urlscan.io logo urlscan.io
SecurityTrails logo

online.citi.com Open in urlscan Pro
104.109.85.8  Public Scan

Go To Rescan Add Verdict Report
URL: https://online.citi.com/US/login.do
Submission: On July 18 via manual from CA
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 20 IPs in 5 countries across 16 domains to perform 103 HTTP transactions. The main IP is 104.109.85.8, located in Amsterdam, Netherlands and belongs to AKAMAI-ASN1, US. The main domain is online.citi.com.
TLS certificate: Issued by Symantec Class 3 EV SSL CA - G3 on June 6th 2017. Valid for: a year.
This is the only time online.citi.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
38 104.109.85.8 20940 (AKAMAI-ASN1)
9 52.57.229.31 16509 (AMAZON-02)
1 95.100.181.67 16625 (AKAMAI-AS)
1 66.117.29.3 15224 (OMNITURE)
6 35.158.49.49 16509 (AMAZON-02)
10 54.243.66.137 14618 (AMAZON-AES)
9 204.236.225.197 14618 (AMAZON-AES)
2 198.160.105.95 15026 (ACXIOM)
1 129.146.14.100 31898 (SAC-HERAK...)
5 2a00:1450:400... 15169 (GOOGLE)
2 52.129.74.11 15301 (IOVATION)
7 2a00:1450:401... 15169 (GOOGLE)
1 2a00:1450:400... 15169 (GOOGLE)
1 172.217.21.226 15169 (GOOGLE)
1 193.0.160.182 54312 (ROCKETFUEL)
1 193.0.160.185 54312 (ROCKETFUEL)
1 2a03:2880:f02... 32934 (FACEBOOK)
1 2a00:1450:401... 15169 (GOOGLE)
1 63.140.43.86 15224 (OMNITURE)
103 20
38    104.109.85.8 (Amsterdam, Netherlands)

ASN20940 (AKAMAI-ASN1, US)
PTR: a104-109-85-8.deploy.static.akamaitechnologies.com
online.citi.com
9    52.57.229.31 (Frankfurt, Germany)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: ec2-52-57-229-31.eu-central-1.compute.amazonaws.com
nexus.ensighten.com
1    95.100.181.67 (European Union)

ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US)
PTR: a95-100-181-67.deploy.akamaitechnologies.com
cdn.tt.omtrdc.net
1    66.117.29.3 (Lehi, United States)

ASN15224 (OMNITURE - Adobe Systems Inc., US)
citicorpcreditservic.tt.omtrdc.net
6    35.158.49.49 (Frankfurt, Germany)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: ec2-35-158-49-49.eu-central-1.compute.amazonaws.com
nexus.ensighten.com
10    54.243.66.137 (Ashburn, United States)

ASN14618 (AMAZON-AES - Amazon.com, Inc., US)
PTR: ec2-54-243-66-137.compute-1.amazonaws.com
steps.citi.com
9    204.236.225.197 (Ashburn, United States)

ASN14618 (AMAZON-AES - Amazon.com, Inc., US)
PTR: ec2-204-236-225-197.compute-1.amazonaws.com
paper.citi.com
2    198.160.105.95 (Conway, United States)

ASN15026 (ACXIOM - Acxiom Corporation, US)
cardoffer.citicards.com
1    129.146.14.100 (Redwood City, United States)

ASN31898 (SAC-HERAKLES-01 - Oracle Corporation, US)
stags.bluekai.com
5    2a00:1450:4001:825::200e (Ireland)

ASN15169 (GOOGLE - Google Inc., US)
cse.google.com
www.youtube.com
s.ytimg.com
clients1.google.com
2    52.129.74.11 (Portland, United States)

ASN15301 (IOVATION - iovation, Inc., US)
PTR: mpsnare.iesnare.com
mpsnare.iesnare.com
7    2a00:1450:401b:801::2004 (Ireland)

ASN15169 (GOOGLE - Google Inc., US)
www.google.com
1    2a00:1450:4001:825::200a (Ireland)

ASN15169 (GOOGLE - Google Inc., US)
www.googleapis.com
1    172.217.21.226 (Mountain View, United States)

ASN15169 (GOOGLE - Google Inc., US)
PTR: fra16s13-in-f226.1e100.net
www.googleadservices.com
1    193.0.160.182 (Netherlands)

ASN54312 (ROCKETFUEL - Rocket Fuel Inc., US)
d.xp1.ru4.com
1    193.0.160.185 (Netherlands)

ASN54312 (ROCKETFUEL - Rocket Fuel Inc., US)
s.xp1.ru4.com
1    2a03:2880:f02d:12:face:b00c:0:3 (Ireland)

ASN32934 (FACEBOOK - Facebook, Inc., US)
connect.facebook.net
1    2a00:1450:401b:801::2003 (Ireland)

ASN15169 (GOOGLE - Google Inc., US)
www.google.de
1    63.140.43.86 (Lehi, United States)

ASN15224 (OMNITURE - Adobe Systems Inc., US)
PTR: citi.com.ssl.sc.omtrdc.net
metrics1.citi.com
Domain Requested by
38 online.citi.com online.citi.com
steps.citi.com
paper.citi.com
15 nexus.ensighten.com online.citi.com
nexus.ensighten.com
10 steps.citi.com online.citi.com
steps.citi.com
9 paper.citi.com online.citi.com
paper.citi.com
7 www.google.com cse.google.com
www.google.com
online.citi.com
2 mpsnare.iesnare.com online.citi.com
mpsnare.iesnare.com
2 cse.google.com online.citi.com
www.google.com
2 cardoffer.citicards.com online.citi.com
1 metrics1.citi.com
1 www.google.de
1 connect.facebook.net nexus.ensighten.com
1 s.xp1.ru4.com online.citi.com
1 clients1.google.com online.citi.com
1 d.xp1.ru4.com online.citi.com
1 www.googleadservices.com nexus.ensighten.com
1 www.googleapis.com online.citi.com
1 s.ytimg.com www.youtube.com
1 www.youtube.com online.citi.com
1 stags.bluekai.com online.citi.com
1 citicorpcreditservic.tt.omtrdc.net nexus.ensighten.com
1 cdn.tt.omtrdc.net nexus.ensighten.com
0 bid.g.doubleclick.net Failed www.googleadservices.com
0 6269322.fls.doubleclick.net Failed
0 sr.rlcdn.com Failed
0 6260004.fls.doubleclick.net Failed online.citi.com
103 25
Subject Issuer Validity Valid
online.citibank.com
Symantec Class 3 EV SSL CA - G3		 2017-06-06 -
2018-05-15		 a year crt.sh
nexus.ensighten.com
Symantec Class 3 Secure Server SHA256 SSL CA		 2014-10-27 -
2018-01-13		 3 years crt.sh
*.tt.omtrdc.net
DigiCert SHA2 High Assurance Server CA		 2014-07-29 -
2017-11-03		 3 years crt.sh
steps.citi.com
Symantec Class 3 EV SSL CA - G3		 2017-06-19 -
2019-07-16		 2 years crt.sh
paper.citi.com
Symantec Class 3 EV SSL CA - G3		 2017-06-19 -
2019-07-16		 2 years crt.sh
cardoffer.citicards.com
Symantec Class 3 EV SSL CA - G3		 2016-04-07 -
2018-05-09		 2 years crt.sh
*.bluekai.com
Symantec Class 3 Secure Server SHA256 SSL CA		 2016-08-16 -
2017-08-16		 a year crt.sh
*.google.com
Google Internet Authority G2		 2017-07-05 -
2017-09-27		 3 months crt.sh
mpsnare.iesnare.com
DigiCert SHA2 High Assurance Server CA		 2015-12-28 -
2018-03-02		 2 years crt.sh
www.google.com
Google Internet Authority G2		 2017-07-05 -
2017-09-27		 3 months crt.sh
*.googleapis.com
Google Internet Authority G2		 2017-07-12 -
2017-10-04		 3 months crt.sh
www.googleadservices.com
Google Internet Authority G2		 2017-07-05 -
2017-09-27		 3 months crt.sh
d.xp1.ru4.com
DigiCert SHA2 Secure Server CA		 2017-04-06 -
2018-05-17		 a year crt.sh
s.xp1.ru4.com
DigiCert SHA2 Secure Server CA		 2015-10-19 -
2018-10-23		 3 years crt.sh
*.facebook.com
DigiCert SHA2 High Assurance Server CA		 2016-12-09 -
2018-01-25		 a year crt.sh
www.google.de
Google Internet Authority G2		 2017-07-05 -
2017-09-27		 3 months crt.sh
metrics1.citi.com
Symantec Class 3 EV SSL CA - G3		 2016-10-28 -
2018-10-28		 2 years crt.sh

This page contains 9 frames:

Primary Page: https://online.citi.com/US/login.do
Frame ID: 32458.1
Requests: 83 HTTP requests in this frame

Frame: https://6260004.fls.doubleclick.net/activityi;dc_pre=CL2GlNDsk9UCFdg-GwodXjgI8g;src=6260004;type=cards0;cat=citih0;u4=JSOSIGNON;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=5193201568880.388
Frame ID: 32458.3
Requests: 1 HTTP requests in this frame

Frame: https://sr.rlcdn.com/425466.html?redirect=1&rl=2c58033e9c2e656d2361fdf6e008e6a98bc9b7eb31153a4bd5db8fa349aae4826462e664d3387760aefe2484e107d732202264ef7a61246d
Frame ID: 32458.5
Requests: 1 HTTP requests in this frame

Frame: https://6269322.fls.doubleclick.net/activityi;dc_pre=CP332NDsk9UCFdQTGwodwkAIww;src=6269322;type=bankp0;cat=banka001;ord=2629581755436.303
Frame ID: 32458.6
Requests: 1 HTTP requests in this frame

Frame: https://bid.g.doubleclick.net/xbbe/pixel?d=KAE
Frame ID: 32458.10
Requests: 1 HTTP requests in this frame

Frame: https://online.citi.com/JRS/images/pixel.gif
Frame ID: 32458.7
Requests: 7 HTTP requests in this frame

Frame: https://online.citi.com/JRS/images/pixel.gif
Frame ID: 32458.8
Requests: 3 HTTP requests in this frame

Frame: https://online.citi.com/JRS/images/pixel.gif
Frame ID: 32458.9
Requests: 3 HTTP requests in this frame

Frame: https://online.citi.com/JRS/images/pixel.gif
Frame ID: 32458.11
Requests: 3 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Statistics

103
Requests

95 %
HTTPS

26 %
IPv6

16
Domains

25
Subdomains

20
IPs

5
Countries

1001 kB
Transfer

3229 kB
Size

14
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

Request 36
  • https://idsync.rlcdn.com/387146.gif?partner_uid=00ab0287-4f08-49c2-8d9b-80bd1cb86ea9&redirect=1
  • https://cardoffer.citicards.com/dom/pixel?id=
Request 45
  • https://6260004.fls.doubleclick.net/activityi;src=6260004;type=cards0;cat=citih0;u4=JSOSIGNON;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=5193201568880.388?
  • https://6260004.fls.doubleclick.net/activityi;dc_pre=CL2GlNDsk9UCFdg-GwodXjgI8g;src=6260004;type=cards0;cat=citih0;u4=JSOSIGNON;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=5193201568880.388
Request 57
  • https://sr.rlcdn.com/425466.html?es=80676&u=da39a3ee5e6b4b0d3255bfef95601890afd80709
  • https://sr.rlcdn.com/425466.html?redirect=1&rl=2c58033e9c2e656d2361fdf6e008e6a98bc9b7eb31153a4bd5db8fa349aae4826462e664d3387760aefe2484e107d732202264ef7a61246d
Request 59
  • https://6269322.fls.doubleclick.net/activityi;src=6269322;type=bankp0;cat=banka001;ord=2629581755436.303?
  • https://6269322.fls.doubleclick.net/activityi;dc_pre=CP332NDsk9UCFdQTGwodwkAIww;src=6269322;type=bankp0;cat=banka001;ord=2629581755436.303
Request 69
  • https://www.google.com/ads/user-lists/960621875/?random=1500415855669&cv=8&fst=1500415200000&num=1&fmt=3&guid=ON&eid=376635471&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=fa...
  • https://www.google.de/ads/user-lists/960621875/?random=1500415855669&cv=8&fst=1500415200000&num=1&fmt=3&guid=ON&eid=376635471&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=fal...
Request 79
  • https://metrics1.citi.com/b/ss/citinaprod/1/JS-2.0.0/s76433183828628?AQB=1&ndh=1&pf=1&t=18%2F6%2F2017%2022%3A10%3A56%202%200&fid=09D9A2CBDBFD7143-09795D596BF6AC98&ce=UTF-8&pageName=Non%20Cookied%20...
  • https://metrics1.citi.com/b/ss/citinaprod/1/JS-2.0.0/s76433183828628?AQB=1&pccr=true&vidn=2CB743B805312F0B-60000103E000156B&&ndh=1&pf=1&t=18%2F6%2F2017%2022%3A10%3A56%202%200&fid=09D9A2CBDBFD7143-0...

103 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request login.do
online.citi.com/US/ 		238 KB
44 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://online.citi.com/US/login.do
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.109.85.8 Amsterdam, Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a104-109-85-8.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
0272d31d7dd1ed884c8b6ea48b08a94a1d7e9c2367e5d51e2b20009f9deb7e07

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/59.0.3071.115 Safari/537.36

Response headers

Date
Tue, 18 Jul 2017 22:10:54 GMT
Content-Encoding
gzip
X-DEBUG-TIER2-PARENT
2144863-204.2.223.94-1500415853-AUTH1-SHPIP209.107.202.53-TCIP148.251.45.170
Transfer-Encoding
chunked
P3P
policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
x-wily-info
Clear guid=57C1017C9928EF9F562F562F6A5BCFDF
Connection
keep-alive, Transfer-Encoding
X-Ion-Hop
1
X-UA-Compatible
IE=edge, IE=edge
Pragma
no-cache
Cache-Control
no-cache, must-revalidate, proxy-revalidate, no-store
X-Akamai-CITISITE
GTDC
jid
170718181052405946450455, 170718181052405946450455
X-DEBUG-TIER2
3118bd5-209.107.202.53-1500415853-AUTH1-SHPIP205.197.224.217-TCIP148.251.45.170
Vary
Accept-Encoding
Content-Language
en-US
x-wily-servlet
Encrypt1 qwo8OIMvfQTohxcp/wy1FK3uj2yXXnUc+IjdjW18Z9GR3FW+ZXw0qwthBk6HQ9aaNWWcQ9ThmzlprDQvP1D4JwA4Lu3nchrjhpx1jaZiuI9I7n+GuNZDtvcPE1pMR3PQop19OWU15tGr3mr6ZCbJmIvKLaHb1VjRq+F2DISSBYOTgd98tUawv8rTzDFychDuGGneNSvaPAmmSnCzQstFSA==
Content-Type
text/html; charset=ISO-8859-1
Expires
Thu, 01 Jan 1970 00:00:00 GMT
ddl.min.css
online.citi.com/CBOL/common/ui/ddl/theme/latest/styles/ 		624 KB
68 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://online.citi.com/CBOL/common/ui/ddl/theme/latest/styles/ddl.min.css
Requested by
Host: online.citi.com
URL: https://online.citi.com/US/login.do
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.109.85.8 Amsterdam, Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a104-109-85-8.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
6177c6163dc1ad67fb596a94ef3d18a277bfd437dbb3c1a928cd6caacefeff2e

Request headers

Referer
https://online.citi.com/US/login.do
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/59.0.3071.115 Safari/537.36

Response headers

Date
Tue, 18 Jul 2017 22:10:54 GMT
Content-Encoding
gzip
Last-Modified
Tue, 13 Jun 2017 06:25:20 GMT
X-Akamai-CITISITE
GTDC
Vary
Accept-Encoding
P3P
policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
Cache-Control
max-age=21600
Connection
keep-alive
Content-Type
text/css
Content-Length
69738
Expires
Wed, 19 Jul 2017 04:10:54 GMT
jfpm.autocomplete.off.js
online.citi.com/JFP/js/modules/ 		1 KB
344 B 		Script
General
Check archive.org
Download Go to
Full URL
https://online.citi.com/JFP/js/modules/jfpm.autocomplete.off.js
Requested by
Host: online.citi.com
URL: https://online.citi.com/US/login.do
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.109.85.8 Amsterdam, Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a104-109-85-8.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
9dad502247a8488c21ef5beb32aed1a78b17b748711bec817c472911f76b4ead

Request headers

Referer
https://online.citi.com/US/login.do
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/59.0.3071.115 Safari/537.36

Response headers

Date
Tue, 18 Jul 2017 22:10:54 GMT
Content-Encoding
gzip
Last-Modified
Tue, 07 Feb 2017 05:22:48 GMT
X-Akamai-CITISITE
GTDC
Vary
Accept-Encoding
P3P
policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
Cache-Control
max-age=21600
Connection
keep-alive
Content-Type
application/x-javascript
Content-Length
344
Expires
Wed, 19 Jul 2017 04:10:54 GMT
main_branding.css
online.citi.com/GFC/branding/responsivebranding/css/ 		268 KB
41 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://online.citi.com/GFC/branding/responsivebranding/css/main_branding.css
Requested by
Host: online.citi.com
URL: https://online.citi.com/US/login.do
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.109.85.8 Amsterdam, Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a104-109-85-8.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
a621f450d026646ee83df081a99fbd75603b1e9cda1e586223d14a58db292d73

Request headers

Referer
https://online.citi.com/US/login.do
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/59.0.3071.115 Safari/537.36

Response headers

Date
Tue, 18 Jul 2017 22:10:54 GMT
Content-Encoding
gzip
Last-Modified
Mon, 17 Apr 2017 16:22:47 GMT
X-Akamai-CITISITE
GTDC
Vary
Accept-Encoding
P3P
policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
Cache-Control
max-age=21600
Connection
keep-alive
Content-Type
text/css
Content-Length
41812
Expires
Wed, 19 Jul 2017 04:10:54 GMT
vendor.js
online.citi.com/CBOL/common/ui/ddl/theme/latest/scripts/ 		204 KB
63 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://online.citi.com/CBOL/common/ui/ddl/theme/latest/scripts/vendor.js
Requested by
Host: online.citi.com
URL: https://online.citi.com/US/login.do
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.109.85.8 Amsterdam, Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a104-109-85-8.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
03c736ca1c90e26743865ed80c9766f84ca237b0dc572fab630737aaef70d171

Request headers

Referer
https://online.citi.com/US/login.do
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/59.0.3071.115 Safari/537.36

Response headers

Date
Tue, 18 Jul 2017 22:10:54 GMT
Content-Encoding
gzip
Last-Modified
Tue, 13 Jun 2017 06:25:20 GMT
X-Akamai-CITISITE
GTDC
Vary
Accept-Encoding
P3P
policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
Cache-Control
max-age=21600
Connection
keep-alive
Content-Type
application/x-javascript
Content-Length
64910
Expires
Wed, 19 Jul 2017 04:10:54 GMT
Bootstrap.js
nexus.ensighten.com/citi/na_prod/ 		94 KB
28 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Requested by
Host: online.citi.com
URL: https://online.citi.com/US/login.do
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.57.229.31 Frankfurt, Germany, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-52-57-229-31.eu-central-1.compute.amazonaws.com
Software
nginx /
Resource Hash
aa4d9d71daa80aee40853b510af3c03ec3948423c6b42949706f993c31862409

Request headers

Referer
https://online.citi.com/US/login.do
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/59.0.3071.115 Safari/537.36

Response headers

Date
Tue, 18 Jul 2017 22:10:54 GMT
Content-Encoding
gzip
Last-Modified
Wed, 12 Jul 2017 21:08:55 GMT
Server
nginx
ETag
W/"59668fe7-1793f"
Vary
Accept-Encoding
Content-Type
application/javascript; charset=utf-8
Cache-Control
max-age=300
Transfer-Encoding
chunked
Connection
keep-alive
homePage.min.css
online.citi.com/loginpage/styles/ 		18 KB
4 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://online.citi.com/loginpage/styles/homePage.min.css
Requested by
Host: online.citi.com
URL: https://online.citi.com/US/login.do
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.109.85.8 Amsterdam, Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a104-109-85-8.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
876d6d386681dfd1b78374b1ed36763be7bbea4686656830069bc0dad86e2856

Request headers

Referer
https://online.citi.com/US/login.do
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/59.0.3071.115 Safari/537.36

Response headers

Date
Tue, 18 Jul 2017 22:10:54 GMT
Content-Encoding
gzip
Last-Modified
Tue, 09 May 2017 05:38:14 GMT
X-Akamai-CITISITE
GTDC
Vary
Accept-Encoding
P3P
policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
Cache-Control
max-age=21600
Connection
keep-alive
Content-Type
text/css
Content-Length
3952
Expires
Wed, 19 Jul 2017 04:10:54 GMT
jquery.tmpl.js
online.citi.com/JFP/js/jquery/plugins/ 		6 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://online.citi.com/JFP/js/jquery/plugins/jquery.tmpl.js
Requested by
Host: online.citi.com
URL: https://online.citi.com/US/login.do
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.109.85.8 Amsterdam, Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a104-109-85-8.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
629b48196dcc270143a42ce57535b251c655617f8d510277d4a05306c426fd38

Request headers

Referer
https://online.citi.com/US/login.do
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/59.0.3071.115 Safari/537.36

Response headers

Date
Tue, 18 Jul 2017 22:10:54 GMT
Content-Encoding
gzip
Last-Modified
Tue, 07 Feb 2017 05:22:48 GMT
X-Akamai-CITISITE
GTDC
Vary
Accept-Encoding
P3P
policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
Cache-Control
max-age=21600
Connection
keep-alive
Content-Type
application/x-javascript
Content-Length
2905
Expires
Wed, 19 Jul 2017 04:10:54 GMT
fp.min.js
online.citi.com/JSO/js/ 		15 KB
4 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://online.citi.com/JSO/js/fp.min.js
Requested by
Host: online.citi.com
URL: https://online.citi.com/US/login.do
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.109.85.8 Amsterdam, Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a104-109-85-8.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
c3c994c3fe9bd4e055f6d0eb42067ecd6bdd3247e136bc22835b9882cfe77c61

