citloginnow.gezuxuru.workers.dev Open in urlscan Pro
2606:4700:3036::ac43:89ae Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

URL:
https://citloginnow.gezuxuru.workers.dev/
Submission: On October 03 via api (October 3rd 2024, 11:18:40 am UTC) from HK — Scanned from DE

Summary HTTP 63 Redirects Behaviour Indicators

Summary

This website contacted 15 IPs in 4 countries across 13 domains to perform 63 HTTP transactions. The main IP is 2606:4700:3036::ac43:89ae, located in United States and belongs to CLOUDFLARENET, US. The main domain is citloginnow.gezuxuru.workers.dev.
TLS certificate: Issued by WE1 on August 24th 2024. Valid for: 3 months.

This is the only time citloginnow.gezuxuru.workers.dev was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Citibank (Banking) Generic Cloudflare (Online)

Domain & IP information

	IP Address	AS Autonomous System
1 8	2606:4700:303... 2606:4700:3036::ac43:89ae	13335 (CLOUDFLAR...) (CLOUDFLARENET)
16	2620:100:6027... 2620:100:6027:15::a27d:480f	19679 (DROPBOX) (DROPBOX)
1	2a00:1450:400... 2a00:1450:4001:829::200a	15169 (GOOGLE) (GOOGLE)
1	23.212.222.130 23.212.222.130	16625 (AKAMAI-AS) (AKAMAI-AS)
1	162.19.58.158 162.19.58.158	16276 (OVH) (OVH)
1	172.67.74.152 172.67.74.152	13335 (CLOUDFLAR...) (CLOUDFLARENET)
7	2600:9000:206... 2600:9000:206f:a400:2:8f43:5780:93a1	16509 (AMAZON-02) (AMAZON-02)
5	2a00:1450:400... 2a00:1450:4001:831::2008	15169 (GOOGLE) (GOOGLE)
1	2600:9000:214... 2600:9000:214f:2a00:1:76cf:fe80:93a1	16509 (AMAZON-02) (AMAZON-02)
1	193.0.160.130 193.0.160.130	54312 (ROCKETFUEL) (ROCKETFUEL)
7	104.17.209.240 104.17.209.240	13335 (CLOUDFLAR...) (CLOUDFLARENET)
10	142.250.185.104 142.250.185.104	15169 (GOOGLE) (GOOGLE)
1	35.244.154.8 35.244.154.8	15169 (GOOGLE) (GOOGLE)
3	104.17.208.240 104.17.208.240	13335 (CLOUDFLAR...) (CLOUDFLARENET)
63	15

8 2606:4700:3036::ac43:89ae (United States) 1 redirects

ASN13335 (CLOUDFLARENET, US)

citloginnow.gezuxuru.workers.dev	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

16 2620:100:6027:15::a27d:480f (United States)

ASN19679 (DROPBOX, US)

dl.dropboxusercontent.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:829::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

ajax.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 23.212.222.130 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a23-212-222-130.deploy.static.akamaitechnologies.com

www.citi.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 162.19.58.158 (France)

ASN16276 (OVH, FR)
PTR: ns3096590.ip-162-19-58.eu

i.ibb.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 172.67.74.152 (United States)

ASN13335 (CLOUDFLARENET, US)

api.ipify.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 2600:9000:206f:a400:2:8f43:5780:93a1 (United States)

ASN16509 (AMAZON-02, US)

nexus.ensighten.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2a00:1450:4001:831::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:214f:2a00:1:76cf:fe80:93a1 (United States)

ASN16509 (AMAZON-02, US)

c1.rfihub.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 193.0.160.130 (United States)

ASN54312 (ROCKETFUEL, US)

20766699p.rfihub.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 104.17.209.240 (None, )

ASN13335 (CLOUDFLARENET, US)

zn3vi8kkuds0jjrfc-citifeedback.siteintercept.qualtrics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
siteintercept.qualtrics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

10 142.250.185.104 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s49-in-f8.1e100.net

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 35.244.154.8 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 8.154.244.35.bc.googleusercontent.com

sr.rlcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 104.17.208.240 (None, )

ASN13335 (CLOUDFLARENET, US)

siteintercept.qualtrics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
16	dropboxusercontent.com dl.dropboxusercontent.com — Cisco Umbrella Rank: 18478	795 KB
15	googletagmanager.com www.googletagmanager.com — Cisco Umbrella Rank: 39	1 MB
10	qualtrics.com zn3vi8kkuds0jjrfc-citifeedback.siteintercept.qualtrics.com — Cisco Umbrella Rank: 34896 siteintercept.qualtrics.com — Cisco Umbrella Rank: 835	98 KB
8	workers.dev 1 redirects citloginnow.gezuxuru.workers.dev	310 KB
7	ensighten.com nexus.ensighten.com — Cisco Umbrella Rank: 4670	93 KB
1	rlcdn.com sr.rlcdn.com — Cisco Umbrella Rank: 31003
1	rfihub.com 20766699p.rfihub.com — Cisco Umbrella Rank: 144366
1	rfihub.net c1.rfihub.net — Cisco Umbrella Rank: 4780	6 KB
1	ipify.org api.ipify.org — Cisco Umbrella Rank: 2041	165 B
1	ibb.co i.ibb.co — Cisco Umbrella Rank: 12145	3 KB
1	citi.com www.citi.com — Cisco Umbrella Rank: 26554	2 KB
1	googleapis.com ajax.googleapis.com — Cisco Umbrella Rank: 412	31 KB
0	amazon-adsystem.com Failed s.amazon-adsystem.com — Cisco Umbrella Rank: 352 Failed
63	13

	Domain	Requested by
16	dl.dropboxusercontent.com	citloginnow.gezuxuru.workers.dev
15	www.googletagmanager.com	dl.dropboxusercontent.com www.googletagmanager.com
9	siteintercept.qualtrics.com	zn3vi8kkuds0jjrfc-citifeedback.siteintercept.qualtrics.com siteintercept.qualtrics.com
8	citloginnow.gezuxuru.workers.dev	1 redirects citloginnow.gezuxuru.workers.dev
7	nexus.ensighten.com	citloginnow.gezuxuru.workers.dev dl.dropboxusercontent.com
1	sr.rlcdn.com	nexus.ensighten.com
1	zn3vi8kkuds0jjrfc-citifeedback.siteintercept.qualtrics.com	nexus.ensighten.com
1	20766699p.rfihub.com	c1.rfihub.net
1	c1.rfihub.net	nexus.ensighten.com
1	api.ipify.org	citloginnow.gezuxuru.workers.dev
1	i.ibb.co	citloginnow.gezuxuru.workers.dev
1	www.citi.com	citloginnow.gezuxuru.workers.dev
1	ajax.googleapis.com	citloginnow.gezuxuru.workers.dev
0	s.amazon-adsystem.com Failed
63	14

This site contains no links.

Subject Issuer	Validity	Valid
gezuxuru.workers.dev WE1	`2024-08-24` - `2024-11-22`	3 months	crt.sh
*.dl.dropboxusercontent.com DigiCert TLS RSA SHA256 2020 CA1	`2024-03-25` - `2025-03-11`	a year	crt.sh
upload.video.google.com WR2	`2024-09-16` - `2024-12-09`	3 months	crt.sh
www.citi.com DigiCert EV RSA CA G2	`2024-05-09` - `2024-12-05`	7 months	crt.sh
ibb.co E5	`2024-08-22` - `2024-11-20`	3 months	crt.sh
ipify.org WE1	`2024-09-15` - `2024-12-14`	3 months	crt.sh
nexus.ensighten.com Amazon RSA 2048 M03	`2024-08-29` - `2025-09-28`	a year	crt.sh
*.google-analytics.com WR2	`2024-09-16` - `2024-12-09`	3 months	crt.sh
*.rfihub.net Amazon RSA 2048 M03	`2024-09-30` - `2025-10-29`	a year	crt.sh
*.rfihub.com Sectigo RSA Domain Validation Secure Server CA	`2024-04-08` - `2025-04-27`	a year	crt.sh
*.qualtrics.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2024-03-27` - `2025-02-19`	a year	crt.sh
*.rlcdn.com Sectigo RSA Domain Validation Secure Server CA	`2024-02-06` - `2025-03-05`	a year	crt.sh

This page contains 3 frames:

Primary Page: https://citloginnow.gezuxuru.workers.dev/
Frame ID: 19A8964F202EBF2BF950A5EDBF60B33A
Requests: 61 HTTP requests in this frame

Frame: https://20766699p.rfihub.com/ca.html?ver=9&ra=859&rb=648&ca=20766699&_o=17169175&_t=&_rev=1&_pcode=1&_orderid=1&ssv_cuuid=&ssv_package=null&ssv_prodlist=null&ssv_pagename=&pe=https%3A%2F%2Fcitloginnow.gezuxuru.workers.dev%2F&pf=https%3A%2F%2Fcitloginnow.gezuxuru.workers.dev%2F&ra=4190338268002747
Frame ID: FE8D90A94F4BEE4A3E04D6E679B1816C
Requests: 1 HTTP requests in this frame

Frame: https://sr.rlcdn.com/425466.html?es=80676&u=da39a3ee5e6b4b0d3255bfef95601890afd80709
Frame ID: 6987E15DF648B65B8E141F365B15B7FC
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Sign On to Your Citi Account - Citibank

Page URL History Show full URLs

https://citloginnow.gezuxuru.workers.dev/ Page URL
https://citloginnow.gezuxuru.workers.dev/cdn-cgi/phish-bypass?atok=zrHdWrKC1dHfpzyjRgi81d7KFJwxBhCrGdNfCWfdsgA-172795... HTTP 301
https://citloginnow.gezuxuru.workers.dev/ Page URL

Detected technologies

Bootstrap (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js

Ensighten (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

//nexus\.ensighten\.com/

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/gtag/js

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

/([\d.]+)/jquery(?:\.min)?\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

63
Requests

98 %
HTTPS

43 %
IPv6

13
Domains

14
Subdomains

15
IPs

4
Countries

2624 kB
Transfer

13522 kB
Size

10
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://citloginnow.gezuxuru.workers.dev/ Page URL
https://citloginnow.gezuxuru.workers.dev/cdn-cgi/phish-bypass?atok=zrHdWrKC1dHfpzyjRgi81d7KFJwxBhCrGdNfCWfdsgA-1727954307-0.0.1.1-%2F HTTP 301
https://citloginnow.gezuxuru.workers.dev/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 42

https://s.amazon-adsystem.com/iu3?pid=c3702eea-109e-48b0-9ef4-c856bdd405e2&event=PageView HTTP 302
https://s.amazon-adsystem.com/iu3?pid=c3702eea-109e-48b0-9ef4-c856bdd405e2&event=PageView&dcc=t

63 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 / Show response
citloginnow.gezuxuru.workers.dev/ 4 KB
2 KB 100ms
28ms Document
text/html 2606:4700:3036::ac43:89ae
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://citloginnow.gezuxuru.workers.dev/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:3036::ac43:89ae , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

e541e0f1457ebdf9633dcefb5787d9f6d6b94b5ec402918686cf9ed8e113cb04

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

cf-ray: 8ccc8814ada035fc-FRA
content-encoding: gzip
content-type: text/html; charset=UTF-8
date: Thu, 03 Oct 2024 11:18:27 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=uTkuj1ESxopIYYRXsbQH9MXuL1Cg8%2B2EDoKeDzpZDqqbhddyle82zX2%2B8XIMEZ8gwRyrqnGYusugLFMFmiZ6ZWnWaSb51tfG40eLqXOxIa2fIhI%2FunZ2QthrvCRR%2B1VykfvGxeuWwhM3SROseZiObf3B3zCGOKUBVP%2FpeMEebw%3D%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
speculation-rules: "/cdn-cgi/speculation"
vary: Accept-Encoding
x-frame-options: SAMEORIGIN

GET
H2 200 speculation
citloginnow.gezuxuru.workers.dev/cdn-cgi/ 128 B
504 B 33ms
32ms Other
application/speculationrules+json 2606:4700:3036::ac43:89ae
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://citloginnow.gezuxuru.workers.dev/cdn-cgi/speculation
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3036::ac43:89ae , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 11a2142988720cd49ff000e5d488493947b3d34821301c5a706b3495b8381f7d

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Origin: https://citloginnow.gezuxuru.workers.dev
Referer: https://citloginnow.gezuxuru.workers.dev/

Response headers

nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=D17VltuD%2ByHikqTlw7E5BFZmxPYp9g5ZhYxgO7maAuP3y2McoApaGPwae4HmuZ4M6Ij6nRdeEHj7USZ4FUZU9tH5yXN2YcqK%2B2QArprDQvvTaaT0REiUrQbztI5eLpEVXK77zi4Q4A07qfT954E%2B9CJeAJDpfLFCgYxns%2Fafhw%3D%3D"}],"group":"cf-nel","max_age":604800}
cf-ray: 8ccc8814ddcc35fc-FRA
access-control-allow-origin: https://citloginnow.gezuxuru.workers.dev
content-length: 128
date: Thu, 03 Oct 2024 11:18:27 GMT
content-type: application/speculationrules+json
vary: Origin, Accept-Encoding
server: cloudflare

GET
H2 200 cf.errors.css
citloginnow.gezuxuru.workers.dev/cdn-cgi/styles/ 23 KB
5 KB 33ms
33ms Stylesheet
text/css 2606:4700:3036::ac43:89ae
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://citloginnow.gezuxuru.workers.dev/cdn-cgi/styles/cf.errors.css

