1 2a9856881d192b485d1bf1928e98c7ec.cloudfront.net (CloudFront)
x-amz-cf-id: 2dFnSLoRqDRP-N_x3FWpDpiwer6380pBl6SV6bQCadeyM9MYGnrvcQ==
x-amz-cf-pop: PRG50-C1
x-amz-version-id: null
x-cache: Hit from cloudfront

GET
H2 200 crossdomain.html Show response
1.b406929acabac9b095f124c81bdfcf57f.com/scripts/prod/ Frame 33B1 221 B
556 B 104ms
20ms Document
text/html 2600:9000:2127:9400:1e:54f1:26c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://1.b406929acabac9b095f124c81bdfcf57f.com/scripts/prod/crossdomain.html
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2127:9400:1e:54f1:26c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 0a23512ea579554af1f2614d6dea6120d38660028fc7624c71a978478fae0eb6

Request headers

Referer: https://www.citicards.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 21879
content-length: 221
content-type: text/html
date: Tue, 17 Oct 2023 16:08:55 GMT
etag: "21e34cf6a03f570df49e212018a567d0"
last-modified: Tue, 13 Oct 2020 12:04:25 GMT
server: AmazonS3
via: 1.1 97101640da3dcba7a2d4a3d67a31b114.cloudfront.net (CloudFront)
x-amz-cf-id: PIGNLVpulLeXS8aJ7cnQPSw34Y269MvuQgUv7e9ps7bdL5OJhFb87A==
x-amz-cf-pop: PRG50-C1
x-amz-version-id: null
x-cache: Hit from cloudfront

GET
H2 200 crossdomain.html Show response
1.c81358859121583b7adf2ace89cb39f44.com/scripts/prod/ Frame 813F 221 B
557 B 112ms
35ms Document
text/html 2600:9000:2127:8600:13:ab57:d440:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://1.c81358859121583b7adf2ace89cb39f44.com/scripts/prod/crossdomain.html
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2127:8600:13:ab57:d440:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 0a23512ea579554af1f2614d6dea6120d38660028fc7624c71a978478fae0eb6

Request headers

Referer: https://www.citicards.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

accept-ranges: bytes
age: 12015
content-length: 221
content-type: text/html
date: Tue, 17 Oct 2023 18:53:19 GMT
etag: "21e34cf6a03f570df49e212018a567d0"
last-modified: Tue, 13 Oct 2020 12:04:25 GMT
server: AmazonS3
via: 1.1 8197d89da72990bb606996d5e7c73ab6.cloudfront.net (CloudFront)
x-amz-cf-id: FBWdyHW3DQptqyDM1l2gcElgLIpFkK7BJzTlmN-CRmbV9-krtQKxNQ==
x-amz-cf-pop: PRG50-C1
x-amz-version-id: null
x-cache: Hit from cloudfront

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 178 KB
65 KB 44ms
43ms Script
application/javascript 2a00:1450:4001:806::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=DC-6269322&l=dataLayer&cx=c

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:806::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

93960b7247899f8aeeeee7a1492042f4d7f282391e7c350e78233319b1dc30f1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.citicards.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Tue, 17 Oct 2023 22:13:33 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 66641
x-xss-protection: 0
last-modified: Tue, 17 Oct 2023 21:30:05 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Tue, 17 Oct 2023 22:13:33 GMT

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 178 KB
65 KB 36ms
36ms Script
application/javascript 2a00:1450:4001:806::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=DC-6256710&l=dataLayer&cx=c

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:806::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

3673b875b1aafcc518c5d81732d66f9395adb9f3722a56d2a5a8cf532d6d3772

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.citicards.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Tue, 17 Oct 2023 22:13:33 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 66731
x-xss-protection: 0
last-modified: Tue, 17 Oct 2023 21:30:05 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Tue, 17 Oct 2023 22:13:33 GMT

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 178 KB
65 KB 26ms
26ms Script
application/javascript 2a00:1450:4001:806::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=DC-6415812&l=dataLayer&cx=c

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:806::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

3437b411499cf91d59ad95a09cb9daea668efeac73ab1f09492e75dded6fc050

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.citicards.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Tue, 17 Oct 2023 22:13:33 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 66728
x-xss-protection: 0
last-modified: Tue, 17 Oct 2023 21:30:05 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Tue, 17 Oct 2023 22:13:33 GMT

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 178 KB
65 KB 22ms
21ms Script
application/javascript 2a00:1450:4001:806::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=DC-6268858&l=dataLayer&cx=c

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:806::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

4c8e2075d12b0f07b89d749927c9fb78cf3d4aa96f8512bdd20f31aa95e34f7e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.citicards.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Tue, 17 Oct 2023 22:13:33 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 66728
x-xss-protection: 0
last-modified: Tue, 17 Oct 2023 21:30:05 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Tue, 17 Oct 2023 22:13:33 GMT

GET
H2 200 sync Show response
live.rezync.com/ 6 KB
7 KB 391ms
337ms Script
text/javascript 65.9.95.44
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://live.rezync.com/sync?c=16b6410431b6374e780104abb0443ca8&p=7e32322de398f7a80f6da0ee1cec9a9b&k=citibank-pixel-4646&zmpID=citibank
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 65.9.95.44 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-65-9-95-44.prg50.r.cloudfront.net
Software: lighttpd/1.4.69 /
Resource Hash: 05b92eea2556bcb9d6069db578e8f536b4092446b1fef4b6b8fbf4ff54ececbc

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.citicards.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Tue, 17 Oct 2023 22:13:33 GMT
via: 1.1 3544838dca6112dd616da017a568e76a.cloudfront.net (CloudFront)
server: lighttpd/1.4.69
x-amz-cf-pop: PRG50-C1
vary: Cookie
x-cache: Miss from cloudfront
content-type: text/javascript
accept-ranges: bytes
content-length: 6252
x-amz-cf-id: O8wVBM7CR1Pz6V4Y-Oy-9LsJlFrLVYdLozCeo1m2ozQaLjUmq-ABQA==

GET
BLOB 200
OK 2778162e-6336-4b27-b2af-a6e4f4f9f8ed
https://www.citicards.com/ 2 KB
0 Other
text/javascript

General

Check archive.org

Show headers Download Go to

Full URL: blob:https://www.citicards.com/2778162e-6336-4b27-b2af-a6e4f4f9f8ed
Requested by: Host: www.citicards.com
URL: https://www.citicards.com/cards/credit/application/flow.action?app=UNSOL&ID=3001&HKOP=2de94b05869e4857c38ba3a5df71418d5ccbea5e43605c020c419744dbe79b6c
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 1eec5d0bc72fba33ce753f6009a277e07041fb92d221ae5839bbc5e8fff1d0bb

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

Content-Length: 2479
Content-Type: text/javascript

GET
H/1.1 200
OK ca.html Show response
20766699p.rfihub.com/ Frame D801 118 B
685 B 144ms
25ms Document
text/html 193.0.160.131
ROCKETFUEL

General

Check archive.org

Show headers Download Go to

Full URL: https://20766699p.rfihub.com/ca.html?ver=9&ra=1822&rb=648&ca=20766699&_o=17169175&_t=citibankonlineconsumercardenterinformation&_rev=1&_pcode=1&_orderid=1&ssv_cuuid=&ssv_package=null&ssv_prodlist=null&ssv_pagename=citibankonlineconsumercardenterinformation&pe=https%3A%2F%2Fwww.citicards.com%2Fcards%2Fcredit%2Fapplication%2Fflow.action%3Fapp%3DUNSOL%26ID%3D3001%26HKOP%3D2de94b05869e4857c38ba3a5df71418d5ccbea5e43605c020c419744dbe79b6c&pf=&ra=21338333050480518
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 193.0.160.131 , United States, ASN54312 (ROCKETFUEL, US),
Reverse DNS
Software: Jetty(9.4.51.v20230217) /
Resource Hash: c437eb764a99e6cd5172d63c3fae564bbc51eda4981058d5edebd2bf0700eb76

Request headers

Referer: https://www.citicards.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Cache-Control: no-cache
Content-Length: 118
Content-Type: text/html;charset=utf-8
Date: Tue, 17 Oct 2023 22:13:33 GMT
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Server: Jetty(9.4.51.v20230217)

GET
H2 200 powered-by-google-on-white3.png
maps.gstatic.com/mapfiles/api-3/images/ 2 KB
2 KB 72ms
22ms Image
image/png 2a00:1450:4001:830::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://maps.gstatic.com/mapfiles/api-3/images/powered-by-google-on-white3.png

Requested by

Host: www.citicards.com
URL: https://www.citicards.com/cards/credit/application/flow.action?app=UNSOL&ID=3001&HKOP=2de94b05869e4857c38ba3a5df71418d5ccbea5e43605c020c419744dbe79b6c

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

cd80d0dcb2a44bd30c11fcdf13d4c280f336dad9442ee7da79146f2bb77381a4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.citicards.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Tue, 17 Oct 2023 22:13:33 GMT
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/geo-tactile
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1616
x-xss-protection: 0
last-modified: Tue, 18 May 2021 19:15:00 GMT
server: sffe
report-to: {"group":"geo-tactile","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/geo-tactile"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: private, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="geo-tactile"
expires: Tue, 17 Oct 2023 22:13:33 GMT

GET
H2 200 autocomplete-icons.png
maps.gstatic.com/mapfiles/api-3/images/ 3 KB
3 KB 72ms
23ms Image
image/png 2a00:1450:4001:830::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://maps.gstatic.com/mapfiles/api-3/images/autocomplete-icons.png

Requested by

Host: www.citicards.com
URL: https://www.citicards.com/cards/credit/application/flow.action?app=UNSOL&ID=3001&HKOP=2de94b05869e4857c38ba3a5df71418d5ccbea5e43605c020c419744dbe79b6c

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

db209390b90b70f4b1ef3540cb581e4ec8edbba21980971b68e4aef5c5d352fb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.citicards.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Tue, 17 Oct 2023 22:13:33 GMT
x-content-type-options: nosniff
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/geo-tactile
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 3351
x-xss-protection: 0
last-modified: Tue, 18 May 2021 19:15:00 GMT
server: sffe
report-to: {"group":"geo-tactile","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/geo-tactile"}]}
content-type: image/png
access-control-allow-origin: *
cache-control: private, max-age=31536000
accept-ranges: bytes
cross-origin-opener-policy-report-only: same-origin; report-to="geo-tactile"
expires: Tue, 17 Oct 2023 22:13:33 GMT

GET
H2 200 crossdomain2.12.0.5273.b96c35cc.min.js Show response
1.a79ab95c1589a13f8a4cab612bc71f9f7.com/scripts/prod/ Frame AB07 3 KB
3 KB 22ms
21ms Script
application/javascript 2600:9000:2127:f400:a:6cdf:4440:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://1.a79ab95c1589a13f8a4cab612bc71f9f7.com/scripts/prod/crossdomain2.12.0.5273.b96c35cc.min.js
Requested by: Host: 1.a79ab95c1589a13f8a4cab612bc71f9f7.com
URL: https://1.a79ab95c1589a13f8a4cab612bc71f9f7.com/scripts/prod/crossdomain.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2127:f400:a:6cdf:4440:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 9cdad69a4b967c882c3d8e9cb054e7334b7f8870e96427a5d20ae2d17eff2622

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://1.a79ab95c1589a13f8a4cab612bc71f9f7.com/scripts/prod/crossdomain.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Tue, 17 Oct 2023 17:20:39 GMT
x-amz-version-id: null
via: 1.1 2a9856881d192b485d1bf1928e98c7ec.cloudfront.net (CloudFront)
last-modified: Tue, 13 Oct 2020 12:04:25 GMT
server: AmazonS3
x-amz-cf-pop: PRG50-C1
age: 17575
etag: "9ee48a4da9c402e8a23ad085fb71f28f"
x-cache: Hit from cloudfront
content-type: application/javascript
accept-ranges: bytes
content-length: 3227
x-amz-cf-id: d3UVQWimXjRXtuWDuj3cmCzBdIxog23jqts6kIfczP2dF0oG1s3deA==

GET
H2 200 crossdomain2.12.0.5273.b96c35cc.min.js Show response
1.b406929acabac9b095f124c81bdfcf57f.com/scripts/prod/ Frame 33B1 3 KB
3 KB 21ms
21ms Script
application/javascript 2600:9000:2127:9400:1e:54f1:26c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://1.b406929acabac9b095f124c81bdfcf57f.com/scripts/prod/crossdomain2.12.0.5273.b96c35cc.min.js
Requested by: Host: 1.b406929acabac9b095f124c81bdfcf57f.com
URL: https://1.b406929acabac9b095f124c81bdfcf57f.com/scripts/prod/crossdomain.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2127:9400:1e:54f1:26c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 9cdad69a4b967c882c3d8e9cb054e7334b7f8870e96427a5d20ae2d17eff2622

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://1.b406929acabac9b095f124c81bdfcf57f.com/scripts/prod/crossdomain.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

x-amz-version-id: null
date: Tue, 17 Oct 2023 13:46:21 GMT
via: 1.1 97101640da3dcba7a2d4a3d67a31b114.cloudfront.net (CloudFront)
last-modified: Tue, 13 Oct 2020 12:04:25 GMT
server: AmazonS3
x-amz-cf-pop: PRG50-C1
age: 30433
etag: "9ee48a4da9c402e8a23ad085fb71f28f"
x-cache: Hit from cloudfront
content-type: application/javascript
accept-ranges: bytes
content-length: 3227
x-amz-cf-id: sebgABBSj-dUufwM7sWb8NrIu_2mH66IowGOXeJZ_BB53Ee3jIDKaQ==

GET
H2 200 crossdomain2.12.0.5273.b96c35cc.min.js Show response
1.c81358859121583b7adf2ace89cb39f44.com/scripts/prod/ Frame 813F 3 KB
3 KB 21ms
21ms Script
application/javascript 2600:9000:2127:8600:13:ab57:d440:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://1.c81358859121583b7adf2ace89cb39f44.com/scripts/prod/crossdomain2.12.0.5273.b96c35cc.min.js
Requested by: Host: 1.c81358859121583b7adf2ace89cb39f44.com
URL: https://1.c81358859121583b7adf2ace89cb39f44.com/scripts/prod/crossdomain.html
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2127:8600:13:ab57:d440:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 9cdad69a4b967c882c3d8e9cb054e7334b7f8870e96427a5d20ae2d17eff2622

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://1.c81358859121583b7adf2ace89cb39f44.com/scripts/prod/crossdomain.html
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

x-amz-version-id: null
date: Tue, 17 Oct 2023 19:47:02 GMT
via: 1.1 8197d89da72990bb606996d5e7c73ab6.cloudfront.net (CloudFront)
last-modified: Tue, 13 Oct 2020 12:04:25 GMT
server: AmazonS3
x-amz-cf-pop: PRG50-C1
age: 8792
etag: "9ee48a4da9c402e8a23ad085fb71f28f"
x-cache: Hit from cloudfront
content-type: application/javascript
accept-ranges: bytes
content-length: 3227
x-amz-cf-id: I2GN9kF2mRL6bWSCfF4IuHqQjln8m-RRRRyWI2w1ApYQl7hiFQ7lUw==

GET
H/1.1 200
OK Interstate-ExtraLight.otf
www.citicards.com/cards/wv/welcome/css/fonts/interstate/ 25 KB
17 KB 77ms
76ms Font
application/octet-stream 23.212.222.131
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://www.citicards.com/cards/wv/welcome/css/fonts/interstate/Interstate-ExtraLight.otf
Requested by: Host: www.citicards.com
URL: https://www.citicards.com/cards/wv/welcome/css/newWelcome.min.css
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.212.222.131 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-212-222-131.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 9df60fb9744a6ccb9d6293a757171fe61e72daf364a7e3001f6430c69c5af89c

Request headers

Referer: https://www.citicards.com/cards/wv/welcome/css/newWelcome.min.css
Origin: https://www.citicards.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

Date: Tue, 17 Oct 2023 22:13:33 GMT
Content-Encoding: gzip
Last-Modified: Thu, 29 Sep 2016 17:21:13 GMT
X-Akamai-CITISITE: SWDC
Vary: Accept-Encoding
Content-Type: text/plain
Connection: keep-alive
Accept-Ranges: bytes
X-DataStream-Cache-Status: 1
Content-Length: 16664

GET
H/1.1 200
OK Interstate-Light.otf
www.citicards.com/cards/wv/welcome/css/fonts/interstate/ 25 KB
17 KB 25ms
25ms Font
application/octet-stream 23.212.222.131
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://www.citicards.com/cards/wv/welcome/css/fonts/interstate/Interstate-Light.otf
Requested by: Host: www.citicards.com
URL: https://www.citicards.com/cards/wv/welcome/css/newWelcome.min.css
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.212.222.131 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-212-222-131.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: eca17c5e10e24caa55225fc490c63cce6fd9cddfbbb44e5b676681e894b6ad25

Request headers

Referer: https://www.citicards.com/cards/wv/welcome/css/newWelcome.min.css
Origin: https://www.citicards.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

Date: Tue, 17 Oct 2023 22:13:33 GMT
Content-Encoding: gzip
Last-Modified: Thu, 29 Sep 2016 17:21:13 GMT
X-Akamai-CITISITE: GTDC
Vary: Accept-Encoding
Content-Type: text/plain
Connection: keep-alive
Accept-Ranges: bytes
X-DataStream-Cache-Status: 1
Content-Length: 16771

GET
DATA 200
OK truncated
/ 89 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 50e6072d26098d48004a30addeecabd5b22b91e5ccdf9dd86f96459783e3ac23

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

Content-Type: image/png

GET
H/1.1 404
Not Found Interstate-Regular.woff
www.citicards.com/cards/wv/welcome/css/fonts/interstate/ 0
0 803ms
803ms Font
text/html 23.212.222.131
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://www.citicards.com/cards/wv/welcome/css/fonts/interstate/Interstate-Regular.woff
Requested by: Host: www.citicards.com
URL: https://www.citicards.com/cards/wv/welcome/css/newWelcome.min.css
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.212.222.131 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-212-222-131.deploy.static.akamaitechnologies.com
Software: /
Resource Hash

Request headers

Referer: https://www.citicards.com/cards/wv/welcome/css/newWelcome.min.css
Origin: https://www.citicards.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

Date: Tue, 17 Oct 2023 22:13:34 GMT
Content-Encoding: gzip
Last-Modified: Sat, 26 Jun 2021 05:35:49 GMT
X-Akamai-CITISITE: GTDC
Vary: Accept-Encoding
Content-Type: text/html
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 1532

GET
BLOB 200
OK fa8fcc5c-5749-4487-9f80-992893692fe5
https://www.citicards.com/ 75 B
0 Other
application/javascript

General

Check archive.org

Show headers Download Go to

Full URL: blob:https://www.citicards.com/fa8fcc5c-5749-4487-9f80-992893692fe5
Requested by: Host: www.citicards.com
URL: https://www.citicards.com/cards/credit/application/flow.action?app=UNSOL&ID=3001&HKOP=2de94b05869e4857c38ba3a5df71418d5ccbea5e43605c020c419744dbe79b6c
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 4caed94f9975debb1a1ee2ff2e68395802a18a4cf3f3be7ae057f1b97b2c87ff

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

Content-Length: 75
Content-Type: application/javascript

GET
H/1.1 200
OK idr.js Show response
a.rfihub.com/ 65 B
705 B 60ms
15ms Script
application/javascript 193.0.160.131
ROCKETFUEL

General

Check archive.org

Show headers Download Go to

Full URL: https://a.rfihub.com/idr.js?_callback=jQuery1910040433315229021716_1697580812590&_=1697580812591
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 193.0.160.131 , United States, ASN54312 (ROCKETFUEL, US),
Reverse DNS
Software: Jetty(9.4.51.v20230217) /
Resource Hash: c8e8dd620dcc08590f8e38e8ed92d87edc6e63dccb8e06ea0ce2135ffc16ca1e

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.citicards.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

Expires: Sun, 10 Nov 2024 22:13:33 GMT
Date: Tue, 17 Oct 2023 22:13:33 GMT
Cache-Control: public, max-age=33696000
Content-Type: application/javascript;charset=iso-8859-1
Server: Jetty(9.4.51.v20230217)
Content-Length: 65
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

GET
H/1.1 200
OK p13n.min.js Show response
cdn.boomtrain.com/p13n/citibank/ 93 KB
30 KB 62ms
9ms Script
application/javascript 18.66.122.57
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.boomtrain.com/p13n/citibank/p13n.min.js
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 18.66.122.57 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-66-122-57.fra60.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 6380b5806e25f267b34990930509aefec9e8fd53b16183d99d38441e7b4025c2

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.citicards.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

x-amz-version-id: 4tTCDH_Ot9gY3n4_I4QvVPNoOYfDcV2s
Content-Encoding: gzip
Via: 1.1 da6955a1993e1118f32bcb48c6630c20.cloudfront.net (CloudFront)
Date: Tue, 17 Oct 2023 21:23:32 GMT
X-Amz-Cf-Pop: FRA60-P2
Age: 3014
x-amz-server-side-encryption: AES256
Transfer-Encoding: chunked
X-Cache: Hit from cloudfront
Connection: keep-alive
Last-Modified: Mon, 09 Oct 2023 02:39:05 GMT
Server: AmazonS3
ETag: W/"f635727fc54b30d1445eca50a4b5224f"
Vary: Accept-Encoding
Content-Type: application/javascript
Cache-Control: public, max-age=3600
X-Amz-Cf-Id: gsxKftDb-Rre_EhBCfJx2hvMj-mWY3CLnNlmS8oXRv9bxYBR16x7tg==

GET
H/1.1 200
OK resolve Show response
people.api.boomtrain.com/identify/ 142 B
457 B 453ms
126ms XHR
application/json 52.2.158.49
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://people.api.boomtrain.com/identify/resolve?data=eyJjb29raWUiOnsiYnNpbiI6IiJ9LCJxdWVyeXN0cmluZyI6e30sImV4dGVybmFsX2lkcyI6eyJ6eW5jIjoiNTAzNmRjZTItZTcxYS00MTBiLWE3NjUtOGZjMWQ4N2EzYWI1OjE2OTc1ODA4MTMuNTI1MjU4In19&site_id=citibank
Requested by: Host: www.citicards.com
URL: https://www.citicards.com/assets/scripts/global/6c8322c7341eac98645c10e3d1d3c7ae.js?seed=AAAjpz-LAQAAFC_bMRxQoajWvZoUseb7-9M_13CDQMMWDa5kNV3LRXPZ6k5d&X-soz9htCz--z=q
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.2.158.49 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-2-158-49.compute-1.amazonaws.com
Software: nginx /
Resource Hash: 9f700a9fc999a4bcac1078d6b0e87f13522bb35bf4ec40839123fc43a49f2202

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.citicards.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

Date: Tue, 17 Oct 2023 22:13:34 GMT
Server: nginx
Access-Control-Allow-Methods: GET,PUT,POST,DELETE
Content-Type: application/json
Access-Control-Allow-Origin: *
Connection: keep-alive
Access-Control-Allow-Headers: X-Requested-With,Content-Type,Authorization,x-app-id
Content-Length: 142

GET
H/1.1 200
OK persons Show response
people.api.boomtrain.com/ 173 B
488 B 169ms
169ms XHR
application/json 52.2.158.49
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://people.api.boomtrain.com/persons?data=eyIkc2V0Ijp7InVzZXJfaWQiOiI1MTA4NTU5NzMwMzU0MzIyMjQ3In0sImJzaW4iOiJpRjBreGhwV2RnbitiRjZoZEVXNlVNbXArZVMzMGZNTzZJVnhJejJzWGJVRkZTK29OemRSMHoybjVHOFVNQi9sNGdBRVJUYkI1cDNDWDNBNDBLT1AxZz09In0%3D&site_id=citibank
Requested by: Host: www.citicards.com
URL: https://www.citicards.com/assets/scripts/global/6c8322c7341eac98645c10e3d1d3c7ae.js?seed=AAAjpz-LAQAAFC_bMRxQoajWvZoUseb7-9M_13CDQMMWDa5kNV3LRXPZ6k5d&X-soz9htCz--z=q
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.2.158.49 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-2-158-49.compute-1.amazonaws.com
Software: nginx /
Resource Hash: 3e9ef72f08cbe7d70278c92e5a92893c01062abc8998fd77f718e925470f9736

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.citicards.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

Date: Tue, 17 Oct 2023 22:13:34 GMT
Server: nginx
Access-Control-Allow-Methods: GET,PUT,POST,DELETE
Content-Type: application/json
Access-Control-Allow-Origin: *
Connection: keep-alive
Access-Control-Allow-Headers: X-Requested-With,Content-Type,Authorization,x-app-id
Content-Length: 173

POST
H2 200 track Show response
events.api.boomtrain.com/event/ 2 B
209 B 694ms
113ms XHR
text/plain 3.210.211.38
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://events.api.boomtrain.com/event/track
Requested by: Host: www.citicards.com
URL: https://www.citicards.com/assets/scripts/global/6c8322c7341eac98645c10e3d1d3c7ae.js?seed=AAAjpz-LAQAAFC_bMRxQoajWvZoUseb7-9M_13CDQMMWDa5kNV3LRXPZ6k5d&X-soz9htCz--z=q
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 3.210.211.38 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-210-211-38.compute-1.amazonaws.com
Software: nginx /
Resource Hash: 565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3

Request headers

Referer: https://www.citicards.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36
Content-Type: text/plain

Response headers

access-control-allow-origin: *
date: Tue, 17 Oct 2023 22:13:35 GMT
server: nginx
access-control-allow-headers: X-Requested-With, Content-Type, Authorization, x-app-id
content-length: 2
access-control-allow-methods: GET, PUT, POST, DELETE
content-type: text/plain

GET
H/1.1 200
OK Interstate-Regular.otf
www.citicards.com/cards/wv/welcome/css/fonts/interstate/ 25 KB
17 KB 54ms
54ms Font
application/octet-stream 23.212.222.131
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://www.citicards.com/cards/wv/welcome/css/fonts/interstate/Interstate-Regular.otf
Requested by: Host: www.citicards.com
URL: https://www.citicards.com/cards/wv/welcome/css/newWelcome.min.css
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 23.212.222.131 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-212-222-131.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: a244a2e637f251116b8794ccef1549f5871da9ccd94a270c3ee9d0e51eca3568

Request headers

Referer: https://www.citicards.com/cards/wv/welcome/css/newWelcome.min.css
Origin: https://www.citicards.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

Date: Tue, 17 Oct 2023 22:13:34 GMT
Content-Encoding: gzip
Last-Modified: Thu, 29 Sep 2016 17:21:13 GMT
X-Akamai-CITISITE: SWDC
Vary: Accept-Encoding
Content-Type: text/plain
Connection: keep-alive
Accept-Ranges: bytes
X-DataStream-Cache-Status: 1
Content-Length: 16802

GET
H2 200 / Show response
zn3vi8kkuds0jjrfc-citifeedback.siteintercept.qualtrics.com/SIE/ 8 KB
4 KB 88ms
34ms Script
application/javascript 104.17.208.240
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://zn3vi8kkuds0jjrfc-citifeedback.siteintercept.qualtrics.com/SIE/?Q_ZID=ZN_3VI8kkudS0JJRFc

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.17.208.240 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

c2c23f79eefc96c5414118e0f72b858ff760ff476ab73b4cf4d15ed5d0eff149

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.citicards.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Tue, 17 Oct 2023 22:13:34 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: br
age: 81676
cf-polished: origSize=9155
content-security-policy-report-only: frame-ancestors 'self' *.qualtrics.com *.my.salesforce.com *.visualforce.com *.visual.force.com *.lightning.force.com; report-uri https://sjc1.qualtrics.com/csp-report
edge-control: max-age=604800
referrer-policy: strict-origin-when-cross-origin
cf-bgj: minify
server: cloudflare
etag: W/"23c3-N6Is4RS6txpijdgpMdRXrb2+/BY"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=3600, s-maxage=604800
permissions-policy: camera=(), geolocation=(), microphone=()
cf-ray: 817be3bc5ee60404-FRA
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept
timing-allow-origin: *

GET
H2 200 tc.min.js Show response
c1.rfihub.net/js/ 19 KB
6 KB 23ms
23ms Script
application/x-javascript 2600:9000:2127:8800:1:76cf:fe80:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c1.rfihub.net/js/tc.min.js
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2127:8800:1:76cf:fe80:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: Jetty(9.4.51.v20230217) /
Resource Hash: 7ef97b12890fc6fee67f869c6e1f74b6719de7d66ac0d649c8d7386a80b4c30f

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.citicards.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Tue, 17 Oct 2023 21:36:57 GMT
content-encoding: br
via: 1.1 017ac0aeeb057314a9b1c06f8b97ba34.cloudfront.net (CloudFront)
last-modified: Tue, 17 Oct 2023 11:27:10 GMT
server: Jetty(9.4.51.v20230217)
x-amz-cf-pop: PRG50-C1
age: 2912
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/x-javascript
p3p: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
cache-control: public, max-age=3600
x-amz-cf-id: lUy1PQhPEA67lt8ZUk63BdcoduFo6LKnH2ticDPiK9H2VhzkhIQeow==
expires: Tue, 17 Oct 2023 22:25:02 GMT

GET
H/1.1 200
OK ca.html Show response
p.rfihub.com/ Frame E017 118 B
685 B 61ms
15ms Document
text/html 193.0.160.131
ROCKETFUEL

General

Check archive.org

Show headers Download Go to

Full URL: https://p.rfihub.com/ca.html?ver=9&ra=1929&rb=648&ca=&_o=17169175&_t=&pe=https%3A%2F%2Fwww.citicards.com%2Fcards%2Fcredit%2Fapplication%2Fflow.action%3Fapp%3DUNSOL%26ID%3D3001%26HKOP%3D2de94b05869e4857c38ba3a5df71418d5ccbea5e43605c020c419744dbe79b6c&pf=&ra=5065256972997101
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 193.0.160.131 , United States, ASN54312 (ROCKETFUEL, US),
Reverse DNS
Software: Jetty(9.4.51.v20230217) /
Resource Hash: c437eb764a99e6cd5172d63c3fae564bbc51eda4981058d5edebd2bf0700eb76

Request headers

Referer: https://www.citicards.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Cache-Control: no-cache
Content-Length: 118
Content-Type: text/html;charset=utf-8
Date: Tue, 17 Oct 2023 22:13:34 GMT
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Server: Jetty(9.4.51.v20230217)

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 197 KB
71 KB 23ms
23ms Script
application/javascript 2a00:1450:4001:806::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-916451471

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

61599227edd27d886363dc91842516e6abaffd4f6de535307a82c733e0db3d6f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.citicards.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Tue, 17 Oct 2023 22:13:34 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 72971
x-xss-protection: 0
last-modified: Tue, 17 Oct 2023 21:30:05 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Tue, 17 Oct 2023 22:13:34 GMT

GET
H2 451 425466.html Show response
sr.rlcdn.com/ Frame 00C6 0
98 B 190ms
116ms Document
text/plain 35.190.60.146
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://sr.rlcdn.com/425466.html?es=80676&u=da39a3ee5e6b4b0d3255bfef95601890afd80709
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.190.60.146 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 146.60.190.35.bc.googleusercontent.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.citicards.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
date: Tue, 17 Oct 2023 22:13:34 GMT
via: 1.1 google

GET
H2 200 sync Show response
live.rezync.com/ 665 B
1 KB 182ms
182ms Script
text/javascript 65.9.95.44
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://live.rezync.com/sync?c=16b6410431b6374e780104abb0443ca8&p=7e32322de398f7a80f6da0ee1cec9a9b&k=citibank-pixel-6667&custom1={_dl.event}&custom2={_dl.evarPageName}&custom3={_dl.pid}&custom4={_dl.CUUID}&custom5={_dl.products[0].product_details}&custom6={_dl.prospect_id}&zmpID=citibank&cache_buster=1697580814733&PageUrl={_dl.url}&page_referrer=
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 65.9.95.44 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-65-9-95-44.prg50.r.cloudfront.net
Software: lighttpd/1.4.69 /
Resource Hash: 4f27a3e4da998024bcf4f93346fed5905e65af8f94e57e915fc238d0e4652717

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.citicards.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Tue, 17 Oct 2023 22:13:34 GMT
via: 1.1 3544838dca6112dd616da017a568e76a.cloudfront.net (CloudFront)
server: lighttpd/1.4.69
x-amz-cf-pop: PRG50-C1
vary: Cookie
x-cache: Miss from cloudfront
content-type: text/javascript
accept-ranges: bytes
content-length: 665
x-amz-cf-id: p8dWqCLvwxYWks19bA-A-hq5DxLuewyBisW8e7uwyxPk36Z-_hkb1Q==

GET
H2 200 bat.js Show response
bat.bing.com/ 44 KB
13 KB 51ms
32ms Script
application/javascript 2620:1ec:c11::200
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://bat.bing.com/bat.js

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

409d3f8134e2ba98a5916f43a28b4a3a973841336b8ff4648eea1e709ade9708

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.citicards.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
content-encoding: gzip
date: Tue, 17 Oct 2023 22:13:34 GMT
last-modified: Thu, 12 Oct 2023 17:36:49 GMT
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: C941BBFFDEB54172A6C4E54B4A493057 Ref B: FRAEDGE2016 Ref C: 2023-10-17T22:13:34Z
etag: "808ec9ad32fdd91:0"
vary: Accept-Encoding
x-cache: CONFIG_NOCACHE
content-type: application/javascript
cache-control: private,max-age=1800
accept-ranges: bytes
content-length: 12978

GET
H2 200 dpm_pixel_min.js Show response
c.tvpixel.com/js/current/ 103 KB
32 KB 101ms
24ms Script
application/javascript 2600:9000:2127:2200:1d:bf0a:0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c.tvpixel.com/js/current/dpm_pixel_min.js?aid=citi-d4f85824-1351-4554-91ff-fdb56f962c5c&comscore=true
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2127:2200:1d:bf0a:0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 61d8137d275f12306e177bc726c2b3e072f9efa4743a0ace6ecbcf7a0932fd07

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.citicards.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Tue, 17 Oct 2023 02:10:24 GMT
x-amz-version-id: oMk5SFqHXboEDRm2.vDWImtx_4ARYxEl
content-encoding: gzip
last-modified: Thu, 16 Sep 2021 18:14:59 GMT
server: AmazonS3
via: 1.1 2a9856881d192b485d1bf1928e98c7ec.cloudfront.net (CloudFront)
x-amz-cf-pop: PRG50-C1
etag: W/"08e770c8a17bf087d50cec01af0892c2"
age: 72191
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
x-amz-cf-id: z-LDmbxsX87VAjfdPLK_lqrHHcbCOsz3_Bg2qe-ff230x-f-TUuYNQ==

GET
H/1.1 200
OK up_loader.1.1.0.js Show response
js.adsrvr.org/ 5 KB
3 KB 79ms
23ms Script
application/x-javascript 65.9.99.119
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://js.adsrvr.org/up_loader.1.1.0.js
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 65.9.99.119 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-65-9-99-119.prg50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 899663bfeab6b11842c974c2417dc0ad88bd79bb7510b1e032384ccf2618dcc1

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.citicards.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