Request headers

Referer
https://online.citi.com/US/login.do
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/59.0.3071.115 Safari/537.36

Response headers

Date
Tue, 18 Jul 2017 22:10:54 GMT
Content-Encoding
gzip
Last-Modified
Tue, 07 Feb 2017 05:22:48 GMT
X-Akamai-CITISITE
GTDC
Vary
Accept-Encoding
P3P
policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
Cache-Control
max-age=21600
Connection
keep-alive
Content-Type
application/x-javascript
Content-Length
4322
Expires
Wed, 19 Jul 2017 04:10:54 GMT
amw.js
online.citi.com/JFP/amw/ 		1 KB
816 B 		Script
General
Check archive.org
Download Go to
Full URL
https://online.citi.com/JFP/amw/amw.js
Requested by
Host: online.citi.com
URL: https://online.citi.com/US/login.do
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.109.85.8 Amsterdam, Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a104-109-85-8.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
823db1b6cf4fe34956773f03a9b3e1c36d3a1fe1b609b1c1bd8730475bc6b81c

Request headers

Referer
https://online.citi.com/US/login.do
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/59.0.3071.115 Safari/537.36

Response headers

Date
Tue, 18 Jul 2017 22:10:54 GMT
Content-Encoding
gzip
Last-Modified
Tue, 11 Apr 2017 05:14:34 GMT
X-Akamai-CITISITE
GTDC
Vary
Accept-Encoding
P3P
policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
Cache-Control
max-age=21600
Connection
keep-alive
Content-Type
application/x-javascript
Content-Length
816
Expires
Wed, 19 Jul 2017 04:10:54 GMT
main.css
online.citi.com/GFC/branding/responsivebranding/css/ 		36 KB
5 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://online.citi.com/GFC/branding/responsivebranding/css/main.css
Requested by
Host: online.citi.com
URL: https://online.citi.com/US/login.do
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.109.85.8 Amsterdam, Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a104-109-85-8.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
745f3ee4d1d9310d3414a8a8dd027158cdd31cfeb4ea0103fcb80351e5f33201

Request headers

Referer
https://online.citi.com/US/login.do
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/59.0.3071.115 Safari/537.36

Response headers

Date
Tue, 18 Jul 2017 22:10:54 GMT
Content-Encoding
gzip
Last-Modified
Tue, 11 Apr 2017 17:49:16 GMT
X-Akamai-CITISITE
GTDC
Vary
Accept-Encoding
P3P
policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
Cache-Control
max-age=21600
Connection
keep-alive
Content-Type
text/css
Content-Length
5450
Expires
Wed, 19 Jul 2017 04:10:54 GMT
citiHomePage.min.js
online.citi.com/loginpage/scripts/ 		10 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://online.citi.com/loginpage/scripts/citiHomePage.min.js
Requested by
Host: online.citi.com
URL: https://online.citi.com/US/login.do
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.109.85.8 Amsterdam, Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a104-109-85-8.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
6be01f3f4d6d03d49a9ee459f1fbafaeca455603ecda12c5ae829e0a6aa04c43

Request headers

Referer
https://online.citi.com/US/login.do
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/59.0.3071.115 Safari/537.36

Response headers

Date
Tue, 18 Jul 2017 22:10:54 GMT
Content-Encoding
gzip
Last-Modified
Tue, 13 Jun 2017 06:25:18 GMT
X-Akamai-CITISITE
GTDC
Vary
Accept-Encoding
P3P
policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
Cache-Control
max-age=21600
Connection
keep-alive
Content-Type
application/x-javascript
Content-Length
3235
Expires
Wed, 19 Jul 2017 04:10:54 GMT
peworkflow.min.js
online.citi.com/personalization/ 		4 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://online.citi.com/personalization/peworkflow.min.js
Requested by
Host: online.citi.com
URL: https://online.citi.com/US/login.do
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.109.85.8 Amsterdam, Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a104-109-85-8.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
cfa6511b58884f7502eef2c077f04aa90759762dcf00a79b87e5745c2dd2512c

Request headers

Referer
https://online.citi.com/US/login.do
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/59.0.3071.115 Safari/537.36

Response headers

Date
Tue, 18 Jul 2017 22:10:54 GMT
Content-Encoding
gzip
Last-Modified
Tue, 13 Jun 2017 06:25:18 GMT
X-Akamai-CITISITE
GTDC
Vary
Accept-Encoding
P3P
policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
Cache-Control
max-age=21600
Connection
keep-alive
Content-Type
application/x-javascript
Content-Length
1308
Expires
Wed, 19 Jul 2017 04:10:54 GMT
oo_engine.min.js
online.citi.com/GFC/branding/olab/js/ 		42 KB
11 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://online.citi.com/GFC/branding/olab/js/oo_engine.min.js
Requested by
Host: online.citi.com
URL: https://online.citi.com/US/login.do
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.109.85.8 Amsterdam, Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a104-109-85-8.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
1f2a0e7aa3dabf73dae3cc7c1e53a70ec51145b39b027bdc1ecae9223c0c80d2

Request headers

Referer
https://online.citi.com/US/login.do
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/59.0.3071.115 Safari/537.36

Response headers

Date
Tue, 18 Jul 2017 22:10:54 GMT
Content-Encoding
gzip
Last-Modified
Thu, 10 Nov 2016 23:26:45 GMT
X-Akamai-CITISITE
GTDC
Vary
Accept-Encoding
P3P
policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
Cache-Control
max-age=21600
Connection
keep-alive
Content-Type
application/x-javascript
Content-Length
11704
Expires
Wed, 19 Jul 2017 04:10:54 GMT
ddl.min.js
online.citi.com/CBOL/common/ui/ddl/theme/latest/scripts/ 		64 KB
17 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://online.citi.com/CBOL/common/ui/ddl/theme/latest/scripts/ddl.min.js
Requested by
Host: online.citi.com
URL: https://online.citi.com/US/login.do
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.109.85.8 Amsterdam, Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a104-109-85-8.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
f1821b3865a1008ba0c088f7dc5c7eeb6b81e414461885c40b8d0f48fcbc9341

Request headers

Referer
https://online.citi.com/US/login.do
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/59.0.3071.115 Safari/537.36

Response headers

Date
Tue, 18 Jul 2017 22:10:54 GMT
Content-Encoding
gzip
Last-Modified
Tue, 13 Jun 2017 06:25:20 GMT
X-Akamai-CITISITE
GTDC
Vary
Accept-Encoding
P3P
policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
Cache-Control
max-age=21600
Connection
keep-alive
Content-Type
application/x-javascript
Content-Length
17670
Expires
Wed, 19 Jul 2017 04:10:54 GMT
main.js
online.citi.com/GFC/branding/responsivebranding/js/ 		24 KB
6 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://online.citi.com/GFC/branding/responsivebranding/js/main.js
Requested by
Host: online.citi.com
URL: https://online.citi.com/US/login.do
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.109.85.8 Amsterdam, Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a104-109-85-8.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
85bb24baa94f0eb9e0e1138e87cb654611313a2f5b260ed0cd5d96afbfba52c3

Request headers

Referer
https://online.citi.com/US/login.do
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/59.0.3071.115 Safari/537.36

Response headers

Date
Tue, 18 Jul 2017 22:10:54 GMT
Content-Encoding
gzip
Last-Modified
Wed, 14 Jun 2017 16:21:18 GMT
X-Akamai-CITISITE
GTDC
Vary
Accept-Encoding
P3P
policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
Cache-Control
max-age=21600
Connection
keep-alive
Content-Type
application/x-javascript
Content-Length
6439
Expires
Wed, 19 Jul 2017 04:10:54 GMT
target.js
cdn.tt.omtrdc.net/cdn/ 		43 KB
14 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.tt.omtrdc.net/cdn/target.js
Requested by
Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
95.100.181.67 , European Union, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a95-100-181-67.deploy.akamaitechnologies.com
Software
Apache /
Resource Hash
88baf441d192730bb7c2c64c311ac76307c88ffb03852a18506098c1f577e89f

Request headers

Referer
https://online.citi.com/US/login.do
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/59.0.3071.115 Safari/537.36
Intervention
<https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

Date
Tue, 18 Jul 2017 22:10:54 GMT
Content-Encoding
gzip
Last-Modified
Fri, 23 Jun 2017 03:34:02 GMT
Server
Apache
ETag
"5f499-aa3e-5529845c7647a"
Vary
Accept-Encoding
Content-Type
text/javascript; charset=utf-8
Cache-Control
must-revalidate, max-age=3600
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
14200
standard
citicorpcreditservic.tt.omtrdc.net/m2/citicorpcreditservic/mbox/ 		988 B
533 B 		Script
General
Check archive.org
Download Go to
Full URL
https://citicorpcreditservic.tt.omtrdc.net/m2/citicorpcreditservic/mbox/standard?mboxHost=online.citi.com&mboxSession=1500415854225-317953&mboxPage=1500415854225-317953&screenHeight=1200&screenWidth=1600&browserWidth=1600&browserHeight=1200&browserTimeOffset=0&colorDepth=24&mboxXDomain=enabled&mboxCount=1&pageDef=jUSCBOL_Loginpage_Uncookied&ProspectCustomer=true&pageLanguage=english&mbox=target-global-mbox&mboxId=0&mboxTime=1500415854227&mboxURL=https%3A%2F%2Fonline.citi.com%2FUS%2Flogin.do&mboxReferrer=&mboxVersion=53
Requested by
Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Protocol
SPDY
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
66.117.29.3 Lehi, United States, ASN15224 (OMNITURE - Adobe Systems Inc., US),
Reverse DNS
Software
Test & Target /
Resource Hash
6a5960687fe90987f59ffe6c36450124b6b607608f4d100d7545fc4372c069a4

Request headers

Referer
https://online.citi.com/US/login.do
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/59.0.3071.115 Safari/537.36
Intervention
<https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

pragma
no-cache
date
Tue, 18 Jul 2017 22:10:53 GMT
content-encoding
gzip
server
Test & Target
vary
Accept-Encoding
p3p
CP="NOI DSP CURa OUR STP COM", CP="NOI DSP CURa OUR STP COM"
status
200
cache-control
no-cache
content-type
text/javascript;charset=utf-8
serverComponent.php
nexus.ensighten.com/citi/na_prod/ 		3 KB
873 B 		Script
General
Check archive.org
Download Go to
Full URL
https://nexus.ensighten.com/citi/na_prod/serverComponent.php?r=33545.211150814655&ClientID=1129&PageID=https%3A%2F%2Fonline.citi.com%2FUS%2Flogin.do
Requested by
Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.57.229.31 Frankfurt, Germany, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-52-57-229-31.eu-central-1.compute.amazonaws.com
Software
nginx /
Resource Hash
a75812fddb74e992f1b917dd1b0097f573613420f6a3c1d7976534daf386c1ee

Request headers

Referer
https://online.citi.com/US/login.do
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/59.0.3071.115 Safari/537.36

Response headers

Date
Tue, 18 Jul 2017 22:10:54 GMT
Content-Encoding
gzip
Server
nginx
Vary
Accept-Encoding
Content-Type
text/javascript
Cache-Control
no-cache, no-store
Transfer-Encoding
chunked
Connection
keep-alive
Expires
Tue, 18 Jul 2017 22:10:53 GMT
e186cee9a7f2b0afdca38ef3840d9d13.js
nexus.ensighten.com/citi/na_prod/code/ 		4 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://nexus.ensighten.com/citi/na_prod/code/e186cee9a7f2b0afdca38ef3840d9d13.js?conditionId0=467299
Requested by
Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.57.229.31 Frankfurt, Germany, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-52-57-229-31.eu-central-1.compute.amazonaws.com
Software
nginx /
Resource Hash
8ab79d13531bd711ddeb984d668fd94d4a1ad0d2e16dc84c2807970d1628ba1b

Request headers

Referer
https://online.citi.com/US/login.do
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/59.0.3071.115 Safari/537.36

Response headers

Date
Tue, 18 Jul 2017 22:10:54 GMT
Content-Encoding
gzip
Last-Modified
Fri, 31 Mar 2017 15:30:37 GMT
Server
nginx
ETag
W/"58de761d-10e4"
Vary
Accept-Encoding
Content-Type
application/javascript; charset=utf-8
Cache-Control
max-age=315360000
Transfer-Encoding
chunked
Connection
keep-alive
be7cc7db75f3781f2fc28e3d3ec88f7e.js
nexus.ensighten.com/citi/na_prod/code/ 		4 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://nexus.ensighten.com/citi/na_prod/code/be7cc7db75f3781f2fc28e3d3ec88f7e.js?conditionId0=490317
Requested by
Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.57.229.31 Frankfurt, Germany, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-52-57-229-31.eu-central-1.compute.amazonaws.com
Software
nginx /
Resource Hash
c139d91e4f48a88c8400112a20c1c499a6cd362e88dccb3fe81b22af55077430

Request headers

Referer
https://online.citi.com/US/login.do
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/59.0.3071.115 Safari/537.36

Response headers

Date
Tue, 18 Jul 2017 22:10:54 GMT
Content-Encoding
gzip
Last-Modified
Thu, 22 Jun 2017 20:52:12 GMT
Server
nginx
ETag
W/"594c2dfc-f70"
Vary
Accept-Encoding
Content-Type
application/javascript; charset=utf-8
Cache-Control
max-age=315360000
Transfer-Encoding
chunked
Connection
keep-alive
21dd803bbed4d08403a27bb0ceffb8ee.js
nexus.ensighten.com/citi/na_prod/code/ 		2 KB
672 B 		Script
General
Check archive.org
Download Go to
Full URL
https://nexus.ensighten.com/citi/na_prod/code/21dd803bbed4d08403a27bb0ceffb8ee.js?conditionId0=480881
Requested by
Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.57.229.31 Frankfurt, Germany, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-52-57-229-31.eu-central-1.compute.amazonaws.com
Software
nginx /
Resource Hash
6160549bfa9298ad3fe4f54514aef544b094fc6853b927b4edf1a61d46e4173f

Request headers

Referer
https://online.citi.com/US/login.do
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/59.0.3071.115 Safari/537.36

Response headers

Date
Tue, 18 Jul 2017 22:10:54 GMT
Content-Encoding
gzip
Last-Modified
Fri, 23 Jun 2017 18:42:43 GMT
Server
nginx
ETag
W/"594d6123-631"
Vary
Accept-Encoding
Content-Type
application/javascript; charset=utf-8
Cache-Control
max-age=315360000
Transfer-Encoding
chunked
Connection
keep-alive
19e29a61f9d2bd540e4b3405561f8f3f.js
nexus.ensighten.com/citi/na_prod/code/ 		34 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://nexus.ensighten.com/citi/na_prod/code/19e29a61f9d2bd540e4b3405561f8f3f.js?conditionId0=421908
Requested by
Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.57.229.31 Frankfurt, Germany, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-52-57-229-31.eu-central-1.compute.amazonaws.com
Software
nginx /
Resource Hash
3d3d1d5ae8cd77c47016e1b254dfe0f175cdff48f1350b0adbbfb74ad5c2a614

Request headers

Referer
https://online.citi.com/US/login.do
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/59.0.3071.115 Safari/537.36

Response headers

Date
Tue, 18 Jul 2017 22:10:54 GMT
Content-Encoding
gzip
Last-Modified
Wed, 12 Jul 2017 16:41:11 GMT
Server
nginx
ETag
W/"59665127-8933"
Vary
Accept-Encoding
Content-Type
application/javascript; charset=utf-8
Cache-Control
max-age=315360000
Transfer-Encoding
chunked
Connection
keep-alive
75beb2d4313837a91646d1b7a2a9b73f.js
nexus.ensighten.com/citi/na_prod/code/ 		997 B
997 B 		Script
General
Check archive.org
Download Go to
Full URL
https://nexus.ensighten.com/citi/na_prod/code/75beb2d4313837a91646d1b7a2a9b73f.js?conditionId0=474145
Requested by
Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.57.229.31 Frankfurt, Germany, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-52-57-229-31.eu-central-1.compute.amazonaws.com
Software
nginx /
Resource Hash
af45c9367e7a2bf6feceb98cc4fffbc63c1d7d8db90c7c2c2639ce03ce779812

Request headers

Referer
https://online.citi.com/US/login.do
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/59.0.3071.115 Safari/537.36

Response headers

Date
Tue, 18 Jul 2017 22:10:54 GMT
Last-Modified
Fri, 10 Feb 2017 19:18:29 GMT
Server
nginx
ETag
"589e1205-3e5"
Content-Type
application/javascript; charset=utf-8
Cache-Control
max-age=315360000
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
997
3b58ed00af8670dc0af85dd6e3dc0bee.js
nexus.ensighten.com/citi/na_prod/code/ 		125 KB
41 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://nexus.ensighten.com/citi/na_prod/code/3b58ed00af8670dc0af85dd6e3dc0bee.js?conditionId0=443037
Requested by
Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.57.229.31 Frankfurt, Germany, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-52-57-229-31.eu-central-1.compute.amazonaws.com
Software
nginx /
Resource Hash
304987a16c4c009cf2465e0e6873ac2511b3a4b6daef85345d23225855e6158e

Request headers

Referer
https://online.citi.com/US/login.do
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/59.0.3071.115 Safari/537.36

Response headers

Date
Tue, 18 Jul 2017 22:10:54 GMT
Content-Encoding
gzip
Last-Modified
Wed, 12 Jul 2017 21:08:55 GMT
Server
nginx
ETag
W/"59668fe7-1f3de"
Vary
Accept-Encoding
Content-Type
application/javascript; charset=utf-8
Cache-Control
max-age=315360000
Transfer-Encoding
chunked
Connection
keep-alive
2b9b8d23d616e836616824194101ac5e.js
nexus.ensighten.com/citi/na_prod/code/ 		4 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://nexus.ensighten.com/citi/na_prod/code/2b9b8d23d616e836616824194101ac5e.js?conditionId0=454466
Requested by
Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.158.49.49 Frankfurt, Germany, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-35-158-49-49.eu-central-1.compute.amazonaws.com
Software
nginx /
Resource Hash
6d56febe0a7e0fc04aa138072771fd78e88e47ec461a8356bcba672cd498af63

Request headers

Referer
https://online.citi.com/US/login.do
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/59.0.3071.115 Safari/537.36

Response headers

Date
Tue, 18 Jul 2017 22:10:54 GMT
Content-Encoding
gzip
Last-Modified
Wed, 12 Jul 2017 20:25:25 GMT
Server
nginx
ETag
W/"596685b5-fcb"
Vary
Accept-Encoding
Content-Type
application/javascript; charset=utf-8
Cache-Control
max-age=315360000
Transfer-Encoding
chunked
Connection
keep-alive
f029507d3ebaf2d7889a3740207b0867.js
nexus.ensighten.com/citi/na_prod/code/ 		73 KB
23 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://nexus.ensighten.com/citi/na_prod/code/f029507d3ebaf2d7889a3740207b0867.js?conditionId0=486757
Requested by
Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.158.49.49 Frankfurt, Germany, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-35-158-49-49.eu-central-1.compute.amazonaws.com
Software
nginx /
Resource Hash
a83a7d8187b62a3975a857c380b453603decf73988114b83db3767dc62d38cda

Request headers

Referer
https://online.citi.com/US/login.do
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/59.0.3071.115 Safari/537.36

Response headers

Date
Tue, 18 Jul 2017 22:10:54 GMT
Content-Encoding
gzip
Last-Modified
Fri, 23 Jun 2017 18:42:43 GMT
Server
nginx
ETag
W/"594d6123-1259d"
Vary
Accept-Encoding
Content-Type
application/javascript; charset=utf-8
Cache-Control
max-age=315360000
Transfer-Encoding
chunked
Connection
keep-alive
0950e4d76a4f94b11375d784515ee6cc.js
nexus.ensighten.com/citi/na_prod/code/ 		4 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://nexus.ensighten.com/citi/na_prod/code/0950e4d76a4f94b11375d784515ee6cc.js?conditionId0=405518
Requested by
Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.57.229.31 Frankfurt, Germany, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-52-57-229-31.eu-central-1.compute.amazonaws.com
Software
nginx /
Resource Hash
f35d515bc97cfe3a498ad05c86aab9466d6274c931055bd1511c7ebf21e50a11

Request headers

Referer
https://online.citi.com/US/login.do
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/59.0.3071.115 Safari/537.36

Response headers

Date
Tue, 18 Jul 2017 22:10:54 GMT
Content-Encoding
gzip
Last-Modified
Wed, 12 Jul 2017 20:25:25 GMT
Server
nginx
ETag
W/"596685b5-102f"
Vary
Accept-Encoding
Content-Type
application/javascript; charset=utf-8
Cache-Control
max-age=315360000
Transfer-Encoding
chunked
Connection
keep-alive
5716f5dcad9e7d2e5e7cba0432232b6e.js
nexus.ensighten.com/citi/na_prod/code/ 		1 KB
566 B 		Script
General
Check archive.org
Download Go to
Full URL
https://nexus.ensighten.com/citi/na_prod/code/5716f5dcad9e7d2e5e7cba0432232b6e.js?conditionId0=462132&conditionId1=489470
Requested by
Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.158.49.49 Frankfurt, Germany, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-35-158-49-49.eu-central-1.compute.amazonaws.com
Software
nginx /
Resource Hash
4763a2782f72a90f6b8e180b30650823594aa0b2616ffdda0d7b5fc4835b3650

Request headers

Referer
https://online.citi.com/US/login.do
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/59.0.3071.115 Safari/537.36

