urlscan.io logo urlscan.io
SecurityTrails logo

weset-authty91.myvnc.com Open in urlscan Pro
35.238.108.96  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
Submitted URL: https://weset-authty91.myvnc.com/
Effective URL: https://weset-authty91.myvnc.com/Login/?token=
Submission: On March 19 via automatic, source certstream-suspicious — Scanned from DE
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 18 IPs in 3 countries across 15 domains to perform 127 HTTP transactions. The main IP is 35.238.108.96, located in Council Bluffs, United States and belongs to GOOGLE, US. The main domain is weset-authty91.myvnc.com.
TLS certificate: Issued by R3 on March 19th 2022. Valid for: 3 months.
This is the only time weset-authty91.myvnc.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Citibank (Banking)

Domain & IP information

19    35.238.108.96 (Council Bluffs, United States)

ASN15169 (GOOGLE, US)
PTR: 96.108.238.35.bc.googleusercontent.com
weset-authty91.myvnc.com
2    151.101.129.175 (United States)

ASN54113 (FASTLY, US)
nebula-cdn.kampyle.com
15    2a00:1450:4001:808::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.googletagmanager.com
1    104.111.228.137 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a104-111-228-137.deploy.static.akamaitechnologies.com
tags.bkrtx.com
2    151.101.130.133 (United States)

ASN54113 (FASTLY, US)
resources.digital-cloud-citi.medallia.com
16    2a00:1450:400e:811::2002 (Ireland)

ASN15169 (GOOGLE, US)
googleads.g.doubleclick.net
9    18.195.42.228 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-18-195-42-228.eu-central-1.compute.amazonaws.com
nexus.ensighten.com
16    2a00:1450:4001:82b::2004 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.google.com
16    2a00:1450:4001:80f::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.google.de
2    104.111.215.191 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a104-111-215-191.deploy.static.akamaitechnologies.com
stags.bluekai.com
1    74.125.140.157 (United States)

ASN15169 (GOOGLE, US)
PTR: wq-in-f157.1e100.net
bid.g.doubleclick.net
1    2600:9000:2156:2200:1:76cf:fe80:93a1 (United States)

ASN16509 (AMAZON-02, US)
c1.rfihub.net
1    193.0.160.128 (United States)

ASN54312 (ROCKETFUEL, US)
20766699p.rfihub.com
1    143.204.98.10 (None, )

ASN- ()
cdn.pbbl.co
1    35.190.60.146 (None, )

ASN- ()
sr.rlcdn.com
1    142.250.186.66 (None, )

ASN- ()
www.googleadservices.com
1    35.241.45.82 (None, )

ASN- ()
udc-neb.kampyle.com
Apex Domain
Subdomains		 Transfer
19 myvnc.com
weset-authty91.myvnc.com
2 MB
17 doubleclick.net
googleads.g.doubleclick.net — Cisco Umbrella Rank: 38
bid.g.doubleclick.net — Cisco Umbrella Rank: 468
19 KB
16 google.de
www.google.de — Cisco Umbrella Rank: 6433
2 KB
16 google.com
www.google.com — Cisco Umbrella Rank: 2
2 KB
15 googletagmanager.com
www.googletagmanager.com — Cisco Umbrella Rank: 54
566 KB
9 ensighten.com
nexus.ensighten.com — Cisco Umbrella Rank: 2591 Failed
84 KB
3 kampyle.com
nebula-cdn.kampyle.com — Cisco Umbrella Rank: 3348
udc-neb.kampyle.com
11 KB
2 bluekai.com
stags.bluekai.com — Cisco Umbrella Rank: 437
676 B
2 medallia.com
resources.digital-cloud-citi.medallia.com — Cisco Umbrella Rank: 23247
89 KB
1 rlcdn.com
sr.rlcdn.com
98 B
1 rfihub.com
20766699p.rfihub.com — Cisco Umbrella Rank: 34103
705 B
1 rfihub.net
c1.rfihub.net — Cisco Umbrella Rank: 5644
6 KB
1 pbbl.co
cdn.pbbl.co Failed
1 googleadservices.com
www.googleadservices.com Failed
15 KB
1 bkrtx.com
tags.bkrtx.com — Cisco Umbrella Rank: 2764
16 KB
127 15
Domain Requested by
19 weset-authty91.myvnc.com weset-authty91.myvnc.com
16 www.google.de weset-authty91.myvnc.com
16 www.google.com 1 redirects weset-authty91.myvnc.com
16 googleads.g.doubleclick.net 1 redirects weset-authty91.myvnc.com
www.googleadservices.com
15 www.googletagmanager.com weset-authty91.myvnc.com
www.googletagmanager.com
9 nexus.ensighten.com weset-authty91.myvnc.com
2 stags.bluekai.com weset-authty91.myvnc.com
tags.bkrtx.com
2 resources.digital-cloud-citi.medallia.com weset-authty91.myvnc.com
resources.digital-cloud-citi.medallia.com
2 nebula-cdn.kampyle.com weset-authty91.myvnc.com
resources.digital-cloud-citi.medallia.com
1 udc-neb.kampyle.com
1 sr.rlcdn.com nexus.ensighten.com
1 20766699p.rfihub.com c1.rfihub.net
1 c1.rfihub.net nexus.ensighten.com
1 bid.g.doubleclick.net weset-authty91.myvnc.com
1 cdn.pbbl.co weset-authty91.myvnc.com
nexus.ensighten.com
1 www.googleadservices.com weset-authty91.myvnc.com
www.googletagmanager.com
1 tags.bkrtx.com weset-authty91.myvnc.com
127 17

This site contains no links.

Subject Issuer Validity Valid
weset-authty91.myvnc.com
R3		 2022-03-19 -
2022-06-17		 3 months crt.sh
*.kampyle.com
GlobalSign Atlas R3 DV TLS CA 2022 Q1		 2022-02-22 -
2023-03-26		 a year crt.sh
*.google-analytics.com
GTS CA 1C3		 2022-02-28 -
2022-05-23		 3 months crt.sh
*.bkrtx.com
DigiCert SHA2 Secure Server CA		 2022-02-07 -
2023-02-06		 a year crt.sh
*.digital-cloud-citi.medallia.com
SSL.com RSA SSL subCA		 2021-11-15 -
2022-10-20		 a year crt.sh
*.g.doubleclick.net
GTS CA 1C3		 2022-02-28 -
2022-05-23		 3 months crt.sh
nexus.ensighten.com
DigiCert TLS RSA SHA256 2020 CA1		 2021-09-14 -
2022-10-12		 a year crt.sh
www.google.com
GTS CA 1C3		 2022-02-28 -
2022-05-23		 3 months crt.sh
www.google.de
GTS CA 1C3		 2022-02-28 -
2022-05-23		 3 months crt.sh
odc-pixel-prod-01.oracle.com
DigiCert SHA2 Secure Server CA		 2022-02-26 -
2023-03-01		 a year crt.sh
*.rfihub.net
Amazon		 2021-12-29 -
2023-01-27		 a year crt.sh
*.rfihub.com
Sectigo RSA Domain Validation Secure Server CA		 2020-06-18 -
2022-06-18		 2 years crt.sh
*.pbbl.co
Amazon		 2021-11-04 -
2022-12-02		 a year crt.sh
*.rlcdn.com
Sectigo RSA Domain Validation Secure Server CA		 2022-02-03 -
2023-02-25		 a year crt.sh
www.googleadservices.com
GTS CA 1C3		 2022-02-28 -
2022-05-23		 3 months crt.sh
*.google.com
GTS CA 1C3		 2022-02-28 -
2022-05-23		 3 months crt.sh
*.google.de
GTS CA 1C3		 2022-02-28 -
2022-05-23		 3 months crt.sh

This page contains 6 frames:

Primary Page: https://weset-authty91.myvnc.com/Login/?token=
Frame ID: E3137CA506B7D8B2B6D1823750EC851C
Requests: 122 HTTP requests in this frame

Frame: https://stags.bluekai.com/site/63068?ret=html&phint=language&phint=product&phint=event&phint=category&phint=page&phint=section1&phint=section2&phint=section3&phint=section4&phint=bankappstatus&phint=productID&phint=__bk_t%3DSign%20On%20to%20Your%20Citi%20Account%20-%20Citibank&phint=__bk_k%3D&phint=__bk_pr%3Dhttp%3A%2F%2Flocalhost%2Fskemas%2FCiti%2520antis%2520upgraded%2520%40VixxxYZ%2F&phint=__bk_l%3Dhttp%3A%2F%2Flocalhost%2Fskemas%2FCiti%2520antis%2520upgraded%2520%40VixxxYZ%2Flogin%2Fses%2F%3Fresponse_type%3Dcode%26client_id%3DMOBI%2540AMER.OAUTHAP%26Auth_key%3D6a09773ace2bd074cd40eceabfc311eaa037e8a2&phint=__bk_v%3D3.1.10&limit=10&r=92544077
Frame ID: 4ECB5AD02F1E3B448341A2F5F920E2D4
Requests: 1 HTTP requests in this frame

Frame: https://bid.g.doubleclick.net/xbbe/pixel?d=KAE
Frame ID: 31D4DD1A92027651DE67425D11811277
Requests: 1 HTTP requests in this frame

Frame: https://20766699p.rfihub.com/ca.html?ver=9&ra=591&rb=648&ca=20766699&_o=17169175&_t=&ssv_cuuid=&ssv_package=null&ssv_prodlist=null&ssv_pagename=&pe=https%3A%2F%2Fweset-authty91.myvnc.com%2FLogin%2F%3Ftoken%3D&pf=https%3A%2F%2Fweset-authty91.myvnc.com%2F&ra=4956978087554975
Frame ID: AC2FE2320B648F119B8262879C70F19A
Requests: 1 HTTP requests in this frame

Frame: https://sr.rlcdn.com/425466.html?es=80676&u=da39a3ee5e6b4b0d3255bfef95601890afd80709
Frame ID: 802A0D1D3B2ACC7526D773933A158EFB
Requests: 1 HTTP requests in this frame

Frame: https://stags.bluekai.com/site/63068?ret=html&phint=language&phint=product&phint=event&phint=category&phint=page&phint=section1&phint=section2&phint=section3&phint=section4&phint=bankappstatus&phint=productID&phint=__bk_t%3DSign%20On%20to%20Your%20Citi%20Account%20-%20Citibank&phint=__bk_k%3D&phint=__bk_pr%3Dhttps%3A%2F%2Fweset-authty91.myvnc.com%2F&phint=__bk_l%3Dhttps%3A%2F%2Fweset-authty91.myvnc.com%2FLogin%2F%3Ftoken%3D&phint=__bk_v%3D3.1.10&limit=10&r=83460557
Frame ID: 6DC41338C7B9E403E8DF9D48D62FE84C
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Sign On to Your Citi Account - Citibank

Page URL History Show full URLs

  1. https://weset-authty91.myvnc.com/ Page URL
  2. https://weset-authty91.myvnc.com/Login/?token= Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js
Overall confidence: 100%
Detected patterns
  • //nexus\.ensighten\.com/
Overall confidence: 100%
Detected patterns
  • googletagmanager\.com/gtag/js

Page Statistics

127
Requests

80 %
HTTPS

29 %
IPv6

15
Domains

17
Subdomains

18
IPs

3
Countries

3326 kB
Transfer

4973 kB
Size

8
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://weset-authty91.myvnc.com/ Page URL
  2. https://weset-authty91.myvnc.com/Login/?token= Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 109
  • https://googleads.g.doubleclick.net/pagead/viewthroughconversion/960621875/?random=1647712695758&cv=9&fst=1647712695758&num=1&fmt=3&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=3&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa3e0&sendb=1&ig=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fweset-authty91.myvnc.com%2FLogin%2F%3Ftoken%3D&ref=https%3A%2F%2Fweset-authty91.myvnc.com%2F&tiba=Sign%20On%20to%20Your%20Citi%20Account%20-%20Citibank&hn=www.googleadservices.com&async=1 HTTP 302
  • https://www.google.com/pagead/1p-user-list/960621875/?random=1647712695758&cv=9&fst=1647709200000&num=1&fmt=3&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=3&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa3e0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fweset-authty91.myvnc.com%2FLogin%2F%3Ftoken%3D&ref=https%3A%2F%2Fweset-authty91.myvnc.com%2F&tiba=Sign%20On%20to%20Your%20Citi%20Account%20-%20Citibank&async=1&is_vtc=1&random=3183123646&resp=GooglemKTybQhCsO HTTP 302
  • https://www.google.de/pagead/1p-user-list/960621875/?random=1647712695758&cv=9&fst=1647709200000&num=1&fmt=3&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=3&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa3e0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fweset-authty91.myvnc.com%2FLogin%2F%3Ftoken%3D&ref=https%3A%2F%2Fweset-authty91.myvnc.com%2F&tiba=Sign%20On%20to%20Your%20Citi%20Account%20-%20Citibank&async=1&is_vtc=1&random=3183123646&resp=GooglemKTybQhCsO&ipr=y

127 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
/
weset-authty91.myvnc.com/ 		4 KB
4 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://weset-authty91.myvnc.com/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
35.238.108.96 Council Bluffs, United States, ASN15169 (GOOGLE, US),
Reverse DNS
96.108.238.35.bc.googleusercontent.com
Software
Apache /
Resource Hash
e54d786bbb6fe201b8e9856dba58cac732013ec0e3066cb824c3716dc5ce915e

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Accept-Language
de-DE,de;q=0.9

Response headers

Date
Sat, 19 Mar 2022 17:58:10 GMT
Server
Apache
Expires
Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control
no-store, no-cache, must-revalidate
Pragma
no-cache
Keep-Alive
timeout=5, max=100
Connection
Keep-Alive
Transfer-Encoding
chunked
Content-Type
text/html; charset=UTF-8
cf.css
weset-authty91.myvnc.com/A/css/other/ 		0
0 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://weset-authty91.myvnc.com/A/css/other/cf.css
Requested by
Host: weset-authty91.myvnc.com
URL: https://weset-authty91.myvnc.com/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
35.238.108.96 Council Bluffs, United States, ASN15169 (GOOGLE, US),
Reverse DNS
96.108.238.35.bc.googleusercontent.com
Software
Apache /
Resource Hash

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://weset-authty91.myvnc.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date
Sat, 19 Mar 2022 17:58:11 GMT
Server
Apache
Connection
Keep-Alive
Keep-Alive
timeout=5, max=99
Content-Length
315
Content-Type
text/html; charset=iso-8859-1
Primary Request /
weset-authty91.myvnc.com/Login/ 		385 KB
386 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://weset-authty91.myvnc.com/Login/?token=
Requested by
Host: weset-authty91.myvnc.com
URL: https://weset-authty91.myvnc.com/
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
35.238.108.96 Council Bluffs, United States, ASN15169 (GOOGLE, US),
Reverse DNS
96.108.238.35.bc.googleusercontent.com
Software
Apache /
Resource Hash
176078acf95925030c4e9b30530e20df88d737449b844668c3e92ba6824667f0

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Referer
https://weset-authty91.myvnc.com/

Response headers

Date
Sat, 19 Mar 2022 17:58:13 GMT
Server
Apache
Expires
Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control
no-store, no-cache, must-revalidate
Pragma
no-cache
Keep-Alive
timeout=5, max=98
Connection
Keep-Alive
Transfer-Encoding
chunked
Content-Type
text/html; charset=UTF-8
cool-2.1.15.min.js
nebula-cdn.kampyle.com/resources/onsite/js/ 		14 KB
5 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://nebula-cdn.kampyle.com/resources/onsite/js/cool-2.1.15.min.js
Requested by
Host: weset-authty91.myvnc.com
URL: https://weset-authty91.myvnc.com/Login/?token=
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.129.175 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
3e72de5de67d6d80b65a114af684eaf880c53c250155a663cb17d677ff064bc1

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://weset-authty91.myvnc.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

x-amz-version-id
9HCXbKZTbCJZkS8s9IuB.pE0JEvI0TGW
content-encoding
gzip
etag
"80dd5e3be5152c5c72d552c6a26ef6ff"
age
153076
via
1.1 varnish
x-cache
HIT
content-length
5197
x-amz-id-2
cv5VPIGCLLcXtswk37oaFl4fBbweUeVQHYrMuBMn+c9sgiGiJKp9+J3PzqI9Db3Up4e5W4lD9Ko=
x-served-by
cache-hhn4081-HHN
last-modified
Sun, 24 Jan 2021 11:03:10 GMT
server
AmazonS3
x-timer
S1647712693.365711,VS0,VE0
date
Sat, 19 Mar 2022 17:58:13 GMT
vary
Accept-Encoding
x-amz-request-id
TJ8QGVFCE6QYVTNF
access-control-allow-origin
*
cache-control
max-age=31622400
accept-ranges
bytes
content-type
application/javascript
x-cache-hits
9544
js
www.googletagmanager.com/gtag/ 		99 KB
40 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagmanager.com/gtag/js?id=AW-916451471
Requested by
Host: weset-authty91.myvnc.com
URL: https://weset-authty91.myvnc.com/Login/?token=
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:808::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
62d78d13e0d580d2235c1000802dd97b9330b682302f1b48e842003ce8c6db9d
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://weset-authty91.myvnc.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date
Sat, 19 Mar 2022 17:58:13 GMT
content-encoding
br
vary
Accept-Encoding
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
40264
x-xss-protection
0
last-modified
Sat, 19 Mar 2022 15:00:00 GMT
server
Google Tag Manager
strict-transport-security
max-age=31536000; includeSubDomains
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
access-control-allow-headers
Cache-Control
expires
Sat, 19 Mar 2022 17:58:13 GMT
bk-coretag.js
tags.bkrtx.com/js/ 		51 KB
16 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tags.bkrtx.com/js/bk-coretag.js
Requested by
Host: weset-authty91.myvnc.com
URL: https://weset-authty91.myvnc.com/Login/?token=
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.111.228.137 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-111-228-137.deploy.static.akamaitechnologies.com
Software
nginx/1.15.8 /
Resource Hash
88cd43c3f5453f7b4db2cbe884b47db3c8317860a2ce6e9b2bc934ff4b8e32eb
Security Headers
Name Value
Strict-Transport-Security max-age=15724800; includeSubDomains