Date: Tue, 17 Oct 2023 03:51:17 GMT
Content-Encoding: gzip
Via: 1.1 017ac0aeeb057314a9b1c06f8b97ba34.cloudfront.net (CloudFront)
Last-Modified: Tue, 01 Aug 2023 20:10:44 GMT
Server: AmazonS3
X-Amz-Cf-Pop: PRG50-C1
Age: 66138
x-amz-server-side-encryption: AES256
ETag: W/"b7474eac210849250426a8f6a39d00f3"
Transfer-Encoding: chunked
Vary: Accept-Encoding
Content-Type: application/x-javascript
X-Cache: Hit from cloudfront
Connection: keep-alive
X-Amz-Cf-Id: yYdoNH7o5_hR53ECNtS32sscj4ByTv8o95jSOAS-Iy71lHV33_8GLg==

GET
H/1.1

200
OK

iu3
s.amazon-adsystem.com/
Redirect Chain

https://s.amazon-adsystem.com/iu3?pid=c3702eea-109e-48b0-9ef4-c856bdd405e2&event=PageView
https://s.amazon-adsystem.com/iu3?pid=c3702eea-109e-48b0-9ef4-c856bdd405e2&event=PageView&dcc=t

0
0

130ms
129ms

Image
text/html

209.54.182.161
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s.amazon-adsystem.com/iu3?pid=c3702eea-109e-48b0-9ef4-c856bdd405e2&event=PageView&dcc=t
Protocol: HTTP/1.1
Server: 209.54.182.161 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.citicards.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

Redirect headers

Pragma: no-cache
Date: Tue, 17 Oct 2023 22:13:35 GMT
Strict-Transport-Security: max-age=47474747; includeSubDomains; preload
Server: Server
x-amz-rid: KQMCE13FAWEQG8ZKQDH8
Vary: Content-Type,Accept-Encoding,User-Agent
p3p: policyref="https://www.amazon.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR DSP COR"
Location: https://s.amazon-adsystem.com/iu3?pid=c3702eea-109e-48b0-9ef4-c856bdd405e2&event=PageView&dcc=t
Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
Connection: keep-alive
Content-Length: 0
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H/1.1 202
Accepted meta
s.rfihub.com/ 0
0 481ms
237ms Image
text/html 193.0.160.131
ROCKETFUEL

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://s.rfihub.com/meta?_o=17169175&_t=app_fire&ssv_cuuid=na&_pcode=093&ssv_fk2=093&ssv_chkprod=citiaadvantageexecutiveworldelitemastercard&ssv_product=citiaadvantageexecutiveworldelitemastercard&ssv_source=cards&_rev=1
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 193.0.160.131 , United States, ASN54312 (ROCKETFUEL, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.citicards.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

GET
H/1.1 200
OK check.js;CIS3SID=1E9AE98D00C7721239A87FB1F61DDD37 Show response
content22.accountonline.com/fp/ Frame A63D 494 KB
89 KB 24ms
23ms Script
text/javascript 91.235.132.220
THM

General

Check archive.org

Show headers Download Go to

Full URL

https://content22.accountonline.com/fp/check.js;CIS3SID=1E9AE98D00C7721239A87FB1F61DDD37?org_id=89oebq5k&session_id=d73badfb6291512b9f1d43ffd18e1f8f2519636970c27cb58dfddf5166d9b69a&nonce=a16891807d617b66&pageid=1&jb=353b24246a736d773f55616e646f75712e68736f3d556b6c646f7f732530383332266a7b60773f4b6a726d6f672468736a3d4168726d6d6527303039333a

Requested by

Host: content22.accountonline.com
URL: https://content22.accountonline.com/fp/tags.js?org_id=89oebq5k&session_id=d73badfb6291512b9f1d43ffd18e1f8f2519636970c27cb58dfddf5166d9b69a&allow_reprofile=1

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

91.235.132.220 , United States, ASN30286 (THM, US),

Reverse DNS

Software

Apache /

Resource Hash

0fdfad8c378a8a626d5b5d629db184a13b3613dc3769ae7cabfc5374cbae2b07

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.citicards.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

Date: Tue, 17 Oct 2023 22:13:34 GMT
Strict-Transport-Security: max-age=31536000
X-Content-Type-Options: nosniff
Content-Encoding: gzip
Transfer-Encoding: chunked
tmx-nonce: a16891807d617b66
Connection: Keep-Alive, Keep-Alive
X-XSS-Protection: 1; mode=block
Pragma: no-cache
Server: Apache
Vary: Accept-Encoding
Content-Type: text/javascript;charset=UTF-8
Cache-Control: no-cache, no-store, must-revalidate
X-Robots-Tag: noindex, nofollow
Keep-Alive: timeout=2, max=99
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H/1.1 200
OK clear.png
content22.accountonline.com/fp/ Frame A63D 81 B
475 B 44ms
16ms Image
image/png 91.235.132.220
THM

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://content22.accountonline.com/fp/clear.png?org_id=89oebq5k&session_id=d73badfb6291512b9f1d43ffd18e1f8f2519636970c27cb58dfddf5166d9b69a&nonce=a16891807d617b66&pageid=1&ck=0&m=1

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

91.235.132.220 , United States, ASN30286 (THM, US),

Reverse DNS

Software

Apache /

Resource Hash

95518cbec0d55a574a9c8ef72a2a7d62ac0d40a4de5dfe67a76a7d214dc8b743

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.citicards.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 17 Oct 2023 22:13:34 GMT
Strict-Transport-Security: max-age=31536000
X-Content-Type-Options: nosniff
Server: Apache
Content-Type: image/png
Cache-Control: no-cache, no-store, must-revalidate
Connection: Keep-Alive
Keep-Alive: timeout=2, max=100
Content-Length: 81
X-XSS-Protection: 1; mode=block
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H/1.1 200
OK clear.png
content22.accountonline.com/fp/ Frame A63D 81 B
475 B 43ms
16ms Image
image/png 91.235.132.220
THM

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://content22.accountonline.com/fp/clear.png?org_id=89oebq5k&session_id=d73badfb6291512b9f1d43ffd18e1f8f2519636970c27cb58dfddf5166d9b69a&nonce=a16891807d617b66&pageid=1&ck=0&m=2

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

91.235.132.220 , United States, ASN30286 (THM, US),

Reverse DNS

Software

Apache /

Resource Hash

95518cbec0d55a574a9c8ef72a2a7d62ac0d40a4de5dfe67a76a7d214dc8b743

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.citicards.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 17 Oct 2023 22:13:34 GMT
Strict-Transport-Security: max-age=31536000
X-Content-Type-Options: nosniff
Server: Apache
Content-Type: image/png
Cache-Control: no-cache, no-store, must-revalidate
Connection: Keep-Alive
Keep-Alive: timeout=2, max=100
Content-Length: 81
X-XSS-Protection: 1; mode=block
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H/1.1 200
OK cls_report Show response
prod.report.nacustomerexperience.citi.com/glassbox/reporting/798b2f12-9162-4a94-91ee-805d883ca266/ 8 KB
3 KB 521ms
101ms XHR
application/json 3.224.91.217
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://prod.report.nacustomerexperience.citi.com/glassbox/reporting/798b2f12-9162-4a94-91ee-805d883ca266/cls_report?_cls_s=a640fd98-a0c2-4fe9-8834-8c4fed70ecae%3A0&_cls_v=d8509083-ac4c-4248-8fbf-3bab75beafc9&pv=2&f_cls_s=true

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

3.224.91.217 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-3-224-91-217.compute-1.amazonaws.com

Software

GlassBox Cligate /

Resource Hash

08c570730a854d59bb36789eb86c2609746cd4f5f7cad993622c5d0f397302d6

Security Headers

Name	Value
Content-Security-Policy	default-src 'self';
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.citicards.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

Date: Tue, 17 Oct 2023 22:13:35 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains
content-encoding: gzip
Content-Security-Policy: default-src 'self';
X-Content-Type-Options: nosniff
Connection: keep-alive
Content-Length: 1731
X-XSS-Protection: 1; mode=block
Referrer-Policy: strict-origin-when-cross-origin
Server: GlassBox Cligate
X-Frame-Options: SAMEORIGIN
vary: origin
Content-Type: application/json
access-control-allow-origin: https://www.citicards.com
access-control-allow-credentials: true
GB-Server: g5075
X-Robots-Tag: noindex

GET
H2 200 detector-dom.min.js Show response
cdn.gbqofs.com/citi-na-prod/p/ Frame A63D 493 KB
148 KB 14ms
14ms Script
application/javascript 2606:4700::6812:180d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.gbqofs.com/citi-na-prod/p/detector-dom.min.js
Requested by: Host: cdn.gbqofs.com
URL: https://cdn.gbqofs.com/citi-na-prod/p/detector-dom.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:180d , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b7f347ef43a4322d773e10b21dde79df81322f29bd70fbddf75837cd4824fb50

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.citicards.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Tue, 17 Oct 2023 22:13:34 GMT
x-amz-version-id: gJNvpqMBavlJHTsZPC_lWgUkR6wekRwD
content-encoding: gzip
cf-cache-status: HIT
via: 1.1 eeb2f3ca588ea4437f4b97ed276a6664.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-P4
age: 2010
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
last-modified: Tue, 26 Sep 2023 12:58:18 GMT
server: cloudflare
etag: W/"f92adf7cf74fc9c8e8ca16c6ff14db5b"
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=14400
cf-ray: 817be3bc69169250-FRA
x-amz-cf-id: nWjhIA9yl5NJvpLDz3utq7T6S8PaCcL3Wz7f6cZpXEniPUBzdN0s0Q==
expires: Wed, 18 Oct 2023 02:13:34 GMT

GET
H2

200

activityi;dc_pre=CNn7zauN_oEDFdPIOwIdyLsO-A;src=6260004;type=appli0;cat=appli0;qty=1;cost=1;ord=2879853513319.5435;auiddc=583581942.1697580813;u1=093;u3=null;u4=jJRSACQ_AboutYou_AA;u12=https%3A%2F%... Show response
6260004.fls.doubleclick.net/ Frame 5890
Redirect Chain

https://6260004.fls.doubleclick.net/activityi;src=6260004;type=appli0;cat=appli0;qty=1;cost=1;ord=2879853513319.5435;auiddc=583581942.1697580813;u1=093;u3=null;u4=jJRSACQ_AboutYou_AA;u12=https%3A%2...
https://6260004.fls.doubleclick.net/activityi;dc_pre=CNn7zauN_oEDFdPIOwIdyLsO-A;src=6260004;type=appli0;cat=appli0;qty=1;cost=1;ord=2879853513319.5435;auiddc=583581942.1697580813;u1=093;u3=null;u4=...

921 B
619 B

62ms
61ms

Document
text/html

142.250.186.38
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://6260004.fls.doubleclick.net/activityi;dc_pre=CNn7zauN_oEDFdPIOwIdyLsO-A;src=6260004;type=appli0;cat=appli0;qty=1;cost=1;ord=2879853513319.5435;auiddc=583581942.1697580813;u1=093;u3=null;u4=jJRSACQ_AboutYou_AA;u12=https%3A%2F%2Fwww.citicards.com%2Fcards%2Fcredit%2Fapplication%2Fflow.action%3Fapp%3DUNSOL%26ID%3D3001%26HKOP%3D2de94b05869e4857c38ba3a5df71418d5ccbea5e43605c020c419744dbe79b6c;u11=;gtm=45fe3ag0;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;epver=2;~oref=https%3A%2F%2Fwww.citicards.com%2Fcards%2Fcredit%2Fapplication%2Fflow.action%3Fapp%3DUNSOL%26ID%3D3001%26HKOP%3D2de94b05869e4857c38ba3a5df71418d5ccbea5e43605c020c419744dbe79b6c?

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=DC-6260004

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.38 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s04-in-f6.1e100.net

Software

cafe /

Resource Hash

5cec84b544de8e5c6cd47e516a417b5b75fda2edeca26110751af4584a38fe66

Security Headers

Name	Value
Strict-Transport-Security	max-age=21600
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.citicards.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, must-revalidate
content-encoding: br
content-length: 443
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Tue, 17 Oct 2023 22:13:34 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
pragma: no-cache
server: cafe
strict-transport-security: max-age=21600
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

Redirect headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, must-revalidate
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Tue, 17 Oct 2023 22:13:34 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
follow-only-when-prerender-shown: 1
location: https://6260004.fls.doubleclick.net/activityi;dc_pre=CNn7zauN_oEDFdPIOwIdyLsO-A;src=6260004;type=appli0;cat=appli0;qty=1;cost=1;ord=2879853513319.5435;auiddc=583581942.1697580813;u1=093;u3=null;u4=jJRSACQ_AboutYou_AA;u12=https%3A%2F%2Fwww.citicards.com%2Fcards%2Fcredit%2Fapplication%2Fflow.action%3Fapp%3DUNSOL%26ID%3D3001%26HKOP%3D2de94b05869e4857c38ba3a5df71418d5ccbea5e43605c020c419744dbe79b6c;u11=;gtm=45fe3ag0;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;epver=2;~oref=https%3A%2F%2Fwww.citicards.com%2Fcards%2Fcredit%2Fapplication%2Fflow.action%3Fapp%3DUNSOL%26ID%3D3001%26HKOP%3D2de94b05869e4857c38ba3a5df71418d5ccbea5e43605c020c419744dbe79b6c?
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
pragma: no-cache
server: cafe
strict-transport-security: max-age=21600
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2

200

activityi;dc_pre=CO34zauN_oEDFQ6Tmwod-7sB4w;src=6260004;type=appli0;cat=aaadv000;qty=1;cost=1995.27;ord=1746401848952.357;auiddc=583581942.1697580813;u1=093;u3=null;u4=jJRSACQ_AboutYou_AA;u11=;gtm=... Show response
6260004.fls.doubleclick.net/ Frame 0928
Redirect Chain

https://6260004.fls.doubleclick.net/activityi;src=6260004;type=appli0;cat=aaadv000;qty=1;cost=1995.27;ord=1746401848952.357;auiddc=583581942.1697580813;u1=093;u3=null;u4=jJRSACQ_AboutYou_AA;u11=;gt...
https://6260004.fls.doubleclick.net/activityi;dc_pre=CO34zauN_oEDFQ6Tmwod-7sB4w;src=6260004;type=appli0;cat=aaadv000;qty=1;cost=1995.27;ord=1746401848952.357;auiddc=583581942.1697580813;u1=093;u3=n...

747 B
613 B

99ms
98ms

Document
text/html

142.250.186.38
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://6260004.fls.doubleclick.net/activityi;dc_pre=CO34zauN_oEDFQ6Tmwod-7sB4w;src=6260004;type=appli0;cat=aaadv000;qty=1;cost=1995.27;ord=1746401848952.357;auiddc=583581942.1697580813;u1=093;u3=null;u4=jJRSACQ_AboutYou_AA;u11=;gtm=45fe3ag0;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;epver=2;~oref=https%3A%2F%2Fwww.citicards.com%2Fcards%2Fcredit%2Fapplication%2Fflow.action%3Fapp%3DUNSOL%26ID%3D3001%26HKOP%3D2de94b05869e4857c38ba3a5df71418d5ccbea5e43605c020c419744dbe79b6c?

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=DC-6260004

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.38 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s04-in-f6.1e100.net

Software

cafe /

Resource Hash

41f4d6d494b581ae3554484389e33593f9f47538bf4932c84af5e24dbe22294f

Security Headers

Name	Value
Strict-Transport-Security	max-age=21600
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.citicards.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, must-revalidate
content-encoding: br
content-length: 440
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Tue, 17 Oct 2023 22:13:35 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
pragma: no-cache
server: cafe
strict-transport-security: max-age=21600
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

Redirect headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, must-revalidate
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Tue, 17 Oct 2023 22:13:34 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
follow-only-when-prerender-shown: 1
location: https://6260004.fls.doubleclick.net/activityi;dc_pre=CO34zauN_oEDFQ6Tmwod-7sB4w;src=6260004;type=appli0;cat=aaadv000;qty=1;cost=1995.27;ord=1746401848952.357;auiddc=583581942.1697580813;u1=093;u3=null;u4=jJRSACQ_AboutYou_AA;u11=;gtm=45fe3ag0;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;epver=2;~oref=https%3A%2F%2Fwww.citicards.com%2Fcards%2Fcredit%2Fapplication%2Fflow.action%3Fapp%3DUNSOL%26ID%3D3001%26HKOP%3D2de94b05869e4857c38ba3a5df71418d5ccbea5e43605c020c419744dbe79b6c?
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
pragma: no-cache
server: cafe
strict-transport-security: max-age=21600
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H/1.1 200
OK /
servedby.flashtalking.com/spot/26288;133248;14791/ 42 B
342 B 42ms
11ms Image
image/gif 23.212.202.173
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://servedby.flashtalking.com/spot/26288;133248;14791/?spotName=00_Citi_Cards_Application_All&U11=https://www.citicards.com/cards/credit/application/flow.action?app=UNSOL&ID=3001&HKOP=2de94b05869e4857c38ba3a5df71418d5ccbea5e43605c020c419744dbe79b6c&U4=jJRSACQ_AboutYou_AA&U1=093&U3=undefined&U2=null

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

23.212.202.173 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-212-202-173.deploy.static.akamaitechnologies.com

Software

prod-xre-app8.frk11 /

Resource Hash

47043e4823a6c21a8881de789b4185355330b5804629d23f6b43dd93f5265292

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.citicards.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 17 Oct 2023 22:13:34 GMT
Strict-Transport-Security: max-age=86400
Server: prod-xre-app8.frk11
Content-Type: image/gif
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Length: 42
Expires: Tue, 17 Oct 2023 22:13:34 GMT

GET
H2 200 / Show response
citi.bridgetrack.com/track/citicards/s/ 0
698 B 176ms
130ms Script
application/x-javascript 35.190.22.40
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://citi.bridgetrack.com/track/citicards/s/?pid=093WE&docid=DD_AppPage&app=UNSOL&appId=0&type=CONSUMER&r=7469379890544.6875&ProspectID=null&sc=A4XEC1
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.190.22.40 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 40.22.190.35.bc.googleusercontent.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.citicards.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Tue, 17 Oct 2023 22:13:34 GMT
via: 1.1 google
p3p: CP="NON DSP COR DEVa PSAa IVAo CONo OUR IND UNI PUR NAV DEM LOC", policyref="http://citi.bridgetrack.com/w3c/p3p.xml"
content-type: application/x-javascript
cache-control: private
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Mon, 16 Oct 2023 22:13:34 GMT

GET
H3 200 a
www.googletagmanager.com/ 0
11 B 24ms
24ms Image
text/html 2a00:1450:4001:806::2008
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.googletagmanager.com/a?v=3&t=l&pid=143669077&rv=3ag0&u=AAAAAAAAAAAAACCA&h=Ag&gtm=45fe3ag0&ccid=_DC-6260004&cid=DC-6260004&l=DC-6260004.L5737.S2.Y79.B0.E1584.EC7.TC1.HTC0~gtm.init.S0.V0.E77~gtm.js.S0.V0.E162.TS5rep.TI1.TE0~gtm.dom.S0.V0.E85~*.S0.V0.E32~*.S0.V0.E25~gtm.load.S0.V0.E13~gtm.init_consent.S1.V0.E78

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.citicards.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Tue, 17 Oct 2023 22:13:34 GMT
server: Google Tag Manager
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
x-xss-protection: 0
content-type: text/html

POST
H2 200 s32093457020871 Show response
metrics1.citi.com/b/ss/citiuscombprod,citicitiuscombprodtest/1/JS-2.23.0/ 43 B
462 B 23ms
23ms XHR
image/gif 63.140.62.164
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://metrics1.citi.com/b/ss/citiuscombprod,citicitiuscombprodtest/1/JS-2.23.0/s32093457020871

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

63.140.62.164 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

ip-63-140-62-164.data.adobedc.net

Software

jag /

Resource Hash

55c9d2f019f9d7ddfd69b2ad0351c5617338a222362aebb02b3b98a4dbc18486

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.citicards.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

date: Tue, 17 Oct 2023 22:13:34 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
p3p: CP="This is not a P3P policy"
content-length: 43
x-xss-protection: 1; mode=block
pragma: no-cache
last-modified: Wed, 18 Oct 2023 22:13:34 GMT
server: jag
etag: 3645527040359497728-4617846877989972354
vary: *
content-type: image/gif;charset=utf-8
access-control-allow-origin: https://www.citicards.com
cache-control: no-cache, no-store, max-age=0, no-transform, private
access-control-allow-credentials: true
expires: Mon, 16 Oct 2023 22:13:34 GMT

GET
H2 204 r.rnc
data.privacy.ensighten.com/privacy/v1/b/ 0
106 B 11ms
10ms Image
text/plain 3.124.173.63
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://data.privacy.ensighten.com/privacy/v1/b/r.rnc?n=1&c=1129&i=5gxb4r&p=na_prod&s=15806&d=8HB7InZlcnNpb24iOiIxLjAuMCIsImdhdGV3YXkiOiIyLjMuNjExIiwiY2xpZW50SWQiOjExMjksInB1Ymxpc2hQYXRoIjoibmFfcHJvZCIsImluc3RhbmNlSWQiOiI1Z3hiNHIiLCJwYWNrZXQiOjEsIm1vZGUiOiJlbmZvcmNlWgDwCG9va2llcyI6eyJCQU5ORVJfTE9BREVEkQDyJyJ9LCJlbnZpcm9ubWVudCI6IkNCT0wgUHJpdmFjeSIsInJlcXVlc3RzIjpbeyJkZXN0aW5hdM4A8TpodHRwczovL2RwbS5kZW1kZXgubmV0L2lkP2RfdmlzaWRfdmVyPTQuNC4wJmRfZmllbGRncm91cD1NQyZkX3J0YmQ9anNvbiZkKAASMggA8FBpZnk9MSZkX29yZ2lkPTYxODM0RDlCNTIyOEE3NDMwQTQ5MEQ0NSU0MEFkb2JlT3JnJmRfbnNpZD0wJnRzPTE2OTc1ODA4MTIzNTgiLCJ0eXBlIjoieGhyIiwic3RhciMBCCQAAP4AAHMBChQAUHNvdXJjOQDBWEhSX01BTkFHRVIiQQDRdHVzIjoiYWxsb3dlZB8BQGFzb24eAdRdLCJkYXRhUGF0dGVyEgCybGlzdCI6W10sImlmAM81NjMyNjcxOTkyfSxQAcAfOVABAD85LCJQAVAfM1ABB_EDd3d3LmNpdGljYXJkcy5jb20vCgD2CC93di93ZWxjb21lL2pzL2Jjc2lkLmpzNgJic2NyaXB0-AEZcjkCPTQxM-kANzQxNOkAMW11dCcDok9ic2VydmVyQ0xIAAJAAj9sb2E9AiGvODgzMDQ3ODIzMO0ALY9jaGFpbnNhd_AAFh408AAvNTPwAE2POTU0MDkwNDDwAC9CbmV3V-sBTy5taW72ABQ9NTgw9gA_NjE29gBOjzA5NjI4NjQ35gEI8gBuZXh1cy5lbnNpZ2h0ZW7VAlJpdGkvbigGEy92AvAWb21wb25lbnQucGhwP25hbWVzcGFjZT1Cb290c3RyYXBwZXImc6oCMGNKc2oGHz1ZAA5jY29kZS8mnQbxFWVkT249VHVlJTIwT2N0JTIwMTclMjAyMDoxMDoyNCUyMEdNVBEAQjIzJkPgBiBEPd8GgSZQYWdlSUQ9QwadJTNBJTJGJTJGqQMxJTJGqwMACADhcmVkaXQlMkZhcHBsaWNdA6AlMkZmbG93LmFjkgYgJTMcAP9aJTNEVU5TT0wlMjZJRCUzRDMwMDElMjZIS09QJTNEMmRlOTRiMDU4NjllNDg1N2MzOGJhM2E1ZGY3MTQxOGQ1Y2NiZWE1ZTQzNjA1YzAyMGM0MTk3NDRkYmU3OWI2YyIsInR5cGUiOiJzHQQIHjE3AiczMTcCz2luc2VydEJlZm9yZRcEMK85NzIzOTczNzU4FwQHD9gBDg8xAv9rHzIxAgwPTgZCBTcCHzk3AgeBbWV0cmljczFABwFmBA_eCQ9PQSZtY74JFxBt5gn6FjkyMTU4NDkyMjQwNzc2MzkxMDM2NDc5MjczODIwNDI3MDg5MTPgCSA2NTULA40DD-AJBC82NYoDAAAUAA-QCEevODc2MzYzMTI2NFUB_10NPAYD5QkRYzgG5y9kaXNwbGF5dGVybXMvNQYQPxkGHz0XBi1RJmFwcD13BvYPJmVtYmVkVE5DPVkmSkZQX1RPS0VOPUJXSlZPNEZOXAoPsgIELjc4CwQBFAAPsgJHnzc2MDUwOTYzM7ICCA9dAf9LAZsMMm9ycKoCAIgHwWljLnR0Lm9tdHJkY1MP8gJyZXN0L3YxL2RlbGl2ZXJ5Py0QHz07AAFAJnNlc28Q8xVJZD04ZTJmOTczYzQzOWY0YWFiYWRjNjhhZTg2ZDM0ZDAxYSaaEH89Mi4xMC4yngIOPTgzNakGKDgzEQsPMA8-nzgwMjgxMzM5NuANCA8GAQEPQQGFHzZBAWYP3wMIDx0KDgH1C_AaYzQ2NzJkODBmMDQ0MWEwNjdjNjM0OTgxZTFhYTU3ZjguanM_Y29uZGmNC7ZJZDA9MzM4MTY5NlcCD1EPBy42MToQPzg1MjQLR581NTMzNzczMzg0CykPFwFPAAkUImVuOxID2RIKFwEPGgpCBB0BHzkdAS79ETJhNmRlYTJiNmM4NTFhOTRmMzFhZTM3Y2U3MWM4MWJhNAJvNDc1ODE3MwISHjKeDyg5MoQRD2cNPK84MzkyMjYyMjEx2wkHD0oDEw8WAUoOSQMKFgEPMgJCBBwBHzK0ECkBTwPwEDdjOGFlMWY5YzIwNjkzMDAyODY3Mjk0OWM2NzAzZjaiEwpmBH80ODQ5OTYzMwKCnzc2MTA3NDcwNBcBjA80AmIFHQEPgA4ID1ADE_4RMTU0YzBiNzhmMGVjNWJjZGFkMzc4OWIyOWNiOTZlYjFmBHc5MDU1NzYmrwYxMT00FQAYNxUAEzIVABg0FQATMxUAHzVzAhIP2QYACpADD6YEPZ8yNjc4MDc1MTWmBC0PVgGJDxgHAApWAQ_mBEMDXAEfMlwBLv4RN2MxMWM5NjcwZmNmMjNiNTViZjQwYmQyZGNhZDVkZmWyAmg4NzcyODiIAjExPTQVABg5FQCYMj0zODM0ODkzFQCYMz0zODExOTIyFQASNCoAGTgVABI1VAAZOWkAEzYVAAlpABI3FQAZNhsDEzhUAB80GwMSD8EHAh819AlHrzkzMTI4MzU3OTcbAy0PvwHzDzYGAQi_AQ-EA0IDxQE_ODA2xQEt_xBlMDkyODI0OWMyNDA4MTBjZTJmMDM2YzBmMzM3ZTE0aggATzU1ODL2BRMeMnkUKDkyHAEP9gU8nzU2Mjg5MTA1NlceCA9MBxMPFgFKDzICYgQcAQ9QGyoBnAr-ETM4ZGQ4MDVjM2Q1N2QyY2EzOGQxMjJiOTBmZTM2YTkwtgVANzU4M_EhA6gWDwEPCA8yAl1_NzQyOTAxOFkRCg8yAhMPFgFKDzICYgQcAR836g0u_hFiMzUwNWFhZjIzNzFkZjNhN2I1MDJlY2Y0NzQwMWNhOTICRzYyMTOKEw8yAnhAODUwMZkeHzN6BS4PFgFKDzICYgQcAR80ZhMu_hFmMGRiMWNmNDQ5NmM4YjQyYzVhMWIyZmE0MGI0ZjE1NzICbzg5NzA5OXIJEw5eGD85MjdyCUefNTUxMzAxNTYyMwIuDxcBSw80AgEIFwEPyghCBB0BHzPbFggPggUT_xBjNjVhMzYwOWUxYmVlZDcyOTU1Yjg4YWZhYzhjZDMxyggARzgwODhAHQ9mBAkPMwJcnzYzMjU4MTY2M3wULg8WAUoPMgJiBBwBHzSADi7-EGY3NzAzYmE3NTAzNGVhYjJjMWMwMGJhZDA1NWZhYjLMF2k0ODgyNzcXDgCADgAVAAsyEREx8xIJFQAiMz0VAAk_AJg0PTEwMjA0NzCVDhI1FQAZNmsOEzYVAAk_ABM3FQAPLBYUD8YCXI84MjQ1OTQ0NpALLw-qAd4PWgNiBbABD4wULv8RMDFhZjc3OGI5ZGQ5MzE0NWIzZTE0MDA0ODU5NjgxNjPABwBPNjUyNDIRFA53Kg_AB0qfOTI0Mjg4MDI11wguDxcBSw80AmIEHQEfNt0XLv8QOGRlZjAyZGQ4YTNiNmRiMTNiZDYzNTE5ZTVkODcxMPQJAUk0MTA0JQUAjgUAFQAJ-RNAMj00OBUACaUTEzMVAA-ZHRMfMnMCXJ81NTAzOTYwNjkzCi4PVgGKD7ICYgNcAS83MCYSL_8NZDE0MDJiZTI3M2IwMDllZGU5ZDViODVhMWE1N3IZAgA8Ew9yAigfOKUMR483MjA1OTg5MxcWLx9lFgFJDzICAQgWAQ-kDEIDHAEvNDCkDC7-ETkzYmQxMTczZTAwNGM1ZjE0YzhjMzEyNzc0YTE3N2Q2GAdfOTM2NjOlDBQOnzAoOTIdAQ9vFT1vOTkwNzc3pQQwDxcBSw80AmISNR0BLzcwPhMu_xBjODRiZmFlNzk5YzBiNTdiY2ExOTVhNGNmNjU4N2M32B0ASTgyMjDRGgDXHV8xNjU0OCAREw9IAl2PNzQxMjQyNjFgCS4PKwFfD1wCYwQxAQ-oCy7_EGQ5OTc4ODJkZjBlMzJhODBmZTI4Nzg4NjQ2OTE2Yjk0EQBPMDY0N8IGFA4nKQ-PBEqfNzc3ODM4MDkwFgGLDzICYgQcAR8xwgYu_xBhOTYwN2JiZWIyZTZlMDZjMDc4MDFkNDc0NTkwMDc5zBcATzg2NzWgEBQPeQQAHzP_KEifODcxNTMzNTA0ZgsuDxYBSg8yAgAfM3Y4TtA4NzE1MzM1MDUxfV19
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 3.124.173.63 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-124-173-63.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.citicards.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Tue, 17 Oct 2023 22:13:34 GMT
cache-control: no-cache, no-store
server: nginx
expires: Tue, 17 Oct 2023 22:13:33 GMT