Requested by

Host: citloginnow.gezuxuru.workers.dev
URL: https://citloginnow.gezuxuru.workers.dev/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:3036::ac43:89ae , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

84e3c77025ace5af143972b4a40fc834dcdfd4e449d4b36a57e62326f16b3091

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://citloginnow.gezuxuru.workers.dev/

Response headers

vary: Accept-Encoding
cache-control: max-age=7200, public
content-encoding: gzip
etag: W/"66f525a7-5df3"
x-content-type-options: nosniff
cf-ray: 8ccc8814ddce35fc-FRA
expires: Thu, 03 Oct 2024 13:18:27 GMT
date: Thu, 03 Oct 2024 11:18:27 GMT
content-type: text/css
last-modified: Thu, 26 Sep 2024 09:13:11 GMT
server: cloudflare
x-frame-options: DENY

GET
H2 200 icon-exclamation.png
citloginnow.gezuxuru.workers.dev/cdn-cgi/images/ 452 B
540 B 10ms
10ms Image
image/png 2606:4700:3036::ac43:89ae
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://citloginnow.gezuxuru.workers.dev/cdn-cgi/images/icon-exclamation.png?1376755637

Requested by

Host: citloginnow.gezuxuru.workers.dev
URL: https://citloginnow.gezuxuru.workers.dev/cdn-cgi/styles/cf.errors.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:3036::ac43:89ae , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f1591a5221136c49438642155691ae6c68e25b7241f3d7ebe975b09a77662016

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://citloginnow.gezuxuru.workers.dev/cdn-cgi/styles/cf.errors.css

Response headers

vary: Accept-Encoding
cache-control: max-age=7200, public
etag: "66f525a7-1c4"
x-content-type-options: nosniff
cf-ray: 8ccc88150e0835fc-FRA
expires: Thu, 03 Oct 2024 13:18:27 GMT
accept-ranges: bytes
content-length: 452
date: Thu, 03 Oct 2024 11:18:27 GMT
content-type: image/png
last-modified: Thu, 26 Sep 2024 09:13:11 GMT
server: cloudflare
x-frame-options: DENY

GET
H2 200 favicon.ico
citloginnow.gezuxuru.workers.dev/ 3 MB
151 KB 114ms
114ms Other
text/html 2606:4700:3036::ac43:89ae
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://citloginnow.gezuxuru.workers.dev/favicon.ico
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3036::ac43:89ae , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: d85294e27c6d8e2ca68fe77d76d663c96c68d971f7d0d221409fd089db5c7df8

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://citloginnow.gezuxuru.workers.dev/

Response headers

nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding: br
speculation-rules: "/cdn-cgi/speculation"
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=yI4nywNud3cJUabcTWCwlFsmskhYlf4H5XVaA92iH3TM0bo%2FqGqXeI7o36hqR5DA62AVwnykP2avVwfv%2FMYp1BspMuC%2Bipkjkow%2F8bPuoBs7WnENlHNbRv2W43DEra%2BJnIICSYsZIcaJW7NEoQwLUyNqOigXPAoPOdCOF%2BL%2FUg%3D%3D"}],"group":"cf-nel","max_age":604800}
cf-ray: 8ccc88152e2d35fc-FRA
date: Thu, 03 Oct 2024 11:18:27 GMT
content-type: text/html;charset=UTF-8
vary: Accept-Encoding
server: cloudflare

GET
H2

200

Primary Request / Show response
citloginnow.gezuxuru.workers.dev/
Redirect Chain

https://citloginnow.gezuxuru.workers.dev/cdn-cgi/phish-bypass?atok=zrHdWrKC1dHfpzyjRgi81d7KFJwxBhCrGdNfCWfdsgA-1727954307-0.0.1.1-%2F
https://citloginnow.gezuxuru.workers.dev/

3 MB
151 KB

19ms
18ms

Document
text/html

2606:4700:3036::ac43:89ae
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://citloginnow.gezuxuru.workers.dev/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3036::ac43:89ae , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: d85294e27c6d8e2ca68fe77d76d663c96c68d971f7d0d221409fd089db5c7df8

Request headers

Referer: https://citloginnow.gezuxuru.workers.dev/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

cf-ray: 8ccc883468c735fc-FRA
content-encoding: br
content-type: text/html;charset=UTF-8
date: Thu, 03 Oct 2024 11:18:32 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=7iJvDGgNYHX1u8ARJ%2BfDOAKW4qBNvt5mOjdENceGksXAo5tro9If7pq%2BgmZ9o8sdZHOKaLv9b1sqz81njNYG1s64v%2B991Jvf2gNqruw6uP7KA9DwnKYrg1Oon9NvimroCgFOugQ3fn%2BAql3gG3MhoAAWltUnCoDj85XUnmIDOQ%3D%3D"}],"group":"cf-nel","max_age":604800}
server: cloudflare
speculation-rules: "/cdn-cgi/speculation"
vary: Accept-Encoding

Redirect headers

cache-control: private, no-cache
cf-ray: 8ccc883448b135fc-FRA
content-length: 167
content-type: text/html
date: Thu, 03 Oct 2024 11:18:32 GMT
location: https://citloginnow.gezuxuru.workers.dev/
server: cloudflare
x-content-type-options: nosniff
x-frame-options: DENY

GET
H2 200 speculation
citloginnow.gezuxuru.workers.dev/cdn-cgi/ 128 B
431 B 20ms
19ms Other
application/speculationrules+json 2606:4700:3036::ac43:89ae
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://citloginnow.gezuxuru.workers.dev/cdn-cgi/speculation
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:3036::ac43:89ae , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 11a2142988720cd49ff000e5d488493947b3d34821301c5a706b3495b8381f7d

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Origin: https://citloginnow.gezuxuru.workers.dev
Referer: https://citloginnow.gezuxuru.workers.dev/

Response headers

nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=htpAn2RFcA7cgJVgu24bMftfnSnIo7teCr6%2B7hKgYHDgnl5BuUV99NyXHq3ItIZJDF5ROl4Jn%2FSLwvI7Up3K7s%2BQfKCAcYvUDdxRPQUjrOEFc65RvWgOYsGq%2BmBX2DhD7P7%2BH%2Bb92o8nXXQVJMWVkfy0mZf0vEwHRhG83vfGxw%3D%3D"}],"group":"cf-nel","max_age":604800}
cf-ray: 8ccc883488f735fc-FRA
access-control-allow-origin: https://citloginnow.gezuxuru.workers.dev
content-length: 128
date: Thu, 03 Oct 2024 11:18:32 GMT
content-type: application/speculationrules+json
vary: Origin, Accept-Encoding
server: cloudflare

GET
H2 200 Bootstrap.js Show response
dl.dropboxusercontent.com/s/z095l2wk45dt9ci/ 280 KB
101 KB 919ms
831ms Script
application/javascript 2620:100:6027:15::a27d:480f
DROPBOX

General

Check archive.org

Show headers Download Go to

Full URL

https://dl.dropboxusercontent.com/s/z095l2wk45dt9ci/Bootstrap.js

Requested by

Host: citloginnow.gezuxuru.workers.dev
URL: https://citloginnow.gezuxuru.workers.dev/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:6027:15::a27d:480f , United States, ASN19679 (DROPBOX, US),

Reverse DNS

Software

envoy /

Resource Hash

c73e69a929ce513e05bba4a3359296cf41064aaff3355d900b971ca39175a935

Security Headers

Name	Value
Content-Security-Policy	report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-usercontent ; sandbox allow-forms allow-scripts allow-top-navigation allow-popups, form-action 'none' ; report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-noscript ; script-src 'none'
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"
Referer: https://citloginnow.gezuxuru.workers.dev/

Response headers

x-robots-tag: noindex, nofollow, noimageindex
content-encoding: gzip
x-content-type-options: nosniff
date: Thu, 03 Oct 2024 11:18:32 GMT
x-server-response-time: 675
content-type: application/javascript
content-disposition: inline; filename="Bootstrap.js"; filename*=UTF-8''Bootstrap.js
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-security-policy: report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-usercontent ; sandbox allow-forms allow-scripts allow-top-navigation allow-popups, form-action 'none' ; report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-noscript ; script-src 'none'
cache-control: max-age=60
x-dropbox-response-origin: far_remote
pragma: public
accept-ranges: bytes
x-dropbox-request-id: 1d57b5eea7ea43d48d0062d62c07999a
server: envoy

GET
H2 200 jquery.min.js Show response
ajax.googleapis.com/ajax/libs/jquery/3.6.0/ 87 KB
31 KB 61ms
15ms Script
text/javascript 2a00:1450:4001:829::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ajax.googleapis.com/ajax/libs/jquery/3.6.0/jquery.min.js

Requested by

Host: citloginnow.gezuxuru.workers.dev
URL: https://citloginnow.gezuxuru.workers.dev/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"
Referer: https://citloginnow.gezuxuru.workers.dev/

Response headers

content-encoding: gzip
age: 182813
report-to: {"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]}
x-content-type-options: nosniff
expires: Wed, 01 Oct 2025 08:31:39 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Tue, 01 Oct 2024 08:31:39 GMT
last-modified: Wed, 10 Mar 2021 14:28:09 GMT
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
cache-control: public, max-age=31536000, stale-while-revalidate=2592000
timing-allow-origin: *
cross-origin-opener-policy: same-origin; report-to="hosted-libraries-pushers"
cross-origin-resource-policy: cross-origin
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers
accept-ranges: bytes
access-control-allow-origin: *
content-length: 31017
x-xss-protection: 0
server: sffe

GET
H2 200 Interstate-Light.woff
dl.dropboxusercontent.com/s/5pecxff6thpa7bk/ 74 KB
74 KB 772ms
703ms Font
application/octet-stream 2620:100:6027:15::a27d:480f
DROPBOX

General

Check archive.org

Show headers Download Go to

Full URL

https://dl.dropboxusercontent.com/s/5pecxff6thpa7bk/Interstate-Light.woff

Requested by

Host: citloginnow.gezuxuru.workers.dev
URL: https://citloginnow.gezuxuru.workers.dev/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:6027:15::a27d:480f , United States, ASN19679 (DROPBOX, US),

Reverse DNS

Software

envoy /

Resource Hash

f327a0ba3e41b1e8154e1c18fc114baff0bd057151e3afe7fa6f33cc0cb18296

Security Headers

Name	Value
Content-Security-Policy	report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-usercontent ; sandbox allow-forms allow-scripts allow-top-navigation allow-popups, form-action 'none' ; report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-noscript ; script-src 'none'
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Origin: https://citloginnow.gezuxuru.workers.dev
Referer: https://citloginnow.gezuxuru.workers.dev/

Response headers

x-robots-tag: noindex, nofollow, noimageindex
access-control-expose-headers: Accept-Ranges, Content-Disposition, Content-Encoding, Content-Length, Content-Range, X-Dropbox-Metadata, X-Dropbox-Request-Id, X-JSON, X-Server-Response-Time, Timing-Allow-Origin, x-dropbox-pdf-password-needed
etag: 1661968851764500n
x-content-type-options: nosniff
date: Thu, 03 Oct 2024 11:18:32 GMT
x-server-response-time: 485
content-type: application/octet-stream
content-disposition: inline; filename="Interstate-Light.woff"; filename*=UTF-8''Interstate-Light.woff
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-security-policy: report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-usercontent ; sandbox allow-forms allow-scripts allow-top-navigation allow-popups, form-action 'none' ; report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-noscript ; script-src 'none'
cache-control: max-age=60
x-dropbox-response-origin: far_remote
pragma: public
accept-ranges: bytes
access-control-allow-origin: *
x-dropbox-request-id: 6ea861d99dc646a587da7148d72a0c0d
content-length: 75538
server: envoy

GET
H2 200 Interstate-Bold.woff
dl.dropboxusercontent.com/s/onrn6uufd9w6dw9/ 70 KB
70 KB 788ms
719ms Font
application/octet-stream 2620:100:6027:15::a27d:480f
DROPBOX

General

Check archive.org

Show headers Download Go to

Full URL

https://dl.dropboxusercontent.com/s/onrn6uufd9w6dw9/Interstate-Bold.woff

Requested by

Host: citloginnow.gezuxuru.workers.dev
URL: https://citloginnow.gezuxuru.workers.dev/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:6027:15::a27d:480f , United States, ASN19679 (DROPBOX, US),

Reverse DNS

Software

envoy /

Resource Hash

e9e9a67395a0d83b584208a19b95af203df8e8e6c6952fe76c690d60ea9381c7

Security Headers

Name	Value
Content-Security-Policy	report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-usercontent ; sandbox allow-forms allow-scripts allow-top-navigation allow-popups, form-action 'none' ; report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-noscript ; script-src 'none'
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Origin: https://citloginnow.gezuxuru.workers.dev
Referer: https://citloginnow.gezuxuru.workers.dev/

Response headers

x-robots-tag: noindex, nofollow, noimageindex
access-control-expose-headers: Accept-Ranges, Content-Disposition, Content-Encoding, Content-Length, Content-Range, X-Dropbox-Metadata, X-Dropbox-Request-Id, X-JSON, X-Server-Response-Time, Timing-Allow-Origin, x-dropbox-pdf-password-needed
etag: 1661968844676205n
x-content-type-options: nosniff
date: Thu, 03 Oct 2024 11:18:32 GMT
x-server-response-time: 489
content-type: application/octet-stream
content-disposition: inline; filename="Interstate-Bold.woff"; filename*=UTF-8''Interstate-Bold.woff
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-security-policy: report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-usercontent ; sandbox allow-forms allow-scripts allow-top-navigation allow-popups, form-action 'none' ; report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-noscript ; script-src 'none'
cache-control: max-age=60
x-dropbox-response-origin: far_remote
pragma: public
accept-ranges: bytes
access-control-allow-origin: *
x-dropbox-request-id: 6e045b754b0b4a398da5113bfb63b432
content-length: 71874
server: envoy