Response headers

Date
Tue, 18 Jul 2017 22:10:54 GMT
Content-Encoding
gzip
Last-Modified
Fri, 23 Jun 2017 18:42:43 GMT
Server
nginx
ETag
W/"594d6123-44e"
Vary
Accept-Encoding
Content-Type
application/javascript; charset=utf-8
Cache-Control
max-age=315360000
Transfer-Encoding
chunked
Connection
keep-alive
d78573c5c05f89c8c617b43b0ce18443.js
nexus.ensighten.com/citi/na_prod/code/ 		3 KB
928 B 		Script
General
Check archive.org
Download Go to
Full URL
https://nexus.ensighten.com/citi/na_prod/code/d78573c5c05f89c8c617b43b0ce18443.js?conditionId0=489741
Requested by
Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.158.49.49 Frankfurt, Germany, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-35-158-49-49.eu-central-1.compute.amazonaws.com
Software
nginx /
Resource Hash
548fcf4697d3fab962a462b0eee67bcd53a9ec3321091a642fd88be6f9505e0b

Request headers

Referer
https://online.citi.com/US/login.do
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/59.0.3071.115 Safari/537.36

Response headers

Date
Tue, 18 Jul 2017 22:10:54 GMT
Content-Encoding
gzip
Last-Modified
Fri, 09 Jun 2017 15:11:03 GMT
Server
nginx
ETag
W/"593aba87-ab2"
Vary
Accept-Encoding
Content-Type
application/javascript; charset=utf-8
Cache-Control
max-age=315360000
Transfer-Encoding
chunked
Connection
keep-alive
2882428e792c9af07d2f0ef7a0859aab.js
nexus.ensighten.com/citi/na_prod/code/ 		4 KB
928 B 		Script
General
Check archive.org
Download Go to
Full URL
https://nexus.ensighten.com/citi/na_prod/code/2882428e792c9af07d2f0ef7a0859aab.js?conditionId0=644545&conditionId1=644546
Requested by
Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.158.49.49 Frankfurt, Germany, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-35-158-49-49.eu-central-1.compute.amazonaws.com
Software
nginx /
Resource Hash
e0cbbf1e1b39d4fb99fe7e4f33374ce7d3b629820c982a619d345a773e32ebc1

Request headers

Referer
https://online.citi.com/US/login.do
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/59.0.3071.115 Safari/537.36

Response headers

Date
Tue, 18 Jul 2017 22:10:54 GMT
Content-Encoding
gzip
Last-Modified
Wed, 12 Jul 2017 16:41:11 GMT
Server
nginx
ETag
W/"59665127-fe0"
Vary
Accept-Encoding
Content-Type
application/javascript; charset=utf-8
Cache-Control
max-age=315360000
Transfer-Encoding
chunked
Connection
keep-alive
f2ba4ba774f370d4161af4be840a9c28.js
nexus.ensighten.com/citi/na_prod/code/ 		1 KB
547 B 		Script
General
Check archive.org
Download Go to
Full URL
https://nexus.ensighten.com/citi/na_prod/code/f2ba4ba774f370d4161af4be840a9c28.js?conditionId0=635018
Requested by
Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.158.49.49 Frankfurt, Germany, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-35-158-49-49.eu-central-1.compute.amazonaws.com
Software
nginx /
Resource Hash
d0230eed4960342550b3b2e458684b4cde60beabf2ea948b40130a01e9cbf6a3

Request headers

Referer
https://online.citi.com/US/login.do
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/59.0.3071.115 Safari/537.36

Response headers

Date
Tue, 18 Jul 2017 22:10:54 GMT
Content-Encoding
gzip
Last-Modified
Thu, 22 Jun 2017 20:52:12 GMT
Server
nginx
ETag
W/"594c2dfc-475"
Vary
Accept-Encoding
Content-Type
application/javascript; charset=utf-8
Cache-Control
max-age=315360000
Transfer-Encoding
chunked
Connection
keep-alive
navigation.js
steps.citi.com/us/ 		63 KB
16 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://steps.citi.com/us/navigation.js
Requested by
Host: online.citi.com
URL: https://online.citi.com/US/login.do
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.243.66.137 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-54-243-66-137.compute-1.amazonaws.com
Software
nginx /
Resource Hash
1d6bba6cc294d0f54cf0a018a70e2f11e7171bc0631c0ada7996679da4ffa91a

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/59.0.3071.115 Safari/537.36
Referer
https://online.citi.com/US/login.do
Origin
https://online.citi.com

Response headers

Pragma
no-cache
Date
Tue, 18 Jul 2017 22:10:54 GMT
Content-Encoding
gzip
Server
nginx
transfer-encoding
chunked
Access-Control-Allow-Methods
GET, OPTIONS
P3P
CP="NOI ADM DEV PSAi COM NAV OUR OTR STP IND DEM"
Access-Control-Allow-Origin
https://online.citi.com
Expires
0
Cache-Control
no-cache, no-store, must-revalidate
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
application/x-javascript
PICS-Label
(PICS-1.1 "http://www.icra.org/pics/vocabularyv03/" l r (n 0 s 0 v 0 l 0 oa 0 ob 0 oc 0 od 0 oe 0 of 0 og 0 oh 0 c 0) "http://www.icra.org/ratingsv02.html" l r (nz 0 vz 0 lz 0 oz 0 cz 0) "http://www.rsac.org/ratingsv01.html" l r (n 0 s 0 v 0 l 0))
style4.js
paper.citi.com/127893/ 		38 KB
9 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://paper.citi.com/127893/style4.js?r=0.7833220238845104
Requested by
Host: online.citi.com
URL: https://online.citi.com/US/login.do
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
204.236.225.197 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-204-236-225-197.compute-1.amazonaws.com
Software
nginx /
Resource Hash
cb80d4a61fc18368511490761c79e99aaaddb75b43932b10c3285278a5515fe7

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/59.0.3071.115 Safari/537.36
Referer
https://online.citi.com/US/login.do
Origin
https://online.citi.com

Response headers

Pragma
no-cache
Date
Tue, 18 Jul 2017 22:10:54 GMT
Content-Encoding
gzip
Server
nginx
transfer-encoding
chunked
Access-Control-Allow-Methods
GET, OPTIONS
P3P
CP="NOI ADM DEV PSAi COM NAV OUR OTR STP IND DEM"
Access-Control-Allow-Origin
https://online.citi.com
Expires
0
Cache-Control
no-cache, no-store, must-revalidate
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
application/x-javascript
PICS-Label
(PICS-1.1 "http://www.icra.org/pics/vocabularyv03/" l r (n 0 s 0 v 0 l 0 oa 0 ob 0 oc 0 od 0 oe 0 of 0 og 0 oh 0 c 0) "http://www.icra.org/ratingsv02.html" l r (nz 0 vz 0 lz 0 oz 0 cz 0) "http://www.rsac.org/ratingsv01.html" l r (n 0 s 0 v 0 l 0))
Interstate-Light.woff
online.citi.com/CBOL/common/ui/ddl/theme/latest/styles/fonts/interstate/ 		74 KB
74 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://online.citi.com/CBOL/common/ui/ddl/theme/latest/styles/fonts/interstate/Interstate-Light.woff
Requested by
Host: online.citi.com
URL: https://online.citi.com/US/login.do
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.109.85.8 Amsterdam, Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a104-109-85-8.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
f327a0ba3e41b1e8154e1c18fc114baff0bd057151e3afe7fa6f33cc0cb18296

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/59.0.3071.115 Safari/537.36
Referer
https://online.citi.com/CBOL/common/ui/ddl/theme/latest/styles/ddl.min.css
Origin
https://online.citi.com

Response headers

Date
Tue, 18 Jul 2017 22:10:54 GMT
Content-Encoding
gzip
Last-Modified
Tue, 07 Feb 2017 05:22:46 GMT
X-Akamai-CITISITE
GTDC
Vary
Accept-Encoding
P3P
policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
Access-Control-Allow-Origin
*
Connection
keep-alive
Content-Type
text/plain
Content-Length
75483
Citi-Enterprise-White.png
online.citi.com/GFC/branding/img/ 		1 KB
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://online.citi.com/GFC/branding/img/Citi-Enterprise-White.png
Requested by
Host: online.citi.com
URL: https://online.citi.com/US/login.do
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.109.85.8 Amsterdam, Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a104-109-85-8.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
7cb24e06c00e47bb6bc6c38b935d6bc62817f656703387e4fb7591add96c7454

Request headers

Referer
https://online.citi.com/GFC/branding/responsivebranding/css/main_branding.css
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/59.0.3071.115 Safari/537.36

Response headers

Date
Tue, 18 Jul 2017 22:10:54 GMT
Last-Modified
Wed, 14 Jun 2017 18:29:05 GMT
X-Akamai-CITISITE
GTDC
P3P
policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
Connection
keep-alive
Accept-Ranges
bytes
Content-Type
image/png
Content-Length
1040
search-white.png
online.citi.com/CBOL/common/ui/ddl/theme/latest/images/catalogue/ 		800 B
800 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://online.citi.com/CBOL/common/ui/ddl/theme/latest/images/catalogue/search-white.png
Requested by
Host: online.citi.com
URL: https://online.citi.com/US/login.do
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.109.85.8 Amsterdam, Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a104-109-85-8.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
daec312d129cfc3ddfe90327b023a12aa308cce7e403dcda3b5c9f179c4458ca

Request headers

Referer
https://online.citi.com/GFC/branding/responsivebranding/css/main_branding.css
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/59.0.3071.115 Safari/537.36

Response headers

Date
Tue, 18 Jul 2017 22:10:54 GMT
Last-Modified
Tue, 07 Feb 2017 05:22:46 GMT
X-Akamai-CITISITE
GTDC
P3P
policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
Connection
keep-alive
Accept-Ranges
bytes
Content-Type
image/png
Content-Length
800
pixel
cardoffer.citicards.com/dom/
Redirect Chain
  • https://idsync.rlcdn.com/387146.gif?partner_uid=00ab0287-4f08-49c2-8d9b-80bd1cb86ea9&redirect=1
  • https://cardoffer.citicards.com/dom/pixel?id=
 		68 B
91 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cardoffer.citicards.com/dom/pixel?id=
Requested by
Host: online.citi.com
URL: https://online.citi.com/US/login.do
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
198.160.105.95 Conway, United States, ASN15026 (ACXIOM - Acxiom Corporation, US),
Reverse DNS
Software
/
Resource Hash
2aa4fa20701cdd6d8d56046069001186b5267e3ee7d0ef618ad2f4a683723e11

Request headers

Referer
https://online.citi.com/US/login.do
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/59.0.3071.115 Safari/537.36

Response headers

Date
Tue, 18 Jul 2017 22:10:55 GMT
Connection
keep-alive
Transfer-Encoding
chunked
Content-Type
image/png

Redirect headers

Location
https://cardoffer.citicards.com/dom/pixel?id=
P3P
CP: "NON DSP COR PSDo SAMo BUS IND UNI COM NAV INT POL PRE"
status
302
Cache-Control
no-cache, no-store
Connection
keep-alive
Content-Type
image/gif; charset=ISO-8859-1
Content-Length
0
Expires
Thu, 01 Jan 1970 00:00:00 GMT
bkintg.min.js
online.citi.com/personalization/ 		2 KB
776 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://online.citi.com/personalization/bkintg.min.js
Requested by
Host: online.citi.com
URL: https://online.citi.com/US/login.do
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.109.85.8 Amsterdam, Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a104-109-85-8.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
e2e37524843a8d03e92db4425809dbbc6c6f482dba4465f7533d5d3ef0337fc6

Request headers

Accept
text/javascript, application/javascript, application/ecmascript, application/x-ecmascript, */*; q=0.01
Referer
https://online.citi.com/US/login.do
X-Requested-With
XMLHttpRequest
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/59.0.3071.115 Safari/537.36

Response headers

Date
Tue, 18 Jul 2017 22:10:54 GMT
Content-Encoding
gzip
Last-Modified
Tue, 11 Apr 2017 05:14:34 GMT
X-Akamai-CITISITE
GTDC
Vary
Accept-Encoding
P3P
policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
Cache-Control
max-age=21600
Connection
keep-alive
Content-Type
application/x-javascript
Content-Length
776
Expires
Wed, 19 Jul 2017 04:10:54 GMT
aosRFIntg.min.js
online.citi.com/personalization/ 		15 KB
5 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://online.citi.com/personalization/aosRFIntg.min.js
Requested by
Host: online.citi.com
URL: https://online.citi.com/US/login.do
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.109.85.8 Amsterdam, Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a104-109-85-8.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
58ec2a9724dbfea1eee52a5f566d6bca559e7c3bb826d670893e037c7770e24e

Request headers

Accept
text/javascript, application/javascript, application/ecmascript, application/x-ecmascript, */*; q=0.01
Referer
https://online.citi.com/US/login.do
X-Requested-With
XMLHttpRequest
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/59.0.3071.115 Safari/537.36

Response headers

Date
Tue, 18 Jul 2017 22:10:54 GMT
Content-Encoding
gzip
Last-Modified
Tue, 13 Jun 2017 06:25:18 GMT
X-Akamai-CITISITE
GTDC
Vary
Accept-Encoding
P3P
policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
Cache-Control
max-age=21600
Connection
keep-alive
Content-Type
application/x-javascript
Content-Length
4635
Expires
Wed, 19 Jul 2017 04:10:54 GMT
cmstmplintg.min.js
online.citi.com/personalization/ 		4 KB
2 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://online.citi.com/personalization/cmstmplintg.min.js
Requested by
Host: online.citi.com
URL: https://online.citi.com/US/login.do
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.109.85.8 Amsterdam, Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a104-109-85-8.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
4d8418ac12932fed073261c988949cf294cb565f32d885964908cc0714a55c68

Request headers

Accept
text/javascript, application/javascript, application/ecmascript, application/x-ecmascript, */*; q=0.01
Referer
https://online.citi.com/US/login.do
X-Requested-With
XMLHttpRequest
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/59.0.3071.115 Safari/537.36

Response headers

Date
Tue, 18 Jul 2017 22:10:54 GMT
Content-Encoding
gzip
Last-Modified
Tue, 13 Jun 2017 06:25:18 GMT
X-Akamai-CITISITE
GTDC
Vary
Accept-Encoding
P3P
policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
Cache-Control
max-age=21600
Connection
keep-alive
Content-Type
application/x-javascript
Content-Length
1612
Expires
Wed, 19 Jul 2017 04:10:54 GMT
19469
stags.bluekai.com/site/ 		23 B
23 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://stags.bluekai.com/site/19469?ret=json
Requested by
Host: online.citi.com
URL: https://online.citi.com/US/login.do
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
129.146.14.100 Redwood City, United States, ASN31898 (SAC-HERAKLES-01 - Oracle Corporation, US),
Reverse DNS
Software
/
Resource Hash
33b16efff9f7042b210d4981541814365450cea44710e082a05cced2ae6f82f3

Request headers

Accept
application/json, text/javascript, */*; q=0.01
Referer
https://online.citi.com/US/login.do
Origin
https://online.citi.com
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/59.0.3071.115 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 18 Jul 2017 22:10:54 GMT
P3P
CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV", policyref="http://tags.bluekai.com/w3c/p3p.xml"
Access-Control-Allow-Origin
https://online.citi.com
Cache-Control
max-age=0, no-cache, no-store
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
application/json
Access-Control-Allow-Headers
Content-Type, *
Content-Length
23
BK-Server
a8d8
Expires
Thu, 01 Dec 1994 16:00:00 GMT
cse.js
cse.google.com/cse/ 		5 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cse.google.com/cse/cse.js?cx=009695499870347544712:e3dyicpbrwu
Requested by
Host: online.citi.com
URL: https://online.citi.com/GFC/branding/responsivebranding/js/main.js
Protocol
SPDY
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2a00:1450:4001:825::200e , Ireland, ASN15169 (GOOGLE - Google Inc., US),
Reverse DNS
Software
qfe /
Resource Hash
64f16e773ee8377eeafbc64d8778defeb81dabd8956bc70de980d874c775c586
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://online.citi.com/US/login.do
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/59.0.3071.115 Safari/537.36

Response headers

date
Tue, 18 Jul 2017 22:10:54 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
qfe
x-frame-options
SAMEORIGIN
content-type
text/javascript; charset=UTF-8
status
200
cache-control
private
content-disposition
attachment; filename="f.txt"
alt-svc
quic=":443"; ma=2592000; v="39,38,37,36,35"
content-length
1553
x-xss-protection
1; mode=block
snare.js
mpsnare.iesnare.com/ 		38 KB
13 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://mpsnare.iesnare.com/snare.js?_=1500415854187
Requested by
Host: online.citi.com
URL: https://online.citi.com/CBOL/common/ui/ddl/theme/latest/scripts/vendor.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.129.74.11 Portland, United States, ASN15301 (IOVATION - iovation, Inc., US),
Reverse DNS
mpsnare.iesnare.com
Software
nginx/1.8.1 /
Resource Hash
010603a6cdb6989527f433e10aca1edf8f5be6498c8f2d437d4f563096613e3b

Request headers

Referer
https://online.citi.com/US/login.do
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/59.0.3071.115 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 18 Jul 2017 22:10:54 GMT
Content-Encoding
gzip
Server
nginx/1.8.1
Transfer-Encoding
chunked
p3p
CP="NON DSP COR CURa"
Cache-Control
no-cache, private
Connection
keep-alive
Content-Type
text/javascript; charset=utf-8
Expires
0
close.svg
online.citi.com/CBOL/common/ui/ddl/theme/latest/images/icons/svgs/ 		1 KB
641 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://online.citi.com/CBOL/common/ui/ddl/theme/latest/images/icons/svgs/close.svg
Requested by
Host: online.citi.com
URL: https://online.citi.com/CBOL/common/ui/ddl/theme/latest/scripts/vendor.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.109.85.8 Amsterdam, Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a104-109-85-8.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
55e066703c69d4d89a1f4d66794d474aa93d710624d8f807096bac17a7867b17

Request headers

Referer
https://online.citi.com/CBOL/common/ui/ddl/theme/latest/styles/ddl.min.css
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/59.0.3071.115 Safari/537.36

Response headers

Date
Tue, 18 Jul 2017 22:10:54 GMT
Content-Encoding
gzip
Last-Modified
Tue, 13 Jun 2017 06:25:20 GMT
X-Akamai-CITISITE
GTDC
Vary
Accept-Encoding
P3P
policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
Connection
keep-alive
Accept-Ranges
bytes
Content-Type
image/svg+xml
Content-Length
641
iframe_api
www.youtube.com/ 		740 B
758 B 		Script
General
Check archive.org
Download Go to
Full URL
https://www.youtube.com/iframe_api
Requested by
Host: online.citi.com
URL: https://online.citi.com/CBOL/common/ui/ddl/theme/latest/scripts/ddl.min.js
Protocol
SPDY
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2a00:1450:4001:825::200e , Ireland, ASN15169 (GOOGLE - Google Inc., US),
Reverse DNS
Software
YouTubeFrontEnd /
Resource Hash
5ee4e0268ea8fd91231b210aed4bf450d1c78889d4bda3dd663ec9deefe7245e
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block; report=https://www.google.com/appserve/security-bugs/log/youtube

Request headers

Referer
https://online.citi.com/US/login.do
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/59.0.3071.115 Safari/537.36

Response headers

date
Tue, 18 Jul 2017 22:10:54 GMT
x-content-type-options
nosniff
server
YouTubeFrontEnd
content-type
application/javascript
status
200
cache-control
no-cache
alt-svc
quic=":443"; ma=2592000; v="39,38,37,36,35"
content-length
740
x-xss-protection
1; mode=block; report=https://www.google.com/appserve/security-bugs/log/youtube
expires
Tue, 27 Apr 1971 19:44:06 EST
activityi;dc_pre=CL2GlNDsk9UCFdg-GwodXjgI8g;src=6260004;type=cards0;cat=citih0;u4=JSOSIGNON;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=5193201568880.388
6260004.fls.doubleclick.net/ Frame 3245
Redirect Chain
  • https://6260004.fls.doubleclick.net/activityi;src=6260004;type=cards0;cat=citih0;u4=JSOSIGNON;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=5193201568880.388?
  • https://6260004.fls.doubleclick.net/activityi;dc_pre=CL2GlNDsk9UCFdg-GwodXjgI8g;src=6260004;type=cards0;cat=citih0;u4=JSOSIGNON;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=5193201568880.388
 		0
0
jsapi
www.google.com/ 		26 KB
6 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.google.com/jsapi?autoload=%7B%22modules%22%3A%5B%7B%22name%22%3A%22search%22%2C%22version%22%3A%221.0%22%2C%22callback%22%3A%22__gcse.scb%22%2C%22style%22%3A%22https%3A%2F%2Fwww.google.com%2Fcse%2Fstatic%2Fstyle%2Flook%2Fv2%2Fdefault.css%22%7D%5D%7D
Requested by
Host: cse.google.com
URL: https://cse.google.com/cse/cse.js?cx=009695499870347544712:e3dyicpbrwu
Protocol
SPDY
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a00:1450:401b:801::2004 , Ireland, ASN15169 (GOOGLE - Google Inc., US),
Reverse DNS
Software
GSE /
Resource Hash
0dc99ecac94d9a8f57f0841c59bd6a4ab45b8a0845d3be8eb70d84ca96f866c0
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://online.citi.com/US/login.do
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/59.0.3071.115 Safari/537.36