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://weset-authty91.myvnc.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Strict-Transport-Security
max-age=15724800; includeSubDomains
Content-Encoding
gzip
Last-Modified
Fri, 21 May 2021 19:14:21 GMT
Server
nginx/1.15.8
ETag
W/"60a8068d-cbc2"
Vary
Accept-Encoding
Content-Type
application/javascript
Cache-Control
max-age=604800
Date
Sat, 19 Mar 2022 17:58:14 GMT
Connection
keep-alive
Content-Length
16078
Expires
Sat, 26 Mar 2022 17:58:14 GMT
Bootstrap.js
weset-authty91.myvnc.com/Login/js/ 		280 KB
280 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://weset-authty91.myvnc.com/Login/js/Bootstrap.js
Requested by
Host: weset-authty91.myvnc.com
URL: https://weset-authty91.myvnc.com/Login/?token=
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
35.238.108.96 Council Bluffs, United States, ASN15169 (GOOGLE, US),
Reverse DNS
96.108.238.35.bc.googleusercontent.com
Software
Apache /
Resource Hash
c73e69a929ce513e05bba4a3359296cf41064aaff3355d900b971ca39175a935
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://weset-authty91.myvnc.com/Login/?token=
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date
Sat, 19 Mar 2022 17:58:13 GMT
X-Content-Type-Options
nosniff
Last-Modified
Sat, 19 Mar 2022 13:52:18 GMT
Server
Apache
Content-Type
application/javascript
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=100
Content-Length
286351
X-XSS-Protection
1; mode=block
Interstate-Light.woff
weset-authty91.myvnc.com/Login/css/ 		74 KB
74 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://weset-authty91.myvnc.com/Login/css/Interstate-Light.woff
Requested by
Host: weset-authty91.myvnc.com
URL: https://weset-authty91.myvnc.com/Login/?token=
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
35.238.108.96 Council Bluffs, United States, ASN15169 (GOOGLE, US),
Reverse DNS
96.108.238.35.bc.googleusercontent.com
Software
Apache /
Resource Hash
f327a0ba3e41b1e8154e1c18fc114baff0bd057151e3afe7fa6f33cc0cb18296
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://weset-authty91.myvnc.com/Login/?token=
Origin
https://weset-authty91.myvnc.com
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date
Sat, 19 Mar 2022 17:58:13 GMT
X-Content-Type-Options
nosniff
Last-Modified
Sat, 19 Mar 2022 13:52:14 GMT
Server
Apache
Content-Type
font/woff
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=100
Content-Length
75538
X-XSS-Protection
1; mode=block
Interstate-Bold.woff
weset-authty91.myvnc.com/Login/css/ 		70 KB
70 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://weset-authty91.myvnc.com/Login/css/Interstate-Bold.woff
Requested by
Host: weset-authty91.myvnc.com
URL: https://weset-authty91.myvnc.com/Login/?token=
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
35.238.108.96 Council Bluffs, United States, ASN15169 (GOOGLE, US),
Reverse DNS
96.108.238.35.bc.googleusercontent.com
Software
Apache /
Resource Hash
e9e9a67395a0d83b584208a19b95af203df8e8e6c6952fe76c690d60ea9381c7
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://weset-authty91.myvnc.com/Login/?token=
Origin
https://weset-authty91.myvnc.com
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date
Sat, 19 Mar 2022 17:58:13 GMT
X-Content-Type-Options
nosniff
Last-Modified
Sat, 19 Mar 2022 13:52:14 GMT
Server
Apache
Content-Type
font/woff
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=100
Content-Length
71874
X-XSS-Protection
1; mode=block
Interstate-Regular.woff
weset-authty91.myvnc.com/Login/css/ 		77 KB
77 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://weset-authty91.myvnc.com/Login/css/Interstate-Regular.woff
Requested by
Host: weset-authty91.myvnc.com
URL: https://weset-authty91.myvnc.com/Login/?token=
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
35.238.108.96 Council Bluffs, United States, ASN15169 (GOOGLE, US),
Reverse DNS
96.108.238.35.bc.googleusercontent.com
Software
Apache /
Resource Hash
045cd226594cb32ddf9d4db8ee45611f4d0788675ae50180b68da975e66fe1fe
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://weset-authty91.myvnc.com/Login/?token=
Origin
https://weset-authty91.myvnc.com
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date
Sat, 19 Mar 2022 17:58:13 GMT
X-Content-Type-Options
nosniff
Last-Modified
Sat, 19 Mar 2022 13:52:14 GMT
Server
Apache
Content-Type
font/woff
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=100
Content-Length
78762
X-XSS-Protection
1; mode=block
conversion_async.js
www.googleadservices.com/pagead/ 		0
0
conversion_async.js
www.googleadservices.com/pagead/ 		0
0
conversion_async.js
www.googleadservices.com/pagead/ 		0
0
conversion_async.js
www.googleadservices.com/pagead/ 		0
0
conversion_async.js
www.googleadservices.com/pagead/ 		0
0
conversion_async.js
www.googleadservices.com/pagead/ 		0
0
conversion_async.js
www.googleadservices.com/pagead/ 		0
0
js
www.googletagmanager.com/gtag/ 		0
0
js
www.googletagmanager.com/gtag/ 		0
0
js
www.googletagmanager.com/gtag/ 		0
0
js
www.googletagmanager.com/gtag/ 		0
0
js
www.googletagmanager.com/gtag/ 		0
0
js
www.googletagmanager.com/gtag/ 		0
0
js
www.googletagmanager.com/gtag/ 		0
0
conversion_async.js
www.googleadservices.com/pagead/ 		0
0
1560.js
cdn.pbbl.co/r/ 		0
0
d139e7d35fc18934e03ae7d1eb3769bf.js
nexus.ensighten.com/citi/na_prod/code/ 		0
0
51aba9f62787efbaa13e53a8d1ae3892.js
nexus.ensighten.com/citi/na_prod/code/ 		0
0
c942fa5b036f63cf515027e22894e5aa.js
nexus.ensighten.com/citi/na_prod/code/ 		0
0
557566dc60916e3de69e006bef252459.js
nexus.ensighten.com/citi/na_prod/code/ 		0
0
42d4d669434e7d621371bd59ca097dbf.js
nexus.ensighten.com/citi/na_prod/code/ 		0
0
fdf45a7c15c1cee06bb71e10dac4e26e.js
nexus.ensighten.com/citi/na_prod/code/ 		0
0
serverComponent.php
nexus.ensighten.com/citi/na_prod/ 		0
0
styles.css
weset-authty91.myvnc.com/Login/css/ 		1 MB
1 MB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://weset-authty91.myvnc.com/Login/css/styles.css
Requested by
Host: weset-authty91.myvnc.com
URL: https://weset-authty91.myvnc.com/Login/?token=
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
35.238.108.96 Council Bluffs, United States, ASN15169 (GOOGLE, US),
Reverse DNS
96.108.238.35.bc.googleusercontent.com
Software
Apache /
Resource Hash
70f3cacfaa80a9d270cf98ce26fef532b1004bc471a20611f35bc70cd6d8d899
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://weset-authty91.myvnc.com/Login/?token=
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date
Sat, 19 Mar 2022 17:58:13 GMT
X-Content-Type-Options
nosniff
Last-Modified
Sat, 19 Mar 2022 13:52:18 GMT
Server
Apache
Content-Type
text/css
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=100
Content-Length
1388422
X-XSS-Protection
1; mode=block
embed.js
resources.digital-cloud-citi.medallia.com/wdcusciti/50/onsite/ 		2 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://resources.digital-cloud-citi.medallia.com/wdcusciti/50/onsite/embed.js
Requested by
Host: weset-authty91.myvnc.com
URL: https://weset-authty91.myvnc.com/Login/?token=
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.130.133 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
b5d1c26722742c44e62a4fbb4b67117d2587aa320f61784a27fea9d66d9f62b4

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://weset-authty91.myvnc.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

x-amz-version-id
7ZFGbm5gfkxV.pQuBY8LWu5zWeTQ0IFs
content-encoding
gzip
etag
"a698e80bc62ebcae5d8ef95ef0d2804d"
age
152994
via
1.1 varnish
x-cache
HIT
content-length
675
x-amz-id-2
1XLSeoD4keLyBShD19j9JKoeR5e3nLPzbAPB+lRsD0fOonUG8J6mykBjsS8p324xZzokDI5OIUk=
x-served-by
cache-hhn4055-HHN
last-modified
Fri, 25 Feb 2022 18:17:26 GMT
server
AmazonS3
x-timer
S1647712694.782623,VS0,VE0
date
Sat, 19 Mar 2022 17:58:13 GMT
vary
Accept-Encoding
x-amz-request-id
1G43Y9X616R781AH
access-control-allow-origin
*
cache-control
max-age=0,must-revalidate
accept-ranges
bytes
content-type
application/javascript
x-cache-hits
89
/
googleads.g.doubleclick.net/pagead/viewthroughconversion/916451471/ 		3 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://googleads.g.doubleclick.net/pagead/viewthroughconversion/916451471/?random=1642148921171&cv=9&fst=1642148921171&num=1&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=864&u_w=1536&u_ah=824&u_aw=1536&u_cd=24&u_his=9&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa1c0&sendb=1&ig=1&data=event%3Dgtag.config&frm=0&url=http%3A%2F%2Flocalhost%2Fskemas%2FCiti%2520antis%2520upgraded%2520%40VixxxYZ%2Flogin%2Fses%2F%3Fresponse_type%3Dcode%26client_id%3DMOBI%2540AMER.OAUTHAP%26Auth_key%3D6a09773ace2bd074cd40eceabfc311eaa037e8a2&ref=http%3A%2F%2Flocalhost%2Fskemas%2FCiti%2520antis%2520upgraded%2520%40VixxxYZ%2F&tiba=Sign%20On%20to%20Your%20Citi%20Account%20-%20Citibank&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4
Requested by
Host: weset-authty91.myvnc.com
URL: https://weset-authty91.myvnc.com/Login/?token=
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:400e:811::2002 , Ireland, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
b11b99679f35612b35b8c414c153285ebf576bf884bcf1282aa6a3b77e85205c
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://weset-authty91.myvnc.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma
no-cache
date
Sat, 19 Mar 2022 17:58:13 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
content-type
text/javascript; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
1183
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
googleads.g.doubleclick.net/pagead/viewthroughconversion/960621875/ 		3 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://googleads.g.doubleclick.net/pagead/viewthroughconversion/960621875/?random=1642148921263&cv=9&fst=1642148921263&num=1&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=864&u_w=1536&u_ah=824&u_aw=1536&u_cd=24&u_his=9&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa1c0&sendb=1&ig=1&data=event%3Dgtag.config&frm=0&url=http%3A%2F%2Flocalhost%2Fskemas%2FCiti%2520antis%2520upgraded%2520%40VixxxYZ%2Flogin%2Fses%2F%3Fresponse_type%3Dcode%26client_id%3DMOBI%2540AMER.OAUTHAP%26Auth_key%3D6a09773ace2bd074cd40eceabfc311eaa037e8a2&ref=http%3A%2F%2Flocalhost%2Fskemas%2FCiti%2520antis%2520upgraded%2520%40VixxxYZ%2F&tiba=Sign%20On%20to%20Your%20Citi%20Account%20-%20Citibank&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4
Requested by
Host: weset-authty91.myvnc.com
URL: https://weset-authty91.myvnc.com/Login/?token=
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:400e:811::2002 , Ireland, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
6936889e6ea8d99c5d944f2ee9ad7461bdfb61e4bca4adf6dae9e177ac847ad1
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://weset-authty91.myvnc.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma
no-cache
date
Sat, 19 Mar 2022 17:58:13 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
content-type
text/javascript; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
1182
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
googleads.g.doubleclick.net/pagead/viewthroughconversion/644574043/ 		3 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://googleads.g.doubleclick.net/pagead/viewthroughconversion/644574043/?random=1642148921305&cv=9&fst=1642148921305&num=1&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&eid=376635471&u_h=864&u_w=1536&u_ah=824&u_aw=1536&u_cd=24&u_his=9&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa1c0&sendb=1&ig=1&data=event%3Dgtag.config&frm=0&url=http%3A%2F%2Flocalhost%2Fskemas%2FCiti%2520antis%2520upgraded%2520%40VixxxYZ%2Flogin%2Fses%2F%3Fresponse_type%3Dcode%26client_id%3DMOBI%2540AMER.OAUTHAP%26Auth_key%3D6a09773ace2bd074cd40eceabfc311eaa037e8a2&ref=http%3A%2F%2Flocalhost%2Fskemas%2FCiti%2520antis%2520upgraded%2520%40VixxxYZ%2F&tiba=Sign%20On%20to%20Your%20Citi%20Account%20-%20Citibank&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4
Requested by
Host: weset-authty91.myvnc.com
URL: https://weset-authty91.myvnc.com/Login/?token=
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:400e:811::2002 , Ireland, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
e8a4294485eefbee4926ba6ff593a7628233c0909ed58bb16e7b63c8bc63ba7a
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://weset-authty91.myvnc.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma
no-cache
date
Sat, 19 Mar 2022 17:58:13 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
content-type
text/javascript; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
1191
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
googleads.g.doubleclick.net/pagead/viewthroughconversion/975701947/ 		3 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://googleads.g.doubleclick.net/pagead/viewthroughconversion/975701947/?random=1642148921445&cv=9&fst=1642148921445&num=1&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=864&u_w=1536&u_ah=824&u_aw=1536&u_cd=24&u_his=9&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa1c0&sendb=1&ig=1&data=event%3Dgtag.config&frm=0&url=http%3A%2F%2Flocalhost%2Fskemas%2FCiti%2520antis%2520upgraded%2520%40VixxxYZ%2Flogin%2Fses%2F%3Fresponse_type%3Dcode%26client_id%3DMOBI%2540AMER.OAUTHAP%26Auth_key%3D6a09773ace2bd074cd40eceabfc311eaa037e8a2&ref=http%3A%2F%2Flocalhost%2Fskemas%2FCiti%2520antis%2520upgraded%2520%40VixxxYZ%2F&tiba=Sign%20On%20to%20Your%20Citi%20Account%20-%20Citibank&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4
Requested by
Host: weset-authty91.myvnc.com
URL: https://weset-authty91.myvnc.com/Login/?token=
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:400e:811::2002 , Ireland, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
19ef71e61ea260132de754bad941bd81341a25572a3b70247feca472245e8069
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://weset-authty91.myvnc.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma
no-cache
date
Sat, 19 Mar 2022 17:58:13 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
content-type
text/javascript; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
1183
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
googleads.g.doubleclick.net/pagead/viewthroughconversion/830907969/ 		3 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://googleads.g.doubleclick.net/pagead/viewthroughconversion/830907969/?random=1642148921448&cv=9&fst=1642148921448&num=1&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=864&u_w=1536&u_ah=824&u_aw=1536&u_cd=24&u_his=9&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa1c0&sendb=1&ig=1&data=event%3Dgtag.config&frm=0&url=http%3A%2F%2Flocalhost%2Fskemas%2FCiti%2520antis%2520upgraded%2520%40VixxxYZ%2Flogin%2Fses%2F%3Fresponse_type%3Dcode%26client_id%3DMOBI%2540AMER.OAUTHAP%26Auth_key%3D6a09773ace2bd074cd40eceabfc311eaa037e8a2&ref=http%3A%2F%2Flocalhost%2Fskemas%2FCiti%2520antis%2520upgraded%2520%40VixxxYZ%2F&tiba=Sign%20On%20to%20Your%20Citi%20Account%20-%20Citibank&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4
Requested by
Host: weset-authty91.myvnc.com
URL: https://weset-authty91.myvnc.com/Login/?token=
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:400e:811::2002 , Ireland, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
59ba550db7e458d068158c106f1ed530820894bd8fc4a4c0cbad2ba9830ac4fa
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://weset-authty91.myvnc.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma
no-cache
date
Sat, 19 Mar 2022 17:58:13 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
content-type
text/javascript; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
1180
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
googleads.g.doubleclick.net/pagead/viewthroughconversion/695231162/ 		3 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://googleads.g.doubleclick.net/pagead/viewthroughconversion/695231162/?random=1642148921829&cv=9&fst=1642148921829&num=1&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=864&u_w=1536&u_ah=824&u_aw=1536&u_cd=24&u_his=9&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa1c0&sendb=1&ig=1&data=event%3Dgtag.config&frm=0&url=http%3A%2F%2Flocalhost%2Fskemas%2FCiti%2520antis%2520upgraded%2520%40VixxxYZ%2Flogin%2Fses%2F%3Fresponse_type%3Dcode%26client_id%3DMOBI%2540AMER.OAUTHAP%26Auth_key%3D6a09773ace2bd074cd40eceabfc311eaa037e8a2&ref=http%3A%2F%2Flocalhost%2Fskemas%2FCiti%2520antis%2520upgraded%2520%40VixxxYZ%2F&tiba=Sign%20On%20to%20Your%20Citi%20Account%20-%20Citibank&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4
Requested by
Host: weset-authty91.myvnc.com
URL: https://weset-authty91.myvnc.com/Login/?token=
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:400e:811::2002 , Ireland, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
240e5a83cdf55f2e51dc88202c4aec54ca03dc9ca7853be6a78baa6faf5e7399
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://weset-authty91.myvnc.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma
no-cache
date
Sat, 19 Mar 2022 17:58:13 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
content-type
text/javascript; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
1182
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
googleads.g.doubleclick.net/pagead/viewthroughconversion/819500023/ 		3 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://googleads.g.doubleclick.net/pagead/viewthroughconversion/819500023/?random=1642148922005&cv=9&fst=1642148922005&num=1&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=864&u_w=1536&u_ah=824&u_aw=1536&u_cd=24&u_his=9&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa1c0&sendb=1&ig=1&data=event%3Dgtag.config&frm=0&url=http%3A%2F%2Flocalhost%2Fskemas%2FCiti%2520antis%2520upgraded%2520%40VixxxYZ%2Flogin%2Fses%2F%3Fresponse_type%3Dcode%26client_id%3DMOBI%2540AMER.OAUTHAP%26Auth_key%3D6a09773ace2bd074cd40eceabfc311eaa037e8a2&ref=http%3A%2F%2Flocalhost%2Fskemas%2FCiti%2520antis%2520upgraded%2520%40VixxxYZ%2F&tiba=Sign%20On%20to%20Your%20Citi%20Account%20-%20Citibank&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4
Requested by
Host: weset-authty91.myvnc.com
URL: https://weset-authty91.myvnc.com/Login/?token=
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:400e:811::2002 , Ireland, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
cef1c9e6ac00420cb0924c80dc6bce5f3d8ac2322ac5fa0898ee81c4bb0246b0
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://weset-authty91.myvnc.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma
no-cache
date
Sat, 19 Mar 2022 17:58:13 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
content-type
text/javascript; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
1184
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
googleads.g.doubleclick.net/pagead/viewthroughconversion/959299794/ 		3 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://googleads.g.doubleclick.net/pagead/viewthroughconversion/959299794/?random=1642148922009&cv=9&fst=1642148922009&num=1&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=864&u_w=1536&u_ah=824&u_aw=1536&u_cd=24&u_his=9&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa1c0&sendb=1&ig=1&data=event%3Dgtag.config&frm=0&url=http%3A%2F%2Flocalhost%2Fskemas%2FCiti%2520antis%2520upgraded%2520%40VixxxYZ%2Flogin%2Fses%2F%3Fresponse_type%3Dcode%26client_id%3DMOBI%2540AMER.OAUTHAP%26Auth_key%3D6a09773ace2bd074cd40eceabfc311eaa037e8a2&ref=http%3A%2F%2Flocalhost%2Fskemas%2FCiti%2520antis%2520upgraded%2520%40VixxxYZ%2F&tiba=Sign%20On%20to%20Your%20Citi%20Account%20-%20Citibank&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4
Requested by
Host: weset-authty91.myvnc.com
URL: https://weset-authty91.myvnc.com/Login/?token=
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:400e:811::2002 , Ireland, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
305dc8e1830d85f5fae62d7d0f64bce480a9046f0901a50034d9051b5194a86e
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://weset-authty91.myvnc.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma
no-cache
date
Sat, 19 Mar 2022 17:58:13 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
content-type
text/javascript; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
1183
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
citipridelogo.jpg
weset-authty91.myvnc.com/Login/css/ 		3 KB
3 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://weset-authty91.myvnc.com/Login/css/citipridelogo.jpg
Requested by
Host: weset-authty91.myvnc.com
URL: https://weset-authty91.myvnc.com/Login/?token=
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
35.238.108.96 Council Bluffs, United States, ASN15169 (GOOGLE, US),
Reverse DNS
96.108.238.35.bc.googleusercontent.com
Software
Apache /
Resource Hash
f94cb7cab7413f3e828c469111e3f9ee7bf21ac163cea343be2cdef866160d40
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://weset-authty91.myvnc.com/Login/?token=
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date
Sat, 19 Mar 2022 17:58:14 GMT
X-Content-Type-Options
nosniff
Last-Modified
Sat, 19 Mar 2022 13:52:14 GMT
Server
Apache
Content-Type
image/jpeg
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=99
Content-Length
2658
X-XSS-Protection
1; mode=block
050-location@2x.svg
weset-authty91.myvnc.com/Login/css/ 		2 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://weset-authty91.myvnc.com/Login/css/050-location@2x.svg
Requested by
Host: weset-authty91.myvnc.com
URL: https://weset-authty91.myvnc.com/Login/?token=
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
35.238.108.96 Council Bluffs, United States, ASN15169 (GOOGLE, US),
Reverse DNS
96.108.238.35.bc.googleusercontent.com
Software
Apache /
Resource Hash
6336ae7b60dff18e0a37721a3a19fd5e18568577a64faa662969d35966dbf72b
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://weset-authty91.myvnc.com/Login/?token=
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date
Sat, 19 Mar 2022 17:58:14 GMT
X-Content-Type-Options
nosniff
Last-Modified
Sat, 19 Mar 2022 13:52:14 GMT
Server
Apache
Content-Type
image/svg+xml
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=98
Content-Length
1752
X-XSS-Protection
1; mode=block
icon_globe_med-grey@2x.svg
weset-authty91.myvnc.com/Login/css/ 		3 KB
4 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://weset-authty91.myvnc.com/Login/css/icon_globe_med-grey@2x.svg
Requested by
Host: weset-authty91.myvnc.com
URL: https://weset-authty91.myvnc.com/Login/?token=
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
35.238.108.96 Council Bluffs, United States, ASN15169 (GOOGLE, US),
Reverse DNS
96.108.238.35.bc.googleusercontent.com
Software
Apache /
Resource Hash
a593628f2d5ba814f37fbcd3963162f094c2764d4b15d82464c2d1aef92f150f
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://weset-authty91.myvnc.com/Login/?token=
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date
Sat, 19 Mar 2022 17:58:14 GMT
X-Content-Type-Options
nosniff
Last-Modified
Sat, 19 Mar 2022 13:52:14 GMT
Server
Apache
Content-Type
image/svg+xml
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=99
Content-Length
3523
X-XSS-Protection
1; mode=block
320_Citi-PLT@3x.png
weset-authty91.myvnc.com/Login/css/ 		11 KB
12 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://weset-authty91.myvnc.com/Login/css/320_Citi-PLT@3x.png
Requested by
Host: weset-authty91.myvnc.com
URL: https://weset-authty91.myvnc.com/Login/?token=
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
35.238.108.96 Council Bluffs, United States, ASN15169 (GOOGLE, US),
Reverse DNS
96.108.238.35.bc.googleusercontent.com
Software
Apache /
Resource Hash
f378974fe6a831ae2f48d9191ea74eb21877d4964d5eedbc2810d8756ed13631
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://weset-authty91.myvnc.com/Login/?token=
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date
Sat, 19 Mar 2022 17:58:14 GMT
X-Content-Type-Options
nosniff
Last-Modified
Sat, 19 Mar 2022 13:52:14 GMT
Server
Apache
Content-Type
image/png
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=97
Content-Length
11562
X-XSS-Protection
1; mode=block
1440_Citi-PLT@3x.png
weset-authty91.myvnc.com/Login/css/ 		27 KB
28 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://weset-authty91.myvnc.com/Login/css/1440_Citi-PLT@3x.png
Requested by
Host: weset-authty91.myvnc.com
URL: https://weset-authty91.myvnc.com/Login/?token=
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
35.238.108.96 Council Bluffs, United States, ASN15169 (GOOGLE, US),
Reverse DNS
96.108.238.35.bc.googleusercontent.com
Software
Apache /
Resource Hash
6dfa343a68ef79e83fef5f7c705119d2473352190c609cf94c67ea99a29fa452
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://weset-authty91.myvnc.com/Login/?token=
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date
Sat, 19 Mar 2022 17:58:14 GMT
X-Content-Type-Options
nosniff
Last-Modified
Sat, 19 Mar 2022 13:52:14 GMT
Server
Apache
Content-Type
image/png
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=99
Content-Length
28149
X-XSS-Protection
1; mode=block
e.gif
nexus.ensighten.com/error/ 		0
107 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://nexus.ensighten.com/error/e.gif?msg=_dl%20is%20not%20defined&lnn=-1&fn=&cid=1129&client=citi&publishPath=na_prod&rid=3092996&did=622672&errorName=ReferenceError
Requested by
Host: weset-authty91.myvnc.com
URL: https://weset-authty91.myvnc.com/Login/?token=
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
18.195.42.228 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-18-195-42-228.eu-central-1.compute.amazonaws.com
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://weset-authty91.myvnc.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date
Sat, 19 Mar 2022 17:58:14 GMT
cache-control
no-cache, no-store
server
nginx
expires
Sat, 19 Mar 2022 17:58:13 GMT
serverComponent.php
nexus.ensighten.com/citi/na_prod/ 		1 KB
740 B 		Script
General
Check archive.org
Download Go to
Full URL
https://nexus.ensighten.com/citi/na_prod/serverComponent.php?r=3219346.3500356455&namespace=Bootstrapper&staticJsPath=nexus.ensighten.com/citi/na_prod/code/&publishedOn=Tue%20Jun%2008%2018:03:25%20GMT%202021&ClientID=1129&PageID=https%3A%2F%2Fweset-authty91.myvnc.com%2FLogin%2F%3Ftoken%3D
Requested by
Host: weset-authty91.myvnc.com
URL: https://weset-authty91.myvnc.com/Login/js/Bootstrap.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
18.195.42.228 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-18-195-42-228.eu-central-1.compute.amazonaws.com
Software
nginx /
Resource Hash
f0ce519069b75d94b29fec0deddd946a57d65b8fb49824ffc0157c634aa203c8