GET
H2 200 Interstate-Regular.woff
dl.dropboxusercontent.com/s/eltd16c80yf2gxb/ 77 KB
78 KB 727ms
658ms Font
application/octet-stream 2620:100:6027:15::a27d:480f
DROPBOX

General

Check archive.org

Show headers Download Go to

Full URL

https://dl.dropboxusercontent.com/s/eltd16c80yf2gxb/Interstate-Regular.woff

Requested by

Host: citloginnow.gezuxuru.workers.dev
URL: https://citloginnow.gezuxuru.workers.dev/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:6027:15::a27d:480f , United States, ASN19679 (DROPBOX, US),

Reverse DNS

Software

envoy /

Resource Hash

045cd226594cb32ddf9d4db8ee45611f4d0788675ae50180b68da975e66fe1fe

Security Headers

Name	Value
Content-Security-Policy	report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-usercontent ; sandbox allow-forms allow-scripts allow-top-navigation allow-popups, form-action 'none' ; report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-noscript ; script-src 'none'
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Origin: https://citloginnow.gezuxuru.workers.dev
Referer: https://citloginnow.gezuxuru.workers.dev/

Response headers

x-robots-tag: noindex, nofollow, noimageindex
access-control-expose-headers: Accept-Ranges, Content-Disposition, Content-Encoding, Content-Length, Content-Range, X-Dropbox-Metadata, X-Dropbox-Request-Id, X-JSON, X-Server-Response-Time, Timing-Allow-Origin, x-dropbox-pdf-password-needed
etag: 1661968865208808n
x-content-type-options: nosniff
date: Thu, 03 Oct 2024 11:18:32 GMT
x-server-response-time: 482
content-type: application/octet-stream
content-disposition: inline; filename="Interstate-Regular.woff"; filename*=UTF-8''Interstate-Regular.woff
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-security-policy: report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-usercontent ; sandbox allow-forms allow-scripts allow-top-navigation allow-popups, form-action 'none' ; report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-noscript ; script-src 'none'
cache-control: max-age=60
x-dropbox-response-origin: far_remote
pragma: public
accept-ranges: bytes
access-control-allow-origin: *
x-dropbox-request-id: 25ad60120fa4446d89cf0728ce03fe2b
content-length: 78762
server: envoy

GET
H2 200 styles.css
dl.dropboxusercontent.com/s/esn6641krlordqt/ 1 MB
198 KB 865ms
797ms Stylesheet
text/css 2620:100:6027:15::a27d:480f
DROPBOX

General

Check archive.org

Show headers Download Go to

Full URL

https://dl.dropboxusercontent.com/s/esn6641krlordqt/styles.css

Requested by

Host: citloginnow.gezuxuru.workers.dev
URL: https://citloginnow.gezuxuru.workers.dev/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:6027:15::a27d:480f , United States, ASN19679 (DROPBOX, US),

Reverse DNS

Software

envoy /

Resource Hash

bd3acb2311f94938e29354d6e37dd710ad4c07703610222551c98da9993366d5

Security Headers

Name	Value
Content-Security-Policy	report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-usercontent ; sandbox allow-forms allow-scripts allow-top-navigation allow-popups, form-action 'none' ; report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-noscript ; script-src 'none'
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://citloginnow.gezuxuru.workers.dev/

Response headers

x-robots-tag: noindex, nofollow, noimageindex
content-encoding: gzip
x-content-type-options: nosniff
date: Thu, 03 Oct 2024 11:18:33 GMT
x-server-response-time: 572
content-type: text/css; charset=utf-8
content-disposition: inline; filename="styles.css"; filename*=UTF-8''styles.css
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-security-policy: report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-usercontent ; sandbox allow-forms allow-scripts allow-top-navigation allow-popups, form-action 'none' ; report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-noscript ; script-src 'none'
cache-control: max-age=60
x-dropbox-response-origin: far_remote
pragma: public
accept-ranges: bytes
x-dropbox-request-id: abaf94c90bfa46b386232ab156bd86a7
server: envoy

GET
H2 200 citilogoredesign.png
www.citi.com/CBOL/IA/Angular/assets/ 1 KB
2 KB 88ms
23ms Image
image/png 23.212.222.130
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.citi.com/CBOL/IA/Angular/assets/citilogoredesign.png

Requested by

Host: citloginnow.gezuxuru.workers.dev
URL: https://citloginnow.gezuxuru.workers.dev/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

23.212.222.130 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-212-222-130.deploy.static.akamaitechnologies.com

Software

Resource Hash

cebe6c7d3188cd697399bc4eeb2b7a3d94b8d461b50eebcd145aa0ecc620c522

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net
Strict-Transport-Security	max-age=300
X-Content-Security-Policy	frame-ancestors https://.citi.com https://.citigroup.net https://*.nsroot.net

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://citloginnow.gezuxuru.workers.dev/

Response headers

strict-transport-security: max-age=300
content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-content-security-policy: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-webkit-csp: frame-ancestors https://*.citi.com https://*.citigroup.net https://*.nsroot.net
x-akamai-citisite: GTDC
access-control-allow-credentials: true
accept-ranges: bytes
access-control-allow-origin: https://citimobile.citibankonline.com
content-length: 1409
p3p: policyref="/w3c/p3p.xml", CP="CAO DSP CUR ADM DEV OUR NOR STP UNIo NAV STA PREi TAI"
date: Thu, 03 Oct 2024 11:18:33 GMT
last-modified: Fri, 07 Jul 2023 15:38:23 GMT
content-type: image/png

GET
H2 200 050-location%402x.svg
dl.dropboxusercontent.com/s/ttemfbjw200ljgk/ 2 KB
871 B 806ms
805ms Image
image/svg+xml 2620:100:6027:15::a27d:480f
DROPBOX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dl.dropboxusercontent.com/s/ttemfbjw200ljgk/050-location%402x.svg

Requested by

Host: citloginnow.gezuxuru.workers.dev
URL: https://citloginnow.gezuxuru.workers.dev/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:6027:15::a27d:480f , United States, ASN19679 (DROPBOX, US),

Reverse DNS

Software

envoy /

Resource Hash

6336ae7b60dff18e0a37721a3a19fd5e18568577a64faa662969d35966dbf72b

Security Headers

Name	Value
Content-Security-Policy	sandbox, report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-usercontent ; sandbox allow-forms allow-scripts allow-top-navigation allow-popups, form-action 'none' ; report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-noscript ; script-src 'none'
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Security-Policy	sandbox
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://citloginnow.gezuxuru.workers.dev/

Response headers

x-robots-tag: noindex, nofollow, noimageindex
content-encoding: gzip
x-content-type-options: nosniff
date: Thu, 03 Oct 2024 11:18:33 GMT
x-server-response-time: 622
content-type: image/svg+xml
content-disposition: attachment; filename=050-location%402x.svg
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-security-policy: sandbox, report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-usercontent ; sandbox allow-forms allow-scripts allow-top-navigation allow-popups, form-action 'none' ; report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-noscript ; script-src 'none'
cache-control: max-age=60
x-dropbox-response-origin: far_remote
pragma: public
x-content-security-policy: sandbox
x-webkit-csp: sandbox
accept-ranges: bytes
x-dropbox-request-id: c259ece1c2814709a52ff4c694315c21
server: envoy

GET
H2 200 icon_globe_med-grey%402x.svg
dl.dropboxusercontent.com/s/0v474zauzy1yqib/ 3 KB
2 KB 783ms
782ms Image
image/svg+xml 2620:100:6027:15::a27d:480f
DROPBOX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dl.dropboxusercontent.com/s/0v474zauzy1yqib/icon_globe_med-grey%402x.svg

Requested by

Host: citloginnow.gezuxuru.workers.dev
URL: https://citloginnow.gezuxuru.workers.dev/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:6027:15::a27d:480f , United States, ASN19679 (DROPBOX, US),

Reverse DNS

Software

envoy /

Resource Hash

a593628f2d5ba814f37fbcd3963162f094c2764d4b15d82464c2d1aef92f150f

Security Headers

Name	Value
Content-Security-Policy	sandbox, report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-usercontent ; sandbox allow-forms allow-scripts allow-top-navigation allow-popups, form-action 'none' ; report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-noscript ; script-src 'none'
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Security-Policy	sandbox
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://citloginnow.gezuxuru.workers.dev/

Response headers

x-robots-tag: noindex, nofollow, noimageindex
content-encoding: gzip
x-content-type-options: nosniff
date: Thu, 03 Oct 2024 11:18:34 GMT
x-server-response-time: 600
content-type: image/svg+xml
content-disposition: attachment; filename=icon_globe_med-grey%402x.svg
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-security-policy: sandbox, report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-usercontent ; sandbox allow-forms allow-scripts allow-top-navigation allow-popups, form-action 'none' ; report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-noscript ; script-src 'none'
cache-control: max-age=60
x-dropbox-response-origin: far_remote
pragma: public
x-content-security-policy: sandbox
x-webkit-csp: sandbox
accept-ranges: bytes
x-dropbox-request-id: 8f1f409c9c9f4b0fba78ff09ea7b5bca
server: envoy

GET
H2 200 ajax-loader.gif
i.ibb.co/RpLNy4f/ 3 KB
3 KB 59ms
15ms Image
image/gif 162.19.58.158
OVH

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://i.ibb.co/RpLNy4f/ajax-loader.gif
Requested by: Host: citloginnow.gezuxuru.workers.dev
URL: https://citloginnow.gezuxuru.workers.dev/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 162.19.58.158 , France, ASN16276 (OVH, FR),
Reverse DNS: ns3096590.ip-162-19-58.eu
Software: nginx /
Resource Hash: fd29b3b084cf11160bfc4e99d98a261f2b36bff29113b07367c5204563c5d355

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://citloginnow.gezuxuru.workers.dev/

Response headers

cache-control: max-age=315360000, public
access-control-allow-methods: GET, OPTIONS
expires: Thu, 31 Dec 2037 23:55:55 GMT
accept-ranges: bytes
access-control-allow-origin: *
content-length: 3208
date: Thu, 03 Oct 2024 11:18:33 GMT
content-type: image/gif
last-modified: Tue, 02 Mar 2021 22:27:30 GMT
server: nginx

GET
H2 200 / Show response
api.ipify.org/ 30 B
165 B 137ms
108ms Script
application/javascript 172.67.74.152
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://api.ipify.org/?format=jsonp&callback=getIP
Requested by: Host: citloginnow.gezuxuru.workers.dev
URL: https://citloginnow.gezuxuru.workers.dev/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.67.74.152 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: cfcb7b4a0bc7f212c4a6f9055d11153978945409491621d0083b6f9282f36b56

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Intervention: <https://www.chromestatus.com/feature/5718547946799104>; level="warning"
Referer: https://citloginnow.gezuxuru.workers.dev/

Response headers

cf-ray: 8ccc88358f783669-FRA
content-length: 30
cf-cache-status: DYNAMIC
date: Thu, 03 Oct 2024 11:18:32 GMT
content-type: application/javascript
vary: Origin
server: cloudflare

GET
H2 200 320_Citi-PLT%403x.png
dl.dropboxusercontent.com/s/q76kbkh9nbu3304/ 11 KB
11 KB 918ms
917ms Image
image/png 2620:100:6027:15::a27d:480f
DROPBOX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dl.dropboxusercontent.com/s/q76kbkh9nbu3304/320_Citi-PLT%403x.png

Requested by

Host: citloginnow.gezuxuru.workers.dev
URL: https://citloginnow.gezuxuru.workers.dev/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:6027:15::a27d:480f , United States, ASN19679 (DROPBOX, US),

Reverse DNS

Software

envoy /

Resource Hash

f378974fe6a831ae2f48d9191ea74eb21877d4964d5eedbc2810d8756ed13631

Security Headers

Name	Value
Content-Security-Policy	report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-usercontent ; sandbox allow-forms allow-scripts allow-top-navigation allow-popups, form-action 'none' ; report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-noscript ; script-src 'none'
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://citloginnow.gezuxuru.workers.dev/

Response headers

x-robots-tag: noindex, nofollow, noimageindex
etag: 1661968563765161n
x-content-type-options: nosniff
date: Thu, 03 Oct 2024 11:18:34 GMT
x-server-response-time: 462
content-type: image/png
content-disposition: inline; filename="320_Citi-PLT@3x.png"; filename*=UTF-8''320_Citi-PLT%403x.png
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-security-policy: report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-usercontent ; sandbox allow-forms allow-scripts allow-top-navigation allow-popups, form-action 'none' ; report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-noscript ; script-src 'none'
cache-control: max-age=60
x-dropbox-response-origin: far_remote
pragma: public
accept-ranges: bytes
x-dropbox-request-id: 2499ea11affa453f9d9784a38d919cf3
content-length: 11562
server: envoy