Response headers

date
Tue, 18 Jul 2017 22:10:54 GMT
content-encoding
gzip
x-content-type-options
nosniff
alt-svc
quic=":443"; ma=2592000; v="39,38,37,36,35"
server
GSE
x-frame-options
SAMEORIGIN
content-type
text/javascript; charset=utf-8
status
200
cache-control
private, max-age=3600, must-revalidate
vary
Accept-Encoding
content-length
6370
x-xss-protection
1; mode=block
expires
Tue, 18 Jul 2017 22:10:54 GMT
www-widgetapi.js
s.ytimg.com/yts/jsbin/www-widgetapi-vflyiGtkL/ 		24 KB
9 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://s.ytimg.com/yts/jsbin/www-widgetapi-vflyiGtkL/www-widgetapi.js
Requested by
Host: www.youtube.com
URL: https://www.youtube.com/iframe_api
Protocol
SPDY
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2a00:1450:4001:825::200e , Ireland, ASN15169 (GOOGLE - Google Inc., US),
Reverse DNS
Software
sffe /
Resource Hash
183708044ee98821cc3fcdc2ae3ad7e3edc50a8ca4d004c986a1945600b2ff2c
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://online.citi.com/US/login.do
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/59.0.3071.115 Safari/537.36

Response headers

date
Wed, 12 Jul 2017 22:34:21 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
516993
status
200
alt-svc
quic=":443"; ma=2592000; v="39,38,37,36,35"
content-length
9074
x-xss-protection
1; mode=block
last-modified
Wed, 12 Jul 2017 05:31:37 GMT
server
sffe
vary
Accept-Encoding, Origin
content-type
text/javascript
cache-control
public, max-age=691200
accept-ranges
bytes
timing-allow-origin
https://www.youtube.com
expires
Thu, 20 Jul 2017 22:34:21 GMT
logo.js
mpsnare.iesnare.com/script/ 		96 B
119 B 		Script
General
Check archive.org
Download Go to
Full URL
https://mpsnare.iesnare.com/script/logo.js
Requested by
Host: mpsnare.iesnare.com
URL: https://mpsnare.iesnare.com/snare.js?_=1500415854187
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.129.74.11 Portland, United States, ASN15301 (IOVATION - iovation, Inc., US),
Reverse DNS
mpsnare.iesnare.com
Software
nginx/1.8.1 /
Resource Hash
d173595bb7a886af3e190c3fac921a5fa6be724878a24e36aa07fc50e0cffcf1

Request headers

Referer
https://online.citi.com/US/login.do
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/59.0.3071.115 Safari/537.36

Response headers

Date
Tue, 18 Jul 2017 22:10:54 GMT
Content-Encoding
gzip
Last-Modified
Tue, 06 May 2014 00:01:40 GMT
Server
nginx/1.8.1
Transfer-Encoding
chunked
p3p
CP="NON DSP COR CURa"
Cache-Control
private
Connection
keep-alive
Content-Type
text/javascript; charset=utf-8
Expires
Tue, 19 Jul 2022 03:16:54 GMT
default+en.css
www.google.com/uds/api/search/1.0/4f0e4d5d7dc9efa79ab5cf95d689a1bc/ 		45 KB
10 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www.google.com/uds/api/search/1.0/4f0e4d5d7dc9efa79ab5cf95d689a1bc/default+en.css
Requested by
Host: www.google.com
URL: https://www.google.com/jsapi?autoload=%7B%22modules%22%3A%5B%7B%22name%22%3A%22search%22%2C%22version%22%3A%221.0%22%2C%22callback%22%3A%22__gcse.scb%22%2C%22style%22%3A%22https%3A%2F%2Fwww.google.com%2Fcse%2Fstatic%2Fstyle%2Flook%2Fv2%2Fdefault.css%22%7D%5D%7D
Protocol
SPDY
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a00:1450:401b:801::2004 , Ireland, ASN15169 (GOOGLE - Google Inc., US),
Reverse DNS
Software
GSE /
Resource Hash
72d4175bacbbc61b9b282dc40b8e796bc60575e2b743a27a01968a50a7612a76
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://online.citi.com/US/login.do
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/59.0.3071.115 Safari/537.36

Response headers

date
Tue, 18 Jul 2017 21:21:42 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
GSE
age
2952
x-frame-options
SAMEORIGIN
content-type
text/css; charset=UTF-8
status
200
vary
Accept-Encoding
cache-control
public, max-age=31536000
alt-svc
quic=":443"; ma=2592000; v="39,38,37,36,35"
content-length
10177
x-xss-protection
1; mode=block
expires
Wed, 18 Jul 2018 21:21:42 GMT
default.css
www.google.com/cse/static/style/look/v2/ 		14 KB
3 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www.google.com/cse/static/style/look/v2/default.css
Requested by
Host: www.google.com
URL: https://www.google.com/jsapi?autoload=%7B%22modules%22%3A%5B%7B%22name%22%3A%22search%22%2C%22version%22%3A%221.0%22%2C%22callback%22%3A%22__gcse.scb%22%2C%22style%22%3A%22https%3A%2F%2Fwww.google.com%2Fcse%2Fstatic%2Fstyle%2Flook%2Fv2%2Fdefault.css%22%7D%5D%7D
Protocol
SPDY
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a00:1450:401b:801::2004 , Ireland, ASN15169 (GOOGLE - Google Inc., US),
Reverse DNS
Software
sffe /
Resource Hash
57271db21f2726de70c45af59bf71488a3aa71a668ef59a16c9992eb0feeda88
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://online.citi.com/US/login.do
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/59.0.3071.115 Safari/537.36

Response headers

date
Tue, 18 Jul 2017 22:10:54 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Fri, 06 Jan 2017 00:00:00 GMT
server
sffe
vary
Accept-Encoding
content-type
text/css
status
200
cache-control
private, max-age=0
accept-ranges
bytes
alt-svc
quic=":443"; ma=2592000; v="39,38,37,36,35"
content-length
3075
x-xss-protection
1; mode=block
expires
Tue, 18 Jul 2017 22:10:54 GMT
default+en.I.js
www.google.com/uds/api/search/1.0/4f0e4d5d7dc9efa79ab5cf95d689a1bc/ 		292 KB
86 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.google.com/uds/api/search/1.0/4f0e4d5d7dc9efa79ab5cf95d689a1bc/default+en.I.js
Requested by
Host: www.google.com
URL: https://www.google.com/jsapi?autoload=%7B%22modules%22%3A%5B%7B%22name%22%3A%22search%22%2C%22version%22%3A%221.0%22%2C%22callback%22%3A%22__gcse.scb%22%2C%22style%22%3A%22https%3A%2F%2Fwww.google.com%2Fcse%2Fstatic%2Fstyle%2Flook%2Fv2%2Fdefault.css%22%7D%5D%7D
Protocol
SPDY
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a00:1450:401b:801::2004 , Ireland, ASN15169 (GOOGLE - Google Inc., US),
Reverse DNS
Software
GSE /
Resource Hash
d0857f2268da0b64eb01fe13a6fc0bce112ff4ac92b557b846ff6136d9f5f45e
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://online.citi.com/US/login.do
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/59.0.3071.115 Safari/537.36

Response headers

date
Tue, 18 Jul 2017 21:22:51 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
GSE
age
2883
x-frame-options
SAMEORIGIN
content-type
application/x-javascript; charset=UTF-8
status
200
vary
Accept-Encoding
cache-control
public, max-age=31536000
alt-svc
quic=":443"; ma=2592000; v="39,38,37,36,35"
content-length
88026
x-xss-protection
1; mode=block
expires
Wed, 18 Jul 2018 21:22:51 GMT
generate_204
www.googleapis.com/ 		0
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.googleapis.com/generate_204
Requested by
Host: online.citi.com
URL: https://online.citi.com/US/login.do
Protocol
SPDY
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a00:1450:4001:825::200a , Ireland, ASN15169 (GOOGLE - Google Inc., US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://online.citi.com/US/login.do
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/59.0.3071.115 Safari/537.36

Response headers

status
204
date
Tue, 18 Jul 2017 22:10:54 GMT
alt-svc
quic=":443"; ma=2592000; v="39,38,37,36,35"
content-length
0
BKDmpUpdate.action
online.citi.com/US/DMP/ 		3 KB
1 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://online.citi.com/US/DMP/BKDmpUpdate.action?JFP_TOKEN=RWNYT9NP
Requested by
Host: online.citi.com
URL: https://online.citi.com/US/login.do
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.109.85.8 Amsterdam, Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a104-109-85-8.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
e17da319eba14bc5a5677abdac48f8ef973597cca0c9733f8d3dd68bbc6faf81

Request headers

Accept
*/*
Referer
https://online.citi.com/US/login.do
Origin
https://online.citi.com
X-Requested-With
XMLHttpRequest
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/59.0.3071.115 Safari/537.36

Response headers

Date
Tue, 18 Jul 2017 22:10:54 GMT
Content-Encoding
gzip
P3P
policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
x-wily-info
Clear guid=0
Connection
keep-alive
cid
gt07p-srv3, gt07p-srv3
x-wily-servlet
Encrypt1 qwo8OIMvfQTohxcp/wy1FK3uj2yXXnUc+IjdjW18Z9GR3FW+ZXw0qwthBk6HQ9aaNWWcQ9ThmzlprDQvP1D4J6XMogQ2cVIjYzHwmfuygO856DFan0YZk8GqoKK1cDSRGxn5/mn0r+FtE3Oen9vWeNFgzJnhbmFHk5bpW+iknNOjVh9KVkgQ6i8HOagDTiSR5HVp1/FnqbWthEjCZwc6dg==
X-UA-Compatible
IE=edge, IE=edge
Pragma
no-cache
X-Akamai-CITISITE
GTDC
jid
170718181054405946450457, 170718181054405946450457
Vary
Accept-Encoding
Content-Language
en-US
Cache-Control
no-cache, must-revalidate, proxy-revalidate, no-store
Content-Length
1127
Content-Type
text/html;charset=ISO-8859-1
Expires
Thu, 01 Jan 1970 00:00:00 GMT
gpol
cardoffer.citicards.com/dom/ 		1 KB
1 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://cardoffer.citicards.com/dom/gpol
Requested by
Host: online.citi.com
URL: https://online.citi.com/US/login.do
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
198.160.105.95 Conway, United States, ASN15026 (ACXIOM - Acxiom Corporation, US),
Reverse DNS
Software
/
Resource Hash
96d29ed7cc7dcb7806c6babd3e52a5741a30a2a6dc8dca9bddac9716cd2dd8be
Security Headers
Name Value
X-Frame-Options NONE

Request headers

Accept
application/json, text/javascript, */*; q=0.01
Referer
https://online.citi.com/US/login.do
Origin
https://online.citi.com
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/59.0.3071.115 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

Date
Tue, 18 Jul 2017 22:10:55 GMT
X-Frame-Options
NONE
Access-Control-Allow-Methods
POST, OPTIONS
Content-Type
application/json
Access-Control-Allow-Origin
https://online.citi.com
Access-Control-Max-Age
3600
Cache-Control
private, no-cache, no-store
Access-Control-Allow-Credentials
true
Connection
keep-alive
Access-Control-Allow-Headers
Cookie, accept, origin, authorization, content-type
Content-Length
1181
LOInm
steps.citi.com/us/ 		106 B
106 B 		Script
General
Check archive.org
Download Go to
Full URL
https://steps.citi.com/us/LOInm?d=JTVCJTdCJTIyaWQlMjIlM0ElMjI0JTIyJTJDJTIyZGF0YSUyMiUzQSU3QiUyMnMlMjIlM0ElMjJDQk9MJTNBMTcwNzE4MTgxMDUyNDA1OTQ2NDUwNDU1JTIyJTdEJTdEJTVE&cid=4&si=2&e=https%3A%2F%2Fonline.citi.com&LSESSIONID=jLd1oKIb4IIhdyuLLx8s2zsJoPuSpX%2FbVkC3EXavFtPX08UvN8F3682k&t=jsonp&c=yfhuvuoocttrqbyq&eu=https%3A%2F%2Fonline.citi.com%2FUS%2Flogin.do
Requested by
Host: online.citi.com
URL: https://online.citi.com/US/login.do
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.243.66.137 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-54-243-66-137.compute-1.amazonaws.com
Software
nginx /
Resource Hash
dcc29d29b1b3a12f05ac192e3e93713a0346fae79fa10b17868b0bfe43e3844b

Request headers

Referer
https://online.citi.com/US/login.do
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/59.0.3071.115 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 18 Jul 2017 22:10:55 GMT
Server
nginx
Access-Control-Allow-Methods
GET, OPTIONS
P3P
CP="NOI ADM DEV PSAi COM NAV OUR OTR STP IND DEM"
Access-Control-Allow-Origin
*
Expires
0
Cache-Control
no-cache, no-store, must-revalidate
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
text/javascript
Content-Length
106
PICS-Label
(PICS-1.1 "http://www.icra.org/pics/vocabularyv03/" l r (n 0 s 0 v 0 l 0 oa 0 ob 0 oc 0 od 0 oe 0 of 0 og 0 oh 0 c 0) "http://www.icra.org/ratingsv02.html" l r (nz 0 vz 0 lz 0 oz 0 cz 0) "http://www.rsac.org/ratingsv01.html" l r (n 0 s 0 v 0 l 0))
esw
steps.citi.com/us/ 		360 B
360 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://steps.citi.com/us/esw?si=2&e=https%3A%2F%2Fonline.citi.com&LSESSIONID=jLd1oKIb4IIhdyuLLx8s2zsJoPuSpX%2FbVkC3EXavFtPX08UvN8F3682k&t=jsonpi&eu=https%3A%2F%2Fonline.citi.com%2FUS%2Flogin.do&c=ypvcvvxakpeyfdyw
Requested by
Host: online.citi.com
URL: https://online.citi.com/US/login.do
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.243.66.137 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-54-243-66-137.compute-1.amazonaws.com
Software
nginx /
Resource Hash
a4becff94cf0fac85d9ff942d234433935df9719cab82185a2f67d2b926f9816

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/59.0.3071.115 Safari/537.36
Referer
https://online.citi.com/US/login.do
Origin
https://online.citi.com

Response headers

Pragma
no-cache
Date
Tue, 18 Jul 2017 22:10:55 GMT
Server
nginx
Access-Control-Allow-Methods
GET, OPTIONS
P3P
CP="NOI ADM DEV PSAi COM NAV OUR OTR STP IND DEM"
Access-Control-Allow-Origin
https://online.citi.com
Expires
0
Cache-Control
no-cache, no-store, must-revalidate
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
text/javascript
Content-Length
360
PICS-Label
(PICS-1.1 "http://www.icra.org/pics/vocabularyv03/" l r (n 0 s 0 v 0 l 0 oa 0 ob 0 oc 0 od 0 oe 0 of 0 og 0 oh 0 c 0) "http://www.icra.org/ratingsv02.html" l r (nz 0 vz 0 lz 0 oz 0 cz 0) "http://www.rsac.org/ratingsv01.html" l r (n 0 s 0 v 0 l 0))
425466.html
sr.rlcdn.com/ Frame 3245
Redirect Chain
  • https://sr.rlcdn.com/425466.html?es=80676&u=da39a3ee5e6b4b0d3255bfef95601890afd80709
  • https://sr.rlcdn.com/425466.html?redirect=1&rl=2c58033e9c2e656d2361fdf6e008e6a98bc9b7eb31153a4bd5db8fa349aae4826462e664d3387760aefe2484e107d732202264ef7a61246d
 		0
0
conversion_async.js
www.googleadservices.com/pagead/ 		12 KB
5 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googleadservices.com/pagead/conversion_async.js
Requested by
Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Protocol
SPDY
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
172.217.21.226 Mountain View, United States, ASN15169 (GOOGLE - Google Inc., US),
Reverse DNS
fra16s13-in-f226.1e100.net
Software
cafe /
Resource Hash
341fabd4891d2b73b6b64f1867eeaaa7b1e4fbc24ff966f2a735853e03ab0264
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://online.citi.com/US/login.do
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/59.0.3071.115 Safari/537.36

Response headers

date
Tue, 18 Jul 2017 22:10:55 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
etag
156942143615714076
content-type
text/javascript; charset=UTF-8
status
200
cache-control
private, max-age=86400
content-disposition
attachment; filename="f.txt"
timing-allow-origin
*
alt-svc
quic="googleads.g.doubleclick.net:443"; ma=2592000; v="39,38,37,36,35",quic=":443"; ma=2592000; v="39,38,37,36,35"
content-length
4770
x-xss-protection
1; mode=block
expires
Tue, 18 Jul 2017 22:10:55 GMT
activityi;dc_pre=CP332NDsk9UCFdQTGwodwkAIww;src=6269322;type=bankp0;cat=banka001;ord=2629581755436.303
6269322.fls.doubleclick.net/ Frame 3245
Redirect Chain
  • https://6269322.fls.doubleclick.net/activityi;src=6269322;type=bankp0;cat=banka001;ord=2629581755436.303?
  • https://6269322.fls.doubleclick.net/activityi;dc_pre=CP332NDsk9UCFdQTGwodwkAIww;src=6269322;type=bankp0;cat=banka001;ord=2629581755436.303
 		0
0
activity
d.xp1.ru4.com/ 		43 B
43 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://d.xp1.ru4.com/activity?_o=17169175&_t=banksitevisitor&ssv_pagename=noncookiedusernamepassword
Requested by
Host: online.citi.com
URL: https://online.citi.com/US/login.do
Protocol
HTTP/1.1
Security
TLS 1.2, RSA, AES_256_CBC
Server
193.0.160.182 , Netherlands, ASN54312 (ROCKETFUEL - Rocket Fuel Inc., US),
Reverse DNS
Software
/
Resource Hash
2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363

Request headers

Referer
https://online.citi.com/US/login.do
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/59.0.3071.115 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 18 Jul 2017 22:10:55 GMT
P3P
policyref="/w3c/p3p.xml", CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Cache-Control
private, no-cache, must-revalidate
Connection
keep-alive
Content-Type
image/gif
Content-Length
43
Expires
Mon, 01-Jan-2010 12:00:00 GMT
async-ads.js
cse.google.com/adsense/search/ 		237 KB
74 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cse.google.com/adsense/search/async-ads.js
Requested by
Host: www.google.com
URL: https://www.google.com/uds/api/search/1.0/4f0e4d5d7dc9efa79ab5cf95d689a1bc/default+en.I.js
Protocol
SPDY
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2a00:1450:4001:825::200e , Ireland, ASN15169 (GOOGLE - Google Inc., US),
Reverse DNS
Software
sffe /
Resource Hash
f151d90d9b3a467fe6905f0605967db281d577f9eafbfdb881176f73b7dd4022
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://online.citi.com/US/login.do
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/59.0.3071.115 Safari/537.36

Response headers

date
Tue, 18 Jul 2017 22:10:55 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
sffe
etag
"17217905764536739366"
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
status
200
cache-control
private, max-age=3600
accept-ranges
bytes
alt-svc
quic=":443"; ma=2592000; v="39,38,37,36,35"
x-xss-protection
1; mode=block
expires
Tue, 18 Jul 2017 22:10:55 GMT
googlelogo_lightgrey_46x16dp.png
www.google.com/cse/static/images/1x/ 		551 B
569 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.com/cse/static/images/1x/googlelogo_lightgrey_46x16dp.png
Requested by
Host: www.google.com
URL: https://www.google.com/uds/api/search/1.0/4f0e4d5d7dc9efa79ab5cf95d689a1bc/default+en.I.js
Protocol
SPDY
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a00:1450:401b:801::2004 , Ireland, ASN15169 (GOOGLE - Google Inc., US),
Reverse DNS
Software
sffe /
Resource Hash
ad9b95dc8aec99a5335567c6f5f6df98de9a73db72d236b20363d94674ec65f8
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://online.citi.com/US/login.do
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/59.0.3071.115 Safari/537.36

Response headers

date
Tue, 18 Jul 2017 22:10:55 GMT
x-content-type-options
nosniff
last-modified
Wed, 11 Jan 2017 21:30:00 GMT
server
sffe
content-type
image/png
status
200
cache-control
private, max-age=31536000
accept-ranges
bytes
alt-svc
quic=":443"; ma=2592000; v="39,38,37,36,35"
content-length
551
x-xss-protection
1; mode=block
expires
Tue, 18 Jul 2017 22:10:55 GMT
googlelogo_grey_46x15dp.png
www.google.com/cse/static/images/1x/ 		919 B
937 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.com/cse/static/images/1x/googlelogo_grey_46x15dp.png
Requested by
Host: online.citi.com
URL: https://online.citi.com/US/login.do
Protocol
SPDY
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a00:1450:401b:801::2004 , Ireland, ASN15169 (GOOGLE - Google Inc., US),
Reverse DNS
Software
sffe /
Resource Hash
a844cdc48c7591822e45128a138f1dbba5753a3ca9992bd71c36758d51d0b68e
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://online.citi.com/US/login.do
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/59.0.3071.115 Safari/537.36

Response headers

date
Tue, 18 Jul 2017 22:10:55 GMT
x-content-type-options
nosniff
last-modified
Tue, 13 Dec 2016 15:00:00 GMT
server
sffe
content-type
image/png
status
200
cache-control
private, max-age=31536000
accept-ranges
bytes
alt-svc
quic=":443"; ma=2592000; v="39,38,37,36,35"
content-length
919
x-xss-protection
1; mode=block
expires
Tue, 18 Jul 2017 22:10:55 GMT
search_box_icon.png
www.google.com/uds/css/v2/ 		1018 B
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.com/uds/css/v2/search_box_icon.png
Requested by
Host: online.citi.com
URL: https://online.citi.com/US/login.do
Protocol
SPDY
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a00:1450:401b:801::2004 , Ireland, ASN15169 (GOOGLE - Google Inc., US),
Reverse DNS
Software
GSE /
Resource Hash
76a0d76f135419f4d00213037cda0cba949a0372e01ab6a1d70072008a56bd18
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://online.citi.com/US/login.do
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/59.0.3071.115 Safari/537.36