GET
H2 204 r.rnc
data.privacy.ensighten.com/privacy/v1/b/ 0
106 B 10ms
9ms Image
text/plain 3.124.173.63
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://data.privacy.ensighten.com/privacy/v1/b/r.rnc?n=2&c=1129&i=5gxb4r&p=na_prod&s=15790&d=8HB7InZlcnNpb24iOiIxLjAuMCIsImdhdGV3YXkiOiIyLjMuNjExIiwiY2xpZW50SWQiOjExMjksInB1Ymxpc2hQYXRoIjoibmFfcHJvZCIsImluc3RhbmNlSWQiOiI1Z3hiNHIiLCJwYWNrZXQiOjEsIm1vZGUiOiJlbmZvcmNlWgDwCG9va2llcyI6eyJCQU5ORVJfTE9BREVEkQDyJyJ9LCJlbnZpcm9ubWVudCI6IkNCT0wgUHJpdmFjeSIsInJlcXVlc3RzIjpbeyJkZXN0aW5hdM4A8hNodHRwczovL25leHVzLmVuc2lnaHRlbi5jb20vY2l0aS9utQDwIC9jb2RlL2E4NjExYTgwMDExZWExYzRlYjNlNzNlMzk5NzU0NWM0LmpzP2NvbmRpXgDHSWQwPTQ4NzYzMTUmFQATMRUAGDMVABMyFQAYNhUAgDM9NDkwMzczbgHwBXR5cGUiOiJzY3JpcHQiLCJzdGFyKwHANjk3NTgwODEyNjI1BgEAewEFFACgOTMzLCJzb3VyYzwAwmluc2VydEJlZm9yZUIAoXR1cyI6ImxvYWQlAUBhc29uJAHUXSwiZGF0YVBhdHRlchIAsmxpc3QiOltdLCJpZADPODI1OTM4MjQ3OH0sVgHIHzlWAQwxbXV0TAKvT2JzZXJ2ZXJDTFwBOC84MlwBLf8RMzE1YTllN2FhNDBhNjcwZGYxMmE0ZTU1OGJjNjMxYTmyAgRPNCIsInMCEB82HQEMD3MCPZ8wNzkyMDgyMjQXAYovMzAXAQwPNAJDBB0BD5ADLv4RZjEyMDQ0OWRjZGI4NGMzYjZkMGY1OGM4Yjk4YWQ4YTM0Al82NzI5OTMCEw-mBAEfNqYESJ82MDg5ODIzMzUzAi0PFgFKD2YEAQgWAQ8yAkMEHAEfORwBLf4RNTAxMTc1MTI5MDgzZDY5NWI0MzNkNDBlNDNkY2Y0ZGQyAl85NTEzMNkGFB83TwMACB0BD2YEPJ82Mzg5MzExNjVmBC4PFwFKD2YEAggXAQ80AkIFHQEfNzQCLf4RZmFiNDRiMTI5ZjU3MWRiOWEwNWY2M2E3MTVhZWM3ODg0Al81ODYzNmYEEw8zAlyfNzA2NTQ0ODg3FgGKDzICYwQcAS84MDICLf4QNmE3YzAxNDVmZmFiMDhmMTQ5Y2UwZWFmYWMwZDFmOWYEeDE0MDcyMzdUCyAxPRUAODMzMhUAETIVACsyM34LACoAODIzOSoAETQqACkzMhUAETUVADgyMzQqABE2FQA4MzMwFQASNxUAGTKTABM4FQAPDgUUD3QJAR83QQdHnzU4NzAyMjU5OCUGLg-_AfIPhAMCCL8BD7YFQgTFAS85M4QDLf0RZTZiOWZlMWY5MjBlZmNjOWVhOGU3ZTYwNGI4OTdjOGO2BX8zMDEzMzM3twUnHzjcAkevNjUwNTgyMTI1MRcBig80AgIIFwEPNAJCBR0BDwcJLvAANjllZDY3MzdmODFiNzJkTQTdZTliZjE4MDI1ZTQyMTQCXzQ1NDc4MwIUHzgdCgAIHAEPHQo8nzg2OTUzOTM4NJoPLg8WAUkPMgJjBRwBDzICLv8RZjc5YWU3NDUyNjRiNDNmM2ZhYWFiODdiZjNjZGI3NWIyAgA_NTg5MgKDnzYxMjM0MTI3MAAJLg8WAUkPMgJjBRwBD04DLv4QMGIwODc1ZDBiYzA3YzFlMThhNTYwMjM1MjNiMjI4M5gGWTQ4NjY3xwkAmRVINjY3OLEJAJgVOTY2N7AJIDM9PAAZMUIKETQUABkyFAASNRQAGDFQABI2FAALFQoAUAAZODwAETgoABk4PAASORQACTwAEDFjFjo2NjliFgLKABk5kAoSMcsAGTlTABIxzAAKkAoTMc0ACQ4LEjHOABo5fgADzwAKaQAQN6gAKTcw4BYRMdEAKjcwfgAB0gApNzBUABMy0gAJmwETMtIACYgBEzLSAAmoABEy0gAqNzAqAAHSACo3MCoAAdIAKTcwOwERMtIAKTcw0gASMtIALzEyxQgTD5IGAC80MMUIR581NjY0OTg5NDahCy4PRAP__3kPjgYBCUQDD_IKQgRKAx83DwwIcG9ubGluZS4bHAEkHABqHPECL3RhZ2dpbmdUcmFuc2Zvcm0RGgQWAD8uanM4BBEvNzEEFgAYNNAToGFwcGVuZENoaWyvGz9zdGG_GyqfNjY2MTc1MzQwLxgID-0ARj44MDG3CwntAA_hAUIE9AAfOYsJLv4RYTU3ZWJkMDc4MjExYjE2ODA5OTk2OGVlMDk3YWE5OTKhCl8yMTkwOAkCET42MjMcAS82MUEGSI84Mjc1NzQ3NBYBiw8fAwAJFgEPMgJCFDUcAR82IhAHAQwEsGRlbWRleC5uZXQvYSDxATUuaHRtbD9kX25zaWQ9MCNnIMElM0ElMkYlMkZ3d3dCBFBjYXJkc0cEBhgCU2lmcmFtnx8L4R8vNDQYAgwPIQQ7nzk1NDk4MjkwNzobCA_7AFUvNjL7AAwP_QFCBAIBDzYTCfQCY29udGVudDIyLmFjY291bnQ0BVBvbS9mcAQGEHMMBPAEb3JnX2lkPTg5b2VicTVrJnNlc08jABQA8EJkNzNiYWRmYjYyOTE1MTJiOWYxZDQzZmZkMThlMWY4ZjI1MTk2MzY5NzBjMjdjYjU4ZGZkZGY1MTY2ZDliNjlhJmFsbG93X3JlcHJvZmlsZT2JIw-8Hw4vNzeJHQAnODJmBA9OAjufNTg5OTI1NDI4TgIJD0wBpC84MJ8CAAlMAQ-fAkIDUwEvMzE9DwjhbWFwcy5nb29nbGVhcGlsBBAvFABBL2FwaQkA8Ahqcy9nZW5fMjA0P2NzcF90ZXN0PXRydYIEA0QCMnhoctIiCo8ELzk55iAAABQABXAkslhIUl9NQU5BR0VSQQACsAgBrwIQZcMIL3JlciQbjzcxNTM2MDkzswgJAN0AD_EARQ-0CAAYOZgHD_EARw_bDQgP8QAK9jxqcz9rZXk9QUl6YVN5Q09fMFZOaEtuNE9qbEpfcDVyUTV1TEtlNGg3V0F5WTBjJmxpYnJhcmllcz1wbGFjZXMmbGFuZ3VhZ2U9Z2KjBg-EJgctNze7CDgzMDD8Dg9VBDufNjUzODIzODU31xgIDyABeQ8pBAALIAEPKQRCAycBLzYwKQQJ8QRib3hlZGdlMzcudHQub210cmRjzgjyAnJlc3QvdjEvZGVsaXZlcnk_5CkQPfsHoGNvcnBjcmVkaXT8JiRpY9cG8xVJZD04ZTJmOTczYzQzOWY0YWFiYWRjNjhhZTg2ZDM0ZDAxYSZRKmc9Mi4xMC5aEQ9vBAMgMzDsCSJlbnsoAvMoAhQAD28ESI80MTI1ODE0NiINCB9tNwH_JAABCwKWBqB0YWdtYW5hZ2VyCAv_Bi9ndGFnL2pzP2lkPURDLTYyNjAwMIwoEi05Mx4LODMxOFkdDwkaPJ82MDk5NTQ2NDI2DQgP5wBBDbcJC-cAD0IEQwTtAA8aEQiSY2RuLmdicW9mZggAIARALW5hLfIt_wQvcC9kZXRlY3Rvci1kb20ubWluFhEULTkzyiM4MzIydQcP8ABCUDczNzk5uBkPyhoID1kGBXEtYXBpLXYzYgn_C2pzLzU0LzEwL2ludGwvZGVfQUxML2NvbW1vAQEWHzkBAQAJXAoPUwc8fzY1NzkwMTFOFgkP-gBVDfIPKTMy-gAP-wFCEzYBAQ8FFAmRYzEucmZpaHViIgdfanMvdGPUAhkdMsMjODMzMqsED9kAQp83OTk5NTkwMjgtCSAP1AIOT3V0aWzTAxUdOSEZIDMzvgUFygcP0gI7nzcyMDcxNDU3MvgAbg7QAgr4AA_3AUME_wAPywRDUG50cm9s4xAPIAwRHzn7AQIP5BZHnzU2ODE3Mjg5NpcpCA_NBCgP_AAcD_8BAQj8AA__AUIFAwEPxQoJDyUQBA_2Aw4CJg5PX2ltcP0DKhg00AcP_QM7nzY5NDI5MTgxOMAVCA8CAiYP_wAhDwUCAAn_AA8FAkIFBgEPCAMID6wKF3A5MzIyJmw9IzavTGF5ZXImY3g9Y_8DED4zMTi9Chk19hkPpAs8nzg4NzIxNDQ2MvkOCA_4AFIO8QcK-AAP9gFCBf4AD_kGCA_-ABZfNTY3MTD2ATYvNjCjJ0ifNzE4NDUwMDU1-ABtDvYBCvgAD_YBQgX-AA_wBwgP9gEVXzQxNTgx7AM3EDbjHgXmCQ_sAzxgNjYyMjAw8yUPqhsHD_gAUg_2AQAJ-AAP9gFC0DY2MjIwMDAyMzZ9XX0
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 3.124.173.63 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-124-173-63.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.citicards.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Tue, 17 Oct 2023 22:13:34 GMT
cache-control: no-cache, no-store
server: nginx
expires: Tue, 17 Oct 2023 22:13:33 GMT

GET
H2 204 r.rnc
data.privacy.ensighten.com/privacy/v1/b/ 0
106 B 10ms
10ms Image
text/plain 3.124.173.63
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://data.privacy.ensighten.com/privacy/v1/b/r.rnc?n=3&c=1129&i=5gxb4r&p=na_prod&s=8782&d=8HB7InZlcnNpb24iOiIxLjAuMCIsImdhdGV3YXkiOiIyLjMuNjExIiwiY2xpZW50SWQiOjExMjksInB1Ymxpc2hQYXRoIjoibmFfcHJvZCIsImluc3RhbmNlSWQiOiI1Z3hiNHIiLCJwYWNrZXQiOjEsIm1vZGUiOiJlbmZvcmNlWgDwCG9va2llcyI6eyJCQU5ORVJfTE9BREVEkQDyJyJ9LCJlbnZpcm9ubWVudCI6IkNCT0wgUHJpdmFjeSIsInJlcXVlc3RzIjpbeyJkZXN0aW5hdM4A-GRodHRwczovL3d3dy5nb29nbGV0YWdtYW5hZ2VyLmNvbS9ndGFnL2pzP2lkPURDLTYyNjg4NTgmbD1kYXRhTGF5ZXImY3g9YyIsInR5cGUiOiJzY3JpcHQiLCJzdGFydCI6MTY5NzU4MDgxMzE4NiwiZW5kFACgNjMxLCJzb3VyYzwAMW11dJgAok9ic2VydmVyQ0xIAKF0dXMiOiJsb2FkzQBAYXNvbswAMF0sIoYAZFBhdHRlchIAsGxpc3QiOltdLCJphwHvNjk2NjkwNzU3NDQ2fSz-AAXxATIwNzY2Njk5cC5yZmlodWL6APQRY2EuaHRtbD92ZXI9OSZyYT0xODIyJnJiPTY0OCZjYT01APAhJl9vPTE3MTY5MTc1Jl90PWNpdGliYW5rb25saW5lY29uc3VtZXJjYXJkZW50ZXJp1AERbegA4CZfcmV2PTEmX3Bjb2RlCQDxBW9yZGVyaWQ9MSZzc3ZfY3V1aWQ9CwDCcGFja2FnZT1udWxsEQAwcm9k7AAHEgB_YWdlbmFtZYEAGTFwZT0CApAlM0ElMkYlMkYIAgDBAACvABBzBwExJTJGDAAACADhcmVkaXQlMkZhcHBsaWPDAKAlMkZmbG93LmFjUQIgJTMcAPZoJTNEVU5TT0wlMjZJRCUzRDMwMDElMjZIS09QJTNEMmRlOTRiMDU4NjllNDg1N2MzOGJhM2E1ZGY3MTQxOGQ1Y2NiZWE1ZTQzNjA1YzAyMGM0MTk3NDRkYmU3OWI2YyZwZj0mcmE9MjEzMzgzMzMwNTA0ODA1MTiEAmJpZnJhbWU8AgqEAjAzMTksAwIaAhI3mAI3Njc1hAKzaW5zZXJ0QmVmb3JCAA9-AiqvNzQ2NDA4NzU0MH4C__IvMjF-AgwPAgVCBYQCHzKEAgfwFDEuYTc5YWI5NWMxNTg5YTEzZjhhNGNhYjYxMmJjNzFmOWY3DgQSL98FIHMvyQbBL2Nyb3NzZG9tYWluKwUPggMRPTEyMAQBNzc2NIIDsmFwcGVuZENoaWxkwwMPgQMqrzY1OTI0NjE0MjT9AHIfMv0ADA8BAkIFBAEPAwcI_xQxLmI0MDY5MjlhY2FiYWM5YjA5NWYxMjRjODFiZGZjZjU3ZgECNQ4FAyg3OAcIDwECO681NzM3NTU1NjM3AQIJD_0AVg8BAgAJ_QAPAQJCBQQBHzgEAQn_EmM4MTM1ODg1OTEyMTU4M2I3YWRmMmFjZTg5Y2IzOWY0NAECSR8yAgRGnzkzMzgyMTU1NQIECg_9AFYPAQIBCP0ADwECQgUEAR81AQIH8QBuZXh1cy5lbnNpZ2h0ZW7tAQALCiIvbrgM1i9Cb290c3RyYXAuanPrBQISBgKqBQptCT43ODTuBAAUAAXxC4lpbm5lckhUTegLYGFsbG93ZfwFL3Jl6wsbnzU5MTEwODk4Nm0JCA3hChEv3wr_ES93di93ZWxjb21lL2pzL2pxdWVyeS0xLjEyLjQubWlu8wCFrzgwMjg5MzIwNzHZAQcP8wATQm5ld1cBAQ_wAImfOTA5NjI4NzY3zQMIsWxpdmUucmV6eW5jxQLwPnN5bmM_Yz0xNmI2NDEwNDMxYjYzNzRlNzgwMTA0YWJiMDQ0M2NhOCZwPTdlMzIzMjJkZTM5OGY3YTgwZjZkYTBlZTFjZWM5YTliJms9EgMA3g31Ai1waXhlbC00NjQ2JnptcElEdw0PGwMRPTIyOBsDPzg5OQQFRp84MDc5NDQzNDIBBggPNwGRAC8QGmVDEAo3AQ8-BUIEPgEfM2UDCBhhOxDwBGlkci5qcz9fY2FsbGJhY2s9alFQBPADMTkxMDA0MDQzMzMxNTIyOTAyOBAVXyMReDI1OTAmXz0QAABWEh90WhENLjg5TgI3OTYwTgIPFwFDfzQ4MTM0NThaEQnwAnBlb3BsZS5hcGkuYm9vbXRyLAwAWBIQaQ4RwGlmeS9yZXNvbHZlP8sR_5o9ZXlKamIyOXJhV1VpT25zaVluTnBiaUk2SWlKOUxDSnhkV1Z5ZVhOMGNtbHVaeUk2ZTMwc0ltVjRkR1Z5Ym1Gc1gybGtjeUk2ZXlKNmVXNWpJam9pTlRBek5tUmpaVEl0WlRjeFlTMDBNVEJpTFdFM05qVXRPR1pqTVdRNE4yRXpZV0kxT2pFMk9UYzFPREE0TVRNdU5USTFNalU0SW4xOSZzaXRlX2lk7QMAP3hocgUHARA5XhALswIBFAAFBQeyWEhSX01BTkFHRVJBAALwDA8HByefODU1OTM4Mjc5rwIID5gB8A6OFDc5NzY0Aw-YAUcPiA8IO2NkbikDVHAxM24vdgYQLw4AD6AHGA8aBAIYN2gGDxoEQwAMFU82MTUxdA0ID4ICBjBwZXLhFQQRBPAlSWtjMlYwSWpwN0luVnpaWEpmYVdRaU9pSTFNVEE0TlRVNU56TXdNelUwTXpJeU1qUTNJbhUE9H5KemFXNGlPaUpwUmpCcmVHaHdWMlJuYml0aVJqWm9aRVZYTmxWTmJYQXJaVk16TUdaTlR6WkpWbmhKZWpKeldHSlZSa1pUSzI5T2VtUlNNSG95YmpWSE9GVk5RaTlzTkdkQlJWSlVZa0kxY0RORFdETkJOREJMVDFBeFp6MDlJbjAlM0Qmc2l0ZV9pZD3AAQYcCA8vBAMApAcMGQgCFAAPLwRHnzkzMDM5ODA4MTYLCA-tAf-bb2V2ZW50c3QHAAEZAG8vdHJhY2uJAg49NjA3iQIBFAAPiQJHnzc1MTAyMjI3MyAFCAHDAA_cALynYWJvdXQ6YmxhbpcBD8QYBiA0N9oJClIIODQ3NkMQD0ETO683OTAzNjU2MTQzYw4HAA8W8A4ucmVwb3J0Lm5hY3VzdG9tZXJleHBlcmllbmNlLgEFAY0NkmdsYXNzYm94Ly4A8h5pbmcvNzk4YjJmMTItOTE2Mi00YTk0LTkxZWUtODA1ZDg4M2NhMjY2L2Nsc18zACA_XwwA8RxzPWE2NDBmZDk4LWEwYzItNGZlOS04ODM0LThjNGZlZDcwZWNhZSUzQTAmMADxHnY9ZDg1MDkwODMtYWM0Yy00MjQ4LThmYmYtM2JhYjc1YmVhZmM5JnB2PTImZjIAUHM9dHJ1BBoDgAsPsgUEAbwUDI8BCdMTD0kIPo83NDMwNTc1OfUPCQ-SAf-Ahm1ldHJpY3MxDANBYi9zc9sJYHVzY29tYrMBECwpAwAEAAYTAPcQdGVzdC8xL0pTLTIuMjMuMC9zMzIwOTM0NTcwMjA4NyIOD6ICBC04NXMZETQUAA_LBUefNjA5NzIzOTE4chgIDxAB2sAwOTcyMzkxODZ9XX0
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 3.124.173.63 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-124-173-63.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.citicards.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Tue, 17 Oct 2023 22:13:34 GMT
cache-control: no-cache, no-store
server: nginx
expires: Tue, 17 Oct 2023 22:13:33 GMT

GET
H2 200 12.52cbbcf53287bbd2bb03.chunk.js Show response
siteintercept.qualtrics.com/dxjsmodule/ 69 KB
21 KB 33ms
32ms Script
application/javascript 104.17.208.240
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://siteintercept.qualtrics.com/dxjsmodule/12.52cbbcf53287bbd2bb03.chunk.js?Q_CLIENTVERSION=1.101.0&Q_CLIENTTYPE=web&Q_BRANDID=www.citicards.com

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.17.208.240 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

beb2f8bbbd49243623d9436e4b4ccaa979d6f5f5cf4c70ff33bc6dd93ca7a741

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.citicards.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Tue, 17 Oct 2023 22:13:34 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: br
age: 50604
cf-polished: origSize=71571
content-security-policy-report-only: frame-ancestors 'self' *.qualtrics.com *.my.salesforce.com *.visualforce.com *.visual.force.com *.lightning.force.com; report-uri https://sjc1.qualtrics.com/csp-report
edge-control: max-age=604800
referrer-policy: strict-origin-when-cross-origin
last-modified: Mon, 09 Oct 2023 17:51:04 GMT
cf-bgj: minify
server: cloudflare
etag: W/"11793-18b15905b40"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=604800, s-maxage=604800
permissions-policy: camera=(), geolocation=(), microphone=()
cf-ray: 817be3bcef570404-FRA
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept
timing-allow-origin: *

GET
H2 200 16001692.js Show response
bat.bing.com/p/action/ 1 KB
839 B 31ms
31ms Script
application/javascript 2620:1ec:c11::200
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://bat.bing.com/p/action/16001692.js

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

8ba3433664353d3f84d37a6b01dd8071bcb10b3785be81c6f89100692a4329e1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.citicards.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
content-encoding: br
date: Tue, 17 Oct 2023 22:13:34 GMT
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: B263E619C36149838A9631F2AF56CF06 Ref B: FRAEDGE2016 Ref C: 2023-10-17T22:13:34Z
vary: Accept-Encoding
x-cache: CONFIG_NOCACHE
content-type: application/javascript; charset=utf-8
cache-control: private,max-age=60

GET
H2 204 0
bat.bing.com/action/ 0
285 B 30ms
30ms Image
text/plain 2620:1ec:c11::200
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://bat.bing.com/action/0?ti=16001692&Ver=2&mid=85c801d0-675a-46f9-9d80-08647c515775&sid=69fc2bd06d3a11ee997a23f23eef3457&vid=69fc1b506d3a11ee81a2afae43a2dc7c&vids=1&msclkid=N&pi=1200101525&lg=en-US&sw=1600&sh=1200&sc=24&tl=Citi%20Online%20Consumer%20Card%20-%20Enter%20Information&p=https%3A%2F%2Fwww.citicards.com%2Fcards%2Fcredit%2Fapplication%2Fflow.action%3Fapp%3DUNSOL%26ID%3D3001%26HKOP%3D2de94b05869e4857c38ba3a5df71418d5ccbea5e43605c020c419744dbe79b6c&r=&lt=7589&evt=pageLoad&sv=1&rn=939711

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.citicards.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

pragma: no-cache
strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Tue, 17 Oct 2023 22:13:34 GMT
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 74F674678D0240509A167C70CF06943B Ref B: FRAEDGE2016 Ref C: 2023-10-17T22:13:34Z
x-cache: CONFIG_NOCACHE
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 204 0
bat.bing.com/action/ 0
229 B 37ms
36ms Image
text/plain 2620:1ec:c11::200
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://bat.bing.com/action/0?ti=16001692&Ver=2&mid=85c801d0-675a-46f9-9d80-08647c515775&sid=69fc2bd06d3a11ee997a23f23eef3457&vid=69fc1b506d3a11ee81a2afae43a2dc7c&vids=0&msclkid=N&ec=jJRSACQ_AboutYou_AA&ea=Application&ev=93&p=https%3A%2F%2Fwww.citicards.com%2Fcards%2Fcredit%2Fapplication%2Fflow.action&sw=1600&sh=1200&sc=24&evt=custom&rn=884485

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.citicards.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

pragma: no-cache
strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Tue, 17 Oct 2023 22:13:34 GMT
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: AB9F008C448544B2B7B25E04C46CC598 Ref B: FRAEDGE2016 Ref C: 2023-10-17T22:13:34Z
x-cache: CONFIG_NOCACHE
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 204 16003743.js Show response
bat.bing.com/p/action/ 0
116 B 35ms
34ms Script
text/plain 2620:1ec:c11::200
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://bat.bing.com/p/action/16003743.js

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.citicards.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: private,max-age=1800
date: Tue, 17 Oct 2023 22:13:34 GMT
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 2680088A8C8548C2A3223238FA2985F3 Ref B: FRAEDGE2016 Ref C: 2023-10-17T22:13:34Z
x-cache: CONFIG_NOCACHE

GET
H2 204 0
bat.bing.com/action/ 0
228 B 36ms
36ms Image
text/plain 2620:1ec:c11::200
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://bat.bing.com/action/0?ti=16003743&Ver=2&mid=a55c2856-f001-4f63-8a95-cfb34b175aa5&sid=69fc2bd06d3a11ee997a23f23eef3457&vid=69fc1b506d3a11ee81a2afae43a2dc7c&vids=0&msclkid=N&pi=1200101525&lg=en-US&sw=1600&sh=1200&sc=24&tl=Citi%20Online%20Consumer%20Card%20-%20Enter%20Information&p=https%3A%2F%2Fwww.citicards.com%2Fcards%2Fcredit%2Fapplication%2Fflow.action%3Fapp%3DUNSOL%26ID%3D3001%26HKOP%3D2de94b05869e4857c38ba3a5df71418d5ccbea5e43605c020c419744dbe79b6c&r=&lt=7589&evt=pageLoad&sv=1&rn=253649

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.citicards.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

pragma: no-cache
strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Tue, 17 Oct 2023 22:13:34 GMT
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: A88446F867CD4631AC8B31F37C12AD69 Ref B: FRAEDGE2016 Ref C: 2023-10-17T22:13:34Z
x-cache: CONFIG_NOCACHE
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 204 0
bat.bing.com/action/ 0
227 B 36ms
36ms Image
text/plain 2620:1ec:c11::200
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://bat.bing.com/action/0?ti=16003743&Ver=2&mid=a55c2856-f001-4f63-8a95-cfb34b175aa5&sid=69fc2bd06d3a11ee997a23f23eef3457&vid=69fc1b506d3a11ee81a2afae43a2dc7c&vids=0&msclkid=N&ec=jJRSACQ_AboutYou_AA&ea=Application&ev=93&p=https%3A%2F%2Fwww.citicards.com%2Fcards%2Fcredit%2Fapplication%2Fflow.action&sw=1600&sh=1200&sc=24&evt=custom&rn=276698

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.citicards.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

pragma: no-cache
strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Tue, 17 Oct 2023 22:13:34 GMT
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 91E418279E7E40FEA67CDAB56722569C Ref B: FRAEDGE2016 Ref C: 2023-10-17T22:13:34Z
x-cache: CONFIG_NOCACHE
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK clear.png Show response
content22.accountonline.com/fp/ Frame A63D 81 B
533 B 41ms
13ms XHR
image/png 91.235.132.220
THM

General

Check archive.org

Show headers Download Go to

Full URL

https://content22.accountonline.com/fp/clear.png

Requested by

Host: content22.accountonline.com
URL: https://content22.accountonline.com/fp/check.js;CIS3SID=1E9AE98D00C7721239A87FB1F61DDD37?org_id=89oebq5k&session_id=d73badfb6291512b9f1d43ffd18e1f8f2519636970c27cb58dfddf5166d9b69a&nonce=a16891807d617b66&pageid=1&jb=353b24246a736d773f55616e646f75712e68736f3d556b6c646f7f732530383332266a7b60773f4b6a726d6f672468736a3d4168726d6d6527303039333a

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

91.235.132.220 , United States, ASN30286 (THM, US),

Reverse DNS

Software

Apache /

Resource Hash

95518cbec0d55a574a9c8ef72a2a7d62ac0d40a4de5dfe67a76a7d214dc8b743

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Accept: */*, 89oebq5k/a16891807d617b66d73badfb6291512b9f1d43ffd18e1f8f2519636970c27cb58dfddf5166d9b69a
Referer: https://www.citicards.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

Date: Tue, 17 Oct 2023 22:13:34 GMT
Strict-Transport-Security: max-age=31536000
Last-Modified: Tue, 17 Oct 2023 22:13:34 GMT
Server: Apache
Etag: ca18ef2d88b24d7aad2ef44a7ee9251b
Content-Type: image/png
Access-Control-Allow-Origin: https://www.citicards.com
Cache-Control: private, must-revalidate, max-age=0
Connection: Keep-Alive
Keep-Alive: timeout=2, max=100
Content-Length: 81
Expires: Sun, 15 Oct 2028 22:13:34 GMT

GET
H/1.1 200
OK ls_fp.html;CIS3SID=1E9AE98D00C7721239A87FB1F61DDD37 Show response
content22.accountonline.com/fp/ Frame 7223 90 KB
14 KB 16ms
16ms Document
text/html 91.235.132.220
THM

General

Check archive.org

Show headers Download Go to

Full URL

https://content22.accountonline.com/fp/ls_fp.html;CIS3SID=1E9AE98D00C7721239A87FB1F61DDD37?org_id=89oebq5k&session_id=d73badfb6291512b9f1d43ffd18e1f8f2519636970c27cb58dfddf5166d9b69a&nonce=a16891807d617b66&pageid=1

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

91.235.132.220 , United States, ASN30286 (THM, US),

Reverse DNS

Software

Apache /

Resource Hash

4f45b25e5801efa6922954445af7c8138b81eca71fdfa356ec853fb7ce57a0c9

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.citicards.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Cache-Control: no-cache, no-store, must-revalidate
Connection: Keep-Alive, Keep-Alive
Content-Encoding: gzip
Content-Type: text/html;charset=UTF-8
Date: Tue, 17 Oct 2023 22:13:34 GMT
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Keep-Alive: timeout=2, max=98
Pragma: no-cache
Server: Apache
Strict-Transport-Security: max-age=31536000
Transfer-Encoding: chunked
Vary: Accept-Encoding
X-Content-Type-Options: nosniff
X-Robots-Tag: noindex, nofollow
X-XSS-Protection: 1; mode=block

GET
H/1.1 204
No Content clear.png Show response
content22.accountonline.com/fp/ Frame A63D 0
387 B 13ms
13ms Script
text/javascript 91.235.132.220
THM

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

91.235.132.220 , United States, ASN30286 (THM, US),

Reverse DNS

Software

Apache /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.citicards.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 17 Oct 2023 22:13:34 GMT
Strict-Transport-Security: max-age=31536000
X-Content-Type-Options: nosniff
Server: Apache
Content-Type: text/javascript
Cache-Control: no-cache, no-store, must-revalidate
Connection: Keep-Alive
Keep-Alive: timeout=2, max=99
X-XSS-Protection: 1; mode=block
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H/1.1 200
OK sid_fp.html;CIS3SID=1E9AE98D00C7721239A87FB1F61DDD37 Show response
h.online-metrix.net/fp/ Frame F027 103 KB
15 KB 60ms
16ms Document
text/html 91.235.132.130
THM

General

Check archive.org

Show headers Download Go to

Full URL

https://h.online-metrix.net/fp/sid_fp.html;CIS3SID=1E9AE98D00C7721239A87FB1F61DDD37?org_id=89oebq5k&session_id=d73badfb6291512b9f1d43ffd18e1f8f2519636970c27cb58dfddf5166d9b69a&nonce=a16891807d617b66&pageid=1

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

91.235.132.130 , United States, ASN30286 (THM, US),

Reverse DNS

h.online-metrix.net

Software

Apache /

Resource Hash

bfd58b907437a0c460a14a89e7da14cfb9f464645adbb95ed4641d5bab03913f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.citicards.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Cache-Control: no-cache, no-store, must-revalidate
Connection: Keep-Alive, Keep-Alive
Content-Encoding: gzip
Content-Type: text/html;charset=UTF-8
Date: Tue, 17 Oct 2023 22:13:34 GMT
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Keep-Alive: timeout=2, max=100
Pragma: no-cache
Server: Apache
Strict-Transport-Security: max-age=31536000
Transfer-Encoding: chunked
Vary: Accept-Encoding
X-Content-Type-Options: nosniff
X-Robots-Tag: noindex, nofollow
X-XSS-Protection: 1; mode=block

GET
H/1.1 200
OK top_fp.html;CIS3SID=1E9AE98D00C7721239A87FB1F61DDD37 Show response
content22.accountonline.com/fp/ Frame 7B34 90 KB
14 KB 16ms
16ms Document
text/html 91.235.132.220
THM

General

Check archive.org

Show headers Download Go to

Full URL

https://content22.accountonline.com/fp/top_fp.html;CIS3SID=1E9AE98D00C7721239A87FB1F61DDD37?org_id=89oebq5k&session_id=d73badfb6291512b9f1d43ffd18e1f8f2519636970c27cb58dfddf5166d9b69a&nonce=a16891807d617b66&pageid=1

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

91.235.132.220 , United States, ASN30286 (THM, US),

Reverse DNS

Software

Apache /

Resource Hash

0e5077af62072c59f889abe0718e551afa15f854da4a26e27ee2146f63472176

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.citicards.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Cache-Control: no-cache, no-store, must-revalidate
Connection: Keep-Alive, Keep-Alive
Content-Encoding: gzip
Content-Type: text/html;charset=UTF-8
Date: Tue, 17 Oct 2023 22:13:34 GMT
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Keep-Alive: timeout=2, max=97
Pragma: no-cache
Server: Apache
Strict-Transport-Security: max-age=31536000
Transfer-Encoding: chunked
Vary: Accept-Encoding
X-Content-Type-Options: nosniff
X-Robots-Tag: noindex, nofollow
X-XSS-Protection: 1; mode=block

GET
H/1.1 204
204 clear.png Show response
content22.accountonline.com/fp/ Frame A63D 0
218 B 14ms
14ms Script
text/javascript 91.235.132.220
THM

General

Check archive.org

Show headers Download Go to

Full URL

https://content22.accountonline.com/fp/clear.png?org_id=89oebq5k&session_id=d73badfb6291512b9f1d43ffd18e1f8f2519636970c27cb58dfddf5166d9b69a&nonce=a16891807d617b66&pageid=1&ja=32323a342626613f34322e7a3d3632246e3f313630327a333230382661643533343030703330323824737a7b3f327a302e6472723d332c3134323024333038302c333432302c3330323224313630322e393030302c333432302c3932303224322e302665763f63303a326360616661373f64666664643965633a343933363f3036603b633761246f6c3f3c267363663f3a36266c683f6a7674707b2533432d304425324e757575266169766b616370647b2e616f6d2732466163726c71273a466370676669742730446378706c6961637c6b6f6e253044646c6f7f2e61617c6b6d6e253b44637278273346574c514d4c2d323449442733443132303927303e484b4d522733443066673b3c6230353a3431673438353561313862693361376c64353134393a66376b61626763376736333e303763303030633633393f36366c6265353b60366324726e3f3b2670683f35306432386163346063666a6531333b603533383f6367326c316266603066362660683f6632373836303b353831363d3766376136386532336463393933393a66393563266a716d3f576966646f757b27303031382468716a3f436a706d6f67253a30333138246a736d773d5f6b6c6c6f777124687362773f416a7a6f6d65246c60613d34266c666f3d382e6e6d76783f32267472663f477d706f7267273044426d726e696e246d61766a723536323833643361306265613230673e6363353432383a3261643337373430396664363d3a3a3134396634676963323666613b36616e62663732313133333b366924667a3d687676727325314327304e25324675757f2c6369746b616372647b2e636d6527304663697066712d3046617067666b742d32446170726c69616374616d6c2d3246646e6d772e6361766b676e253344637872253344574c514f4c2d32364b4c27314433383233273a3448494d522731443a646739346030353a34396d363a3d3763313a606133633766643f3134313a663d6163626563376734333e3035613830326334393b35363c666267353b6034632e703f706c7767696c5d666463716025354764636c736723726e7d67696e5d75616c646f77715d6f656461615f7264637b65722d374764696e736723726e7767616e5d61646d62655d63637a6d60697425374764616c71672372647567696c5d797769636b766b6f65253d45666364716721706477656b665d736a6d616975617e6527354564616c716721786e776f696e5d7067616c726e637b6d7225354764696e736521726e776769665f766e6b5d726c61716770273d4766636e71672370647565696e5d646574636c7e70273d4566636e716521726e7765616e5f737465577469657767702735456e616c716d23726c756f6b6c5d62637663273747646164736726676e5f633f75656a656e5f6562454e273230332c32273a30284f726766454c2532324751253238322e322d303243687a6d6f6b7d6f29556760454e253a30454c534e25323247532d3032392e30273032284f72676c454425323047512d3030474c514e2732304d53253038332c30253a32416a7a6d6d6b776f2b55656a4b6b745767624b6b76253a32556d62474e434c474c475d6b6c7b74616e61676c5d617272637b7125334a2532324d5a565f6264676c66576f696c6f637a27334a253030455a545f616d6c67705d6a75666467705f68636e645d6e6c6f6176273b40253230475a565f66646f617657606e656e6c2731402d3030475a565d647269675d64657274682731422d30324d58545d716a616467705d766d7874757067576e6f642531402732304d58545d7c677a74757a675d61676f70706771716b6f665f60707461253340273238475a5c5f74677a767572675d616d657072657171616d6e5f7265766125334a2532324d5a565f746d7a76777a675f646b6e76677257616c69736d74726d72696b27314a253232475a545f715045402d33422530324747535f656e676f656e7c5f696c6c677a5f75616c76273b402530324d47515f6e626d5f72676e6467705f656b726561702731402532324d4751577374616c666970645f6467706b76617c6976677b273142253a324d475b5d74677a7677706557666e6f61762533402732384d475b5f74677a767572675d646e6761745f6e6b666761722531402732304745535d7c677a74757a675d6a696e665d646e6d63742d33402532324f45515d746d7a767d72655d6a636c665d646e6d69745f6c6b6c6d63722533402730304f4d535f746d7076657857637070697b5f6d60686761742d3340253232574540454c57616d646f725d6077666667705d64646f617427314a273230574740454c5f6b6f6d727a677173656c5d766770767570675d6371746b25314225303057474047445d61676d707067717365665d766770747572675d6d7663253340273030574d42474e57616d6d707a6771716d665f76677a7677726d5f6774633325334027323855474a474c5d616d6d70706771716d645f74677a7c7772655f71317663253b4225303855474247445d616d65727267717167665f7c657a747570655f7131746b5d717a67622731402532325547404f4c5f6467607d655f72656c666772657a5f696c6e6d2733422d3032554d40474e5d66677274605f7665787675726727334a273038574540454e5f647063755d6a75666667707b2733422530325545424f4c5f6e6771675f63676c76677076253140273032574d42454c5f6f756c766b5f6c70637f313624656e5f683f3164643d64666636353c3264646336323565363a6265326d353664323d373634393234663630373b267f676e763d4b6e74676e253a324b66632e2475656c723f4b6c766d6c2532324b7a6b732532324d72656e4f4c253038476c6769666724616b663d33&jb=313736246c713f4f6d78616c6c6127304e372e302530322a576966646f757b2730304e5c27303239322e32273140273238576b6e36362533402732387a343c292530324370706e6755676a4b697427304e3733372e3134273230204b4856454e2732432d30326e616965273032456763636f2b2532324368706d6d6d27304e31313a2c322e353b3b312c3f3025323251696461726927304435333f2e3334

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

91.235.132.220 , United States, ASN30286 (THM, US),

Reverse DNS

Software

Apache /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.citicards.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

Date: Tue, 17 Oct 2023 22:13:34 GMT
Strict-Transport-Security: max-age=31536000
Server: Apache
Connection: Keep-Alive
Keep-Alive: timeout=2, max=98
Content-Type: text/javascript;charset=UTF-8