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://weset-authty91.myvnc.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date
Sat, 19 Mar 2022 17:58:14 GMT
cache-control
no-cache, no-store
content-type
text/javascript
server
nginx
content-encoding
gzip
vary
Accept-Encoding
expires
Sat, 19 Mar 2022 17:58:13 GMT
/
www.google.com/pagead/1p-user-list/916451471/ 		42 B
108 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.com/pagead/1p-user-list/916451471/?random=1642148921171&cv=9&fst=1642147200000&num=1&bg=ffffff&guid=ON&u_h=864&u_w=1536&u_ah=824&u_aw=1536&u_cd=24&u_his=9&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa1c0&sendb=1&data=event%3Dgtag.config&frm=0&url=http%3A%2F%2Flocalhost%2Fskemas%2FCiti%2520antis%2520upgraded%2520%40VixxxYZ%2Flogin%2Fses%2F%3Fresponse_type%3Dcode%26client_id%3DMOBI%2540AMER.OAUTHAP%26Auth_key%3D6a09773ace2bd074cd40eceabfc311eaa037e8a2&ref=http%3A%2F%2Flocalhost%2Fskemas%2FCiti%2520antis%2520upgraded%2520%40VixxxYZ%2F&tiba=Sign%20On%20to%20Your%20Citi%20Account%20-%20Citibank&async=1&fmt=3&is_vtc=1&random=2940674635&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y
Requested by
Host: weset-authty91.myvnc.com
URL: https://weset-authty91.myvnc.com/Login/?token=
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82b::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://weset-authty91.myvnc.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma
no-cache
date
Sat, 19 Mar 2022 17:58:14 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
content-security-policy
script-src 'none'; object-src 'none'
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
www.google.de/pagead/1p-user-list/916451471/ 		42 B
108 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.de/pagead/1p-user-list/916451471/?random=1642148921171&cv=9&fst=1642147200000&num=1&bg=ffffff&guid=ON&u_h=864&u_w=1536&u_ah=824&u_aw=1536&u_cd=24&u_his=9&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa1c0&sendb=1&data=event%3Dgtag.config&frm=0&url=http%3A%2F%2Flocalhost%2Fskemas%2FCiti%2520antis%2520upgraded%2520%40VixxxYZ%2Flogin%2Fses%2F%3Fresponse_type%3Dcode%26client_id%3DMOBI%2540AMER.OAUTHAP%26Auth_key%3D6a09773ace2bd074cd40eceabfc311eaa037e8a2&ref=http%3A%2F%2Flocalhost%2Fskemas%2FCiti%2520antis%2520upgraded%2520%40VixxxYZ%2F&tiba=Sign%20On%20to%20Your%20Citi%20Account%20-%20Citibank&async=1&fmt=3&is_vtc=1&random=2940674635&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y
Requested by
Host: weset-authty91.myvnc.com
URL: https://weset-authty91.myvnc.com/Login/?token=
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://weset-authty91.myvnc.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma
no-cache
date
Sat, 19 Mar 2022 17:58:14 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
content-security-policy
script-src 'none'; object-src 'none'
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
www.google.com/pagead/1p-user-list/960621875/ 		42 B
108 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.com/pagead/1p-user-list/960621875/?random=1642148921263&cv=9&fst=1642147200000&num=1&bg=ffffff&guid=ON&u_h=864&u_w=1536&u_ah=824&u_aw=1536&u_cd=24&u_his=9&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa1c0&sendb=1&data=event%3Dgtag.config&frm=0&url=http%3A%2F%2Flocalhost%2Fskemas%2FCiti%2520antis%2520upgraded%2520%40VixxxYZ%2Flogin%2Fses%2F%3Fresponse_type%3Dcode%26client_id%3DMOBI%2540AMER.OAUTHAP%26Auth_key%3D6a09773ace2bd074cd40eceabfc311eaa037e8a2&ref=http%3A%2F%2Flocalhost%2Fskemas%2FCiti%2520antis%2520upgraded%2520%40VixxxYZ%2F&tiba=Sign%20On%20to%20Your%20Citi%20Account%20-%20Citibank&async=1&fmt=3&is_vtc=1&random=1891635433&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y
Requested by
Host: weset-authty91.myvnc.com
URL: https://weset-authty91.myvnc.com/Login/?token=
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82b::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://weset-authty91.myvnc.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma
no-cache
date
Sat, 19 Mar 2022 17:58:14 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
content-security-policy
script-src 'none'; object-src 'none'
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
www.google.de/pagead/1p-user-list/960621875/ 		42 B
108 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.de/pagead/1p-user-list/960621875/?random=1642148921263&cv=9&fst=1642147200000&num=1&bg=ffffff&guid=ON&u_h=864&u_w=1536&u_ah=824&u_aw=1536&u_cd=24&u_his=9&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa1c0&sendb=1&data=event%3Dgtag.config&frm=0&url=http%3A%2F%2Flocalhost%2Fskemas%2FCiti%2520antis%2520upgraded%2520%40VixxxYZ%2Flogin%2Fses%2F%3Fresponse_type%3Dcode%26client_id%3DMOBI%2540AMER.OAUTHAP%26Auth_key%3D6a09773ace2bd074cd40eceabfc311eaa037e8a2&ref=http%3A%2F%2Flocalhost%2Fskemas%2FCiti%2520antis%2520upgraded%2520%40VixxxYZ%2F&tiba=Sign%20On%20to%20Your%20Citi%20Account%20-%20Citibank&async=1&fmt=3&is_vtc=1&random=1891635433&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y
Requested by
Host: weset-authty91.myvnc.com
URL: https://weset-authty91.myvnc.com/Login/?token=
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://weset-authty91.myvnc.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma
no-cache
date
Sat, 19 Mar 2022 17:58:14 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
content-security-policy
script-src 'none'; object-src 'none'
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
www.google.com/pagead/1p-user-list/644574043/ 		42 B
548 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.com/pagead/1p-user-list/644574043/?random=1642148921305&cv=9&fst=1642147200000&num=1&bg=ffffff&guid=ON&eid=376635471&u_h=864&u_w=1536&u_ah=824&u_aw=1536&u_cd=24&u_his=9&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa1c0&sendb=1&data=event%3Dgtag.config&frm=0&url=http%3A%2F%2Flocalhost%2Fskemas%2FCiti%2520antis%2520upgraded%2520%40VixxxYZ%2Flogin%2Fses%2F%3Fresponse_type%3Dcode%26client_id%3DMOBI%2540AMER.OAUTHAP%26Auth_key%3D6a09773ace2bd074cd40eceabfc311eaa037e8a2&ref=http%3A%2F%2Flocalhost%2Fskemas%2FCiti%2520antis%2520upgraded%2520%40VixxxYZ%2F&tiba=Sign%20On%20to%20Your%20Citi%20Account%20-%20Citibank&async=1&fmt=3&is_vtc=1&random=365451271&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y
Requested by
Host: weset-authty91.myvnc.com
URL: https://weset-authty91.myvnc.com/Login/?token=
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82b::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://weset-authty91.myvnc.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma
no-cache
date
Sat, 19 Mar 2022 17:58:14 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
content-security-policy
script-src 'none'; object-src 'none'
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
www.google.de/pagead/1p-user-list/644574043/ 		42 B
108 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.de/pagead/1p-user-list/644574043/?random=1642148921305&cv=9&fst=1642147200000&num=1&bg=ffffff&guid=ON&eid=376635471&u_h=864&u_w=1536&u_ah=824&u_aw=1536&u_cd=24&u_his=9&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa1c0&sendb=1&data=event%3Dgtag.config&frm=0&url=http%3A%2F%2Flocalhost%2Fskemas%2FCiti%2520antis%2520upgraded%2520%40VixxxYZ%2Flogin%2Fses%2F%3Fresponse_type%3Dcode%26client_id%3DMOBI%2540AMER.OAUTHAP%26Auth_key%3D6a09773ace2bd074cd40eceabfc311eaa037e8a2&ref=http%3A%2F%2Flocalhost%2Fskemas%2FCiti%2520antis%2520upgraded%2520%40VixxxYZ%2F&tiba=Sign%20On%20to%20Your%20Citi%20Account%20-%20Citibank&async=1&fmt=3&is_vtc=1&random=365451271&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y
Requested by
Host: weset-authty91.myvnc.com
URL: https://weset-authty91.myvnc.com/Login/?token=
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://weset-authty91.myvnc.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma
no-cache
date
Sat, 19 Mar 2022 17:58:14 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
content-security-policy
script-src 'none'; object-src 'none'
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
www.google.com/pagead/1p-user-list/975701947/ 		42 B
108 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.com/pagead/1p-user-list/975701947/?random=1642148921445&cv=9&fst=1642147200000&num=1&bg=ffffff&guid=ON&u_h=864&u_w=1536&u_ah=824&u_aw=1536&u_cd=24&u_his=9&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa1c0&sendb=1&data=event%3Dgtag.config&frm=0&url=http%3A%2F%2Flocalhost%2Fskemas%2FCiti%2520antis%2520upgraded%2520%40VixxxYZ%2Flogin%2Fses%2F%3Fresponse_type%3Dcode%26client_id%3DMOBI%2540AMER.OAUTHAP%26Auth_key%3D6a09773ace2bd074cd40eceabfc311eaa037e8a2&ref=http%3A%2F%2Flocalhost%2Fskemas%2FCiti%2520antis%2520upgraded%2520%40VixxxYZ%2F&tiba=Sign%20On%20to%20Your%20Citi%20Account%20-%20Citibank&async=1&fmt=3&is_vtc=1&random=609867887&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y
Requested by
Host: weset-authty91.myvnc.com
URL: https://weset-authty91.myvnc.com/Login/?token=
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82b::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://weset-authty91.myvnc.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma
no-cache
date
Sat, 19 Mar 2022 17:58:14 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
content-security-policy
script-src 'none'; object-src 'none'
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
www.google.de/pagead/1p-user-list/975701947/ 		42 B
548 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.de/pagead/1p-user-list/975701947/?random=1642148921445&cv=9&fst=1642147200000&num=1&bg=ffffff&guid=ON&u_h=864&u_w=1536&u_ah=824&u_aw=1536&u_cd=24&u_his=9&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa1c0&sendb=1&data=event%3Dgtag.config&frm=0&url=http%3A%2F%2Flocalhost%2Fskemas%2FCiti%2520antis%2520upgraded%2520%40VixxxYZ%2Flogin%2Fses%2F%3Fresponse_type%3Dcode%26client_id%3DMOBI%2540AMER.OAUTHAP%26Auth_key%3D6a09773ace2bd074cd40eceabfc311eaa037e8a2&ref=http%3A%2F%2Flocalhost%2Fskemas%2FCiti%2520antis%2520upgraded%2520%40VixxxYZ%2F&tiba=Sign%20On%20to%20Your%20Citi%20Account%20-%20Citibank&async=1&fmt=3&is_vtc=1&random=609867887&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y
Requested by
Host: weset-authty91.myvnc.com
URL: https://weset-authty91.myvnc.com/Login/?token=
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://weset-authty91.myvnc.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma
no-cache
date
Sat, 19 Mar 2022 17:58:14 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
content-security-policy
script-src 'none'; object-src 'none'
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
www.google.com/pagead/1p-user-list/830907969/ 		42 B
108 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.com/pagead/1p-user-list/830907969/?random=1642148921448&cv=9&fst=1642147200000&num=1&bg=ffffff&guid=ON&u_h=864&u_w=1536&u_ah=824&u_aw=1536&u_cd=24&u_his=9&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa1c0&sendb=1&data=event%3Dgtag.config&frm=0&url=http%3A%2F%2Flocalhost%2Fskemas%2FCiti%2520antis%2520upgraded%2520%40VixxxYZ%2Flogin%2Fses%2F%3Fresponse_type%3Dcode%26client_id%3DMOBI%2540AMER.OAUTHAP%26Auth_key%3D6a09773ace2bd074cd40eceabfc311eaa037e8a2&ref=http%3A%2F%2Flocalhost%2Fskemas%2FCiti%2520antis%2520upgraded%2520%40VixxxYZ%2F&tiba=Sign%20On%20to%20Your%20Citi%20Account%20-%20Citibank&async=1&fmt=3&is_vtc=1&random=3782744288&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y
Requested by
Host: weset-authty91.myvnc.com
URL: https://weset-authty91.myvnc.com/Login/?token=
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82b::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://weset-authty91.myvnc.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma
no-cache
date
Sat, 19 Mar 2022 17:58:14 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
content-security-policy
script-src 'none'; object-src 'none'
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
www.google.de/pagead/1p-user-list/830907969/ 		42 B
108 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.de/pagead/1p-user-list/830907969/?random=1642148921448&cv=9&fst=1642147200000&num=1&bg=ffffff&guid=ON&u_h=864&u_w=1536&u_ah=824&u_aw=1536&u_cd=24&u_his=9&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa1c0&sendb=1&data=event%3Dgtag.config&frm=0&url=http%3A%2F%2Flocalhost%2Fskemas%2FCiti%2520antis%2520upgraded%2520%40VixxxYZ%2Flogin%2Fses%2F%3Fresponse_type%3Dcode%26client_id%3DMOBI%2540AMER.OAUTHAP%26Auth_key%3D6a09773ace2bd074cd40eceabfc311eaa037e8a2&ref=http%3A%2F%2Flocalhost%2Fskemas%2FCiti%2520antis%2520upgraded%2520%40VixxxYZ%2F&tiba=Sign%20On%20to%20Your%20Citi%20Account%20-%20Citibank&async=1&fmt=3&is_vtc=1&random=3782744288&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y
Requested by
Host: weset-authty91.myvnc.com
URL: https://weset-authty91.myvnc.com/Login/?token=
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://weset-authty91.myvnc.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma
no-cache
date
Sat, 19 Mar 2022 17:58:14 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
content-security-policy
script-src 'none'; object-src 'none'
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
www.google.com/pagead/1p-user-list/695231162/ 		42 B
108 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.com/pagead/1p-user-list/695231162/?random=1642148921829&cv=9&fst=1642147200000&num=1&bg=ffffff&guid=ON&u_h=864&u_w=1536&u_ah=824&u_aw=1536&u_cd=24&u_his=9&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa1c0&sendb=1&data=event%3Dgtag.config&frm=0&url=http%3A%2F%2Flocalhost%2Fskemas%2FCiti%2520antis%2520upgraded%2520%40VixxxYZ%2Flogin%2Fses%2F%3Fresponse_type%3Dcode%26client_id%3DMOBI%2540AMER.OAUTHAP%26Auth_key%3D6a09773ace2bd074cd40eceabfc311eaa037e8a2&ref=http%3A%2F%2Flocalhost%2Fskemas%2FCiti%2520antis%2520upgraded%2520%40VixxxYZ%2F&tiba=Sign%20On%20to%20Your%20Citi%20Account%20-%20Citibank&async=1&fmt=3&is_vtc=1&random=3117878267&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y
Requested by
Host: weset-authty91.myvnc.com
URL: https://weset-authty91.myvnc.com/Login/?token=
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82b::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://weset-authty91.myvnc.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma
no-cache
date
Sat, 19 Mar 2022 17:58:14 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
content-security-policy
script-src 'none'; object-src 'none'
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
www.google.de/pagead/1p-user-list/695231162/ 		42 B
108 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.de/pagead/1p-user-list/695231162/?random=1642148921829&cv=9&fst=1642147200000&num=1&bg=ffffff&guid=ON&u_h=864&u_w=1536&u_ah=824&u_aw=1536&u_cd=24&u_his=9&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa1c0&sendb=1&data=event%3Dgtag.config&frm=0&url=http%3A%2F%2Flocalhost%2Fskemas%2FCiti%2520antis%2520upgraded%2520%40VixxxYZ%2Flogin%2Fses%2F%3Fresponse_type%3Dcode%26client_id%3DMOBI%2540AMER.OAUTHAP%26Auth_key%3D6a09773ace2bd074cd40eceabfc311eaa037e8a2&ref=http%3A%2F%2Flocalhost%2Fskemas%2FCiti%2520antis%2520upgraded%2520%40VixxxYZ%2F&tiba=Sign%20On%20to%20Your%20Citi%20Account%20-%20Citibank&async=1&fmt=3&is_vtc=1&random=3117878267&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y
Requested by
Host: weset-authty91.myvnc.com
URL: https://weset-authty91.myvnc.com/Login/?token=
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://weset-authty91.myvnc.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma
no-cache
date
Sat, 19 Mar 2022 17:58:14 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
content-security-policy
script-src 'none'; object-src 'none'
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
www.google.com/pagead/1p-user-list/819500023/ 		42 B
108 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.com/pagead/1p-user-list/819500023/?random=1642148922005&cv=9&fst=1642147200000&num=1&bg=ffffff&guid=ON&u_h=864&u_w=1536&u_ah=824&u_aw=1536&u_cd=24&u_his=9&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa1c0&sendb=1&data=event%3Dgtag.config&frm=0&url=http%3A%2F%2Flocalhost%2Fskemas%2FCiti%2520antis%2520upgraded%2520%40VixxxYZ%2Flogin%2Fses%2F%3Fresponse_type%3Dcode%26client_id%3DMOBI%2540AMER.OAUTHAP%26Auth_key%3D6a09773ace2bd074cd40eceabfc311eaa037e8a2&ref=http%3A%2F%2Flocalhost%2Fskemas%2FCiti%2520antis%2520upgraded%2520%40VixxxYZ%2F&tiba=Sign%20On%20to%20Your%20Citi%20Account%20-%20Citibank&async=1&fmt=3&is_vtc=1&random=2324088858&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y
Requested by
Host: weset-authty91.myvnc.com
URL: https://weset-authty91.myvnc.com/Login/?token=
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82b::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://weset-authty91.myvnc.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma
no-cache
date
Sat, 19 Mar 2022 17:58:14 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
content-security-policy
script-src 'none'; object-src 'none'
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
www.google.de/pagead/1p-user-list/819500023/ 		42 B
108 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.de/pagead/1p-user-list/819500023/?random=1642148922005&cv=9&fst=1642147200000&num=1&bg=ffffff&guid=ON&u_h=864&u_w=1536&u_ah=824&u_aw=1536&u_cd=24&u_his=9&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa1c0&sendb=1&data=event%3Dgtag.config&frm=0&url=http%3A%2F%2Flocalhost%2Fskemas%2FCiti%2520antis%2520upgraded%2520%40VixxxYZ%2Flogin%2Fses%2F%3Fresponse_type%3Dcode%26client_id%3DMOBI%2540AMER.OAUTHAP%26Auth_key%3D6a09773ace2bd074cd40eceabfc311eaa037e8a2&ref=http%3A%2F%2Flocalhost%2Fskemas%2FCiti%2520antis%2520upgraded%2520%40VixxxYZ%2F&tiba=Sign%20On%20to%20Your%20Citi%20Account%20-%20Citibank&async=1&fmt=3&is_vtc=1&random=2324088858&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y
Requested by
Host: weset-authty91.myvnc.com
URL: https://weset-authty91.myvnc.com/Login/?token=
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://weset-authty91.myvnc.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma
no-cache
date
Sat, 19 Mar 2022 17:58:14 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
content-security-policy
script-src 'none'; object-src 'none'
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
www.google.com/pagead/1p-user-list/959299794/ 		42 B
108 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.com/pagead/1p-user-list/959299794/?random=1642148922009&cv=9&fst=1642147200000&num=1&bg=ffffff&guid=ON&u_h=864&u_w=1536&u_ah=824&u_aw=1536&u_cd=24&u_his=9&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa1c0&sendb=1&data=event%3Dgtag.config&frm=0&url=http%3A%2F%2Flocalhost%2Fskemas%2FCiti%2520antis%2520upgraded%2520%40VixxxYZ%2Flogin%2Fses%2F%3Fresponse_type%3Dcode%26client_id%3DMOBI%2540AMER.OAUTHAP%26Auth_key%3D6a09773ace2bd074cd40eceabfc311eaa037e8a2&ref=http%3A%2F%2Flocalhost%2Fskemas%2FCiti%2520antis%2520upgraded%2520%40VixxxYZ%2F&tiba=Sign%20On%20to%20Your%20Citi%20Account%20-%20Citibank&async=1&fmt=3&is_vtc=1&random=2088364394&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y
Requested by
Host: weset-authty91.myvnc.com
URL: https://weset-authty91.myvnc.com/Login/?token=
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82b::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://weset-authty91.myvnc.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma
no-cache
date
Sat, 19 Mar 2022 17:58:14 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
content-security-policy
script-src 'none'; object-src 'none'
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
www.google.de/pagead/1p-user-list/959299794/ 		42 B
108 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.de/pagead/1p-user-list/959299794/?random=1642148922009&cv=9&fst=1642147200000&num=1&bg=ffffff&guid=ON&u_h=864&u_w=1536&u_ah=824&u_aw=1536&u_cd=24&u_his=9&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa1c0&sendb=1&data=event%3Dgtag.config&frm=0&url=http%3A%2F%2Flocalhost%2Fskemas%2FCiti%2520antis%2520upgraded%2520%40VixxxYZ%2Flogin%2Fses%2F%3Fresponse_type%3Dcode%26client_id%3DMOBI%2540AMER.OAUTHAP%26Auth_key%3D6a09773ace2bd074cd40eceabfc311eaa037e8a2&ref=http%3A%2F%2Flocalhost%2Fskemas%2FCiti%2520antis%2520upgraded%2520%40VixxxYZ%2F&tiba=Sign%20On%20to%20Your%20Citi%20Account%20-%20Citibank&async=1&fmt=3&is_vtc=1&random=2088364394&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y
Requested by
Host: weset-authty91.myvnc.com
URL: https://weset-authty91.myvnc.com/Login/?token=
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://weset-authty91.myvnc.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma
no-cache
date
Sat, 19 Mar 2022 17:58:14 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
content-security-policy
script-src 'none'; object-src 'none'
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
LSO_4959.jpg
weset-authty91.myvnc.com/Login/css/ 		171 KB
171 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://weset-authty91.myvnc.com/Login/css/LSO_4959.jpg
Requested by
Host: weset-authty91.myvnc.com
URL: https://weset-authty91.myvnc.com/Login/?token=
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
35.238.108.96 Council Bluffs, United States, ASN15169 (GOOGLE, US),
Reverse DNS
96.108.238.35.bc.googleusercontent.com
Software
Apache /
Resource Hash
48e89b7e40e096b89d864a5c8ee340ce44ca60fe9675310ef2f3f40a53a7d593
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://weset-authty91.myvnc.com/Login/?token=
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date
Sat, 19 Mar 2022 17:58:14 GMT
X-Content-Type-Options
nosniff
Last-Modified
Sat, 19 Mar 2022 13:52:16 GMT
Server
Apache
Content-Type
image/jpeg
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=99
Content-Length
174933
X-XSS-Protection
1; mode=block
Citi-Branding-Sprite.png
weset-authty91.myvnc.com/Login/img/ 		315 B
315 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://weset-authty91.myvnc.com/Login/img/Citi-Branding-Sprite.png
Requested by
Host: weset-authty91.myvnc.com
URL: https://weset-authty91.myvnc.com/Login/?token=
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
35.238.108.96 Council Bluffs, United States, ASN15169 (GOOGLE, US),
Reverse DNS
96.108.238.35.bc.googleusercontent.com
Software
Apache /
Resource Hash
d5a89e26beae0bc03ad18a0b0d1d3d75f87c32047879d25da11970cb5c4662a3