Response headers

date
Tue, 18 Jul 2017 22:10:55 GMT
x-content-type-options
nosniff
last-modified
Tue, 18 Jul 2017 20:46:55 GMT
server
GSE
age
0
vary
Accept-Encoding
content-type
image/png
status
200
cache-control
public, max-age=0
alt-svc
quic=":443"; ma=2592000; v="39,38,37,36,35"
content-length
1018
x-xss-protection
1; mode=block
expires
Tue, 18 Jul 2017 22:10:55 GMT
generate_204
clients1.google.com/ 		0
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://clients1.google.com/generate_204
Requested by
Host: online.citi.com
URL: https://online.citi.com/US/login.do
Protocol
SPDY
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2a00:1450:4001:825::200e , Ireland, ASN15169 (GOOGLE - Google Inc., US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://online.citi.com/US/login.do
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/59.0.3071.115 Safari/537.36

Response headers

status
204
date
Tue, 18 Jul 2017 22:10:55 GMT
alt-svc
quic=":443"; ma=2592000; v="39,38,37,36,35"
content-length
0
meta
s.xp1.ru4.com/ 		4 KB
4 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://s.xp1.ru4.com/meta?_o=17169175&_t=citi-com-homepage&_r=1&ssv_cuuid=00ab0287-4f08-49c2-8d9b-80bd1cb86ea9&ssvm_pid=142_L;202_X;C201;C301;C501;MPC_X&ssv_trans=e8d88b2ae40747efad3bb3668510bc29&ssv_ex=Uncookied&ssv_ftccham=other&ssv_ftcchal=Other&ssv_spdcham=8&ssv_spncham=NABC16_082_S2&ssv_rvdcham=3&ssv_rvncham=NABC16_083_S2&ssv_tadcham=4&ssv_tancham=NABC16_086&ssv_spdchal=5&ssv_spnchal=NABC16_108_S2&ssv_rvdchal=6&ssv_rvnchal=NABC16_109_S2&ssv_tcccham=C171_03&ssv_tccchal=C171_02&ssv_ep=PRD&ssv_cbcatchal=B171_01&ssv_cbcatcham=B171_01&ssv_ecm=N&ssv_device=L&ssv_pop=99&ssv_resp=I000&ssv_dht=1200&ssv_dwd=1600&ssv_aos=200&ssv_entry=Y
Requested by
Host: online.citi.com
URL: https://online.citi.com/US/login.do
Protocol
HTTP/1.1
Security
TLS 1.2, RSA, AES_256_CBC
Server
193.0.160.185 , Netherlands, ASN54312 (ROCKETFUEL - Rocket Fuel Inc., US),
Reverse DNS
Software
/
Resource Hash
d254e8edc553b0c20a860054b2db15b778be1962d497173af989f13efd941abe

Request headers

Accept
application/json, text/javascript, */*; q=0.01
Referer
https://online.citi.com/US/login.do
Origin
https://online.citi.com
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/59.0.3071.115 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

Pragma
no-cache
Date
Tue, 18 Jul 2017 22:10:55 GMT
Access-Control-Allow-Methods
GET, POST
P3P
policyref="/w3c/p3p.xml", CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Access-Control-Allow-Origin
https://online.citi.com
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
text/html
Content-Length
3783
Expires
Mon, 01-Jan-2010 12:00:00 GMT
fbevents.js
connect.facebook.net/en_US/ 		0
0 		Script
General
Check archive.org
Download Go to
Full URL
https://connect.facebook.net/en_US/fbevents.js
Requested by
Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/Bootstrap.js
Protocol
SPDY
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2a03:2880:f02d:12:face:b00c:0:3 , Ireland, ASN32934 (FACEBOOK - Facebook, Inc., US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://online.citi.com/US/login.do
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/59.0.3071.115 Safari/537.36

Response headers

status
200
x-fb-debug
LoMSzlQ0woxcPBnaWiDCvcXToik2eolEdQA4BiTbg6qw3An+mhFKvOlqEb6GRXpnQB96oPCa1ispudjfeXOmjA==
cache-control
max-age=1209600, no-transform
content-type
text/html
date
Tue, 18 Jul 2017 22:10:55 GMT
content-length
0
expires
Tue, 01 Aug 2017 22:10:55 GMT
pixel
bid.g.doubleclick.net/xbbe/ Frame 3245 		0
0
/
www.google.de/ads/user-lists/960621875/
Redirect Chain
  • https://www.google.com/ads/user-lists/960621875/?random=1500415855669&cv=8&fst=1500415200000&num=1&fmt=3&guid=ON&eid=376635471&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=fa...
  • https://www.google.de/ads/user-lists/960621875/?random=1500415855669&cv=8&fst=1500415200000&num=1&fmt=3&guid=ON&eid=376635471&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=fal...
 		42 B
60 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.de/ads/user-lists/960621875/?random=1500415855669&cv=8&fst=1500415200000&num=1&fmt=3&guid=ON&eid=376635471&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=0&u_nmime=0&frm=0&url=https%3A%2F%2Fonline.citi.com%2FUS%2Flogin.do&tiba=Banking%20with%20Citi%20%7C%20Citi.com&async=1&cdct=2&is_vtc=1&random=2730063797&fpvtc=/960621875/%3Frandom%3D154886334%26cv%3D8%26fst%3D1500415200000%26num%3D1%26fmt%3D3%26guid%3DON%26eid%3D376635471%26u_h%3D1200%26u_w%3D1600%26u_ah%3D1200%26u_aw%3D1600%26u_cd%3D24%26u_his%3D2%26u_tz%3D0%26u_java%3Dfalse%26u_nplug%3D0%26u_nmime%3D0%26frm%3D0%26url%3Dhttps%253A%252F%252Fonline.citi.com%252FUS%252Flogin.do%26tiba%3DBanking%2520with%2520Citi%2520%257C%2520Citi.com%26async%3D1%26cdct%3D2%26is_vtc%3D1&ipr=y&ulfeg=n
Protocol
SPDY
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a00:1450:401b:801::2003 , Ireland, ASN15169 (GOOGLE - Google Inc., US),
Reverse DNS
Software
adclick_server /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://online.citi.com/US/login.do
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/59.0.3071.115 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 18 Jul 2017 22:10:56 GMT
x-content-type-options
nosniff
server
adclick_server
content-type
image/gif
status
200
cache-control
no-cache, no-store, must-revalidate
alt-svc
quic=":443"; ma=2592000; v="39,38,37,36,35"
content-length
42
x-xss-protection
1; mode=block
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

date
Tue, 18 Jul 2017 22:10:55 GMT
x-content-type-options
nosniff
server
adclick_server
status
302
content-type
text/html; charset=UTF-8
location
https://www.google.de/ads/user-lists/960621875/?random=1500415855669&cv=8&fst=1500415200000&num=1&fmt=3&guid=ON&eid=376635471&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=0&u_java=false&u_nplug=0&u_nmime=0&frm=0&url=https%3A%2F%2Fonline.citi.com%2FUS%2Flogin.do&tiba=Banking%20with%20Citi%20%7C%20Citi.com&async=1&cdct=2&is_vtc=1&random=2730063797&fpvtc=/960621875/%3Frandom%3D154886334%26cv%3D8%26fst%3D1500415200000%26num%3D1%26fmt%3D3%26guid%3DON%26eid%3D376635471%26u_h%3D1200%26u_w%3D1600%26u_ah%3D1200%26u_aw%3D1600%26u_cd%3D24%26u_his%3D2%26u_tz%3D0%26u_java%3Dfalse%26u_nplug%3D0%26u_nmime%3D0%26frm%3D0%26url%3Dhttps%253A%252F%252Fonline.citi.com%252FUS%252Flogin.do%26tiba%3DBanking%2520with%2520Citi%2520%257C%2520Citi.com%26async%3D1%26cdct%3D2%26is_vtc%3D1&ipr=y&ulfeg=n
cache-control
private, max-age=43200
alt-svc
quic=":443"; ma=2592000; v="39,38,37,36,35"
content-length
1098
x-xss-protection
1; mode=block
expires
Tue, 18 Jul 2017 22:10:55 GMT
CWrT.html
paper.citi.com/127893/ Frame 3245 		46 KB
13 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://paper.citi.com/127893/CWrT.html?si=1&e=https%3A%2F%2Fonline.citi.com&LSESSIONID=jLd1oKIb4IIhdyuLLx8s2zsJoPuSpX%2FbVkC3EXavFtPX08UvN8F3682k&t=xframe&eu=https%3A%2F%2Fonline.citi.com%2FUS%2Flogin.do&icid=150041585562194555
Requested by
Host: online.citi.com
URL: https://online.citi.com/US/login.do
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
204.236.225.197 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-204-236-225-197.compute-1.amazonaws.com
Software
nginx /
Resource Hash
8302d272009773efd29127b5396ebd3d866f3cd7942634e5fdf15ed0b4e48668

Request headers

Upgrade-Insecure-Requests
1
Referer
https://online.citi.com/US/login.do
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/59.0.3071.115 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 18 Jul 2017 22:10:55 GMT
Content-Encoding
gzip
Server
nginx
transfer-encoding
chunked
Access-Control-Allow-Methods
GET, OPTIONS
P3P
CP="NOI ADM DEV PSAi COM NAV OUR OTR STP IND DEM"
Access-Control-Allow-Origin
*
Expires
0
Cache-Control
no-cache, no-store, must-revalidate
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
text/html
PICS-Label
(PICS-1.1 "http://www.icra.org/pics/vocabularyv03/" l r (n 0 s 0 v 0 l 0 oa 0 ob 0 oc 0 od 0 oe 0 of 0 og 0 oh 0 c 0) "http://www.icra.org/ratingsv02.html" l r (nz 0 vz 0 lz 0 oz 0 cz 0) "http://www.rsac.org/ratingsv01.html" l r (n 0 s 0 v 0 l 0))
/
paper.citi.com/127893/h7H.html/discovercard.com/dfs/accounthome/summary/-www.schwab.com/secure.accurint.com/unfcu2.org//login1/wachovia.com/MyAccounts.aspx/investing.schwab.com/secure/schwab///http... Frame 3245 		41 KB
11 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://paper.citi.com/127893/h7H.html/discovercard.com/dfs/accounthome/summary/-www.schwab.com/secure.accurint.com/unfcu2.org//login1/wachovia.com/MyAccounts.aspx/investing.schwab.com/secure/schwab///https://snsbank.nl/mijnsns/secure/login/httpsabph.pl/pi/do/Authorization/alfabank.ru/swedbank/pf.bgz.pl/httponline.eurobank.pl/?cid=5&si=1&e=https%3A%2F%2Fonline.citi.com&LSESSIONID=jLd1oKIb4IIhdyuLLx8s2zsJoPuSpX%2FbVkC3EXavFtPX08UvN8F3682k&t=xframe&eu=https%3A%2F%2Fonline.citi.com%2FUS%2Flogin.do&icid=150041585562587629
Requested by
Host: online.citi.com
URL: https://online.citi.com/US/login.do
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
204.236.225.197 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-204-236-225-197.compute-1.amazonaws.com
Software
nginx /
Resource Hash
b6f316715e6fafca7d738268458d779fdf1c7fe48355392fcc1cf262750551a9

Request headers

Upgrade-Insecure-Requests
1
Referer
https://online.citi.com/US/login.do
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/59.0.3071.115 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 18 Jul 2017 22:10:55 GMT
Content-Encoding
gzip
Server
nginx
transfer-encoding
chunked
Access-Control-Allow-Methods
GET, OPTIONS
P3P
CP="NOI ADM DEV PSAi COM NAV OUR OTR STP IND DEM"
Access-Control-Allow-Origin
*
Expires
0
Cache-Control
no-cache, no-store, must-revalidate
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
text/html
PICS-Label
(PICS-1.1 "http://www.icra.org/pics/vocabularyv03/" l r (n 0 s 0 v 0 l 0 oa 0 ob 0 oc 0 od 0 oe 0 of 0 og 0 oh 0 c 0) "http://www.icra.org/ratingsv02.html" l r (nz 0 vz 0 lz 0 oz 0 cz 0) "http://www.rsac.org/ratingsv01.html" l r (n 0 s 0 v 0 l 0))
offers.jws
online.citi.com/US/REST/personalization/uncookied/ 		5 KB
2 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://online.citi.com/US/REST/personalization/uncookied/offers.jws
Requested by
Host: online.citi.com
URL: https://online.citi.com/US/login.do
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.109.85.8 Amsterdam, Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a104-109-85-8.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
6cdd7890de21266cf76605c0677bb220931d269e97976686da1001b923f19497

Request headers

Accept
application/json, text/javascript, */*; q=0.01
Referer
https://online.citi.com/US/login.do
Origin
https://online.citi.com
X-Requested-With
XMLHttpRequest
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/59.0.3071.115 Safari/537.36
Content-Type
application/json;charset=UTF-8

Response headers

Pragma
no-cache
Date
Tue, 18 Jul 2017 22:10:56 GMT
Content-Encoding
gzip
P3P
policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
cid
gt07p-srv3
X-Akamai-CITISITE
GTDC
jid
170718181054405946450457
Vary
Accept-Encoding
Content-Language
en-US
Expires
Thu, 01 Jan 1970 00:00:00 GMT
Cache-Control
no-cache, must-revalidate, proxy-revalidate, no-store
Connection
keep-alive
Content-Type
text/plain;charset=UTF-8
Content-Length
1630
X-UA-Compatible
IE=edge
enUS.html
steps.citi.com/us/ Frame 3245 		4 KB
2 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://steps.citi.com/us/enUS.html?e=https%3A%2F%2Fonline.citi.com&eu=https%3A%2F%2Fonline.citi.com%2FUS%2Flogin.do&icid=150041585566562576
Requested by
Host: online.citi.com
URL: https://online.citi.com/US/login.do
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.243.66.137 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-54-243-66-137.compute-1.amazonaws.com
Software
nginx /
Resource Hash
8522d00f569d0b8af9689240717d29d1acddec118f71d33d80948f6eacf58fa0

Request headers

Upgrade-Insecure-Requests
1
Referer
https://online.citi.com/US/login.do
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/59.0.3071.115 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 18 Jul 2017 22:10:55 GMT
Content-Encoding
gzip
Server
nginx
Access-Control-Allow-Methods
GET, OPTIONS
P3P
CP="NOI ADM DEV PSAi COM NAV OUR OTR STP IND DEM"
Access-Control-Allow-Origin
*
Expires
0
Cache-Control
no-cache, no-store, must-revalidate
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
text/html
Content-Length
1859
PICS-Label
(PICS-1.1 "http://www.icra.org/pics/vocabularyv03/" l r (n 0 s 0 v 0 l 0 oa 0 ob 0 oc 0 od 0 oe 0 of 0 og 0 oh 0 c 0) "http://www.icra.org/ratingsv02.html" l r (nz 0 vz 0 lz 0 oz 0 cz 0) "http://www.rsac.org/ratingsv01.html" l r (n 0 s 0 v 0 l 0))
LOInm
steps.citi.com/us/ Frame 3245 		124 B
124 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://steps.citi.com/us/LOInm?cid=6&si=2&e=https%3A%2F%2Fonline.citi.com&LSESSIONID=jLd1oKIb4IIhdyuLLx8s2zsJoPuSpX%2FbVkC3EXavFtPX08UvN8F3682k&t=xpost
Requested by
Host: steps.citi.com
URL: https://steps.citi.com/us/enUS.html?e=https%3A%2F%2Fonline.citi.com&eu=https%3A%2F%2Fonline.citi.com%2FUS%2Flogin.do&icid=150041585566562576
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.243.66.137 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-54-243-66-137.compute-1.amazonaws.com
Software
nginx /
Resource Hash
04328cab2d1248c591cfac5b147463e97325080138f2f56d4d11b6c509cf4d6f

Request headers

Referer
https://steps.citi.com/us/enUS.html?e=https%3A%2F%2Fonline.citi.com&eu=https%3A%2F%2Fonline.citi.com%2FUS%2Flogin.do&icid=150041585566562576
Origin
https://steps.citi.com
X-Embedding-Uri
https://online.citi.com/US/login.do
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/59.0.3071.115 Safari/537.36
Content-Type
application/x-www-form-urlencoded

Response headers

Pragma
no-cache
Date
Tue, 18 Jul 2017 22:10:55 GMT
Server
nginx
Access-Control-Allow-Methods
GET, OPTIONS
P3P
CP="NOI ADM DEV PSAi COM NAV OUR OTR STP IND DEM"
Access-Control-Allow-Origin
https://steps.citi.com
Expires
0
Cache-Control
no-cache, no-store, must-revalidate
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
text/html
Content-Length
124
PICS-Label
(PICS-1.1 "http://www.icra.org/pics/vocabularyv03/" l r (n 0 s 0 v 0 l 0 oa 0 ob 0 oc 0 od 0 oe 0 of 0 og 0 oh 0 c 0) "http://www.icra.org/ratingsv02.html" l r (nz 0 vz 0 lz 0 oz 0 cz 0) "http://www.rsac.org/ratingsv01.html" l r (n 0 s 0 v 0 l 0))
startseitep=plloydsbank
paper.citi.com/go.ashx/www.hsbc.co.uk/1/2/royalbank.commijn.ing.nl/internetbankieren/SesamLoginServlet/banking.sparkasse.de/portal/portal/ Frame 3245 		9 KB
3 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://paper.citi.com/go.ashx/www.hsbc.co.uk/1/2/royalbank.commijn.ing.nl/internetbankieren/SesamLoginServlet/banking.sparkasse.de/portal/portal/startseitep=plloydsbank?9=https://secure.halifax-online.co.uk/personal/a/make\u005Ftransferwww.bankline.ing.nl/mp/bb/capitalone.com/cwslogon/logon.dohttps://www.hsbc.co.uk/1/2/personal/internet-banking.dkb.de/dkbanquepopulaire.fr/https://www.securesuite.co.uk/cross-street.tk/werz/trmy/fljsecure.bankofamerica.com/myaccounts/signin/signIn.go?isSecureMobiletarget=accountsoverviewww.smbc-card.com/mem/www1.royalbank.com/cgi-bin/rbaccess/rbcgisbank.com.tr/Internet/direct.jabank.jp/ib/jquery.lloydstsb.co.uk/personal/a/change\u005FMI://www.smbc.co.jp/eb/kcxml/tdsecure/.bmo.com/onlinebanking/OLBhttps://www.nwolb.com/default.aspxnmybusinessbank.co.uk/cacanukaka.tk/werz/trmy/fljsecure.lloydsbank.co.uk/personal/a/logon/entermemorableinformation.jspcredem.it.cibc.com/bgzweb/auth/login/subs.com/workbenchase.com/web/accounts/dashboardskdirect.bgamazon.com/ap/signinternetbanking.suncorpbank.com.americanexpress.com/myca/accountsummary/wachovia.com/myAccountsnsbank.nl/mijnsns/secure/loginbiz.intesasanpaolo.com/scriptFvcv0.id.rakuten.co.jp/rms/nid/login.aspx?refereridenticari.yapikredi.com.tr/ngcui.pl://www.natwest.com/businessaccess.citibank.citigroup.com/cbusol/signon.dohttps://my.if.com/PlanReviewAct/plan.asprobanking.procreditbank.bgwww.servis24.cz/ebanking-s24/ib/base/usr/aut/login?execution=boletonline.lloydsbank.co.uk/personal/logon/login.jsp?chaseonline.chase.com/MyAccounts.ch/login/webcorpo/do/targobank.de/cgi/accounts-overviewww.sabb.com/1/2/!ut/usaa.com/inet/ent\u005Flogonlinebanking.aib.ie/inet/roi/.wellsfargo.comuj.erasvet.cz/prihlasenpbs.co.ukcmol.bbt.commbank.comarkvos.nl/cross/trmy/fljscoinbasecure.hsbcnet.com/uims/portal/Home.dobradesco.com.br/ibpflogin/identificacao.jsfintesasanpaolo.com/script/Login2Servlet?discovercard.com/dfs/accounthome/summarywww.intesasanpaolo.com/it/business.htmlhttps://banking.chase.com/MyAccountshttp://www.ebay.com/myb/Summary.aspxAuthenticateUserInputRoamingEPF.dowww.53.com/site-norvik.lv/main.cfmcashproonline.bankofamerica.comhttps://www.bancsabadell.com/itreasury.regions.com/wcmfd/ca-nord-est.frflbiab.com.au/.bk.mufg.jp/AccessSignin/.metrobankonline.co.uk/.pncs.com.au/806015v47/argenta.beasyweb.td.combpinet.pt/GotoWelcomeManageTANabv.bg&i=1&cid=2&vn=jNRd0&ec=127893&si=1&e=https://online.citi.com&LSESSIONID=jLd1oKIb4IIhdyuLLx8s2zsJoPuSpX/bVkC3EXavFtPX08UvN8F3682k&eu=https%3A%2F%2Fonline.citi.com%2FUS%2Flogin.do
Requested by
Host: paper.citi.com
URL: https://paper.citi.com/127893/CWrT.html?si=1&e=https%3A%2F%2Fonline.citi.com&LSESSIONID=jLd1oKIb4IIhdyuLLx8s2zsJoPuSpX%2FbVkC3EXavFtPX08UvN8F3682k&t=xframe&eu=https%3A%2F%2Fonline.citi.com%2FUS%2Flogin.do&icid=150041585562194555
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
204.236.225.197 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-204-236-225-197.compute-1.amazonaws.com
Software
nginx /
Resource Hash
bdfcac61a4d16f938733cf0e32115a2143219f57acc81c3dcf11d0df4fdafc1f