GET
H/1.1 200
OK clear.png
89oebq5kfrnwu4b4b2kgnva3uss5n4odddy4rnlna16891807d617b66am1.e.aa.online-metrix.net/fp/ Frame A63D 81 B
438 B 181ms
13ms Image
image/png 91.235.134.131
THM

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://89oebq5kfrnwu4b4b2kgnva3uss5n4odddy4rnlna16891807d617b66am1.e.aa.online-metrix.net/fp/clear.png?org_id=89oebq5k&session_id=d73badfb6291512b9f1d43ffd18e1f8f2519636970c27cb58dfddf5166d9b69a&nonce=a16891807d617b66&pageid=1&di=yes

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

91.235.134.131 , United States, ASN30286 (THM, US),

Reverse DNS

Software

Apache /

Resource Hash

95518cbec0d55a574a9c8ef72a2a7d62ac0d40a4de5dfe67a76a7d214dc8b743

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.citicards.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 17 Oct 2023 22:13:35 GMT
Strict-Transport-Security: max-age=31536000
X-Content-Type-Options: nosniff
Server: Apache
Content-Type: image/png
Cache-Control: no-cache, no-store, must-revalidate
Connection: close
Content-Length: 81
X-XSS-Protection: 1; mode=block
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2 200 up Show response
insight.adsrvr.org/track/ Frame 7590 0
60 B 107ms
34ms Document
text/html 35.71.131.137
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://insight.adsrvr.org/track/up?adv=1jw5cvl&ref=https%3A%2F%2Fwww.citicards.com%2Fcards%2Fcredit%2Fapplication%2Fflow.action%3Fapp%3DUNSOL%26ID%3D3001%26HKOP%3D2de94b05869e4857c38ba3a5df71418d5ccbea5e43605c020c419744dbe79b6c&upid=hqgowpz&upv=1.1.0&id=ttdUniversalPixelTag1697580814726&td1=jJRSACQ_AboutYou_AA&td2=093
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 35.71.131.137 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a6370ebea231e0c9a.awsglobalaccelerator.com
Software: Kestrel /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.citicards.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

content-length: 0
content-type: text/html
date: Tue, 17 Oct 2023 22:13:35 GMT
server: Kestrel

GET
BLOB 200
OK 947148fc-4a7e-42fd-8255-cfb9c7839aed
https://www.citicards.com/ Frame A63D 0
0 Other
application/javascript

General

Check archive.org

Show headers Download Go to

Full URL: blob:https://www.citicards.com/947148fc-4a7e-42fd-8255-cfb9c7839aed
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

Content-Length: 0
Content-Type: application/javascript

GET
BLOB 200
OK 661400e3-8cdb-4d2d-aa9b-280894fc3ab5
https://www.citicards.com/ Frame A63D 2 KB
0 Other
application/javascript

General

Check archive.org

Show headers Download Go to

Full URL: blob:https://www.citicards.com/661400e3-8cdb-4d2d-aa9b-280894fc3ab5
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 321f8b18564a1ccb8d951eabeadef3f21fb21af23a60ffc669e248816904cf90

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

Content-Length: 1720
Content-Type: application/javascript

GET
BLOB 200
OK 24157493-0ee8-4ca8-907f-117632bba1e0
https://www.citicards.com/ Frame A63D 2 KB
0 Other
application/javascript

General

Check archive.org

Show headers Download Go to

Full URL: blob:https://www.citicards.com/24157493-0ee8-4ca8-907f-117632bba1e0
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 321f8b18564a1ccb8d951eabeadef3f21fb21af23a60ffc669e248816904cf90

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

Content-Length: 1720
Content-Type: application/javascript

GET
BLOB 200
OK 4bbd4663-824c-4fb9-bb67-4a8968827b4b
https://www.citicards.com/ Frame A63D 2 KB
0 Other
application/javascript

General

Check archive.org

Show headers Download Go to

Full URL: blob:https://www.citicards.com/4bbd4663-824c-4fb9-bb67-4a8968827b4b
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 321f8b18564a1ccb8d951eabeadef3f21fb21af23a60ffc669e248816904cf90

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

Content-Length: 1720
Content-Type: application/javascript

GET
BLOB 200
OK c67de874-dac1-45c8-b596-19c3cbe68de6
https://www.citicards.com/ Frame A63D 2 KB
0 Other
application/javascript

General

Check archive.org

Show headers Download Go to

Full URL: blob:https://www.citicards.com/c67de874-dac1-45c8-b596-19c3cbe68de6
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 321f8b18564a1ccb8d951eabeadef3f21fb21af23a60ffc669e248816904cf90

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

Content-Length: 1720
Content-Type: application/javascript

GET
BLOB 200
OK 1137aae6-6781-414f-b9b2-058f92b7cb11
https://www.citicards.com/ Frame A63D 2 KB
0 Other
application/javascript

General

Check archive.org

Show headers Download Go to

Full URL: blob:https://www.citicards.com/1137aae6-6781-414f-b9b2-058f92b7cb11
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 321f8b18564a1ccb8d951eabeadef3f21fb21af23a60ffc669e248816904cf90

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

Content-Length: 1720
Content-Type: application/javascript

GET
BLOB 200
OK 47831080-f5c2-4286-9bb2-738baa0423ea
https://www.citicards.com/ Frame A63D 2 KB
0 Other
application/javascript

General

Check archive.org

Show headers Download Go to

Full URL: blob:https://www.citicards.com/47831080-f5c2-4286-9bb2-738baa0423ea
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 321f8b18564a1ccb8d951eabeadef3f21fb21af23a60ffc669e248816904cf90

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

Content-Length: 1720
Content-Type: application/javascript

GET
BLOB 200
OK a4e12420-1b1f-4a86-825c-8ef4f2518d8e
https://www.citicards.com/ Frame A63D 2 KB
0 Other
application/javascript

General

Check archive.org

Show headers Download Go to

Full URL: blob:https://www.citicards.com/a4e12420-1b1f-4a86-825c-8ef4f2518d8e
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 321f8b18564a1ccb8d951eabeadef3f21fb21af23a60ffc669e248816904cf90

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

Content-Length: 1720
Content-Type: application/javascript

GET
BLOB 200
OK 9728097c-79fc-4682-82ca-1360d9c41171
https://www.citicards.com/ Frame A63D 2 KB
0 Other
application/javascript

General

Check archive.org

Show headers Download Go to

Full URL: blob:https://www.citicards.com/9728097c-79fc-4682-82ca-1360d9c41171
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 321f8b18564a1ccb8d951eabeadef3f21fb21af23a60ffc669e248816904cf90

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

Content-Length: 1720
Content-Type: application/javascript

GET
BLOB 200
OK bbba10d6-097f-427b-8471-647f440a0f59
https://www.citicards.com/ Frame A63D 2 KB
0 Other
application/javascript

General

Check archive.org

Show headers Download Go to

Full URL: blob:https://www.citicards.com/bbba10d6-097f-427b-8471-647f440a0f59
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 321f8b18564a1ccb8d951eabeadef3f21fb21af23a60ffc669e248816904cf90

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

Content-Length: 1720
Content-Type: application/javascript

GET
BLOB 200
OK c7c26958-6c9a-44bb-9a8c-4aa968f430f6
https://www.citicards.com/ Frame A63D 2 KB
0 Other
application/javascript

General

Check archive.org

Show headers Download Go to

Full URL: blob:https://www.citicards.com/c7c26958-6c9a-44bb-9a8c-4aa968f430f6
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 321f8b18564a1ccb8d951eabeadef3f21fb21af23a60ffc669e248816904cf90

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

Content-Length: 1720
Content-Type: application/javascript

GET
BLOB 200
OK b472c71b-6404-4af3-afba-de5a896b48a6
https://www.citicards.com/ Frame A63D 2 KB
0 Other
application/javascript

General

Check archive.org

Show headers Download Go to

Full URL: blob:https://www.citicards.com/b472c71b-6404-4af3-afba-de5a896b48a6
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 321f8b18564a1ccb8d951eabeadef3f21fb21af23a60ffc669e248816904cf90

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

Content-Length: 1720
Content-Type: application/javascript

GET
BLOB 200
OK 259e616b-7367-404a-a92e-cf8f37888f33
https://www.citicards.com/ Frame A63D 2 KB
0 Other
application/javascript

General

Check archive.org

Show headers Download Go to

Full URL: blob:https://www.citicards.com/259e616b-7367-404a-a92e-cf8f37888f33
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 321f8b18564a1ccb8d951eabeadef3f21fb21af23a60ffc669e248816904cf90

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

Content-Length: 1720
Content-Type: application/javascript

GET
BLOB 200
OK 67eff73c-ed3c-4c3d-9086-83a1032a1c45
https://www.citicards.com/ Frame A63D 2 KB
0 Other
application/javascript

General

Check archive.org

Show headers Download Go to

Full URL: blob:https://www.citicards.com/67eff73c-ed3c-4c3d-9086-83a1032a1c45
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 321f8b18564a1ccb8d951eabeadef3f21fb21af23a60ffc669e248816904cf90

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

Content-Length: 1720
Content-Type: application/javascript

GET
BLOB 200
OK 3583279b-f24c-41f0-9916-ec10f44af2fb
https://www.citicards.com/ Frame A63D 2 KB
0 Other
application/javascript

General

Check archive.org

Show headers Download Go to

Full URL: blob:https://www.citicards.com/3583279b-f24c-41f0-9916-ec10f44af2fb
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 321f8b18564a1ccb8d951eabeadef3f21fb21af23a60ffc669e248816904cf90

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

Content-Length: 1720
Content-Type: application/javascript

GET
BLOB 200
OK 31311ee7-2242-41e4-befa-29db4c6dfe4e
https://www.citicards.com/ Frame A63D 2 KB
0 Other
application/javascript

General

Check archive.org

Show headers Download Go to

Full URL: blob:https://www.citicards.com/31311ee7-2242-41e4-befa-29db4c6dfe4e
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 321f8b18564a1ccb8d951eabeadef3f21fb21af23a60ffc669e248816904cf90

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

Content-Length: 1720
Content-Type: application/javascript

GET
BLOB 200
OK 194cfcfb-ed07-4834-a630-2bce2e98e763
https://www.citicards.com/ Frame A63D 2 KB
0 Other
application/javascript

General

Check archive.org

Show headers Download Go to

Full URL: blob:https://www.citicards.com/194cfcfb-ed07-4834-a630-2bce2e98e763
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 321f8b18564a1ccb8d951eabeadef3f21fb21af23a60ffc669e248816904cf90

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

Content-Length: 1720
Content-Type: application/javascript

GET
BLOB 200
OK 89febe7e-86b4-439a-b5f4-cc30481a4712
https://www.citicards.com/ Frame A63D 1 KB
0 Other
application/javascript

General

Check archive.org

Show headers Download Go to

Full URL: blob:https://www.citicards.com/89febe7e-86b4-439a-b5f4-cc30481a4712
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 216507030d061110c3a2935edd9b9fccf5eeada2f03f5892ff7f816f4e42f2a2

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

Content-Length: 1357
Content-Type: application/javascript

OPTIONS
H2 200 tp2
p.tvpixel.com/com.snowplowanalytics.snowplow/ Frame 0
0 328ms
103ms Preflight 34.232.37.73
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://p.tvpixel.com/com.snowplowanalytics.snowplow/tp2
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.232.37.73 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-232-37-73.compute-1.amazonaws.com
Software: nginx /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://www.citicards.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Content-Type, SP-Anonymous
access-control-allow-origin: https://www.citicards.com
access-control-max-age: 600
content-length: 0
date: Tue, 17 Oct 2023 22:13:35 GMT
server: nginx

POST
H2 200 tp2 Show response
p.tvpixel.com/com.snowplowanalytics.snowplow/ 2 B
330 B 310ms
104ms XHR
text/plain 34.232.37.73
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://p.tvpixel.com/com.snowplowanalytics.snowplow/tp2
Requested by: Host: www.citicards.com
URL: https://www.citicards.com/assets/scripts/global/6c8322c7341eac98645c10e3d1d3c7ae.js?seed=AAAjpz-LAQAAFC_bMRxQoajWvZoUseb7-9M_13CDQMMWDa5kNV3LRXPZ6k5d&X-soz9htCz--z=q
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.232.37.73 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-232-37-73.compute-1.amazonaws.com
Software: nginx /
Resource Hash: 2689367b205c16ce32ed4200942b8b8b1e262dfc70d9bc9fbc77c49699a4f1df

Request headers

Referer: https://www.citicards.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36
Content-Type: application/json; charset=UTF-8

Response headers

access-control-allow-origin: https://www.citicards.com
date: Tue, 17 Oct 2023 22:13:35 GMT
access-control-allow-credentials: true
content-type: text/plain; charset=UTF-8
server: nginx
content-length: 2
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR NID PSA OUR IND COM NAV STA"

GET
H2 200 p
sb.scorecardresearch.com/ 43 B
299 B 50ms
9ms Image
image/gif 13.32.99.105
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sb.scorecardresearch.com/p?c1=2&c2=34402982&ns_type=hidden&ns_event=page_view&c6=citi-d4f85824-1351-4554-91ff-fdb56f962c5c&c7=https%3A%2F%2Fwww.citicards.com%2Fcards%2Fcredit%2Fapplication%2Fflow.action%3Fapp%3DUNSOL%26ID%3D3001%26HKOP%3D2de94b05869e4857c38ba3a5df71418d5ccbea5e43605c020c419744dbe79b6c&c8=Citi%20Online%20Consumer%20Card%20-%20Enter%20Information&c9=&rn=1697580815094
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.32.99.105 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-32-99-105.fra60.r.cloudfront.net
Software: /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.citicards.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Tue, 17 Oct 2023 22:13:35 GMT
via: 1.1 5492e1c9a06f2320204e7fcc383cff5c.cloudfront.net (CloudFront)
accept-ch: UA, Platform, Arch, Model, Mobile
x-amz-cf-pop: FRA60-P3
x-cache: Miss from cloudfront
content-type: image/gif
content-length: 43
x-amz-cf-id: _4mpc81sJGKFNVRfjW5As-xqjcTNZPeweQL9rYFrG_MmbskTlYjS-A==

GET
H2 200 p
sb.scorecardresearch.com/ 43 B
298 B 50ms
9ms Image
image/gif 13.32.99.105
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://sb.scorecardresearch.com/p?c1=2&c2=34402982&ns_type=hidden&ns_event=tx_event|store_name%3Daa_app_start%26order_id%3D093%26order_value%3D&c6=citi-d4f85824-1351-4554-91ff-fdb56f962c5c&c7=https%3A%2F%2Fwww.citicards.com%2Fcards%2Fcredit%2Fapplication%2Fflow.action%3Fapp%3DUNSOL%26ID%3D3001%26HKOP%3D2de94b05869e4857c38ba3a5df71418d5ccbea5e43605c020c419744dbe79b6c&c8=Citi%20Online%20Consumer%20Card%20-%20Enter%20Information&c9=&rn=1697580815103
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.32.99.105 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-32-99-105.fra60.r.cloudfront.net
Software: /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.citicards.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Tue, 17 Oct 2023 22:13:35 GMT
via: 1.1 5492e1c9a06f2320204e7fcc383cff5c.cloudfront.net (CloudFront)
accept-ch: UA, Platform, Arch, Model, Mobile
x-amz-cf-pop: FRA60-P3
x-cache: Miss from cloudfront
content-type: image/gif
content-length: 43
x-amz-cf-id: 8TsxoO-zSWRgwP1kIRqFNrnJ-T-4AMiClZ8o8qXKNI0xu-_7eJu-eA==

GET
H2 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/916451471/ 3 KB
2 KB 98ms
37ms Script
text/javascript 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/916451471/?random=1697580815121&cv=11&fst=1697580815121&bg=ffffff&guid=ON&async=1&gtm=45be3ag0&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.citicards.com%2Fcards%2Fcredit%2Fapplication%2Fflow.action%3Fapp%3DUNSOL%26ID%3D3001%26HKOP%3D2de94b05869e4857c38ba3a5df71418d5ccbea5e43605c020c419744dbe79b6c&hn=www.googleadservices.com&frm=0&tiba=Citi%20Online%20Consumer%20Card%20-%20Enter%20Information&auid=583581942.1697580813&uamb=0&uaw=0&data=event%3Dgtag.config&rfmt=3&fmt=4

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

31d2402686ea4dc2200bdc2dd72dcf822948af11209aac7e2def24c409637125

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.citicards.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 17 Oct 2023 22:13:35 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1440
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 196 KB
71 KB 28ms
27ms Script
application/javascript 2a00:1450:4001:806::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-960621875&l=dataLayer&cx=c

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

a12bcc01193835447bf3f5e1de68e908a07996caa8daa568085de9102d181927

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.citicards.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Tue, 17 Oct 2023 22:13:35 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 72773
x-xss-protection: 0
last-modified: Tue, 17 Oct 2023 21:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Tue, 17 Oct 2023 22:13:35 GMT

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 147 KB
56 KB 37ms
37ms Script
application/javascript 2a00:1450:4001:806::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-644574043&l=dataLayer&cx=c

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

5e1f1e49f551ec2f0e8ff30411db5758042e4086b21dca94d45ef9b7de54ef53

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.citicards.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Tue, 17 Oct 2023 22:13:35 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 57034
x-xss-protection: 0
last-modified: Tue, 17 Oct 2023 21:30:05 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Tue, 17 Oct 2023 22:13:35 GMT

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 146 KB
56 KB 22ms
22ms Script
application/javascript 2a00:1450:4001:806::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-975701947&l=dataLayer&cx=c

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

d61d13bed9c03d834de5b2f719a71a2f9bfd9df370cecc041c976c23af48365c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.citicards.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Tue, 17 Oct 2023 22:13:35 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 56896
x-xss-protection: 0
last-modified: Tue, 17 Oct 2023 21:30:05 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Tue, 17 Oct 2023 22:13:35 GMT

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 210 KB
75 KB 43ms
42ms Script
application/javascript 2a00:1450:4001:806::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-830907969&l=dataLayer&cx=c

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

30dc51fd43e4f096cba4541704d1f9923f5584706e7bc2d1574d6232ff1a64ac

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.citicards.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Tue, 17 Oct 2023 22:13:35 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 76504
x-xss-protection: 0
last-modified: Tue, 17 Oct 2023 21:30:05 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Tue, 17 Oct 2023 22:13:35 GMT

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 192 KB
70 KB 35ms
35ms Script
application/javascript 2a00:1450:4001:806::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-695231162&l=dataLayer&cx=c

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

7026b29ed15e78fd1f7e3c186b9415f30289c55f376109ec6266dd40713126ba

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.citicards.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Tue, 17 Oct 2023 22:13:35 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 71518
x-xss-protection: 0
last-modified: Tue, 17 Oct 2023 21:30:05 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Tue, 17 Oct 2023 22:13:35 GMT

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 199 KB
72 KB 38ms
38ms Script
application/javascript 2a00:1450:4001:806::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-819500023&l=dataLayer&cx=c

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

a22e2962308d2689d539f2c9cb0b270ec9a81b3d489b04e4956edd25cd6e09e9

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.citicards.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Tue, 17 Oct 2023 22:13:35 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 73442
x-xss-protection: 0
last-modified: Tue, 17 Oct 2023 21:30:05 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Tue, 17 Oct 2023 22:13:35 GMT

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 147 KB
56 KB 41ms
40ms Script
application/javascript 2a00:1450:4001:806::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-959299794&l=dataLayer&cx=c

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

5c06cbef078f814b98203312ded33c9948747a43ab43444f13d70cff9a6c7eda

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.citicards.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Tue, 17 Oct 2023 22:13:35 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 56995
x-xss-protection: 0
last-modified: Tue, 17 Oct 2023 21:30:05 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Tue, 17 Oct 2023 22:13:35 GMT

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 197 KB
71 KB 49ms
49ms Script
application/javascript 2a00:1450:4001:806::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-10955006959&l=dataLayer&cx=c

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

8d3b1521ae4ada452dfa2cd85fe4ba47b88c799cae8d5e38e613e9f46b764e62

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.citicards.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Tue, 17 Oct 2023 22:13:35 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 73111
x-xss-protection: 0
last-modified: Tue, 17 Oct 2023 21:30:05 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Tue, 17 Oct 2023 22:13:35 GMT

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 203 KB
72 KB 44ms
44ms Script
application/javascript 2a00:1450:4001:806::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-11172302925&l=dataLayer&cx=c

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:806::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

b498311bcfe208f4b1a814ca1d5242fdf5a5e24dbc68d174d1b842f6614db0e1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.citicards.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Tue, 17 Oct 2023 22:13:35 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 74129
x-xss-protection: 0
last-modified: Tue, 17 Oct 2023 21:00:00 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Tue, 17 Oct 2023 22:13:35 GMT

GET
H/1.1 200
OK cls_report Show response
prod.report.nacustomerexperience.citi.com/glassbox/reporting/798b2f12-9162-4a94-91ee-805d883ca266/ Frame A63D 8 KB
3 KB 218ms
102ms XHR
application/json 3.224.91.217
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Host: cdn.gbqofs.com
URL: https://cdn.gbqofs.com/citi-na-prod/p/detector-dom.min.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

3.224.91.217 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-3-224-91-217.compute-1.amazonaws.com

Software

GlassBox Cligate /

Resource Hash

1da5ef6664b721dddbb209dd40dff4e7841a48a0e5e501229b969e61dc65ef56

Security Headers

Name	Value
Content-Security-Policy	default-src 'self';
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.citicards.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

Date: Tue, 17 Oct 2023 22:13:35 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains
content-encoding: gzip
Content-Security-Policy: default-src 'self';
X-Content-Type-Options: nosniff
Connection: keep-alive
Content-Length: 1728
X-XSS-Protection: 1; mode=block
Referrer-Policy: strict-origin-when-cross-origin
Server: GlassBox Cligate
X-Frame-Options: SAMEORIGIN
vary: origin
Content-Type: application/json
access-control-allow-origin: https://www.citicards.com
access-control-allow-credentials: true
GB-Server: g5055
X-Robots-Tag: noindex

GET
H3 204 TagAuditBeacon.rnc
nexus.ensighten.com/citi/na_prod/ 0
217 B 12ms
10ms Image
text/plain 2600:9000:206f:5200:2:8f43:5780:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://nexus.ensighten.com/citi/na_prod/TagAuditBeacon.rnc?cid=1129&data=[-1|-1|1;358910|3277348|1;733156|3820838|1;732901|3932014|1;677895|3649354|1;732900|3815189|1;732902|3881695|1;744608|3881694|1;-1|-1|1;-1|-1|1;578278|3834644|1;552021|3913647|1;624610|3649360|1;373773|1482837|1;622672|3092996|1;553765|2555625|0;-1|-1|1;-1|-1|1;716093|3789691|1;713661|3789693|1;-1|-1|1;-1|-1|1;-1|-1|1;-1|-1|1;-1|-1|1;-1|-1|1;-1|-1|1;-1|-1|1;-1|-1|1;-1|-1|1;-1|-1|1;-1|-1|1;-1|-1|1;-1|-1|1;-1|-1|1;-1|-1|1;-1|-1|1;-1|-1|1;-1|-1|1;-1|-1|1;-1|-1|1;-1|-1|1;-1|-1|1;-1|-1|1;-1|-1|1;-1|-1|1;-1|-1|1;-1|-1|1;-1|-1|1;-1|-1|1;-1|-1|1;-1|-1|1;-1|-1|1;-1|-1|1;-1|-1|1;-1|-1|1;-1|-1|1;-1|-1|1;-1|-1|1;-1|-1|1;-1|-1|1;-1|-1|1;-1|-1|1;-1|-1|1;-1|-1|1;-1|-1|1;-1|-1|1;-1|-1|1;-1|-1|1;-1|-1|1;-1|-1|1;-1|-1|1;-1|-1|1;-1|-1|1;-1|-1|1;-1|-1|1;-1|-1|1;-1|-1|1;-1|-1|1;-1|-1|1;423185|1815185|0;534325|2547863|1;623461|3887789|1;508299|2278935|1;620980|3111290|1;494437|3724319|1;662152|3923551|1;-1|-1|1;-1|-1|1;-1|-1|1;-1|-1|1;-1|-1|1;-1|-1|1;-1|-1|1;-1|-1|1;-1|-1|1;-1|-1|1;-1|-1|1;-1|-1|1;-1|-1|1;-1|-1|1;-1|-1|1;-1|-1|1;-1|-1|1;-1|-1|1;620066|3038384|1;-1|-1|1;-1|-1|1;-1|-1|1;-1|-1|1;-1|-1|1;-1|-1|1;-1|-1|1;-1|-1|1;-1|-1|1;-1|-1|1;-1|-1|1;-1|-1|1;-1|-1|1;-1|-1|1;727452|3781592|1;-1|-1|1;-1|-1|1;-1|-1|1;-1|-1|1;363747|1205544|0;706463|3705954|1;704091|3709544|1;609397|3716549|1;-1|-1|1;-1|-1|1;-1|-1|1;-1|-1|1;486892|2929498|0;600937|2897286|1;531459|3486389|1;-1|-1|1;-1|-1|1;-1|-1|1;-1|-1|1;-1|-1|1;-1|-1|1;-1|-1|1;-1|-1|1;-1|-1|1;-1|-1|1;-1|-1|1;-1|-1|1;-1|-1|1;-1|-1|1;-1|-1|1;-1|-1|1;-1|-1|1;-1|-1|1;-1|-1|1;-1|-1|1;639140|3919833|1;507276|2366488|1;388219|1865473|1;-1|-1|1;-1|-1|1;-1|-1|1;-1|-1|1;-1|-1|1;-1|-1|1;-1|-1|1;-1|-1|1;-1|-1|1;-1|-1|1;-1|-1|1;-1|-1|1;-1|-1|1;-1|-1|1;-1|-1|1;-1|-1|1;-1|-1|1;-1|-1|1;-1|-1|1;-1|-1|1;-1|-1|1;-1|-1|1;-1|-1|1;-1|-1|1;-1|-1|1;-1|-1|1;-1|-1|1;-1|-1|1;555592|3924268|1;-1|-1|1;-1|-1|1;-1|-1|1;-1|-1|1;-1|-1|1;-1|-1|1;-1|-1|1;-1|-1|1;-1|-1|1;-1|-1|1;-1|-1|1;-1|-1|1;-1|-1|1;-1|-1|1;-1|-1|1;-1|-1|1;-1|-1|1;-1|-1|1;-1|-1|1;-1|-1|1;-1|-1|1;-1|-1|1;-1|-1|1;-1|-1|1;-1|-1|1;-1|-1|1;-1|-1|1;-1|-1|1;-1|-1|1;-1|-1|1;-1|-1|1;-1|-1|1;-1|-1|1;-1|-1|1;-1|-1|1;-1|-1|1;-1|-1|1;-1|-1|1;-1|-1|1;-1|-1|1;-1|-1|1;-1|-1|1;-1|-1|1;-1|-1|1;-1|-1|1;-1|-1|1;-1|-1|1;-1|-1|1;-1|-1|1;-1|-1|1;-1|-1|1;-1|-1|1;-1|-1|1;-1|-1|1;-1|-1|1;-1|-1|1;-1|-1|1;-1|-1|1;-1|-1|1;-1|-1|1;-1|-1|1;-1|-1|1;-1|-1|1;-1|-1|1;-1|-1|1;-1|-1|1;-1|-1|1;-1|-1|1;-1|-1|1;-1|-1|1;-1|-1|1;-1|-1|1;-1|-1|1;-1|-1|1;-1|-1|1;-1|-1|1;-1|-1|1;-1|-1|1;-1|-1|1;-1|-1|1;-1|-1|1;-1|-1|1;-1|-1|1;-1|-1|1;-1|-1|1;-1|-1|1;-1|-1|1;-1|-1|1;-1|-1|1;-1|-1|1;-1|-1|1;-1|-1|1;-1|-1|1;-1|-1|1;-1|-1|1;-1|-1|1;593700|2834829|1;666421|3887790|1;-1|-1|1;510670|2923227|0;707461|3709547|1;-1|-1|1;-1|-1|1;747707|3923541|1;754702|3947444|1;-1|-1|1;-1|-1|1;751284|3931852|1;-1|-1|1;-1|-1|1;-1|-1|1;-1|-1|1;750533|3926909|1;-1|-1|1;-1|-1|1;-1|-1|1;-1|-1|1;750512|3926904|1;512346|2923041|1;-1|-1|1;-1|-1|1;607856|3851352|1;-1|-1|1;-1|-1|1;640942|3851358|1;-1|-1|1;-1|-1|1;-1|-1|1;-1|-1|1;-1|-1|1;-1|-1|1;697723|3622406|1;737634|3874514|1;-1|-1|1;-1|-1|1;-1|-1|1;-1|-1|1;753132|3941783|1;-1|-1|1;-1|-1|1;747221|3931854|1;727856|3933976|1;753133|3941782|1;754704|3947441|1;-1|-1|1;-1|-1|1;-1|-1|1;-1|-1|1;-1|-1|1;-1|-1|1;-1|-1|1;-1|-1|1;754703|3947438|1;-1|-1|1;-1|-1|1;-1|-1|1;-1|-1|1;-1|-1|1;-1|-1|1;-1|-1|1;-1|-1|1;-1|-1|1;-1|-1|1;-1|-1|1;-1|-1|1;737632|3874513|1;745054|3902041|1;693696|3933966|1;599415|3851355|1;692920|3933974|1;745059|3903202|1;663315|3399158|1;737519|3926902|1;-1|-1|1;-1|-1|1;-1|-1|1;-1|-1|1;-1|-1|1;-1|-1|1;-1|-1|1;-1|-1|1;-1|-1|1;-1|-1|1;-1|-1|1;-1|-1|1;740752|3869558|1;611315|3941809|1;-1|-1|1;-1|-1|1;-1|-1|1;-1|-1|1;747863|3902040|1;755023|3947445|1;-1|-1|1;-1|-1|1;584566|2776548|1;737518|3926901|1;752417|3947443|1;-1|-1|1;-1|-1|1;593103|3937022|1;-1|-1|1;733750|3931451|1;-1|-1|1;-1|-1|1;751069|3924071|1;-1|-1|1;-1|-1|1;-1|-1|1;737630|3874512|1;638200|3851350|1;753816|3941785|1;-1|-1|1;-1|-1|1;750536|3926907|1;-1|-1|1;-1|-1|1;-1|-1|1;-1|-1|1;-1|-1|1;747706|3923550|1;-1|-1|1;-1|-1|1;727855|3933978|1;752167|3947439|1;-1|-1|1;-1|-1|1;750538|3926906|1;-1|-1|1;-1|-1|1;737633|3874515|1;737752|3854519|1;744882|3903204|1;751283|3931853|1;692933|3933970|1;573017|2670646|1;750535|3941758|1;-1|-1|1;-1|-1|1;522574|2923043|1;750532|3926908|1;-1|-1|1;-1|-1|1;720775|3861112|1;-1|-1|1;-1|-1|1;750622|3923529|1;-1|-1|1;-1|-1|1;588511|2801138|1;629918|3931478|1;719651|3923531|1;750523|3926903|1;643578|3952785|1;753838|3941780|1;750516|3923545|1;753840|3941781|1;-1|-1|1;-1|-1|1;753700|3941786|1;692919|3933973|1;753743|3941787|1;747222|3931851|1;750517|3923547|1;-1|-1|1;-1|-1|1;689979|3941808|1;-1|-1|1;-1|-1|1;-1|-1|1;-1|-1|1;-1|-1|1;-1|-1|1;-1|-1|1;-1|-1|1;670807|3446797|1;632449|3161673|1;663310|3399161|1;522572|2923042|1;750522|3923546|1;-1|-1|1;-1|-1|1;-1|-1|1;-1|-1|1;-1|-1|1;-1|-1|1;696250|3804421|1;-1|-1|1;-1|-1|1;-1|-1|1;-1|-1|1;-1|-1|1;580663|2734578|1;-1|-1|1;-1|-1|1;-1|-1|1;-1|-1|1;651608|3851359|1;750531|3923548|1;-1|-1|1;-1|-1|1;-1|-1|1;-1|-1|1;626438|3111536|1;752238|3933971|1;692917|3933975|1;753684|3944664|1;737703|3874511|1;-1|-1|1;-1|-1|1;663313|3399160|1;515853|2923044|1;528144|2923045|0;-1|-1|1;737613|3851313|1;-1|-1|1;-1|-1|1;733751|3931453|1;752166|3947440|1;743148|3941820|1;737702|3926900|1;753815|3941784|1;-1|-1|1;-1|-1|1;-1|-1|1;-1|-1|1;578262|3941837|1;737701|3926899|1;753131|3941779|1;522576|2923046|1;632249|3919742|1;-1|-1|1;-1|-1|1;750537|3926905|1;-1|-1|1;-1|-1|1;752418|3947442|1;-1|-1|1;-1|-1|1;738516|3854517|1;-1|-1|1;-1|-1|1;-1|-1|1;-1|-1|1;562734|2742762|1;-1|-1|1;-1|-1|1;737631|3874516|1;-1|-1|1;-1|-1|1;-1|-1|1;725679|3790344|1;-1|-1|1;733749|3931452|1;751352|3941788|1;-1|-1|1;-1|-1|1;582775|3283873|1;-1|-1|1;-1|-1|1;578343|2836703|1;494445|3672877|1;511409|2255179|1;369351|3154250|0;385436|2514756|1;572750|2680754|1;712976|3754715|1;739545|3856336|1;536503|3648719|1;685767|3533827|1;589752|3861204|1;685268|3854522|1;738715|3854520|1;536311|3688125|1;-1|-1|1;-1|-1|1;-1|-1|1;-1|-1|1]&idx=0&r=0.4408123569299005
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 2600:9000:206f:5200:2:8f43:5780:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: CloudFront /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.citicards.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Tue, 17 Oct 2023 21:57:56 GMT
via: 1.1 4874e0c922f34c928345f4c183ea11b4.cloudfront.net (CloudFront)
server: CloudFront
age: 939
x-amz-cf-pop: FRA56-C1
x-cache: Hit from cloudfront
cache-control: no-cache, no-store
alt-svc: h3=":443"; ma=86400
x-amz-cf-id: uLpYj7JoxO_YZy3hqiaLqo7nJO0zTXLjveZaAfsyEs8qeV_9Py5fWw==

GET
H/1.1 204
No Content clear.png Show response
content22.accountonline.com/fp/ Frame 7223 0
387 B 14ms
13ms Script
text/javascript 91.235.132.220
THM

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Host: content22.accountonline.com
URL: https://content22.accountonline.com/fp/ls_fp.html;CIS3SID=1E9AE98D00C7721239A87FB1F61DDD37?org_id=89oebq5k&session_id=d73badfb6291512b9f1d43ffd18e1f8f2519636970c27cb58dfddf5166d9b69a&nonce=a16891807d617b66&pageid=1