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://weset-authty91.myvnc.com/Login/?token=
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date
Sat, 19 Mar 2022 17:58:14 GMT
Server
Apache
Connection
Keep-Alive
Keep-Alive
timeout=5, max=97
Content-Length
315
Content-Type
text/html; charset=iso-8859-1
Appstore-Googleplay-JDPower-Sprite.png
weset-authty91.myvnc.com/Login/css/ 		44 KB
44 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://weset-authty91.myvnc.com/Login/css/Appstore-Googleplay-JDPower-Sprite.png
Requested by
Host: weset-authty91.myvnc.com
URL: https://weset-authty91.myvnc.com/Login/?token=
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
35.238.108.96 Council Bluffs, United States, ASN15169 (GOOGLE, US),
Reverse DNS
96.108.238.35.bc.googleusercontent.com
Software
Apache /
Resource Hash
b8e446605f92c29a178dd6494688103ac268004592afe06643df46f4bff68577
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://weset-authty91.myvnc.com/Login/?token=
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date
Sat, 19 Mar 2022 17:58:14 GMT
X-Content-Type-Options
nosniff
Last-Modified
Sat, 19 Mar 2022 13:52:14 GMT
Server
Apache
Content-Type
image/png
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=99
Content-Length
44996
X-XSS-Protection
1; mode=block
social-media_facebook@3x.png
weset-authty91.myvnc.com/Login/css/ 		445 B
752 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://weset-authty91.myvnc.com/Login/css/social-media_facebook@3x.png
Requested by
Host: weset-authty91.myvnc.com
URL: https://weset-authty91.myvnc.com/Login/?token=
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
35.238.108.96 Council Bluffs, United States, ASN15169 (GOOGLE, US),
Reverse DNS
96.108.238.35.bc.googleusercontent.com
Software
Apache /
Resource Hash
695788dc05d94be3b32060ffea15c1a4d74897bd32e5da7811e7ca76d82fc86b
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://weset-authty91.myvnc.com/Login/?token=
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date
Sat, 19 Mar 2022 17:58:15 GMT
X-Content-Type-Options
nosniff
Last-Modified
Sat, 19 Mar 2022 13:52:16 GMT
Server
Apache
Content-Type
image/png
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=96
Content-Length
445
X-XSS-Protection
1; mode=block
social-media_twitter@3x.png
weset-authty91.myvnc.com/Login/css/ 		1 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://weset-authty91.myvnc.com/Login/css/social-media_twitter@3x.png
Requested by
Host: weset-authty91.myvnc.com
URL: https://weset-authty91.myvnc.com/Login/?token=
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
35.238.108.96 Council Bluffs, United States, ASN15169 (GOOGLE, US),
Reverse DNS
96.108.238.35.bc.googleusercontent.com
Software
Apache /
Resource Hash
5394d11ec8ad7a5494bcdb65cd95f885388532e14fb45a747e249112389bd837
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://weset-authty91.myvnc.com/Login/?token=
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date
Sat, 19 Mar 2022 17:58:14 GMT
X-Content-Type-Options
nosniff
Last-Modified
Sat, 19 Mar 2022 13:52:16 GMT
Server
Apache
Content-Type
image/png
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=96
Content-Length
1277
X-XSS-Protection
1; mode=block
social-media_youtube@3x.png
weset-authty91.myvnc.com/Login/css/ 		1 KB
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://weset-authty91.myvnc.com/Login/css/social-media_youtube@3x.png
Requested by
Host: weset-authty91.myvnc.com
URL: https://weset-authty91.myvnc.com/Login/?token=
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
35.238.108.96 Council Bluffs, United States, ASN15169 (GOOGLE, US),
Reverse DNS
96.108.238.35.bc.googleusercontent.com
Software
Apache /
Resource Hash
be9b5382b4526ffd3306d0292122ce3599123f1cd543f52f3035b4f24fbf9de8
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://weset-authty91.myvnc.com/Login/?token=
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

Date
Sat, 19 Mar 2022 17:58:14 GMT
X-Content-Type-Options
nosniff
Last-Modified
Sat, 19 Mar 2022 13:52:16 GMT
Server
Apache
Content-Type
image/png
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=98
Content-Length
1175
X-XSS-Protection
1; mode=block
63068
stags.bluekai.com/site/ Frame 4ECB 		71 B
338 B 		Document
General
Check archive.org
Download Go to
Full URL
https://stags.bluekai.com/site/63068?ret=html&phint=language&phint=product&phint=event&phint=category&phint=page&phint=section1&phint=section2&phint=section3&phint=section4&phint=bankappstatus&phint=productID&phint=__bk_t%3DSign%20On%20to%20Your%20Citi%20Account%20-%20Citibank&phint=__bk_k%3D&phint=__bk_pr%3Dhttp%3A%2F%2Flocalhost%2Fskemas%2FCiti%2520antis%2520upgraded%2520%40VixxxYZ%2F&phint=__bk_l%3Dhttp%3A%2F%2Flocalhost%2Fskemas%2FCiti%2520antis%2520upgraded%2520%40VixxxYZ%2Flogin%2Fses%2F%3Fresponse_type%3Dcode%26client_id%3DMOBI%2540AMER.OAUTHAP%26Auth_key%3D6a09773ace2bd074cd40eceabfc311eaa037e8a2&phint=__bk_v%3D3.1.10&limit=10&r=92544077
Requested by
Host: weset-authty91.myvnc.com
URL: https://weset-authty91.myvnc.com/Login/?token=
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
104.111.215.191 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-111-215-191.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
53350525edba0b889e87ea52a16ed843a928a2557e9f8d6747acd7ff991c95c3

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Referer
https://weset-authty91.myvnc.com/

Response headers

Content-Type
text/html
Content-Length
71
P3P
CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV", policyref="http://tags.bluekai.com/w3c/p3p.xml"
BK-Server
3436
Date
Sat, 19 Mar 2022 17:58:14 GMT
Connection
keep-alive
X-N
S
generic1642092206405.js
resources.digital-cloud-citi.medallia.com/wdcusciti/50/onsite/ 		0
0
pixel
bid.g.doubleclick.net/xbbe/ Frame 31D4 		0
683 B 		Document
General
Check archive.org
Download Go to
Full URL
https://bid.g.doubleclick.net/xbbe/pixel?d=KAE
Requested by
Host: weset-authty91.myvnc.com
URL: https://weset-authty91.myvnc.com/Login/?token=
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
74.125.140.157 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
wq-in-f157.1e100.net
Software
cafe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Referer
https://weset-authty91.myvnc.com/