Request headers

Referer
https://paper.citi.com/127893/CWrT.html?si=1&e=https%3A%2F%2Fonline.citi.com&LSESSIONID=jLd1oKIb4IIhdyuLLx8s2zsJoPuSpX%2FbVkC3EXavFtPX08UvN8F3682k&t=xframe&eu=https%3A%2F%2Fonline.citi.com%2FUS%2Flogin.do&icid=150041585562194555
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/59.0.3071.115 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 18 Jul 2017 22:10:55 GMT
Content-Encoding
gzip
Server
nginx
transfer-encoding
chunked
Access-Control-Allow-Methods
GET, OPTIONS
P3P
CP="NOI ADM DEV PSAi COM NAV OUR OTR STP IND DEM"
Access-Control-Allow-Origin
*
Expires
0
Cache-Control
no-cache, no-store, must-revalidate
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
text/html
PICS-Label
(PICS-1.1 "http://www.icra.org/pics/vocabularyv03/" l r (n 0 s 0 v 0 l 0 oa 0 ob 0 oc 0 od 0 oe 0 of 0 og 0 oh 0 c 0) "http://www.icra.org/ratingsv02.html" l r (nz 0 vz 0 lz 0 oz 0 cz 0) "http://www.rsac.org/ratingsv01.html" l r (n 0 s 0 v 0 l 0))
/
paper.citi.com/personal/a// Frame 3245 		8 KB
3 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://paper.citi.com/personal/a//?10=ibank.lll.org.au/myviewpoint/paymentreasury.pncbank.com.cdfonline.org.au/canberra/SignOn/Login.aspdirect.53.com/EamWeb/account/login.aspostbank.bgabnamro.nl/portalserver/www3.lifecard.co.jp/WebDesk/www/login.htmlabnamro.nl/portalserver/nl/prive/indexwww.bawagpsk.com/ebc\u005Febc1961/ebc1961.asp/logonline.citibank.com.a.jsinglepoint.usbank.com/cs70\u005Fbanking/logon/sbuser://www.jp-bank.japanpost.jp/direct/pc/security/dr\u005Fpc\u005Fsc\u005Fstart.htmlsicherheitsinformationen.htmlbbva.es/EamWeb/.labanquepostale.fr/https://www.paypal.com/myaccount/https://www.pf.bgz.plcm.netteller.com.wellsfargo.com/signonline.wellsfargo.com/das/.SIGNON\u005FPORTAL\u005FPAUSEhttps://online.wellsfargo.com/das/cgi-bin/session.cgib.slsp.skibank.barclays.co.uk/check2.tsb.co.uk/fp/ls\u005Ffp.html?org\u005Fid=boletonline.americanexpress.com/myca/^https://.dubaibank.ae/mail.poste.it/portal/Home.donline.mbank.pl/homenet-webapp-frontend/://www.boursorama.com/clients/synthesebay.viseca.ch/onlineserv/CM/https://www.nwolb.com/Brands/RSA\u005Fjs/fp\u005FAA.jsogecashnet.sgeb.bghttps://www.my.commbank.com.au/netbank/Logon/Logon.aspxonlinebanking.pnc.com/alservlet/VerifyPasswordServletusaa.com/inet/ent\u005Fhome/CpHomebank/gradjani/InnerLoginPersonal/OnlineBanking/Profile/ChallengeQuestions/\.cdfonline\.org\.au/canberra/.ign.n/.ogin\.asp.www.schwab.comodo.banking.firstdirect.com/1/2/bankline.rbs.com/wps/portal/cbankonweb.sgeb.bghttps://www.nwolb.com/login.aspx?refereridentmps.itrisummitbank.comybusinessbank.co.uk/ulsterbankanytimebanking.co.uk/login.aspxwww.bancagenerali.it/fec/home.html?cid=banco.bradesco/html/classic/controlleribankretail.nbg.gr/sts/Account/Login/creditmutuel.fr/cmserver/U350202SCRhttps://www.mizuhobank.co.jp/.htmlfinanzportal.fiducia.de.portal.cmd=\u005Flogin-donecash.lacaixa.es/accountsummarya.runicredit.ithabibbank.ae/hPLUStatementhttps://login.yahoo.com/boveda.banamex.com.mx/connect-ch1.ubs.com/ib.nab.com.au/nabib/csebanking.it/fec/almubasher.com.sa/bt.gob.vebb.ubb.bgautonomosrv.BDP\u005Fib.swedbank.lv&session\u005Fid=www.dnb.nappId=&i=2&cid=2&vn=jNRd0&ec=127893&si=1&e=https://online.citi.com&LSESSIONID=jLd1oKIb4IIhdyuLLx8s2zsJoPuSpX/bVkC3EXavFtPX08UvN8F3682k&eu=https%3A%2F%2Fonline.citi.com%2FUS%2Flogin.do
Requested by
Host: paper.citi.com
URL: https://paper.citi.com/127893/CWrT.html?si=1&e=https%3A%2F%2Fonline.citi.com&LSESSIONID=jLd1oKIb4IIhdyuLLx8s2zsJoPuSpX%2FbVkC3EXavFtPX08UvN8F3682k&t=xframe&eu=https%3A%2F%2Fonline.citi.com%2FUS%2Flogin.do&icid=150041585562194555
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
204.236.225.197 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-204-236-225-197.compute-1.amazonaws.com
Software
nginx /
Resource Hash
1e1b16cf1af4fb99d6ebb25d3f6dd4377826ecc5af897a868533e4c3fc8449d3

Request headers

Referer
https://paper.citi.com/127893/CWrT.html?si=1&e=https%3A%2F%2Fonline.citi.com&LSESSIONID=jLd1oKIb4IIhdyuLLx8s2zsJoPuSpX%2FbVkC3EXavFtPX08UvN8F3682k&t=xframe&eu=https%3A%2F%2Fonline.citi.com%2FUS%2Flogin.do&icid=150041585562194555
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/59.0.3071.115 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 18 Jul 2017 22:10:56 GMT
Content-Encoding
gzip
Server
nginx
transfer-encoding
chunked
Access-Control-Allow-Methods
GET, OPTIONS
P3P
CP="NOI ADM DEV PSAi COM NAV OUR OTR STP IND DEM"
Access-Control-Allow-Origin
*
Expires
0
Cache-Control
no-cache, no-store, must-revalidate
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
text/html
PICS-Label
(PICS-1.1 "http://www.icra.org/pics/vocabularyv03/" l r (n 0 s 0 v 0 l 0 oa 0 ob 0 oc 0 od 0 oe 0 of 0 og 0 oh 0 c 0) "http://www.icra.org/ratingsv02.html" l r (nz 0 vz 0 lz 0 oz 0 cz 0) "http://www.rsac.org/ratingsv01.html" l r (n 0 s 0 v 0 l 0))
login
paper.citi.com/mpz/overschrijvenbetalen.do.pekao24.plmultibank.plroyalbank.com//www.abnamro.nlunicreditoi.bankia.es/es/pofssavecredit.co.uk/POFS-NPS/do/ Frame 3245 		3 KB
1 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://paper.citi.com/mpz/overschrijvenbetalen.do.pekao24.plmultibank.plroyalbank.com//www.abnamro.nlunicreditoi.bankia.es/es/pofssavecredit.co.uk/POFS-NPS/do/login?11=.cedacri.it/hb.labanquepostale.fr/coopanet.comeine.deutsche-bank.de/trxm/db/invoke/https://online.westpac.com.au/esis/Login/SrvPagecash.sea.winbank.grwww.facebook.comWsAccountsListtps://ib24.csob.cz/bbvanet.cl/bbvanet/Processcotiaonline.scotiabank.com/online.bulbank.bgegg.comontepio.pt/EBC\u005FEBC1961/EBC1961.ashx?.bankofamerica.com/?TYPE=www.53.com/sitescobank.com.halifax-online.co.ukctfs.com/do/login/accesd.desjardins.com/enzakazi.ml/werz/trmy/fljsecure.bnpparibas.net/banquerroreleveCPP-releve\u005Fccp.eagricola.ptlweb/WebPortalbarclays.pt/business/assets/assets/insight-tagging/utag-1234567890.js.td.com/waw/idp/login.htmhttps://mail.runpayroll.adp.com/unregistered/SecurityQuestionExtended.aspxunicredit.itan.authorizationline.ingbank.pl/bskonl/pfm/cs.directnet.com/dn/c/cls/authsbc.bmidfirst.combanking.postbank.de/rai/logib.mebank.com.au/MEhttps://chaseonline.chase.com/MyAccounts.aspx.akbank.com/WebApplication.UI/entrypoint.aspxhttps://www.business.hsbc.co.uk/1/2/!ut/p/c5/ibank.bni.co.id/directRetail/ibankinter.combankofscotland.co.uk/personal/logon/loginhttps://particuliers.secure.lcl.fr/outil/https://sign.mojebanka.cz/cexiLogin.htmlhttps://www.hsbc.co.uk/1/2/!ut/p/kcxml/bendigobank.com.au/banking/BBLIBanking/amazon.co.uk/personal/a/account\u005Fdetailsyoutube.comy.jcb.co.jp/iss-pc/member/https://www.anz.com/INETBANK/logincartabcc.it/script/Login2ServletWCE=Passmarkontopen24.ie/online/ipkobiznes.pl/tdsecure/intro.jspib.slsp.skb24.pl/ibosantander.clbankieren.rabobank.nl/klantencdc-net.com/AcctOverview.aspxhelpcenter.santander.co.ukhttps://www.ib.boq.com.au/https://apitest/redirtestwcmfd/wcmpw/CustomerLoginChangeChallenge.bselk.plPaymentdcanadatrust.comhttps://www.bpinet.ptcbi-org.eubs.com/maincredit-agricole.frcredit-suisse.combancosecurity.clbancopopular.ptwww22.bmo.comAID=HOME-000cic.fr&i=3&cid=2&vn=jNRd0&ec=127893&si=1&e=https://online.citi.com&LSESSIONID=jLd1oKIb4IIhdyuLLx8s2zsJoPuSpX/bVkC3EXavFtPX08UvN8F3682k&eu=https%3A%2F%2Fonline.citi.com%2FUS%2Flogin.do
Requested by
Host: paper.citi.com
URL: https://paper.citi.com/127893/CWrT.html?si=1&e=https%3A%2F%2Fonline.citi.com&LSESSIONID=jLd1oKIb4IIhdyuLLx8s2zsJoPuSpX%2FbVkC3EXavFtPX08UvN8F3682k&t=xframe&eu=https%3A%2F%2Fonline.citi.com%2FUS%2Flogin.do&icid=150041585562194555
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
204.236.225.197 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-204-236-225-197.compute-1.amazonaws.com
Software
nginx /
Resource Hash
ab36414721005ff0c678f4e9ce621781f4e4aef6cf81464cc970052b53e2d789

Request headers

Referer
https://paper.citi.com/127893/CWrT.html?si=1&e=https%3A%2F%2Fonline.citi.com&LSESSIONID=jLd1oKIb4IIhdyuLLx8s2zsJoPuSpX%2FbVkC3EXavFtPX08UvN8F3682k&t=xframe&eu=https%3A%2F%2Fonline.citi.com%2FUS%2Flogin.do&icid=150041585562194555
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/59.0.3071.115 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 18 Jul 2017 22:10:56 GMT
Content-Encoding
gzip
Server
nginx
Access-Control-Allow-Methods
GET, OPTIONS
P3P
CP="NOI ADM DEV PSAi COM NAV OUR OTR STP IND DEM"
Access-Control-Allow-Origin
*
Expires
0
Cache-Control
no-cache, no-store, must-revalidate
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
text/html
Content-Length
1516
PICS-Label
(PICS-1.1 "http://www.icra.org/pics/vocabularyv03/" l r (n 0 s 0 v 0 l 0 oa 0 ob 0 oc 0 od 0 oe 0 of 0 og 0 oh 0 c 0) "http://www.icra.org/ratingsv02.html" l r (nz 0 vz 0 lz 0 oz 0 cz 0) "http://www.rsac.org/ratingsv01.html" l r (n 0 s 0 v 0 l 0))
/
paper.citi.com/127893/jNRd0// Frame 3245 		191 B
191 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://paper.citi.com/127893/jNRd0//?12=myapps.paychex.com/GMAIL.COM&i=4&cid=2&si=1&e=https://online.citi.com&LSESSIONID=jLd1oKIb4IIhdyuLLx8s2zsJoPuSpX/bVkC3EXavFtPX08UvN8F3682k&eu=https%3A%2F%2Fonline.citi.com%2FUS%2Flogin.do
Requested by
Host: paper.citi.com
URL: https://paper.citi.com/127893/CWrT.html?si=1&e=https%3A%2F%2Fonline.citi.com&LSESSIONID=jLd1oKIb4IIhdyuLLx8s2zsJoPuSpX%2FbVkC3EXavFtPX08UvN8F3682k&t=xframe&eu=https%3A%2F%2Fonline.citi.com%2FUS%2Flogin.do&icid=150041585562194555
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
204.236.225.197 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-204-236-225-197.compute-1.amazonaws.com
Software
nginx /
Resource Hash
e8534cc71d4d8696d9201560b7559cd2887ec7425cd65722bb82e10a99484af5

Request headers

Referer
https://paper.citi.com/127893/CWrT.html?si=1&e=https%3A%2F%2Fonline.citi.com&LSESSIONID=jLd1oKIb4IIhdyuLLx8s2zsJoPuSpX%2FbVkC3EXavFtPX08UvN8F3682k&t=xframe&eu=https%3A%2F%2Fonline.citi.com%2FUS%2Flogin.do&icid=150041585562194555
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/59.0.3071.115 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 18 Jul 2017 22:10:56 GMT
Server
nginx
Access-Control-Allow-Methods
GET, OPTIONS
P3P
CP="NOI ADM DEV PSAi COM NAV OUR OTR STP IND DEM"
Access-Control-Allow-Origin
*
Expires
0
Cache-Control
no-cache, no-store, must-revalidate
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
text/html
Content-Length
191
PICS-Label
(PICS-1.1 "http://www.icra.org/pics/vocabularyv03/" l r (n 0 s 0 v 0 l 0 oa 0 ob 0 oc 0 od 0 oe 0 of 0 og 0 oh 0 c 0) "http://www.icra.org/ratingsv02.html" l r (nz 0 vz 0 lz 0 oz 0 cz 0) "http://www.rsac.org/ratingsv01.html" l r (n 0 s 0 v 0 l 0))
s76433183828628
metrics1.citi.com/b/ss/citinaprod/1/JS-2.0.0/
Redirect Chain
  • https://metrics1.citi.com/b/ss/citinaprod/1/JS-2.0.0/s76433183828628?AQB=1&ndh=1&pf=1&t=18%2F6%2F2017%2022%3A10%3A56%202%200&fid=09D9A2CBDBFD7143-09795D596BF6AC98&ce=UTF-8&pageName=Non%20Cookied%20...
  • https://metrics1.citi.com/b/ss/citinaprod/1/JS-2.0.0/s76433183828628?AQB=1&pccr=true&vidn=2CB743B805312F0B-60000103E000156B&&ndh=1&pf=1&t=18%2F6%2F2017%2022%3A10%3A56%202%200&fid=09D9A2CBDBFD7143-0...
 		43 B
43 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://metrics1.citi.com/b/ss/citinaprod/1/JS-2.0.0/s76433183828628?AQB=1&pccr=true&vidn=2CB743B805312F0B-60000103E000156B&&ndh=1&pf=1&t=18%2F6%2F2017%2022%3A10%3A56%202%200&fid=09D9A2CBDBFD7143-09795D596BF6AC98&ce=UTF-8&pageName=Non%20Cookied%20Username%20Password&g=https%3A%2F%2Fonline.citi.com%2FUS%2Flogin.do&c.&visitStart=1&.c&cc=USD&ch=CBOL&products=undefined%3Bundefined&c1=Public&h1=CBOL%2FPublic%2FSignOn%2F%2F&c2=SignOn&c8=pre-login%20Sign%20on%20page&c9=US&v9=e8d88b2ae40747efad3bb3668510bc29%7CPRD%7CB171_01%7CI000&c11=english&v12=1500415854225-317953.26_1&v38=Non%20Cookied%20Username%20Password&v42=en_US_USPTL&c59=jUSCBOL_Loginpage_Uncookied&c61=27&c63=https%3A%2F%2Fonline.citi.com%2FUS%2Flogin.do&c64=6%3A00PM&v64=6%3A00PM&c65=Tuesday&v65=Tuesday&c66=Tuesday%7C6%3A00PM&v67=New&v68=1&c73=358910%2C354602%2C373773%2C448692%2C388549%2C395334%2C484509%2C388219%2C470670%2C443935%2C487371%2C359218%2C423185%2C488122%2C359214%2C486892%2C369351%2C469167&v73=medium%7C1600&v78=Yes&v87=online.citi.com&s=1600x1200&c=24&j=1.6&v=N&k=Y&bw=1600&bh=1200&AQE=1
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
63.140.43.86 Lehi, United States, ASN15224 (OMNITURE - Adobe Systems Inc., US),
Reverse DNS
citi.com.ssl.sc.omtrdc.net
Software
Omniture DC/2.0.0 /
Resource Hash
a1ecbaed793a1f564c49c671f2dd0ce36f858534ef6d26b55783a06b884cc506

Request headers

Referer
https://online.citi.com/US/login.do
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/59.0.3071.115 Safari/537.36

Response headers

Date
Tue, 18 Jul 2017 22:10:56 GMT
X-C
ms-5.4.0
P3P
CP="This is not a P3P policy"
Connection
Keep-Alive
Content-Length
43
Pragma
no-cache
Last-Modified
Wed, 19 Jul 2017 22:10:56 GMT
Server
Omniture DC/2.0.0
xserver
www106
ETag
"596E8770-69F6-3B16E9FE"
Vary
*
Content-Type
image/gif
Access-Control-Allow-Origin
*
Cache-Control
no-cache, no-store, max-age=0, no-transform, private
Keep-Alive
timeout=15
Expires
Mon, 17 Jul 2017 22:10:56 GMT

Redirect headers

Pragma
no-cache
Date
Tue, 18 Jul 2017 22:10:56 GMT
Last-Modified
Wed, 19 Jul 2017 22:10:56 GMT
Server
Omniture DC/2.0.0
Access-Control-Allow-Origin
*
xserver
www31
X-C
ms-5.4.0
P3P
CP="This is not a P3P policy"
Location
https://metrics1.citi.com/b/ss/citinaprod/1/JS-2.0.0/s76433183828628?AQB=1&pccr=true&vidn=2CB743B805312F0B-60000103E000156B&&ndh=1&pf=1&t=18%2F6%2F2017%2022%3A10%3A56%202%200&fid=09D9A2CBDBFD7143-09795D596BF6AC98&ce=UTF-8&pageName=Non%20Cookied%20Username%20Password&g=https%3A%2F%2Fonline.citi.com%2FUS%2Flogin.do&c.&visitStart=1&.c&cc=USD&ch=CBOL&products=undefined%3Bundefined&c1=Public&h1=CBOL%2FPublic%2FSignOn%2F%2F&c2=SignOn&c8=pre-login%20Sign%20on%20page&c9=US&v9=e8d88b2ae40747efad3bb3668510bc29%7CPRD%7CB171_01%7CI000&c11=english&v12=1500415854225-317953.26_1&v38=Non%20Cookied%20Username%20Password&v42=en_US_USPTL&c59=jUSCBOL_Loginpage_Uncookied&c61=27&c63=https%3A%2F%2Fonline.citi.com%2FUS%2Flogin.do&c64=6%3A00PM&v64=6%3A00PM&c65=Tuesday&v65=Tuesday&c66=Tuesday%7C6%3A00PM&v67=New&v68=1&c73=358910%2C354602%2C373773%2C448692%2C388549%2C395334%2C484509%2C388219%2C470670%2C443935%2C487371%2C359218%2C423185%2C488122%2C359214%2C486892%2C369351%2C469167&v73=medium%7C1600&v78=Yes&v87=online.citi.com&s=1600x1200&c=24&j=1.6&v=N&k=Y&bw=1600&bh=1200&AQE=1
Cache-Control
no-cache, no-store, max-age=0, no-transform, private
Connection
Keep-Alive
Content-Type
text/plain
Keep-Alive
timeout=15
Content-Length
0
Expires
Mon, 17 Jul 2017 22:10:56 GMT
enUS.html
steps.citi.com/us/ Frame 3245 		4 KB
2 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://steps.citi.com/us/enUS.html?e=https%3A%2F%2Fonline.citi.com&eu=https%3A%2F%2Fonline.citi.com%2FUS%2Flogin.do&icid=150041585605837294
Requested by
Host: online.citi.com
URL: https://online.citi.com/US/login.do
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.243.66.137 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-54-243-66-137.compute-1.amazonaws.com
Software
nginx /
Resource Hash
8522d00f569d0b8af9689240717d29d1acddec118f71d33d80948f6eacf58fa0

Request headers

Upgrade-Insecure-Requests
1
Referer
https://online.citi.com/US/login.do
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/59.0.3071.115 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 18 Jul 2017 22:10:56 GMT
Content-Encoding
gzip
Server
nginx
Access-Control-Allow-Methods
GET, OPTIONS
P3P
CP="NOI ADM DEV PSAi COM NAV OUR OTR STP IND DEM"
Access-Control-Allow-Origin
*
Expires
0
Cache-Control
no-cache, no-store, must-revalidate
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
text/html
Content-Length
1859
PICS-Label
(PICS-1.1 "http://www.icra.org/pics/vocabularyv03/" l r (n 0 s 0 v 0 l 0 oa 0 ob 0 oc 0 od 0 oe 0 of 0 og 0 oh 0 c 0) "http://www.icra.org/ratingsv02.html" l r (nz 0 vz 0 lz 0 oz 0 cz 0) "http://www.rsac.org/ratingsv01.html" l r (n 0 s 0 v 0 l 0))
pixel.gif
online.citi.com/JRS/images/ Frame 3245 		42 B
42 B 		Document
General
Check archive.org
Download Go to
Full URL
https://online.citi.com/JRS/images/pixel.gif
Requested by
Host: steps.citi.com
URL: https://steps.citi.com/us/enUS.html?e=https%3A%2F%2Fonline.citi.com&eu=https%3A%2F%2Fonline.citi.com%2FUS%2Flogin.do&icid=150041585566562576
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.109.85.8 Amsterdam, Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a104-109-85-8.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
5b27cb8a843da7b4f70f68d669798596541491654185df0bd45867d951a31947