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

91.235.132.220 , United States, ASN30286 (THM, US),

Reverse DNS

Software

Apache /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://content22.accountonline.com/fp/ls_fp.html;CIS3SID=1E9AE98D00C7721239A87FB1F61DDD37?org_id=89oebq5k&session_id=d73badfb6291512b9f1d43ffd18e1f8f2519636970c27cb58dfddf5166d9b69a&nonce=a16891807d617b66&pageid=1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 17 Oct 2023 22:13:35 GMT
Strict-Transport-Security: max-age=31536000
X-Content-Type-Options: nosniff
Server: Apache
Content-Type: text/javascript
Cache-Control: no-cache, no-store, must-revalidate
Connection: Keep-Alive
Keep-Alive: timeout=2, max=96
X-XSS-Protection: 1; mode=block
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H/1.1 200
OK p13n.min.js Show response
cdn.boomtrain.com/p13n/citibank/ 93 KB
30 KB 9ms
8ms Script
application/javascript 18.66.122.57
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.boomtrain.com/p13n/citibank/p13n.min.js
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 18.66.122.57 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-66-122-57.fra60.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 6380b5806e25f267b34990930509aefec9e8fd53b16183d99d38441e7b4025c2

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.citicards.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

x-amz-version-id: 4tTCDH_Ot9gY3n4_I4QvVPNoOYfDcV2s
Content-Encoding: gzip
Via: 1.1 da6955a1993e1118f32bcb48c6630c20.cloudfront.net (CloudFront)
Date: Tue, 17 Oct 2023 21:23:32 GMT
X-Amz-Cf-Pop: FRA60-P2
Age: 3016
x-amz-server-side-encryption: AES256
Transfer-Encoding: chunked
X-Cache: Hit from cloudfront
Connection: keep-alive
Last-Modified: Mon, 09 Oct 2023 02:39:05 GMT
Server: AmazonS3
ETag: W/"f635727fc54b30d1445eca50a4b5224f"
Vary: Accept-Encoding
Content-Type: application/javascript
Cache-Control: public, max-age=3600
X-Amz-Cf-Id: Tvr-_-axwVP6O6lq0ZCMy3pvUBxrl4_V8O4gA_ZYCz09wgBQbueFzA==

POST
H2 200 Targeting.php Show response
siteintercept.qualtrics.com/WRSiteInterceptEngine/ 9 KB
2 KB 147ms
146ms XHR
application/json 104.17.208.240
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://siteintercept.qualtrics.com/WRSiteInterceptEngine/Targeting.php?Q_ZoneID=ZN_3VI8kkudS0JJRFc&Q_CLIENTVERSION=1.101.0&Q_CLIENTTYPE=web

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.17.208.240 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

7042be63003430d5919b301a368619c448ece33c05302eb13ffdabf3af5a8fe3

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.citicards.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36
Content-type: application/x-www-form-urlencoded

Response headers

date: Tue, 17 Oct 2023 22:13:35 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
content-encoding: br
content-security-policy-report-only: frame-ancestors 'self' *.qualtrics.com *.my.salesforce.com *.visualforce.com *.visual.force.com *.lightning.force.com; report-uri https://sjc1.qualtrics.com/csp-report
referrer-policy: strict-origin-when-cross-origin
server: cloudflare
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: https://www.citicards.com
cache-control: no-store, no-cache, must-revalidate, max-age=0
access-control-allow-credentials: true
permissions-policy: camera=(), geolocation=(), microphone=()
trace-id: 284dadcd992b6cab
cf-ray: 817be3bfa9980404-FRA
timing-allow-origin: *

GET
H2 200 dc_pre=CNn7zauN_oEDFdPIOwIdyLsO-A;src=6260004;type=appli0;cat=appli0;qty=1;cost=1;ord=2879853513319.5435;auiddc=583581942.1697580813;u1=093;u3=null;u4=jJRSACQ_AboutYou_AA;u12=https%3A%2F%2Fwww.citi... Show response
adservice.google.com/ddm/fls/i/ Frame F3C3 920 B
514 B 94ms
53ms Document
text/html 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/ddm/fls/i/dc_pre=CNn7zauN_oEDFdPIOwIdyLsO-A;src=6260004;type=appli0;cat=appli0;qty=1;cost=1;ord=2879853513319.5435;auiddc=583581942.1697580813;u1=093;u3=null;u4=jJRSACQ_AboutYou_AA;u12=https%3A%2F%2Fwww.citicards.com%2Fcards%2Fcredit%2Fapplication%2Fflow.action%3Fapp%3DUNSOL%26ID%3D3001%26HKOP%3D2de94b05869e4857c38ba3a5df71418d5ccbea5e43605c020c419744dbe79b6c;u11=;gtm=45fe3ag0;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;epver=2;~oref=https%3A%2F%2Fwww.citicards.com%2Fcards%2Fcredit%2Fapplication%2Fflow.action%3Fapp%3DUNSOL%26ID%3D3001%26HKOP%3D2de94b05869e4857c38ba3a5df71418d5ccbea5e43605c020c419744dbe79b6c

Requested by

Host: 6260004.fls.doubleclick.net
URL: https://6260004.fls.doubleclick.net/activityi;dc_pre=CNn7zauN_oEDFdPIOwIdyLsO-A;src=6260004;type=appli0;cat=appli0;qty=1;cost=1;ord=2879853513319.5435;auiddc=583581942.1697580813;u1=093;u3=null;u4=jJRSACQ_AboutYou_AA;u12=https%3A%2F%2Fwww.citicards.com%2Fcards%2Fcredit%2Fapplication%2Fflow.action%3Fapp%3DUNSOL%26ID%3D3001%26HKOP%3D2de94b05869e4857c38ba3a5df71418d5ccbea5e43605c020c419744dbe79b6c;u11=;gtm=45fe3ag0;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;epver=2;~oref=https%3A%2F%2Fwww.citicards.com%2Fcards%2Fcredit%2Fapplication%2Fflow.action%3Fapp%3DUNSOL%26ID%3D3001%26HKOP%3D2de94b05869e4857c38ba3a5df71418d5ccbea5e43605c020c419744dbe79b6c?

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

47bd0f94c766dc42eeb2da6ea6f18c5216bf8723e79bf4e6e2627c9bbaf6e882

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://6260004.fls.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, must-revalidate
content-encoding: br
content-length: 444
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Tue, 17 Oct 2023 22:13:35 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
pragma: no-cache
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 dc_pre=CO34zauN_oEDFQ6Tmwod-7sB4w;src=6260004;type=appli0;cat=aaadv000;qty=1;cost=1995.27;ord=1746401848952.357;auiddc=583581942.1697580813;u1=093;u3=null;u4=jJRSACQ_AboutYou_AA;u11=;gtm=45fe3ag0;u... Show response
adservice.google.com/ddm/fls/i/ Frame F8AC 746 B
818 B 90ms
51ms Document
text/html 2a00:1450:4001:82a::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.com/ddm/fls/i/dc_pre=CO34zauN_oEDFQ6Tmwod-7sB4w;src=6260004;type=appli0;cat=aaadv000;qty=1;cost=1995.27;ord=1746401848952.357;auiddc=583581942.1697580813;u1=093;u3=null;u4=jJRSACQ_AboutYou_AA;u11=;gtm=45fe3ag0;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;epver=2;~oref=https%3A%2F%2Fwww.citicards.com%2Fcards%2Fcredit%2Fapplication%2Fflow.action%3Fapp%3DUNSOL%26ID%3D3001%26HKOP%3D2de94b05869e4857c38ba3a5df71418d5ccbea5e43605c020c419744dbe79b6c

Requested by

Host: 6260004.fls.doubleclick.net
URL: https://6260004.fls.doubleclick.net/activityi;dc_pre=CO34zauN_oEDFQ6Tmwod-7sB4w;src=6260004;type=appli0;cat=aaadv000;qty=1;cost=1995.27;ord=1746401848952.357;auiddc=583581942.1697580813;u1=093;u3=null;u4=jJRSACQ_AboutYou_AA;u11=;gtm=45fe3ag0;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;epver=2;~oref=https%3A%2F%2Fwww.citicards.com%2Fcards%2Fcredit%2Fapplication%2Fflow.action%3Fapp%3DUNSOL%26ID%3D3001%26HKOP%3D2de94b05869e4857c38ba3a5df71418d5ccbea5e43605c020c419744dbe79b6c?

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

bae1c20c5d1f34876af062d30f9771f439d8ed1219c6c0567880b472d8799e18

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://6260004.fls.doubleclick.net/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, must-revalidate
content-encoding: br
content-length: 443
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Tue, 17 Oct 2023 22:13:35 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
pragma: no-cache
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H/1.1 204
204 clear3.png;CIS3SID=1E9AE98D00C7721239A87FB1F61DDD37 Show response
content22.accountonline.com/fp/ Frame A63D 0
218 B 15ms
14ms Script
text/javascript 91.235.132.220
THM

General

Check archive.org

Show headers Download Go to

Full URL

https://content22.accountonline.com/fp/clear3.png;CIS3SID=1E9AE98D00C7721239A87FB1F61DDD37?org_id=89oebq5k&session_id=d73badfb6291512b9f1d43ffd18e1f8f2519636970c27cb58dfddf5166d9b69a&nonce=a16891807d617b66&pageid=1&je=3132343a26266863613f39267067675d7d72646174673f2737422d3232322d30302533492735402d30327467702730322d334333253544253041253a30332d32322731432537402730304944445f524d57404f582530302733412d354264696e7165253a4127303a6168676169606d782d323025324134253746253f46273a43253030302532302731432d37422530304946445f484d4f475f50404f4e472d30302533492737406e636c7167273041253a32616865616b626d7a253a30273a43342737462537462730412d32323327303a2733412535402732324944445d464d4c5f54495a434044475f4b4c414d4f452d323025334325354064616471672d32432730306368676169606778253230273a4134253546273544253a4325303a362732322d3143273f40253030414a474343494c475f4343434d574e5c27303a25334327374266636e71672d32432530306b6a65636b606d7a25323a2532413c273744253f4627304b27323037273030253b41273742273232514356414c45574143414d574e54273030273b4125354064696e73652530412732326b68656163606d78253a3027304b36253746273546253a432732323425323027334927354a2532304f4d4e455b5d4f435a4b455427303a27334125374064616c7b6525304b27303263606761696a6d782730302730433c253744253544253041253a30352d32322731432537402730306975746857716d7025323227314325354a66616e7b672732432d30306160676369606d7a27323a253043342735442735442d30412d32323a27303225314327354a25323263777c6a55736570436664726d7373273a302733412d374064696e736727304127323a636a656369626f7a27323a27304b34253746273744273041273a32392530302d3141253740273032544d524d5157464b5343444d51575a47253030273143253d4264616c7165253041253a306160656369606d7825303027304b34253546273f4625324327303031302d3232273b432737422d3030717c6770335d7177606d61742732322733412737426e636e7b652530412732327177606f6174253230273a4134253546273544253a4325303a333325323a2731432d3542273030646e6f7f457a637576696f6c49657127303a25334327374266636e71672d3243253030606b6464656c273032253a4334273d462737442d3041273a3031302730302733492535422530325f67746566764b6c25323027314125374064636473652530412d303268696666676e253a3225304b362735442d3546273a41253030333127323a2531412535422530304a4e525d5c4f4b474c273232273143273d4266616e716d2732432530306a69646c656e273a302732433c2737462d354427304127303239342732322733412735422d30305058585d477a7472632730302d33412537406e636c736527304125323a6869666c676c25323a2730413c27354627354627374c

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

91.235.132.220 , United States, ASN30286 (THM, US),

Reverse DNS

Software

Apache /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.citicards.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

Date: Tue, 17 Oct 2023 22:13:35 GMT
Strict-Transport-Security: max-age=31536000
Server: Apache
Connection: Keep-Alive
Keep-Alive: timeout=2, max=95
Content-Type: text/javascript;charset=UTF-8

GET
H2 200 16001692 Show response
bat.bing.com/p/insights/t/ 705 B
874 B 116ms
115ms Script
application/x-javascript 2620:1ec:c11::200
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://bat.bing.com/p/insights/t/16001692

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

43b0db1e8b48f7ad65386e7afe7645314b8f3c07f12398453e83966b1f135473

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.citicards.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

expires: -1
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-encoding: gzip
date: Tue, 17 Oct 2023 22:13:34 GMT
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 65BD5B010DC943CE87DD68532B74D2F8 Ref B: FRAEDGE2016 Ref C: 2023-10-17T22:13:35Z
vary: Accept-Encoding
x-azure-ref: 20231017T221335Z-xxe7sq84rd6s746fy8zmpzagc400000003tg00000002wrbp
content-type: application/x-javascript
x-cache: CONFIG_NOCACHE
cache-control: no-cache, no-store
accept-ranges: bytes
content-length: 595
request-context: appId=cid-v1:67bc0b23-8423-4b52-b1ca-6a87709ceaa2

POST
H/1.1 200
OK cls_report Show response
prod.report.nacustomerexperience.citi.com/glassbox/reporting/798b2f12-9162-4a94-91ee-805d883ca266/ 8 KB
3 KB 162ms
102ms XHR
application/json 3.224.91.217
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://prod.report.nacustomerexperience.citi.com/glassbox/reporting/798b2f12-9162-4a94-91ee-805d883ca266/cls_report?clsjsv=6.6.118B256&_cls_s=a640fd98-a0c2-4fe9-8834-8c4fed70ecae:0&_cls_v=d8509083-ac4c-4248-8fbf-3bab75beafc9&pid=f817ad3f-39dc-4528-94ec-72b46243969a&sn=1&cfg&pv=2&aid=

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

3.224.91.217 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-3-224-91-217.compute-1.amazonaws.com

Software

GlassBox Cligate /

Resource Hash

3394ccdb7c7861e721d118226b2735339ec9a5d71ab2916f64a00c9bcea4373a

Security Headers

Name	Value
Content-Security-Policy	default-src 'self';
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.citicards.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

Date: Tue, 17 Oct 2023 22:13:35 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains
content-encoding: gzip
Content-Security-Policy: default-src 'self';
X-Content-Type-Options: nosniff
Connection: keep-alive
Content-Length: 1730
X-XSS-Protection: 1; mode=block
Referrer-Policy: strict-origin-when-cross-origin
Server: GlassBox Cligate
X-Frame-Options: SAMEORIGIN
vary: origin
Content-Type: application/json
access-control-allow-origin: https://www.citicards.com
access-control-allow-credentials: true
GB-Server: g5075
X-Robots-Tag: noindex

GET
H2 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/960621875/ 3 KB
1 KB 36ms
35ms Script
text/javascript 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/960621875/?random=1697580815357&cv=11&fst=1697580815357&bg=ffffff&guid=ON&async=1&gtm=45be3ab0&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.citicards.com%2Fcards%2Fcredit%2Fapplication%2Fflow.action%3Fapp%3DUNSOL%26ID%3D3001%26HKOP%3D2de94b05869e4857c38ba3a5df71418d5ccbea5e43605c020c419744dbe79b6c&hn=www.googleadservices.com&frm=0&tiba=Citi%20Online%20Consumer%20Card%20-%20Enter%20Information&auid=583581942.1697580813&uamb=0&uaw=0&data=event%3Dgtag.config&rfmt=3&fmt=4

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

e298a6cc0a1877c72c1cfebacb0d334396aeb435025bcbc168d0a753f4098a99

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.citicards.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 17 Oct 2023 22:13:35 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1439
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/975701947/ 3 KB
1 KB 33ms
33ms Script
text/javascript 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/975701947/?random=1697580815375&cv=11&fst=1697580815375&bg=ffffff&guid=ON&async=1&gtm=45be3ag0&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.citicards.com%2Fcards%2Fcredit%2Fapplication%2Fflow.action%3Fapp%3DUNSOL%26ID%3D3001%26HKOP%3D2de94b05869e4857c38ba3a5df71418d5ccbea5e43605c020c419744dbe79b6c&hn=www.googleadservices.com&frm=0&tiba=Citi%20Online%20Consumer%20Card%20-%20Enter%20Information&auid=583581942.1697580813&uamb=0&uaw=0&data=event%3Dgtag.config&rfmt=3&fmt=4

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

7642c442fd9d507dab536bc61ceac7c82b14d033243de5145458cdb908dbd54b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.citicards.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 17 Oct 2023 22:13:35 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1440
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/695231162/ 3 KB
1 KB 34ms
33ms Script
text/javascript 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/695231162/?random=1697580815395&cv=11&fst=1697580815395&bg=ffffff&guid=ON&async=1&gtm=45be3ag0&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.citicards.com%2Fcards%2Fcredit%2Fapplication%2Fflow.action%3Fapp%3DUNSOL%26ID%3D3001%26HKOP%3D2de94b05869e4857c38ba3a5df71418d5ccbea5e43605c020c419744dbe79b6c&hn=www.googleadservices.com&frm=0&tiba=Citi%20Online%20Consumer%20Card%20-%20Enter%20Information&auid=583581942.1697580813&uamb=0&uaw=0&data=event%3Dgtag.config&rfmt=3&fmt=4

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

5e7d41474cb295985f63d2230319b6ebb1db8fadf7e47b3ef375370ea0a2fd01

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.citicards.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 17 Oct 2023 22:13:35 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1440
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/959299794/ 3 KB
1 KB 32ms
31ms Script
text/javascript 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/959299794/?random=1697580815414&cv=11&fst=1697580815414&bg=ffffff&guid=ON&async=1&gtm=45be3ag0&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.citicards.com%2Fcards%2Fcredit%2Fapplication%2Fflow.action%3Fapp%3DUNSOL%26ID%3D3001%26HKOP%3D2de94b05869e4857c38ba3a5df71418d5ccbea5e43605c020c419744dbe79b6c&hn=www.googleadservices.com&frm=0&tiba=Citi%20Online%20Consumer%20Card%20-%20Enter%20Information&auid=583581942.1697580813&uamb=0&uaw=0&data=event%3Dgtag.config&rfmt=3&fmt=4

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

707bdb2e6227302b95bc734573ec66d77847d845dd7a741758d793e5e2dd6e1d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.citicards.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 17 Oct 2023 22:13:35 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1441
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/819500023/ 3 KB
1 KB 30ms
30ms Script
text/javascript 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/819500023/?random=1697580815437&cv=11&fst=1697580815437&bg=ffffff&guid=ON&async=1&gtm=45be3ag0&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.citicards.com%2Fcards%2Fcredit%2Fapplication%2Fflow.action%3Fapp%3DUNSOL%26ID%3D3001%26HKOP%3D2de94b05869e4857c38ba3a5df71418d5ccbea5e43605c020c419744dbe79b6c&hn=www.googleadservices.com&frm=0&tiba=Citi%20Online%20Consumer%20Card%20-%20Enter%20Information&auid=583581942.1697580813&uamb=0&uaw=0&data=event%3Dgtag.config&rfmt=3&fmt=4

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

062ee837c39ae803e8e39400cc01dbeb6cbd37536bbbc39dac4b4a3eddb626ed

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.citicards.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 17 Oct 2023 22:13:35 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1438
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/644574043/ 3 KB
1 KB 34ms
33ms Script
text/javascript 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/644574043/?random=1697580815457&cv=11&fst=1697580815457&bg=ffffff&guid=ON&async=1&gtm=45be3ag0&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.citicards.com%2Fcards%2Fcredit%2Fapplication%2Fflow.action%3Fapp%3DUNSOL%26ID%3D3001%26HKOP%3D2de94b05869e4857c38ba3a5df71418d5ccbea5e43605c020c419744dbe79b6c&hn=www.googleadservices.com&frm=0&tiba=Citi%20Online%20Consumer%20Card%20-%20Enter%20Information&auid=583581942.1697580813&uamb=0&uaw=0&data=event%3Dgtag.config&rfmt=3&fmt=4

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

11cbf0988ce7e7b95afbf21a775614d18c0b6fdc2d15d54424a0e00008bef9b4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.citicards.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 17 Oct 2023 22:13:35 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1441
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/11172302925/ 3 KB
1 KB 34ms
33ms Script
text/javascript 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/11172302925/?random=1697580815481&cv=11&fst=1697580815481&bg=ffffff&guid=ON&async=1&gtm=45be3ab0&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.citicards.com%2Fcards%2Fcredit%2Fapplication%2Fflow.action%3Fapp%3DUNSOL%26ID%3D3001%26HKOP%3D2de94b05869e4857c38ba3a5df71418d5ccbea5e43605c020c419744dbe79b6c&hn=www.googleadservices.com&frm=0&tiba=Citi%20Online%20Consumer%20Card%20-%20Enter%20Information&auid=583581942.1697580813&uamb=0&uaw=0&data=event%3Dgtag.config&rfmt=3&fmt=4

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

aeabeb108bd6bc6386510a56272ba58200aaf64a69a54c3ae918ea1998ce29a9

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.citicards.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 17 Oct 2023 22:13:35 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1437
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/830907969/ 3 KB
1 KB 32ms
32ms Script
text/javascript 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/830907969/?random=1697580815503&cv=11&fst=1697580815503&bg=ffffff&guid=ON&async=1&gtm=45be3ag0&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.citicards.com%2Fcards%2Fcredit%2Fapplication%2Fflow.action%3Fapp%3DUNSOL%26ID%3D3001%26HKOP%3D2de94b05869e4857c38ba3a5df71418d5ccbea5e43605c020c419744dbe79b6c&hn=www.googleadservices.com&frm=0&tiba=Citi%20Online%20Consumer%20Card%20-%20Enter%20Information&auid=583581942.1697580813&uamb=0&uaw=0&data=event%3Dgtag.config&rfmt=3&fmt=4

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

dc3666500e1fdc17dab6f563757cd07f44acf583f21ea20fb5af99ab619fdc80

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.citicards.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 17 Oct 2023 22:13:35 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1440
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/10955006959/ 3 KB
1 KB 33ms
32ms Script
text/javascript 2a00:1450:4001:830::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/10955006959/?random=1697580815525&cv=11&fst=1697580815525&bg=ffffff&guid=ON&async=1&gtm=45be3ag0&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.citicards.com%2Fcards%2Fcredit%2Fapplication%2Fflow.action%3Fapp%3DUNSOL%26ID%3D3001%26HKOP%3D2de94b05869e4857c38ba3a5df71418d5ccbea5e43605c020c419744dbe79b6c&hn=www.googleadservices.com&frm=0&tiba=Citi%20Online%20Consumer%20Card%20-%20Enter%20Information&auid=583581942.1697580813&uamb=0&uaw=0&data=event%3Dgtag.config&rfmt=3&fmt=4

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

be4c432d5fcfb3f53d2523ba67c9bcda89bcf7ad7587aac38d742a83d4892810

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.citicards.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 17 Oct 2023 22:13:35 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1442
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.com/pagead/1p-user-list/916451471/ 42 B
455 B 61ms
27ms Image
image/gif 2a00:1450:4001:828::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/916451471/?random=1697580815121&cv=11&fst=1697580000000&bg=ffffff&guid=ON&async=1&gtm=45be3ag0&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.citicards.com%2Fcards%2Fcredit%2Fapplication%2Fflow.action%3Fapp%3DUNSOL%26ID%3D3001%26HKOP%3D2de94b05869e4857c38ba3a5df71418d5ccbea5e43605c020c419744dbe79b6c&frm=0&tiba=Citi%20Online%20Consumer%20Card%20-%20Enter%20Information&data=event%3Dgtag.config&fmt=3&is_vtc=1&random=2976706598&rmt_tld=0&ipr=y

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.citicards.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 17 Oct 2023 22:13:35 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.de/pagead/1p-user-list/916451471/ 42 B
108 B 90ms
30ms Image
image/gif 2a00:1450:4001:827::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/916451471/?random=1697580815121&cv=11&fst=1697580000000&bg=ffffff&guid=ON&async=1&gtm=45be3ag0&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.citicards.com%2Fcards%2Fcredit%2Fapplication%2Fflow.action%3Fapp%3DUNSOL%26ID%3D3001%26HKOP%3D2de94b05869e4857c38ba3a5df71418d5ccbea5e43605c020c419744dbe79b6c&frm=0&tiba=Citi%20Online%20Consumer%20Card%20-%20Enter%20Information&data=event%3Dgtag.config&fmt=3&is_vtc=1&random=2976706598&rmt_tld=1&ipr=y

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.citicards.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 17 Oct 2023 22:13:35 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 CoreModule.js Show response
siteintercept.qualtrics.com/dxjsmodule/ 102 KB
32 KB 26ms
24ms Script
application/javascript 104.17.208.240
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://siteintercept.qualtrics.com/dxjsmodule/CoreModule.js?Q_CLIENTVERSION=1.101.0&Q_CLIENTTYPE=web&Q_BRANDID=citifeedback

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.17.208.240 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

617795824f268204fce200417ba784cf0ad062c0c1613d5a114c457bc503ff8b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.citicards.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Tue, 17 Oct 2023 22:13:35 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: br
age: 50604
cf-polished: origSize=105688
content-security-policy-report-only: frame-ancestors 'self' *.qualtrics.com *.my.salesforce.com *.visualforce.com *.visual.force.com *.lightning.force.com; report-uri https://sjc1.qualtrics.com/csp-report
edge-control: max-age=604800
referrer-policy: strict-origin-when-cross-origin
last-modified: Mon, 09 Oct 2023 17:51:04 GMT
cf-bgj: minify
server: cloudflare
etag: W/"19cd8-18b15905b40"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=604800, s-maxage=604800
permissions-policy: camera=(), geolocation=(), microphone=()
cf-ray: 817be3c14ace0404-FRA
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept
timing-allow-origin: *

GET
H/1.1 204
No Content clear.png Show response
content22.accountonline.com/fp/ Frame A63D 0
387 B 13ms
13ms Script
text/javascript 91.235.132.220
THM

General

Check archive.org

Show headers Download Go to

Full URL

https://content22.accountonline.com/fp/clear.png?org_id=89oebq5k&session_id=d73badfb6291512b9f1d43ffd18e1f8f2519636970c27cb58dfddf5166d9b69a&nonce=a16891807d617b66&pageid=1&jac=1&je=35343524266a646c3f312e6a66683f3b313431373164606439373b3765313e356061373d3660603b3b62613630613a266266766e3d323a343a38332e726f356e6f2460637473763f27354a2532326e677e676c25323027314131263030273a412732327b7663767d71253030273143253a326168617067696c65253a30273f4426637766683d6163356031653665343a396163616334643061376b31393031313433343e6037613b33373b34603666386c643638363230333a64653c64323b6663663a36353924677a31356631656737316161663737333637373e3564303c3b3136373d3036673130666461603a33313b6163267563683d2735422d30306972636a6b766563767770672d32322531432d3032253230273043253a32626b7c6c6773732d3030273b43253030273030253a432732326072616c66732d30302d33412737402535462730412d323266776e64546572736b6d6c4c697b7425303a273141253d4027374c2732412730306f6f6a696e6525303225314366696e716d2532412730326d6d66676e2d32322531432d3032253230273043253a32706e6976646f72652730302d31412730302730322d3241253230706c63766667706f5e6572716b6d6e25303027314925323227303a273243253030756f773e3425303a27314166696e71672d35442477636e3f253f422732326072616c66732d30302d33412737402535462730412d32326d6d60616e6525323027314166696c73672d304125323a726e637c646f706f273030253b41273232273232273544

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

91.235.132.220 , United States, ASN30286 (THM, US),

Reverse DNS

Software

Apache /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.citicards.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 17 Oct 2023 22:13:35 GMT
Strict-Transport-Security: max-age=31536000
X-Content-Type-Options: nosniff
Server: Apache
Content-Type: text/javascript
Cache-Control: no-cache, no-store, must-revalidate
Connection: Keep-Alive
Keep-Alive: timeout=2, max=94
X-XSS-Protection: 1; mode=block
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H3

200

dc_pre=CO34zauN_oEDFQ6Tmwod-7sB4w;src=6260004;type=appli0;cat=aaadv000;qty=1;cost=1995.27;ord=1746401848952.357;auiddc=583581942.1697580813;u1=093;u3=null;u4=jJRSACQ_AboutYou_AA;u11=;gtm=45fe3ag0;u... Show response
6260004.fls.doubleclick.net/ddm/fls/r/ Frame 1BF2
Redirect Chain

https://adservice.google.de/ddm/fls/i/dc_pre=CO34zauN_oEDFQ6Tmwod-7sB4w;src=6260004;type=appli0;cat=aaadv000;qty=1;cost=1995.27;ord=1746401848952.357;auiddc=583581942.1697580813;u1=093;u3=null;u4=j...
https://6260004.fls.doubleclick.net/ddm/fls/r/dc_pre=CO34zauN_oEDFQ6Tmwod-7sB4w;src=6260004;type=appli0;cat=aaadv000;qty=1;cost=1995.27;ord=1746401848952.357;auiddc=583581942.1697580813;u1=093;u3=n...

737 B
435 B

70ms
69ms

Document
text/html

142.250.186.38
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://6260004.fls.doubleclick.net/ddm/fls/r/dc_pre=CO34zauN_oEDFQ6Tmwod-7sB4w;src=6260004;type=appli0;cat=aaadv000;qty=1;cost=1995.27;ord=1746401848952.357;auiddc=583581942.1697580813;u1=093;u3=null;u4=jJRSACQ_AboutYou_AA;u11=;gtm=45fe3ag0;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;epver=2;~oref=https%3A%2F%2Fwww.citicards.com%2Fcards%2Fcredit%2Fapplication%2Fflow.action%3Fapp%3DUNSOL%26ID%3D3001%26HKOP%3D2de94b05869e4857c38ba3a5df71418d5ccbea5e43605c020c419744dbe79b6c

Requested by

Host: adservice.google.com
URL: https://adservice.google.com/ddm/fls/i/dc_pre=CO34zauN_oEDFQ6Tmwod-7sB4w;src=6260004;type=appli0;cat=aaadv000;qty=1;cost=1995.27;ord=1746401848952.357;auiddc=583581942.1697580813;u1=093;u3=null;u4=jJRSACQ_AboutYou_AA;u11=;gtm=45fe3ag0;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;epver=2;~oref=https%3A%2F%2Fwww.citicards.com%2Fcards%2Fcredit%2Fapplication%2Fflow.action%3Fapp%3DUNSOL%26ID%3D3001%26HKOP%3D2de94b05869e4857c38ba3a5df71418d5ccbea5e43605c020c419744dbe79b6c

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.186.38 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s04-in-f6.1e100.net

Software

cafe /

Resource Hash

6b88cb00ec74901f91b39f0c85af0f1645e1228e78f680adfa6c8bf28eed41e0

Security Headers

Name	Value
Strict-Transport-Security	max-age=21600
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://adservice.google.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=0
content-encoding: br
content-length: 412
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Tue, 17 Oct 2023 22:13:35 GMT
expires: Tue, 17 Oct 2023 22:13:35 GMT
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
server: cafe
strict-transport-security: max-age=21600
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

Redirect headers

alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, must-revalidate
content-length: 0
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Tue, 17 Oct 2023 22:13:35 GMT
expires: Fri, 01 Jan 1990 00:00:00 GMT
location: https://6260004.fls.doubleclick.net/ddm/fls/r/dc_pre=CO34zauN_oEDFQ6Tmwod-7sB4w;src=6260004;type=appli0;cat=aaadv000;qty=1;cost=1995.27;ord=1746401848952.357;auiddc=583581942.1697580813;u1=093;u3=null;u4=jJRSACQ_AboutYou_AA;u11=;gtm=45fe3ag0;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;epver=2;~oref=https%3A%2F%2Fwww.citicards.com%2Fcards%2Fcredit%2Fapplication%2Fflow.action%3Fapp%3DUNSOL%26ID%3D3001%26HKOP%3D2de94b05869e4857c38ba3a5df71418d5ccbea5e43605c020c419744dbe79b6c
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
pragma: no-cache
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 dc_pre=CNn7zauN_oEDFdPIOwIdyLsO-A;src=6260004;type=appli0;cat=appli0;qty=1;cost=1;ord=2879853513319.5435;auiddc=583581942.1697580813;u1=093;u3=null;u4=jJRSACQ_AboutYou_AA;u12=https%3A%2F%2Fwww.citi... Show response
adservice.google.de/ddm/fls/i/ Frame A51A 194 B
193 B 93ms
54ms Document
text/html 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://adservice.google.de/ddm/fls/i/dc_pre=CNn7zauN_oEDFdPIOwIdyLsO-A;src=6260004;type=appli0;cat=appli0;qty=1;cost=1;ord=2879853513319.5435;auiddc=583581942.1697580813;u1=093;u3=null;u4=jJRSACQ_AboutYou_AA;u12=https%3A%2F%2Fwww.citicards.com%2Fcards%2Fcredit%2Fapplication%2Fflow.action%3Fapp%3DUNSOL%26ID%3D3001%26HKOP%3D2de94b05869e4857c38ba3a5df71418d5ccbea5e43605c020c419744dbe79b6c;u11=;gtm=45fe3ag0;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;epver=2;~oref=https%3A%2F%2Fwww.citicards.com%2Fcards%2Fcredit%2Fapplication%2Fflow.action%3Fapp%3DUNSOL%26ID%3D3001%26HKOP%3D2de94b05869e4857c38ba3a5df71418d5ccbea5e43605c020c419744dbe79b6c

Requested by

Host: adservice.google.com
URL: https://adservice.google.com/ddm/fls/i/dc_pre=CNn7zauN_oEDFdPIOwIdyLsO-A;src=6260004;type=appli0;cat=appli0;qty=1;cost=1;ord=2879853513319.5435;auiddc=583581942.1697580813;u1=093;u3=null;u4=jJRSACQ_AboutYou_AA;u12=https%3A%2F%2Fwww.citicards.com%2Fcards%2Fcredit%2Fapplication%2Fflow.action%3Fapp%3DUNSOL%26ID%3D3001%26HKOP%3D2de94b05869e4857c38ba3a5df71418d5ccbea5e43605c020c419744dbe79b6c;u11=;gtm=45fe3ag0;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;epver=2;~oref=https%3A%2F%2Fwww.citicards.com%2Fcards%2Fcredit%2Fapplication%2Fflow.action%3Fapp%3DUNSOL%26ID%3D3001%26HKOP%3D2de94b05869e4857c38ba3a5df71418d5ccbea5e43605c020c419744dbe79b6c

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

05978957c6c8b028f2785dc77271c286bfac76e30b7bcd7e835c2927fbe897cf

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://adservice.google.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: private, max-age=0
content-encoding: br
content-length: 85
content-type: text/html; charset=UTF-8
cross-origin-resource-policy: cross-origin
date: Tue, 17 Oct 2023 22:13:35 GMT
expires: Tue, 17 Oct 2023 22:13:35 GMT
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
server: cafe
timing-allow-origin: *
x-content-type-options: nosniff
x-xss-protection: 0

GET
H2 200 0.7.13 Show response
bat.bing.com/p/insights/s/ 34 KB
15 KB 37ms
37ms Script
application/javascript 2620:1ec:c11::200
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://bat.bing.com/p/insights/s/0.7.13

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

/ ARR/3.0

Resource Hash

f0a77e0433ca7256e7748fde729a21dc6509083bbed69a4cde1ecd57494e67d5

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.citicards.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
content-encoding: br
date: Tue, 17 Oct 2023 22:13:34 GMT
x-powered-by: ARR/3.0
x-cache: CONFIG_NOCACHE
content-length: 14566
last-modified: Tue, 17 Oct 2023 11:58:17 GMT
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 60E77FC370014C98A8D904700C2D2FB2 Ref B: FRAEDGE2016 Ref C: 2023-10-17T22:13:35Z
etag: W/"0x8DBCF0859CDB8FA"
vary: Accept-Encoding
x-azure-ref: 20231017T221335Z-qbwumxgepp3sb2bse8ghwt1t3n000000071g00000003hkyw
content-type: application/javascript;charset=utf-8
access-control-allow-origin: *
x-ms-request-id: 876520f9-301e-004d-6f0e-01e137000000
cache-control: public, max-age=86400
x-ms-version: 2018-03-28