Response headers

p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
timing-allow-origin
*
cross-origin-resource-policy
cross-origin
content-type
text/html; charset=UTF-8
x-content-type-options
nosniff
date
Sat, 19 Mar 2022 17:58:14 GMT
server
cafe
content-length
0
x-xss-protection
0
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
expires
Sat, 19 Mar 2022 17:58:14 GMT
cache-control
private
fdf45a7c15c1cee06bb71e10dac4e26e.js
nexus.ensighten.com/citi/na_prod/code/ 		989 B
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://nexus.ensighten.com/citi/na_prod/code/fdf45a7c15c1cee06bb71e10dac4e26e.js?conditionId0=4849963
Requested by
Host: weset-authty91.myvnc.com
URL: https://weset-authty91.myvnc.com/Login/js/Bootstrap.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
18.195.42.228 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-18-195-42-228.eu-central-1.compute.amazonaws.com
Software
nginx /
Resource Hash
7df13706eaab8ce9a3dcd2a501f60bc66987c83834d07dfaf07ae56ef814c110

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://weset-authty91.myvnc.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date
Sat, 19 Mar 2022 17:58:14 GMT
last-modified
Tue, 14 May 2019 17:01:42 GMT
server
nginx
etag
"5cdaf476-3dd"
content-type
application/javascript; charset=utf-8
cache-control
max-age=315360000
accept-ranges
bytes
content-length
989
da6191c2b2959a15b37bb1f025a35ecd.js
nexus.ensighten.com/citi/na_prod/code/ 		5 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://nexus.ensighten.com/citi/na_prod/code/da6191c2b2959a15b37bb1f025a35ecd.js?conditionId0=4897099
Requested by
Host: weset-authty91.myvnc.com
URL: https://weset-authty91.myvnc.com/Login/js/Bootstrap.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
18.195.42.228 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-18-195-42-228.eu-central-1.compute.amazonaws.com
Software
nginx /
Resource Hash
5cbb5852d6dd001b4defb3f6ace7f8beb88d0f19d20d00ebfd086a24c31988db

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://weset-authty91.myvnc.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date
Sat, 19 Mar 2022 17:58:14 GMT
content-encoding
gzip
last-modified
Tue, 01 Mar 2022 18:19:28 GMT
server
nginx
etag
W/"621e63b0-12ea"
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
cache-control
max-age=315360000
557566dc60916e3de69e006bef252459.js
nexus.ensighten.com/citi/na_prod/code/ 		2 KB
961 B 		Script
General
Check archive.org
Download Go to
Full URL
https://nexus.ensighten.com/citi/na_prod/code/557566dc60916e3de69e006bef252459.js?conditionId0=4837456
Requested by
Host: weset-authty91.myvnc.com
URL: https://weset-authty91.myvnc.com/Login/js/Bootstrap.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
18.195.42.228 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-18-195-42-228.eu-central-1.compute.amazonaws.com
Software
nginx /
Resource Hash
31b00ff4929696dfca06885da68e58c3e09f6ecb4ae0fe1ae287e99a3fd1f716

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://weset-authty91.myvnc.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date
Sat, 19 Mar 2022 17:58:14 GMT
content-encoding
gzip
last-modified
Tue, 27 Aug 2019 16:59:12 GMT
server
nginx
etag
W/"5d656160-887"
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
cache-control
max-age=315360000
a81e05b9f5c7e57b0d80e617030f8bd0.js
nexus.ensighten.com/citi/na_prod/code/ 		157 KB
34 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://nexus.ensighten.com/citi/na_prod/code/a81e05b9f5c7e57b0d80e617030f8bd0.js?conditionId0=421908
Requested by
Host: weset-authty91.myvnc.com
URL: https://weset-authty91.myvnc.com/Login/js/Bootstrap.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
18.195.42.228 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-18-195-42-228.eu-central-1.compute.amazonaws.com
Software
nginx /
Resource Hash
0bcb15216559cb490a994fc29303e9e66b109926890e7d3abfddbbfcef347c8e

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://weset-authty91.myvnc.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date
Sat, 19 Mar 2022 17:58:14 GMT
content-encoding
gzip
last-modified
Wed, 16 Mar 2022 21:07:32 GMT
server
nginx
etag
W/"62325194-275e6"
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
cache-control
max-age=315360000
51aba9f62787efbaa13e53a8d1ae3892.js
nexus.ensighten.com/citi/na_prod/code/ 		1 KB
847 B 		Script
General
Check archive.org
Download Go to
Full URL
https://nexus.ensighten.com/citi/na_prod/code/51aba9f62787efbaa13e53a8d1ae3892.js?conditionId0=4827153
Requested by
Host: weset-authty91.myvnc.com
URL: https://weset-authty91.myvnc.com/Login/js/Bootstrap.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
18.195.42.228 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-18-195-42-228.eu-central-1.compute.amazonaws.com
Software
nginx /
Resource Hash
bf8892a953595eb96b9ca68c5756849d404115dcf2ee9bf87e8b4e7b3cf8e650

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://weset-authty91.myvnc.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date
Sat, 19 Mar 2022 17:58:14 GMT
content-encoding
gzip
last-modified
Tue, 31 Aug 2021 17:19:01 GMT
server
nginx
etag
W/"612e6485-52a"
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
cache-control
max-age=315360000
e047f7a400b1380b9dd4b041c45aed8c.js
nexus.ensighten.com/citi/na_prod/code/ 		133 KB
36 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://nexus.ensighten.com/citi/na_prod/code/e047f7a400b1380b9dd4b041c45aed8c.js?conditionId0=486757
Requested by
Host: weset-authty91.myvnc.com
URL: https://weset-authty91.myvnc.com/Login/js/Bootstrap.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
18.195.42.228 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-18-195-42-228.eu-central-1.compute.amazonaws.com
Software
nginx /
Resource Hash
ffb651309250e9ce8ca4d6a354d9403cb80ec23ef11eebc6d518163948061c82

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://weset-authty91.myvnc.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date
Sat, 19 Mar 2022 17:58:14 GMT
content-encoding
gzip
last-modified
Mon, 07 Mar 2022 18:42:31 GMT
server
nginx
etag
W/"62265217-2131c"
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
cache-control
max-age=315360000
fb5dd1201f281250801b0d9c5b73ac92.js
nexus.ensighten.com/citi/na_prod/code/ 		35 KB
8 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://nexus.ensighten.com/citi/na_prod/code/fb5dd1201f281250801b0d9c5b73ac92.js?conditionId0=467299
Requested by
Host: weset-authty91.myvnc.com
URL: https://weset-authty91.myvnc.com/Login/js/Bootstrap.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
18.195.42.228 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-18-195-42-228.eu-central-1.compute.amazonaws.com
Software
nginx /
Resource Hash
9946d53fd289535b32d7d2fa1bf8c251337dda6ccf582dfe2764bf5101d09081

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://weset-authty91.myvnc.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date
Sat, 19 Mar 2022 17:58:14 GMT
content-encoding
gzip
last-modified
Mon, 07 Mar 2022 18:42:31 GMT
server
nginx
etag
W/"62265217-8ae7"
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
cache-control
max-age=315360000
js
www.googletagmanager.com/gtag/ 		89 KB
36 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagmanager.com/gtag/js?id=DC-6268858
Requested by
Host: weset-authty91.myvnc.com
URL: https://weset-authty91.myvnc.com/Login/js/Bootstrap.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:808::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
a6e17deb5d2a9954def8e522ed124a5b6469289637b1083d9cc81707826e9283
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://weset-authty91.myvnc.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date
Sat, 19 Mar 2022 17:58:14 GMT
content-encoding
br
vary
Accept-Encoding
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
36569
x-xss-protection
0
last-modified
Sat, 19 Mar 2022 15:00:00 GMT
server
Google Tag Manager
strict-transport-security
max-age=31536000; includeSubDomains
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
access-control-allow-headers
Cache-Control
expires
Sat, 19 Mar 2022 17:58:14 GMT
js
www.googletagmanager.com/gtag/ 		89 KB
36 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagmanager.com/gtag/js?id=DC-6260004
Requested by
Host: weset-authty91.myvnc.com
URL: https://weset-authty91.myvnc.com/Login/js/Bootstrap.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:808::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
e240cc5eae742b60924ba12329e9642efe98288473939813627d63dc63df5518
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://weset-authty91.myvnc.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date
Sat, 19 Mar 2022 17:58:14 GMT
content-encoding
br
vary
Accept-Encoding
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
36565
x-xss-protection
0
last-modified
Sat, 19 Mar 2022 15:00:00 GMT
server
Google Tag Manager
strict-transport-security
max-age=31536000; includeSubDomains
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
access-control-allow-headers
Cache-Control
expires
Sat, 19 Mar 2022 17:58:14 GMT
tc.min.js
c1.rfihub.net/js/ 		19 KB
6 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://c1.rfihub.net/js/tc.min.js
Requested by
Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/code/fb5dd1201f281250801b0d9c5b73ac92.js?conditionId0=467299
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2156:2200:1:76cf:fe80:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Jetty(9.3.29.v20201019) /
Resource Hash
7ef97b12890fc6fee67f869c6e1f74b6719de7d66ac0d649c8d7386a80b4c30f

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://weset-authty91.myvnc.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date
Sat, 19 Mar 2022 16:59:06 GMT
content-encoding
gzip
last-modified
Sat, 19 Mar 2022 16:58:56 GMT
server
Jetty(9.3.29.v20201019)
age
3548
x-cache
Hit from cloudfront
p3p
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
via
1.1 632ee301c4920b52f2463aa9e978c57e.cloudfront.net (CloudFront)
cache-control
public, max-age=3600
x-amz-cf-pop
FRA50-C1
content-type
application/x-javascript
content-length
6162
x-amz-cf-id
AQlSJSGNe25SVfepEaYMhQQvImotpkZ_Da6LgsLNs1aCs9VLcXfOnQ==
expires
Sat, 19 Mar 2022 17:59:06 GMT
js
www.googletagmanager.com/gtag/ 		89 KB
36 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagmanager.com/gtag/js?id=DC-6268858&l=dataLayer&cx=c
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-916451471
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:808::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
d1ba7a6475255c11f281cb94dcc3de7090a7a580fc2c64cb9b880d36b1be6d2f
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://weset-authty91.myvnc.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date
Sat, 19 Mar 2022 17:58:14 GMT
content-encoding
br
vary
Accept-Encoding
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
36563
x-xss-protection
0
last-modified
Sat, 19 Mar 2022 15:00:00 GMT
server
Google Tag Manager
strict-transport-security
max-age=31536000; includeSubDomains
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
access-control-allow-headers
Cache-Control
expires
Sat, 19 Mar 2022 17:58:14 GMT
ca.html
20766699p.rfihub.com/ Frame AC2F 		118 B
705 B 		Document
General
Check archive.org
Download Go to
Full URL
https://20766699p.rfihub.com/ca.html?ver=9&ra=591&rb=648&ca=20766699&_o=17169175&_t=&ssv_cuuid=&ssv_package=null&ssv_prodlist=null&ssv_pagename=&pe=https%3A%2F%2Fweset-authty91.myvnc.com%2FLogin%2F%3Ftoken%3D&pf=https%3A%2F%2Fweset-authty91.myvnc.com%2F&ra=4956978087554975
Requested by
Host: c1.rfihub.net
URL: https://c1.rfihub.net/js/tc.min.js
Protocol
HTTP/1.1
Security
TLS 1.2, RSA, AES_256_CBC
Server
193.0.160.128 , United States, ASN54312 (ROCKETFUEL, US),
Reverse DNS
Software
Jetty(9.3.29.v20201019) /
Resource Hash
c437eb764a99e6cd5172d63c3fae564bbc51eda4981058d5edebd2bf0700eb76

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Referer
https://weset-authty91.myvnc.com/

Response headers

Date
Sat, 19 Mar 2022 17:58:15 GMT
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Cache-Control
no-cache
Content-Type
text/html;charset=utf-8
Content-Length
118
Server
Jetty(9.3.29.v20201019)
js
www.googletagmanager.com/gtag/ 		89 KB
36 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagmanager.com/gtag/js?id=DC-6260004&l=dataLayer&cx=c
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-916451471
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:808::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
0f197c1bafc914491304543957ab66aca2478f96f47e83c1d52c6ed3f0c705e9
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://weset-authty91.myvnc.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date
Sat, 19 Mar 2022 17:58:14 GMT
content-encoding
br
vary
Accept-Encoding
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
36559
x-xss-protection
0
last-modified
Sat, 19 Mar 2022 15:00:00 GMT
server
Google Tag Manager
strict-transport-security
max-age=31536000; includeSubDomains
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
access-control-allow-headers
Cache-Control
expires
Sat, 19 Mar 2022 17:58:14 GMT
js
www.googletagmanager.com/gtag/ 		89 KB
36 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagmanager.com/gtag/js?id=DC-6269322&l=dataLayer&cx=c
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-916451471
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:808::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
ecc1b4a8618cab027412168bdd0de6e4d4ade3e076303f89a36ba4dd312a93f9
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://weset-authty91.myvnc.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date
Sat, 19 Mar 2022 17:58:14 GMT
content-encoding
br
vary
Accept-Encoding
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
36562
x-xss-protection
0
last-modified
Sat, 19 Mar 2022 15:00:00 GMT
server
Google Tag Manager
strict-transport-security
max-age=31536000; includeSubDomains
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
access-control-allow-headers
Cache-Control
expires
Sat, 19 Mar 2022 17:58:14 GMT
js
www.googletagmanager.com/gtag/ 		89 KB
36 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagmanager.com/gtag/js?id=DC-6256710&l=dataLayer&cx=c
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-916451471
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:808::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
9aadbf79a92035c44b837b9c2a08c5fab94bcb95cd674e025bfba1691fa6f275
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://weset-authty91.myvnc.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date
Sat, 19 Mar 2022 17:58:14 GMT
content-encoding
br
vary
Accept-Encoding
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
36562
x-xss-protection
0
last-modified
Sat, 19 Mar 2022 15:00:00 GMT
server
Google Tag Manager
strict-transport-security
max-age=31536000; includeSubDomains
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
access-control-allow-headers
Cache-Control
expires
Sat, 19 Mar 2022 17:58:14 GMT
js
www.googletagmanager.com/gtag/ 		89 KB
36 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagmanager.com/gtag/js?id=DC-6415812&l=dataLayer&cx=c
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-916451471
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:808::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
47947b365dd8c21dce94bc4c0fb396a4092a9432c51d1e110a459e2ef4f66ced
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://weset-authty91.myvnc.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date
Sat, 19 Mar 2022 17:58:14 GMT
content-encoding
br
vary
Accept-Encoding
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
36562
x-xss-protection
0
last-modified
Sat, 19 Mar 2022 15:00:00 GMT
server
Google Tag Manager
strict-transport-security
max-age=31536000; includeSubDomains
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
access-control-allow-headers
Cache-Control
expires
Sat, 19 Mar 2022 17:58:14 GMT
1560.js
cdn.pbbl.co/r/ 		0
0 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.pbbl.co/r/1560.js
Requested by
Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/code/da6191c2b2959a15b37bb1f025a35ecd.js?conditionId0=4897099
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.98.10 -, , ASN (),
Reverse DNS
Software
/
Resource Hash

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://weset-authty91.myvnc.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers
425466.html
sr.rlcdn.com/ Frame 802A 		0
98 B 		Document
General
Check archive.org
Download Go to
Full URL
https://sr.rlcdn.com/425466.html?es=80676&u=da39a3ee5e6b4b0d3255bfef95601890afd80709
Requested by
Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/code/fb5dd1201f281250801b0d9c5b73ac92.js?conditionId0=467299
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
35.190.60.146 -, , ASN (),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Referer
https://weset-authty91.myvnc.com/

Response headers

date
Sat, 19 Mar 2022 17:58:15 GMT
content-length
0
via
1.1 google
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
generic1645813044147.js
resources.digital-cloud-citi.medallia.com/wdcusciti/50/onsite/ 		532 KB
88 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://resources.digital-cloud-citi.medallia.com/wdcusciti/50/onsite/generic1645813044147.js
Requested by
Host: resources.digital-cloud-citi.medallia.com
URL: https://resources.digital-cloud-citi.medallia.com/wdcusciti/50/onsite/embed.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.130.133 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
05a45e5c705e5fa8b22c243d3461520e64f75236b702335764bed044e763e25e

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://weset-authty91.myvnc.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

x-amz-version-id
n9np7L1i8NPYVmXlDkA6OOYu.Ggu5g4q
content-encoding
gzip
etag
"b6b583d1c21fe708664599f47fe6d042"
age
151668
via
1.1 varnish
x-cache
HIT
content-length
89444
x-amz-id-2
1if0wswQ9/02sNnPV9vfeWjFhz1ZxKs3bUc8lqlSgJ703gKZilSlz37bHV3PrJV07Ecpz1CTyts=
x-served-by
cache-hhn4055-HHN
last-modified
Fri, 25 Feb 2022 18:17:26 GMT
server
AmazonS3
x-timer
S1647712695.316919,VS0,VE0
date
Sat, 19 Mar 2022 17:58:15 GMT
vary
Accept-Encoding
x-amz-request-id
D15YCVR45X4PJ69F
access-control-allow-origin
*
cache-control
max-age=0,must-revalidate
accept-ranges
bytes
content-type
application/javascript
x-cache-hits
89
63068
stags.bluekai.com/site/ Frame 6DC4 		71 B
338 B 		Document
General
Check archive.org
Download Go to
Full URL
https://stags.bluekai.com/site/63068?ret=html&phint=language&phint=product&phint=event&phint=category&phint=page&phint=section1&phint=section2&phint=section3&phint=section4&phint=bankappstatus&phint=productID&phint=__bk_t%3DSign%20On%20to%20Your%20Citi%20Account%20-%20Citibank&phint=__bk_k%3D&phint=__bk_pr%3Dhttps%3A%2F%2Fweset-authty91.myvnc.com%2F&phint=__bk_l%3Dhttps%3A%2F%2Fweset-authty91.myvnc.com%2FLogin%2F%3Ftoken%3D&phint=__bk_v%3D3.1.10&limit=10&r=83460557
Requested by
Host: tags.bkrtx.com
URL: https://tags.bkrtx.com/js/bk-coretag.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
104.111.215.191 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-111-215-191.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
53350525edba0b889e87ea52a16ed843a928a2557e9f8d6747acd7ff991c95c3