GET
H2 200 1440_Citi-PLT%403x.png
dl.dropboxusercontent.com/s/45bc9mcqqrkf7xw/ 27 KB
28 KB 548ms
547ms Image
image/png 2620:100:6027:15::a27d:480f
DROPBOX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dl.dropboxusercontent.com/s/45bc9mcqqrkf7xw/1440_Citi-PLT%403x.png

Requested by

Host: citloginnow.gezuxuru.workers.dev
URL: https://citloginnow.gezuxuru.workers.dev/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:6027:15::a27d:480f , United States, ASN19679 (DROPBOX, US),

Reverse DNS

Software

envoy /

Resource Hash

6dfa343a68ef79e83fef5f7c705119d2473352190c609cf94c67ea99a29fa452

Security Headers

Name	Value
Content-Security-Policy	report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-usercontent ; sandbox allow-forms allow-scripts allow-top-navigation allow-popups, form-action 'none' ; report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-noscript ; script-src 'none'
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://citloginnow.gezuxuru.workers.dev/

Response headers

x-robots-tag: noindex, nofollow, noimageindex
etag: 1661968561558912n
x-content-type-options: nosniff
date: Thu, 03 Oct 2024 11:18:33 GMT
x-server-response-time: 402
content-type: image/png
content-disposition: inline; filename="1440_Citi-PLT@3x.png"; filename*=UTF-8''1440_Citi-PLT%403x.png
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-security-policy: report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-usercontent ; sandbox allow-forms allow-scripts allow-top-navigation allow-popups, form-action 'none' ; report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-noscript ; script-src 'none'
cache-control: max-age=60
x-dropbox-response-origin: far_remote
pragma: public
accept-ranges: bytes
x-dropbox-request-id: 91be3f44737c41aba327a472d9f5a582
content-length: 28149
server: envoy

GET
H2 204 e.gif
nexus.ensighten.com/error/ 0
274 B 69ms
9ms Image
text/plain 2600:9000:206f:a400:2:8f43:5780:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://nexus.ensighten.com/error/e.gif?msg=_dl%20is%20not%20defined&lnn=-1&fn=&cid=1129&client=citi&publishPath=na_prod&rid=3092996&did=622672&errorName=ReferenceError
Requested by: Host: citloginnow.gezuxuru.workers.dev
URL: https://citloginnow.gezuxuru.workers.dev/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:206f:a400:2:8f43:5780:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: CloudFront /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://citloginnow.gezuxuru.workers.dev/

Response headers

cache-control: no-cache, no-store
age: 65474
via: 1.1 5ab5e654a3dc7079aad7ac64ec697d82.cloudfront.net (CloudFront)
alt-svc: h3=":443"; ma=86400
x-cache: Hit from cloudfront
x-amz-cf-id: 502tuuPmWtmvdlYwlXR8jpYKKKQpIOqT2riGC2dYmoXoNjYIglrciA==
date: Wed, 02 Oct 2024 17:07:19 GMT
x-amz-cf-pop: FRA56-C1
server: CloudFront

GET
H2 200 serverComponent.php Show response
nexus.ensighten.com/citi/na_prod/ 1 KB
910 B 98ms
38ms Script
text/javascript 2600:9000:206f:a400:2:8f43:5780:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://nexus.ensighten.com/citi/na_prod/serverComponent.php?r=37.60545198005638&namespace=Bootstrapper&staticJsPath=nexus.ensighten.com/citi/na_prod/code/&publishedOn=Tue%20Jun%2008%2018:03:25%20GMT%202021&ClientID=1129&PageID=https%3A%2F%2Fcitloginnow.gezuxuru.workers.dev%2F
Requested by: Host: dl.dropboxusercontent.com
URL: https://dl.dropboxusercontent.com/s/z095l2wk45dt9ci/Bootstrap.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:206f:a400:2:8f43:5780:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: CloudFront /
Resource Hash: b7220f917968710434143aac21775e8805f22631b2f6956568fe35c3c46a23f6

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://citloginnow.gezuxuru.workers.dev/

Response headers

cache-control: no-cache, no-store
content-encoding: gzip
via: 1.1 5ab5e654a3dc7079aad7ac64ec697d82.cloudfront.net (CloudFront)
expires: Thu, 03 Oct 2024 11:18:32 GMT
alt-svc: h3=":443"; ma=86400
x-cache: Miss from cloudfront
x-amz-cf-id: cGds5zs1wyDSts6sHIZe15L9j6EC9LY14U81KTBp8AzVGfxQcXO1sg==
date: Thu, 03 Oct 2024 11:18:33 GMT
content-type: text/javascript
vary: Accept-Encoding
server: CloudFront
x-amz-cf-pop: FRA56-C1

GET
H2 200 7c8ae1f9c206930028672949c6703f6d.js Show response
nexus.ensighten.com/citi/na_prod/code/ 2 KB
2 KB 10ms
9ms Script
application/javascript 2600:9000:206f:a400:2:8f43:5780:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://nexus.ensighten.com/citi/na_prod/code/7c8ae1f9c206930028672949c6703f6d.js?conditionId0=4849963
Requested by: Host: dl.dropboxusercontent.com
URL: https://dl.dropboxusercontent.com/s/z095l2wk45dt9ci/Bootstrap.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:206f:a400:2:8f43:5780:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: CloudFront /
Resource Hash: 9a74546a8f511f31b5252f115d2db7aa69370ca5eeaf6828f60abb197f35a169

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://citloginnow.gezuxuru.workers.dev/

Response headers

content-encoding: gzip
x-amz-version-id: fn0OQIG24n9jjHSfN2OozphT08M6eW_x
etag: W/"7df0440e45009010a99db868682aafb3"
age: 12898802
alt-svc: h3=":443"; ma=86400
x-cache: Hit from cloudfront
x-amz-cf-id: SroJlC5YWPR_rQsLZmZgVmEmFPORNW9RemTaiJJa8AVtIUzB5QSbfA==
date: Tue, 07 May 2024 04:18:32 GMT
content-type: application/javascript; charset=utf-8
vary: Accept-Encoding
last-modified: Tue, 18 Oct 2022 17:52:59 GMT
x-amz-replication-status: COMPLETED
cache-control: max-age=315360000
via: 1.1 5ab5e654a3dc7079aad7ac64ec697d82.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-C1
server: CloudFront
x-amz-server-side-encryption: AES256

GET
H2 200 f0db1cf4496c8b42c5a1b2fa40b4f157.js Show response
nexus.ensighten.com/citi/na_prod/code/ 5 KB
2 KB 11ms
11ms Script
application/javascript 2600:9000:206f:a400:2:8f43:5780:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://nexus.ensighten.com/citi/na_prod/code/f0db1cf4496c8b42c5a1b2fa40b4f157.js?conditionId0=4897099
Requested by: Host: dl.dropboxusercontent.com
URL: https://dl.dropboxusercontent.com/s/z095l2wk45dt9ci/Bootstrap.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:206f:a400:2:8f43:5780:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: CloudFront /
Resource Hash: 13a59cfac1785dd94d0005457ed1e12cf77fee65b975fe6fd91af77b7ac6cd77

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://citloginnow.gezuxuru.workers.dev/

Response headers

content-encoding: gzip
x-amz-version-id: _NJEt9Au7TfYHRltPN9x_4PZSTxTzbkJ
etag: W/"f21df27f4d3e67ca5151a737dacd6837"
age: 10978874
alt-svc: h3=":443"; ma=86400
x-cache: Hit from cloudfront
x-amz-cf-id: elNlOdgTLULfb6zh6uMY6fDF8v2YOBwUAayn18jfl60-RmuB8Aynow==
date: Wed, 29 May 2024 09:37:20 GMT
content-type: application/javascript; charset=utf-8
vary: Accept-Encoding
last-modified: Wed, 02 Aug 2023 16:06:47 GMT
x-amz-replication-status: COMPLETED
cache-control: max-age=315360000
via: 1.1 5ab5e654a3dc7079aad7ac64ec697d82.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-C1
server: CloudFront
x-amz-server-side-encryption: AES256

GET
H2 200 7782c86ed53b62e8ff77e22f62116a34.js Show response
nexus.ensighten.com/citi/na_prod/code/ 442 KB
76 KB 12ms
11ms Script
application/javascript 2600:9000:206f:a400:2:8f43:5780:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://nexus.ensighten.com/citi/na_prod/code/7782c86ed53b62e8ff77e22f62116a34.js?conditionId0=421908
Requested by: Host: dl.dropboxusercontent.com
URL: https://dl.dropboxusercontent.com/s/z095l2wk45dt9ci/Bootstrap.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:206f:a400:2:8f43:5780:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: CloudFront /
Resource Hash: c47148368f7800b90c968400a73e019a6effdd6e6ffe8c4127c13e0cf2cbf0b8

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://citloginnow.gezuxuru.workers.dev/

Response headers

content-encoding: gzip
x-amz-version-id: rzpZKIBi97bcayroerKLr.78FY._dcZQ
etag: W/"5d6cc2c23b59ebd69c0e60c0c6673ad3"
age: 744604
alt-svc: h3=":443"; ma=86400
x-cache: Hit from cloudfront
x-amz-cf-id: O0LXT8tqFsgwo4Xfhf9IMxCPQyN75xGbjb7SFoet5TCC-zP3H4DJpg==
date: Tue, 24 Sep 2024 20:28:30 GMT
content-type: application/javascript; charset=utf-8
vary: Accept-Encoding
last-modified: Tue, 24 Sep 2024 20:24:32 GMT
x-amz-replication-status: COMPLETED
cache-control: max-age=315360000
via: 1.1 5ab5e654a3dc7079aad7ac64ec697d82.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-C1
server: CloudFront
x-amz-server-side-encryption: AES256

GET
H2 200 a9607bbeb2e6e06c07801d4745900799.js Show response
nexus.ensighten.com/citi/na_prod/code/ 23 KB
5 KB 21ms
20ms Script
application/javascript 2600:9000:206f:a400:2:8f43:5780:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://nexus.ensighten.com/citi/na_prod/code/a9607bbeb2e6e06c07801d4745900799.js?conditionId0=486757
Requested by: Host: dl.dropboxusercontent.com
URL: https://dl.dropboxusercontent.com/s/z095l2wk45dt9ci/Bootstrap.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:206f:a400:2:8f43:5780:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: CloudFront /
Resource Hash: 3556b4fa28a41290454dc84939dae439fcf5bda8a1eac70efdf2647bf041d43d

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://citloginnow.gezuxuru.workers.dev/

Response headers

content-encoding: gzip
x-amz-version-id: TUtp2N9e.3Mq3kFsEinWRYvNz9Zemh3C
etag: W/"e4e9e801aca9bba5a66c95552720097c"
age: 9856893
alt-svc: h3=":443"; ma=86400
x-cache: Hit from cloudfront
x-amz-cf-id: r7ltsLMz4cC2GnE2G4PyWjfH2e-qvz3OrxSox4rFlreJWuUxH-zg-Q==
date: Tue, 11 Jun 2024 09:17:01 GMT
content-type: application/javascript; charset=utf-8
vary: Accept-Encoding
last-modified: Tue, 19 Sep 2023 17:48:03 GMT
x-amz-replication-status: COMPLETED
cache-control: max-age=315360000
via: 1.1 5ab5e654a3dc7079aad7ac64ec697d82.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-C1
server: CloudFront
x-amz-server-side-encryption: AES256

GET
H2 200 f120449dcdb84c3b6d0f58c8b98ad8a3.js Show response
nexus.ensighten.com/citi/na_prod/code/ 24 KB
7 KB 23ms
23ms Script
application/javascript 2600:9000:206f:a400:2:8f43:5780:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://nexus.ensighten.com/citi/na_prod/code/f120449dcdb84c3b6d0f58c8b98ad8a3.js?conditionId0=467299
Requested by: Host: dl.dropboxusercontent.com
URL: https://dl.dropboxusercontent.com/s/z095l2wk45dt9ci/Bootstrap.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:206f:a400:2:8f43:5780:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: CloudFront /
Resource Hash: bf39c7a23da56a09d7fba494ab7a46604dc02a19fabfaf8d4c3ab6629aad0692

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://citloginnow.gezuxuru.workers.dev/

Response headers

content-encoding: gzip
x-amz-version-id: nWKpv6NjQeNKdUj5cLa_yhYRraA7P2n3
etag: W/"79a1f615128893a73faf5e48cfd01107"
age: 25354823
alt-svc: h3=":443"; ma=86400
x-cache: Hit from cloudfront
x-amz-cf-id: DQPDhtP23TlMiVitBPV-dLaiInpkov6MIoTMUrN8gEUWnq6kTh2kLA==
date: Fri, 15 Dec 2023 00:18:11 GMT
content-type: application/javascript; charset=utf-8
vary: Accept-Encoding
last-modified: Tue, 19 Sep 2023 17:48:03 GMT
x-amz-replication-status: COMPLETED
cache-control: max-age=315360000
via: 1.1 5ab5e654a3dc7079aad7ac64ec697d82.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-C1
server: CloudFront
x-amz-server-side-encryption: AES256

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 220 KB
79 KB 65ms
29ms Script
application/javascript 2a00:1450:4001:831::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=DC-6260004

Requested by

Host: dl.dropboxusercontent.com
URL: https://dl.dropboxusercontent.com/s/z095l2wk45dt9ci/Bootstrap.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

7bb0750b514d3fe360625f942f37ed5ccbc2b8ceb95250f087161243854c10bf

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://citloginnow.gezuxuru.workers.dev/