GET
H2 200 /
www.google.com/pagead/1p-user-list/830907969/ 42 B
108 B 28ms
28ms Image
image/gif 2a00:1450:4001:828::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/830907969/?random=1697580815503&cv=11&fst=1697580000000&bg=ffffff&guid=ON&async=1&gtm=45be3ag0&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.citicards.com%2Fcards%2Fcredit%2Fapplication%2Fflow.action%3Fapp%3DUNSOL%26ID%3D3001%26HKOP%3D2de94b05869e4857c38ba3a5df71418d5ccbea5e43605c020c419744dbe79b6c&frm=0&tiba=Citi%20Online%20Consumer%20Card%20-%20Enter%20Information&data=event%3Dgtag.config&fmt=3&is_vtc=1&random=525005232&rmt_tld=0&ipr=y

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.citicards.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 17 Oct 2023 22:13:35 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.de/pagead/1p-user-list/830907969/ 42 B
108 B 40ms
30ms Image
image/gif 2a00:1450:4001:827::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/830907969/?random=1697580815503&cv=11&fst=1697580000000&bg=ffffff&guid=ON&async=1&gtm=45be3ag0&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.citicards.com%2Fcards%2Fcredit%2Fapplication%2Fflow.action%3Fapp%3DUNSOL%26ID%3D3001%26HKOP%3D2de94b05869e4857c38ba3a5df71418d5ccbea5e43605c020c419744dbe79b6c&frm=0&tiba=Citi%20Online%20Consumer%20Card%20-%20Enter%20Information&data=event%3Dgtag.config&fmt=3&is_vtc=1&random=525005232&rmt_tld=1&ipr=y

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.citicards.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 17 Oct 2023 22:13:35 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.com/pagead/1p-user-list/10955006959/ 42 B
108 B 26ms
25ms Image
image/gif 2a00:1450:4001:828::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/10955006959/?random=1697580815525&cv=11&fst=1697580000000&bg=ffffff&guid=ON&async=1&gtm=45be3ag0&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.citicards.com%2Fcards%2Fcredit%2Fapplication%2Fflow.action%3Fapp%3DUNSOL%26ID%3D3001%26HKOP%3D2de94b05869e4857c38ba3a5df71418d5ccbea5e43605c020c419744dbe79b6c&frm=0&tiba=Citi%20Online%20Consumer%20Card%20-%20Enter%20Information&data=event%3Dgtag.config&fmt=3&is_vtc=1&random=2053731661&rmt_tld=0&ipr=y

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.citicards.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 17 Oct 2023 22:13:35 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.de/pagead/1p-user-list/10955006959/ 42 B
108 B 39ms
29ms Image
image/gif 2a00:1450:4001:827::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/10955006959/?random=1697580815525&cv=11&fst=1697580000000&bg=ffffff&guid=ON&async=1&gtm=45be3ag0&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.citicards.com%2Fcards%2Fcredit%2Fapplication%2Fflow.action%3Fapp%3DUNSOL%26ID%3D3001%26HKOP%3D2de94b05869e4857c38ba3a5df71418d5ccbea5e43605c020c419744dbe79b6c&frm=0&tiba=Citi%20Online%20Consumer%20Card%20-%20Enter%20Information&data=event%3Dgtag.config&fmt=3&is_vtc=1&random=2053731661&rmt_tld=1&ipr=y

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.citicards.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 17 Oct 2023 22:13:35 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.com/pagead/1p-user-list/960621875/ 42 B
108 B 26ms
26ms Image
image/gif 2a00:1450:4001:828::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/960621875/?random=1697580815357&cv=11&fst=1697580000000&bg=ffffff&guid=ON&async=1&gtm=45be3ab0&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.citicards.com%2Fcards%2Fcredit%2Fapplication%2Fflow.action%3Fapp%3DUNSOL%26ID%3D3001%26HKOP%3D2de94b05869e4857c38ba3a5df71418d5ccbea5e43605c020c419744dbe79b6c&frm=0&tiba=Citi%20Online%20Consumer%20Card%20-%20Enter%20Information&data=event%3Dgtag.config&fmt=3&is_vtc=1&random=1337877789&rmt_tld=0&ipr=y

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.citicards.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 17 Oct 2023 22:13:35 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.de/pagead/1p-user-list/960621875/ 42 B
108 B 46ms
37ms Image
image/gif 2a00:1450:4001:827::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/960621875/?random=1697580815357&cv=11&fst=1697580000000&bg=ffffff&guid=ON&async=1&gtm=45be3ab0&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.citicards.com%2Fcards%2Fcredit%2Fapplication%2Fflow.action%3Fapp%3DUNSOL%26ID%3D3001%26HKOP%3D2de94b05869e4857c38ba3a5df71418d5ccbea5e43605c020c419744dbe79b6c&frm=0&tiba=Citi%20Online%20Consumer%20Card%20-%20Enter%20Information&data=event%3Dgtag.config&fmt=3&is_vtc=1&random=1337877789&rmt_tld=1&ipr=y

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.citicards.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 17 Oct 2023 22:13:35 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.com/pagead/1p-user-list/975701947/ 42 B
108 B 27ms
26ms Image
image/gif 2a00:1450:4001:828::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/975701947/?random=1697580815375&cv=11&fst=1697580000000&bg=ffffff&guid=ON&async=1&gtm=45be3ag0&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.citicards.com%2Fcards%2Fcredit%2Fapplication%2Fflow.action%3Fapp%3DUNSOL%26ID%3D3001%26HKOP%3D2de94b05869e4857c38ba3a5df71418d5ccbea5e43605c020c419744dbe79b6c&frm=0&tiba=Citi%20Online%20Consumer%20Card%20-%20Enter%20Information&data=event%3Dgtag.config&fmt=3&is_vtc=1&random=3897636910&rmt_tld=0&ipr=y

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.citicards.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 17 Oct 2023 22:13:35 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.de/pagead/1p-user-list/975701947/ 42 B
108 B 37ms
29ms Image
image/gif 2a00:1450:4001:827::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/975701947/?random=1697580815375&cv=11&fst=1697580000000&bg=ffffff&guid=ON&async=1&gtm=45be3ag0&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.citicards.com%2Fcards%2Fcredit%2Fapplication%2Fflow.action%3Fapp%3DUNSOL%26ID%3D3001%26HKOP%3D2de94b05869e4857c38ba3a5df71418d5ccbea5e43605c020c419744dbe79b6c&frm=0&tiba=Citi%20Online%20Consumer%20Card%20-%20Enter%20Information&data=event%3Dgtag.config&fmt=3&is_vtc=1&random=3897636910&rmt_tld=1&ipr=y

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.citicards.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 17 Oct 2023 22:13:35 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.com/pagead/1p-user-list/695231162/ 42 B
108 B 27ms
27ms Image
image/gif 2a00:1450:4001:828::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/695231162/?random=1697580815395&cv=11&fst=1697580000000&bg=ffffff&guid=ON&async=1&gtm=45be3ag0&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.citicards.com%2Fcards%2Fcredit%2Fapplication%2Fflow.action%3Fapp%3DUNSOL%26ID%3D3001%26HKOP%3D2de94b05869e4857c38ba3a5df71418d5ccbea5e43605c020c419744dbe79b6c&frm=0&tiba=Citi%20Online%20Consumer%20Card%20-%20Enter%20Information&data=event%3Dgtag.config&fmt=3&is_vtc=1&random=3080752617&rmt_tld=0&ipr=y

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.citicards.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 17 Oct 2023 22:13:35 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.de/pagead/1p-user-list/695231162/ 42 B
455 B 35ms
27ms Image
image/gif 2a00:1450:4001:827::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/695231162/?random=1697580815395&cv=11&fst=1697580000000&bg=ffffff&guid=ON&async=1&gtm=45be3ag0&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.citicards.com%2Fcards%2Fcredit%2Fapplication%2Fflow.action%3Fapp%3DUNSOL%26ID%3D3001%26HKOP%3D2de94b05869e4857c38ba3a5df71418d5ccbea5e43605c020c419744dbe79b6c&frm=0&tiba=Citi%20Online%20Consumer%20Card%20-%20Enter%20Information&data=event%3Dgtag.config&fmt=3&is_vtc=1&random=3080752617&rmt_tld=1&ipr=y

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.citicards.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 17 Oct 2023 22:13:35 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.com/pagead/1p-user-list/959299794/ 42 B
108 B 28ms
27ms Image
image/gif 2a00:1450:4001:828::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/959299794/?random=1697580815414&cv=11&fst=1697580000000&bg=ffffff&guid=ON&async=1&gtm=45be3ag0&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.citicards.com%2Fcards%2Fcredit%2Fapplication%2Fflow.action%3Fapp%3DUNSOL%26ID%3D3001%26HKOP%3D2de94b05869e4857c38ba3a5df71418d5ccbea5e43605c020c419744dbe79b6c&frm=0&tiba=Citi%20Online%20Consumer%20Card%20-%20Enter%20Information&data=event%3Dgtag.config&fmt=3&is_vtc=1&random=804698325&rmt_tld=0&ipr=y

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.citicards.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 17 Oct 2023 22:13:35 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.de/pagead/1p-user-list/959299794/ 42 B
108 B 29ms
28ms Image
image/gif 2a00:1450:4001:827::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/959299794/?random=1697580815414&cv=11&fst=1697580000000&bg=ffffff&guid=ON&async=1&gtm=45be3ag0&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.citicards.com%2Fcards%2Fcredit%2Fapplication%2Fflow.action%3Fapp%3DUNSOL%26ID%3D3001%26HKOP%3D2de94b05869e4857c38ba3a5df71418d5ccbea5e43605c020c419744dbe79b6c&frm=0&tiba=Citi%20Online%20Consumer%20Card%20-%20Enter%20Information&data=event%3Dgtag.config&fmt=3&is_vtc=1&random=804698325&rmt_tld=1&ipr=y

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.citicards.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 17 Oct 2023 22:13:35 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.com/pagead/1p-user-list/819500023/ 42 B
108 B 26ms
26ms Image
image/gif 2a00:1450:4001:828::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/819500023/?random=1697580815437&cv=11&fst=1697580000000&bg=ffffff&guid=ON&async=1&gtm=45be3ag0&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.citicards.com%2Fcards%2Fcredit%2Fapplication%2Fflow.action%3Fapp%3DUNSOL%26ID%3D3001%26HKOP%3D2de94b05869e4857c38ba3a5df71418d5ccbea5e43605c020c419744dbe79b6c&frm=0&tiba=Citi%20Online%20Consumer%20Card%20-%20Enter%20Information&data=event%3Dgtag.config&fmt=3&is_vtc=1&random=2416522156&rmt_tld=0&ipr=y

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.citicards.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 17 Oct 2023 22:13:35 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.de/pagead/1p-user-list/819500023/ 42 B
108 B 28ms
28ms Image
image/gif 2a00:1450:4001:827::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/819500023/?random=1697580815437&cv=11&fst=1697580000000&bg=ffffff&guid=ON&async=1&gtm=45be3ag0&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.citicards.com%2Fcards%2Fcredit%2Fapplication%2Fflow.action%3Fapp%3DUNSOL%26ID%3D3001%26HKOP%3D2de94b05869e4857c38ba3a5df71418d5ccbea5e43605c020c419744dbe79b6c&frm=0&tiba=Citi%20Online%20Consumer%20Card%20-%20Enter%20Information&data=event%3Dgtag.config&fmt=3&is_vtc=1&random=2416522156&rmt_tld=1&ipr=y

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.citicards.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 17 Oct 2023 22:13:35 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.com/pagead/1p-user-list/644574043/ 42 B
108 B 26ms
26ms Image
image/gif 2a00:1450:4001:828::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/644574043/?random=1697580815457&cv=11&fst=1697580000000&bg=ffffff&guid=ON&async=1&gtm=45be3ag0&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.citicards.com%2Fcards%2Fcredit%2Fapplication%2Fflow.action%3Fapp%3DUNSOL%26ID%3D3001%26HKOP%3D2de94b05869e4857c38ba3a5df71418d5ccbea5e43605c020c419744dbe79b6c&frm=0&tiba=Citi%20Online%20Consumer%20Card%20-%20Enter%20Information&data=event%3Dgtag.config&fmt=3&is_vtc=1&random=2231049914&rmt_tld=0&ipr=y

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.citicards.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 17 Oct 2023 22:13:35 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.de/pagead/1p-user-list/644574043/ 42 B
108 B 38ms
38ms Image
image/gif 2a00:1450:4001:827::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/644574043/?random=1697580815457&cv=11&fst=1697580000000&bg=ffffff&guid=ON&async=1&gtm=45be3ag0&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.citicards.com%2Fcards%2Fcredit%2Fapplication%2Fflow.action%3Fapp%3DUNSOL%26ID%3D3001%26HKOP%3D2de94b05869e4857c38ba3a5df71418d5ccbea5e43605c020c419744dbe79b6c&frm=0&tiba=Citi%20Online%20Consumer%20Card%20-%20Enter%20Information&data=event%3Dgtag.config&fmt=3&is_vtc=1&random=2231049914&rmt_tld=1&ipr=y

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.citicards.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 17 Oct 2023 22:13:35 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.com/pagead/1p-user-list/11172302925/ 42 B
108 B 26ms
26ms Image
image/gif 2a00:1450:4001:828::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/11172302925/?random=1697580815481&cv=11&fst=1697580000000&bg=ffffff&guid=ON&async=1&gtm=45be3ab0&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.citicards.com%2Fcards%2Fcredit%2Fapplication%2Fflow.action%3Fapp%3DUNSOL%26ID%3D3001%26HKOP%3D2de94b05869e4857c38ba3a5df71418d5ccbea5e43605c020c419744dbe79b6c&frm=0&tiba=Citi%20Online%20Consumer%20Card%20-%20Enter%20Information&data=event%3Dgtag.config&fmt=3&is_vtc=1&random=1004325066&rmt_tld=0&ipr=y

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:828::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.citicards.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 17 Oct 2023 22:13:35 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 /
www.google.de/pagead/1p-user-list/11172302925/ 42 B
108 B 37ms
37ms Image
image/gif 2a00:1450:4001:827::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/pagead/1p-user-list/11172302925/?random=1697580815481&cv=11&fst=1697580000000&bg=ffffff&guid=ON&async=1&gtm=45be3ab0&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.citicards.com%2Fcards%2Fcredit%2Fapplication%2Fflow.action%3Fapp%3DUNSOL%26ID%3D3001%26HKOP%3D2de94b05869e4857c38ba3a5df71418d5ccbea5e43605c020c419744dbe79b6c&frm=0&tiba=Citi%20Online%20Consumer%20Card%20-%20Enter%20Information&data=event%3Dgtag.config&fmt=3&is_vtc=1&random=1004325066&rmt_tld=1&ipr=y

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.citicards.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 17 Oct 2023 22:13:35 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 204
204 clear1.png;CIS3SID=1E9AE98D00C7721239A87FB1F61DDD37
content22.accountonline.com/fp/ Frame A63D 0
400 B 18ms
16ms Image
image/png 91.235.132.220
THM

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://content22.accountonline.com/fp/clear1.png;CIS3SID=1E9AE98D00C7721239A87FB1F61DDD37?org_id=89oebq5k&session_id=d73badfb6291512b9f1d43ffd18e1f8f2519636970c27cb58dfddf5166d9b69a&nonce=a16891807d617b66&pageid=1&jf=34333a247369665d706c6c3d7464705d455234384c6550776b71636e437a5e3a2473696c5d66637c673d33343b35373838383335267169645d767978673f7f656238676164736324716b6c5f6b657b3f3b3235393332333130363837326330343638636d3166323a32313234323a306130363638636733643231303932353833343032323034353561356b64306432613c666663313564663066693236663061333730393b6061303a616066616761623b343634643638643a356469353a3134623536316661373032663c31306537666c3138386167603b6532306235663c326632356e35323139366366323336643230636766643162396361663f34316d6461363b3a363224716b66577369673f31383636303230333230616b3561306b343435336c3367643032366637643735356c61333930613836363b336b66673b6433603a636537373061343166396464606b6330656367636361303a3231323867363364693435663b663236613232336438366634343231663731336b31646c3737343a603036303561663f6534356733306065616434333666373b39316130247169667a3f32

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

91.235.132.220 , United States, ASN30286 (THM, US),

Reverse DNS

Software

Apache /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.citicards.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 17 Oct 2023 22:13:35 GMT
Strict-Transport-Security: max-age=31536000
X-Content-Type-Options: nosniff
Server: Apache
Content-Type: image/png;charset=UTF-8
Cache-Control: no-cache, no-store, must-revalidate
Connection: Keep-Alive, Keep-Alive
Keep-Alive: timeout=2, max=93
X-XSS-Protection: 1; mode=block
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H/1.1 204
204 clear1.png;CIS3SID=8042F7610D8F63F95F75EB69B7C96A89
h.online-metrix.net/fp/ Frame F027 0
400 B 16ms
16ms Image
image/png 91.235.132.130
THM

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://h.online-metrix.net/fp/clear1.png;CIS3SID=8042F7610D8F63F95F75EB69B7C96A89?org_id=89oebq5k&session_id=d73badfb6291512b9f1d43ffd18e1f8f2519636970c27cb58dfddf5166d9b69a&nonce=a16891807d617b66&pageid=1&jf=34333a247369665d706c6c3d7464705d444730417241615b61396b35484d7b742473696c5d66637c673d33343b35373838383335267169645d767978673f7f656238676164736324716b6c5f6b657b3f3b3235393332333130363837326330343638636d3166323a32313234323a306130363638636733643231303932353833343032323034613666663e38623367633b3a35373960353562306e3965356a36346435386130346d37313660353066306c633031643666343634663f34633866633134353464323a35303962333567353b3a33613734663064653863376130643035663934313731303332323466613139356062663730623b61343f3b35306239373336646624716b66577369673f3138363630323033323038306338613a663b30326967633a69306531646131663569356630386365623a33626c31663c3361303731356237613734316263643a66393039313830606731303a323132383b32666230643a353134656366643b66393f656635663764313432646933603a33336333636561633733373a343039336039666136633a616036643f6164356d247169667a3f33

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

91.235.132.130 , United States, ASN30286 (THM, US),

Reverse DNS

h.online-metrix.net

Software

Apache /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://h.online-metrix.net/fp/sid_fp.html;CIS3SID=1E9AE98D00C7721239A87FB1F61DDD37?org_id=89oebq5k&session_id=d73badfb6291512b9f1d43ffd18e1f8f2519636970c27cb58dfddf5166d9b69a&nonce=a16891807d617b66&pageid=1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 17 Oct 2023 22:13:35 GMT
Strict-Transport-Security: max-age=31536000
X-Content-Type-Options: nosniff
Server: Apache
Content-Type: image/png;charset=UTF-8
Cache-Control: no-cache, no-store, must-revalidate
Connection: Keep-Alive, Keep-Alive
Keep-Alive: timeout=2, max=99
X-XSS-Protection: 1; mode=block
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2 200 7.6a5abbaac1addb20b44a.chunk.js Show response
siteintercept.qualtrics.com/dxjsmodule/ 2 KB
1 KB 25ms
25ms Script
application/javascript 104.17.208.240
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://siteintercept.qualtrics.com/dxjsmodule/7.6a5abbaac1addb20b44a.chunk.js?Q_CLIENTVERSION=1.101.0&Q_CLIENTTYPE=web&Q_BRANDID=citifeedback

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.17.208.240 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

243d7f52bc723643e7fd076024b91882b2890a851bb4490d74599de930f94edf

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.citicards.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Tue, 17 Oct 2023 22:13:35 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: br
age: 50604
cf-polished: origSize=2904
content-security-policy-report-only: frame-ancestors 'self' *.qualtrics.com *.my.salesforce.com *.visualforce.com *.visual.force.com *.lightning.force.com; report-uri https://sjc1.qualtrics.com/csp-report
edge-control: max-age=604800
referrer-policy: strict-origin-when-cross-origin
last-modified: Mon, 09 Oct 2023 17:51:04 GMT
cf-bgj: minify
server: cloudflare
etag: W/"b58-18b15905b40"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=604800, s-maxage=604800
permissions-policy: camera=(), geolocation=(), microphone=()
cf-ray: 817be3c18b0d0404-FRA
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept
timing-allow-origin: *

GET
H2 200 1.a605478b456b5ddb983a.chunk.js Show response
siteintercept.qualtrics.com/dxjsmodule/ 28 KB
7 KB 25ms
25ms Script
application/javascript 104.17.208.240
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://siteintercept.qualtrics.com/dxjsmodule/1.a605478b456b5ddb983a.chunk.js?Q_CLIENTVERSION=1.101.0&Q_CLIENTTYPE=web&Q_BRANDID=citifeedback

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.17.208.240 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

9c7432cbb5f36d9b00b72311825f7caab51cbbc29f387ec8a2b3b35e781a7351

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.citicards.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Tue, 17 Oct 2023 22:13:35 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: br
age: 50604
cf-polished: origSize=29370
content-security-policy-report-only: frame-ancestors 'self' *.qualtrics.com *.my.salesforce.com *.visualforce.com *.visual.force.com *.lightning.force.com; report-uri https://sjc1.qualtrics.com/csp-report
edge-control: max-age=604800
referrer-policy: strict-origin-when-cross-origin
last-modified: Mon, 09 Oct 2023 17:51:04 GMT
cf-bgj: minify
server: cloudflare
etag: W/"72ba-18b15905b40"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=604800, s-maxage=604800
permissions-policy: camera=(), geolocation=(), microphone=()
cf-ray: 817be3c18b0f0404-FRA
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept
timing-allow-origin: *

GET
H2 200 FeedbackButtonModule.js Show response
siteintercept.qualtrics.com/dxjsmodule/ 63 KB
23 KB 27ms
27ms Script
application/javascript 104.17.208.240
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://siteintercept.qualtrics.com/dxjsmodule/FeedbackButtonModule.js?Q_CLIENTVERSION=1.101.0&Q_CLIENTTYPE=web&Q_BRANDID=citifeedback

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.17.208.240 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

d276c47343bb731bd426b7414b9c1bda826998888df6fadd73fc49adf9b1ef64

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.citicards.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Tue, 17 Oct 2023 22:13:35 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: br
age: 50596
cf-polished: origSize=65278
content-security-policy-report-only: frame-ancestors 'self' *.qualtrics.com *.my.salesforce.com *.visualforce.com *.visual.force.com *.lightning.force.com; report-uri https://sjc1.qualtrics.com/csp-report
edge-control: max-age=604800
referrer-policy: strict-origin-when-cross-origin
last-modified: Mon, 09 Oct 2023 17:51:04 GMT
cf-bgj: minify
server: cloudflare
etag: W/"fefe-18b15905b40"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=604800, s-maxage=604800
permissions-policy: camera=(), geolocation=(), microphone=()
cf-ray: 817be3c18b100404-FRA
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept
timing-allow-origin: *

GET
H2 200 Asset.php Show response
siteintercept.qualtrics.com/WRSiteInterceptEngine/ 10 KB
2 KB 108ms
88ms XHR
application/json 104.17.209.240
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://siteintercept.qualtrics.com/WRSiteInterceptEngine/Asset.php?Module=SI_0AioryRkl8bxHM2&Version=25&Q_ORIGIN=https://www.citicards.com&Q_CLIENTVERSION=1.101.0&Q_CLIENTTYPE=web

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.17.209.240 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

4b99a4e92de3333bf62e8c2766dc1a880f1c19308c1591d2516974f6369b721a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.citicards.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

servershortname
date: Tue, 17 Oct 2023 22:13:35 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: MISS
content-encoding: br
content-security-policy-report-only: frame-ancestors 'self' *.qualtrics.com *.my.salesforce.com *.visualforce.com *.visual.force.com *.lightning.force.com; report-uri https://sjc1.qualtrics.com/csp-report
p3p: CP="CAO DSP COR CURa ADMa DEVa OUR IND PHY ONL UNI COM NAV INT DEM PRE"
edge-control: max-age=604800
referrer-policy: strict-origin-when-cross-origin
last-modified: Tue, 17 Oct 2023 22:13:35 GMT
server: cloudflare
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: *
cache-control: public, max-age=604800, s-maxage=604800, max-age=315360000
access-control-allow-credentials: false
permissions-policy: camera=(), geolocation=(), microphone=()
cf-ray: 817be3c1aa03bb50-FRA
expires: Fri, 14 Oct 2033 22:13:35 GMT

GET
H2 200 Asset.php Show response
siteintercept.qualtrics.com/WRSiteInterceptEngine/ 2 KB
782 B 700ms
684ms XHR
application/json 104.17.209.240
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://siteintercept.qualtrics.com/WRSiteInterceptEngine/Asset.php?Module=CR_6sPqDX4wKQujPO6&Version=9&Q_InterceptID=SI_0AioryRkl8bxHM2&Q_ORIGIN=https://www.citicards.com&Q_CLIENTVERSION=1.101.0&Q_CLIENTTYPE=web

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.17.209.240 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

566095a5f65029a8730735e82ff6cf43336a92723d96484db740011b88467aa1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.citicards.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

servershortname
date: Tue, 17 Oct 2023 22:13:36 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: MISS
content-encoding: br
content-security-policy-report-only: frame-ancestors 'self' *.qualtrics.com *.my.salesforce.com *.visualforce.com *.visual.force.com *.lightning.force.com; report-uri https://sjc1.qualtrics.com/csp-report
p3p: CP="CAO DSP COR CURa ADMa DEVa OUR IND PHY ONL UNI COM NAV INT DEM PRE"
edge-control: max-age=604800
referrer-policy: strict-origin-when-cross-origin
last-modified: Tue, 17 Oct 2023 22:13:36 GMT
server: cloudflare
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: *
cache-control: public, max-age=604800, s-maxage=604800, max-age=315360000
access-control-allow-credentials: false
permissions-policy: camera=(), geolocation=(), microphone=()
cf-ray: 817be3c1aa04bb50-FRA
expires: Fri, 14 Oct 2033 22:13:36 GMT

POST
H2 204 p Show response
bat.bing.com/p/insights/c/ 0
209 B 102ms
101ms XHR
text/plain 2620:1ec:c11::200
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://bat.bing.com/p/insights/c/p

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

Accept: application/x-webinsights-gzip
Referer: https://www.citicards.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
date: Tue, 17 Oct 2023 22:13:35 GMT
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: F273D07D8C5A4086AECBA0B2FB57954D Ref B: FRAEDGE2016 Ref C: 2023-10-17T22:13:35Z
vary: Origin
x-cache: CONFIG_NOCACHE
access-control-allow-origin: https://www.citicards.com
access-control-allow-credentials: true
request-context: appId=cid-v1:2f7711a9-b21e-4abe-a9d6-5b0ce5d18b64

POST
H2 200 tp2 Show response
p.tvpixel.com/com.snowplowanalytics.snowplow/ 2 B
329 B 104ms
103ms XHR
text/plain 34.232.37.73
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://p.tvpixel.com/com.snowplowanalytics.snowplow/tp2
Requested by: Host: www.citicards.com
URL: https://www.citicards.com/assets/scripts/global/6c8322c7341eac98645c10e3d1d3c7ae.js?seed=AAAjpz-LAQAAFC_bMRxQoajWvZoUseb7-9M_13CDQMMWDa5kNV3LRXPZ6k5d&X-soz9htCz--z=q
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.232.37.73 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-232-37-73.compute-1.amazonaws.com
Software: nginx /
Resource Hash: 2689367b205c16ce32ed4200942b8b8b1e262dfc70d9bc9fbc77c49699a4f1df

Request headers

Referer: https://www.citicards.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36
Content-Type: application/json; charset=UTF-8

Response headers

access-control-allow-origin: https://www.citicards.com
date: Tue, 17 Oct 2023 22:13:35 GMT
access-control-allow-credentials: true
content-type: text/plain; charset=UTF-8
server: nginx
content-length: 2
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR NID PSA OUR IND COM NAV STA"

OPTIONS
H2 200 tp2
p.tvpixel.com/com.snowplowanalytics.snowplow/ Frame 0
0 103ms
103ms Preflight 34.232.37.73
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://p.tvpixel.com/com.snowplowanalytics.snowplow/tp2
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.232.37.73 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-232-37-73.compute-1.amazonaws.com
Software: nginx /
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: content-type
Access-Control-Request-Method: POST
Origin: https://www.citicards.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Content-Type, SP-Anonymous
access-control-allow-origin: https://www.citicards.com
access-control-max-age: 600
content-length: 0
date: Tue, 17 Oct 2023 22:13:35 GMT
server: nginx

GET
H/1.1 200
OK /
servedby.flashtalking.com/spot/1/26288;134985;14791/ Frame 1BF2 42 B
343 B 34ms
34ms Image
image/gif 23.212.202.173
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://servedby.flashtalking.com/spot/1/26288;134985;14791/?spotName=AA_Advantage_World_Elite_Card_Application_Start&U1=093&U2=&U3=null&U4=jJRSACQ_AboutYou_AA&U11=&cachebuster=1111094252

Requested by

Host: 6260004.fls.doubleclick.net
URL: https://6260004.fls.doubleclick.net/ddm/fls/r/dc_pre=CO34zauN_oEDFQ6Tmwod-7sB4w;src=6260004;type=appli0;cat=aaadv000;qty=1;cost=1995.27;ord=1746401848952.357;auiddc=583581942.1697580813;u1=093;u3=null;u4=jJRSACQ_AboutYou_AA;u11=;gtm=45fe3ag0;uaa=;uab=;uafvl=;uamb=0;uam=;uap=;uapv=;uaw=0;epver=2;~oref=https%3A%2F%2Fwww.citicards.com%2Fcards%2Fcredit%2Fapplication%2Fflow.action%3Fapp%3DUNSOL%26ID%3D3001%26HKOP%3D2de94b05869e4857c38ba3a5df71418d5ccbea5e43605c020c419744dbe79b6c

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

23.212.202.173 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-212-202-173.deploy.static.akamaitechnologies.com

Software

prod-xre-app11.frk11 /

Resource Hash

47043e4823a6c21a8881de789b4185355330b5804629d23f6b43dd93f5265292

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://6260004.fls.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 17 Oct 2023 22:13:35 GMT
Strict-Transport-Security: max-age=86400
Server: prod-xre-app11.frk11
Content-Type: image/gif
Cache-Control: max-age=0, no-cache, no-store
Connection: keep-alive
Content-Length: 42
Expires: Tue, 17 Oct 2023 22:13:35 GMT

GET
H2 200 spp.pl
sp.analytics.yahoo.com/ Frame 1BF2 43 B
632 B 110ms
35ms Image
image/gif 212.82.100.181
YAHOO-IRD

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://sp.analytics.yahoo.com/spp.pl?a=10000&.yp=10114464&ec=consumer

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

212.82.100.181 Dublin, Ireland, ASN34010 (YAHOO-IRD, GB),

Reverse DNS

spdc.pbp.vip.ir2.yahoo.com

Software

ATS /

Resource Hash

0e4b1e428a2198ef747010c094101c257b568a97cdcc0f31ed5e9868cc835b39

Security Headers

Name	Value
Content-Security-Policy	sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://6260004.fls.doubleclick.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 17 Oct 2023 22:13:35 GMT
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
server: ATS
content-security-policy: sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
age: 0
expect-ct: max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-frame-options: DENY
content-type: image/gif
cache-control: no-cache, private, must-revalidate
accept-ranges: bytes
content-length: 43
expires: Tue, 17 Oct 2023 22:13:35 GMT

GET
H/1.1 204
No Content clear.png Show response
content22.accountonline.com/fp/ Frame A63D 0
387 B 14ms
13ms Script
text/javascript 91.235.132.220
THM

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

91.235.132.220 , United States, ASN30286 (THM, US),

Reverse DNS

Software

Apache /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.citicards.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

Pragma: no-cache
Date: Tue, 17 Oct 2023 22:13:36 GMT
Strict-Transport-Security: max-age=31536000
X-Content-Type-Options: nosniff
Server: Apache
Content-Type: text/javascript
Cache-Control: no-cache, no-store, must-revalidate
Connection: Keep-Alive
Keep-Alive: timeout=2, max=92
X-XSS-Protection: 1; mode=block
Expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2 200 Graphic.php
iad1.qualtrics.com/WRQualtricsSiteIntercept/ 2 KB
3 KB 57ms
13ms Image
image/png 184.30.20.101
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://iad1.qualtrics.com/WRQualtricsSiteIntercept/Graphic.php?IM=IM_2ghDuHHjeSOirNc

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

184.30.20.101 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a184-30-20-101.deploy.static.akamaitechnologies.com

Software

Resource Hash

25f4eeb23f67fe1d74534ed37230ecd54ab4f57524276970dcbeaaf3b0fc64f9

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.citicards.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Tue, 17 Oct 2023 22:13:36 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
content-security-policy-report-only: frame-ancestors 'self' *.qualtrics.com *.my.salesforce.com *.visualforce.com *.visual.force.com *.lightning.force.com; report-uri https://sjc1.qualtrics.com/csp-report
content-disposition: inline; filename=feedback.png
content-length: 2196
x-request-id: 3c85c64c-8d5e-49dc-9c9d-bc6ad64287e6
referrer-policy: strict-origin-when-cross-origin
etag: "e6ed675f115fb1568bb1aabc00aa3f30"
content-type: image/png
access-control-allow-origin: *
x-transaction-id: faf96004-31bd-4b20-b9c5-84d42c693f9b
cache-control: public, max-age=2
permissions-policy: camera=(), geolocation=(), microphone=()
x-robots-tag: noindex
expires: Tue, 17 Oct 2023 22:13:38 GMT

POST
H2 200 / Show response
siteintercept.qualtrics.com/WRSiteInterceptEngine/ 45 B
216 B 34ms
34ms XHR
text/plain 104.17.209.240
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://siteintercept.qualtrics.com/WRSiteInterceptEngine/?Q_Impress=1&Q_CID=CR_6sPqDX4wKQujPO6&Q_SIID=SI_0AioryRkl8bxHM2&Q_ASID=AS_07210024&Q_CLIENTVERSION=1.101.0&Q_CLIENTTYPE=web&r=1697580816383

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.17.209.240 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f47f21063dfdcbdeffed3d97689b45efae7a52401cd7fc5b8d07c42d2f232ab9

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.citicards.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36
Content-type: application/x-www-form-urlencoded

Response headers

date: Tue, 17 Oct 2023 22:13:36 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-encoding: br
cf-cache-status: DYNAMIC
x-content-type-options: nosniff
content-security-policy-report-only: frame-ancestors 'self' *.qualtrics.com *.my.salesforce.com *.visualforce.com *.visual.force.com *.lightning.force.com; report-uri https://sjc1.qualtrics.com/csp-report
referrer-policy: strict-origin-when-cross-origin
server: cloudflare
vary: Accept-Encoding
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://www.citicards.com
cache-control: no-store, no-cache, must-revalidate, max-age=0
access-control-allow-credentials: true
permissions-policy: camera=(), geolocation=(), microphone=()
trace-id: 9ec9f589d57a70aa
cf-ray: 817be3c66c35bb50-FRA