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Referer
https://weset-authty91.myvnc.com/

Response headers

Content-Type
text/html
Content-Length
71
P3P
CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV", policyref="http://tags.bluekai.com/w3c/p3p.xml"
BK-Server
2e13
Date
Sat, 19 Mar 2022 17:58:15 GMT
Connection
keep-alive
X-N
S
conversion_async.js
www.googleadservices.com/pagead/ 		39 KB
15 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googleadservices.com/pagead/conversion_async.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-916451471
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.250.186.66 -, , ASN (),
Reverse DNS
Software
cafe /
Resource Hash
b872b4ad2e649961fbf3cdc43966716bd820301634adebaf5329c1aa22a1f7ee
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://weset-authty91.myvnc.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date
Sat, 19 Mar 2022 17:58:15 GMT
content-encoding
gzip
x-content-type-options
nosniff
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
14889
x-xss-protection
0
server
cafe
etag
11178597599353190569
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
cache-control
private, max-age=3600
timing-allow-origin
*
expires
Sat, 19 Mar 2022 17:58:15 GMT
js
www.googletagmanager.com/gtag/ 		99 KB
39 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagmanager.com/gtag/js?id=AW-960621875&l=dataLayer&cx=c
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-916451471
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:808::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
d954fb5ecb3b158b90b283529846f344331bd175799f424755a3786a405e14a4
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://weset-authty91.myvnc.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date
Sat, 19 Mar 2022 17:58:15 GMT
content-encoding
br
vary
Accept-Encoding
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
40273
x-xss-protection
0
last-modified
Sat, 19 Mar 2022 15:00:00 GMT
server
Google Tag Manager
strict-transport-security
max-age=31536000; includeSubDomains
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
access-control-allow-headers
Cache-Control
expires
Sat, 19 Mar 2022 17:58:15 GMT
js
www.googletagmanager.com/gtag/ 		99 KB
39 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagmanager.com/gtag/js?id=AW-644574043&l=dataLayer&cx=c
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-916451471
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:808::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
c4bfc45b3cbb970db8d5280e5992333498eeed96e5dbda1375ae7be6204b20c6
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://weset-authty91.myvnc.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date
Sat, 19 Mar 2022 17:58:15 GMT
content-encoding
br
vary
Accept-Encoding
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
40336
x-xss-protection
0
last-modified
Sat, 19 Mar 2022 15:00:00 GMT
server
Google Tag Manager
strict-transport-security
max-age=31536000; includeSubDomains
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
access-control-allow-headers
Cache-Control
expires
Sat, 19 Mar 2022 17:58:15 GMT
js
www.googletagmanager.com/gtag/ 		99 KB
39 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagmanager.com/gtag/js?id=AW-975701947&l=dataLayer&cx=c
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-916451471
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:808::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
9bae0960b0e69f0f24e789b5a3825850055f9f71caab3975ce718c79ff5087a5
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://weset-authty91.myvnc.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date
Sat, 19 Mar 2022 17:58:15 GMT
content-encoding
br
vary
Accept-Encoding
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
40273
x-xss-protection
0
last-modified
Sat, 19 Mar 2022 15:00:00 GMT
server
Google Tag Manager
strict-transport-security
max-age=31536000; includeSubDomains
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
access-control-allow-headers
Cache-Control
expires
Sat, 19 Mar 2022 17:58:15 GMT
js
www.googletagmanager.com/gtag/ 		99 KB
39 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagmanager.com/gtag/js?id=AW-830907969&l=dataLayer&cx=c
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-916451471
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:808::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
548194622289ab82f8acdbbf28b42344707286162061b234825775b5eb8e54a2
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://weset-authty91.myvnc.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date
Sat, 19 Mar 2022 17:58:15 GMT
content-encoding
br
vary
Accept-Encoding
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
40249
x-xss-protection
0
last-modified
Sat, 19 Mar 2022 15:00:00 GMT
server
Google Tag Manager
strict-transport-security
max-age=31536000; includeSubDomains
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
access-control-allow-headers
Cache-Control
expires
Sat, 19 Mar 2022 17:58:15 GMT
js
www.googletagmanager.com/gtag/ 		99 KB
39 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagmanager.com/gtag/js?id=AW-695231162&l=dataLayer&cx=c
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-916451471
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:808::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
8558112ac03ab3ed170af04ab21c3e2153644d7be610b1b02045fa3d6d9a835a
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://weset-authty91.myvnc.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date
Sat, 19 Mar 2022 17:58:15 GMT
content-encoding
br
vary
Accept-Encoding
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
40276
x-xss-protection
0
last-modified
Sat, 19 Mar 2022 15:00:00 GMT
server
Google Tag Manager
strict-transport-security
max-age=31536000; includeSubDomains
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
access-control-allow-headers
Cache-Control
expires
Sat, 19 Mar 2022 17:58:15 GMT
js
www.googletagmanager.com/gtag/ 		99 KB
39 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagmanager.com/gtag/js?id=AW-819500023&l=dataLayer&cx=c
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-916451471
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:808::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
18d6a4a09afb30486dd82b5f891b48a89c0351db8f822cfe62c211dbfc7ea662
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://weset-authty91.myvnc.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date
Sat, 19 Mar 2022 17:58:15 GMT
content-encoding
br
vary
Accept-Encoding
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
40252
x-xss-protection
0
last-modified
Sat, 19 Mar 2022 15:00:00 GMT
server
Google Tag Manager
strict-transport-security
max-age=31536000; includeSubDomains
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
access-control-allow-headers
Cache-Control
expires
Sat, 19 Mar 2022 17:58:15 GMT
js
www.googletagmanager.com/gtag/ 		99 KB
39 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagmanager.com/gtag/js?id=AW-959299794&l=dataLayer&cx=c
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-916451471
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:808::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
dc49949d2fbc73d50f3342afecce24e3e8618decb9cac61e9ec1ac80f089ae66
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://weset-authty91.myvnc.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

date
Sat, 19 Mar 2022 17:58:15 GMT
content-encoding
br
vary
Accept-Encoding
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
40250
x-xss-protection
0
last-modified
Sat, 19 Mar 2022 15:00:00 GMT
server
Google Tag Manager
strict-transport-security
max-age=31536000; includeSubDomains
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
access-control-allow-headers
Cache-Control
expires
Sat, 19 Mar 2022 17:58:15 GMT
cool-2.1.15.min.js
nebula-cdn.kampyle.com/resources/onsite/js/ 		14 KB
5 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://nebula-cdn.kampyle.com/resources/onsite/js/cool-2.1.15.min.js
Requested by
Host: resources.digital-cloud-citi.medallia.com
URL: https://resources.digital-cloud-citi.medallia.com/wdcusciti/50/onsite/generic1645813044147.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.129.175 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
3e72de5de67d6d80b65a114af684eaf880c53c250155a663cb17d677ff064bc1

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://weset-authty91.myvnc.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

x-amz-version-id
9HCXbKZTbCJZkS8s9IuB.pE0JEvI0TGW
content-encoding
gzip
etag
"80dd5e3be5152c5c72d552c6a26ef6ff"
age
153078
via
1.1 varnish
x-cache
HIT
content-length
5197
x-amz-id-2
cv5VPIGCLLcXtswk37oaFl4fBbweUeVQHYrMuBMn+c9sgiGiJKp9+J3PzqI9Db3Up4e5W4lD9Ko=
x-served-by
cache-hhn4081-HHN
last-modified
Sun, 24 Jan 2021 11:03:10 GMT
server
AmazonS3
x-timer
S1647712695.383069,VS0,VE0
date
Sat, 19 Mar 2022 17:58:15 GMT
vary
Accept-Encoding
x-amz-request-id
TJ8QGVFCE6QYVTNF
access-control-allow-origin
*
cache-control
max-age=31622400
accept-ranges
bytes
content-type
application/javascript
x-cache-hits
9545
__cool.gif
udc-neb.kampyle.com/egw/5/qceuv8449dzg58ptt1bhda9g8ue19c7s/track/ 		0
318 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://udc-neb.kampyle.com/egw/5/qceuv8449dzg58ptt1bhda9g8ue19c7s/track/__cool.gif?data=eyJldmVudHMiOiBbCiAgICB7InNlc3Npb25fc2NyZWVuX3NpemUiOiAiMTYwMHgxMjAwIiwic2Vzc2lvbl9kdWEiOiAiTW96aWxsYS81LjAgKFdpbmRvd3MgTlQgMTAuMDsgV2luNjQ7IHg2NCkgQXBwbGVXZWJLaXQvNTM3LjM2IChLSFRNTCwgbGlrZSBHZWNrbykgQ2hyb21lLzk5LjAuNDg0NC41MSBTYWZhcmkvNTM3LjM2Iiwic2Vzc2lvbl9wbGF0Zm9ybSI6ICJMaW51eCB4ODZfNjQiLCJyZWZlcnJpbmdfdXJsIjogImh0dHBzOi8vd2VzZXQtYXV0aHR5OTEubXl2bmMuY29tLyIsInJlZmVycmluZ19kb21haW4iOiAid2VzZXQtYXV0aHR5OTEubXl2bmMuY29tIiwidHJhY2tlcl90eXBlIjogImphdmFzY3JpcHQiLCJ0cmFja2VyX3ZlcnNpb24iOiAiMi4xLjE1IiwiZXZlbnRfbmFtZSI6ICJuZWJ1bGFfcGFnZV92aWV3IiwiZXZlbnRfdGltZXN0YW1wX2Vwb2NoIjogIjE2NDc3MTI2OTU0MjEiLCJldmVudF90aW1lem9uZV9vZmZzZXQiOiAwLCJ1c2VyX2lkIjogIjE3ZmEzNTQ3NDdiOTg5LTA1MGVmMTAxYTIyNmI0LTk3NzE3M2MtMWQ0YzAwLTE3ZmEzNTQ3NDdjYmMwIiwiZW52aXJvbWVudCI6ICJkaWdpdGFsLWNsb3VkLXVzLWNpdGkiLCJhY2NvdW50SWQiOiA0OSwidXJsIjogImh0dHBzOi8vd2VzZXQtYXV0aHR5OTEubXl2bmMuY29tL0xvZ2luLz90b2tlbj0iLCJ3ZWJzaXRlSWQiOiA1MCwiZm9ybUlkIjogbnVsbCwiZm9ybVRyaWdnZXJUeXBlIjogbnVsbCwia2FtcHlsZV9kYXRhIjogeyJMQVNUX0lOVklUQVRJT05fVklFVyI6ICIiLCJERUNMSU5FRF9EQVRFIjogIiIsImthbXB5bGVJbnZpdGVQcmVzZW50ZWQiOiAiIiwia2FtcHlsZV91c2VyaWQiOiAiYmNiNy1hZDNiLTNmMzQtYzc4Zi1kNjRjLTM4ODEtZDYyNC05MWU5Iiwia2FtcHlsZVVzZXJTZXNzaW9uIjogIjE2NDc3MTI2OTUzODYiLCJrYW1weWxlVXNlclBlcmNlbnRpbGUiOiAiIiwiU1VCTUlUVEVEX0RBVEUiOiAiIn0sImNvb2tpZV9zaXplIjogMzQwLCJrYW1weWxlX3ZlcnNpb24iOiAiMi40Mi4xIiwib25zaXRlX3ZlcnNpb24iOiAiMi40Mi4xIiwiaGlzdG9yeV9sZW5ndGgiOiAzLCJldmVudF9sb2NhbF90aW1lc3RhbXAiOiAxNjQ3NzEyNjk1Mzg4LCJwb3NpdGlvbiI6IG51bGwsImlzVXNlcklkZW50aWZpZWQiOiBmYWxzZSwiZmVlZGJhY2tfY29ycmVsYXRpb25fdXVpZCI6IG51bGx9Cl19
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
35.241.45.82 -, , ASN (),
Reverse DNS
Software
Jetty(9.2.11.v20150529) /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://weset-authty91.myvnc.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