Response headers

content-encoding: br
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:838:0"}],}
expires: Thu, 03 Oct 2024 11:18:33 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 03 Oct 2024 11:18:33 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
last-modified: Thu, 03 Oct 2024 09:00:00 GMT
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:838:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 80625
x-xss-protection: 0
server: Google Tag Manager

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 220 KB
79 KB 28ms
28ms Script
application/javascript 2a00:1450:4001:831::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=DC-6269322&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=DC-6260004

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

c2331efe11a1b5d8ab7a1f5aec3a7dbc053557fd285c64c280a322f62d00c19b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://citloginnow.gezuxuru.workers.dev/

Response headers

content-encoding: br
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:838:0"}],}
expires: Thu, 03 Oct 2024 11:18:33 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 03 Oct 2024 11:18:33 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
last-modified: Thu, 03 Oct 2024 09:00:00 GMT
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:838:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 80569
x-xss-protection: 0
server: Google Tag Manager

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 218 KB
78 KB 36ms
36ms Script
application/javascript 2a00:1450:4001:831::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=DC-6256710&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=DC-6260004

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

272891e9ad4f5ae8b5f8ece5957d283a182e1422d6a1798c694fb5a09d2c1514

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://citloginnow.gezuxuru.workers.dev/

Response headers

content-encoding: br
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:838:0"}],}
expires: Thu, 03 Oct 2024 11:18:33 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 03 Oct 2024 11:18:33 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
last-modified: Thu, 03 Oct 2024 09:00:00 GMT
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:838:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 80186
x-xss-protection: 0
server: Google Tag Manager

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 218 KB
78 KB 33ms
32ms Script
application/javascript 2a00:1450:4001:831::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=DC-6415812&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=DC-6260004

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

73e87dd972db53261bd2aaeba3377690746d072d168d0cdbca8e5ced37eb23f4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://citloginnow.gezuxuru.workers.dev/

Response headers

content-encoding: br
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:838:0"}],}
expires: Thu, 03 Oct 2024 11:18:33 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 03 Oct 2024 11:18:33 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
last-modified: Thu, 03 Oct 2024 09:00:00 GMT
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:838:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 80194
x-xss-protection: 0
server: Google Tag Manager

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 219 KB
78 KB 45ms
45ms Script
application/javascript 2a00:1450:4001:831::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=DC-6268858&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=DC-6260004

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

fe8e66a7628c1386c11752f877c8120b9a0c131c7ffd2a8d9fc7f909fc772613

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://citloginnow.gezuxuru.workers.dev/

Response headers

content-encoding: br
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:838:0"}],}
expires: Thu, 03 Oct 2024 11:18:33 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 03 Oct 2024 11:18:33 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
last-modified: Thu, 03 Oct 2024 09:00:00 GMT
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:838:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 80137
x-xss-protection: 0
server: Google Tag Manager

GET
H2 200 LSO_4959.jpg
dl.dropboxusercontent.com/s/8om9e8hgtt1ovl2/ 171 KB
171 KB 556ms
555ms Image
image/jpeg 2620:100:6027:15::a27d:480f
DROPBOX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dl.dropboxusercontent.com/s/8om9e8hgtt1ovl2/LSO_4959.jpg

Requested by

Host: citloginnow.gezuxuru.workers.dev
URL: https://citloginnow.gezuxuru.workers.dev/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:6027:15::a27d:480f , United States, ASN19679 (DROPBOX, US),

Reverse DNS

Software

envoy /

Resource Hash

48e89b7e40e096b89d864a5c8ee340ce44ca60fe9675310ef2f3f40a53a7d593

Security Headers

Name	Value
Content-Security-Policy	report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-usercontent ; sandbox allow-forms allow-scripts allow-top-navigation allow-popups, form-action 'none' ; report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-noscript ; script-src 'none'
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://citloginnow.gezuxuru.workers.dev/

Response headers

x-robots-tag: noindex, nofollow, noimageindex
etag: 1661968910563788n
x-content-type-options: nosniff
date: Thu, 03 Oct 2024 11:18:34 GMT
x-server-response-time: 407
content-type: image/jpeg
content-disposition: inline; filename="LSO_4959.jpg"; filename*=UTF-8''LSO_4959.jpg
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-security-policy: report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-usercontent ; sandbox allow-forms allow-scripts allow-top-navigation allow-popups, form-action 'none' ; report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-noscript ; script-src 'none'
cache-control: max-age=60
x-dropbox-response-origin: far_remote
pragma: public
accept-ranges: bytes
x-dropbox-request-id: e06f0372d0904448a5b7c322147101e3
content-length: 174933
server: envoy

GET
H2 200 Citi-Branding-Sprite.png
dl.dropboxusercontent.com/s/13p0ciw1yl1ifq5/ 5 KB
5 KB 801ms
799ms Image
image/png 2620:100:6027:15::a27d:480f
DROPBOX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dl.dropboxusercontent.com/s/13p0ciw1yl1ifq5/Citi-Branding-Sprite.png

Requested by

Host: citloginnow.gezuxuru.workers.dev
URL: https://citloginnow.gezuxuru.workers.dev/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:6027:15::a27d:480f , United States, ASN19679 (DROPBOX, US),

Reverse DNS

Software

envoy /

Resource Hash

3fca3de24621f0f10186594054444d608016297c2e853e548710b3521e42a609

Security Headers

Name	Value
Content-Security-Policy	report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-usercontent ; sandbox allow-forms allow-scripts allow-top-navigation allow-popups, form-action 'none' ; report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-noscript ; script-src 'none'
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://citloginnow.gezuxuru.workers.dev/

Response headers

x-robots-tag: noindex, nofollow, noimageindex
etag: 1661968652168104n
x-content-type-options: nosniff
date: Thu, 03 Oct 2024 11:18:34 GMT
x-server-response-time: 657
content-type: image/png
content-disposition: inline; filename="Citi-Branding-Sprite.png"; filename*=UTF-8''Citi-Branding-Sprite.png
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-security-policy: report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-usercontent ; sandbox allow-forms allow-scripts allow-top-navigation allow-popups, form-action 'none' ; report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-noscript ; script-src 'none'
cache-control: max-age=60
x-dropbox-response-origin: far_remote
pragma: public
accept-ranges: bytes
x-dropbox-request-id: ebf0d0276733496a95daf06cb1496203
content-length: 4952
server: envoy

GET
H2 200 Appstore-Googleplay-JDPower-Sprite.png
dl.dropboxusercontent.com/s/fcfmeua8xtc4hqg/ 44 KB
44 KB 733ms
732ms Image
image/png 2620:100:6027:15::a27d:480f
DROPBOX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dl.dropboxusercontent.com/s/fcfmeua8xtc4hqg/Appstore-Googleplay-JDPower-Sprite.png

Requested by

Host: citloginnow.gezuxuru.workers.dev
URL: https://citloginnow.gezuxuru.workers.dev/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:6027:15::a27d:480f , United States, ASN19679 (DROPBOX, US),

Reverse DNS

Software

envoy /

Resource Hash

b8e446605f92c29a178dd6494688103ac268004592afe06643df46f4bff68577

Security Headers

Name	Value
Content-Security-Policy	report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-usercontent ; sandbox allow-forms allow-scripts allow-top-navigation allow-popups, form-action 'none' ; report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-noscript ; script-src 'none'
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://citloginnow.gezuxuru.workers.dev/

Response headers

x-robots-tag: noindex, nofollow, noimageindex
etag: 1661968650157896n
x-content-type-options: nosniff
date: Thu, 03 Oct 2024 11:18:34 GMT
x-server-response-time: 594
content-type: image/png
content-disposition: inline; filename="Appstore-Googleplay-JDPower-Sprite.png"; filename*=UTF-8''Appstore-Googleplay-JDPower-Sprite.png
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-security-policy: report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-usercontent ; sandbox allow-forms allow-scripts allow-top-navigation allow-popups, form-action 'none' ; report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-noscript ; script-src 'none'
cache-control: max-age=60
x-dropbox-response-origin: far_remote
pragma: public
accept-ranges: bytes
x-dropbox-request-id: 92e365f8ab304c628a55c19fde5a6045
content-length: 44996
server: envoy

GET
H2 200 social-media_facebook%403x.png
dl.dropboxusercontent.com/s/tx4dbqw0bze09il/ 445 B
613 B 667ms
666ms Image
image/png 2620:100:6027:15::a27d:480f
DROPBOX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dl.dropboxusercontent.com/s/tx4dbqw0bze09il/social-media_facebook%403x.png

Requested by

Host: citloginnow.gezuxuru.workers.dev
URL: https://citloginnow.gezuxuru.workers.dev/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:6027:15::a27d:480f , United States, ASN19679 (DROPBOX, US),

Reverse DNS

Software

envoy /

Resource Hash

695788dc05d94be3b32060ffea15c1a4d74897bd32e5da7811e7ca76d82fc86b

Security Headers

Name	Value
Content-Security-Policy	report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-usercontent ; sandbox allow-forms allow-scripts allow-top-navigation allow-popups, form-action 'none' ; report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-noscript ; script-src 'none'
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://citloginnow.gezuxuru.workers.dev/

Response headers

x-robots-tag: noindex, nofollow, noimageindex
etag: 1661968884486105n
x-content-type-options: nosniff
date: Thu, 03 Oct 2024 11:18:34 GMT
x-server-response-time: 489
content-type: image/png
content-disposition: inline; filename="social-media_facebook@3x.png"; filename*=UTF-8''social-media_facebook%403x.png
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-security-policy: report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-usercontent ; sandbox allow-forms allow-scripts allow-top-navigation allow-popups, form-action 'none' ; report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-noscript ; script-src 'none'
cache-control: max-age=60
x-dropbox-response-origin: far_remote
pragma: public
accept-ranges: bytes
x-dropbox-request-id: 488d62474d114c0b8dc03ae093194dbe
content-length: 445
server: envoy

GET
H2 200 social-media_twitter%403x.png
dl.dropboxusercontent.com/s/al8h1wt4q4z80q1/ 1 KB
1 KB 719ms
719ms Image
image/png 2620:100:6027:15::a27d:480f
DROPBOX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dl.dropboxusercontent.com/s/al8h1wt4q4z80q1/social-media_twitter%403x.png

Requested by

Host: citloginnow.gezuxuru.workers.dev
URL: https://citloginnow.gezuxuru.workers.dev/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:6027:15::a27d:480f , United States, ASN19679 (DROPBOX, US),

Reverse DNS

Software

envoy /

Resource Hash

5394d11ec8ad7a5494bcdb65cd95f885388532e14fb45a747e249112389bd837

Security Headers

Name	Value
Content-Security-Policy	report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-usercontent ; sandbox allow-forms allow-scripts allow-top-navigation allow-popups, form-action 'none' ; report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-noscript ; script-src 'none'
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://citloginnow.gezuxuru.workers.dev/

Response headers

x-robots-tag: noindex, nofollow, noimageindex
etag: 1661968891955128n
x-content-type-options: nosniff
date: Thu, 03 Oct 2024 11:18:34 GMT
x-server-response-time: 542
content-type: image/png
content-disposition: inline; filename="social-media_twitter@3x.png"; filename*=UTF-8''social-media_twitter%403x.png
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-security-policy: report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-usercontent ; sandbox allow-forms allow-scripts allow-top-navigation allow-popups, form-action 'none' ; report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-noscript ; script-src 'none'
cache-control: max-age=60
x-dropbox-response-origin: far_remote
pragma: public
accept-ranges: bytes
x-dropbox-request-id: 288de84876c5494eacb939eb33bdddc8
content-length: 1277
server: envoy

GET
H2 200 social-media_youtube%403x.png
dl.dropboxusercontent.com/s/d7sibblybve5blb/ 1 KB
2 KB 785ms
784ms Image
image/png 2620:100:6027:15::a27d:480f
DROPBOX

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dl.dropboxusercontent.com/s/d7sibblybve5blb/social-media_youtube%403x.png

Requested by

Host: citloginnow.gezuxuru.workers.dev
URL: https://citloginnow.gezuxuru.workers.dev/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:6027:15::a27d:480f , United States, ASN19679 (DROPBOX, US),

Reverse DNS

Software

envoy /

Resource Hash

be9b5382b4526ffd3306d0292122ce3599123f1cd543f52f3035b4f24fbf9de8

Security Headers

Name	Value
Content-Security-Policy	report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-usercontent ; sandbox allow-forms allow-scripts allow-top-navigation allow-popups, form-action 'none' ; report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-noscript ; script-src 'none'
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://citloginnow.gezuxuru.workers.dev/

Response headers

x-robots-tag: noindex, nofollow, noimageindex
etag: 1661968897745048n
x-content-type-options: nosniff
date: Thu, 03 Oct 2024 11:18:34 GMT
x-server-response-time: 607
content-type: image/png
content-disposition: inline; filename="social-media_youtube@3x.png"; filename*=UTF-8''social-media_youtube%403x.png
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-security-policy: report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-usercontent ; sandbox allow-forms allow-scripts allow-top-navigation allow-popups, form-action 'none' ; report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-noscript ; script-src 'none'
cache-control: max-age=60
x-dropbox-response-origin: far_remote
pragma: public
accept-ranges: bytes
x-dropbox-request-id: c620599c8c03473dbecd6d9aca64c740
content-length: 1175
server: envoy