GET
H2 200 wr-dialog-close-btn-white.png
siteintercept.qualtrics.com/WRQualtricsShared/Graphics/siteintercept/ 254 B
547 B 24ms
24ms Image
image/png 104.17.208.240
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://siteintercept.qualtrics.com/WRQualtricsShared/Graphics/siteintercept/wr-dialog-close-btn-white.png

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.17.208.240 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

cd5496f75a7c1029bc681f639794b83f034d5ecd884e8514ae12b13eee9eec70

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.citicards.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

expires: Thu, 17 Mar 2033 11:41:25 GMT
date: Tue, 17 Oct 2023 22:13:36 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
age: 18268331
cf-polished: origSize=759
p3p: CP="CAO DSP COR CURa ADMa DEVa OUR IND PHY ONL UNI COM NAV INT DEM PRE"
content-length: 254
referrer-policy: strict-origin-when-cross-origin
last-modified: Tue, 28 Feb 2023 19:32:28 GMT
cf-bgj: imgq:85,h2pri
server: cloudflare
vary: Accept-Encoding
content-type: image/png
cache-control: max-age=315360000, public
permissions-policy: camera=(), geolocation=(), microphone=()
accept-ranges: bytes
cf-ray: 817be3c66f630404-FRA
trace-id: 75d12b1d8566c104
servershortname

GET
H/1.1 204
204 clear3.png;CIS3SID=1E9AE98D00C7721239A87FB1F61DDD37 Show response
content22.accountonline.com/fp/ Frame A63D 0
218 B 15ms
14ms Script
text/javascript 91.235.132.220
THM

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

91.235.132.220 , United States, ASN30286 (THM, US),

Reverse DNS

Software

Apache /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.citicards.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

Date: Tue, 17 Oct 2023 22:13:36 GMT
Strict-Transport-Security: max-age=31536000
Server: Apache
Connection: Keep-Alive
Keep-Alive: timeout=2, max=91
Content-Type: text/javascript;charset=UTF-8

GET
H2 204 r.rnc
data.privacy.ensighten.com/privacy/v1/b/ 0
106 B 12ms
12ms Image
text/plain 3.124.173.63
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://data.privacy.ensighten.com/privacy/v1/b/r.rnc?n=4&c=1129&i=5gxb4r&p=na_prod&s=15766&d=8HB7InZlcnNpb24iOiIxLjAuMCIsImdhdGV3YXkiOiIyLjMuNjExIiwiY2xpZW50SWQiOjExMjksInB1Ymxpc2hQYXRoIjoibmFfcHJvZCIsImluc3RhbmNlSWQiOiI1Z3hiNHIiLCJwYWNrZXQiOjQsIm1vZGUiOiJlbmZvcmNlWgDwCG9va2llcyI6eyJCQU5ORVJfTE9BREVEkQDyJyJ9LCJlbnZpcm9ubWVudCI6IkNCT0wgUHJpdmFjeSIsInJlcXVlc3RzIjpbeyJkZXN0aW5hdM4A8TpodHRwczovL3AucmZpaHViLmNvbS9jYS5odG1sP3Zlcj05JnJhPTE5MjkmcmI9NjQ4JmNhPSZfbz0xNzE2OTE3NSZfdD0mcGU9SQDwByUzQSUyRiUyRnd3dy5jaXRpY2FyZHNUADElMkYMAAAIAOFyZWRpdCUyRmFwcGxpY4oAoCUyRmZsb3cuYWOYACAlMxwA8GYlM0RVTlNPTCUyNklEJTNEMzAwMSUyNkhLT1AlM0QyZGU5NGIwNTg2OWU0ODU3YzM4YmEzYTVkZjcxNDE4ZDVjY2JlYTVlNDM2MDVjMDIwYzQxOTc0NGRiZTc5YjZjJnBmPSZyYT01MDY1MjU2OTcyOTk3MTDGAfAVdHlwZSI6ImlmcmFtZSIsInN0YXJ0IjoxNjk3NTgwODE0NzIzcgEA5wEFFAChODU2LCJzb3VyYzwAo25zZXJ0QmVmb3JCAKF0dXMiOiJsb2FkkQH0BmFzb25zIjpbXSwiZGF0YVBhdHRlchIAQmxpc3QcABJpZADPNjY5NjgwNTk1MH0swgH_NC80OMIBDDFtdXSaAqJPYnNlcnZlckNMCgIPyAEyLzc1yAEH8AN6bjN2aThra3VkczBqanJmYy1JA_EQZmVlZGJhY2suc2l0ZWludGVyY2VwdC5xdWFsdHJpY2QD8QMvU0lFLz9RX1pJRD1aTl8zVklHAKNTMEpKUkZjIiwi2QJic2NyaXB0zwAM2QIeMRcBJzY42QKgYXBwZW5kQ2hpbMgCP3N0YRABK580Mzc4NjU1NzgQAYQPJwIBCRABDycCQwIXAS82MCcCCIBiYXQuYmluZ10FEi83BfCkLzA_dGk9MTYwMDE2OTImVmVyPTImbWlkPTg1YzgwMWQwLTY3NWEtNDZmOS05ZDgwLTA4NjQ3YzUxNTc3NSZzaWQ9NjlmYzJiZDA2ZDNhMTFlZTk5N2EyM2YyM2VlZjM0NTcmdmlkPTY5ZmMxYjUwNmQzYTExZWU4MWEyYWZhZTQzYTJkYzdjJnZpZHM9MSZtc2Nsa2lkPU4mcGk9MTIwMDEwMTUyNSZsZz1lbi1VUyZzdz2tADEmc2gfAPATJnNjPTI0JnRsPUNpdGklMjBPbmxpbmUlMjBDb25zdW1lcgsAsGFyZCUyMC0lMjBFBgNAJTIwSSUHEW2tAz8mcD2IBp7xFXI9Jmx0PTc1ODkmZXZ0PXBhZ2VMb2FkJnN2PTEmcm49OTM5N10IA74DP2ltZ7sDAS84N5QGAAAUAAWUBvIHSFRNTEltYWdlX1NFVEFUVFJJQlVURUwAAsYDYGFsbG93ZdkDL3JloQYbrzU0ODU5NDQwNjLJAwcPsgKNJjAmsgL2DGVjPWpKUlNBQ1FfQWJvdXRZb3VfQUEmZWE9QbUIbyZldj05M3QCPA8WAwQAGwJgY3VzdG9tFAJmODg0NDg10gUPFAIGHjbPBRg3qAgPFAJJrzgzMDAzMzA1NzEUAhQAIQImanPWAA-oBggvNDXZAAAIqAYfaYEJO683NDI3NDU3ODA3zABAD4sIABg3zAAPZAZCBNIAHzFTCggAkQEPZAYGRzM3NDNkBv8UYTU1YzI4NTYtZjAwMS00ZjYzLThhOTUtY2ZiMzRiMTc1YWFkBj4IsgMPZAb_K2YyNTM2NDl6Aw9QBAUuODJ3AwAUAA9kBlKfODU5NjEyNjM2LQoID7ICmQ9kBoxvMjc2Njk4FAIQD3gIACc4MzMMD2QGSa85MTUxMjcyMDY0mAVADz0HACc4NdkAD2QGRQ_gAgj_HGluc2lnaHQuYWRzcnZyLm9yZy90cmFjay91cD9hZHY9MWp3NWN2bCZyZWYKC5_wEXVwaWQ9aHFnb3dweiZ1cHY9MS4xLjAmaWQ9dHRkVW5phBOoYWxQaXhlbFRhZ48RXzYmdGQxsgkCd3RkMj0wOTPHAg_WEQYQON0BImVuchED6hEBFAAK3gRfRlJBTUVDC0CPNjc3MDIzNjBjCAkoanP6ATB1cF9QEjFlci4pAR8uPAkVHzfFBQAP2AJIjzU2MjI2OTQxuAUJD9kAMw9JCQAA1AEFwAEPSQlCBd8AHzmDBAckYzFfFd9uZXQvanMvdGMubWlusgEVHjJ3Bxk5dwcPigQ9jzk5OTU5MjA30wBHD1kRAArTAA-sAUISN9kAHzFZEf__HQ0ICEc1MDc3CAgMqwIYQVQRX2Vycm9y8xcgBVIRDwQUqAigDQ_uCowPUhEnLzUwrQ8KDw0CMg9LER4MERYPrQ__4w2ZDQ-rAgwK4xoPuQQlBacPDz0ICA-nD5kPWRL_VBw0lAwPrAIMD1cFMwNSEh83BBW0D2QHjA9SEhYPDQJiBUsSD3EJCFBwLnR2cIAQAXYd8ANjb20uc25vd3Bsb3dhbmFseXSJHwQSAEYvdHAydxAgeGgFCgxKIj41MTBdCgEUAAW0DrhYSFJfTUFOQUdFUlcKD6sbKI82NjkwNTA3M8sYCA_oANUZY9AB8QBqcy9jdXJyZW50L2RwbV_pARJfpw9QP2FpZD2IIfAjLWQ0Zjg1ODI0LTEzNTEtNDU1NC05MWZmLWZkYjU2Zjk2MmM1YyZjb21zY29yZT10cnUAJAO7HQ_RGgkPCAIAJzEwZQwP4w88rzg5MDYwODM0Nza2EAgPHgF3DdoRKTUxHgEMgw0KywgAJhMPgw0gBSQBD5EVCADpJvEBZ29vZ2xldGFnbWFuYWdlch0E9wdndGFnL2pzP2lkPUFXLTkxNjQ1MTQ3XyYPDQIIHTLeHD81MTOiE0hgOTU5MDIyZSYPDQIHD-kAQg4GEgvpAA_YAUID7wAvNzGiCgiBc3IucmxjZG7MAWI0MjU0NjYUKfgjZXM9ODA2NzYmdT1kYTM5YTNlZTVlNmI0YjBkMzI1NWJmZWY5NTYwMTg5MGFmZDgwNzBYGw99FgYtNzKWFTg1MTmrHw96JTtANzI5NkIXHzGdHwgPBAFeDw8CAQkEAQ8PAkIECwEfM7wiCLFsaXZlLnJlenluYxIC8D5zeW5jP2M9MTZiNjQxMDQzMWI2Mzc0ZTc4MDEwNGFiYjA0NDNjYTgmcD03ZTMyMzIyZGUzOThmN2E4MGY2ZGEwZWUxY2VjOWE5YiZrPVgGUWJhbmstcgZiLTY2Njcm7CHTMT17X2RsLmV2ZW50fRQAFDIUAKRhclBhZ2VOYW1lGwASMxsANHBpZBIAEjQSAFRDVVVJRBQAEjUUAACLLIN1Y3RzWzBdLgwAhF9kZXRhaWxzKgAVNioAYHNwZWN0X1gAUXptcElECwcAswDgJmNhY2hlX2J1c3Rlcj1RAgMiKzAzMyaeADJVcmxEAFB1cmx9Jtwkpl9yZWZlcnJlcj0dCQ8LBQgeM8UONzMwMhgHDxcDO584OTI4MDIzMDIXBwgPDAL_Zw8fBAAKDAIPHwRCBBMCHzQqBQkPlSsIcFdSU2l0ZUmtKACzK9BFbmdpbmUvVGFyZ2V0wCkwcGhwtCs_b25ltysC8AEmUV9DTElFTlRWRVJTSU9OFR0QMBcdBBgAhlRZUEU9d2ViTwMPbAwELjMwVwgBFAAUc7YuD2wMPp84MTI0NDA1MTFUDQgP0SwJDzwB_yr0HWR4anNtb2R1bGUvMTIuNTJjYmJjZjUzMjg3YmJkMmJiMDMuY2h1bmsuanM_TAIPZAINsCZRX0JSQU5ESUQ9EAoAuQYB1jEAFAcGgAIPzwUHLjg25ww_MzA5zwVGnzkxNjU3ODM5NrwDJA9EAYMOKgoKRAEPBwVCBUsBDyYJCA-eIv9KLjk4FhMoMzMKCQ_3AUIDliIvMTARCQgABwRxLmJyaWRnZY0kAA4EA5ckABsAASIEQC9zLz_fI_ADMDkzV0UmZG9jaWQ9RERfQXBwJwpRJmFwcD3tNQAKAFBJZD0wJjMR8RM9Q09OU1VNRVImcj03NDY5Mzc5ODkwNTQ0LjY4NzUmUHJvmApwSUQ9bnVsbEAwX0E0WEVDZQ8SLTgy6zI4NTMziwQPUAFCnzkwODA1MTA4M5IECAkeGRRw3TEAKzEA2DEPNSIUPTg3MFMXKDM0MAIPOgs9fzExNDY1MjUgBAgP2QA0D0QGAAnZAA-5AUIjODngAA8NEggP4AAHAIAdD7kBFR84uQFbQDY0MTXfEB82pAkID9kANA_MDQAPuQFPBeAAD7kBCAAAD6IucmVwb3J0Lm5hfA_BZXJleHBlcmllbmNlzDoB1wSSZ2xhc3Nib3gvLgDAaW5nLzc5OGIyZjEy5RNQMi00YTkSFvIFZWUtODA1ZDg4M2NhMjY2L2Nsc18zAPAGP2Nsc2pzdj02LjYuMTE4QjI1NiZfHwDyGXM9YTY0MGZkOTgtYTBjMi00ZmU5LTg4MzQtOGM0ZmVkNzBlY2FlOjAuAPAYdj1kODUwOTA4My1hYzRjLTQyNDgtOGZiZi0zYmFiNzViZWFmYzkmdAXwJGY4MTdhZDNmLTM5ZGMtNDUyOC05NGVjLTcyYjQ2MjQzOTY5YSZzbj0xJmNmZyZwdj0yJu8WBtEJD1EMBQ6GMSA1MxQAD1EMSMA3ODA0MTE2Mzd9XX0
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 3.124.173.63 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-124-173-63.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.citicards.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Tue, 17 Oct 2023 22:13:37 GMT
cache-control: no-cache, no-store
server: nginx
expires: Tue, 17 Oct 2023 22:13:36 GMT

GET
H2 204 r.rnc
data.privacy.ensighten.com/privacy/v1/b/ 0
106 B 12ms
11ms Image
text/plain 3.124.173.63
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://data.privacy.ensighten.com/privacy/v1/b/r.rnc?n=5&c=1129&i=5gxb4r&p=na_prod&s=15728&d=8HB7InZlcnNpb24iOiIxLjAuMCIsImdhdGV3YXkiOiIyLjMuNjExIiwiY2xpZW50SWQiOjExMjksInB1Ymxpc2hQYXRoIjoibmFfcHJvZCIsImluc3RhbmNlSWQiOiI1Z3hiNHIiLCJwYWNrZXQiOjQsIm1vZGUiOiJlbmZvcmNlWgDwCG9va2llcyI6eyJCQU5ORVJfTE9BREVEkQDyJyJ9LCJlbnZpcm9ubWVudCI6IkNCT0wgUHJpdmFjeSIsInJlcXVlc3RzIjpbeyJkZXN0aW5hdM4AgGh0dHBzOi8vmQDyIC5yZXBvcnQubmFjdXN0b21lcmV4cGVyaWVuY2UuY2l0aS5jb20vZ2xhc3Nib3gvLgDyHmluZy83OThiMmYxMi05MTYyLTRhOTQtOTFlZS04MDVkODgzY2EyNjYvY2xzXzMA8AY_Y2xzanN2PTYuNi4xMThCMjU2Jl8fAPIZcz1hNjQwZmQ5OC1hMGMyLTRmZTktODgzNC04YzRmZWQ3MGVjYWU6MC4A_Xx2PWQ4NTA5MDgzLWFjNGMtNDI0OC04ZmJmLTNiYWI3NWJlYWZjOSZwaWQ9ZjgxN2FkM2YtMzlkYy00NTI4LTk0ZWMtNzJiNDYyNDM5NjlhJnNuPTEmY2ZnJnB2PTImYWlkPSIsInR5cGUiOiJ4aHIiLCJzdGFydCI6MTY5NzU4MDgxNTM0NSwiZW5kFADyBXNvdXJjZSI6IlhIUl9NQU5BR0VSQQDRdHVzIjoiYWxsb3dlZJwBQGFzb26bAdRdLCJkYXRhUGF0dGVyEgCwbGlzdCI6W10sImlWAu82OTg3ODA0MTE2Mzd9LM0BBfIFd3d3Lmdvb2dsZXRhZ21hbmFnZXK8AfAKdGFnL2pzP2lkPUFXLTk2MDYyMTg3NSZsPXoAtUxheWVyJmN4PWMi-QBic2NyaXB0uwAK_AAwMTMxdwIClgATNxABRTY4LCL8AMJpbnNlcnRCZWZvcmVCAAL9AD9sb2H6ACGvNjY4NDgzNTAyNfoAbh80-gAMMW11dGEDr09ic2VydmVyQ0wAATkfOAABL483NTcwMTk0N_oBNy84NvoBR585NzIzOTE1NjX6AG8P-gEACfoAD_oBQgQAAS82MfoBLp82OTUyMzExNjL6ASQdMvoCLzQw9ANInzgyOTUzOTI2OfQDLw_6AC0O-gEK-gAP-gFCBQABD-4FMI81OTI5OTc5NPoBJB4z-gEfMvQDSK83NTAxMTYwOTcw9AIuHzn6ACwP-gEACfoAD_oBQgUAAQ_0Ay-fODE5NTAwMDIz-gE3HzT0A0hgNzA2OTA19AQP-gEuD_oALQ_6AQAJ-gAP-gFDBAABHzQAAS6PNjQ0NTc0MDT6ASUO4gk_NDY56AdHnzc0NzUzMjgyMfQDLw_6AC0P-gEACfoAD_oBQwQAAR8z-gEurzExMTcyMzAyOTLeCyUPAgEAJzky_AEPAgFCnzk3MDg5MDU2MvYEMI8zMDkwNzk2OfYEJA7qCDc1MTUAAQ_eDDyfNTUyNjQxMTA5_AEvHzj6ACwO-gEK-gAP-gFCBQABD-oJL68xMDk1NTAwNjk1_AElDuwILzUz7AhJnzgzMzIyMDk2NvgDLw_8AC4P_gEACfwAD_4BQhQ3AgEP6AoIAtIQ8xxhZHMuZy5kb3VibGVjbGljay5uZXQvcGFnZWFkL3ZpZXd0aHJvdWdoY29utBP2BC85MTY0NTE0NzEvP3JhbmRvbT3CEdsxMjEmY3Y9MTEmZnN0GABBYmc9ZgEA8BYmZ3VpZD1PTiZhc3luYz0xJmd0bT00NWJlM2FnMCZ1X3c9MTYwCQBAaD0xMgkAMXJsPVkTkCUzQSUyRiUyRpIRAEITUGNhcmRzixExJTJGDAAACADhcmVkaXQlMkZhcHBsaWM5EKAlMkZmbG93LmFjqBMgJTMcAPVUJTNEVU5TT0wlMjZJRCUzRDMwMDElMjZIS09QJTNEMmRlOTRiMDU4NjllNDg1N2MzOGJhM2E1ZGY3MTQxOGQ1Y2NiZWE1ZTQzNjA1YzAyMGM0MTk3NDRkYmU3OWI2YyZobj13OBIgYWS5EDFpY2WtAPAVJmZybT0wJnRpYmE9Q2l0aSUyME9ubGluZSUyMENvbnN1bWVyCwDRYXJkJTIwLSUyMEVudBMAEEnBFBFt0wAgJmFFAaU1ODM1ODE5NDIuhAHwADMmdWFtYj0wJnVhdz0wJooS8A09ZXZlbnQlM0RndGFnLmNvbmZpZyZyZm10PTMmBgAfNKESEx0wswwKxwOgYXBwZW5kQ2hpbJASP3N0YaASKp81NTgzMzAzNTemEAgPxAL__yEPjwViBMsCLzgykQYH0GNkbi5ib29tdHJhaW7TBGAvcDEzbi_mBEFiYW5rDgB_Lm1pbi5qc64DES4zMG0MLzU3cQpOnzg5MTc1NjI5MnMMCHBiYXQuYmluiQTwAG0vcC9pbnNpZ2h0cy90L_cFTzE2OTLhABIfNOEAACc4NFIKD1oHQp81NDcwNDQyNDdcCAgPlgQmBWoKD1oHAD81MDNaBwIAGAAPWgf_rS81MZYEABg4HQ0PywJCnzkwMjEwMjM3NyMMCA_LAiYHNQwPzQIBLzI1zQIDPzI1Js0C_64fM80CAQjuDQ_NAkKfNTc3OTc1NjY08A8ID80CJgXaHQ_LAgA_MzU3ywICABgAD8sCERBi6QwP8gz_hD4zNjfyDC84N2MITZ82MDEyNzgyNzVjCEEUOaseD8sCAR83lgUDLzM3lgX_rxAzTwgaZVojKDU4dhoPlgVCjzcyNDEzMDQy-QwJD5YFJgWCHg_LAgEfOcsCBB85ywL_rz80MDaWBQAIywIPiBI7nzYyMDE0OTkzMkwVQQ_EAv_nD1oIAQjEAg-PBUIFywIPUxVCBBciD48FAD80MTQlCwIAGAAPJQsRDxcY_4kuNDK0Kyg1ONYgD8sCQ48xNTUwNjc0N1MVCA9aCCYF6CIPywIBHzPwDQM_NDM3uxD_ri80NJYFAQ_LAk6PNTc5MDAyNTCVKQkPywImBbkjD8sCAQ-7EAQvNDXLAv-wD7sQASc5MLsQDyULPI84OTY3NjA4MWUnCA_EAv__IR446Q0JxAIPWghDBMsCDxcZQgZIKA-RBQEfOD4jAz80ODFcCBIPTBb_iRA0uQIMgRMvOTGRBUePNzgxMDE1NjYgC0EHDisPxgL_3g91IQAJxgIPkwVDBM0CD90bCFBzaXRlaScn0WNlcHQucXVhbHRyaWNwJ_ECL2R4anNtb2R1bGUvQ29yZU0LAPQNLmpzP1FfQ0xJRU5UVkVSU0lPTj0xLjEwMS4wJhgA8ARUWVBFPXdlYiZRX0JSQU5ESUQ9kSOPZmVlZGJhY2uoIhEuNTb-Ki82MIkjT8A2ODg0NTY2MDR9XX0
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 3.124.173.63 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-124-173-63.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.citicards.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Tue, 17 Oct 2023 22:13:37 GMT
cache-control: no-cache, no-store
server: nginx
expires: Tue, 17 Oct 2023 22:13:36 GMT

GET
H2 204 r.rnc
data.privacy.ensighten.com/privacy/v1/b/ 0
106 B 12ms
12ms Image
text/plain 3.124.173.63
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://data.privacy.ensighten.com/privacy/v1/b/r.rnc?n=6&c=1129&i=5gxb4r&p=na_prod&s=6887&d=8HB7InZlcnNpb24iOiIxLjAuMCIsImdhdGV3YXkiOiIyLjMuNjExIiwiY2xpZW50SWQiOjExMjksInB1Ymxpc2hQYXRoIjoibmFfcHJvZCIsImluc3RhbmNlSWQiOiI1Z3hiNHIiLCJwYWNrZXQiOjQsIm1vZGUiOiJlbmZvcmNlWgDwCG9va2llcyI6eyJCQU5ORVJfTE9BREVEkQDyJyJ9LCJlbnZpcm9ubWVudCI6IkNCT0wgUHJpdmFjeSIsInJlcXVlc3RzIjpbeyJkZXN0aW5hdM4A9BxodHRwczovL3NpdGVpbnRlcmNlcHQucXVhbHRyaWNzLmNvbS9XUlNpdGVJHgDyHUVuZ2luZS9Bc3NldC5waHA_TW9kdWxlPVNJXzBBaW9yeVJrbDhieEhNMiZWNgHUPTI1JlFfT1JJR0lOPXIAwXd3dy5jaXRpY2FyZGgA9QkmUV9DTElFTlRWRVJTSU9OPTEuMTAxLjAYAPAdVFlQRT13ZWIiLCJ0eXBlIjoieGhyIiwic3RhcnQiOjE2OTc1ODA4MTU2MDgSAQCHAQoUAFBzb3VyYzkAslhIUl9NQU5BR0VSQQDRdHVzIjoiYWxsb3dlZDMBQGFzb24yAdRdLCJkYXRhUGF0dGVyEgCzbGlzdCI6W10sImlmAL8zNjk0MzM0OTd9LGQB_631A0NSXzZzUHFEWDR3S1F1alBPNsgCRTkmUV8IAy9JRPMCAQ_oAlouMTHoAgAUAA_oAkevODI3MDk1NDgwM-gCSg-EAf8vgWJhdC5iaW5nwQX2BHAvaW5zaWdodHMvcy8wLjcuMTNEBWJzY3JpcHQGBQpHBT41ODNfAkUzMSwiXwIxbXV0SQaiT2JzZXJ2ZXJDTEgAAk4FP2xvYUsFIp80ODQ5MTI4NTFjAiNRZHhqc22TBv8SLzcuNmE1YWJiYWFjMWFkZGIyMGI0NGEuY2h1bmsuanM_cgYVsCZRX0JSQU5ESUQ9swaPZmVlZGJhY2tFARE_NjA3RQEAFzlFAaBhcHBlbmRDaGlsLgE_c3RhPgEqrzkwMzk5MjIwNzQ-AbIvMTQ-AQwPgwJCBEUBHziDAi__BjEuYTYwNTQ3OGI0NTZiNWRkYjk4M4MCcC80MIMCRq84MzI4Njc2ODA5gwIuDz4BcQ-DAgEJPgEPgwJCBEUBLzE2RQEuE0avBGJCdXR0b26uCw_-BGkvNDV7AkavNTk3MTI1NDM1MjYBqg9zAgIINgEPcwJCBT0BD7gDCPMbNjI2MDAwNC5mbHMuZG91YmxlY2xpY2submV0L2FjdGl2aXR5aTtzcmM9KgAQO6sNtD1hcHBsaTA7Y2F0CwDwEHF0eT0xO2Nvc3Q9MTtvcmQ9Mjg3OTg1MzUxMzMxOS7EAfUDO2F1aWRkYz01ODM1ODE5NDIu4w3yHDM7dTE9MDkzO3UzPW51bGw7dTQ9akpSU0FDUV9BYm91dFlvdV9BQTt1MTJxDp0lM0ElMkYlMkZ3DjElMkaDDgAIAIFyZWRpdCUyRq8AEWPbCIAlMkZmbG93Lt0AQG9uJTMcAPB4JTNEVU5TT0wlMjZJRCUzRDMwMDElMjZIS09QJTNEMmRlOTRiMDU4NjllNDg1N2MzOGJhM2E1ZGY3MTQxOGQ1Y2NiZWE1ZTQzNjA1YzAyMGM0MTk3NDRkYmU3OWI2Yzt1MTE9O2d0bT00NWZlM2FnMDt1YWE9O3VhYj07dWFmdmw9O3VhbWI9GAAQbRMAEXAFABB2BgD_Anc9MDtlcHZlcj0yO35vcmVm_wCeFj9WCWJpZnJhbWVTCgmbCk40ODEwGAgfNyIDCRJBRwAPXAkqnzg4MDk4ODQ3OFwJCA95CwU2Yy9w2QAPuBAEPTczMtYAARQABXELD7gQPp84ODU3ODM2MDLQDQgP0wArDkQMNzczMwEGD9MARw-mAQiRcC50dnBpeGVsIA3wA2NvbS5zbm93cGxvd2FuYWx5dPsSBBIATy90cDK7AQ8eNHMSEDcUAA-7AUefNTY2OTA1MTM3rwUID-gA1QNtBg-XBimIYWFkdjAwMDuZBmE5OTUuMjefBv8CMTc0NjQwMTg0ODk1Mi4zNTeeBjIP6QX_EQ7jEi85OekFTZ81ODA2NTg2NTdHCiQPMhcDwD9RX0ltcHJlc3M9MdUWP0lEPegSAE9RX1NJWxQF8AFBU0lEPUFTXzA3MjEwMDI0RgAPMxcSNSZyPTwJNzYzOP8RD4sGAz02Mzh5DwIUAA_QBEefNzE0NTkzMDEwdQH_W8AxNDU5MzAxMDJ9XX0
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 3.124.173.63 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-124-173-63.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.citicards.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Tue, 17 Oct 2023 22:13:37 GMT
cache-control: no-cache, no-store
server: nginx
expires: Tue, 17 Oct 2023 22:13:36 GMT

GET
H/1.1 204
204 clear3.png;CIS3SID=1E9AE98D00C7721239A87FB1F61DDD37 Show response
content22.accountonline.com/fp/ Frame A63D 0
219 B 44ms
16ms Script
text/javascript 91.235.132.220
THM

General

Check archive.org

Show headers Download Go to

Full URL

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

91.235.132.220 , United States, ASN30286 (THM, US),

Reverse DNS

Software

Apache /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.citicards.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

Date: Tue, 17 Oct 2023 22:13:39 GMT
Strict-Transport-Security: max-age=31536000
Server: Apache
Connection: Keep-Alive
Keep-Alive: timeout=2, max=100
Content-Type: text/javascript;charset=UTF-8

GET
H2 204 r.rnc
data.privacy.ensighten.com/privacy/v1/b/ 0
106 B 10ms
9ms Image
text/plain 3.124.173.63
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://data.privacy.ensighten.com/privacy/v1/b/r.rnc?n=7&c=1129&i=5gxb4r&p=na_prod&s=3215&d=8HB7InZlcnNpb24iOiIxLjAuMCIsImdhdGV3YXkiOiIyLjMuNjExIiwiY2xpZW50SWQiOjExMjksInB1Ymxpc2hQYXRoIjoibmFfcHJvZCIsImluc3RhbmNlSWQiOiI1Z3hiNHIiLCJwYWNrZXQiOjcsIm1vZGUiOiJlbmZvcmNlWgDwCG9va2llcyI6eyJCQU5ORVJfTE9BREVEkQDyJyJ9LCJlbnZpcm9ubWVudCI6IkNCT0wgUHJpdmFjeSIsInJlcXVlc3RzIjpbeyJkZXN0aW5hdM4A9BhodHRwczovL3NpdGVpbnRlcmNlcHQucXVhbHRyaWNzLmNvbS9XUlEQAPoAU2hhcmVkL0dyYXBoaWNzNwDwGy93ci1kaWFsb2ctY2xvc2UtYnRuLXdoaXRlLnBuZyIsInR5cGUiOiJpbQ0A8AVzdGFydCI6MTY5NzU4MDgxNjM4M8gAAD0BBRQAoDQxMSwic291cmM5APALYXBwZW5kQ2hpbGQiLCJzdGF0dXMiOiJsb2EQAGByZWFzb27lANRdLCJkYXRhUGF0dGVyEgCybGlzdCI6W10sImljAM81NDcwOTE0NjUzfSwXAYofNhcBDDFtdXTPAa9PYnNlcnZlckNMHgE5HzYeAQfxAG5leHVzLmVuc2lnaHRlbi0CYmNpdGkvbuoC1i9Cb290c3RyYXAuanMAAmJzY3JpcHSkAAkDAj0zNzjsAE84ODQ2AwIPYHRpbWVvdVQADwYCHp85MTEwODk4NjLoAAdAd3d3LtgAQmNhcmQTAwEKAP8RL3d2L3dlbGNvbWUvanMvanF1ZXJ5LTEuMTIuNC5taW71ABYcN-EBC_UAbXJlbW92ZfgCD_UAJ684MDI4OTMyMDc09QAtQm5ld1cDAQ_yAIuvOTA5NjI4NzY3N_IABw_PAkAP2gFeFDXPAg_VBAjxFDEuYTc5YWI5NWMxNTg5YTEzZjhhNGNhYjYxMmJjNzFmOWY3ywMCqAMgcy-1BvYCL2Nyb3NzZG9tYWluLmh0bWzPA29pZnJhbWXPAwE8ODk52gJHOTA5N88DD9oCPp82NTkyNDYyMjAAAXE_OTAwAAFmD9oDCP8UMS5iNDA2OTI5YWNhYmFjOWIwOTVmMTI0YzgxYmRmY2Y1N2YAAjM_OTAyAAFdrzU3Mzc1NTY0MTjoAwf_FDEuYzgxMzU4ODU5MTIxNTgzYjdhZGYyYWNlODljYjM5ZjQ0AAE1HzQAAV2fOTMzODIxNjMz6AQIgWEucmZpaHVi5QDwBGlkci5qcz9fY2FsbGJhY2s9alHHBvUIMTkxMDA0MDQzMzMxNTIyOTAyMTcxNl-uCXgyNTkwJl89EAAAAQsD4gkCOgQPEwQBLzk2EwNenzg0ODEzNDU5MBMCAL9hYm91dDpibGFua9EEED40NzfRAgqgCA-MCQsPsgcn0Dc5MDM2NTYxNTV9XX0
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 3.124.173.63 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-3-124-173-63.eu-central-1.compute.amazonaws.com
Software: nginx /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.citicards.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.70 Safari/537.36

Response headers

date: Tue, 17 Oct 2023 22:13:39 GMT
cache-control: no-cache, no-store
server: nginx
expires: Tue, 17 Oct 2023 22:13:38 GMT