x-me
prod-instance-gatewayservice-green-sx6j
date
Sat, 19 Mar 2022 17:58:15 GMT
via
1.1 google
server
Jetty(9.2.11.v20150529)
access-control-allow-headers
X-Requested-With, Origin, Content-Type, Accept
access-control-max-age
1800
access-control-allow-methods
GET, POST, PUT, DELETE
content-type
image/gif; charset=UTF-8
access-control-allow-origin
*
access-control-allow-credentials
true
alt-svc
clear
content-length
0
x-application-context
application:9090
/
googleads.g.doubleclick.net/pagead/viewthroughconversion/695231162/ 		2 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://googleads.g.doubleclick.net/pagead/viewthroughconversion/695231162/?random=1647712695752&cv=9&fst=1647712695752&num=1&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=3&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa3e0&sendb=1&ig=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fweset-authty91.myvnc.com%2FLogin%2F%3Ftoken%3D&ref=https%3A%2F%2Fweset-authty91.myvnc.com%2F&tiba=Sign%20On%20to%20Your%20Citi%20Account%20-%20Citibank&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4
Requested by
Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/conversion_async.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:400e:811::2002 , Ireland, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
972d9f0db48368cfe87f6a7a30ffed6f24c4df83ace4d1391fbbcab3a4e631dc
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://weset-authty91.myvnc.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma
no-cache
date
Sat, 19 Mar 2022 17:58:15 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
content-type
text/javascript; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
1069
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
googleads.g.doubleclick.net/pagead/viewthroughconversion/644574043/ 		2 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://googleads.g.doubleclick.net/pagead/viewthroughconversion/644574043/?random=1647712695755&cv=9&fst=1647712695755&num=1&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=3&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa3e0&sendb=1&ig=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fweset-authty91.myvnc.com%2FLogin%2F%3Ftoken%3D&ref=https%3A%2F%2Fweset-authty91.myvnc.com%2F&tiba=Sign%20On%20to%20Your%20Citi%20Account%20-%20Citibank&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4
Requested by
Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/conversion_async.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:400e:811::2002 , Ireland, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
afe4bad9f786ea48dff9f036a9b09ee5b3484392cf05cf9981f4915c688a24d3
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://weset-authty91.myvnc.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma
no-cache
date
Sat, 19 Mar 2022 17:58:15 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
content-type
text/javascript; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
1071
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
googleads.g.doubleclick.net/pagead/viewthroughconversion/830907969/ 		2 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://googleads.g.doubleclick.net/pagead/viewthroughconversion/830907969/?random=1647712695756&cv=9&fst=1647712695756&num=1&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=3&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa3e0&sendb=1&ig=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fweset-authty91.myvnc.com%2FLogin%2F%3Ftoken%3D&ref=https%3A%2F%2Fweset-authty91.myvnc.com%2F&tiba=Sign%20On%20to%20Your%20Citi%20Account%20-%20Citibank&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4
Requested by
Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/conversion_async.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:400e:811::2002 , Ireland, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
8518d9fe678db516a00e524a287d86e805fd6cc9301240a8683b9890c146c436
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://weset-authty91.myvnc.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma
no-cache
date
Sat, 19 Mar 2022 17:58:15 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
content-type
text/javascript; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
1072
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
googleads.g.doubleclick.net/pagead/viewthroughconversion/916451471/ 		2 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://googleads.g.doubleclick.net/pagead/viewthroughconversion/916451471/?random=1647712695757&cv=9&fst=1647712695757&num=1&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=3&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa3e0&sendb=1&ig=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fweset-authty91.myvnc.com%2FLogin%2F%3Ftoken%3D&ref=https%3A%2F%2Fweset-authty91.myvnc.com%2F&tiba=Sign%20On%20to%20Your%20Citi%20Account%20-%20Citibank&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4
Requested by
Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/conversion_async.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:400e:811::2002 , Ireland, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
6f1f85e990d15f0c6b60c12d779c32b1f6eb1f068c5d2b043346c86d4f9e35f4
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://weset-authty91.myvnc.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma
no-cache
date
Sat, 19 Mar 2022 17:58:15 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
content-type
text/javascript; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
1070
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
googleads.g.doubleclick.net/pagead/viewthroughconversion/959299794/ 		2 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://googleads.g.doubleclick.net/pagead/viewthroughconversion/959299794/?random=1647712695758&cv=9&fst=1647712695758&num=1&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=3&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa3e0&sendb=1&ig=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fweset-authty91.myvnc.com%2FLogin%2F%3Ftoken%3D&ref=https%3A%2F%2Fweset-authty91.myvnc.com%2F&tiba=Sign%20On%20to%20Your%20Citi%20Account%20-%20Citibank&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4
Requested by
Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/conversion_async.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:400e:811::2002 , Ireland, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
b0763a02f87d755004c1cc1f36d9191d7368a3c56e6df85e5ccfe0c98fad6876
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://weset-authty91.myvnc.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma
no-cache
date
Sat, 19 Mar 2022 17:58:15 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
content-type
text/javascript; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
1071
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
www.google.de/pagead/1p-user-list/960621875/
Redirect Chain
  • https://googleads.g.doubleclick.net/pagead/viewthroughconversion/960621875/?random=1647712695758&cv=9&fst=1647712695758&num=1&fmt=3&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=12...
  • https://www.google.com/pagead/1p-user-list/960621875/?random=1647712695758&cv=9&fst=1647709200000&num=1&fmt=3&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=3&u_tz=0&u_java=f...
  • https://www.google.de/pagead/1p-user-list/960621875/?random=1647712695758&cv=9&fst=1647709200000&num=1&fmt=3&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=3&u_tz=0&u_java=fa...
42 B
64 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.de/pagead/1p-user-list/960621875/?random=1647712695758&cv=9&fst=1647709200000&num=1&fmt=3&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=3&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa3e0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fweset-authty91.myvnc.com%2FLogin%2F%3Ftoken%3D&ref=https%3A%2F%2Fweset-authty91.myvnc.com%2F&tiba=Sign%20On%20to%20Your%20Citi%20Account%20-%20Citibank&async=1&is_vtc=1&random=3183123646&resp=GooglemKTybQhCsO&ipr=y
Protocol
H3
Server
2a00:1450:4001:80f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://weset-authty91.myvnc.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma
no-cache
date
Sat, 19 Mar 2022 17:58:15 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
content-security-policy
script-src 'none'; object-src 'none'
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma
no-cache
date
Sat, 19 Mar 2022 17:58:15 GMT
x-content-type-options
nosniff
server
cafe
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-type
image/gif
location
https://www.google.de/pagead/1p-user-list/960621875/?random=1647712695758&cv=9&fst=1647709200000&num=1&fmt=3&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=3&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa3e0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fweset-authty91.myvnc.com%2FLogin%2F%3Ftoken%3D&ref=https%3A%2F%2Fweset-authty91.myvnc.com%2F&tiba=Sign%20On%20to%20Your%20Citi%20Account%20-%20Citibank&async=1&is_vtc=1&random=3183123646&resp=GooglemKTybQhCsO&ipr=y
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
content-security-policy
script-src 'none'; object-src 'none'
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
googleads.g.doubleclick.net/pagead/viewthroughconversion/819500023/ 		2 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://googleads.g.doubleclick.net/pagead/viewthroughconversion/819500023/?random=1647712695759&cv=9&fst=1647712695759&num=1&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=3&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa3e0&sendb=1&ig=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fweset-authty91.myvnc.com%2FLogin%2F%3Ftoken%3D&ref=https%3A%2F%2Fweset-authty91.myvnc.com%2F&tiba=Sign%20On%20to%20Your%20Citi%20Account%20-%20Citibank&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4
Requested by
Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/conversion_async.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:400e:811::2002 , Ireland, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
754f1aab1ff014d34f48a2f555f3b3b4144c30b556485201ff27164e4cd670b0
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://weset-authty91.myvnc.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma
no-cache
date
Sat, 19 Mar 2022 17:58:15 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
content-type
text/javascript; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
1069
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
googleads.g.doubleclick.net/pagead/viewthroughconversion/975701947/ 		2 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://googleads.g.doubleclick.net/pagead/viewthroughconversion/975701947/?random=1647712695760&cv=9&fst=1647712695760&num=1&bg=ffffff&guid=ON&resp=GooglemKTybQhCsO&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=3&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa3e0&sendb=1&ig=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fweset-authty91.myvnc.com%2FLogin%2F%3Ftoken%3D&ref=https%3A%2F%2Fweset-authty91.myvnc.com%2F&tiba=Sign%20On%20to%20Your%20Citi%20Account%20-%20Citibank&hn=www.googleadservices.com&async=1&rfmt=3&fmt=4
Requested by
Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/conversion_async.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:400e:811::2002 , Ireland, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
bf401b18252536d92337719fbb6df87fddc118cda4c40f9a802ec7c7a1e0c41a
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://weset-authty91.myvnc.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma
no-cache
date
Sat, 19 Mar 2022 17:58:15 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
content-type
text/javascript; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
1072
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
www.google.com/pagead/1p-user-list/695231162/ 		42 B
64 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.com/pagead/1p-user-list/695231162/?random=1647712695752&cv=9&fst=1647709200000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=3&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa3e0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fweset-authty91.myvnc.com%2FLogin%2F%3Ftoken%3D&ref=https%3A%2F%2Fweset-authty91.myvnc.com%2F&tiba=Sign%20On%20to%20Your%20Citi%20Account%20-%20Citibank&async=1&fmt=3&is_vtc=1&random=1035707597&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:82b::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://weset-authty91.myvnc.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma
no-cache
date
Sat, 19 Mar 2022 17:58:15 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
content-security-policy
script-src 'none'; object-src 'none'
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
www.google.de/pagead/1p-user-list/695231162/ 		42 B
64 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.de/pagead/1p-user-list/695231162/?random=1647712695752&cv=9&fst=1647709200000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=3&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa3e0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fweset-authty91.myvnc.com%2FLogin%2F%3Ftoken%3D&ref=https%3A%2F%2Fweset-authty91.myvnc.com%2F&tiba=Sign%20On%20to%20Your%20Citi%20Account%20-%20Citibank&async=1&fmt=3&is_vtc=1&random=1035707597&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:80f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://weset-authty91.myvnc.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma
no-cache
date
Sat, 19 Mar 2022 17:58:15 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
content-security-policy
script-src 'none'; object-src 'none'
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
www.google.com/pagead/1p-user-list/959299794/ 		42 B
64 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.com/pagead/1p-user-list/959299794/?random=1647712695758&cv=9&fst=1647709200000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=3&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa3e0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fweset-authty91.myvnc.com%2FLogin%2F%3Ftoken%3D&ref=https%3A%2F%2Fweset-authty91.myvnc.com%2F&tiba=Sign%20On%20to%20Your%20Citi%20Account%20-%20Citibank&async=1&fmt=3&is_vtc=1&random=1525722711&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:82b::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://weset-authty91.myvnc.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma
no-cache
date
Sat, 19 Mar 2022 17:58:15 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
content-security-policy
script-src 'none'; object-src 'none'
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
www.google.de/pagead/1p-user-list/959299794/ 		42 B
64 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.de/pagead/1p-user-list/959299794/?random=1647712695758&cv=9&fst=1647709200000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=3&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa3e0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fweset-authty91.myvnc.com%2FLogin%2F%3Ftoken%3D&ref=https%3A%2F%2Fweset-authty91.myvnc.com%2F&tiba=Sign%20On%20to%20Your%20Citi%20Account%20-%20Citibank&async=1&fmt=3&is_vtc=1&random=1525722711&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:80f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://weset-authty91.myvnc.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma
no-cache
date
Sat, 19 Mar 2022 17:58:15 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
content-security-policy
script-src 'none'; object-src 'none'
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
www.google.com/pagead/1p-user-list/644574043/ 		42 B
64 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.com/pagead/1p-user-list/644574043/?random=1647712695755&cv=9&fst=1647709200000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=3&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa3e0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fweset-authty91.myvnc.com%2FLogin%2F%3Ftoken%3D&ref=https%3A%2F%2Fweset-authty91.myvnc.com%2F&tiba=Sign%20On%20to%20Your%20Citi%20Account%20-%20Citibank&async=1&fmt=3&is_vtc=1&random=920061915&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:82b::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://weset-authty91.myvnc.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma
no-cache
date
Sat, 19 Mar 2022 17:58:15 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
content-security-policy
script-src 'none'; object-src 'none'
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
www.google.de/pagead/1p-user-list/644574043/ 		42 B
64 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.de/pagead/1p-user-list/644574043/?random=1647712695755&cv=9&fst=1647709200000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=3&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa3e0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fweset-authty91.myvnc.com%2FLogin%2F%3Ftoken%3D&ref=https%3A%2F%2Fweset-authty91.myvnc.com%2F&tiba=Sign%20On%20to%20Your%20Citi%20Account%20-%20Citibank&async=1&fmt=3&is_vtc=1&random=920061915&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:80f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://weset-authty91.myvnc.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma
no-cache
date
Sat, 19 Mar 2022 17:58:15 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
content-security-policy
script-src 'none'; object-src 'none'
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
www.google.com/pagead/1p-user-list/916451471/ 		42 B
64 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.com/pagead/1p-user-list/916451471/?random=1647712695757&cv=9&fst=1647709200000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=3&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa3e0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fweset-authty91.myvnc.com%2FLogin%2F%3Ftoken%3D&ref=https%3A%2F%2Fweset-authty91.myvnc.com%2F&tiba=Sign%20On%20to%20Your%20Citi%20Account%20-%20Citibank&async=1&fmt=3&is_vtc=1&random=1947424021&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:82b::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://weset-authty91.myvnc.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma
no-cache
date
Sat, 19 Mar 2022 17:58:15 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
content-security-policy
script-src 'none'; object-src 'none'
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
www.google.de/pagead/1p-user-list/916451471/ 		42 B
64 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.de/pagead/1p-user-list/916451471/?random=1647712695757&cv=9&fst=1647709200000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=3&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa3e0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fweset-authty91.myvnc.com%2FLogin%2F%3Ftoken%3D&ref=https%3A%2F%2Fweset-authty91.myvnc.com%2F&tiba=Sign%20On%20to%20Your%20Citi%20Account%20-%20Citibank&async=1&fmt=3&is_vtc=1&random=1947424021&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:80f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://weset-authty91.myvnc.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma
no-cache
date
Sat, 19 Mar 2022 17:58:15 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
content-security-policy
script-src 'none'; object-src 'none'
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
www.google.com/pagead/1p-user-list/830907969/ 		42 B
64 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.com/pagead/1p-user-list/830907969/?random=1647712695756&cv=9&fst=1647709200000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=3&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa3e0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fweset-authty91.myvnc.com%2FLogin%2F%3Ftoken%3D&ref=https%3A%2F%2Fweset-authty91.myvnc.com%2F&tiba=Sign%20On%20to%20Your%20Citi%20Account%20-%20Citibank&async=1&fmt=3&is_vtc=1&random=2171958120&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:82b::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://weset-authty91.myvnc.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma
no-cache
date
Sat, 19 Mar 2022 17:58:15 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
content-security-policy
script-src 'none'; object-src 'none'
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
www.google.de/pagead/1p-user-list/830907969/ 		42 B
64 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.de/pagead/1p-user-list/830907969/?random=1647712695756&cv=9&fst=1647709200000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=3&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa3e0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fweset-authty91.myvnc.com%2FLogin%2F%3Ftoken%3D&ref=https%3A%2F%2Fweset-authty91.myvnc.com%2F&tiba=Sign%20On%20to%20Your%20Citi%20Account%20-%20Citibank&async=1&fmt=3&is_vtc=1&random=2171958120&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:80f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://weset-authty91.myvnc.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma
no-cache
date
Sat, 19 Mar 2022 17:58:15 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
content-security-policy
script-src 'none'; object-src 'none'
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
www.google.com/pagead/1p-user-list/975701947/ 		42 B
64 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.com/pagead/1p-user-list/975701947/?random=1647712695760&cv=9&fst=1647709200000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=3&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa3e0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fweset-authty91.myvnc.com%2FLogin%2F%3Ftoken%3D&ref=https%3A%2F%2Fweset-authty91.myvnc.com%2F&tiba=Sign%20On%20to%20Your%20Citi%20Account%20-%20Citibank&async=1&fmt=3&is_vtc=1&random=1816270089&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:82b::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://weset-authty91.myvnc.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma
no-cache
date
Sat, 19 Mar 2022 17:58:15 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
content-security-policy
script-src 'none'; object-src 'none'
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
www.google.de/pagead/1p-user-list/975701947/ 		42 B
64 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.de/pagead/1p-user-list/975701947/?random=1647712695760&cv=9&fst=1647709200000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=3&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa3e0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fweset-authty91.myvnc.com%2FLogin%2F%3Ftoken%3D&ref=https%3A%2F%2Fweset-authty91.myvnc.com%2F&tiba=Sign%20On%20to%20Your%20Citi%20Account%20-%20Citibank&async=1&fmt=3&is_vtc=1&random=1816270089&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:80f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://weset-authty91.myvnc.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma
no-cache
date
Sat, 19 Mar 2022 17:58:15 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
content-security-policy
script-src 'none'; object-src 'none'
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
www.google.com/pagead/1p-user-list/819500023/ 		42 B
64 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.com/pagead/1p-user-list/819500023/?random=1647712695759&cv=9&fst=1647709200000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=3&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa3e0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fweset-authty91.myvnc.com%2FLogin%2F%3Ftoken%3D&ref=https%3A%2F%2Fweset-authty91.myvnc.com%2F&tiba=Sign%20On%20to%20Your%20Citi%20Account%20-%20Citibank&async=1&fmt=3&is_vtc=1&random=237711790&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:82b::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://weset-authty91.myvnc.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma
no-cache
date
Sat, 19 Mar 2022 17:58:15 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
content-security-policy
script-src 'none'; object-src 'none'
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
www.google.de/pagead/1p-user-list/819500023/ 		42 B
64 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.de/pagead/1p-user-list/819500023/?random=1647712695759&cv=9&fst=1647709200000&num=1&bg=ffffff&guid=ON&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=3&u_tz=0&u_java=false&u_nplug=3&u_nmime=4&gtm=2oa3e0&sendb=1&data=event%3Dgtag.config&frm=0&url=https%3A%2F%2Fweset-authty91.myvnc.com%2FLogin%2F%3Ftoken%3D&ref=https%3A%2F%2Fweset-authty91.myvnc.com%2F&tiba=Sign%20On%20to%20Your%20Citi%20Account%20-%20Citibank&async=1&fmt=3&is_vtc=1&random=237711790&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:80f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://weset-authty91.myvnc.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36

Response headers

pragma
no-cache
date
Sat, 19 Mar 2022 17:58:15 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
content-security-policy
script-src 'none'; object-src 'none'
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
www.googleadservices.com
URL
http://www.googleadservices.com/pagead/conversion_async.js
Domain
www.googleadservices.com
URL
http://www.googleadservices.com/pagead/conversion_async.js
Domain
www.googleadservices.com
URL
http://www.googleadservices.com/pagead/conversion_async.js
Domain
www.googleadservices.com
URL
http://www.googleadservices.com/pagead/conversion_async.js
Domain
www.googleadservices.com
URL
http://www.googleadservices.com/pagead/conversion_async.js
Domain
www.googleadservices.com
URL
http://www.googleadservices.com/pagead/conversion_async.js
Domain
www.googleadservices.com
URL
http://www.googleadservices.com/pagead/conversion_async.js
Domain
www.googletagmanager.com
URL
http://www.googletagmanager.com/gtag/js?id=AW-959299794&l=dataLayer&cx=c
Domain
www.googletagmanager.com
URL
http://www.googletagmanager.com/gtag/js?id=AW-819500023&l=dataLayer&cx=c
Domain
www.googletagmanager.com
URL
http://www.googletagmanager.com/gtag/js?id=AW-695231162&l=dataLayer&cx=c
Domain
www.googletagmanager.com
URL
http://www.googletagmanager.com/gtag/js?id=AW-830907969&l=dataLayer&cx=c
Domain
www.googletagmanager.com
URL
http://www.googletagmanager.com/gtag/js?id=AW-975701947&l=dataLayer&cx=c
Domain
www.googletagmanager.com
URL
http://www.googletagmanager.com/gtag/js?id=AW-644574043&l=dataLayer&cx=c
Domain
www.googletagmanager.com
URL
http://www.googletagmanager.com/gtag/js?id=AW-960621875&l=dataLayer&cx=c
Domain
www.googleadservices.com
URL
http://www.googleadservices.com/pagead/conversion_async.js
Domain
cdn.pbbl.co
URL
http://cdn.pbbl.co/r/1560.js
Domain
nexus.ensighten.com
URL
http://nexus.ensighten.com/citi/na_prod/code/d139e7d35fc18934e03ae7d1eb3769bf.js?conditionId0=486757
Domain
nexus.ensighten.com
URL
http://nexus.ensighten.com/citi/na_prod/code/51aba9f62787efbaa13e53a8d1ae3892.js?conditionId0=4827153
Domain
nexus.ensighten.com
URL
http://nexus.ensighten.com/citi/na_prod/code/c942fa5b036f63cf515027e22894e5aa.js?conditionId0=421908
Domain
nexus.ensighten.com
URL
http://nexus.ensighten.com/citi/na_prod/code/557566dc60916e3de69e006bef252459.js?conditionId0=4837456
Domain
nexus.ensighten.com
URL
http://nexus.ensighten.com/citi/na_prod/code/42d4d669434e7d621371bd59ca097dbf.js?conditionId0=4897099
Domain
nexus.ensighten.com
URL
http://nexus.ensighten.com/citi/na_prod/code/fdf45a7c15c1cee06bb71e10dac4e26e.js?conditionId0=4849963
Domain
nexus.ensighten.com
URL
http://nexus.ensighten.com/citi/na_prod/serverComponent.php?r=197721.56227406068&namespace=Bootstrapper&staticJsPath=nexus.ensighten.com/citi/na_prod/code/&publishedOn=Tue%20Jun%2008%2018:03:25%20GMT%202021&ClientID=1129&PageID=http%3A%2F%2Flocalhost%2Fskemas%2FCiti%2520antis%2520upgraded%2520%40VixxxYZ%2Flogin%2Fses%2F%3Fresponse_type%3Dcode%26client_id%3DMOBI%2540AMER.OAUTHAP%26Auth_key%3D6a09773ace2bd074cd40eceabfc311eaa037e8a2
Domain
resources.digital-cloud-citi.medallia.com
URL
http://resources.digital-cloud-citi.medallia.com/wdcusciti/50/onsite/generic1642092206405.js

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Citibank (Banking)

58 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| 1 object| 2 object| 3 object| 4 object| 5 object| 6 object| 7 function| structuredClone object| oncontextlost object| oncontextrestored object| google_tag_manager object| dataLayer object| ensBootstraps object| Bootstrapper function| Visitor object| s_c_il number| s_c_in object| adobe_visitor function| targetPageParams object| adobe function| mboxCreate function| mboxDefine function| mboxUpdate number| getOfferCount object| citiData object| tags object| BKTAG function| bk_addUserCtx function| bk_addPageCtx function| bk_addEmailHash function| bk_addPhoneHash function| bk_doJSTag function| bk_doJSTag2 function| bk_doCarsJSTag function| bk_doPartnerAltTag function| bk_doCallbackTag function| bk_doCallbackTagWithTimeOut object| ttMETA function| ttMBX object| KAMPYLE_EMBED function| bk_async object| val function| gtag function| _rfi boolean| bk_use_multiple_iframes boolean| bk_allow_multiple_calls object| google_tag_data function| extend function| RocketfuelBCPInclude function| RocketfuelBCPClass function| RocketfuelUtils object| RocketfuelBCP undefined| CCSID undefined| citiLocale boolean| citiNGA undefined| pageID object| _pp

8 Cookies

Domain/Path Name / Value
weset-authty91.myvnc.com/ Name: PHPSESSID
Value: 4b8b1f0b3f912a933ae3320066047b15
weset-authty91.myvnc.com/ Name: 7830
Value: error
weset-authty91.myvnc.com/ Name: 7018
Value:
weset-authty91.myvnc.com/ Name: 64072
Value:
.doubleclick.net/ Name: IDE
Value: AHWqTUkyu_LsSTAme9I1Bsdu9AVPrw0bCzOvelsuhMVXM0Tk85JMz_OXdm0bzMSm
.weset-authty91.myvnc.com/ Name: _gcl_au
Value: 1.1.1312518037.1647712695
.rfihub.com/ Name: ruds
Value: H4sIAAAAAAAAAOMSNjU0Mja0NDMxMjQzNjAxMDA0NxPiM9RNTTEv8zc0SAt0rQwGADxYlTMlAAAA
.rfihub.com/ Name: rud
Value: H4sIAAAAAAAAAOMSNjU0Mja0NDMxMjQzNjAxMDA0NxPiM9RNTTEv8zc0SAt0rQyW4jU0MzE3NzQyszQ1MrAEAJJtVqU0AAAA