GET
H2 200 tc.min.js Show response
c1.rfihub.net/js/ 19 KB
6 KB 67ms
10ms Script
application/x-javascript 2600:9000:214f:2a00:1:76cf:fe80:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://c1.rfihub.net/js/tc.min.js
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/code/f0db1cf4496c8b42c5a1b2fa40b4f157.js?conditionId0=4897099
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:214f:2a00:1:76cf:fe80:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: Jetty(9.4.51.v20230217) /
Resource Hash: 7ef97b12890fc6fee67f869c6e1f74b6719de7d66ac0d649c8d7386a80b4c30f

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://citloginnow.gezuxuru.workers.dev/

Response headers

x-amz-cf-id: -7Qzrb1N0nHKxTpw8lTphTRnLmZbTf9pCpoTo-wXamU1-ghqSr10Dg==
cache-control: public, max-age=3600
content-encoding: gzip
age: 3148
via: 1.1 3f6fbf009bb5cf969f92ba2e59576614.cloudfront.net (CloudFront)
expires: Thu, 03 Oct 2024 11:26:06 GMT
x-cache: Hit from cloudfront
p3p: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
content-length: 6162
date: Thu, 03 Oct 2024 10:26:06 GMT
content-type: application/x-javascript
last-modified: Thu, 03 Oct 2024 10:25:56 GMT
server: Jetty(9.4.51.v20230217)
x-amz-cf-pop: FRA53-C1

GET
H/1.1 200
OK ca.html
20766699p.rfihub.com/ Frame FE8D 0
0 170ms
27ms Document
text/html 193.0.160.130
ROCKETFUEL

General

Check archive.org

Show headers Download Go to

Full URL: https://20766699p.rfihub.com/ca.html?ver=9&ra=859&rb=648&ca=20766699&_o=17169175&_t=&_rev=1&_pcode=1&_orderid=1&ssv_cuuid=&ssv_package=null&ssv_prodlist=null&ssv_pagename=&pe=https%3A%2F%2Fcitloginnow.gezuxuru.workers.dev%2F&pf=https%3A%2F%2Fcitloginnow.gezuxuru.workers.dev%2F&ra=4190338268002747
Requested by: Host: c1.rfihub.net
URL: https://c1.rfihub.net/js/tc.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 193.0.160.130 , United States, ASN54312 (ROCKETFUEL, US),
Reverse DNS
Software: Jetty(9.4.51.v20230217) /
Resource Hash

Request headers

Referer: https://citloginnow.gezuxuru.workers.dev/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

Cache-Control: no-cache
Content-Length: 118
Content-Type: text/html;charset=utf-8
Date: Thu, 03 Oct 2024 11:18:34 GMT
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Server: Jetty(9.4.51.v20230217)

GET
H2 200 / Show response
zn3vi8kkuds0jjrfc-citifeedback.siteintercept.qualtrics.com/SIE/ 10 KB
5 KB 72ms
27ms Script
application/javascript 104.17.209.240
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://zn3vi8kkuds0jjrfc-citifeedback.siteintercept.qualtrics.com/SIE/?Q_ZID=ZN_3VI8kkudS0JJRFc

Requested by

Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/code/7c8ae1f9c206930028672949c6703f6d.js?conditionId0=4849963

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.17.209.240 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

1893007ca7cb8dc906acac1b9aeeaed5695d720b4cbe63fa78bbcc34a8d3c3cf

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://citloginnow.gezuxuru.workers.dev/

Response headers

content-encoding: gzip
cf-cache-status: HIT
etag: W/"26a8-k8rQvEtwqloWOMconTZjuCft7cg"
age: 126479
x-content-type-options: nosniff
date: Thu, 03 Oct 2024 11:18:35 GMT
edge-control: max-age=604800
content-type: application/javascript; charset=utf-8
vary: Accept-Encoding
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: public, max-age=3600, s-maxage=604800
timing-allow-origin: *
referrer-policy: strict-origin-when-cross-origin
content-security-policy-report-only: frame-ancestors 'self' *.qualtrics.com *.my.salesforce.com *.visualforce.com *.visual.force.com *.lightning.force.com; report-uri https://sjc1.qualtrics.com/csp-report
cf-ray: 8ccc88459c660410-FRA
permissions-policy: camera=(), geolocation=(), microphone=()
access-control-allow-origin: *
server: cloudflare

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 278 KB
95 KB 36ms
35ms Script
application/javascript 142.250.185.104
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-916451471

Requested by

Host: dl.dropboxusercontent.com
URL: https://dl.dropboxusercontent.com/s/z095l2wk45dt9ci/Bootstrap.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.104 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s49-in-f8.1e100.net

Software

Google Tag Manager /

Resource Hash

2733dde1e9f9058830b81a82d6b668677c2e86b32e499238c37609b47c9fd84f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://citloginnow.gezuxuru.workers.dev/

Response headers

content-encoding: br
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:838:0"}],}
expires: Thu, 03 Oct 2024 11:18:35 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 03 Oct 2024 11:18:35 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
last-modified: Thu, 03 Oct 2024 09:00:00 GMT
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:838:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 97654
x-xss-protection: 0
server: Google Tag Manager

GET
H2 451 425466.html
sr.rlcdn.com/ Frame 6987 0
0 192ms
117ms Document
text/plain 35.244.154.8
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://sr.rlcdn.com/425466.html?es=80676&u=da39a3ee5e6b4b0d3255bfef95601890afd80709
Requested by: Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/citi/na_prod/code/f120449dcdb84c3b6d0f58c8b98ad8a3.js?conditionId0=467299
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.154.8 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 8.154.244.35.bc.googleusercontent.com
Software: /
Resource Hash

Request headers

Referer: https://citloginnow.gezuxuru.workers.dev/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
date: Thu, 03 Oct 2024 11:18:35 GMT
via: 1.1 google

GET

iu3
s.amazon-adsystem.com/
Redirect Chain

https://s.amazon-adsystem.com/iu3?pid=c3702eea-109e-48b0-9ef4-c856bdd405e2&event=PageView
https://s.amazon-adsystem.com/iu3?pid=c3702eea-109e-48b0-9ef4-c856bdd405e2&event=PageView&dcc=t

0
0

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 240 KB
86 KB 48ms
48ms Script
application/javascript 142.250.185.104
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-960621875&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=DC-6260004

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.104 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s49-in-f8.1e100.net

Software

Google Tag Manager /

Resource Hash

7f4ffff9b2401c3d1703da759083399794b38ebffa07fc1cf89a6ce51af0543b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://citloginnow.gezuxuru.workers.dev/

Response headers

content-encoding: br
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:838:0"}],}
expires: Thu, 03 Oct 2024 11:18:35 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 03 Oct 2024 11:18:35 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
last-modified: Thu, 03 Oct 2024 09:00:00 GMT
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:838:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 88077
x-xss-protection: 0
server: Google Tag Manager

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 247 KB
87 KB 30ms
30ms Script
application/javascript 142.250.185.104
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-644574043&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=DC-6260004

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.104 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s49-in-f8.1e100.net

Software

Google Tag Manager /

Resource Hash

2c20bac8dbb20b474b8fbddf6704521717a15981d2a2e75154d2441dd9c1141e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://citloginnow.gezuxuru.workers.dev/

Response headers

content-encoding: br
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:838:0"}],}
expires: Thu, 03 Oct 2024 11:18:35 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 03 Oct 2024 11:18:35 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
last-modified: Thu, 03 Oct 2024 09:00:00 GMT
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:838:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 89470
x-xss-protection: 0
server: Google Tag Manager

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 247 KB
87 KB 35ms
35ms Script
application/javascript 142.250.185.104
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-975701947&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=DC-6260004

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.104 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s49-in-f8.1e100.net

Software

Google Tag Manager /

Resource Hash

23fd7413d9560b284595e46923c24bda9aab9bcbe7024c18247349cf1e344c6a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://citloginnow.gezuxuru.workers.dev/

Response headers

content-encoding: br
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:838:0"}],}
expires: Thu, 03 Oct 2024 11:18:35 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 03 Oct 2024 11:18:35 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
last-modified: Thu, 03 Oct 2024 09:00:00 GMT
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:838:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 89442
x-xss-protection: 0
server: Google Tag Manager

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 253 KB
89 KB 57ms
57ms Script
application/javascript 142.250.185.104
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-830907969&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=DC-6260004

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.104 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s49-in-f8.1e100.net

Software

Google Tag Manager /

Resource Hash

e5ca9c55d19c98b4ebb9c22c4127db31e3c651fc92f21feea371d56d41940d73

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://citloginnow.gezuxuru.workers.dev/

Response headers

content-encoding: br
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:838:0"}],}
expires: Thu, 03 Oct 2024 11:18:35 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 03 Oct 2024 11:18:35 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
last-modified: Thu, 03 Oct 2024 09:00:00 GMT
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:838:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 91387
x-xss-protection: 0
server: Google Tag Manager

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 235 KB
84 KB 31ms
31ms Script
application/javascript 142.250.185.104
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-695231162&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=DC-6260004

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.104 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s49-in-f8.1e100.net

Software

Google Tag Manager /

Resource Hash

6408688549334e5c0ddbf1342656ac7fef0336351f252096e9167f5b8d79130a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://citloginnow.gezuxuru.workers.dev/

Response headers

content-encoding: br
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:838:0"}],}
expires: Thu, 03 Oct 2024 11:18:35 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 03 Oct 2024 11:18:35 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
last-modified: Thu, 03 Oct 2024 09:00:00 GMT
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:838:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 86450
x-xss-protection: 0
server: Google Tag Manager

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 243 KB
86 KB 51ms
51ms Script
application/javascript 142.250.185.104
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-819500023&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=DC-6260004

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.104 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s49-in-f8.1e100.net

Software

Google Tag Manager /

Resource Hash

c94d44f098e2ee3555c17f7a12445c3ef4781d471e87ee3542791e17ad2ddbc4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://citloginnow.gezuxuru.workers.dev/

Response headers

content-encoding: br
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:838:0"}],}
expires: Thu, 03 Oct 2024 11:18:35 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 03 Oct 2024 11:18:35 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
last-modified: Thu, 03 Oct 2024 09:00:00 GMT
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:838:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 88462
x-xss-protection: 0
server: Google Tag Manager

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 281 KB
95 KB 64ms
64ms Script
application/javascript 142.250.185.104
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-959299794&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=DC-6260004

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.104 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s49-in-f8.1e100.net

Software

Google Tag Manager /

Resource Hash

08bd9a160ea720ed17e06b0f20a16115ec2d08613d59987f0fbb4b4aca1e3648

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://citloginnow.gezuxuru.workers.dev/

Response headers

content-encoding: br
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:838:0"}],}
expires: Thu, 03 Oct 2024 11:18:35 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 03 Oct 2024 11:18:35 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
last-modified: Thu, 03 Oct 2024 09:00:00 GMT
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:838:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 97714
x-xss-protection: 0
server: Google Tag Manager

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 240 KB
86 KB 60ms
60ms Script
application/javascript 142.250.185.104
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-10955006959&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=DC-6260004

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.104 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s49-in-f8.1e100.net

Software

Google Tag Manager /

Resource Hash

b17c96a9da611aeba53130ab2cba6fcfa36ac21472e221dbb0ec300778913094

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://citloginnow.gezuxuru.workers.dev/

Response headers

content-encoding: br
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:838:0"}],}
expires: Thu, 03 Oct 2024 11:18:35 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 03 Oct 2024 11:18:35 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
last-modified: Thu, 03 Oct 2024 09:00:00 GMT
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:838:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 87980
x-xss-protection: 0
server: Google Tag Manager

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 275 KB
94 KB 62ms
62ms Script
application/javascript 142.250.185.104
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-11172302925&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=DC-6260004

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.104 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s49-in-f8.1e100.net

Software

Google Tag Manager /

Resource Hash

dd915acf721b1ad667177ac8059973f4acef2a09f04f65e1c96d51ad5ea85a5c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://citloginnow.gezuxuru.workers.dev/

Response headers

content-encoding: br
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:838:0"}],}
expires: Thu, 03 Oct 2024 11:18:35 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Thu, 03 Oct 2024 11:18:35 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
last-modified: Thu, 03 Oct 2024 09:00:00 GMT
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:838:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 96276
x-xss-protection: 0
server: Google Tag Manager

GET
H2 200 12.8fb54ff2c385347a3180.chunk.js Show response
siteintercept.qualtrics.com/dxjsmodule/ 75 KB
21 KB 31ms
25ms Script
application/javascript 104.17.209.240
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://siteintercept.qualtrics.com/dxjsmodule/12.8fb54ff2c385347a3180.chunk.js?Q_CLIENTVERSION=2.15.1&Q_CLIENTTYPE=web&Q_BRANDID=citloginnow.gezuxuru.workers.dev

Requested by

Host: zn3vi8kkuds0jjrfc-citifeedback.siteintercept.qualtrics.com
URL: https://zn3vi8kkuds0jjrfc-citifeedback.siteintercept.qualtrics.com/SIE/?Q_ZID=ZN_3VI8kkudS0JJRFc

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.17.209.240 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

57103bc25d647144e5613e9e68d5a9132929ef4502108e4eae900139b5455926

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://citloginnow.gezuxuru.workers.dev/