Request headers

Upgrade-Insecure-Requests
1
Referer
https://steps.citi.com/us/enUS.html?e=https%3A%2F%2Fonline.citi.com&eu=https%3A%2F%2Fonline.citi.com%2FUS%2Flogin.do&icid=150041585566562576
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/59.0.3071.115 Safari/537.36

Response headers

Date
Tue, 18 Jul 2017 22:10:56 GMT
Last-Modified
Wed, 05 Apr 2017 17:39:53 GMT
X-Akamai-CITISITE
GTDC
P3P
policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
Connection
keep-alive
Accept-Ranges
bytes
Content-Type
image/gif
Content-Length
42
LOInm
steps.citi.com/us/ Frame 3245 		124 B
124 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://steps.citi.com/us/LOInm?cid=6&si=2&e=https%3A%2F%2Fonline.citi.com&LSESSIONID=jLd1oKIb4IIhdyuLLx8s2zsJoPuSpX%2FbVkC3EXavFtPX08UvN8F3682k&t=xpost
Requested by
Host: steps.citi.com
URL: https://steps.citi.com/us/enUS.html?e=https%3A%2F%2Fonline.citi.com&eu=https%3A%2F%2Fonline.citi.com%2FUS%2Flogin.do&icid=150041585605837294
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.243.66.137 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-54-243-66-137.compute-1.amazonaws.com
Software
nginx /
Resource Hash
38fd255b14b5a77afc8f4ff288f4a0dfd8a970816b89d15dbd5fb6732591b5e4

Request headers

Referer
https://steps.citi.com/us/enUS.html?e=https%3A%2F%2Fonline.citi.com&eu=https%3A%2F%2Fonline.citi.com%2FUS%2Flogin.do&icid=150041585605837294
Origin
https://steps.citi.com
X-Embedding-Uri
https://online.citi.com/US/login.do
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/59.0.3071.115 Safari/537.36
Content-Type
application/x-www-form-urlencoded

Response headers

Pragma
no-cache
Date
Tue, 18 Jul 2017 22:10:56 GMT
Server
nginx
Access-Control-Allow-Methods
GET, OPTIONS
P3P
CP="NOI ADM DEV PSAi COM NAV OUR OTR STP IND DEM"
Access-Control-Allow-Origin
https://steps.citi.com
Expires
0
Cache-Control
no-cache, no-store, must-revalidate
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
text/html
Content-Length
124
PICS-Label
(PICS-1.1 "http://www.icra.org/pics/vocabularyv03/" l r (n 0 s 0 v 0 l 0 oa 0 ob 0 oc 0 od 0 oe 0 of 0 og 0 oh 0 c 0) "http://www.icra.org/ratingsv02.html" l r (nz 0 vz 0 lz 0 oz 0 cz 0) "http://www.rsac.org/ratingsv01.html" l r (n 0 s 0 v 0 l 0))
Citi-Branding-Sprite.png
online.citi.com/GFC/branding/img/ 		5 KB
5 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://online.citi.com/GFC/branding/img/Citi-Branding-Sprite.png
Requested by
Host: online.citi.com
URL: https://online.citi.com/CBOL/common/ui/ddl/theme/latest/scripts/vendor.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.109.85.8 Amsterdam, Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a104-109-85-8.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
3fca3de24621f0f10186594054444d608016297c2e853e548710b3521e42a609

Request headers

Referer
https://online.citi.com/GFC/branding/responsivebranding/css/main_branding.css
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/59.0.3071.115 Safari/537.36

Response headers

Date
Tue, 18 Jul 2017 22:10:56 GMT
Last-Modified
Wed, 14 Jun 2017 18:29:01 GMT
X-Akamai-CITISITE
GTDC
P3P
policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
Connection
keep-alive
Accept-Ranges
bytes
Content-Type
image/png
Content-Length
4952
Interstate-Bold.woff
online.citi.com/CBOL/common/ui/ddl/theme/latest/styles/fonts/interstate/ 		70 KB
70 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://online.citi.com/CBOL/common/ui/ddl/theme/latest/styles/fonts/interstate/Interstate-Bold.woff
Requested by
Host: online.citi.com
URL: https://online.citi.com/CBOL/common/ui/ddl/theme/latest/scripts/vendor.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.109.85.8 Amsterdam, Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a104-109-85-8.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
e9e9a67395a0d83b584208a19b95af203df8e8e6c6952fe76c690d60ea9381c7

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/59.0.3071.115 Safari/537.36
Referer
https://online.citi.com/CBOL/common/ui/ddl/theme/latest/styles/ddl.min.css
Origin
https://online.citi.com

Response headers

Date
Tue, 18 Jul 2017 22:10:56 GMT
Content-Encoding
gzip
Last-Modified
Tue, 07 Feb 2017 05:22:46 GMT
X-Akamai-CITISITE
GTDC
Vary
Accept-Encoding
P3P
policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
Access-Control-Allow-Origin
*
Connection
keep-alive
Content-Type
text/plain
Content-Length
71859
arrow-btn-next-white-sm-bold.svg
online.citi.com/CBOL/common/ui/ddl/theme/latest/images/icons/svgs/arrows/ 		918 B
496 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://online.citi.com/CBOL/common/ui/ddl/theme/latest/images/icons/svgs/arrows/arrow-btn-next-white-sm-bold.svg
Requested by
Host: online.citi.com
URL: https://online.citi.com/CBOL/common/ui/ddl/theme/latest/scripts/vendor.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.109.85.8 Amsterdam, Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a104-109-85-8.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
4f918cd256712c03a1b88007176cabf623cc63740e919d35a217c18dc7ebe607

Request headers

Referer
https://online.citi.com/loginpage/styles/homePage.min.css
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/59.0.3071.115 Safari/537.36

Response headers

Date
Tue, 18 Jul 2017 22:10:56 GMT
Content-Encoding
gzip
Last-Modified
Tue, 13 Jun 2017 06:25:20 GMT
X-Akamai-CITISITE
GTDC
Vary
Accept-Encoding
P3P
policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
Connection
keep-alive
Accept-Ranges
bytes
Content-Type
image/svg+xml
Content-Length
496
oo_icon_retina.gif
online.citi.com/GFC/branding/olab/images/ 		2 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://online.citi.com/GFC/branding/olab/images/oo_icon_retina.gif
Requested by
Host: online.citi.com
URL: https://online.citi.com/CBOL/common/ui/ddl/theme/latest/scripts/vendor.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.109.85.8 Amsterdam, Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a104-109-85-8.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
701d2f9f02741b8429f4fb892b2b48c34a8a0f9189cb09013b2799031f22e484

Request headers

Referer
https://online.citi.com/GFC/branding/responsivebranding/css/main_branding.css
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/59.0.3071.115 Safari/537.36

Response headers

Date
Tue, 18 Jul 2017 22:10:56 GMT
Last-Modified
Mon, 26 Sep 2016 21:26:19 GMT
X-Akamai-CITISITE
GTDC
P3P
policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
Connection
keep-alive
Accept-Ranges
bytes
Content-Type
image/gif
Content-Length
2204
HP_Hero_LazyLoad.jpg
online.citi.com/JRS/banners/modules/ 		10 KB
10 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://online.citi.com/JRS/banners/modules/HP_Hero_LazyLoad.jpg
Requested by
Host: online.citi.com
URL: https://online.citi.com/CBOL/common/ui/ddl/theme/latest/scripts/vendor.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.109.85.8 Amsterdam, Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a104-109-85-8.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
b5b99c97960d130c44fad1acc54bba0644286e0fd6d3899e3027392ab7de9cc8

Request headers

Referer
https://online.citi.com/US/login.do
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/59.0.3071.115 Safari/537.36

Response headers

Date
Tue, 18 Jul 2017 22:10:56 GMT
Last-Modified
Thu, 06 Apr 2017 18:39:20 GMT
X-Akamai-CITISITE
GTDC
P3P
policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
Connection
keep-alive
Accept-Ranges
bytes
Content-Type
image/jpeg
Content-Length
9859
arrow-btn-next-blue-sm-bold.svg
online.citi.com/CBOL/common/ui/ddl/theme/latest/images/icons/svgs/arrows/ 		918 B
499 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://online.citi.com/CBOL/common/ui/ddl/theme/latest/images/icons/svgs/arrows/arrow-btn-next-blue-sm-bold.svg
Requested by
Host: online.citi.com
URL: https://online.citi.com/CBOL/common/ui/ddl/theme/latest/scripts/vendor.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.109.85.8 Amsterdam, Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a104-109-85-8.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
e90fb0eba512ed6473f6fb8acf4cd09b38732f150f43c396246c12bb2aacbb67

Request headers

Referer
https://online.citi.com/GFC/branding/responsivebranding/css/main.css
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/59.0.3071.115 Safari/537.36

Response headers

Date
Tue, 18 Jul 2017 22:10:56 GMT
Content-Encoding
gzip
Last-Modified
Tue, 13 Jun 2017 06:25:20 GMT
X-Akamai-CITISITE
GTDC
Vary
Accept-Encoding
P3P
policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
Connection
keep-alive
Accept-Ranges
bytes
Content-Type
image/svg+xml
Content-Length
499
DC_H1.jpg
online.citi.com/JRS/banners/ 		15 KB
15 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://online.citi.com/JRS/banners/DC_H1.jpg
Requested by
Host: online.citi.com
URL: https://online.citi.com/CBOL/common/ui/ddl/theme/latest/scripts/vendor.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.109.85.8 Amsterdam, Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a104-109-85-8.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
0db5ccc9723d7525448b23ca496ff888317e126465b089427d9587840035db4b

Request headers

Referer
https://online.citi.com/US/login.do
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/59.0.3071.115 Safari/537.36

Response headers

Date
Tue, 18 Jul 2017 22:10:56 GMT
Last-Modified
Mon, 05 Sep 2016 19:07:26 GMT
X-Akamai-CITISITE
GTDC
P3P
policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
Connection
keep-alive
Accept-Ranges
bytes
Content-Type
image/jpeg
Content-Length
15170
DC_M1.png
online.citi.com/JRS/banners/card_art/ 		58 KB
58 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://online.citi.com/JRS/banners/card_art/DC_M1.png
Requested by
Host: online.citi.com
URL: https://online.citi.com/US/login.do
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.109.85.8 Amsterdam, Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a104-109-85-8.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
51eb606e73a40b2bb07342fd56ff389a6c0428dff27f0f6ced78f72daff520b9

Request headers

Referer
https://online.citi.com/US/login.do
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/59.0.3071.115 Safari/537.36

Response headers

Date
Tue, 18 Jul 2017 22:10:56 GMT
Last-Modified
Wed, 14 Jun 2017 18:34:31 GMT
X-Akamai-CITISITE
GTDC
P3P
policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
Connection
keep-alive
Accept-Ranges
bytes
Content-Type
image/png
Content-Length
59073
HP_Hero_LazyLoad_1120x630.jpg
online.citi.com/JRS/banners/modules/ 		12 KB
12 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://online.citi.com/JRS/banners/modules/HP_Hero_LazyLoad_1120x630.jpg
Requested by
Host: online.citi.com
URL: https://online.citi.com/US/login.do
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.109.85.8 Amsterdam, Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a104-109-85-8.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
e18c28c95bea1af6b2187c6a35eb651dccabfb2212e529b6edd4a2e2f4c39ea8

Request headers

Referer
https://online.citi.com/US/login.do
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/59.0.3071.115 Safari/537.36

Response headers

Date
Tue, 18 Jul 2017 22:10:56 GMT
Last-Modified
Thu, 06 Apr 2017 18:39:20 GMT
X-Akamai-CITISITE
GTDC
P3P
policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
Connection
keep-alive
Accept-Ranges
bytes
Content-Type
image/jpeg
Content-Length
12405
Simplicity_M7_A526x330.png
online.citi.com/JRS/banners/card_art/ 		73 KB
73 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://online.citi.com/JRS/banners/card_art/Simplicity_M7_A526x330.png
Requested by
Host: online.citi.com
URL: https://online.citi.com/US/login.do
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.109.85.8 Amsterdam, Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a104-109-85-8.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
f2020a5c586dc75e61b9fe7e04f6c0da9303d1db86ef234326ac1ebae981fb72

Request headers

Referer
https://online.citi.com/US/login.do
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/59.0.3071.115 Safari/537.36

Response headers

Date
Tue, 18 Jul 2017 22:10:56 GMT
Last-Modified
Wed, 14 Jun 2017 18:34:25 GMT
X-Akamai-CITISITE
GTDC
P3P
policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
Connection
keep-alive
Accept-Ranges
bytes
Content-Type
image/png
Content-Length
74662
esw
steps.citi.com/us/ 		360 B
360 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://steps.citi.com/us/esw?si=2&e=https%3A%2F%2Fonline.citi.com&LSESSIONID=jLd1oKIb4IIhdyuLLx8s2zsJoPuSpX%2FbVkC3EXavFtPX08UvN8F3682k&t=jsonpi&eu=https%3A%2F%2Fonline.citi.com%2FUS%2Flogin.do&c=ykcmbcbowlwlvgdz
Requested by
Host: online.citi.com
URL: https://online.citi.com/US/login.do
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.243.66.137 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-54-243-66-137.compute-1.amazonaws.com
Software
nginx /
Resource Hash
58e62eec368d52b5812ce56f7ef5e09c65d320eef4197e31d195d087f924b40c

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/59.0.3071.115 Safari/537.36
Referer
https://online.citi.com/US/login.do
Origin
https://online.citi.com

Response headers

Pragma
no-cache
Date
Tue, 18 Jul 2017 22:10:56 GMT
Server
nginx
Access-Control-Allow-Methods
GET, OPTIONS
P3P
CP="NOI ADM DEV PSAi COM NAV OUR OTR STP IND DEM"
Access-Control-Allow-Origin
https://online.citi.com
Expires
0
Cache-Control
no-cache, no-store, must-revalidate
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
text/javascript
Content-Length
360
PICS-Label
(PICS-1.1 "http://www.icra.org/pics/vocabularyv03/" l r (n 0 s 0 v 0 l 0 oa 0 ob 0 oc 0 od 0 oe 0 of 0 og 0 oh 0 c 0) "http://www.icra.org/ratingsv02.html" l r (nz 0 vz 0 lz 0 oz 0 cz 0) "http://www.rsac.org/ratingsv01.html" l r (n 0 s 0 v 0 l 0))
LOInm
paper.citi.com/127893/ Frame 3245 		67 B
67 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://paper.citi.com/127893/LOInm?cid=2&si=1&e=https%3A%2F%2Fonline.citi.com&LSESSIONID=jLd1oKIb4IIhdyuLLx8s2zsJoPuSpX%2FbVkC3EXavFtPX08UvN8F3682k&t=ajax&eu=https%3A%2F%2Fonline.citi.com%2FUS%2Flogin.do
Requested by
Host: paper.citi.com
URL: https://paper.citi.com/127893/CWrT.html?si=1&e=https%3A%2F%2Fonline.citi.com&LSESSIONID=jLd1oKIb4IIhdyuLLx8s2zsJoPuSpX%2FbVkC3EXavFtPX08UvN8F3682k&t=xframe&eu=https%3A%2F%2Fonline.citi.com%2FUS%2Flogin.do&icid=150041585562194555
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
204.236.225.197 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-204-236-225-197.compute-1.amazonaws.com
Software
nginx /
Resource Hash
2b69a58b8e551ab7488fed5a620a3e4cbc7e7426454407869726a06edfaf103a

Request headers

Referer
https://paper.citi.com/127893/CWrT.html?si=1&e=https%3A%2F%2Fonline.citi.com&LSESSIONID=jLd1oKIb4IIhdyuLLx8s2zsJoPuSpX%2FbVkC3EXavFtPX08UvN8F3682k&t=xframe&eu=https%3A%2F%2Fonline.citi.com%2FUS%2Flogin.do&icid=150041585562194555
Origin
https://paper.citi.com
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/59.0.3071.115 Safari/537.36
Content-Type
application/x-www-form-urlencoded

Response headers

Pragma
no-cache
Date
Tue, 18 Jul 2017 22:10:56 GMT
Server
nginx
Access-Control-Allow-Methods
GET, OPTIONS
P3P
CP="NOI ADM DEV PSAi COM NAV OUR OTR STP IND DEM"
Access-Control-Allow-Origin
https://paper.citi.com
Expires
0
Cache-Control
no-cache, no-store, must-revalidate
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
text/html
Content-Length
67
PICS-Label
(PICS-1.1 "http://www.icra.org/pics/vocabularyv03/" l r (n 0 s 0 v 0 l 0 oa 0 ob 0 oc 0 od 0 oe 0 of 0 og 0 oh 0 c 0) "http://www.icra.org/ratingsv02.html" l r (nz 0 vz 0 lz 0 oz 0 cz 0) "http://www.rsac.org/ratingsv01.html" l r (n 0 s 0 v 0 l 0))
pixel.gif
online.citi.com/JRS/images/ Frame 3245 		42 B
42 B 		Document
General
Check archive.org
Download Go to
Full URL
https://online.citi.com/JRS/images/pixel.gif
Requested by
Host: steps.citi.com
URL: https://steps.citi.com/us/enUS.html?e=https%3A%2F%2Fonline.citi.com&eu=https%3A%2F%2Fonline.citi.com%2FUS%2Flogin.do&icid=150041585605837294
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.109.85.8 Amsterdam, Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a104-109-85-8.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
5b27cb8a843da7b4f70f68d669798596541491654185df0bd45867d951a31947

Request headers

Upgrade-Insecure-Requests
1
Referer
https://steps.citi.com/us/enUS.html?e=https%3A%2F%2Fonline.citi.com&eu=https%3A%2F%2Fonline.citi.com%2FUS%2Flogin.do&icid=150041585605837294
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/59.0.3071.115 Safari/537.36

Response headers

Date
Tue, 18 Jul 2017 22:10:56 GMT
Last-Modified
Wed, 05 Apr 2017 17:39:53 GMT
X-Akamai-CITISITE
GTDC
P3P
policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
Connection
keep-alive
Accept-Ranges
bytes
Content-Type
image/gif
Content-Length
42
LOInm
paper.citi.com/127893/ Frame 3245 		106 B
106 B 		Script
General
Check archive.org
Download Go to
Full URL
https://paper.citi.com/127893/LOInm?d=JTVCJTdCJTIyaWQlMjIlM0ElMjI1JTIyJTJDJTIyZGF0YSUyMiUzQSU3QiUyMmglMjIlM0ElMjIlMjIlMkMlMjJlJTIyJTNBJTIyaHR0cHMlM0ElMkYlMkZvbmxpbmUuY2l0aS5jb20lMjIlN0QlN0QlNUQ%3D&cid=5&si=1&e=https%3A%2F%2Fonline.citi.com&LSESSIONID=jLd1oKIb4IIhdyuLLx8s2zsJoPuSpX%2FbVkC3EXavFtPX08UvN8F3682k&t=jsonp&c=thmqpdoesd_qdfkw&eu=https%3A%2F%2Fonline.citi.com%2FUS%2Flogin.do
Requested by
Host: paper.citi.com
URL: https://paper.citi.com/127893/h7H.html/discovercard.com/dfs/accounthome/summary/-www.schwab.com/secure.accurint.com/unfcu2.org//login1/wachovia.com/MyAccounts.aspx/investing.schwab.com/secure/schwab///https://snsbank.nl/mijnsns/secure/login/httpsabph.pl/pi/do/Authorization/alfabank.ru/swedbank/pf.bgz.pl/httponline.eurobank.pl/?cid=5&si=1&e=https%3A%2F%2Fonline.citi.com&LSESSIONID=jLd1oKIb4IIhdyuLLx8s2zsJoPuSpX%2FbVkC3EXavFtPX08UvN8F3682k&t=xframe&eu=https%3A%2F%2Fonline.citi.com%2FUS%2Flogin.do&icid=150041585562587629
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
204.236.225.197 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-204-236-225-197.compute-1.amazonaws.com
Software
nginx /
Resource Hash
ed4b54378ef396024406a264e4f1619dd5db19902c5ce2532e7f72c8128c8e43

Request headers

Referer
https://paper.citi.com/127893/h7H.html/discovercard.com/dfs/accounthome/summary/-www.schwab.com/secure.accurint.com/unfcu2.org//login1/wachovia.com/MyAccounts.aspx/investing.schwab.com/secure/schwab///https://snsbank.nl/mijnsns/secure/login/httpsabph.pl/pi/do/Authorization/alfabank.ru/swedbank/pf.bgz.pl/httponline.eurobank.pl/?cid=5&si=1&e=https%3A%2F%2Fonline.citi.com&LSESSIONID=jLd1oKIb4IIhdyuLLx8s2zsJoPuSpX%2FbVkC3EXavFtPX08UvN8F3682k&t=xframe&eu=https%3A%2F%2Fonline.citi.com%2FUS%2Flogin.do&icid=150041585562587629
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/59.0.3071.115 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 18 Jul 2017 22:10:56 GMT
Server
nginx
Access-Control-Allow-Methods
GET, OPTIONS
P3P
CP="NOI ADM DEV PSAi COM NAV OUR OTR STP IND DEM"
Access-Control-Allow-Origin
*
Expires
0
Cache-Control
no-cache, no-store, must-revalidate
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
text/javascript
Content-Length
106
PICS-Label
(PICS-1.1 "http://www.icra.org/pics/vocabularyv03/" l r (n 0 s 0 v 0 l 0 oa 0 ob 0 oc 0 od 0 oe 0 of 0 og 0 oh 0 c 0) "http://www.icra.org/ratingsv02.html" l r (nz 0 vz 0 lz 0 oz 0 cz 0) "http://www.rsac.org/ratingsv01.html" l r (n 0 s 0 v 0 l 0))
esw
steps.citi.com/us/ 		360 B
360 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://steps.citi.com/us/esw?si=2&e=https%3A%2F%2Fonline.citi.com&LSESSIONID=jLd1oKIb4IIhdyuLLx8s2zsJoPuSpX%2FbVkC3EXavFtPX08UvN8F3682k&t=jsonpi&eu=https%3A%2F%2Fonline.citi.com%2FUS%2Flogin.do&c=awav_qtcsmpifyvh
Requested by
Host: online.citi.com
URL: https://online.citi.com/US/login.do
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.243.66.137 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-54-243-66-137.compute-1.amazonaws.com
Software
nginx /
Resource Hash
e6763e61afb9253bdaae35bfdacc8e4ba252146d4342f987aae1445be655bca0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/59.0.3071.115 Safari/537.36
Referer
https://online.citi.com/US/login.do
Origin
https://online.citi.com