Verdicts & Comments Add Verdict or Comment

233 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

59 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
l.loyalty.ms.aa.com/	1969-12-31 23:59:59	Name: ASP.NET_SessionId Value: lwt2ltpxcy3tgbzekj3uwikh
l.loyalty.ms.aa.com/	1969-12-31 23:59:59	Name: BIGipServercnv_ats_ssl_pool Value: 1128732682.47873.0000
www.citicards.com/	1969-12-31 23:59:59	Name: JSESSIONID Value: 0000I3QHeN6tsvwoAFsRkLXtsQk:1921acq1
.citicards.com/	1970-01-20 15:33:08	Name: ak_bmsc Value: B21FBB10AD494604A8E7434EF78B030C~000000000000000000000000000000~YAAQrOIlFxVAej2LAQAAzn6zPxUNU62uuJtmUAbtuILoM5XOnZSnAv1E8g5tQ/0aLMRtpW6W+oZdVQIa99BifzIgWwGXz2kQ/vJ8YL/sCBMKQczvpwxFbGrHwE2KjtzTJm9n4z69mP/img/j039Su/0aQzLHgP5rQTYNrbs3CHOcWZbTau3WzzIN3+wE0OiZDGGGrEuzqKEeEJrpGPeofIbELKm2dR2xeG2D8X1+8EldTTQnc2zv7SndJTPkC4w2ETzwRLTD7SM+R56sueEQcWBj4ABSSBOftd/I7GpFo+rZsayZb5J+VrTrhbs1hSpVHdhAw7B1XH98/hD3iE+hr5+IAPM86EGpOIU6oIatdtE0vzHLvXGsgqirJk8GzfbBz+kn+eA=
.citicards.com/	1970-01-20 15:33:08	Name: ensighten_conentSync_timestamp Value: 1
.citicards.com/	1970-01-21 00:18:36	Name: CITI_ENSIGHTEN_PRIVACY_BANNER_LOADED Value: 1
.citicards.com/	1969-12-31 23:59:59	Name: CITI_ENSIGHTEN_CC_SYNC Value: 0
.citicards.com/	1969-12-31 23:59:59	Name: at_check Value: true
.citicards.com/	1970-01-21 00:18:36	Name: bmuid Value: 1697580812452-0B7AF3EA-C636-4312-9095-1137E0F54154
.demdex.net/	1970-01-20 19:52:12	Name: demdex Value: 76150096283887386614252401464242713106
.citicards.com/	1969-12-31 23:59:59	Name: AMCVS_61834D9B5228A7430A490D45%40AdobeOrg Value: 1
.citi.com/	1970-01-21 01:09:00	Name: s_ecid Value: MCMID%7C69215849224077639103647927382042708913
.www.citicards.com/	1969-12-31 23:59:59	Name: bcsid_cc Value: E363950EB24AF65A13614F875F6B6894
.everesttech.net/	1970-01-21 00:18:36	Name: everest_g_v2 Value: g_surferid~ZS8HDAAAAFddJQOJ
.citicards.com/	1969-12-31 23:59:59	Name: cdContextId Value: 2
.www.citicards.com/	1969-12-31 23:59:59	Name: cdContextId Value: 2
content22.accountonline.com/	1970-01-21 01:09:00	Name: thx_guid Value: 3b58375294dc3af804a59d48dd5ee040
.dpm.demdex.net/	1970-01-20 19:52:12	Name: dpm Value: 76150096283887386614252401464242713106
.citicards.com/	1970-01-21 01:09:00	Name: AMCV_61834D9B5228A7430A490D45%40AdobeOrg Value: 1585540135%7CMCIDTS%7C19648%7CMCMID%7C69215849224077639103647927382042708913%7CMCAAMLH-1698185612%7C6%7CMCAAMB-1698185612%7CRKhpRz8krg2tLO6pguXWp5olkAcUniQYPHaMWWgdJ3xzPWQmdj0y%7CMCOPTOUT-1697588012s%7CNONE%7CMCAID%7CNONE%7CMCSYNCSOP%7C411-19655%7CvVersion%7C4.4.0
www.citicards.com/	1970-01-20 15:33:02	Name: 7830 Value: error
www.citicards.com/	1970-01-20 15:33:02	Name: 7018 Value:
www.citicards.com/	1970-01-20 17:42:36	Name: 64072 Value:
.citicorpcreditservic.tt.omtrdc.net/	1970-01-20 15:33:02	Name: citicorpcreditservic!mboxSession Value: 8e2f973c439f4aabadc68ae86d34d01a
.citicorpcreditservic.tt.omtrdc.net/	1970-01-21 01:09:00	Name: citicorpcreditservic!mboxPC Value: 8e2f973c439f4aabadc68ae86d34d01a.37_0
.citicards.com/	1970-01-20 15:33:02	Name: mboxEdgeCluster Value: 37
.citicards.com/	1970-01-21 01:09:00	Name: mbox Value: session#8e2f973c439f4aabadc68ae86d34d01a#1697582674\|PC#8e2f973c439f4aabadc68ae86d34d01a.37_0#1760825614
.citicards.com/	1970-01-21 00:18:36	Name: cdSNum Value: 1697580812969-sjn0000666-6ce3cdc0-8dcb-401b-8bfb-b9f0d723abf8
.citicards.com/	1970-01-20 17:42:36	Name: _gcl_au Value: 1.1.583581942.1697580813
.citicards.com/	1970-01-21 01:09:00	Name: _cls_v Value: d8509083-ac4c-4248-8fbf-3bab75beafc9
.citicards.com/	1969-12-31 23:59:59	Name: _cls_s Value: a640fd98-a0c2-4fe9-8834-8c4fed70ecae:0
.tt.omtrdc.net/	1970-01-20 15:33:02	Name: citicorpcreditservic!mboxSession Value: 8e2f973c439f4aabadc68ae86d34d01a
.tt.omtrdc.net/	1970-01-21 01:09:00	Name: citicorpcreditservic!mboxPC Value: 8e2f973c439f4aabadc68ae86d34d01a.37_0
.rfihub.com/	1970-01-21 00:54:36	Name: rud Value: H4sIAAAAAAAA_-MSNjU0sDA1tTQ3NjA2NTE2MjIyMRfiM9Q1L3PJCisIyS4oiUoHAMrdAQMlAAAA
.rfihub.com/	1969-12-31 23:59:59	Name: ruds Value: H4sIAAAAAAAA_-MSNjU0sDA1tTQ3NjA2NTE2MjIyMRfiM9Q1L3PJCisIyS4oiUoHAMrdAQMlAAAA
.rezync.com/	1970-01-20 19:52:12	Name: zync-uuid Value: 5036dce2-e71a-410b-a765-8fc1d87a3ab5:1697580813.525258
.citicards.com/	1970-01-21 00:18:36	Name: btIdentify Value: 04c4b588-027a-4688-84c9-a52afa59526d
.citicards.com/	1970-01-20 15:33:04	Name: _bts Value: ea8c751e-50c5-49e9-ba07-6445b394dc05
.citicards.com/	1970-01-21 00:18:36	Name: _bti Value: %7B%22app_id%22%3A%22citibank%22%2C%22bsin%22%3A%22h7thJLBwnifnNkT6Vo1Y2wSLUjwBuml6wi214mzlWIVCuxDwz5o83wZTPU3MEMmW8yv8qQfCi2ehqefW3wK5pA%3D%3D%22%2C%22is_identified%22%3Atrue%2C%22user_id%22%3A%225108559730354322247%22%7D
.citicards.com/	1970-01-20 15:33:08	Name: bm_sv Value: 0FEB47601AFC1F0FBC0B273E9DF53C8E~YAAQrOIlF3NAej2LAQAAdpGzPxWtZfDWIJIV3RlY+GL7x3AmjEeW+TJz0LkFkcq2sms2vix8jpRevNsh8zXygC/bwUjnviQsNm0NN3elXJNVrPpSJeZFY28FXqlkaEf1AU35nSo0XddOYqPggGr0Y95rDrLUCW2bo6d5us6EhHF5Ok+Pn56517R8ftovpRSVZrjaim6/S/npTJelAPegPCDO/QzEaUz2QwvaoNgVjV1ojpIVutnMWeEBEPjXFSLfBu3V~1
.citicards.com/	1970-01-20 16:16:12	Name: s_nr Value: 1697580814846-New
.citicards.com/	1970-01-20 15:33:02	Name: gpv_pn Value: public%7Capplication%7CCiti%20%20AAdvantage%20Executive%20World%20Elite%20Mastercard%7Cstart
.citicards.com/	1969-12-31 23:59:59	Name: s_cc Value: true
live.rezync.com/	1970-01-20 19:52:12	Name: sd-session-id Value: eyJfcGVybWFuZW50Ijp0cnVlLCJzZXNzaW9uX2lkIjoiNTAzNmRjZTItZTcxYS00MTBiLWE3NjUtOGZjMWQ4N2EzYWI1OjE2OTc1ODA4MTMuNTI1MjU4In0.ZS8HDg.dL7s8m8RrlTkxJCLWtGB0aTF1sY
.bing.com/	1970-01-21 00:54:36	Name: MUID Value: 0E940249947B6902016C11E495A96800
.citi.bridgetrack.com/	1970-01-21 00:11:24	Name: ATC9 Value: 63203\|ZyKc*.B.gABwf.J.By5.SDrk.KQg.lOP.Bj.Tq.27.E
.citi.bridgetrack.com/	1970-01-21 00:10:19	Name: CitiBT%5F9 Value: GUID=21E97D3F805F464E8AB2975BD56FEC50&SID=A8F2964CD63D4327861C404AC0D765D2
.citi.bridgetrack.com/	1970-01-21 00:10:19	Name: CitiBT Value: GUID=21E97D3F805F464E8AB2975BD56FEC50
.citi.bridgetrack.com/	1969-12-31 23:59:59	Name: CitiBTSES Value: SID=4E233DD5AC844CF7B87279FA3E454DFD
.citicards.com/	1970-01-20 15:33:02	Name: _dpm_ses.95a4 Value: *
.citicards.com/	1970-01-21 00:18:36	Name: _dpm_id.95a4 Value: a898769c-f6a7-47cc-9480-188a0850baec.1697580815.1.1697580815.1697580815.687b2285-8a79-41b1-ace9-21030a9862d5
.doubleclick.net/	1970-01-21 00:54:36	Name: IDE Value: AHWqTUlVLcVi3YpKF7pvmwnDPh8DQleitwUsrgp_oCA_3TWMB7spHiIiY5YsB00B
.amazon-adsystem.com/	1970-01-20 21:44:32	Name: ad-id Value: AwlcyoXsSU-6qTWyTztGBLk
.amazon-adsystem.com/	1970-01-21 01:09:00	Name: ad-privacy Value: 0
prod.report.nacustomerexperience.citi.com/	1970-01-20 15:43:05	Name: AWSALBCORS Value: +GfzPOi2ekBFyP9Qre5hEe1Qd0cIxzcotApbw/gikl9/P/qwgIma0e9nri0I6KFxkuXcA4VWcURyCnxyrdJR2ZU+l1a/eVucwE80yN4t9HcjdUaglzKXnTrRp/pP
.citicards.com/	1969-12-31 23:59:59	Name: cls_e Value: a640fd98-a0c2-4fe9-8834-8c4fed70ecae:16355281953541
.citicards.com/	1970-01-20 15:34:27	Name: _uetsid Value: 69fc2bd06d3a11ee997a23f23eef3457\|cyaehp\|2\|ffx\|0\|1385
.tvpixel.com/	1970-01-21 00:18:36	Name: sp Value: 9a75df1d-38ff-45df-8fd9-fc8d88344883
.citicards.com/	1970-01-21 00:54:36	Name: _uetvid Value: 69fc1b506d3a11ee81a2afae43a2dc7c\|1brhuka\|1697580815881\|1\|1\|bat.bing.com/p/insights/c/p
.yahoo.com/	1970-01-21 00:18:58	Name: A3 Value: d=AQABBA8HL2UCEDp78iLnutP7XrmNuRPOUT4FEgEBAQFYMGU4ZeATyiMA_eMAAA&S=AQAAAk8Q1Soif8qyofmKA1ODA_Q

23 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
rendering	warning	URL: https://www.citicards.com/assets/scripts/global/6c8322c7341eac98645c10e3d1d3c7ae.js?seed=AAAjpz-LAQAAFC_bMRxQoajWvZoUseb7-9M_13CDQMMWDa5kNV3LRXPZ6k5d&X-soz9htCz--z=q Message: Canvas2D: Multiple readback operations using getImageData are faster with the willReadFrequently attribute set to true. See: https://html.spec.whatwg.org/multipage/canvas.html#concept-canvas-will-read-frequently
rendering	warning	URL: https://www.citicards.com/assets/scripts/global/6c8322c7341eac98645c10e3d1d3c7ae.js?seed=AAAjpz-LAQAAFC_bMRxQoajWvZoUseb7-9M_13CDQMMWDa5kNV3LRXPZ6k5d&X-soz9htCz--z=q Message: Canvas2D: Multiple readback operations using getImageData are faster with the willReadFrequently attribute set to true. See: https://html.spec.whatwg.org/multipage/canvas.html#concept-canvas-will-read-frequently
network	error	URL: https://www.citicards.com/cards/wv/welcome/css/fonts/interstate/Interstate-ExtraLight.woff Message: Failed to load resource: the server responded with a status of 404 (Not Found)
network	error	URL: https://www.citicards.com/cards/wv/welcome/css/fonts/interstate/Interstate-Light.woff Message: Failed to load resource: the server responded with a status of 404 (Not Found)
rendering	warning	URL: https://www.citicards.com/assets/scripts/global/6c8322c7341eac98645c10e3d1d3c7ae.js?seed=AAAjpz-LAQAAFC_bMRxQoajWvZoUseb7-9M_13CDQMMWDa5kNV3LRXPZ6k5d&X-soz9htCz--z=q Message: Canvas2D: Multiple readback operations using getImageData are faster with the willReadFrequently attribute set to true. See: https://html.spec.whatwg.org/multipage/canvas.html#concept-canvas-will-read-frequently
network	error	URL: https://www.citicards.com/cards/wv/welcome/css/fonts/interstate/Interstate-Regular.woff Message: Failed to load resource: the server responded with a status of 404 (Not Found)
network	error	URL: https://sr.rlcdn.com/425466.html?es=80676&u=da39a3ee5e6b4b0d3255bfef95601890afd80709 Message: Failed to load resource: the server responded with a status of 451 ()
worker	warning	URL: blob:https://www.citicards.com/47831080-f5c2-4286-9bb2-738baa0423ea(Line 16) Message: WebSocket connection to 'wss://127.0.0.1:3389/' failed: WebSocket is closed before the connection is established.
worker	warning	URL: blob:https://www.citicards.com/4bbd4663-824c-4fb9-bb67-4a8968827b4b(Line 16) Message: WebSocket connection to 'wss://127.0.0.1:5901/' failed: WebSocket is closed before the connection is established.
worker	warning	URL: blob:https://www.citicards.com/c67de874-dac1-45c8-b596-19c3cbe68de6(Line 16) Message: WebSocket connection to 'wss://127.0.0.1:5902/' failed: WebSocket is closed before the connection is established.
worker	warning	URL: blob:https://www.citicards.com/a4e12420-1b1f-4a86-825c-8ef4f2518d8e(Line 16) Message: WebSocket connection to 'wss://127.0.0.1:5950/' failed: WebSocket is closed before the connection is established.
worker	warning	URL: blob:https://www.citicards.com/31311ee7-2242-41e4-befa-29db4c6dfe4e(Line 16) Message: WebSocket connection to 'wss://127.0.0.1:7070/' failed: WebSocket is closed before the connection is established.
worker	warning	URL: blob:https://www.citicards.com/bbba10d6-097f-427b-8471-647f440a0f59(Line 16) Message: WebSocket connection to 'wss://127.0.0.1:5939/' failed: WebSocket is closed before the connection is established.
worker	warning	URL: blob:https://www.citicards.com/194cfcfb-ed07-4834-a630-2bce2e98e763(Line 16) Message: WebSocket connection to 'wss://127.0.0.1:2112/' failed: WebSocket is closed before the connection is established.
worker	warning	URL: blob:https://www.citicards.com/c7c26958-6c9a-44bb-9a8c-4aa968f430f6(Line 16) Message: WebSocket connection to 'wss://127.0.0.1:6039/' failed: WebSocket is closed before the connection is established.
worker	warning	URL: blob:https://www.citicards.com/24157493-0ee8-4ca8-907f-117632bba1e0(Line 16) Message: WebSocket connection to 'wss://127.0.0.1:5900/' failed: WebSocket is closed before the connection is established.
worker	warning	URL: blob:https://www.citicards.com/1137aae6-6781-414f-b9b2-058f92b7cb11(Line 16) Message: WebSocket connection to 'wss://127.0.0.1:5903/' failed: WebSocket is closed before the connection is established.
worker	warning	URL: blob:https://www.citicards.com/259e616b-7367-404a-a92e-cf8f37888f33(Line 16) Message: WebSocket connection to 'wss://127.0.0.1:6040/' failed: WebSocket is closed before the connection is established.
worker	warning	URL: blob:https://www.citicards.com/3583279b-f24c-41f0-9916-ec10f44af2fb(Line 16) Message: WebSocket connection to 'wss://127.0.0.1:5279/' failed: WebSocket is closed before the connection is established.
worker	warning	URL: blob:https://www.citicards.com/b472c71b-6404-4af3-afba-de5a896b48a6(Line 16) Message: WebSocket connection to 'wss://127.0.0.1:5944/' failed: WebSocket is closed before the connection is established.
worker	warning	URL: blob:https://www.citicards.com/67eff73c-ed3c-4c3d-9086-83a1032a1c45(Line 16) Message: WebSocket connection to 'wss://127.0.0.1:5938/' failed: WebSocket is closed before the connection is established.
worker	warning	URL: blob:https://www.citicards.com/661400e3-8cdb-4d2d-aa9b-280894fc3ab5(Line 16) Message: WebSocket connection to 'wss://127.0.0.1:63333/' failed: WebSocket is closed before the connection is established.
worker	warning	URL: blob:https://www.citicards.com/9728097c-79fc-4682-82ca-1360d9c41171(Line 16) Message: WebSocket connection to 'wss://127.0.0.1:5931/' failed: WebSocket is closed before the connection is established.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Content-Security-Policy	Frame-Ancestors 'self' https://sit01.disputes.citi.com https://disputes.citi.com
X-Frame-Options	Allow-From https://sit01.disputes.citi.com https://disputes.citi.com

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

1.a79ab95c1589a13f8a4cab612bc71f9f7.com
1.b406929acabac9b095f124c81bdfcf57f.com
1.c81358859121583b7adf2ace89cb39f44.com
20766699p.rfihub.com
6260004.fls.doubleclick.net
89oebq5kfrnwu4b4b2kgnva3uss5n4odddy4rnlna16891807d617b66am1.e.aa.online-metrix.net
a.rfihub.com
adservice.google.com
adservice.google.de
bat.bing.com
c.tvpixel.com
c1.rfihub.net
cdn.boomtrain.com
cdn.gbqofs.com
citi.bridgetrack.com
citi.demdex.net
citicorpcreditservic.tt.omtrdc.net
cm.everesttech.net
content22.accountonline.com
data.privacy.ensighten.com
dpm.demdex.net
events.api.boomtrain.com
googleads.g.doubleclick.net
h.online-metrix.net
iad1.qualtrics.com
insight.adsrvr.org
js.adsrvr.org
l.loyalty.ms.aa.com
live.rezync.com
maps.googleapis.com
maps.gstatic.com
mboxedge37.tt.omtrdc.net
metrics1.citi.com
nexus.ensighten.com
online.citi.com
p.rfihub.com
p.tvpixel.com
people.api.boomtrain.com
prod.report.nacustomerexperience.citi.com
s.amazon-adsystem.com
s.rfihub.com
sb.scorecardresearch.com
servedby.flashtalking.com
siteintercept.qualtrics.com
sp.analytics.yahoo.com
sr.rlcdn.com
tagmanager1.citicards.com
www.citicards.com
www.google.com
www.google.de
www.googletagmanager.com
zn3vi8kkuds0jjrfc-citifeedback.siteintercept.qualtrics.com
104.17.208.240
104.17.209.240
13.32.99.105
142.250.186.38
173.213.4.54
18.66.122.57
184.30.20.101
184.31.87.130
193.0.160.131
209.54.182.161
212.82.100.181
23.212.202.173
23.212.222.131
2600:9000:206f:5200:2:8f43:5780:93a1
2600:9000:2127:2200:1d:bf0a:0:93a1
2600:9000:2127:8600:13:ab57:d440:93a1
2600:9000:2127:8800:1:76cf:fe80:93a1
2600:9000:2127:9400:1e:54f1:26c0:93a1
2600:9000:2127:f400:a:6cdf:4440:93a1
2606:4700::6812:180d
2620:1ec:c11::200
2a00:1450:4001:806::2008
2a00:1450:4001:80b::2002
2a00:1450:4001:80f::200a
2a00:1450:4001:827::2003
2a00:1450:4001:828::2004
2a00:1450:4001:82a::2002
2a00:1450:4001:830::2002
2a00:1450:4001:830::2003
3.124.173.63
3.210.211.38
3.224.91.217
34.232.37.73
34.251.64.143
34.254.109.178
35.190.22.40
35.190.60.146
35.71.131.137
52.2.158.49
54.217.181.83
63.140.62.164
63.33.173.25
65.9.95.44
65.9.99.119
66.235.152.115
91.235.132.130
91.235.132.220
91.235.134.131
05978957c6c8b028f2785dc77271c286bfac76e30b7bcd7e835c2927fbe897cf
05b92eea2556bcb9d6069db578e8f536b4092446b1fef4b6b8fbf4ff54ececbc
062ee837c39ae803e8e39400cc01dbeb6cbd37536bbbc39dac4b4a3eddb626ed
07f6baeb3a16d7474a408bd4f6ae6bfe8c2538c41ba342f2431ddc64264b4fcf
08c570730a854d59bb36789eb86c2609746cd4f5f7cad993622c5d0f397302d6
0a23512ea579554af1f2614d6dea6120d38660028fc7624c71a978478fae0eb6
0dc7d9b25888b998417847cf1f6fbb25aa87d566ad11fda81e001b70127049de
0e4b1e428a2198ef747010c094101c257b568a97cdcc0f31ed5e9868cc835b39
0e5077af62072c59f889abe0718e551afa15f854da4a26e27ee2146f63472176
0fdfad8c378a8a626d5b5d629db184a13b3613dc3769ae7cabfc5374cbae2b07
11cbf0988ce7e7b95afbf21a775614d18c0b6fdc2d15d54424a0e00008bef9b4
13a59cfac1785dd94d0005457ed1e12cf77fee65b975fe6fd91af77b7ac6cd77
13aeb21aad8ff255db3a2b8545cf1d271b30d049fd496f0276e2a8482a3bf40e
1486a9aed14d5db38b722ecc929872d080793c5c3f65b5f188f36db108b8a7da
15a4cb39ab2b7781594d5e971542db2c4a6999908d84b71da8de1fd16416ab66
186dbee7c80a42c87f0a4a72dc375c9ffd0eda173c48cb2c09937a5247053ffc
1a5121904c4ec7014f2ceba1cdc7c1d3cab284c975cc72f84d15cd7f8af7b84a
1c34a537ea8a62cb24c782a11aaf49c1cbd671e5d264d81c6732e2338e05d2af
1d5febe7550e44775ba5e28b75501a4e08358d1c3df20324cae03ec31c0b70b9
1da5ef6664b721dddbb209dd40dff4e7841a48a0e5e501229b969e61dc65ef56
1eec5d0bc72fba33ce753f6009a277e07041fb92d221ae5839bbc5e8fff1d0bb
216507030d061110c3a2935edd9b9fccf5eeada2f03f5892ff7f816f4e42f2a2
2192c61e7cee34b3baa6dda1e2085472eb25c7fac5d558f5e433dd6d8f4f715c
22ad331165b712e3d879b32dcf10ce25a5b65bf6860eb7a5c3cf0b7d35e0ad7d
22ce6e30bfd054773e788600dac65c5b948152e36447d41503c347488cc187b4
243d7f52bc723643e7fd076024b91882b2890a851bb4490d74599de930f94edf
25f4eeb23f67fe1d74534ed37230ecd54ab4f57524276970dcbeaaf3b0fc64f9
2689367b205c16ce32ed4200942b8b8b1e262dfc70d9bc9fbc77c49699a4f1df
27d92130c0321dad5a03760fd5ac98a3d04ed4c94d88418fe6d50da1f7fc5cbe
2bfcc40557a1d63c2c5486c1cd7ab18fd1ad1a4cab88684606bae9288ac16459
2cd8c98a7ba7914c78ad67f963d95201ca25a3b3e925b82eb5e298169c63a1c3
30dc51fd43e4f096cba4541704d1f9923f5584706e7bc2d1574d6232ff1a64ac
31d2402686ea4dc2200bdc2dd72dcf822948af11209aac7e2def24c409637125
321f8b18564a1ccb8d951eabeadef3f21fb21af23a60ffc669e248816904cf90
326886cab3a3fb74b0801184b8484bd827d756b013295756d33a51e5606212cb
3394ccdb7c7861e721d118226b2735339ec9a5d71ab2916f64a00c9bcea4373a
3437b411499cf91d59ad95a09cb9daea668efeac73ab1f09492e75dded6fc050
3556b4fa28a41290454dc84939dae439fcf5bda8a1eac70efdf2647bf041d43d
3673b875b1aafcc518c5d81732d66f9395adb9f3722a56d2a5a8cf532d6d3772
36b1684424f00acbb8059de654a1d7b870f37b1366438665a1c17d593ac7443f
3e9ef72f08cbe7d70278c92e5a92893c01062abc8998fd77f718e925470f9736
409d3f8134e2ba98a5916f43a28b4a3a973841336b8ff4648eea1e709ade9708
40cefd284724286ec23670e16cc7b354c2cee0527edda1ae49eea62b8301bff4
41bd89f24edd2547aa2764e91d6e42401cf5ff1e4c381ab7d5e444668047c296
41f4d6d494b581ae3554484389e33593f9f47538bf4932c84af5e24dbe22294f
43b0db1e8b48f7ad65386e7afe7645314b8f3c07f12398453e83966b1f135473
47043e4823a6c21a8881de789b4185355330b5804629d23f6b43dd93f5265292
47bd0f94c766dc42eeb2da6ea6f18c5216bf8723e79bf4e6e2627c9bbaf6e882
4a652b0fa582775153c5a8c892917c12c090729e16c523ba812cc67f7a1b80f4
4b99a4e92de3333bf62e8c2766dc1a880f1c19308c1591d2516974f6369b721a
4c680597a16bbd662d9722ba3d2183a3b9c753afcb73025b94763908b588d1b0
4c8e2075d12b0f07b89d749927c9fb78cf3d4aa96f8512bdd20f31aa95e34f7e
4caed94f9975debb1a1ee2ff2e68395802a18a4cf3f3be7ae057f1b97b2c87ff
4f27a3e4da998024bcf4f93346fed5905e65af8f94e57e915fc238d0e4652717
4f45b25e5801efa6922954445af7c8138b81eca71fdfa356ec853fb7ce57a0c9
50e6072d26098d48004a30addeecabd5b22b91e5ccdf9dd86f96459783e3ac23
5548648d480fb045965c062b862a42141fc9bdfd09951d1df36790f6f468bb27
55c9d2f019f9d7ddfd69b2ad0351c5617338a222362aebb02b3b98a4dbc18486
565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3
566095a5f65029a8730735e82ff6cf43336a92723d96484db740011b88467aa1
5859379607421976dccddd67c3bb7e8c7159d28bf1ff3eb9553a52ca3300117b
5c06cbef078f814b98203312ded33c9948747a43ab43444f13d70cff9a6c7eda
5cec84b544de8e5c6cd47e516a417b5b75fda2edeca26110751af4584a38fe66
5e1f1e49f551ec2f0e8ff30411db5758042e4086b21dca94d45ef9b7de54ef53
5e7d41474cb295985f63d2230319b6ebb1db8fadf7e47b3ef375370ea0a2fd01
6121c34648c249cd479d04ed1ceef908485bd13c4fad3279645a422baec4f00a
61599227edd27d886363dc91842516e6abaffd4f6de535307a82c733e0db3d6f
617795824f268204fce200417ba784cf0ad062c0c1613d5a114c457bc503ff8b
61d8137d275f12306e177bc726c2b3e072f9efa4743a0ace6ecbcf7a0932fd07
6380b5806e25f267b34990930509aefec9e8fd53b16183d99d38441e7b4025c2
686eb5d7c927dd741ef72adda5c719b478d36f1e29520ee16d5121854c174b10
6b88cb00ec74901f91b39f0c85af0f1645e1228e78f680adfa6c8bf28eed41e0
6bbbb8d1dba813c63e9f73954b5366dd9e340f164b4e9338b31bd9f457877bad
6e8aa099376459830d295cba8264ffadb98343db5539af204925bf6932a0ed45
7026b29ed15e78fd1f7e3c186b9415f30289c55f376109ec6266dd40713126ba
7042be63003430d5919b301a368619c448ece33c05302eb13ffdabf3af5a8fe3
707bdb2e6227302b95bc734573ec66d77847d845dd7a741758d793e5e2dd6e1d
727ce54fb45496290a9fc1d62ca1e82ad68badf85ce5bd6939fd8bd5eda2ac62
7337d0aa06e2a7d2555a60936c9243f8f93c24dcd64e064d0181e6790294607b
7642c442fd9d507dab536bc61ceac7c82b14d033243de5145458cdb908dbd54b
7881b3a35e6712f776a28e3ca51c2805be477b9935e1289774a7aaf187d2eec0
7a475c7e8d1e4a08ddbe9bd36baadedd8c28d9cfcaa958f1e9af84fba8cb1829
7ae7ff4e02c7bfeb84de787c23509da824b3fde99f2714bb90b9f2d3f87c7d72
7bea17a80a61ed0f54248b4ffc4c718f7c8ff2619742577a73591d62ce074da8
7ef97b12890fc6fee67f869c6e1f74b6719de7d66ac0d649c8d7386a80b4c30f
815711bcd35e9fc1c6e20eaebbc2e2e63fc7175a001b02fb5d2c0e448c56ddff
84a4d7b944f72d47afc7d5cae2f91ac4cf0751aeae9e419a26dce4fd9a44cd93
85df0b6b78a2ab418938a2078c18e64cdb2bb3e5551d6ab5aa296207e669fe58
899663bfeab6b11842c974c2417dc0ad88bd79bb7510b1e032384ccf2618dcc1
8ba3433664353d3f84d37a6b01dd8071bcb10b3785be81c6f89100692a4329e1
8d3b1521ae4ada452dfa2cd85fe4ba47b88c799cae8d5e38e613e9f46b764e62
9316cfe82231e58622ce9789f58a4d41b83a59cd9428b78bd57d24cb798c6868
931b268362de44bae26ba2eedbaa2fb3989d722b4dcc3640a245832dd62af348
93960b7247899f8aeeeee7a1492042f4d7f282391e7c350e78233319b1dc30f1
95518cbec0d55a574a9c8ef72a2a7d62ac0d40a4de5dfe67a76a7d214dc8b743
9a74546a8f511f31b5252f115d2db7aa69370ca5eeaf6828f60abb197f35a169
9c7432cbb5f36d9b00b72311825f7caab51cbbc29f387ec8a2b3b35e781a7351
9cae06504ac6c7b45130682051604184176eb69a6ac6b8df8012c9e93d727c6f
9cd73467ec59bd56d50e838b1a3060d274d35bc66a680e530c7aa2d4197dd9cc
9cdad69a4b967c882c3d8e9cb054e7334b7f8870e96427a5d20ae2d17eff2622
9df60fb9744a6ccb9d6293a757171fe61e72daf364a7e3001f6430c69c5af89c
9f700a9fc999a4bcac1078d6b0e87f13522bb35bf4ec40839123fc43a49f2202
a12bcc01193835447bf3f5e1de68e908a07996caa8daa568085de9102d181927
a22e2962308d2689d539f2c9cb0b270ec9a81b3d489b04e4956edd25cd6e09e9
a244a2e637f251116b8794ccef1549f5871da9ccd94a270c3ee9d0e51eca3568
a3ea0132cb5e6f30bc1e74ddf7d499673476cfcd4f67ce7a89d14dce60ba6712
aeabeb108bd6bc6386510a56272ba58200aaf64a69a54c3ae918ea1998ce29a9
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
b498311bcfe208f4b1a814ca1d5242fdf5a5e24dbc68d174d1b842f6614db0e1
b7f347ef43a4322d773e10b21dde79df81322f29bd70fbddf75837cd4824fb50
b9b5b5f5ebe95b7331b0a728519be48436079a97cb1e22c8c1f543e0eb8fb06b
bae1c20c5d1f34876af062d30f9771f439d8ed1219c6c0567880b472d8799e18
be4c432d5fcfb3f53d2523ba67c9bcda89bcf7ad7587aac38d742a83d4892810
beb2f8bbbd49243623d9436e4b4ccaa979d6f5f5cf4c70ff33bc6dd93ca7a741
bf39c7a23da56a09d7fba494ab7a46604dc02a19fabfaf8d4c3ab6629aad0692
bfd58b907437a0c460a14a89e7da14cfb9f464645adbb95ed4641d5bab03913f
bfee92627d3ee6ef32f79d53989ba3e960cd5edfafd764f8089e1ad18c18327f
c0d74e213f200a34ebdee4be1dc1ba5ec9f08090a0de5db6fdd20f20e9012e96
c2c23f79eefc96c5414118e0f72b858ff760ff476ab73b4cf4d15ed5d0eff149
c437eb764a99e6cd5172d63c3fae564bbc51eda4981058d5edebd2bf0700eb76
c6227150aefd71e74fd9371e5d7e7022e98f403c056b766036380fbf276757f3
c8e8dd620dcc08590f8e38e8ed92d87edc6e63dccb8e06ea0ce2135ffc16ca1e
ca3d163bab055381827226140568f3bef7eaac187cebd76878e0b63e9e442356
cd5496f75a7c1029bc681f639794b83f034d5ecd884e8514ae12b13eee9eec70
cd80d0dcb2a44bd30c11fcdf13d4c280f336dad9442ee7da79146f2bb77381a4
d2635be4e400a98a722fed17ebdaa956188a3819c34eed93c46248ac1f47430d
d276c47343bb731bd426b7414b9c1bda826998888df6fadd73fc49adf9b1ef64
d61d13bed9c03d834de5b2f719a71a2f9bfd9df370cecc041c976c23af48365c
db209390b90b70f4b1ef3540cb581e4ec8edbba21980971b68e4aef5c5d352fb
dc1904a557b3b1f7d001adb461950fa564369fd7f0929e270a44c784f8ce7816
dc3666500e1fdc17dab6f563757cd07f44acf583f21ea20fb5af99ab619fdc80
e16a0447e9449900c27d97ad6a1efd08eb5b4e8f5759b28dd8d18b812e775f7b
e298a6cc0a1877c72c1cfebacb0d334396aeb435025bcbc168d0a753f4098a99
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e62ab53cdd0da4275a539b12b7e8c720040b2ce44f8173ef27fa207778da2769
e93ef9435bd70e93fecb217810f4d755f9835e356758aab3b03ba77631ba7007
e9ae7d44bbc0dc049ed8b51aea98eda276648335d680747e3ba6cae32c3c5f26
ea8cfa086b29feae594f7dfaa9f1cc35ce10c4f6b8c38a340aaa95b7741ff142
eca17c5e10e24caa55225fc490c63cce6fd9cddfbbb44e5b676681e894b6ad25
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f0a77e0433ca7256e7748fde729a21dc6509083bbed69a4cde1ecd57494e67d5
f23d41bca3d2e7269e285a3683607f31a08061d35e0bed47f44f80e0360b061d
f37b123c1b20f224d0e15060735b6d39e680331391bbf46ce1f17c5c3d55410e
f47f21063dfdcbdeffed3d97689b45efae7a52401cd7fc5b8d07c42d2f232ab9
f83d1d4a5d84bc8e4c7e21673e4ecfc55998658333b68687bd429c1df7250723
f86a1d93a04fa97faf2232a6dfdb05cbc2a6074eeb3812a24a1d2b28c21a9967
fa2d499915cc9d27d3ed17f446d25a0fe5068ef7623e03f7ff274ca5cc20650b
fd2ea6b3edb33fc45b5b8aec9e5d20779cf575e1232271c8c0178a7802c94605

www.citicards.com Open in urlscan Pro 23.212.222.131 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

234 Requests

90 %HTTPS

33 %IPv6

33 Domains

52 Subdomains

47 IPs

4 Countries

3208 kBTransfer

10649 kBSize

59 Cookies

20 Outgoing links

Page URL History

Redirected requests

234 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 1 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

www.citicards.com Open in urlscan Pro
23.212.222.131 Public Scan

Screenshot
Live screenshot

Full Image

234
Requests

90 %
HTTPS

33 %
IPv6

33
Domains

52
Subdomains

47
IPs

4
Countries

3208 kB
Transfer

10649 kB
Size

59
Cookies

234 HTTP transactions
1 data transactions