Response headers

content-encoding: gzip
cf-cache-status: HIT
etag: W/"12c78-192303fde28"
age: 190406
x-content-type-options: nosniff
date: Thu, 03 Oct 2024 11:18:35 GMT
edge-control: max-age=604800
content-type: application/javascript
last-modified: Thu, 26 Sep 2024 21:32:25 GMT
vary: Accept-Encoding
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: public, max-age=604800, s-maxage=604800
timing-allow-origin: *
referrer-policy: strict-origin-when-cross-origin
content-security-policy-report-only: frame-ancestors 'self' *.qualtrics.com *.my.salesforce.com *.visualforce.com *.visual.force.com *.lightning.force.com; report-uri https://sjc1.qualtrics.com/csp-report
cf-ray: 8ccc8845ecd40410-FRA
permissions-policy: camera=(), geolocation=(), microphone=()
access-control-allow-origin: *
server: cloudflare

POST
H2 200 Targeting.php Show response
siteintercept.qualtrics.com/WRSiteInterceptEngine/ 9 KB
2 KB 40ms
38ms XHR
application/json 104.17.209.240
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://siteintercept.qualtrics.com/WRSiteInterceptEngine/Targeting.php?Q_ZoneID=ZN_3VI8kkudS0JJRFc&Q_CLIENTVERSION=2.15.1&Q_CLIENTTYPE=web

Requested by

Host: siteintercept.qualtrics.com
URL: https://siteintercept.qualtrics.com/dxjsmodule/12.8fb54ff2c385347a3180.chunk.js?Q_CLIENTVERSION=2.15.1&Q_CLIENTTYPE=web&Q_BRANDID=citloginnow.gezuxuru.workers.dev

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.17.209.240 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

4ee979c85220204afa940ac1ae828a7cac7c18fc66a7e6a22521380ed020055c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Content-type: application/x-www-form-urlencoded
Referer: https://citloginnow.gezuxuru.workers.dev/

Response headers

content-encoding: gzip
cf-cache-status: DYNAMIC
x-content-type-options: nosniff
date: Thu, 03 Oct 2024 11:18:35 GMT
content-type: application/json
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: no-store, no-cache, must-revalidate, max-age=0
timing-allow-origin: *
trace-id: 4ebcb688409b0bd4
access-control-allow-credentials: true
referrer-policy: strict-origin-when-cross-origin
content-security-policy-report-only: frame-ancestors 'self' *.qualtrics.com *.my.salesforce.com *.visualforce.com *.visual.force.com *.lightning.force.com; report-uri https://sjc1.qualtrics.com/csp-report
cf-ray: 8ccc88462d1e0410-FRA
permissions-policy: camera=(), geolocation=(), microphone=()
access-control-allow-origin: https://citloginnow.gezuxuru.workers.dev
server: cloudflare

GET
H2 200 CoreModule.js Show response
siteintercept.qualtrics.com/dxjsmodule/ 102 KB
30 KB 21ms
20ms Script
application/javascript 104.17.209.240
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://siteintercept.qualtrics.com/dxjsmodule/CoreModule.js?Q_CLIENTVERSION=2.15.1&Q_CLIENTTYPE=web&Q_BRANDID=citifeedback

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.17.209.240 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

2ddf233b2287a31b45a210e5457693812cddb388f6e194c0c69defe6bfeea64a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://citloginnow.gezuxuru.workers.dev/

Response headers

content-encoding: gzip
cf-cache-status: HIT
etag: W/"197d6-192303fde28"
age: 193251
x-content-type-options: nosniff
date: Thu, 03 Oct 2024 11:18:35 GMT
edge-control: max-age=604800
content-type: application/javascript
last-modified: Thu, 26 Sep 2024 21:32:25 GMT
vary: Accept-Encoding
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: public, max-age=604800, s-maxage=604800
timing-allow-origin: *
referrer-policy: strict-origin-when-cross-origin
content-security-policy-report-only: frame-ancestors 'self' *.qualtrics.com *.my.salesforce.com *.visualforce.com *.visual.force.com *.lightning.force.com; report-uri https://sjc1.qualtrics.com/csp-report
cf-ray: 8ccc88467d750410-FRA
permissions-policy: camera=(), geolocation=(), microphone=()
access-control-allow-origin: *
server: cloudflare

GET
H2 200 7.73c42dd91dd4024bdc8b.chunk.js Show response
siteintercept.qualtrics.com/dxjsmodule/ 3 KB
1 KB 31ms
31ms Script
application/javascript 104.17.209.240
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://siteintercept.qualtrics.com/dxjsmodule/7.73c42dd91dd4024bdc8b.chunk.js?Q_CLIENTVERSION=2.15.1&Q_CLIENTTYPE=web&Q_BRANDID=citifeedback

Requested by

Host: zn3vi8kkuds0jjrfc-citifeedback.siteintercept.qualtrics.com
URL: https://zn3vi8kkuds0jjrfc-citifeedback.siteintercept.qualtrics.com/SIE/?Q_ZID=ZN_3VI8kkudS0JJRFc

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.17.209.240 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

cd99af0cb9d4c434a60d555702421c7651bd8de2a2eccea1175df7078056572d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://citloginnow.gezuxuru.workers.dev/

Response headers

content-encoding: gzip
cf-cache-status: HIT
etag: W/"b55-192303fde28"
age: 553370
x-content-type-options: nosniff
date: Thu, 03 Oct 2024 11:18:35 GMT
edge-control: max-age=604800
content-type: application/javascript
last-modified: Thu, 26 Sep 2024 21:32:25 GMT
vary: Accept-Encoding
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: public, max-age=604800, s-maxage=604800
timing-allow-origin: *
referrer-policy: strict-origin-when-cross-origin
content-security-policy-report-only: frame-ancestors 'self' *.qualtrics.com *.my.salesforce.com *.visualforce.com *.visual.force.com *.lightning.force.com; report-uri https://sjc1.qualtrics.com/csp-report
cf-ray: 8ccc88476ec10410-FRA
permissions-policy: camera=(), geolocation=(), microphone=()
access-control-allow-origin: *
server: cloudflare

GET
H2 200 1.9be9741a35135c39570b.chunk.js Show response
siteintercept.qualtrics.com/dxjsmodule/ 29 KB
7 KB 22ms
21ms Script
application/javascript 104.17.209.240
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://siteintercept.qualtrics.com/dxjsmodule/1.9be9741a35135c39570b.chunk.js?Q_CLIENTVERSION=2.15.1&Q_CLIENTTYPE=web&Q_BRANDID=citifeedback

Requested by

Host: zn3vi8kkuds0jjrfc-citifeedback.siteintercept.qualtrics.com
URL: https://zn3vi8kkuds0jjrfc-citifeedback.siteintercept.qualtrics.com/SIE/?Q_ZID=ZN_3VI8kkudS0JJRFc

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.17.209.240 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

5d8c684005410ebd09215aae45d44c6ecf19bad869192647a37a9460650806cf

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://citloginnow.gezuxuru.workers.dev/

Response headers

content-encoding: gzip
cf-cache-status: HIT
etag: W/"7421-192303fde28"
age: 553370
x-content-type-options: nosniff
date: Thu, 03 Oct 2024 11:18:35 GMT
edge-control: max-age=604800
content-type: application/javascript
last-modified: Thu, 26 Sep 2024 21:32:25 GMT
vary: Accept-Encoding
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: public, max-age=604800, s-maxage=604800
timing-allow-origin: *
referrer-policy: strict-origin-when-cross-origin
content-security-policy-report-only: frame-ancestors 'self' *.qualtrics.com *.my.salesforce.com *.visualforce.com *.visual.force.com *.lightning.force.com; report-uri https://sjc1.qualtrics.com/csp-report
cf-ray: 8ccc88476ec50410-FRA
permissions-policy: camera=(), geolocation=(), microphone=()
access-control-allow-origin: *
server: cloudflare

GET
H2 200 FeedbackButtonModule.js Show response
siteintercept.qualtrics.com/dxjsmodule/ 96 KB
29 KB 23ms
23ms Script
application/javascript 104.17.209.240
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://siteintercept.qualtrics.com/dxjsmodule/FeedbackButtonModule.js?Q_CLIENTVERSION=2.15.1&Q_CLIENTTYPE=web&Q_BRANDID=citifeedback

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.17.209.240 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

915709687d064f47b0327189996de17b8367544397a87c4f4a29bae29341fa03

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://citloginnow.gezuxuru.workers.dev/

Response headers

content-encoding: gzip
cf-cache-status: HIT
etag: W/"180b6-192303fde28"
age: 553266
x-content-type-options: nosniff
date: Thu, 03 Oct 2024 11:18:35 GMT
edge-control: max-age=604800
content-type: application/javascript
last-modified: Thu, 26 Sep 2024 21:32:25 GMT
vary: Accept-Encoding
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: public, max-age=604800, s-maxage=604800
timing-allow-origin: *
referrer-policy: strict-origin-when-cross-origin
content-security-policy-report-only: frame-ancestors 'self' *.qualtrics.com *.my.salesforce.com *.visualforce.com *.visual.force.com *.lightning.force.com; report-uri https://sjc1.qualtrics.com/csp-report
cf-ray: 8ccc88476eca0410-FRA
permissions-policy: camera=(), geolocation=(), microphone=()
access-control-allow-origin: *
server: cloudflare

GET
H2 200 Asset.php Show response
siteintercept.qualtrics.com/WRSiteInterceptEngine/ 10 KB
1 KB 696ms
676ms XHR
application/json 104.17.208.240
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://siteintercept.qualtrics.com/WRSiteInterceptEngine/Asset.php?Module=SI_0AioryRkl8bxHM2&Version=28&Q_ORIGIN=https://citloginnow.gezuxuru.workers.dev&Q_CLIENTVERSION=2.15.1&Q_CLIENTTYPE=web&Q_BrandTier=Pn2UP9lWlr&Q_ARCACHEVERSION=21&Q_BRANDDC=iad1

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.17.208.240 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

c36fb550b47afef13cdc8fa2a984f29fb59145ca02cd362d8d98ea6f2d76ad74

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://citloginnow.gezuxuru.workers.dev/

Response headers

x-request-id: c7ce162f-39a2-41c1-a1b2-15641180e157
x-transaction-id: d52fff4a-0322-40e3-bd7b-a0b8a9341c6a
content-encoding: gzip
cf-cache-status: MISS
etag: W/"282d-gTiBWFb0c5KGWkW3d6wD6iOW4X0"
x-content-type-options: nosniff
date: Thu, 03 Oct 2024 11:18:36 GMT
edge-control: max-age=604800
content-type: application/json; charset=utf-8
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: public, max-age=604800, s-maxage=604800
referrer-policy: strict-origin-when-cross-origin
content-security-policy-report-only: frame-ancestors 'self' *.qualtrics.com *.my.salesforce.com *.visualforce.com *.visual.force.com *.lightning.force.com; report-uri https://sjc1.qualtrics.com/csp-report
cf-ray: 8ccc884788754d56-FRA
permissions-policy: camera=(), geolocation=(), microphone=()
access-control-allow-origin: *
server: cloudflare

GET
H2 200 Asset.php Show response
siteintercept.qualtrics.com/WRSiteInterceptEngine/ 2 KB
1 KB 145ms
125ms XHR
application/json 104.17.208.240
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://siteintercept.qualtrics.com/WRSiteInterceptEngine/Asset.php?Module=CR_6F54YSt4iL0fWT4&Version=1&Q_InterceptID=SI_0AioryRkl8bxHM2&Q_ORIGIN=https://citloginnow.gezuxuru.workers.dev&Q_CLIENTVERSION=2.15.1&Q_CLIENTTYPE=web&Q_BrandTier=Pn2UP9lWlr&Q_ARCACHEVERSION=21&Q_BRANDDC=iad1

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.17.208.240 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

fc368d7fa49f320a38741dc571da27b9ccd3afff19423a05b6b92b47fb453d8f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://citloginnow.gezuxuru.workers.dev/

Response headers

x-request-id: 1cf5ccab-8984-4e24-a2f7-a72944cde584
x-transaction-id: 9c3dc90f-80bd-4b28-a8d8-8a0284b0aa43
content-encoding: gzip
cf-cache-status: MISS
etag: W/"777-fEDrx1+g8aMwvQG9BJPt9H1KTqg"
x-content-type-options: nosniff
date: Thu, 03 Oct 2024 11:18:35 GMT
edge-control: max-age=604800
content-type: application/json; charset=utf-8
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: public, max-age=604800, s-maxage=604800
referrer-policy: strict-origin-when-cross-origin
content-security-policy-report-only: frame-ancestors 'self' *.qualtrics.com *.my.salesforce.com *.visualforce.com *.visual.force.com *.lightning.force.com; report-uri https://sjc1.qualtrics.com/csp-report
cf-ray: 8ccc884788774d56-FRA
permissions-policy: camera=(), geolocation=(), microphone=()
access-control-allow-origin: *
server: cloudflare

GET
H2 200 favicon.ico
dl.dropboxusercontent.com/s/faq078xaxkrnxze/ 9 KB
8 KB 541ms
541ms Other
image/x-icon 2620:100:6027:15::a27d:480f
DROPBOX

General

Check archive.org

Show headers Download Go to

Full URL

https://dl.dropboxusercontent.com/s/faq078xaxkrnxze/favicon.ico

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2620:100:6027:15::a27d:480f , United States, ASN19679 (DROPBOX, US),

Reverse DNS

Software

envoy /

Resource Hash

2f6d73a312361b30f573d8f97bf9b345f2316c3d8b40723592b3145e360f8c32

Security Headers

Name	Value
Content-Security-Policy	report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-usercontent ; sandbox allow-forms allow-scripts allow-top-navigation allow-popups, form-action 'none' ; report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-noscript ; script-src 'none'
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Referer: https://citloginnow.gezuxuru.workers.dev/