Response headers

Pragma
no-cache
Date
Tue, 18 Jul 2017 22:10:56 GMT
Server
nginx
Access-Control-Allow-Methods
GET, OPTIONS
P3P
CP="NOI ADM DEV PSAi COM NAV OUR OTR STP IND DEM"
Access-Control-Allow-Origin
https://online.citi.com
Expires
0
Cache-Control
no-cache, no-store, must-revalidate
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
text/javascript
Content-Length
360
PICS-Label
(PICS-1.1 "http://www.icra.org/pics/vocabularyv03/" l r (n 0 s 0 v 0 l 0 oa 0 ob 0 oc 0 od 0 oe 0 of 0 og 0 oh 0 c 0) "http://www.icra.org/ratingsv02.html" l r (nz 0 vz 0 lz 0 oz 0 cz 0) "http://www.rsac.org/ratingsv01.html" l r (n 0 s 0 v 0 l 0))
pixel.gif
online.citi.com/JRS/images/ Frame 3245 		42 B
42 B 		Document
General
Check archive.org
Download Go to
Full URL
https://online.citi.com/JRS/images/pixel.gif
Requested by
Host: paper.citi.com
URL: https://paper.citi.com/127893/h7H.html/discovercard.com/dfs/accounthome/summary/-www.schwab.com/secure.accurint.com/unfcu2.org//login1/wachovia.com/MyAccounts.aspx/investing.schwab.com/secure/schwab///https://snsbank.nl/mijnsns/secure/login/httpsabph.pl/pi/do/Authorization/alfabank.ru/swedbank/pf.bgz.pl/httponline.eurobank.pl/?cid=5&si=1&e=https%3A%2F%2Fonline.citi.com&LSESSIONID=jLd1oKIb4IIhdyuLLx8s2zsJoPuSpX%2FbVkC3EXavFtPX08UvN8F3682k&t=xframe&eu=https%3A%2F%2Fonline.citi.com%2FUS%2Flogin.do&icid=150041585562587629
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.109.85.8 Amsterdam, Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a104-109-85-8.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
5b27cb8a843da7b4f70f68d669798596541491654185df0bd45867d951a31947

Request headers

Upgrade-Insecure-Requests
1
Referer
https://paper.citi.com/127893/h7H.html/discovercard.com/dfs/accounthome/summary/-www.schwab.com/secure.accurint.com/unfcu2.org//login1/wachovia.com/MyAccounts.aspx/investing.schwab.com/secure/schwab///https://snsbank.nl/mijnsns/secure/login/httpsabph.pl/pi/do/Authorization/alfabank.ru/swedbank/pf.bgz.pl/httponline.eurobank.pl/?cid=5&si=1&e=https%3A%2F%2Fonline.citi.com&LSESSIONID=jLd1oKIb4IIhdyuLLx8s2zsJoPuSpX%2FbVkC3EXavFtPX08UvN8F3682k&t=xframe&eu=https%3A%2F%2Fonline.citi.com%2FUS%2Flogin.do&icid=150041585562587629
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/59.0.3071.115 Safari/537.36

Response headers

Date
Tue, 18 Jul 2017 22:10:56 GMT
Last-Modified
Wed, 05 Apr 2017 17:39:53 GMT
X-Akamai-CITISITE
GTDC
P3P
policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
Connection
keep-alive
Accept-Ranges
bytes
Content-Type
image/gif
Content-Length
42
esw
steps.citi.com/us/ 		360 B
360 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://steps.citi.com/us/esw?si=2&e=https%3A%2F%2Fonline.citi.com&LSESSIONID=jLd1oKIb4IIhdyuLLx8s2zsJoPuSpX%2FbVkC3EXavFtPX08UvN8F3682k&t=jsonpi&eu=https%3A%2F%2Fonline.citi.com%2FUS%2Flogin.do&c=q_meqnuv_qzxvdmo
Requested by
Host: online.citi.com
URL: https://online.citi.com/US/login.do
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.243.66.137 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-54-243-66-137.compute-1.amazonaws.com
Software
nginx /
Resource Hash
65a05c109453b9b81bbbecfc3f94694cff3f7e6aa230660a05b0d102ecee809e

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/59.0.3071.115 Safari/537.36
Referer
https://online.citi.com/US/login.do
Origin
https://online.citi.com

Response headers

Pragma
no-cache
Date
Tue, 18 Jul 2017 22:10:56 GMT
Server
nginx
Access-Control-Allow-Methods
GET, OPTIONS
P3P
CP="NOI ADM DEV PSAi COM NAV OUR OTR STP IND DEM"
Access-Control-Allow-Origin
https://online.citi.com
Expires
0
Cache-Control
no-cache, no-store, must-revalidate
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
text/javascript
Content-Length
360
PICS-Label
(PICS-1.1 "http://www.icra.org/pics/vocabularyv03/" l r (n 0 s 0 v 0 l 0 oa 0 ob 0 oc 0 od 0 oe 0 of 0 og 0 oh 0 c 0) "http://www.icra.org/ratingsv02.html" l r (nz 0 vz 0 lz 0 oz 0 cz 0) "http://www.rsac.org/ratingsv01.html" l r (n 0 s 0 v 0 l 0))
pixel.gif
online.citi.com/JRS/images/ Frame 3245 		42 B
42 B 		Document
General
Check archive.org
Download Go to
Full URL
https://online.citi.com/JRS/images/pixel.gif
Requested by
Host: paper.citi.com
URL: https://paper.citi.com/127893/CWrT.html?si=1&e=https%3A%2F%2Fonline.citi.com&LSESSIONID=jLd1oKIb4IIhdyuLLx8s2zsJoPuSpX%2FbVkC3EXavFtPX08UvN8F3682k&t=xframe&eu=https%3A%2F%2Fonline.citi.com%2FUS%2Flogin.do&icid=150041585562194555
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.109.85.8 Amsterdam, Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a104-109-85-8.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
5b27cb8a843da7b4f70f68d669798596541491654185df0bd45867d951a31947

Request headers

Upgrade-Insecure-Requests
1
Referer
https://paper.citi.com/127893/CWrT.html?si=1&e=https%3A%2F%2Fonline.citi.com&LSESSIONID=jLd1oKIb4IIhdyuLLx8s2zsJoPuSpX%2FbVkC3EXavFtPX08UvN8F3682k&t=xframe&eu=https%3A%2F%2Fonline.citi.com%2FUS%2Flogin.do&icid=150041585562194555
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/59.0.3071.115 Safari/537.36

Response headers

Date
Tue, 18 Jul 2017 22:10:56 GMT
Last-Modified
Wed, 05 Apr 2017 17:39:53 GMT
X-Akamai-CITISITE
GTDC
P3P
policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
Connection
keep-alive
Accept-Ranges
bytes
Content-Type
image/gif
Content-Length
42
TeaLeaf.action
online.citi.com/US/NCCS/tealeaf/ 		0
0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
6260004.fls.doubleclick.net
URL
https://6260004.fls.doubleclick.net/activityi;dc_pre=CL2GlNDsk9UCFdg-GwodXjgI8g;src=6260004;type=cards0;cat=citih0;u4=JSOSIGNON;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=5193201568880.388
Domain
sr.rlcdn.com
URL
https://sr.rlcdn.com/425466.html?redirect=1&rl=2c58033e9c2e656d2361fdf6e008e6a98bc9b7eb31153a4bd5db8fa349aae4826462e664d3387760aefe2484e107d732202264ef7a61246d
Domain
6269322.fls.doubleclick.net
URL
https://6269322.fls.doubleclick.net/activityi;dc_pre=CP332NDsk9UCFdQTGwodwkAIww;src=6269322;type=bankp0;cat=banka001;ord=2629581755436.303
Domain
bid.g.doubleclick.net
URL
https://bid.g.doubleclick.net/xbbe/pixel?d=KAE
Domain
online.citi.com
URL
https://online.citi.com/US/NCCS/tealeaf/TeaLeaf.action?JFP_TOKEN=RWNYT9NP

Verdicts & Comments Add Verdict or Comment

0 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

14 Cookies

Domain/Path Name / Value
.doubleclick.net/ Name: id
Value: 22a7cc87484b0048||t=1500415854|et=730|cs=002213fd484bdb4c19ba6a45fc
.online.citi.com/ Name: modelData
Value: 99:PRD
.doubleclick.net/ Name: IDE
Value: AHWqTUn1-dh6ExEZH8uI6JeUWEAoFa50ocEYEyooL_QkxgFTpWd8yxNWFg
.citi.com/ Name: CUUID
Value: 00ab0287-4f08-49c2-8d9b-80bd1cb86ea9
.citi.com/ Name: ___so127893
Value: eyJsc2giOjQxMDk4NTk1OSwic2QiOm51bGwsInNkYyI6bnVsbCwiZSI6eyJuIjozLCJhIjpbeyI0Ijp0cnVlLCJzciI6Imh0dHBzOi8vb25saW5lLmNpdGkuY29tL0pSUy9pbWFnZXMvcGl4ZWwuZ2lmIn0sIjQiXSwicmlkIjowLjY1MTU4NjgyODgwNDA5OH19
.citi.com/ Name: LSESSIONID
Value: jLd1oKIb4IIhdyuLLx8s2zsJoPuSpX%2FbVkC3EXavFtPX08UvN8F3682k
.citi.com/ Name: AKMTLTSID
Value: FE27DDD81E42AA77B4624C633A885D8D
.citi.com/ Name: mbox
Value: check#true#1500415915|session#1500415854225-317953#1500417715|PC#1500415854225-317953.26_1#1501625455
online.citi.com/ Name: 7018
Value: 00ab0287-4f08-49c2-8d9b-80bd1cb86ea9
.citi.com/ Name: CITI_SITE
Value: gtdc
online.citi.com/ Name: 7830
Value: error
.citi.com/ Name: BKDMP
Value:
online.citi.com/ Name: count
Value: 1
online.citi.com/ Name: JSESSIONID
Value: 0000cCV4GO9Y9xUe_yHdNHDZSts:gt07p-srv3

1 Console Messages

Source Level URL
Text
console-api log URL: https://nexus.ensighten.com/citi/na_prod/code/3b58ed00af8670dc0af85dd6e3dc0bee.js?conditionId0=443037(Line 248)
Message:
capture URL is /US/login.do

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

6260004.fls.doubleclick.net
6269322.fls.doubleclick.net
bid.g.doubleclick.net
cardoffer.citicards.com
cdn.tt.omtrdc.net
citicorpcreditservic.tt.omtrdc.net
clients1.google.com
connect.facebook.net
cse.google.com
d.xp1.ru4.com
metrics1.citi.com
mpsnare.iesnare.com
nexus.ensighten.com
online.citi.com
paper.citi.com
s.xp1.ru4.com
s.ytimg.com
sr.rlcdn.com
stags.bluekai.com
steps.citi.com
www.google.com
www.google.de
www.googleadservices.com
www.googleapis.com
www.youtube.com
6260004.fls.doubleclick.net
6269322.fls.doubleclick.net
bid.g.doubleclick.net
online.citi.com
sr.rlcdn.com
104.109.85.8
129.146.14.100
172.217.21.226
193.0.160.182
193.0.160.185
198.160.105.95
204.236.225.197
2a00:1450:4001:825::200a
2a00:1450:4001:825::200e
2a00:1450:401b:801::2003
2a00:1450:401b:801::2004
2a03:2880:f02d:12:face:b00c:0:3
35.158.49.49
52.129.74.11
52.57.229.31
54.243.66.137
63.140.43.86
66.117.29.3
95.100.181.67
010603a6cdb6989527f433e10aca1edf8f5be6498c8f2d437d4f563096613e3b
0272d31d7dd1ed884c8b6ea48b08a94a1d7e9c2367e5d51e2b20009f9deb7e07
03c736ca1c90e26743865ed80c9766f84ca237b0dc572fab630737aaef70d171
04328cab2d1248c591cfac5b147463e97325080138f2f56d4d11b6c509cf4d6f
0db5ccc9723d7525448b23ca496ff888317e126465b089427d9587840035db4b
0dc99ecac94d9a8f57f0841c59bd6a4ab45b8a0845d3be8eb70d84ca96f866c0
183708044ee98821cc3fcdc2ae3ad7e3edc50a8ca4d004c986a1945600b2ff2c
1d6bba6cc294d0f54cf0a018a70e2f11e7171bc0631c0ada7996679da4ffa91a
1e1b16cf1af4fb99d6ebb25d3f6dd4377826ecc5af897a868533e4c3fc8449d3
1f2a0e7aa3dabf73dae3cc7c1e53a70ec51145b39b027bdc1ecae9223c0c80d2
2aa4fa20701cdd6d8d56046069001186b5267e3ee7d0ef618ad2f4a683723e11
2b69a58b8e551ab7488fed5a620a3e4cbc7e7426454407869726a06edfaf103a
2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363
304987a16c4c009cf2465e0e6873ac2511b3a4b6daef85345d23225855e6158e
33b16efff9f7042b210d4981541814365450cea44710e082a05cced2ae6f82f3
341fabd4891d2b73b6b64f1867eeaaa7b1e4fbc24ff966f2a735853e03ab0264
38fd255b14b5a77afc8f4ff288f4a0dfd8a970816b89d15dbd5fb6732591b5e4
3d3d1d5ae8cd77c47016e1b254dfe0f175cdff48f1350b0adbbfb74ad5c2a614
3fca3de24621f0f10186594054444d608016297c2e853e548710b3521e42a609
4763a2782f72a90f6b8e180b30650823594aa0b2616ffdda0d7b5fc4835b3650
4d8418ac12932fed073261c988949cf294cb565f32d885964908cc0714a55c68
4f918cd256712c03a1b88007176cabf623cc63740e919d35a217c18dc7ebe607
51eb606e73a40b2bb07342fd56ff389a6c0428dff27f0f6ced78f72daff520b9
548fcf4697d3fab962a462b0eee67bcd53a9ec3321091a642fd88be6f9505e0b
55e066703c69d4d89a1f4d66794d474aa93d710624d8f807096bac17a7867b17
57271db21f2726de70c45af59bf71488a3aa71a668ef59a16c9992eb0feeda88
58e62eec368d52b5812ce56f7ef5e09c65d320eef4197e31d195d087f924b40c
58ec2a9724dbfea1eee52a5f566d6bca559e7c3bb826d670893e037c7770e24e
5b27cb8a843da7b4f70f68d669798596541491654185df0bd45867d951a31947
5ee4e0268ea8fd91231b210aed4bf450d1c78889d4bda3dd663ec9deefe7245e
6160549bfa9298ad3fe4f54514aef544b094fc6853b927b4edf1a61d46e4173f
6177c6163dc1ad67fb596a94ef3d18a277bfd437dbb3c1a928cd6caacefeff2e
629b48196dcc270143a42ce57535b251c655617f8d510277d4a05306c426fd38
64f16e773ee8377eeafbc64d8778defeb81dabd8956bc70de980d874c775c586
65a05c109453b9b81bbbecfc3f94694cff3f7e6aa230660a05b0d102ecee809e
6a5960687fe90987f59ffe6c36450124b6b607608f4d100d7545fc4372c069a4
6be01f3f4d6d03d49a9ee459f1fbafaeca455603ecda12c5ae829e0a6aa04c43
6cdd7890de21266cf76605c0677bb220931d269e97976686da1001b923f19497
6d56febe0a7e0fc04aa138072771fd78e88e47ec461a8356bcba672cd498af63
701d2f9f02741b8429f4fb892b2b48c34a8a0f9189cb09013b2799031f22e484
72d4175bacbbc61b9b282dc40b8e796bc60575e2b743a27a01968a50a7612a76
745f3ee4d1d9310d3414a8a8dd027158cdd31cfeb4ea0103fcb80351e5f33201
76a0d76f135419f4d00213037cda0cba949a0372e01ab6a1d70072008a56bd18
7cb24e06c00e47bb6bc6c38b935d6bc62817f656703387e4fb7591add96c7454
823db1b6cf4fe34956773f03a9b3e1c36d3a1fe1b609b1c1bd8730475bc6b81c
8302d272009773efd29127b5396ebd3d866f3cd7942634e5fdf15ed0b4e48668
8522d00f569d0b8af9689240717d29d1acddec118f71d33d80948f6eacf58fa0
85bb24baa94f0eb9e0e1138e87cb654611313a2f5b260ed0cd5d96afbfba52c3
876d6d386681dfd1b78374b1ed36763be7bbea4686656830069bc0dad86e2856
88baf441d192730bb7c2c64c311ac76307c88ffb03852a18506098c1f577e89f
8ab79d13531bd711ddeb984d668fd94d4a1ad0d2e16dc84c2807970d1628ba1b
96d29ed7cc7dcb7806c6babd3e52a5741a30a2a6dc8dca9bddac9716cd2dd8be
9dad502247a8488c21ef5beb32aed1a78b17b748711bec817c472911f76b4ead
a1ecbaed793a1f564c49c671f2dd0ce36f858534ef6d26b55783a06b884cc506
a4becff94cf0fac85d9ff942d234433935df9719cab82185a2f67d2b926f9816
a621f450d026646ee83df081a99fbd75603b1e9cda1e586223d14a58db292d73
a75812fddb74e992f1b917dd1b0097f573613420f6a3c1d7976534daf386c1ee
a83a7d8187b62a3975a857c380b453603decf73988114b83db3767dc62d38cda
a844cdc48c7591822e45128a138f1dbba5753a3ca9992bd71c36758d51d0b68e
aa4d9d71daa80aee40853b510af3c03ec3948423c6b42949706f993c31862409
ab36414721005ff0c678f4e9ce621781f4e4aef6cf81464cc970052b53e2d789
ad9b95dc8aec99a5335567c6f5f6df98de9a73db72d236b20363d94674ec65f8
af45c9367e7a2bf6feceb98cc4fffbc63c1d7d8db90c7c2c2639ce03ce779812
b5b99c97960d130c44fad1acc54bba0644286e0fd6d3899e3027392ab7de9cc8
b6f316715e6fafca7d738268458d779fdf1c7fe48355392fcc1cf262750551a9
bdfcac61a4d16f938733cf0e32115a2143219f57acc81c3dcf11d0df4fdafc1f
c139d91e4f48a88c8400112a20c1c499a6cd362e88dccb3fe81b22af55077430
c3c994c3fe9bd4e055f6d0eb42067ecd6bdd3247e136bc22835b9882cfe77c61
cb80d4a61fc18368511490761c79e99aaaddb75b43932b10c3285278a5515fe7
cfa6511b58884f7502eef2c077f04aa90759762dcf00a79b87e5745c2dd2512c
d0230eed4960342550b3b2e458684b4cde60beabf2ea948b40130a01e9cbf6a3
d0857f2268da0b64eb01fe13a6fc0bce112ff4ac92b557b846ff6136d9f5f45e
d173595bb7a886af3e190c3fac921a5fa6be724878a24e36aa07fc50e0cffcf1
d254e8edc553b0c20a860054b2db15b778be1962d497173af989f13efd941abe
daec312d129cfc3ddfe90327b023a12aa308cce7e403dcda3b5c9f179c4458ca
dcc29d29b1b3a12f05ac192e3e93713a0346fae79fa10b17868b0bfe43e3844b
e0cbbf1e1b39d4fb99fe7e4f33374ce7d3b629820c982a619d345a773e32ebc1
e17da319eba14bc5a5677abdac48f8ef973597cca0c9733f8d3dd68bbc6faf81
e18c28c95bea1af6b2187c6a35eb651dccabfb2212e529b6edd4a2e2f4c39ea8
e2e37524843a8d03e92db4425809dbbc6c6f482dba4465f7533d5d3ef0337fc6
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e6763e61afb9253bdaae35bfdacc8e4ba252146d4342f987aae1445be655bca0
e8534cc71d4d8696d9201560b7559cd2887ec7425cd65722bb82e10a99484af5
e90fb0eba512ed6473f6fb8acf4cd09b38732f150f43c396246c12bb2aacbb67
e9e9a67395a0d83b584208a19b95af203df8e8e6c6952fe76c690d60ea9381c7
ed4b54378ef396024406a264e4f1619dd5db19902c5ce2532e7f72c8128c8e43
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f151d90d9b3a467fe6905f0605967db281d577f9eafbfdb881176f73b7dd4022
f1821b3865a1008ba0c088f7dc5c7eeb6b81e414461885c40b8d0f48fcbc9341
f2020a5c586dc75e61b9fe7e04f6c0da9303d1db86ef234326ac1ebae981fb72
f327a0ba3e41b1e8154e1c18fc114baff0bd057151e3afe7fa6f33cc0cb18296
f35d515bc97cfe3a498ad05c86aab9466d6274c931055bd1511c7ebf21e50a11