30 Console Messages

Source Level URL
Text
network error URL: https://weset-authty91.myvnc.com/A/css/other/cf.css
Message:
Failed to load resource: the server responded with a status of 404 (Not Found)
security error URL: https://weset-authty91.myvnc.com/Login/?token=
Message:
Mixed Content: The page at 'https://weset-authty91.myvnc.com/Login/?token=' was loaded over HTTPS, but requested an insecure script 'http://www.googleadservices.com/pagead/conversion_async.js'. This request has been blocked; the content must be served over HTTPS.
security error URL: https://weset-authty91.myvnc.com/Login/?token=
Message:
Mixed Content: The page at 'https://weset-authty91.myvnc.com/Login/?token=' was loaded over HTTPS, but requested an insecure script 'http://www.googleadservices.com/pagead/conversion_async.js'. This request has been blocked; the content must be served over HTTPS.
security error URL: https://weset-authty91.myvnc.com/Login/?token=
Message:
Mixed Content: The page at 'https://weset-authty91.myvnc.com/Login/?token=' was loaded over HTTPS, but requested an insecure script 'http://www.googleadservices.com/pagead/conversion_async.js'. This request has been blocked; the content must be served over HTTPS.
security error URL: https://weset-authty91.myvnc.com/Login/?token=
Message:
Mixed Content: The page at 'https://weset-authty91.myvnc.com/Login/?token=' was loaded over HTTPS, but requested an insecure script 'http://www.googleadservices.com/pagead/conversion_async.js'. This request has been blocked; the content must be served over HTTPS.
security error URL: https://weset-authty91.myvnc.com/Login/?token=
Message:
Mixed Content: The page at 'https://weset-authty91.myvnc.com/Login/?token=' was loaded over HTTPS, but requested an insecure script 'http://www.googleadservices.com/pagead/conversion_async.js'. This request has been blocked; the content must be served over HTTPS.
security error URL: https://weset-authty91.myvnc.com/Login/?token=
Message:
Mixed Content: The page at 'https://weset-authty91.myvnc.com/Login/?token=' was loaded over HTTPS, but requested an insecure script 'http://www.googleadservices.com/pagead/conversion_async.js'. This request has been blocked; the content must be served over HTTPS.
security error URL: https://weset-authty91.myvnc.com/Login/?token=
Message:
Mixed Content: The page at 'https://weset-authty91.myvnc.com/Login/?token=' was loaded over HTTPS, but requested an insecure script 'http://www.googleadservices.com/pagead/conversion_async.js'. This request has been blocked; the content must be served over HTTPS.
security error URL: https://weset-authty91.myvnc.com/Login/?token=
Message:
Mixed Content: The page at 'https://weset-authty91.myvnc.com/Login/?token=' was loaded over HTTPS, but requested an insecure script 'http://www.googletagmanager.com/gtag/js?id=AW-959299794&l=dataLayer&cx=c'. This request has been blocked; the content must be served over HTTPS.
security error URL: https://weset-authty91.myvnc.com/Login/?token=
Message:
Mixed Content: The page at 'https://weset-authty91.myvnc.com/Login/?token=' was loaded over HTTPS, but requested an insecure script 'http://www.googletagmanager.com/gtag/js?id=AW-819500023&l=dataLayer&cx=c'. This request has been blocked; the content must be served over HTTPS.
security error URL: https://weset-authty91.myvnc.com/Login/?token=
Message:
Mixed Content: The page at 'https://weset-authty91.myvnc.com/Login/?token=' was loaded over HTTPS, but requested an insecure script 'http://www.googletagmanager.com/gtag/js?id=AW-695231162&l=dataLayer&cx=c'. This request has been blocked; the content must be served over HTTPS.
security error URL: https://weset-authty91.myvnc.com/Login/?token=
Message:
Mixed Content: The page at 'https://weset-authty91.myvnc.com/Login/?token=' was loaded over HTTPS, but requested an insecure script 'http://www.googletagmanager.com/gtag/js?id=AW-830907969&l=dataLayer&cx=c'. This request has been blocked; the content must be served over HTTPS.
security error URL: https://weset-authty91.myvnc.com/Login/?token=
Message:
Mixed Content: The page at 'https://weset-authty91.myvnc.com/Login/?token=' was loaded over HTTPS, but requested an insecure script 'http://www.googletagmanager.com/gtag/js?id=AW-975701947&l=dataLayer&cx=c'. This request has been blocked; the content must be served over HTTPS.
security error URL: https://weset-authty91.myvnc.com/Login/?token=
Message:
Mixed Content: The page at 'https://weset-authty91.myvnc.com/Login/?token=' was loaded over HTTPS, but requested an insecure script 'http://www.googletagmanager.com/gtag/js?id=AW-644574043&l=dataLayer&cx=c'. This request has been blocked; the content must be served over HTTPS.
security error URL: https://weset-authty91.myvnc.com/Login/?token=
Message:
Mixed Content: The page at 'https://weset-authty91.myvnc.com/Login/?token=' was loaded over HTTPS, but requested an insecure script 'http://www.googletagmanager.com/gtag/js?id=AW-960621875&l=dataLayer&cx=c'. This request has been blocked; the content must be served over HTTPS.
security error URL: https://weset-authty91.myvnc.com/Login/?token=
Message:
Mixed Content: The page at 'https://weset-authty91.myvnc.com/Login/?token=' was loaded over HTTPS, but requested an insecure script 'http://www.googleadservices.com/pagead/conversion_async.js'. This request has been blocked; the content must be served over HTTPS.
security error URL: https://weset-authty91.myvnc.com/Login/?token=
Message:
Mixed Content: The page at 'https://weset-authty91.myvnc.com/Login/?token=' was loaded over HTTPS, but requested an insecure script 'http://cdn.pbbl.co/r/1560.js'. This request has been blocked; the content must be served over HTTPS.
security error URL: https://weset-authty91.myvnc.com/Login/?token=
Message:
Mixed Content: The page at 'https://weset-authty91.myvnc.com/Login/?token=' was loaded over HTTPS, but requested an insecure script 'http://nexus.ensighten.com/citi/na_prod/code/d139e7d35fc18934e03ae7d1eb3769bf.js?conditionId0=486757'. This request has been blocked; the content must be served over HTTPS.
security error URL: https://weset-authty91.myvnc.com/Login/?token=
Message:
Mixed Content: The page at 'https://weset-authty91.myvnc.com/Login/?token=' was loaded over HTTPS, but requested an insecure script 'http://nexus.ensighten.com/citi/na_prod/code/51aba9f62787efbaa13e53a8d1ae3892.js?conditionId0=4827153'. This request has been blocked; the content must be served over HTTPS.
security error URL: https://weset-authty91.myvnc.com/Login/?token=
Message:
Mixed Content: The page at 'https://weset-authty91.myvnc.com/Login/?token=' was loaded over HTTPS, but requested an insecure script 'http://nexus.ensighten.com/citi/na_prod/code/c942fa5b036f63cf515027e22894e5aa.js?conditionId0=421908'. This request has been blocked; the content must be served over HTTPS.
security error URL: https://weset-authty91.myvnc.com/Login/?token=
Message:
Mixed Content: The page at 'https://weset-authty91.myvnc.com/Login/?token=' was loaded over HTTPS, but requested an insecure script 'http://nexus.ensighten.com/citi/na_prod/code/557566dc60916e3de69e006bef252459.js?conditionId0=4837456'. This request has been blocked; the content must be served over HTTPS.
security error URL: https://weset-authty91.myvnc.com/Login/?token=
Message:
Mixed Content: The page at 'https://weset-authty91.myvnc.com/Login/?token=' was loaded over HTTPS, but requested an insecure script 'http://nexus.ensighten.com/citi/na_prod/code/42d4d669434e7d621371bd59ca097dbf.js?conditionId0=4897099'. This request has been blocked; the content must be served over HTTPS.
security error URL: https://weset-authty91.myvnc.com/Login/?token=
Message:
Mixed Content: The page at 'https://weset-authty91.myvnc.com/Login/?token=' was loaded over HTTPS, but requested an insecure script 'http://nexus.ensighten.com/citi/na_prod/code/fdf45a7c15c1cee06bb71e10dac4e26e.js?conditionId0=4849963'. This request has been blocked; the content must be served over HTTPS.
security error URL: https://weset-authty91.myvnc.com/Login/?token=
Message:
Mixed Content: The page at 'https://weset-authty91.myvnc.com/Login/?token=' was loaded over HTTPS, but requested an insecure script 'http://nexus.ensighten.com/citi/na_prod/serverComponent.php?r=197721.56227406068&namespace=Bootstrapper&staticJsPath=nexus.ensighten.com/citi/na_prod/code/&publishedOn=Tue%20Jun%2008%2018:03:25%20GMT%202021&ClientID=1129&PageID=http%3A%2F%2Flocalhost%2Fskemas%2FCiti%2520antis%2520upgraded%2520%40VixxxYZ%2Flogin%2Fses%2F%3Fresponse_type%3Dcode%26client_id%3DMOBI%2540AMER.OAUTHAP%26Auth_key%3D6a09773ace2bd074cd40eceabfc311eaa037e8a2'. This request has been blocked; the content must be served over HTTPS.
security error URL: https://weset-authty91.myvnc.com/Login/?token=
Message:
Mixed Content: The page at 'https://weset-authty91.myvnc.com/Login/?token=' was loaded over HTTPS, but requested an insecure script 'http://resources.digital-cloud-citi.medallia.com/wdcusciti/50/onsite/generic1642092206405.js'. This request has been blocked; the content must be served over HTTPS.
security error URL: https://weset-authty91.myvnc.com/Login/?token=(Line 9240)
Message:
Mixed Content: The page at 'https://weset-authty91.myvnc.com/Login/?token=' was loaded over HTTPS, but requested an insecure frame 'http://fast.citi.demdex.net/dest5.html?d_nsid=0#http%3A%2F%2Flocalhost%2Fskemas%2FCiti%2520antis%2520upgraded%2520%40VixxxYZ%2Flogin%2Fses%2F%3Fresponse_type%3Dcode%26client_id%3DMOBI%2540AMER.OAUTHAP%26Auth_key%3D6a09773ace2bd074cd40eceabfc311eaa037e8a2'. This request has been blocked; the content must be served over HTTPS.
security error URL: https://weset-authty91.myvnc.com/Login/?token=(Line 9240)
Message:
Mixed Content: The page at 'https://weset-authty91.myvnc.com/Login/?token=' was loaded over HTTPS, but requested an insecure frame 'http://cdn.pbbl.co/i/pp.html'. This request has been blocked; the content must be served over HTTPS.
network error URL: https://weset-authty91.myvnc.com/Login/img/Citi-Branding-Sprite.png
Message:
Failed to load resource: the server responded with a status of 404 (Not Found)
network error URL: https://cdn.pbbl.co/r/1560.js
Message:
Failed to load resource: the server responded with a status of 403 ()
network error URL: https://sr.rlcdn.com/425466.html?es=80676&u=da39a3ee5e6b4b0d3255bfef95601890afd80709
Message:
Failed to load resource: the server responded with a status of 451 ()

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

20766699p.rfihub.com
bid.g.doubleclick.net
c1.rfihub.net
cdn.pbbl.co
googleads.g.doubleclick.net
nebula-cdn.kampyle.com
nexus.ensighten.com
resources.digital-cloud-citi.medallia.com
sr.rlcdn.com
stags.bluekai.com
tags.bkrtx.com
udc-neb.kampyle.com
weset-authty91.myvnc.com
www.google.com
www.google.de
www.googleadservices.com
www.googletagmanager.com
cdn.pbbl.co
nexus.ensighten.com
resources.digital-cloud-citi.medallia.com
www.googleadservices.com
www.googletagmanager.com
104.111.215.191
104.111.228.137
142.250.186.66
143.204.98.10
151.101.129.175
151.101.130.133
18.195.42.228
193.0.160.128
2600:9000:2156:2200:1:76cf:fe80:93a1
2a00:1450:4001:808::2008
2a00:1450:4001:80f::2003
2a00:1450:4001:82b::2004
2a00:1450:400e:811::2002
35.190.60.146
35.238.108.96
35.241.45.82
74.125.140.157
045cd226594cb32ddf9d4db8ee45611f4d0788675ae50180b68da975e66fe1fe
05a45e5c705e5fa8b22c243d3461520e64f75236b702335764bed044e763e25e
0bcb15216559cb490a994fc29303e9e66b109926890e7d3abfddbbfcef347c8e
0f197c1bafc914491304543957ab66aca2478f96f47e83c1d52c6ed3f0c705e9
176078acf95925030c4e9b30530e20df88d737449b844668c3e92ba6824667f0
18d6a4a09afb30486dd82b5f891b48a89c0351db8f822cfe62c211dbfc7ea662
19ef71e61ea260132de754bad941bd81341a25572a3b70247feca472245e8069
240e5a83cdf55f2e51dc88202c4aec54ca03dc9ca7853be6a78baa6faf5e7399
305dc8e1830d85f5fae62d7d0f64bce480a9046f0901a50034d9051b5194a86e
31b00ff4929696dfca06885da68e58c3e09f6ecb4ae0fe1ae287e99a3fd1f716
3e72de5de67d6d80b65a114af684eaf880c53c250155a663cb17d677ff064bc1
47947b365dd8c21dce94bc4c0fb396a4092a9432c51d1e110a459e2ef4f66ced
48e89b7e40e096b89d864a5c8ee340ce44ca60fe9675310ef2f3f40a53a7d593
53350525edba0b889e87ea52a16ed843a928a2557e9f8d6747acd7ff991c95c3
5394d11ec8ad7a5494bcdb65cd95f885388532e14fb45a747e249112389bd837
548194622289ab82f8acdbbf28b42344707286162061b234825775b5eb8e54a2
59ba550db7e458d068158c106f1ed530820894bd8fc4a4c0cbad2ba9830ac4fa
5cbb5852d6dd001b4defb3f6ace7f8beb88d0f19d20d00ebfd086a24c31988db
62d78d13e0d580d2235c1000802dd97b9330b682302f1b48e842003ce8c6db9d
6336ae7b60dff18e0a37721a3a19fd5e18568577a64faa662969d35966dbf72b
6936889e6ea8d99c5d944f2ee9ad7461bdfb61e4bca4adf6dae9e177ac847ad1
695788dc05d94be3b32060ffea15c1a4d74897bd32e5da7811e7ca76d82fc86b
6dfa343a68ef79e83fef5f7c705119d2473352190c609cf94c67ea99a29fa452
6f1f85e990d15f0c6b60c12d779c32b1f6eb1f068c5d2b043346c86d4f9e35f4
70f3cacfaa80a9d270cf98ce26fef532b1004bc471a20611f35bc70cd6d8d899
754f1aab1ff014d34f48a2f555f3b3b4144c30b556485201ff27164e4cd670b0
7df13706eaab8ce9a3dcd2a501f60bc66987c83834d07dfaf07ae56ef814c110
7ef97b12890fc6fee67f869c6e1f74b6719de7d66ac0d649c8d7386a80b4c30f
8518d9fe678db516a00e524a287d86e805fd6cc9301240a8683b9890c146c436
8558112ac03ab3ed170af04ab21c3e2153644d7be610b1b02045fa3d6d9a835a
88cd43c3f5453f7b4db2cbe884b47db3c8317860a2ce6e9b2bc934ff4b8e32eb
972d9f0db48368cfe87f6a7a30ffed6f24c4df83ace4d1391fbbcab3a4e631dc
9946d53fd289535b32d7d2fa1bf8c251337dda6ccf582dfe2764bf5101d09081
9aadbf79a92035c44b837b9c2a08c5fab94bcb95cd674e025bfba1691fa6f275
9bae0960b0e69f0f24e789b5a3825850055f9f71caab3975ce718c79ff5087a5
a593628f2d5ba814f37fbcd3963162f094c2764d4b15d82464c2d1aef92f150f
a6e17deb5d2a9954def8e522ed124a5b6469289637b1083d9cc81707826e9283
afe4bad9f786ea48dff9f036a9b09ee5b3484392cf05cf9981f4915c688a24d3
b0763a02f87d755004c1cc1f36d9191d7368a3c56e6df85e5ccfe0c98fad6876
b11b99679f35612b35b8c414c153285ebf576bf884bcf1282aa6a3b77e85205c
b5d1c26722742c44e62a4fbb4b67117d2587aa320f61784a27fea9d66d9f62b4
b872b4ad2e649961fbf3cdc43966716bd820301634adebaf5329c1aa22a1f7ee
b8e446605f92c29a178dd6494688103ac268004592afe06643df46f4bff68577
be9b5382b4526ffd3306d0292122ce3599123f1cd543f52f3035b4f24fbf9de8
bf401b18252536d92337719fbb6df87fddc118cda4c40f9a802ec7c7a1e0c41a
bf8892a953595eb96b9ca68c5756849d404115dcf2ee9bf87e8b4e7b3cf8e650
c437eb764a99e6cd5172d63c3fae564bbc51eda4981058d5edebd2bf0700eb76
c4bfc45b3cbb970db8d5280e5992333498eeed96e5dbda1375ae7be6204b20c6
c73e69a929ce513e05bba4a3359296cf41064aaff3355d900b971ca39175a935
cef1c9e6ac00420cb0924c80dc6bce5f3d8ac2322ac5fa0898ee81c4bb0246b0
d1ba7a6475255c11f281cb94dcc3de7090a7a580fc2c64cb9b880d36b1be6d2f
d5a89e26beae0bc03ad18a0b0d1d3d75f87c32047879d25da11970cb5c4662a3
d954fb5ecb3b158b90b283529846f344331bd175799f424755a3786a405e14a4
dc49949d2fbc73d50f3342afecce24e3e8618decb9cac61e9ec1ac80f089ae66
e240cc5eae742b60924ba12329e9642efe98288473939813627d63dc63df5518
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e54d786bbb6fe201b8e9856dba58cac732013ec0e3066cb824c3716dc5ce915e
e8a4294485eefbee4926ba6ff593a7628233c0909ed58bb16e7b63c8bc63ba7a
e9e9a67395a0d83b584208a19b95af203df8e8e6c6952fe76c690d60ea9381c7
ecc1b4a8618cab027412168bdd0de6e4d4ade3e076303f89a36ba4dd312a93f9
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f0ce519069b75d94b29fec0deddd946a57d65b8fb49824ffc0157c634aa203c8
f327a0ba3e41b1e8154e1c18fc114baff0bd057151e3afe7fa6f33cc0cb18296
f378974fe6a831ae2f48d9191ea74eb21877d4964d5eedbc2810d8756ed13631
f94cb7cab7413f3e828c469111e3f9ee7bf21ac163cea343be2cdef866160d40
ffb651309250e9ce8ca4d6a354d9403cb80ec23ef11eebc6d518163948061c82