Response headers

x-robots-tag: noindex, nofollow, noimageindex
content-encoding: gzip
x-content-type-options: nosniff
date: Thu, 03 Oct 2024 11:18:35 GMT
x-server-response-time: 401
content-type: image/x-icon
content-disposition: inline; filename="favicon.ico"; filename*=UTF-8''favicon.ico
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-security-policy: report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-usercontent ; sandbox allow-forms allow-scripts allow-top-navigation allow-popups, form-action 'none' ; report-uri https://www.dropbox.com/csp_log?policy_name=blockserver-noscript ; script-src 'none'
cache-control: max-age=60
x-dropbox-response-origin: far_remote
pragma: public
accept-ranges: bytes
x-dropbox-request-id: bbc1707829784fb4b466e6d85fa207c8
server: envoy

POST
H2 200 / Show response
siteintercept.qualtrics.com/WRSiteInterceptEngine/ 45 B
243 B 37ms
35ms XHR
text/plain 104.17.208.240
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://siteintercept.qualtrics.com/WRSiteInterceptEngine/?Q_Impress=1&Q_CID=CR_6F54YSt4iL0fWT4&Q_SIID=SI_0AioryRkl8bxHM2&Q_ASID=AS_07210024&Q_CLIENTVERSION=2.15.1&Q_CLIENTTYPE=web&r=1727954316123

Requested by

Host: siteintercept.qualtrics.com
URL: https://siteintercept.qualtrics.com/dxjsmodule/CoreModule.js?Q_CLIENTVERSION=2.15.1&Q_CLIENTTYPE=web&Q_BRANDID=citifeedback

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.17.208.240 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f47f21063dfdcbdeffed3d97689b45efae7a52401cd7fc5b8d07c42d2f232ab9

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Content-type: application/x-www-form-urlencoded
Referer: https://citloginnow.gezuxuru.workers.dev/

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: no-store, no-cache, must-revalidate, max-age=0
content-encoding: br
cf-cache-status: DYNAMIC
trace-id: a5f051d661b2657e
access-control-allow-credentials: true
x-content-type-options: nosniff
referrer-policy: strict-origin-when-cross-origin
cf-ray: 8ccc884bcc9a4d56-FRA
permissions-policy: camera=(), geolocation=(), microphone=()
access-control-allow-origin: https://citloginnow.gezuxuru.workers.dev
date: Thu, 03 Oct 2024 11:18:36 GMT
content-type: text/plain; charset=UTF-8
server: cloudflare
content-security-policy-report-only: frame-ancestors 'self' *.qualtrics.com *.my.salesforce.com *.visualforce.com *.visual.force.com *.lightning.force.com; report-uri https://sjc1.qualtrics.com/csp-report

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: s.amazon-adsystem.com
URL: https://s.amazon-adsystem.com/iu3?pid=c3702eea-109e-48b0-9ef4-c856bdd405e2&event=PageView&dcc=t

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Citibank (Banking) Generic Cloudflare (Online)

36 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

10 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.citloginnow.gezuxuru.workers.dev/	1970-01-21 00:00:40	Name: __cf_mw_byp Value: zrHdWrKC1dHfpzyjRgi81d7KFJwxBhCrGdNfCWfdsgA-1727954307-0.0.1.1-/
.dropboxusercontent.com/	1969-12-31 23:59:59	Name: uc_session Value: xt4j2WNMuZVOBK78cckKoSDZkdvhCLw2OOs8LSL1ZuNAuEDkVUNotSAn4KnX7KFe
citloginnow.gezuxuru.workers.dev/	1970-01-20 23:59:16	Name: 7018 Value:
citloginnow.gezuxuru.workers.dev/	1970-01-20 23:59:16	Name: 7830 Value: error
citloginnow.gezuxuru.workers.dev/	1970-01-21 02:08:50	Name: 64072 Value:
.gezuxuru.workers.dev/	1970-01-21 02:08:50	Name: _gcl_au Value: 1.1.1528015562.1727954314
.rfihub.com/	1970-01-21 09:20:50	Name: rud Value: H4sIAAAAAAAA_-MSNjU0NjQwNzc3MjExszA0MDS1NBLiM9T1rUwuCPY0z_B2CTAEAIHw_swlAAAA
.rfihub.com/	1969-12-31 23:59:59	Name: ruds Value: H4sIAAAAAAAA_-MSNjU0NjQwNzc3MjExszA0MDS1NBLiM9T1rUwuCPY0z_B2CTAEAIHw_swlAAAA
.amazon-adsystem.com/	1970-01-21 06:29:28	Name: ad-id Value: A6OELRsm-kYvpfEo2qop6yU
.amazon-adsystem.com/	1970-01-21 09:35:14	Name: ad-privacy Value: 0

6 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
javascript	warning	Message: A parser-blocking, cross site (i.e. different eTLD+1) script, https://dl.dropboxusercontent.com/s/z095l2wk45dt9ci/Bootstrap.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript	warning	Message: A parser-blocking, cross site (i.e. different eTLD+1) script, https://dl.dropboxusercontent.com/s/z095l2wk45dt9ci/Bootstrap.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript	warning	Message: A parser-blocking, cross site (i.e. different eTLD+1) script, https://ajax.googleapis.com/ajax/libs/jquery/3.6.0/jquery.min.js, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
javascript	warning	Message: A parser-blocking, cross site (i.e. different eTLD+1) script, https://api.ipify.org/?format=jsonp&callback=getIP, is invoked via document.write. The network request for this script MAY be blocked by the browser in this or a future page load due to poor network connectivity. If blocked in this page load, it will be confirmed in a subsequent console message. See https://www.chromestatus.com/feature/5718547946799104 for more details.
recommendation	verbose	URL: https://citloginnow.gezuxuru.workers.dev/ Message: [DOM] Password field is not contained in a form: (More info: https://goo.gl/9p2vKq) %o
recommendation	verbose	URL: https://citloginnow.gezuxuru.workers.dev/ Message: [DOM] Password field is not contained in a form: (More info: https://goo.gl/9p2vKq) %o

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
X-Frame-Options	SAMEORIGIN

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

20766699p.rfihub.com
ajax.googleapis.com
api.ipify.org
c1.rfihub.net
citloginnow.gezuxuru.workers.dev
dl.dropboxusercontent.com
i.ibb.co
nexus.ensighten.com
s.amazon-adsystem.com
siteintercept.qualtrics.com
sr.rlcdn.com
www.citi.com
www.googletagmanager.com
zn3vi8kkuds0jjrfc-citifeedback.siteintercept.qualtrics.com
s.amazon-adsystem.com
104.17.208.240
104.17.209.240
142.250.185.104
162.19.58.158
172.67.74.152
193.0.160.130
23.212.222.130
2600:9000:206f:a400:2:8f43:5780:93a1
2600:9000:214f:2a00:1:76cf:fe80:93a1
2606:4700:3036::ac43:89ae
2620:100:6027:15::a27d:480f
2a00:1450:4001:829::200a
2a00:1450:4001:831::2008
35.244.154.8
045cd226594cb32ddf9d4db8ee45611f4d0788675ae50180b68da975e66fe1fe
08bd9a160ea720ed17e06b0f20a16115ec2d08613d59987f0fbb4b4aca1e3648
11a2142988720cd49ff000e5d488493947b3d34821301c5a706b3495b8381f7d
13a59cfac1785dd94d0005457ed1e12cf77fee65b975fe6fd91af77b7ac6cd77
1893007ca7cb8dc906acac1b9aeeaed5695d720b4cbe63fa78bbcc34a8d3c3cf
23fd7413d9560b284595e46923c24bda9aab9bcbe7024c18247349cf1e344c6a
272891e9ad4f5ae8b5f8ece5957d283a182e1422d6a1798c694fb5a09d2c1514
2733dde1e9f9058830b81a82d6b668677c2e86b32e499238c37609b47c9fd84f
2c20bac8dbb20b474b8fbddf6704521717a15981d2a2e75154d2441dd9c1141e
2ddf233b2287a31b45a210e5457693812cddb388f6e194c0c69defe6bfeea64a
2f6d73a312361b30f573d8f97bf9b345f2316c3d8b40723592b3145e360f8c32
3556b4fa28a41290454dc84939dae439fcf5bda8a1eac70efdf2647bf041d43d
3fca3de24621f0f10186594054444d608016297c2e853e548710b3521e42a609
48e89b7e40e096b89d864a5c8ee340ce44ca60fe9675310ef2f3f40a53a7d593
4ee979c85220204afa940ac1ae828a7cac7c18fc66a7e6a22521380ed020055c
5394d11ec8ad7a5494bcdb65cd95f885388532e14fb45a747e249112389bd837
57103bc25d647144e5613e9e68d5a9132929ef4502108e4eae900139b5455926
5d8c684005410ebd09215aae45d44c6ecf19bad869192647a37a9460650806cf
6336ae7b60dff18e0a37721a3a19fd5e18568577a64faa662969d35966dbf72b
6408688549334e5c0ddbf1342656ac7fef0336351f252096e9167f5b8d79130a
695788dc05d94be3b32060ffea15c1a4d74897bd32e5da7811e7ca76d82fc86b
6dfa343a68ef79e83fef5f7c705119d2473352190c609cf94c67ea99a29fa452
73e87dd972db53261bd2aaeba3377690746d072d168d0cdbca8e5ced37eb23f4
7bb0750b514d3fe360625f942f37ed5ccbc2b8ceb95250f087161243854c10bf
7ef97b12890fc6fee67f869c6e1f74b6719de7d66ac0d649c8d7386a80b4c30f
7f4ffff9b2401c3d1703da759083399794b38ebffa07fc1cf89a6ce51af0543b
84e3c77025ace5af143972b4a40fc834dcdfd4e449d4b36a57e62326f16b3091
915709687d064f47b0327189996de17b8367544397a87c4f4a29bae29341fa03
9a74546a8f511f31b5252f115d2db7aa69370ca5eeaf6828f60abb197f35a169
a593628f2d5ba814f37fbcd3963162f094c2764d4b15d82464c2d1aef92f150f
b17c96a9da611aeba53130ab2cba6fcfa36ac21472e221dbb0ec300778913094
b7220f917968710434143aac21775e8805f22631b2f6956568fe35c3c46a23f6
b8e446605f92c29a178dd6494688103ac268004592afe06643df46f4bff68577
bd3acb2311f94938e29354d6e37dd710ad4c07703610222551c98da9993366d5
be9b5382b4526ffd3306d0292122ce3599123f1cd543f52f3035b4f24fbf9de8
bf39c7a23da56a09d7fba494ab7a46604dc02a19fabfaf8d4c3ab6629aad0692
c2331efe11a1b5d8ab7a1f5aec3a7dbc053557fd285c64c280a322f62d00c19b
c36fb550b47afef13cdc8fa2a984f29fb59145ca02cd362d8d98ea6f2d76ad74
c47148368f7800b90c968400a73e019a6effdd6e6ffe8c4127c13e0cf2cbf0b8
c73e69a929ce513e05bba4a3359296cf41064aaff3355d900b971ca39175a935
c94d44f098e2ee3555c17f7a12445c3ef4781d471e87ee3542791e17ad2ddbc4
cd99af0cb9d4c434a60d555702421c7651bd8de2a2eccea1175df7078056572d
cebe6c7d3188cd697399bc4eeb2b7a3d94b8d461b50eebcd145aa0ecc620c522
cfcb7b4a0bc7f212c4a6f9055d11153978945409491621d0083b6f9282f36b56
d85294e27c6d8e2ca68fe77d76d663c96c68d971f7d0d221409fd089db5c7df8
dd915acf721b1ad667177ac8059973f4acef2a09f04f65e1c96d51ad5ea85a5c
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e541e0f1457ebdf9633dcefb5787d9f6d6b94b5ec402918686cf9ed8e113cb04
e5ca9c55d19c98b4ebb9c22c4127db31e3c651fc92f21feea371d56d41940d73
e9e9a67395a0d83b584208a19b95af203df8e8e6c6952fe76c690d60ea9381c7
f1591a5221136c49438642155691ae6c68e25b7241f3d7ebe975b09a77662016
f327a0ba3e41b1e8154e1c18fc114baff0bd057151e3afe7fa6f33cc0cb18296
f378974fe6a831ae2f48d9191ea74eb21877d4964d5eedbc2810d8756ed13631
f47f21063dfdcbdeffed3d97689b45efae7a52401cd7fc5b8d07c42d2f232ab9
fc368d7fa49f320a38741dc571da27b9ccd3afff19423a05b6b92b47fb453d8f
fd29b3b084cf11160bfc4e99d98a261f2b36bff29113b07367c5204563c5d355
fe8e66a7628c1386c11752f877c8120b9a0c131c7ffd2a8d9fc7f909fc772613
ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e

citloginnow.gezuxuru.workers.dev Open in urlscan Pro 2606:4700:3036::ac43:89ae Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

63 Requests

98 %HTTPS

43 %IPv6

13 Domains

14 Subdomains

15 IPs

4 Countries

2624 kBTransfer

13522 kBSize

10 Cookies

0 Outgoing links

Page URL History

Redirected requests

63 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

citloginnow.gezuxuru.workers.dev Open in urlscan Pro
2606:4700:3036::ac43:89ae Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

63
Requests

98 %
HTTPS

43 %
IPv6

13
Domains

14
Subdomains

15
IPs

4
Countries

2624 kB
Transfer

13522 kB
Size

10
Cookies

63 HTTP transactions
0 data transactions